synapses-cas 0.1.0

data/lib/casserver/authenticators/open_id.rb

@@ -0,0 +1,22 @@
+require 'casserver/authenticators/base'
+
+require 'openid'
+require 'openid/extensions/sreg'
+require 'openid/extensions/pape'
+require 'openid/store/memory'
+
+
+# CURRENTLY UNIMPLEMENTED
+# This is just starter code.
+class CASServer::Authenticators::OpenID < CASServer::Authenticators::Base
+
+  def validate(credentials)
+    raise NotImplementedError, "The OpenID authenticator is not yet implemented. "+
+      "See http://code.google.com/p/rubycas-server/issues/detail?id=36 if you are interested in helping this along."
+
+    read_standard_credentials(credentials)
+
+    store = OpenID::Store::Memory.new
+    consumer = OpenID::Consumer.new({}, store)
+  end
+end

data/lib/casserver/authenticators/sql.rb

@@ -0,0 +1,133 @@
+require 'casserver/authenticators/base'
+
+begin
+  require 'active_record'
+rescue LoadError
+  require 'rubygems'
+  require 'active_record'
+end
+
+# Authenticates against a plain SQL table.
+#
+# This assumes that all of your users are stored in a table that has a 'username'
+# column and a 'password' column. When the user logs in, CAS conects to the
+# database and looks for a matching username/password in the users table. If a
+# matching username and password is found, authentication is successful.
+#
+# Any database backend supported by ActiveRecord can be used.
+#
+# Config example:
+#
+#   authenticator:
+#     class: CASServer::Authenticators::SQL
+#     database:
+#       adapter: mysql
+#       database: some_database_with_users_table
+#       username: root
+#       password:
+#       server: localhost
+#     user_table: users
+#     username_column: username
+#     password_column: password
+#
+# When replying to a CAS client's validation request, the server will normally
+# provide the client with the authenticated user's username. However it is now
+# possible for the server to provide the client with additional attributes.
+# You can configure the SQL authenticator to provide data from additional
+# columns in the users table by listing the names of the columns under the
+# 'extra_attributes' option. Note though that this functionality is experimental.
+# It should work with RubyCAS-Client, but may or may not work with other CAS
+# clients.
+#
+# For example, with this configuration, the 'full_name' and 'access_level'
+# columns will be provided to your CAS clients along with the username:
+#
+#   authenticator:
+#     class: CASServer::Authenticators::SQL
+#     database:
+#       adapter: mysql
+#       database: some_database_with_users_table
+#     user_table: users
+#     username_column: username
+#     password_column: password
+#     ignore_type_column: true # indicates if you want to ignore Single Table Inheritance 'type' field
+#     extra_attributes: full_name, access_level
+#
+class CASServer::Authenticators::SQL < CASServer::Authenticators::Base
+  def self.setup(options)
+    raise CASServer::AuthenticatorError, "Invalid authenticator configuration!" unless options[:database]
+
+    user_model_name = "CASUser_#{options[:auth_index]}"
+    $LOG.debug "CREATING USER MODEL #{user_model_name}"
+
+    class_eval %{
+      class #{user_model_name} < ActiveRecord::Base
+      end
+    }
+
+    @user_model = const_get(user_model_name)
+    @user_model.establish_connection(options[:database])
+    @user_model.set_table_name(options[:user_table] || 'users')
+    @user_model.inheritance_column = 'no_inheritance_column' if options[:ignore_type_column]
+  end
+
+  def self.user_model
+    @user_model
+  end
+
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    raise_if_not_configured
+
+    user_model = self.class.user_model
+
+    username_column = @options[:username_column] || 'username'
+    password_column = @options[:password_column] || 'password'
+    
+    $LOG.debug "#{self.class}: [#{user_model}] " + "Connection pool size: #{user_model.connection_pool.instance_variable_get(:@checked_out).length}/#{user_model.connection_pool.instance_variable_get(:@connections).length}"
+    results = user_model.find(:all, :conditions => ["#{username_column} = ? AND #{password_column} = ?", @username, @password])
+    user_model.connection_pool.checkin(user_model.connection)
+       
+    if results.size > 0
+      $LOG.warn("#{self.class}: Multiple matches found for user #{@username.inspect}") if results.size > 1
+      
+      unless @options[:extra_attributes].blank?
+        if results.size > 1
+          $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
+        else
+          user = results.first
+
+          extract_extra(user)
+          log_extra
+        end
+      end
+
+      return true
+    else
+      return false
+    end
+  end
+
+  protected
+
+  def raise_if_not_configured
+    raise CASServer::AuthenticatorError.new(
+      "Cannot validate credentials because the authenticator hasn't yet been configured"
+    ) unless @options
+  end
+
+  def extract_extra user
+    @extra_attributes = {}
+    extra_attributes_to_extract.each do |col|
+      @extra_attributes[col] = user.send(col)
+    end
+  end
+
+  def log_extra
+    if @extra_attributes.empty?
+      $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+    else
+      $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+    end
+  end
+end

data/lib/casserver/authenticators/sql_authlogic.rb

@@ -0,0 +1,93 @@
+require 'casserver/authenticators/sql'
+
+# These were pulled directly from Authlogic, and new ones can be added
+# just by including new Crypto Providers
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/aes256'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/bcrypt'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/md5'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/sha1'
+require File.dirname(__FILE__) + '/authlogic_crypto_providers/sha512'
+
+begin
+  require 'active_record'
+rescue LoadError
+  require 'rubygems'
+  require 'active_record'
+end
+
+# This is a version of the SQL authenticator that works nicely with Authlogic.
+# Passwords are encrypted the same way as it done in Authlogic.
+# Before use you this, you MUST configure rest_auth_digest_streches and rest_auth_site_key in
+# config.
+#
+# Using this authenticator requires restful authentication plugin on rails (client) side.
+#
+# * git://github.com/binarylogic/authlogic.git
+#
+# Usage:
+
+# authenticator:
+#   class: CASServer::Authenticators::SQLAuthlogic
+#   database:
+#     adapter: mysql
+#     database: some_database_with_users_table
+#     user: root
+#     password:
+#     server: localhost
+#   user_table: user
+#   username_column: login
+#   password_column: crypted_password
+#   salt_column: password_salt
+#   encryptor: Sha1
+#   encryptor_options:
+#     digest_format: --SALT--PASSWORD--
+#     stretches: 1
+#
+class CASServer::Authenticators::SQLAuthlogic < CASServer::Authenticators::SQL
+
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    raise_if_not_configured
+
+    user_model = self.class.user_model
+
+    username_column = @options[:username_column] || "login"
+    password_column = @options[:password_column] || "crypted_password"
+    salt_column     = @options[:salt_column]
+
+    $LOG.debug "#{self.class}: [#{user_model}] " + "Connection pool size: #{user_model.connection_pool.instance_variable_get(:@checked_out).length}/#{user_model.connection_pool.instance_variable_get(:@connections).length}"
+    results = user_model.find(:all, :conditions => ["#{username_column} = ?", @username])
+    user_model.connection_pool.checkin(user_model.connection)
+
+    begin
+      encryptor = eval("Authlogic::CryptoProviders::" + @options[:encryptor] || "Sha512")
+    rescue
+      $LOG.warn("Could not initialize Authlogic crypto class for '#{@options[:encryptor]}'")
+      encryptor = Authlogic::CryptoProviders::Sha512
+    end
+
+    @options[:encryptor_options].each do |name, value|
+      encryptor.send("#{name}=", value) if encryptor.respond_to?("#{name}=")
+    end
+
+    if results.size > 0
+      $LOG.warn("Multiple matches found for user '#{@username}'") if results.size > 1
+      user = results.first
+      tokens = [@password, (not salt_column.nil?) && user.send(salt_column) || nil].compact
+      crypted = user.send(password_column)
+
+      unless @options[:extra_attributes].blank?
+        if results.size > 1
+          $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
+        else
+          extract_extra(user)
+          log_extra
+        end
+      end
+
+      return encryptor.matches?(crypted, tokens)
+    else
+      return false
+    end
+  end
+end

data/lib/casserver/authenticators/sql_encrypted.rb

@@ -0,0 +1,75 @@
+require 'casserver/authenticators/sql'
+
+require 'digest/sha1'
+require 'digest/sha2'
+require 'crypt-isaac'
+
+# This is a more secure version of the SQL authenticator. Passwords are encrypted
+# rather than being stored in plain text.
+#
+# Based on code contributed by Ben Mabey.
+#
+# Using this authenticator requires some configuration on the client side. Please see
+# http://code.google.com/p/rubycas-server/wiki/UsingTheSQLEncryptedAuthenticator
+class CASServer::Authenticators::SQLEncrypted < CASServer::Authenticators::SQL
+  # Include this module into your application's user model.
+  #
+  # Your model must have an 'encrypted_password' column where the password will be stored,
+  # and an 'encryption_salt' column that will be populated with a random string before
+  # the user record is first created.
+  module EncryptedPassword
+    def self.included(mod)
+      raise "#{self} should be inclued in an ActiveRecord class!" unless mod.respond_to?(:before_save)
+      mod.before_save :generate_encryption_salt
+    end
+
+    def encrypt(str)
+      generate_encryption_salt unless encryption_salt
+      Digest::SHA256.hexdigest("#{encryption_salt}::#{str}")
+    end
+
+    def password=(password)
+      self[:encrypted_password] = encrypt(password)
+    end
+
+    def generate_encryption_salt
+      self.encryption_salt = Digest::SHA1.hexdigest(Crypt::ISAAC.new.rand(2**31).to_s) unless
+        encryption_salt
+    end
+  end
+
+  def self.setup(options)
+    super(options)
+    user_model.__send__(:include, EncryptedPassword)
+  end
+
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    raise_if_not_configured
+
+    user_model = self.class.user_model
+
+    username_column = @options[:username_column] || "username"
+    encrypt_function = @options[:encrypt_function] || 'user.encrypted_password == Digest::SHA256.hexdigest("#{user.encryption_salt}::#{@password}")'
+
+    $LOG.debug "#{self.class}: [#{user_model}] " + "Connection pool size: #{user_model.connection_pool.instance_variable_get(:@checked_out).length}/#{user_model.connection_pool.instance_variable_get(:@connections).length}"
+    results = user_model.find(:all, :conditions => ["#{username_column} = ?", @username])
+    user_model.connection_pool.checkin(user_model.connection)
+    
+    if results.size > 0
+      $LOG.warn("Multiple matches found for user '#{@username}'") if results.size > 1
+      user = results.first
+      unless @options[:extra_attributes].blank?
+        if results.size > 1
+          $LOG.warn("#{self.class}: Unable to extract extra_attributes because multiple matches were found for #{@username.inspect}")
+        else
+          extract_extra(user)
+              log_extra
+        end
+      end
+      return eval(encrypt_function)
+    else
+      return false
+    end
+  end
+end

data/lib/casserver/authenticators/sql_md5.rb

@@ -0,0 +1,19 @@
+require 'casserver/authenticators/sql'
+
+require 'digest/md5'
+
+# Essentially the same as the standard SQL authenticator, but this version
+# assumes that your password is stored as an MD5 hash.
+#
+# This was contributed by malcomm for Drupal authentication. To work with
+# Drupal, you should use 'name' for the :username_column config option, and
+# 'pass' for the :password_column.
+class CASServer::Authenticators::SQLMd5 < CASServer::Authenticators::SQL
+
+  protected
+    def read_standard_credentials(credentials)
+      super
+      @password = Digest::MD5.hexdigest(@password)
+    end
+
+end

data/lib/casserver/authenticators/sql_rest_auth.rb

@@ -0,0 +1,82 @@
+require 'casserver/authenticators/sql_encrypted'
+
+require 'digest/sha1'
+
+begin
+  require 'active_record'
+rescue LoadError
+  require 'rubygems'
+  require 'active_record'
+end
+
+# This is a version of the SQL authenticator that works nicely with RestfulAuthentication.
+# Passwords are encrypted the same way as it done in RestfulAuthentication.
+# Before use you this, you MUST configure rest_auth_digest_streches and rest_auth_site_key in
+# config.
+#
+# Using this authenticator requires restful authentication plugin on rails (client) side.
+#
+# * git://github.com/technoweenie/restful-authentication.git
+#
+class CASServer::Authenticators::SQLRestAuth < CASServer::Authenticators::SQLEncrypted
+
+  def validate(credentials)
+    read_standard_credentials(credentials)
+    raise_if_not_configured
+
+    raise CASServer::AuthenticatorError, "You must specify a 'site_key' in the SQLRestAuth authenticator's configuration!" unless  @options[:site_key]
+    raise CASServer::AuthenticatorError, "You must specify 'digest_streches' in the SQLRestAuth authenticator's configuration!" unless  @options[:digest_streches]
+
+    user_model = self.class.user_model
+
+    username_column = @options[:username_column] || "email"
+
+    $LOG.debug "#{self.class}: [#{user_model}] " + "Connection pool size: #{user_model.connection_pool.instance_variable_get(:@checked_out).length}/#{user_model.connection_pool.instance_variable_get(:@connections).length}"
+    results = user_model.find(:all, :conditions => ["#{username_column} = ?", @username])
+    user_model.connection_pool.checkin(user_model.connection)
+
+    if results.size > 0
+      $LOG.warn("Multiple matches found for user '#{@username}'") if results.size > 1
+      user = results.first
+      if user.crypted_password == user.encrypt(@password,@options[:site_key],@options[:digest_streches])
+        unless @options[:extra_attributes].blank?
+          extract_extra(user)
+          log_extra
+        end
+        return true
+      else
+        return false
+      end
+    else
+      return false
+    end
+  end
+
+  def self.setup(options)
+    super(options)
+    user_model.__send__(:include, EncryptedPassword)
+  end
+
+  module EncryptedPassword
+
+    def self.included(mod)
+      raise "#{self} should be inclued in an ActiveRecord class!" unless mod.respond_to?(:before_save)
+    end
+
+    def encrypt(password,site_key,digest_streches)
+      password_digest(password, self.salt,site_key,digest_streches)
+    end
+
+    def secure_digest(*args)
+      Digest::SHA1.hexdigest(args.flatten.join('--'))
+    end
+
+    def password_digest(password, salt,site_key,digest_streches)
+      digest = site_key
+      digest_streches.times do
+        digest = secure_digest(digest, salt, password, site_key) 
+      end
+      digest
+    end
+  end
+end

data/lib/casserver/authenticators/test.rb

@@ -0,0 +1,22 @@
+# encoding: UTF-8
+require 'casserver/authenticators/base'
+
+# Dummy authenticator used for testing.
+# Accepts any username as valid as long as the password is "testpassword"; otherwise authentication fails.
+# Raises an AuthenticationError when username is "do_error" (this is useful to test the Exception
+# handling functionality).
+class CASServer::Authenticators::Test < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    raise CASServer::AuthenticatorError, "Username is 'do_error'!" if @username == 'do_error'
+
+    @extra_attributes[:test_utf_string] = "Ютф"
+    @extra_attributes[:test_numeric] = 123.45
+    @extra_attributes[:test_serialized] = {:foo => 'bar', :alpha => [1,2,3]}
+
+    valid_password = options[:password] || "testpassword"
+
+    return @password == valid_password
+  end
+end