warden-hmac-authentication 0.5.1 → 0.5.2

data/README.md

@@ -83,6 +83,24 @@ or use a Proc that retrieves the secret.
                                      }
     end
 
+### Retrieving the user from the database
+
+If a callable object is given for the `:retrieve_user` option, this callable will be called after successful authentication. The callable must accept the strategy itself as its only argument. The strategy allows access to all request parameters and header as well as all derived values. The result will be memoized. 
+
+    use Warden::Manager do |manager|
+      manager.failure_app = -> env { [401, {"Content-Length" => "0"}, [""]] }
+      # other scopes
+      manager.scope_defaults :hmac, :strategies => [:hmac_query, :hmac_header], 
+                                     :store => false, 
+                                     :hmac => { 
+                                       :retrieve_user => Proc.new {|strategy|
+                                         User.get(strategy.params["userid"])
+                                       }
+                                     }
+    end
+
+An alternative is overwriting the strategies `retrieve_user` method.
+
 ### Controlling the HMAC algorithm
 
 The algorithm can be controlled using the `:algorithm` option:
@@ -120,9 +138,11 @@ No authentication attempt is made if the scheme name in the `Authorization` head
 ## Authentication Header Format
 
 The format of the Authentication Header can be controlled using the `:auth_header_format` directive. The given format string will be interpolated
-with all given options and the signature. The default value is `%{auth_scheme} %{signature}` which will result in an auth header with a format such as `HMAC 539263f4f83878a4917d2f9c1521320c28b926a9`. 
+with all given options and the signature. The default value is `%{scheme} %{signature}` which will result in an auth header with a format such as `HMAC 539263f4f83878a4917d2f9c1521320c28b926a9`. The format string must contain at least the `scheme` and `signature` components.
 
-The `:auth_header_format` directive has a companion directive, `:auth_header_parse` which can be a proc or a regular expression. Any given regular expression will be evaluated against the string and any named capture pattern will be added to the parameters for the request. The regular expression must at least contain a pattern named `scheme` and pattern named `signature`. The default value is `/(?<scheme>\w+) (?<signature>\w+)/`
+The `:auth_header_format` directive has a companion directive, `:auth_header_parse` which must be a regular expression. Any given regular expression will be evaluated against the authorization header. The results can be retrieved using the `parsed_auth_header` method. The regular expression must at least contain a pattern named `scheme` and pattern named `signature`. The default value for this directive is a regular expression that is auto-generated by translating the `:auth_header_format` setting to a regular expression that contains a named capture group for each named part of the format string. Each capture allows for word characters, plus, dash, underscore and dot. The default :auth_header_format `%{scheme} %{signature}` will be translated to `/(?<autschemeh_scheme>[-_+.\w]+) (?<signature>[-_+.\w]+)/`.
+	
+See the section about multiple authentication secrets for a use-case and a comprehensive example.	
 
 ## Optional nonce
 
@@ -306,9 +326,7 @@ secrets allows us to implement multiple signing keys:
 							             access_key_id = strategy.parsed_auth_header["access_key_id"]
 							             keys[access_key_id]
 							           },
-							           :auth_header_format => '%{scheme} %{access_key_id} %{signature}',
-							           :auth_header_parse => /(?<scheme>\w+) (?<access_key_id>\w+) (?<signature>\w+)/
-							         }
+							           :auth_header_format => '%{scheme} %{access_key_id} %{signature}'							         }
     end
 
 This combination of settings uses a slightly different Format for the authorization header and transports the secret keys ID in the header of the form `HMAC KEY2 a59456da1f61f86e96622e283780f58b7428c892`

data/lib/hmac/strategies/base.rb

@@ -64,11 +64,12 @@ module Warden
            headers   
         end
   
-        # Retrieve a user from the database. Stub implementation that just returns true, needed for compat.
+        # Retrieve a user from the database. Calls the proc given in :retrieve_user, else returns true
         #
-        # @return [Bool] true
+        # @return [Mixed] The result of the configured proc, true is no proc was given
         def retrieve_user
-          true
+          @user ||= config[:retrieve_user].respond_to?(:call) ? config[:retrieve_user].call(self) : true
+          @user
         end
   
         # Log a debug message if a logger is available.
@@ -119,8 +120,40 @@ module Warden
             (config[:optional_headers] || []) + ["Content-MD5", "Content-Type"]
           end
           
+          def auth_header_format
+            config[:auth_header_format] || '%{scheme} %{signature}'
+          end
+          
           def auth_header_parse
-            config[:auth_header_parse] || /(?<scheme>\w+) (?<signature>\w+)/
+            unless @auth_header_parse
+              r = config[:auth_header_parse]
+              
+              if !r
+                # transforms the auth_header_format to a regular expression
+                # that allows [-_+.\w] for each of the segments in the format string
+                #
+                # '%{scheme} %{signature}' => /(?<scheme>[-_+.\w]+) (?<signature>[-_+.\w]+)/
+                #
+                split_re = /(?<!%)(%{[^}]+})/
+                replace_re = /(?<!%)%{([^}]+)}/
+	  
+          	    segments = auth_header_format.split split_re
+                segments.each_index do |i; md, key|
+                  md = replace_re.match(segments[i])
+                  if ! md.nil?
+                    key = md.captures[0].to_sym
+                    segments[i] = "(?<#{key}>[-_+.\\w]+)"
+                  else
+                    segments[i] = segments[i].gsub "%%", "%"
+                  end
+                end
+                r = Regexp.new segments.join
+              end
+              
+              @auth_header_parse = r
+            end
+            
+            @auth_header_parse
           end
     
           def lowercase_headers

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: warden-hmac-authentication
 version: !ruby/object:Gem::Version
-  version: 0.5.1
+  version: 0.5.2
   prerelease: 
 platform: ruby
 authors:
@@ -10,11 +10,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-12-13 00:00:00.000000000Z
+date: 2011-12-14 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: addressable
-  requirement: &2154689180 !ruby/object:Gem::Requirement
+  requirement: &2155925200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -22,10 +22,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2154689180
+  version_requirements: *2155925200
 - !ruby/object:Gem::Dependency
   name: rack
-  requirement: &2154688640 !ruby/object:Gem::Requirement
+  requirement: &2155924300 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -33,10 +33,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2154688640
+  version_requirements: *2155924300
 - !ruby/object:Gem::Dependency
   name: trollop
-  requirement: &2154688200 !ruby/object:Gem::Requirement
+  requirement: &2155923580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -44,10 +44,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2154688200
+  version_requirements: *2155923580
 - !ruby/object:Gem::Dependency
   name: warden
-  requirement: &2154687720 !ruby/object:Gem::Requirement
+  requirement: &2155922780 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -55,10 +55,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2154687720
+  version_requirements: *2155922780
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &2154687300 !ruby/object:Gem::Requirement
+  requirement: &2155922360 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -66,10 +66,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2154687300
+  version_requirements: *2155922360
 - !ruby/object:Gem::Dependency
   name: rack-test
-  requirement: &2154686860 !ruby/object:Gem::Requirement
+  requirement: &2155921780 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -77,10 +77,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2154686860
+  version_requirements: *2155921780
 - !ruby/object:Gem::Dependency
   name: riot
-  requirement: &2154686440 !ruby/object:Gem::Requirement
+  requirement: &2155921300 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -88,10 +88,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2154686440
+  version_requirements: *2155921300
 - !ruby/object:Gem::Dependency
   name: timecop
-  requirement: &2154671560 !ruby/object:Gem::Requirement
+  requirement: &2155920720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -99,10 +99,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2154671560
+  version_requirements: *2155920720
 - !ruby/object:Gem::Dependency
   name: simplecov
-  requirement: &2154670940 !ruby/object:Gem::Requirement
+  requirement: &2155920200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -110,10 +110,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2154670940
+  version_requirements: *2155920200
 - !ruby/object:Gem::Dependency
   name: simplecov-html
-  requirement: &2154670300 !ruby/object:Gem::Requirement
+  requirement: &2155919780 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -121,7 +121,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2154670300
+  version_requirements: *2155919780
 description: ! "This gem provides request authentication via [HMAC](http://en.wikipedia.org/wiki/Hmac).
   The main usage is request based, noninteractive\n  authentication for API implementations.
   Two strategies are supported that differ mainly in how the authentication information