trivialsso 0.1.0

data/.gitignore

@@ -0,0 +1,4 @@
+*.gem
+.bundle
+Gemfile.lock
+pkg/*

data/Gemfile

@@ -0,0 +1,4 @@
+source "http://rubygems.org"
+
+# Specify your gem's dependencies in trivialsso.gemspec
+gemspec

data/MIT-LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) 2012 David J. Lee. http://lee.dj/
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,103 @@
+## Trivialsso
+
+A very simple gem to help with creating and reading cookies across multiple sites in a Ruby on Rails application.
+
+This allows for a simple single sign on solution among sites within the same domain.
+
+This does *not* work across domains.
+
+
+## Getting Started
+
+Add the gem to your Gemfile
+
+	gem 'trivialsso'
+
+Install the gem
+
+	bundle install
+
+After you've installed the gem, you need to generate a configuration file.
+
+	rails g trivialsso:install
+
+This will create an initializer file with a shared secret. You need to modify this to a big long
+string of characters. Keep this safe from others as they could forge cookies for your sites if they
+get ahold of this string. All sites that use the single sign on must have this same shared secret
+for the cookies to properly interoperate.
+
+## Creating a cookie
+
+A cookie is created using a hash of data supplied to it. This must contain a "username" key.
+
+When you create the cookie data an expire time is built into the payload. Setting the :expires on the cookie is
+just a convenience to make sure it gets cleared by the browser. The actual expiration date that matters is what is encoded in the cookie.
+
+
+	# Create a hash of data we want to store in the cookie.
+	userdata = {"username" => current_user.login, "display" => current_user.display_name, "groups" => current_user.memberof}
+	
+	#Generate the cookie data
+	cookie = Trivialsso::Login.cookie(userdata)
+	
+	# Set the cookie
+	cookies[:sso_login] = {
+		:value => cookie,
+		:expires => Trivialsso::Login.expire_date,
+		:domain => 'mydomain.com',
+		:httponly => true,
+	}
+
+The above code creates a hash of data we will be putting in the cookie, generates the cookie, and then sets the cookie in the browser.
+
+## Decoding a cookie
+
+Retrieve the contents of the cookie by calling decode_cookie
+
+	@userdata = Trivialsso::Login.decode_cookie(cookies[:sso_login])
+
+This will throw an exception if the cookie has been tampered with, or if the expiration date has passed.
+
+## Sample code for application_controller
+
+Here are some methods you can add into your application controller to authenticate against the cookie.
+
+	# If there is a problem with the cookie, redirect back to our central login server.
+	rescue_from Trivialsso::CookieError do |exception|
+		redirect_to 'https://login.mydomain.com/'
+	end
+
+	# authorize our users based on the cookie.
+	before_filter :auth_user!
+
+	# authenticate a user and set @current_user
+	def auth_user!
+		cu = current_user
+
+		# Check for authorization based on "groups" data that was put in the cookie
+		# by the central login application.
+		# you could also skip this check and just return true if the cookie is valid.
+		if cu['groups'].include? "ALLOWED_GROUP"    #all lower case
+			@current_user = cu
+			return true
+		else
+			render :file => "#{Rails.root}/public/403", :formats => [:html], :status => 403, :layout => false
+		end
+
+		return false
+	end
+
+	# our current_user decodes the cookie.
+	def current_user
+		Trivialsso::Login.decode_cookie(cookies[:ophth_login])
+	end
+
+	# Define the name we want to record in paper_trail (if using)
+	def user_for_paper_trail
+		if @current_user.blank?
+			return "anonymous"
+		else
+			return @current_user['username']
+		end
+	end
+

data/Rakefile

@@ -0,0 +1,7 @@
+require "bundler/gem_tasks"
+
+require "rake/testtask"
+
+Rake::TestTask.new do |t|
+	t.libs << 'test'
+end

data/lib/generators/templates/README

@@ -0,0 +1,9 @@
+===============================================================================
+
+What you need to do next:
+
+    Edit config/initalizers/sso_secret.rb to include a secret that will
+    be shared between all of the sites. This secret must match for each
+    site using the cookies.
+
+===============================================================================

data/lib/generators/templates/sso_secret.rb

@@ -0,0 +1,5 @@
+# This file is required to define the shared secret used for generating and decoding
+# SSO cookies. This secret *must* be the same across all of your applications.
+
+# TODO, figure out how to get app_name
+<%= Rails.application.class.parent_name %>::Application.config.sso_secret = "You-really-need-to-change-this-to-a-nice-long-random-string"

data/lib/generators/trivialsso/install_generator.rb

@@ -0,0 +1,20 @@
+module Trivialsso
+	module Generators
+		class InstallGenerator < Rails::Generators::Base
+			source_root File.expand_path("../../templates",__FILE__)
+			
+			desc "Creates a sso_secret initalizer"
+			
+			def copy_intializer
+				#template - maybe use that in the future?
+				template "sso_secret.rb", "config/initializers/sso_secret.rb"
+			end
+			
+			
+			def show_readme
+				readme "README"
+			end
+			
+		end
+	end
+end

data/lib/trivialsso/version.rb

@@ -0,0 +1,3 @@
+module Trivialsso
+  VERSION = "0.1.0"
+end

data/lib/trivialsso.rb

@@ -0,0 +1,110 @@
+require "trivialsso/version"
+
+module Trivialsso	
+		class Login
+			# signing and un-signing may have to be refactored to use OpenSSL:HMAC...
+			# as this will not work well across platforms. (ideally this should work for PHP as well)
+
+			# create an encrypted and signed cookie containing userdata and an expiry date.
+			# userdata should be an array, and at minimum include a 'username' key.
+			# using json serializer to hopefully allow future cross version compatibliity 
+			# (Marshall, the default serializer, is not compatble between versions)
+			def self.cookie(userdata, exp_date = expire_date)
+				begin
+					raise MissingConfig if Rails.configuration.sso_secret.blank?	
+				rescue NoMethodError
+					raise MissingConfig
+				end
+				raise NoUsernameCookie if userdata['username'].blank?
+				enc = ActiveSupport::MessageEncryptor.new(Rails.configuration.sso_secret, :serializer => JSON)
+				cookie = enc.encrypt_and_sign([userdata,exp_date.to_i])
+				return cookie		
+			end
+
+			# Decodes and verifies an encrypted cookie
+			# throw a proper exception if a bad or invalid cookie.
+			# otherwise, return the username and userdata stored in the cookie
+			def self.decode_cookie(cookie)
+				begin
+					raise MissingConfig if Rails.configuration.sso_secret.blank?	
+				rescue NoMethodError
+					raise MissingConfig
+				end
+				if cookie.blank?
+					raise MissingCookie
+				else
+					enc = ActiveSupport::MessageEncryptor.new(Rails.configuration.sso_secret, :serializer => JSON)
+					begin
+						userdata, timestamp = enc.decrypt_and_verify(cookie)
+					rescue ActiveSupport::MessageVerifier::InvalidSignature
+						#raise our own cookie error instead of passing on invalid signature.
+						raise BadCookie
+					rescue ActiveSupport::MessageEncryptor::InvalidMessage
+						#raise our own cookie error instead of passing on invalid message.
+						raise BadCookie
+					end
+
+					# Determine how many seconds our cookie is valid for.
+					timeRemain = timestamp - DateTime.now.to_i
+
+					#make sure current time is not past timestamp.
+					if timeRemain > 0
+						return userdata
+					else
+						raise LoginExpired
+					end
+				end
+			end
+
+			#returns the exipiry date from now. Used for setting an expiry date when creating cookies.
+			def self.expire_date
+				9.hours.from_now
+			end
+		end
+
+
+	#
+	# Error Classes
+	#	
+		# General Cookie Error
+		class CookieError < RuntimeError
+			def to_s
+				"There was an error processing the Ophth Cookie"
+			end
+		end
+
+		# Cookie can not be verified, data has been altered
+		class BadCookie < CookieError
+			def to_s
+				"Login cookie can not be verified!"
+			end
+		end
+
+		# cookie is no longer valid
+		class LoginExpired < CookieError
+			def to_s
+				"Login cookie has expired!"
+			end
+		end
+
+		# Cookie is missing
+		class MissingCookie < CookieError
+			def to_s
+				"Login cookie is missing!"
+			end
+		end
+
+		# Cookie is lacking a username.
+		class NoUsernameCookie < CookieError
+			def to_s
+				"Need username to create cookie"
+			end
+		end
+
+		# Missing configuration value.
+		class MissingConfig < CookieError
+			def to_s
+				"Missing secret configuration for cookie, need to define config.sso_secret"
+			end
+		end
+end

data/test/test_trivialsso.rb

@@ -0,0 +1,96 @@
+require 'active_support/core_ext'
+require 'rails/all'
+
+require 'test/unit'
+require 'mocha'         # Need the mocha gem to properly stub out rails configuration.
+require 'trivialsso'
+
+
+##
+# Test suite for Trivialsso. Which requires rails (for config values) and active_support for time calculations.
+#
+class TrivialssoTest < Test::Unit::TestCase
+
+	def setup
+		# Stub out our Rails config so we can test things properly.
+		Rails.stubs(:configuration).returns(Rails::Application::Configuration.allocate)
+		Rails.configuration.sso_secret = "57f236fdb162bd951f2ed15683a9d9d327f26ecdccb1897107161b76223b07a46d34907c3357e66b4eb0ef6e06888a700c0dc"			
+	end
+
+
+	def test_can_create_cookie		
+		mycookie = Trivialsso::Login.cookie({'username' => 'testor'})
+		assert !mycookie.nil?		
+	end
+
+	def test_create_cookie_with_userdata
+		mycookie = Trivialsso::Login.cookie({'username' => 'testor', 'data' => 'additional cookie data'})
+		assert !mycookie.nil?
+	end
+	
+	def test_create_cookie_and_decode_it
+		mycookie = Trivialsso::Login.cookie({'username' => 'testor', 'data' => 'additional cookie data'})
+		data = Trivialsso::Login.decode_cookie(mycookie)
+		
+		if data['data'] == 'additional cookie data'
+			assert true
+		else
+			assert false
+		end
+	end
+	
+	def test_throw_exception_on_missing_username
+		begin
+			mycookie = Trivialsso::Login.cookie("")
+		rescue Trivialsso::NoUsernameCookie
+			assert true, "Exception thrown due to blank username"
+		else
+			assert false, "No exception was raised for a blank username"
+		end
+	end
+	
+	
+	def test_expire_date_exists
+		# in a full rails environment, this will return an ActiveSupport::TimeWithZone
+		mydate = Trivialsso::Login.expire_date
+		assert mydate.is_a?(Time), "proper Time object not returned"
+	end
+	
+	def test_expire_date_is_in_future
+		assert (DateTime.now < Trivialsso::Login.expire_date), "Expire date is in the past - cookie will expire immediatly."
+	end
+	
+	def test_exception_on_blank_cookie
+		begin
+			Trivialsso::Login.decode_cookie("")
+		rescue Trivialsso::MissingCookie
+			assert true			
+		else
+			assert false, "no exception was raised for a blank cookie"
+		end
+	end
+	
+	def test_exception_on_bad_cookie
+		begin
+			Trivialsso::Login.decode_cookie("BAhbB0kiC2RqbGVlMgY6BkVUbCsHo17iTg")
+		rescue Trivialsso::BadCookie
+			assert true			
+		else
+			assert false, "no exception was raised for a malformed cookie"
+		end		
+	end
+	
+	def test_exception_on_expired_cookie
+		#create a cookie that is expired.
+		temp_cookie = Trivialsso::Login.cookie({'username' => 'testor'}, 2.seconds.ago)
+		
+		begin
+			Trivialsso::Login.decode_cookie(temp_cookie)
+		rescue Trivialsso::LoginExpired
+			assert true
+		else
+			assert false, "no exception was raised for an expired cookie"
+		end
+	end
+	
+end

data/trivialsso.gemspec

@@ -0,0 +1,29 @@
+# -*- encoding: utf-8 -*-
+$:.push File.expand_path("../lib", __FILE__)
+require "trivialsso/version"
+
+Gem::Specification.new do |s|
+  s.name        = "trivialsso"
+  s.version     = Trivialsso::VERSION
+  s.authors     = ["David J. Lee"]
+  s.email       = ["david@lee.dj"]
+  s.homepage    = "https://github.com/DavidJLee/trivialsso"
+  s.summary     = "A simple library to help with Single Sign On cookies"
+  s.description = "Used to encode and decode cookies used in a single sign on implementation within the same domain"
+
+  s.rubyforge_project = "trivialsso"
+
+  s.files         = `git ls-files`.split("\n")
+  s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")
+  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
+  s.require_paths = ["lib"]
+
+  # specify any dependencies here; for example:
+  # s.add_development_dependency "rspec"
+  # s.add_runtime_dependency "rails"
+
+	# Need at least 3.2.0 to support the JSON serialization.
+	s.add_dependency "rails",					"~> 3.2.0"
+	s.add_dependency "activesupport", "~> 3.2.0"
+
+end

metadata

@@ -0,0 +1,81 @@
+--- !ruby/object:Gem::Specification
+name: trivialsso
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+  prerelease: 
+platform: ruby
+authors:
+- David J. Lee
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2012-03-08 00:00:00.000000000Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: &70357652379460 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 3.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: *70357652379460
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: &70357652378960 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 3.2.0
+  type: :runtime
+  prerelease: false
+  version_requirements: *70357652378960
+description: Used to encode and decode cookies used in a single sign on implementation
+  within the same domain
+email:
+- david@lee.dj
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- .gitignore
+- Gemfile
+- MIT-LICENSE
+- README.md
+- Rakefile
+- lib/generators/templates/README
+- lib/generators/templates/sso_secret.rb
+- lib/generators/trivialsso/install_generator.rb
+- lib/trivialsso.rb
+- lib/trivialsso/version.rb
+- test/test_trivialsso.rb
+- trivialsso.gemspec
+homepage: https://github.com/DavidJLee/trivialsso
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: trivialsso
+rubygems_version: 1.8.6
+signing_key: 
+specification_version: 3
+summary: A simple library to help with Single Sign On cookies
+test_files:
+- test/test_trivialsso.rb