synapse-rubycas-server 1.1.3alpha

data/db/migrate/002_add_indexes_for_performance.rb

@@ -0,0 +1,15 @@
+class AddIndexesForPerformance < ActiveRecord::Migration
+  def self.up
+    add_index :casserver_lt,  :ticket
+    add_index :casserver_st,  :ticket
+    add_index :casserver_tgt, :ticket
+    add_index :casserver_pgt, :ticket
+  end
+
+  def self.down
+    remove_index  :casserver_pgt, :ticket
+    remove_index  :casserver_st,  :ticket
+    remove_index  :casserver_lt,  :ticket
+    remove_index  :casserver_tgt, :ticket
+  end
+end

data/lib/casserver/authenticators/active_directory_ldap.rb

@@ -0,0 +1,17 @@
+# Slightly modified version of the LDAP authenticator for Microsoft's ActiveDirectory.
+# The only difference is that the default_username_attribute for AD is 'sAMAccountName'
+# rather than 'uid'.
+class CASServer::Authenticators::ActiveDirectoryLDAP < CASServer::Authenticators::LDAP
+  protected
+  def default_username_attribute
+    "sAMAccountName"
+  end
+
+  def extract_extra_attributes(ldap_entry)
+    super(ldap_entry)
+    if @extra_attributes["objectGUID"]
+      @extra_attributes["guid"] = @extra_attributes["objectGUID"].to_s.unpack("H*").to_s
+    end
+    ldap_entry
+  end
+end

data/lib/casserver/authenticators/active_resource.rb

@@ -0,0 +1,113 @@
+begin
+  require 'active_resource'
+rescue LoadError
+  $stderr.puts "To use the ActiveResource authenticator, you must first install gems from active_resource group. See: Gemfile"
+end
+
+module CASServer
+  module Authenticators
+
+    module Helpers
+      class Identity < ActiveResource::Base
+
+        # define method_name accessor
+        cattr_accessor(:method_name)
+        self.method_name = :authenticate
+
+        def self.method_type
+          @@method_type ||= :post
+        end
+
+        def self.method_type= type
+          methods = [:get, :post, :put, :delete]
+          raise ArgumentError, "Method type should be one of #{methods.map { |m| m.to_s.upcase }.join(', ')}" unless methods.include? type.to_sym
+          @@method_type = type
+        end
+
+        # Autenticate an identity using the given method
+        # @param [Hash] credentials
+        def self.authenticate(credentials = {})
+          response = send(method_type, method_name, credentials)
+          new.from_authentication_data(response)
+        end
+
+        # Used to load object attributes from the given response
+        def from_authentication_data response
+          load_attributes_from_response(response)
+        end
+      end
+    end
+
+    class ActiveResource < Base
+
+      # This is called at server startup.
+      # Any class-wide initializiation for the authenticator should be done here.
+      # (e.g. establish database connection).
+      # You can leave this empty if you don't need to set up anything.
+      def self.setup(options)
+        raise AuthenticatorError, 'You must define at least site option' unless options[:site]
+        # apply options to active resource object
+        options.each do |method, arg|
+          Helpers::Identity.send "#{method}=", arg if Helpers::Identity.respond_to? "#{method}="
+        end
+        $LOG.info "ActiveResource configuration loaded"
+      end
+
+      # Override this to implement your authentication credential validation.
+      # This is called each time the user tries to log in. The credentials hash
+      # holds the credentials as entered by the user (generally under :username
+      # and :password keys; :service and :request are also included by default)
+      #
+      # Note that the standard credentials can be read in to instance variables
+      # by calling #read_standard_credentials.
+      def validate(credentials)
+        begin
+          $LOG.debug("Starting Active Resource authentication")
+          result = Helpers::Identity.authenticate(credentials.except(:request))
+          extract_extra_attributes(result) if result
+          !!result
+        rescue ::ActiveResource::ConnectionError => e
+          if e.response.blank? # band-aid for ARes 2.3.x -- craps out if to_s is called without a response
+            e = e.class.to_s
+          end
+          $LOG.warn("Error during authentication: #{e}")
+          false
+        end
+      end
+
+      private
+
+      def extract_extra_attributes(resource)
+        @extra_attributes = {}
+        $LOG.debug("Parsing extra attributes")
+        if @options[:extra_attributes]
+          extra_attributes_to_extract.each do |attr|
+            @extra_attributes[attr] = resource.send(attr).to_s
+          end
+        else
+          @extra_attributes = resource.attributes
+        end
+        # do filtering
+        extra_attributes_to_filter.each do |attr|
+          @extra_attributes.delete(attr)
+        end
+      end
+
+      # extract attributes to filter from the given configuration
+      def extra_attributes_to_filter
+        # default value if not set
+        return ['password'] unless @options[:filter_attributes]
+        # parse option value
+        if @options[:filter_attributes].kind_of? Array
+          attrs = @options[:filter_attributes]
+        elsif @options[:filter_attributes].kind_of? String
+          attrs = @options[:filter_attributes].split(',').collect { |col| col.strip }
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:filter_attributes].inspect}. This must be an Array of column names or a comma-separated list.")
+          attrs = []
+        end
+        attrs
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/aes256.rb

@@ -0,0 +1,43 @@
+require "openssl"
+
+module Authlogic
+  module CryptoProviders
+    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
+    # In an initializer, or before your application initializes, you should do the following:
+    #
+    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrably a bunch of random characters"
+    #
+    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
+    # then you should consider Sha512 or BCrypt instead.
+    #
+    # Keep your key in a safe place, some even say the key should be stored on a separate server.
+    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
+    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
+    # store the key with the lock.
+    class AES256
+      class << self
+        attr_writer :key
+
+        def encrypt(*tokens)
+          aes.encrypt
+          aes.key = @key
+          [aes.update(tokens.join) + aes.final].pack("m").chomp
+        end
+
+        def matches?(crypted, *tokens)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+        rescue OpenSSL::CipherError
+          false
+        end
+
+        private
+          def aes
+            raise ArgumentError.new("You must provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
+            @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/bcrypt.rb

@@ -0,0 +1,92 @@
+begin
+  require "bcrypt"
+rescue LoadError
+end
+
+module Authlogic
+  module CryptoProviders
+    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
+    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
+    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
+    # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
+    #
+    #   require "bcrypt"
+    #   require "digest"
+    #   require "benchmark"
+    #
+    #   Benchmark.bm(18) do |x|
+    #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
+    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
+    #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
+    #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
+    #   end
+    #
+    #                           user     system      total        real
+    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
+    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
+    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
+    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
+    #
+    # You can play around with the cost to get that perfect balance between performance and security.
+    #
+    # Decided BCrypt is for you? Just insall the bcrypt gem:
+    #
+    #   gem install bcrypt-ruby
+    #
+    # Tell acts_as_authentic to use it:
+    #
+    #   acts_as_authentic do |c|
+    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
+    #   end
+    #
+    # You are good to go!
+    class BCrypt
+      class << self
+        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
+        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        def cost
+          @cost ||= 10
+        end
+        attr_writer :cost
+
+        # Creates a BCrypt hash for the password passed.
+        def encrypt(*tokens)
+          ::BCrypt::Password.create(join_tokens(tokens), :cost => cost)
+        end
+
+        # Does the hash match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(hash, *tokens)
+          $LOG.debug hash
+          $LOG.debug tokens.inspect
+
+          hash = new_from_hash(hash)
+          return false if hash.blank?
+          hash == join_tokens(tokens)
+        end
+
+        # This method is used as a flag to tell Authlogic to "resave" the password upon a successful login, using the new cost
+        def cost_matches?(hash)
+          hash = new_from_hash(hash)
+          if hash.blank?
+            false
+          else
+            hash.cost == cost
+          end
+        end
+
+        private
+          def join_tokens(tokens)
+            tokens.flatten.join
+          end
+
+          def new_from_hash(hash)
+            begin
+              ::BCrypt::Password.new(hash)
+            rescue ::BCrypt::Errors::InvalidHash
+              return nil
+            end
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/md5.rb

@@ -0,0 +1,34 @@
+require "digest/md5"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from md5 based systems.
+    # I highly discourage using this crypto provider as it superbly inferior
+    # to your other options.
+    #
+    # Please use any other provider offered by Authlogic.
+    class MD5
+      class << self
+        attr_accessor :join_token
+
+        # The number of times to loop through the encryption.
+        def stretches
+          @stretches ||= 1
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a MD5 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::MD5.hexdigest(digest) }
+          digest
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha1.rb

@@ -0,0 +1,59 @@
+require "digest/sha1"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from restful_authentication.
+    # I highly discourage using this crypto provider as it inferior to your other options.
+    # Please use any other provider offered by Authlogic.
+    class Sha1
+      class << self
+        def join_token
+          @join_token ||= "--"
+        end
+        attr_writer :join_token
+
+        def digest_format=(format)
+          @digest_format = format
+        end
+
+        # This is for "old style" authentication with a custom format of digest
+        def digest(tokens)
+          if @digest_format
+            @digest_format.
+              gsub('PASSWORD', tokens.first).
+              gsub('SALT', tokens.last)
+          else
+            tokens.join(join_token)
+          end
+        end
+
+        # The number of times to loop through the encryption.
+        # This is ten because that is what restful_authentication defaults to.
+
+        def stretches
+          @stretches ||= 10
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a Sha1 hash.
+        def encrypt(*tokens)
+          tokens = tokens.flatten
+
+          if stretches > 1
+            hash = tokens.shift
+            stretches.times { hash = Digest::SHA1.hexdigest([hash, *tokens].join(join_token)) }
+          else
+            hash = Digest::SHA1.hexdigest( digest(tokens) )
+          end
+
+          hash
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha512.rb

@@ -0,0 +1,50 @@
+require "digest/sha2"
+
+module Authlogic
+  # The acts_as_authentic method has a crypto_provider option. This allows you to use any type of encryption you like.
+  # Just create a class with a class level encrypt and matches? method. See example below.
+  #
+  # === Example
+  #
+  #   class MyAwesomeEncryptionMethod
+  #     def self.encrypt(*tokens)
+  #       # the tokens passed will be an array of objects, what type of object is irrelevant,
+  #       # just do what you need to do with them and return a single encrypted string.
+  #       # for example, you will most likely join all of the objects into a single string and then encrypt that string
+  #     end
+  #
+  #     def self.matches?(crypted, *tokens)
+  #       # return true if the crypted string matches the tokens.
+  #       # depending on your algorithm you might decrypt the string then compare it to the token, or you might
+  #       # encrypt the tokens and make sure it matches the crypted string, its up to you
+  #     end
+  #   end
+  module CryptoProviders
+    # = Sha512
+    #
+    # Uses the Sha512 hash algorithm to encrypt passwords.
+    class Sha512
+      class << self
+        attr_accessor :join_token
+
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 20
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a Sha512 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::SHA512.hexdigest(digest) }
+          digest
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/base.rb

@@ -0,0 +1,70 @@
+require 'active_support'
+require 'active_support/core_ext'
+
+module CASServer
+  module Authenticators
+    class Base
+      attr_accessor :options
+      attr_reader :username # make this accessible so that we can pick up any
+                            # transformations done within the authenticator
+
+      # This is called at server startup.
+      # Any class-wide initializiation for the authenticator should be done here.
+      # (e.g. establish database connection).
+      # You can leave this empty if you don't need to set up anything.
+      def self.setup(options)
+      end
+
+      # This is called prior to #validate (i.e. each time the user tries to log in).
+      # Any per-instance initialization for the authenticator should be done here.
+      #
+      # By default this makes the authenticator options hash available for #validate
+      # under @options and initializes @extra_attributes to an empty hash.
+      def configure(options)
+        raise ArgumentError, "options must be a HashWithIndifferentAccess" unless options.kind_of? HashWithIndifferentAccess
+        @options = options.dup
+        @extra_attributes = {}
+      end
+
+      # Override this to implement your authentication credential validation.
+      # This is called each time the user tries to log in. The credentials hash
+      # holds the credentials as entered by the user (generally under :username
+      # and :password keys; :service and :request are also included by default)
+      #
+      # Note that the standard credentials can be read in to instance variables
+      # by calling #read_standard_credentials.
+      def validate(credentials)
+        raise NotImplementedError, "This method must be implemented by a class extending #{self.class}"
+      end
+
+      def extra_attributes
+        @extra_attributes
+      end
+
+      protected
+      def read_standard_credentials(credentials)
+        @username = credentials[:username]
+        @password = credentials[:password]
+        @service = credentials[:service]
+        @request = credentials[:request]
+      end
+
+      def extra_attributes_to_extract
+        if @options[:extra_attributes].kind_of? Array
+          attrs = @options[:extra_attributes]
+        elsif @options[:extra_attributes].kind_of? String
+          attrs = @options[:extra_attributes].split(',').collect{|col| col.strip}
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:extra_attributes].inspect}. This must be an Array of column names or a comma-separated list.")
+          attrs = []
+        end
+
+        $LOG.debug("#{self.class.name} will try to extract the following extra_attributes: #{attrs.inspect}")
+        return attrs
+      end
+    end
+  end
+
+  class AuthenticatorError < Exception
+  end
+end

data/lib/casserver/authenticators/client_certificate.rb

@@ -0,0 +1,47 @@
+require 'casserver/authenticators/base'
+
+# NOT YET IMPLEMENTED
+#
+# This authenticator will authenticate the user based on a client SSL certificate.
+#
+# You will probably want to use this along with another authenticator, chaining
+# it so that if the client does not provide a certificate, the server can
+# fall back to some other authentication mechanism.
+#
+# Here's an example of how to use two chained authenticators in the config.yml
+# file. The server will first use the ClientCertificate authenticator, and
+# only fall back to the SQL authenticator of the first one fails:
+#
+# authenticator:
+#  -
+#    class: CASServer::Authenticators::ClientCertificate
+#  -
+#    class: CASServer::Authenticators::SQL
+#    database:
+#      adapter: mysql
+#      database: some_database_with_users_table
+#      user: root
+#      password:
+#      server: localhost
+#    user_table: user
+#    username_column: username
+#    password_column: password
+#
+class CASServer::Authenticators::ClientCertificate < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    @client_cert = credentials[:request]['SSL_CLIENT_CERT']
+
+    # note that I haven't actually tested to see if SSL_CLIENT_CERT gets
+    # filled with data when a client cert is provided, but this should be
+    # the case at least in theory :)
+
+    return false if @client_cert.blank?
+
+    # IMPLEMENT SSL CERTIFICATE VALIDATION CODE HERE
+    raise NotImplementedError, "#{self.class.name}#validate NOT YET IMPLEMENTED!"
+
+    return true # if SSL certificate is valid, false otherwise
+  end
+end

data/lib/casserver/authenticators/google.rb

@@ -0,0 +1,62 @@
+require 'uri'
+require 'net/http'
+require 'net/https'
+require 'timeout'
+
+# Validates Google accounts against Google's authentication service -- in other
+# words, this authenticator allows users to log in to CAS using their
+# Gmail/Google accounts.
+class CASServer::Authenticators::Google < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @username.blank? || @password.blank?
+
+    if @options[:restricted_domain]
+      return false if @username.count('@') != 1
+      return false if @username.split('@').last != @options[:restricted_domain]
+    end
+
+    auth_data = {
+      'Email'   => @username,
+      'Passwd'  => @password,
+      'service' => 'xapi',
+      'source'  => 'RubyCAS-Server',
+      'accountType' => 'HOSTED_OR_GOOGLE'
+    }
+
+    url = URI.parse('https://www.google.com/accounts/ClientLogin')
+    if @options[:proxy]
+      http = Net::HTTP.Proxy(@options[:proxy][:host], @options[:proxy][:port], @options[:proxy][:username], @options[:proxy][:password]).new(url.host, url.port)
+    else
+      http = Net::HTTP.new(url.host, url.port)
+    end
+    http.use_ssl = true
+
+    # TODO: make the timeout configurable
+    wait_seconds = 10
+    begin
+      timeout(wait_seconds) do
+        res = http.start do |conn|
+          req = Net::HTTP::Post.new(url.path)
+          req.set_form_data(auth_data,'&')
+          conn.request(req)
+        end
+
+        case res
+        when Net::HTTPSuccess
+          true
+        when Net::HTTPForbidden
+          false
+        else
+          $LOG.error("Unexpected response from Google while validating credentials: #{res.inspect} ==> #{res.body}.")
+          raise CASServer::AuthenticatorError, "Unexpected response received from Google while validating credentials."
+        end
+      end
+    rescue Timeout::Error
+      $LOG.error("Google did not respond to the credential validation request. We waited for #{wait_seconds.inspect} seconds before giving up.")
+      raise CASServer::AuthenticatorError, "Timeout while waiting for Google to validate credentials."
+    end
+
+  end
+end