uchouhan-rubycas-server 1.0.a

data/lib/casserver/authenticators/authlogic_crypto_providers/bcrypt.rb

@@ -0,0 +1,92 @@
+begin
+  require "bcrypt"
+rescue LoadError
+end
+
+module Authlogic
+  module CryptoProviders
+    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
+    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
+    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
+    # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
+    #
+    #   require "bcrypt"
+    #   require "digest"
+    #   require "benchmark"
+    #
+    #   Benchmark.bm(18) do |x|
+    #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
+    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
+    #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
+    #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
+    #   end
+    #
+    #                           user     system      total        real
+    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
+    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
+    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
+    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
+    #
+    # You can play around with the cost to get that perfect balance between performance and security.
+    #
+    # Decided BCrypt is for you? Just insall the bcrypt gem:
+    #
+    #   gem install bcrypt-ruby
+    #
+    # Tell acts_as_authentic to use it:
+    #
+    #   acts_as_authentic do |c|
+    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
+    #   end
+    #
+    # You are good to go!
+    class BCrypt
+      class << self
+        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
+        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        def cost
+          @cost ||= 10
+        end
+        attr_writer :cost
+
+        # Creates a BCrypt hash for the password passed.
+        def encrypt(*tokens)
+          ::BCrypt::Password.create(join_tokens(tokens), :cost => cost)
+        end
+
+        # Does the hash match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(hash, *tokens)
+          $LOG.debug hash
+          $LOG.debug tokens.inspect
+
+          hash = new_from_hash(hash)
+          return false if hash.blank?
+          hash == join_tokens(tokens)
+        end
+
+        # This method is used as a flag to tell Authlogic to "resave" the password upon a successful login, using the new cost
+        def cost_matches?(hash)
+          hash = new_from_hash(hash)
+          if hash.blank?
+            false
+          else
+            hash.cost == cost
+          end
+        end
+
+        private
+          def join_tokens(tokens)
+            tokens.flatten.join
+          end
+
+          def new_from_hash(hash)
+            begin
+              ::BCrypt::Password.new(hash)
+            rescue ::BCrypt::Errors::InvalidHash
+              return nil
+            end
+          end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/md5.rb

@@ -0,0 +1,34 @@
+require "digest/md5"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from md5 based systems.
+    # I highly discourage using this crypto provider as it superbly inferior
+    # to your other options.
+    #
+    # Please use any other provider offered by Authlogic.
+    class MD5
+      class << self
+        attr_accessor :join_token
+
+        # The number of times to loop through the encryption.
+        def stretches
+          @stretches ||= 1
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a MD5 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::MD5.hexdigest(digest) }
+          digest
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha1.rb

@@ -0,0 +1,59 @@
+require "digest/sha1"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from restful_authentication.
+    # I highly discourage using this crypto provider as it inferior to your other options.
+    # Please use any other provider offered by Authlogic.
+    class Sha1
+      class << self
+        def join_token
+          @join_token ||= "--"
+        end
+        attr_writer :join_token
+
+        def digest_format=(format)
+          @digest_format = format
+        end
+
+        # This is for "old style" authentication with a custom format of digest
+        def digest(tokens)
+          if @digest_format
+            @digest_format.
+              gsub('PASSWORD', tokens.first).
+              gsub('SALT', tokens.last)
+          else
+            tokens.join(join_token)
+          end
+        end
+
+        # The number of times to loop through the encryption.
+        # This is ten because that is what restful_authentication defaults to.
+
+        def stretches
+          @stretches ||= 10
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a Sha1 hash.
+        def encrypt(*tokens)
+          tokens = tokens.flatten
+
+          if stretches > 1
+            hash = tokens.shift
+            stretches.times { hash = Digest::SHA1.hexdigest([hash, *tokens].join(join_token)) }
+          else
+            hash = Digest::SHA1.hexdigest( digest(tokens) )
+          end
+
+          hash
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/authlogic_crypto_providers/sha512.rb

@@ -0,0 +1,50 @@
+require "digest/sha2"
+
+module Authlogic
+  # The acts_as_authentic method has a crypto_provider option. This allows you to use any type of encryption you like.
+  # Just create a class with a class level encrypt and matches? method. See example below.
+  #
+  # === Example
+  #
+  #   class MyAwesomeEncryptionMethod
+  #     def self.encrypt(*tokens)
+  #       # the tokens passed will be an array of objects, what type of object is irrelevant,
+  #       # just do what you need to do with them and return a single encrypted string.
+  #       # for example, you will most likely join all of the objects into a single string and then encrypt that string
+  #     end
+  #
+  #     def self.matches?(crypted, *tokens)
+  #       # return true if the crypted string matches the tokens.
+  #       # depending on your algorithm you might decrypt the string then compare it to the token, or you might
+  #       # encrypt the tokens and make sure it matches the crypted string, its up to you
+  #     end
+  #   end
+  module CryptoProviders
+    # = Sha512
+    #
+    # Uses the Sha512 hash algorithm to encrypt passwords.
+    class Sha512
+      class << self
+        attr_accessor :join_token
+
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 20
+        end
+        attr_writer :stretches
+
+        # Turns your raw password into a Sha512 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::SHA512.hexdigest(digest) }
+          digest
+        end
+
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/casserver/authenticators/base.rb

@@ -0,0 +1,67 @@
+module CASServer
+  module Authenticators
+    class Base
+      attr_accessor :options
+      attr_reader :username # make this accessible so that we can pick up any
+                            # transformations done within the authenticator
+
+      # This is called at server startup.
+      # Any class-wide initializiation for the authenticator should be done here.
+      # (e.g. establish database connection).
+      # You can leave this empty if you don't need to set up anything.
+      def self.setup(options)
+      end
+
+      # This is called prior to #validate (i.e. each time the user tries to log in).
+      # Any per-instance initialization for the authenticator should be done here.
+      #
+      # By default this makes the authenticator options hash available for #validate
+      # under @options and initializes @extra_attributes to an empty hash.
+      def configure(options)
+        raise ArgumentError, "options must be a HashWithIndifferentAccess" unless options.kind_of? HashWithIndifferentAccess
+        @options = options.dup
+        @extra_attributes = {}
+      end
+
+      # Override this to implement your authentication credential validation.
+      # This is called each time the user tries to log in. The credentials hash
+      # holds the credentials as entered by the user (generally under :username
+      # and :password keys; :service and :request are also included by default)
+      #
+      # Note that the standard credentials can be read in to instance variables
+      # by calling #read_standard_credentials.
+      def validate(credentials)
+        raise NotImplementedError, "This method must be implemented by a class extending #{self.class}"
+      end
+
+      def extra_attributes
+        @extra_attributes
+      end
+
+      protected
+      def read_standard_credentials(credentials)
+        @username = credentials[:username]
+        @password = credentials[:password]
+        @service = credentials[:service]
+        @request = credentials[:request]
+      end
+
+      def extra_attributes_to_extract
+        if @options[:extra_attributes].kind_of? Array
+          attrs = @options[:extra_attributes]
+        elsif @options[:extra_attributes].kind_of? String
+          attrs = @options[:extra_attributes].split(',').collect{|col| col.strip}
+        else
+          $LOG.error("Can't figure out attribute list from #{@options[:extra_attributes].inspect}. This must be an Aarray of column names or a comma-separated list.")
+          attrs = []
+        end
+
+        $LOG.debug("#{self.class.name} will try to extract the following extra_attributes: #{attrs.inspect}")
+        return attrs
+      end
+    end
+  end
+
+  class AuthenticatorError < Exception
+  end
+end

data/lib/casserver/authenticators/client_certificate.rb

@@ -0,0 +1,47 @@
+require 'casserver/authenticators/base'
+
+# NOT YET IMPLEMENTED
+#
+# This authenticator will authenticate the user based on a client SSL certificate.
+#
+# You will probably want to use this along with another authenticator, chaining
+# it so that if the client does not provide a certificate, the server can
+# fall back to some other authentication mechanism.
+#
+# Here's an example of how to use two chained authenticators in the config.yml
+# file. The server will first use the ClientCertificate authenticator, and
+# only fall back to the SQL authenticator of the first one fails:
+#
+# authenticator:
+#  -
+#    class: CASServer::Authenticators::ClientCertificate
+#  -
+#    class: CASServer::Authenticators::SQL
+#    database:
+#      adapter: mysql
+#      database: some_database_with_users_table
+#      user: root
+#      password:
+#      server: localhost
+#    user_table: user
+#    username_column: username
+#    password_column: password
+#
+class CASServer::Authenticators::ClientCertificate < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    @client_cert = credentials[:request]['SSL_CLIENT_CERT']
+
+    # note that I haven't actually tested to see if SSL_CLIENT_CERT gets
+    # filled with data when a client cert is provided, but this should be
+    # the case at least in theory :)
+
+    return false if @client_cert.blank?
+
+    # IMPLEMENT SSL CERTIFICATE VALIDATION CODE HERE
+    raise NotImplementedError, "#{self.class.name}#validate NOT YET IMPLEMENTED!"
+
+    return true # if SSL certificate is valid, false otherwise
+  end
+end

data/lib/casserver/authenticators/google.rb

@@ -0,0 +1,58 @@
+require 'casserver/authenticators/base'
+require 'uri'
+require 'net/http'
+require 'net/https'
+require 'timeout'
+
+# Validates Google accounts against Google's authentication service -- in other
+# words, this authenticator allows users to log in to CAS using their
+# Gmail/Google accounts.
+class CASServer::Authenticators::Google < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @username.blank? || @password.blank?
+
+    auth_data = {
+      'Email'   => @username,
+      'Passwd'  => @password,
+      'service' => 'xapi',
+      'source'  => 'RubyCAS-Server',
+      'accountType' => 'HOSTED_OR_GOOGLE'
+    }
+
+    url = URI.parse('https://www.google.com/accounts/ClientLogin')
+    if $CONF.proxy_host
+      http = Net::HTTP.Proxy($CONF.proxy_host, $CONF.proxy_port, $CONF.proxy_username, $CONF.proxy_password).new(url.host, url.port)
+    else
+      http = Net::HTTP.new(url.host, url.port)
+    end
+    http.use_ssl = true
+
+    # TODO: make the timeout configurable
+    wait_seconds = 10
+    begin
+      timeout(wait_seconds) do
+        res = http.start do |conn|
+          req = Net::HTTP::Post.new(url.path)
+          req.set_form_data(auth_data,'&')
+          conn.request(req)
+        end
+
+        case res
+        when Net::HTTPSuccess
+          true
+        when Net::HTTPForbidden
+          false
+        else
+          $LOG.error("Unexpected response from Google while validating credentials: #{res.inspect} ==> #{res.body}.")
+          raise CASServer::AuthenticatorError, "Unexpected response received from Google while validating credentials."
+        end
+      end
+    rescue Timeout::Error
+      $LOG.error("Google did not respond to the credential validation request. We waited for #{wait_seconds.inspect} seconds before giving up.")
+      raise CASServer::AuthenticatorError, "Timeout while waiting for Google to validate credentials."
+    end
+
+  end
+end

data/lib/casserver/authenticators/ldap.rb

@@ -0,0 +1,147 @@
+require 'casserver/authenticators/base'
+
+begin
+  require 'net/ldap'
+rescue LoadError
+  require 'rubygems'
+  begin
+    gem 'ruby-net-ldap', '~> 0.0.4'
+  rescue Gem::LoadError
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    $stderr.puts
+    $stderr.puts "To use the LDAP/AD authenticator, you must first install the 'ruby-net-ldap' gem."
+    $stderr.puts
+    $stderr.puts "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
+    exit 1
+  end
+  require 'net/ldap'
+end
+
+# Basic LDAP authenticator. Should be compatible with OpenLDAP and other similar LDAP servers,
+# although it hasn't been officially tested. See example config file for details on how
+# to configure it.
+class CASServer::Authenticators::LDAP < CASServer::Authenticators::Base
+  def validate(credentials)
+    read_standard_credentials(credentials)
+
+    return false if @password.blank?
+
+    raise CASServer::AuthenticatorError, "Cannot validate credentials because the authenticator hasn't yet been configured" unless @options
+    raise CASServer::AuthenticatorError, "Invalid LDAP authenticator configuration!" unless @options[:ldap]
+    raise CASServer::AuthenticatorError, "You must specify a server host in the LDAP configuration!" unless @options[:ldap][:host] || @options[:ldap][:server]
+
+    raise CASServer::AuthenticatorError, "The username '#{@username}' contains invalid characters." if (@username =~ /[*\(\)\0\/]/)
+
+    preprocess_username
+
+    @ldap = Net::LDAP.new
+
+
+    @options[:ldap][:host] ||= @options[:ldap][:server]
+    @ldap.host = @options[:ldap][:host]
+    @ldap.port = @options[:ldap][:port] if @options[:ldap][:port]
+    @ldap.encryption(@options[:ldap][:encryption].intern) if @options[:ldap][:encryption]
+
+    begin
+      if @options[:ldap][:auth_user]
+        bind_success = bind_by_username_with_preauthentication
+      else
+        bind_success = bind_by_username
+      end
+
+      return false unless bind_success
+
+      entry = find_user
+      extract_extra_attributes(entry)
+
+      return true
+    rescue Net::LDAP::LdapError => e
+      raise CASServer::AuthenticatorError,
+        "LDAP authentication failed with '#{e}'. Check your authenticator configuration."
+    end
+  end
+
+  protected
+    def default_username_attribute
+      "cn"
+    end
+
+  private
+    # Add prefix to username, if :username_prefix was specified in the :ldap config.
+    def preprocess_username
+      @username = @options[:ldap][:username_prefix] + @username if @options[:ldap][:username_prefix]
+    end
+
+    # Attempt to bind with the LDAP server using the username and password entered by
+    # the user. If a :filter was specified in the :ldap config, the filter will be
+    # added to the LDAP query for the username.
+    def bind_by_username
+      username_attribute = options[:ldap][:username_attribute] || default_username_attribute
+
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
+    end
+
+    # If an auth_user is specified, we will connect ("pre-authenticate") with the
+    # LDAP server using the authenticator account, and then attempt to bind as the
+    # user who is actually trying to authenticate. Note that you need to set up
+    # the special authenticator account first. Also, auth_user must be the authenticator
+    # user's full CN, which is probably not the same as their username.
+    #
+    # This pre-authentication process is necessary because binding can only be done
+    # using the CN, so having just the username is not enough. We connect as auth_user,
+    # and then try to find the target user's CN based on the given username. Then we bind
+    # as the target user to validate their credentials.
+    def bind_by_username_with_preauthentication
+      raise CASServer::AuthenticatorError, "A password must be specified in the configuration for the authenticator user!" unless
+        @options[:ldap][:auth_password]
+
+      @ldap.authenticate(@options[:ldap][:auth_user], @options[:ldap][:auth_password])
+
+      @ldap.bind_as(:base => @options[:ldap][:base], :password => @password, :filter => user_filter)
+    end
+
+    # Combine the filter for finding the user with the optional extra filter specified in the config
+    # (if any).
+    def user_filter
+      username_attribute = options[:ldap][:username_attribute] || default_username_attribute
+
+      filter = Array(username_attribute).map { |ua| Net::LDAP::Filter.eq(ua, @username) }.reduce(:|)
+      unless @options[:ldap][:filter].blank?
+        filter &= Net::LDAP::Filter.construct(@options[:ldap][:filter])
+      end
+
+      filter
+    end
+
+    # Finds the user based on the user_filter (this is called after authentication).
+    # We do this to make it possible to extract extra_attributes.
+    def find_user
+      results = @ldap.search( :base => options[:ldap][:base], :filter => user_filter)
+      return results.first
+    end
+
+    def extract_extra_attributes(ldap_entry)
+      @extra_attributes = {}
+      extra_attributes_to_extract.each do |attr|
+        v = !ldap_entry[attr].blank? && ldap_entry[attr].first
+        if v
+          if ldap_entry[attr].kind_of?(Array)
+             @extra_attributes[attr] = []
+             ldap_entry[attr].each do |a|
+               @extra_attributes[attr] << a
+             end
+          else
+            @extra_attributes[attr] = v.to_s
+          end
+        end
+      end
+
+      if @extra_attributes.empty?
+        $LOG.warn("#{self.class}: Did not read any extra_attributes for user #{@username.inspect} even though an :extra_attributes option was provided.")
+      else
+        $LOG.debug("#{self.class}: Read the following extra_attributes for user #{@username.inspect}: #{@extra_attributes.inspect}")
+      end
+      ldap_entry
+    end
+end