spiderfw 0.5

data/apps/soap/lib/soap.rb

@@ -0,0 +1,217 @@
+require 'soap/mapping/registry'
+
+module SOAP; module Mapping
+    
+    class Registry
+        
+        class Map
+            def class2soap(klass)
+                ancestors = klass.ancestors
+                ancestors.delete(::Object)
+                ancestors.delete(::Kernel)
+                ancestors.each do |k|
+                    return @obj2soap[k][0] if @obj2soap[k]
+                end
+                return nil
+            end
+        end
+        
+        def class2soap(klass)
+            @map.class2soap(klass)
+        end
+        
+    end
+    
+end; end
+
+module Spider
+    
+    module Soap
+        
+        XsdNs             = 'http://www.w3.org/2001/XMLSchema'
+        WsdlNs            = 'http://schemas.xmlsoap.org/wsdl/'
+        SoapNs            = 'http://schemas.xmlsoap.org/wsdl/soap/'
+        SoapEncodingNs    = 'http://schemas.xmlsoap.org/soap/encoding/'
+        SoapHttpTransport = 'http://schemas.xmlsoap.org/soap/http'
+        
+        def self.included(klass)
+            klass.extend(ClassMethods)
+        end
+        
+        module ClassMethods
+        
+            def SoapArray(type)
+                Class.new(SoapArray) do
+                    @array_type = type
+                end
+            end
+        
+            def SoapStruct(elements)
+                Class.new(SoapStruct) do
+                    @elements = elements
+                end
+            end
+            
+        end
+        
+        class GenericStructFactory < SOAP::Mapping::Factory
+            def initialize(qname)
+                @qname = qname
+            end
+            
+            def obj2soap(soap_class, obj, info, map)
+                soap_obj = soap_class.new(@qname)
+                info[:elements].each do |key, type|
+                    value = obj[key.to_sym]
+                    soap_obj[key.to_s] = SOAP::Mapping._obj2soap(value, map)
+                end
+                soap_obj
+            end
+
+            def soap2obj(obj_class, node, info, map)
+                return false unless node.type == @qname
+                obj = obj_class.new
+                node.each do |key, value|
+                    obj[key.to_sym] = value.data
+                end
+                return true, obj
+            end
+        end
+        
+        module SoapType
+            def self.included(klass)
+                klass.extend(ClassMethods)
+            end
+            
+            module ClassMethods
+                def qname
+                    @soap_controller.type_to_qname(self)
+                end
+                
+                def soap_controller=(c)
+                    @soap_controller = c
+                end
+                
+                def collect_soap_types
+                    st = [self]
+                    self.types.each do |t|
+                        st += t.collect_soap_types if t < SoapType
+                    end
+                    return st
+                end
+            end
+            
+        end
+        
+        # FIXME:
+        # SOAP marks the return as a generic array, not with our qtype
+        # should probably use a custom factory
+        class SoapArray < Array
+            include SoapType
+            
+            def self.array_type
+                @array_type
+            end
+            
+            def self.types
+                return [@array_type]
+            end
+            
+            def self.soap_class
+                SOAP::SOAPArray
+            end
+            
+            def self.soap_factory
+                SOAP::Mapping::Registry::TypedArrayFactory
+            end
+
+            def self.soap_info
+                {
+                    :type => @soap_controller.type_to_qname(array_type)
+                }
+            end
+
+            def initialize(array)
+                replace(array)
+                if (self.class.array_type < SoapType)
+                    self.each_index do |i|
+                        self[i] = self.class.array_type.new(self[i]) unless self[i].is_a?(self.class.array_type)
+                    end
+                end
+                    
+            end
+        end
+        
+        class SoapStruct < Hash
+            include SoapType
+            
+            def self.elements
+                @elements
+            end
+            
+            def self.types
+                return @elements.values
+            end
+            
+            def self.soap_class
+                SOAP::SOAPStruct
+            end
+            
+            def self.soap_factory
+                Spider::Soap::GenericStructFactory.new(self.qname)
+            end
+            
+            def self.soap_info
+                {:elements => @elements}
+            end
+            
+            attr_reader :content
+            def initialize(content=nil)
+                if (content.is_a?(Hash))
+                    self.replace(content)
+                else
+                    self.class.elements.each do |key, type|
+                        self[key] = content.send(key)
+                    end
+                end
+                self.class.elements.each do |key, type|
+                    if type < SoapType
+                        self[key] = type.new(self[key]) if self[key] && !self[key].is_a?(type)
+                    end
+                end
+            end
+        end
+        
+        class SoapProxy
+            
+            def initialize(target, soap_methods)
+                @target = target
+                @soap_methods = soap_methods
+                shadow = class <<self; self; end
+                soap_methods.each do |name, params|
+                    shadow.class_eval do
+                        define_method(name) do |*args|
+                            wrap_soap_method(name, *args)
+                        end
+                    end
+                end
+            end
+            
+            def wrap_soap_method(name, *args)
+                return super unless @soap_methods[name]
+                res = @target.send(name, *args)
+                return nil unless @soap_methods[name][:return]
+                if (@soap_methods[name][:return][:type] < SoapType && !res.is_a?(@soap_methods[name][:return][:type]))
+                    return @soap_methods[name][:return][:type].new(res)
+                else
+                    return res
+                end
+            end
+            
+        end
+        
+        
+    end
+    
+    
+end

data/apps/sso/_init.rb

@@ -0,0 +1,16 @@
+module Spider
+
+    module SSO
+
+        @description = ""
+        @version = 0.1
+        @path = File.dirname(__FILE__)
+        include Spider::App
+
+    end
+
+
+end
+
+require 'apps/sso/lib/saml2'
+require 'apps/sso/controllers/mixins/saml2_mixin'

data/apps/sso/config/options.rb

@@ -0,0 +1,13 @@
+module Spider
+
+    config_option 'sso.providers', _("A list of SAML2 providers (SP or IDP)"), :type => :conf
+    config_option 'sso.providers.x.name', _("Provider name")
+    config_option 'sso.providers.x.role', _("Provider role (idp or sp)"), :type => Symbol, :choices => [:sp, :idp],
+        :default => :sp
+    config_option 'sso.providers.x.metadata', _("Path to the provider's metadata (defaults to config/sso/metadata/[provider_name].xml)"),
+        :default => lambda{ |name| Spider.paths[:config]+'/sso/metadata/'+name+'.xml'}
+    config_option 'sso.providers.x.cert_chain', _("Path to the provider's CA certificate chain file (should be in config/sso/cert/[provider_name]_chain.pem)")
+    config_option 'sso.providers.x.pub_key', _("Path to the provider's public key (defaults to config/sso/cert/[provider_name].pem)"),
+        :default => lambda{ |name| Spider.paths[:config]+'/sso/cert/'+name+'.pem'}
+
+end

data/apps/sso/controllers/mixins/saml2_mixin.rb

@@ -0,0 +1,149 @@
+require 'apps/sso/lib/saml2/backend'
+require 'base64'
+require 'uri'
+require 'zlib'
+
+module Spider
+
+    module SAML2Mixin
+        include Spider::ControllerMixins::HTTPMixin
+        
+        def self.included(klass)
+            klass.extend(ClassMethods)
+            super
+        end
+        
+        module ClassMethods
+            
+            def template_paths
+                [Spider::SSO.path+'/views'] + super
+            end
+        
+            def sso_role(*args)
+                @sso_roles = {}
+                if args.length > 0 
+                    args.each { |arg| @sso_roles[arg] = true }
+                end
+                @sso_roles
+            end
+        
+            def sso_services(*args)
+                @sso_services = args if args.length > 0
+                @sso_services
+            end
+        
+            def saml2_bindings(*args)
+                @saml2_bindings = args if args.length > 0
+                @saml2_bindings
+            end
+        
+            def sso_org(val=nil)
+                @sso_org = val if val
+                @sso_org || 'default'
+            end
+            
+            def sso_id(val=nil)
+                @sso_id = val if val
+                return @sso_id if @sso_id
+                org = Spider.conf.get("orgs.#{sso_org}")
+                return org['common_name']
+            end
+            
+        end
+        
+        def get_metadata(type = :idp)
+            @response.headers['Content-Type'] = 'text/xml'
+            sso_org = self.class.sso_org
+            org = Spider.conf.get("orgs.#{sso_org}")
+            raise "Undefined organization #{sso_org}" unless org
+            pub_key = org[:pub_key]
+            bindings = {}
+            self.class.saml2_bindings.each do |b|
+                bindings[b] = {}
+                self.class.sso_services.each do |s|
+                    bindings[b][s] = {
+                        :location => request_url + '/'+s.to_s
+                    }
+                    if b == :http_redirect
+                        bindings[b][s][:response_location] = request_url+'/'+s.to_s+'_return'
+                    end
+                end
+            end
+            params = {
+                :organization => org[:name],
+                :key => IO.read(org[:pub_key]),
+                :cert => IO.read(org[:cert]),
+                :entity_id => self.class.sso_id,
+                :bindings => bindings
+            }
+            return SAML2.metadata(type, params)
+        end
+        
+        def metadata(type = :idp)
+            $out << get_metadata(type)
+        end
+        
+        # This method must be implemented by the controller, and has to return the user's attributes
+        # to send to the service provider, or raise an Unauthorized exception
+        def get_user_attributes
+        end
+                
+        def sso
+            saml_request = @request.params['SAMLRequest'] || @request.session[:saml_request]
+            @request.session[:saml_request] = saml_request
+            raise HTTPStatus.BAD_REQUEST, "SAML Request not found" unless saml_request
+            relay_state = @request.params['RelayState'] || @request.session[:saml_relay_state] || ''
+            @request.session[:saml_relay_state] = relay_state
+            begin
+                user = get_user_attributes
+            rescue Spider::Auth::Unauthorized
+                redir_url = 'login?redirect='+URI.escape(@request.uri)
+                redirect(redir_url, Spider::HTTP::FOUND)
+            end
+            org = Spider.conf.get("orgs.#{self.class.sso_org}")
+            @server = SAML2::Backend.init(get_metadata, IO.read(org[:private_key]), IO.read(org[:cert]))
+            # decoded_request = Zlib::Inflate.new(-Zlib::MAX_WBITS).inflate Base64.decode64 URI.decode saml_request
+            #             Spider::Logger.debug("SAML_REQUEST: \n#{decoded_request}")
+            #             request = @server.parse_authn_request(decoded_request)
+            #             response = @server.authn_response([], @request.session.sid)
+            #             @scene.sp_url = request[:assertion_consumer_url]
+            #             @scene.saml_response = response[:body]
+            #             @scene.relay_state = relay_state
+            #             @response.headers['Content-Type'] = 'text/html'
+            #             render('saml2_post')
+            request = @server.parse_authn_request(@request.env['QUERY_STRING'])
+            response = @server.authn_response([], @request.session.sid)
+            @request.session.delete(:saml_request)
+            @request.session.delete(:saml_relay_state)
+            @scene.sp_url = response[:url]
+            @scene.saml_response = response[:body]
+            @scene.relay_state = relay_state
+            send_saml_response(response)
+            
+        end
+        
+        def single_logout
+            saml_request = @request.params['SAMLRequest']
+            raise HTTPStatus.BAD_REQUEST, "SAML Request not found" unless saml_request
+            org = Spider.conf.get("orgs.#{self.class.sso_org}")
+            @server = SAML2::Backend.init(get_metadata, IO.read(org[:private_key]), IO.read(org[:cert]))
+            request = @server.parse_logout_request(@request.env['QUERY_STRING'])
+            @request.session.class.delete(request[:session_index])
+            response = @server.logout_response
+            send_saml_response(response)
+        end
+        
+        def send_saml_response(response)
+            if (response[:body])
+                # Always respond through POST, is this correct ?
+                @response.headers['Content-Type'] = 'text/html'
+                render('saml2_post')
+            else
+                redirect(response[:url], Spider::HTTP::FOUND)
+            end
+        end
+        
+    end
+    
+    
+end

data/apps/sso/lib/saml2/backend.rb

@@ -0,0 +1,16 @@
+module Spider; module SAML2
+    
+    # Abstract class implementing the SAML2 methods
+    
+    class Backend
+        
+        def self.init(metadata, private_key, certificate)
+            return LassoBackend.new(metadata, private_key, certificate)
+        end
+        
+    end
+    
+    
+end; end
+
+require 'apps/sso/lib/saml2/lasso_backend'

data/apps/sso/lib/saml2/lasso_backend.rb

@@ -0,0 +1,88 @@
+require 'lasso'
+
+module Spider; module SAML2
+
+    class LassoBackend < Backend
+
+        def initialize(metadata, private_key, certificate)
+            @server = Lasso::Server.new_from_buffers(metadata, private_key, nil, certificate)
+            providers = Spider.conf.get('sso.providers')
+            providers.each do |label, conf|
+                role = conf['role'] == :idp ? Lasso::PROVIDER_ROLE_IDP : Lasso::PROVIDER_ROLE_SP
+                @server.add_provider(role, conf['metadata'], conf['pub_key'], conf['cert'])
+            end
+        end
+        
+        def parse_authn_request(msg)
+            @login = Lasso::Login.new(@server)
+            @login.process_authn_request_msg(msg)
+            @login.validate_request_msg(true, true)
+            return {
+                :assertion_consumer_url => @login.request.assertionConsumerServiceURL
+            }
+        end
+        
+
+        def authn_response(user_attributes=[], session_index=nil, reauthenticate_at=nil, not_before=nil, not_after=nil)
+            dt_format = "%Y-%m-%dT%H:%M:%S%Z"
+            reauthenticate_at = reauthenticate_at.strftime(dt_format) if reauthenticate_at.is_a?(Date) || reauthenticate_at.is_a?(Time)
+            not_before = not_before.strftime(dt_format) if not_before.is_a?(Date) || not_before.is_a?(Time)
+            not_after = not_after.strftime(dt_format) if not_after.is_a?(Date) || not_after.is_a?(Time)
+            now = DateTime.now.strftime(dt_format)
+            @login.build_assertion(Lasso::SAML_AUTHENTICATION_METHOD_PASSWORD, now, reauthenticate_at, not_before, not_after)    
+            if (user_attributes.empty?)
+                # Dummy attribute
+                user_attributes.push({:name => 'dummy', :value => 'dummy'})
+            end
+            attribute_statement = Lasso::Saml2AttributeStatement.new
+            attributes = Lasso::NodeList.new
+            user_attributes.each do |a|
+                attribute = Lasso::Saml2Attribute.new
+                attribute.name = a[:name]
+                a[:name_format] ||= :unspecifed
+                attribute.nameFormat = Spider::SAML2::AttributeFormats[a[:name_format]]
+                values = a[:values] || [a[:value]]
+                attribute_values = Lasso::NodeList.new
+                values.each do |v|
+                    val = Lasso::Saml2AttributeValue.new
+                    text_node = Lasso::MiscTextNode.new
+                    text_node.content = v
+                    list = Lasso::NodeList.new
+                    list.append(text_node)
+                    val.any = list
+                    attribute_values.append(val)
+                end
+                attribute.attributeValue = attribute_values
+                attributes.append(attribute)
+            end
+            attribute_statement.attribute = attributes
+            attr_stats = Lasso::NodeList.new
+            attr_stats.append(attribute_statement)
+            @login.response.assertion.get_item(0).attributeStatement = attr_stats
+            @login.response.assertion.get_item(0).authnStatement.get_item(0).sessionIndex = session_index if session_index
+            @login.build_authn_response_msg
+            return {:body => @login.msgBody, :url => @login.msgUrl}
+        end
+        
+        def parse_logout_request(msg)
+            @logout = Lasso::Logout.new(@server)
+            begin
+                @logout.process_request_msg(msg)
+                #@logout.validate_request()
+            rescue => exc
+                raise unless exc.message =~ /Lasso Warning/
+            end
+            return {
+                :session_index => @logout.request.sessionIndex,
+                :remote_provider_id => @logout.remoteProviderId
+            }
+        end
+        
+        def logout_response
+            @logout.build_response_msg
+            return {:body => @logout.msgBody, :url => @logout.msgUrl}
+        end
+
+    end
+
+end; end

data/apps/sso/lib/saml2.rb

@@ -0,0 +1,112 @@
+require 'builder'
+
+module Spider
+
+    module SAML2
+        MetadataNs = 'urn:oasis:names:tc:SAML:2.0:metadata'
+        AssertionNs = 'urn:oasis:names:tc:SAML:2.0:assertion'
+        ProtocolNs = 'urn:oasis:names:tc:SAML:2.0:protocol'
+        XMLDsNs = 'http://www.w3.org/2000/09/xmldsig#'
+        AttributeFormats = {
+            :unspecified => 'urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified',
+            :uri => 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+            :basic => 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic'
+        }
+        
+        def self.services
+            {
+                :artifact_resolution => 'ArtifactResolution',
+                :single_logout => 'SingleLogout',
+                :manage_name_id => 'ManageNameID',
+                :sso => 'SingleSignOn'
+            }
+        end
+        
+        def self.bindings
+            {
+                :soap => 'urn:oasis:names:tc:SAML:2.0:bindings:SOAP',
+                :http_redirect => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'
+            }
+        end
+
+        def self.idp_metadata(params)
+            return metadata(:idp, params)
+        end
+        
+        def self.sp_metadata(params)
+            return metadata(:sp, params)
+        end
+
+        def self.metadata(type, params)
+            defaults = {
+            }
+            if type == :idp
+                defaults.merge!({
+                    :authn_request_signed => 'true'
+                })
+            elsif type == :sp
+                defaults.merge!({
+                    :want_authn_request_signed => 'true'
+                })
+            end
+            params.reject!{ |k, v| !v }
+            params.merge!(defaults)
+            xml = ''
+            xm = Builder::XmlMarkup.new(:target => xml, :indent => 2)
+            xm.instruct!
+            xm.EntityDescriptor(
+                'xmlns' => MetadataNs,
+                'xmlns:saml' => AssertionNs,
+                'xmlns:ds' => XMLDsNs,
+                'entityID' => params[:entity_id]
+            ) do
+                descriptor_name = type == :sp ? :SPSSODescriptor : :IDPSSODescriptor
+                xm.method_missing(descriptor_name,
+                    'WantAuthnRequestsSigned' => params[:want_authn_request_signed],
+                    'AuthnRequestSigned' => params[:authn_request_signed],
+                    'protocolSupportEnumeration' => ProtocolNs
+                ) do
+                    xm.KeyDescriptor('use' => 'signing') do
+                        xm.ds(:KeyInfo, 'xmlns:ds' => XMLDsNs) do
+                            xm.ds(:X509Data) do
+                                xm.ds(:X509Certificate, params[:cert])
+                            end
+                        end
+                    end
+                    xm.KeyDescriptor('use' => 'encryption') do
+                        xm.ds(:KeyInfo, 'xmlns:ds' => XMLDsNs) do
+                            xm.ds(:KeyValue, params[:key])
+                        end
+                    end
+                    params[:bindings].each do |binding, services|
+                        binding_ns = self.bindings[binding]
+                        services.each do |name, data|
+                            service_name = self.services[name]+'Service'
+                            attributes = {}
+                            attributes['Binding'] = binding_ns
+                            attributes['Location'] = data[:location] if data[:location]
+                            attributes['ResponseLocation'] = data[:response_location] if data[:response_location]
+                            xm.method_missing(service_name, attributes)
+                        end
+                    end
+                end
+                xm.Organization do
+                    xm.OrganizationName(params[:organization], 'xml:lang' => 'en')
+                end
+            end
+            return xml
+        end
+        
+        def self.load_metadata(provider)
+            providers = Spider.conf.get('sso.providers')
+            return IO.read(providers[provider]['metadata'])
+        end
+        
+        
+        class SAML2Exception < RuntimeError
+        end
+
+    end
+
+
+end

data/apps/sso/views/saml2_post.shtml

@@ -0,0 +1,19 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+    <meta http-equiv="content-type" content="text/html; charset=utf-8" />
+    <title>SAML 2.0 POST</title>
+</head>
+<body onload="document.forms[0].submit()">
+    <noscript>
+        <p><strong>_(Note):</strong> _(Since your browser does not support JavaScript, you must press the button below once to proceed.)</p> 
+    </noscript>
+    <form method="post" action="{ @sp_url }">
+        <input type="hidden" name="SAMLResponse" value="{ @saml_response }">
+        <input type="hidden" name="RelayState" value="{ @relay_state }">
+        <noscript>
+			<input type="submit" value="_(Submit the response to the service)" />
+		</noscript>
+    </form>
+</body>

data/apps/webdav/_init.rb

@@ -0,0 +1,15 @@
+module Spider
+
+    module WebDAV
+
+        @description = ""
+        @version = 0.1
+        @path = File.dirname(__FILE__)
+        include Spider::App
+
+    end
+
+
+end
+
+require 'apps/webdav/controllers/webdav_controller'