tilia-dav 3.1.0.pre.alpha2

data/lib/tilia/dav/auth/backend/abstract_digest.rb

@@ -0,0 +1,132 @@
+module Tilia
+  module Dav
+    module Auth
+      module Backend
+        # HTTP Digest authentication backend class
+        #
+        # This class can be used by authentication objects wishing to use HTTP Digest
+        # Most of the digest logic is handled, implementors just need to worry about
+        # the getDigestHash method
+        class AbstractDigest
+          include BackendInterface
+
+          # Authentication Realm.
+          #
+          # The realm is often displayed by browser clients when showing the
+          # authentication dialog.
+          #
+          # @var string
+          # RUBY: attr_accessor :realm
+
+          # This is the prefix that will be used to generate principal urls.
+          #
+          # @var string
+          # RUBY: attr_accessor :principal_prefix
+
+          # Sets the authentication realm for this backend.
+          #
+          # Be aware that for Digest authentication, the realm influences the digest
+          # hash. Choose the realm wisely, because if you change it later, all the
+          # existing hashes will break and nobody can authenticate.
+          #
+          # @param string realm
+          # @return void
+          attr_writer :realm
+
+          # Returns a users digest hash based on the username and realm.
+          #
+          # If the user was not known, null must be returned.
+          #
+          # @param string realm
+          # @param string username
+          # @return string|null
+          def digest_hash(_realm, _username)
+          end
+
+          # When this method is called, the backend must check if authentication was
+          # successful.
+          #
+          # The returned value must be one of the following
+          #
+          # [true, "principals/username"]
+          # [false, "reason for failure"]
+          #
+          # If authentication was successful, it's expected that the authentication
+          # backend returns a so-called principal url.
+          #
+          # Examples of a principal url:
+          #
+          # principals/admin
+          # principals/user1
+          # principals/users/joe
+          # principals/uid/123457
+          #
+          # If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+          # return a string such as:
+          #
+          # principals/users/[username]
+          #
+          # @param RequestInterface request
+          # @param ResponseInterface response
+          # @return array
+          def check(request, response)
+            digest = Http::Auth::Digest.new(@realm, request, response)
+            digest.init
+
+            username = digest.username
+
+            # No username was given
+            unless username
+              return [false, "No 'Authorization: Digest' header found. Either the client didn't send one, or the server is misconfigured"]
+            end
+
+            hash = digest_hash(@realm, username)
+            # If this was false, the user account didn't exist
+            return [false, 'Username or password was incorrect'] unless hash
+            unless hash.is_a?(String)
+              fail Dav::Exception, 'The returned value from getDigestHash must be a string or null'
+            end
+
+            # If this was false, the password or part of the hash was incorrect.
+            unless digest.validate_a1(hash)
+              return [false, 'Username or password was incorrect']
+            end
+
+            [true, "#{@principal_prefix}#{username}"]
+          end
+
+          # This method is called when a user could not be authenticated, and
+          # authentication was required for the current request.
+          #
+          # This gives you the opportunity to set authentication headers. The 401
+          # status code will already be set.
+          #
+          # In this case of Basic Auth, this would for example mean that the
+          # following header needs to be set:
+          #
+          # response.add_header('WWW-Authenticate', 'Basic realm=SabreDAV')
+          #
+          # Keep in mind that in the case of multiple authentication backends, other
+          # WWW-Authenticate headers may already have been set, and you'll want to
+          # append your own WWW-Authenticate header instead of overwriting the
+          # existing one.
+          #
+          # @param RequestInterface request
+          # @param ResponseInterface response
+          # @return void
+          def challenge(request, response)
+            auth = Http::Auth::Digest.new(@realm, request, response)
+            auth.init
+            auth.require_login
+          end
+
+          # TODO: document
+          def initialize
+            @realm = 'TiliaDAV'
+            @principal_prefix = 'principals/'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/tilia/dav/auth/backend/apache.rb

@@ -0,0 +1,85 @@
+module Tilia
+  module Dav
+    module Auth
+      module Backend
+        # Apache authenticator
+        #
+        # This authentication backend assumes that authentication has been
+        # configured in apache, rather than within SabreDAV.
+        #
+        # Make sure apache is properly configured for this to work.
+        class Apache
+          include BackendInterface
+          # This is the prefix that will be used to generate principal urls.
+          #
+          # @var string
+          # RUBY: attr_accessor :principal_prefix
+
+          # When this method is called, the backend must check if authentication was
+          # successful.
+          #
+          # The returned value must be one of the following
+          #
+          # [true, "principals/username"]
+          # [false, "reason for failure"]
+          #
+          # If authentication was successful, it's expected that the authentication
+          # backend returns a so-called principal url.
+          #
+          # Examples of a principal url:
+          #
+          # principals/admin
+          # principals/user1
+          # principals/users/joe
+          # principals/uid/123457
+          #
+          # If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+          # return a string such as:
+          #
+          # principals/users/[username]
+          #
+          # @param RequestInterface request
+          # @param ResponseInterface response
+          # @return array
+          def check(request, _response)
+            remote_user = request.raw_server_value('REMOTE_USER')
+            unless remote_user
+              remote_user = request.raw_server_value('REDIRECT_REMOTE_USER')
+            end
+            unless remote_user
+              return [false, 'No REMOTE_USER property was found in the PHP $_SERVER super-global. This likely means your server is not configured correctly']
+            end
+
+            [true, "#{@principal_prefix}#{remote_user}"]
+          end
+
+          # This method is called when a user could not be authenticated, and
+          # authentication was required for the current request.
+          #
+          # This gives you the opportunity to set authentication headers. The 401
+          # status code will already be set.
+          #
+          # In this case of Basic Auth, this would for example mean that the
+          # following header needs to be set:
+          #
+          # response.add_header('WWW-Authenticate', 'Basic realm=SabreDAV')
+          #
+          # Keep in mind that in the case of multiple authentication backends, other
+          # WWW-Authenticate headers may already have been set, and you'll want to
+          # append your own WWW-Authenticate header instead of overwriting the
+          # existing one.
+          #
+          # @param RequestInterface request
+          # @param ResponseInterface response
+          # @return void
+          def challenge(_request, _response)
+          end
+
+          def initialize
+            @principal_prefix = 'principals/'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/tilia/dav/auth/backend/backend_interface.rb

@@ -0,0 +1,61 @@
+module Tilia
+  module Dav
+    module Auth
+      module Backend
+        # This is the base class for any authentication object.
+        module BackendInterface
+          # When this method is called, the backend must check if authentication was
+          # successful.
+          #
+          # The returned value must be one of the following
+          #
+          # [true, "principals/username"]
+          # [false, "reason for failure"]
+          #
+          # If authentication was successful, it's expected that the authentication
+          # backend returns a so-called principal url.
+          #
+          # Examples of a principal url:
+          #
+          # principals/admin
+          # principals/user1
+          # principals/users/joe
+          # principals/uid/123457
+          #
+          # If you don't use WebDAV ACL (RFC3744) we recommend that you simply
+          # return a string such as:
+          #
+          # principals/users/[username]
+          #
+          # @param RequestInterface request
+          # @param ResponseInterface response
+          # @return array
+          def check(_request, _response)
+          end
+
+          # This method is called when a user could not be authenticated, and
+          # authentication was required for the current request.
+          #
+          # This gives you the opportunity to set authentication headers. The 401
+          # status code will already be set.
+          #
+          # In this case of Basic Auth, this would for example mean that the
+          # following header needs to be set:
+          #
+          # response.add_header('WWW-Authenticate', 'Basic realm=SabreDAV')
+          #
+          # Keep in mind that in the case of multiple authentication backends, other
+          # WWW-Authenticate headers may already have been set, and you'll want to
+          # append your own WWW-Authenticate header instead of overwriting the
+          # existing one.
+          #
+          # @param RequestInterface request
+          # @param ResponseInterface response
+          # @return void
+          def challenge(_request, _response)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/tilia/dav/auth/backend/basic_call_back.rb

@@ -0,0 +1,46 @@
+module Tilia
+  module Dav
+    module Auth
+      module Backend
+        # Extremely simply HTTP Basic auth backend.
+        #
+        # This backend basically works by calling a callback, which receives a
+        # username and password.
+        # The callback must return true or false depending on if authentication was
+        # correct.
+        class BasicCallBack < AbstractBasic
+          # Callback
+          #
+          # @var callable
+          # RUBY: attr_accessor :call_back
+
+          # Creates the backend.
+          #
+          # A callback must be provided to handle checking the username and
+          # password.
+          #
+          # @param callable call_back
+          # @return void
+          def initialize(call_back)
+            super()
+            @call_back = call_back
+          end
+
+          protected
+
+          # Validates a username and password
+          #
+          # This method should return true or false depending on if login
+          # succeeded.
+          #
+          # @param string username
+          # @param string password
+          # @return bool
+          def validate_user_pass(username, password)
+            @call_back.call(username, password)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/tilia/dav/auth/backend/file.rb

@@ -0,0 +1,61 @@
+module Tilia
+  module Dav
+    module Auth
+      module Backend
+        # This is an authentication backend that uses a file to manage passwords.
+        #
+        # The backend file must conform to Apache's htdigest format
+        class File < AbstractDigest
+          # List of users
+          #
+          # @var array
+          # RUBY: attr_accessor :users
+
+          # Creates the backend object.
+          #
+          # If the filename argument is passed in, it will parse out the specified file fist.
+          #
+          # @param string|null filename
+          def initialize(filename = nil)
+            super()
+            @users = {}
+
+            load_file(filename) if filename
+          end
+
+          # Loads an htdigest-formatted file. This method can be called multiple times if
+          # more than 1 file is used.
+          #
+          # @param string filename
+          # @return void
+          def load_file(filename)
+            ::File.readlines(filename).each do |line|
+              line.chomp!
+
+              if line.scan(':').size != 2
+                fail Dav::Exception, 'Malformed htdigest file. Every line should contain 2 colons'
+              end
+
+              (username, realm, a1) = line.split(':')
+
+              unless a1 =~ /^[a-zA-Z0-9]{32}$/
+                fail Dav::Exception, 'Malformed htdigest file. Invalid md5 hash'
+              end
+
+              @users[realm + ':' + username] = a1
+            end
+          end
+
+          # Returns a users' information
+          #
+          # @param string realm
+          # @param string username
+          # @return string
+          def digest_hash(realm, username)
+            @users["#{realm}:#{username}"]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/tilia/dav/auth/backend/sequel.rb

@@ -0,0 +1,46 @@
+module Tilia
+  module Dav
+    module Auth
+      module Backend
+        # This is an authentication backend that uses a database to manage passwords.
+        class Sequel < AbstractDigest
+          protected
+
+          # Reference to PDO connection
+          #
+          # @var PDO
+          attr_accessor :pdo
+
+          public
+
+          # PDO table name we'll be using
+          #
+          # @var string
+          attr_accessor :table_name
+
+          # Creates the backend object.
+          #
+          # If the filename argument is passed in, it will parse out the specified file fist.
+          #
+          # @param sequel
+          def initialize(sequel)
+            @sequel = sequel
+            @table_name = 'users'
+          end
+
+          # Returns the digest hash for a user.
+          #
+          # @param string realm
+          # @param string username
+          # @return string|null
+          def digest_hash(_realm, username)
+            @sequel.fetch("SELECT digesta1 FROM #{@table_name} WHERE username=?", username) do |row|
+              return row[:digesta1]
+            end
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/tilia/dav/auth/plugin.rb

@@ -0,0 +1,157 @@
+module Tilia
+  module Dav
+    module Auth
+      # This plugin provides Authentication for a WebDAV server.
+      #
+      # It works by providing a Auth\Backend class. Several examples of these
+      # classes can be found in the Backend directory.
+      #
+      # It's possible to provide more than one backend to this plugin. If more than
+      # one backend was provided, each backend will attempt to authenticate. Only if
+      # all backends fail, we throw a 401.
+      class Plugin < ServerPlugin
+        # authentication backends
+        # RUBY: attr_accessor :backends
+
+        # The currently logged in principal. Will be `null` if nobody is currently
+        # logged in.
+        #
+        # @var string|null
+        # RUBY: attr_accessor :current_principal
+
+        # Creates the authentication plugin
+        #
+        # @param Backend\BackendInterface auth_backend
+        def initialize(auth_backend = nil)
+          @backends = []
+          add_backend(auth_backend) if auth_backend
+        end
+
+        # Adds an authentication backend to the plugin.
+        #
+        # @param Backend\BackendInterface auth_backend
+        # @return void
+        def add_backend(auth_backend)
+          @backends << auth_backend
+        end
+
+        # Initializes the plugin. This function is automatically called by the server
+        #
+        # @param Server server
+        # @return void
+        def setup(server)
+          server.on('beforeMethod', method(:before_method), 10)
+        end
+
+        # Returns a plugin name.
+        #
+        # Using this name other plugins will be able to access other plugins
+        # using DAV\Server::getPlugin
+        #
+        # @return string
+        def plugin_name
+          'auth'
+        end
+
+        # Returns the currently logged-in principal.
+        #
+        # This will return a string such as:
+        #
+        # principals/username
+        # principals/users/username
+        #
+        # This method will return null if nobody is logged in.
+        #
+        # @return string|null
+        attr_reader :current_principal
+
+        # Returns the current username.
+        #
+        # This method is deprecated and is only kept for backwards compatibility
+        # purposes. Please switch to current_principal.
+        #
+        # @deprecated Will be removed in a future version!
+        # @return string|null
+        def current_user
+          # We just do a 'basename' on the principal to give back a sane value
+          # here.
+          user_name = Http::UrlUtil.split_path(current_principal)[1]
+
+          user_name
+        end
+
+        # This method is called before any HTTP method and forces users to be authenticated
+        #
+        # @param RequestInterface request
+        # @param ResponseInterface response
+        # @return bool
+        def before_method(request, response)
+          if @current_principal
+            # We already have authentication information. This means that the
+            # event has already fired earlier, and is now likely fired for a
+            # sub-request.
+            #
+            # We don't want to authenticate users twice, so we simply don't do
+            # anything here. See Issue #700 for additional reasoning.
+            #
+            # This is not a perfect solution, but will be fixed once the
+            # "currently authenticated principal" is information that's not
+            # not associated with the plugin, but rather per-request.
+            #
+            # See issue #580 for more information about that.
+            return nil
+          end
+
+          if @backends.empty?
+            fail Dav::Exception, 'No authentication backends were configured on this server.'
+          end
+
+          reasons = []
+          @backends.each do |backend|
+            result = backend.check(request, response)
+
+            if !result.is_a?(Array) ||
+               result.size != 2 ||
+               !(result[0].is_a?(TrueClass) || result[0].is_a?(FalseClass)) ||
+               !result[1].is_a?(String)
+              fail Dav::Exception, 'The authentication backend did not return a correct value from the check method.'
+            end
+
+            if result[0]
+              @current_principal = result[1]
+              # Exit early
+              return nil
+            end
+            reasons << result[1]
+          end
+
+          # If we got here, it means that no authentication backend was
+          # successful in authenticating the user.
+          @current_principal = nil
+
+          @backends.each do |backend|
+            backend.challenge(request, response)
+          end
+          fail Exception::NotAuthenticated, reasons.join(', ')
+        end
+
+        # Returns a bunch of meta-data about the plugin.
+        #
+        # Providing this information is optional, and is mainly displayed by the
+        # Browser plugin.
+        #
+        # The description key in the returned array may contain html and will not
+        # be sanitized.
+        #
+        # @return array
+        def plugin_info
+          {
+            'name'        => plugin_name,
+            'description' => 'Generic authentication plugin',
+            'link'        => 'http://sabre.io/dav/authentication/'
+          }
+        end
+      end
+    end
+  end
+end