whimsy-asf 0.0.24 → 0.0.25

data/asf.version

@@ -1 +1 @@
-0.0.24
+0.0.25

data/lib/whimsy/asf/ldap.rb

@@ -2,38 +2,22 @@ require 'wunderbar'
 require 'ldap'
 
 module ASF
-
   # determine whether or not the LDAP API can be used
   def self.init_ldap
     @ldap = nil
 
-    config = ASF::Config.get(:ldap)
+    host = ASF::LDAP.host
 
-    unless config
-      conf = '/etc/ldap/ldap.conf'
-      if File.exist? conf
-        config = File.read(conf)[/^uri\s+(ldaps?:\/\/\S+?:\d+)/i, 1]
-      end
-    end
-
-    unless config
-      # https://www.pingmybox.com/dashboard?location=304
-      config = %w(ldaps://ldap1-us-west.apache.org:636
-        ldaps://ldap1-eu-central.apache.org:636
-        ldaps://ldap2-us-west.apache.org:636
-        ldaps://ldap1-us-east.apache.org:636).sample
-    end
-
-    Wunderbar.info "Connecting to LDAP server: #{config}"
+    Wunderbar.info "Connecting to LDAP server: #{host}"
 
     begin
-      uri = URI.parse(config)
+      uri = URI.parse(host)
       if uri.scheme == 'ldaps'
-        @ldap = LDAP::SSLConn.new(uri.host, uri.port)
+        @ldap = ::LDAP::SSLConn.new(uri.host, uri.port)
       else
-        @ldap = LDAP::Conn.new(uri.host, uri.port)
+        @ldap = ::LDAP::Conn.new(uri.host, uri.port)
       end
-    rescue LDAP::ResultError=>re
+    rescue ::LDAP::ResultError=>re
       Wunderbar.error "Error binding to LDAP server: message: ["+ re.message + "]"
     end
   end
@@ -47,7 +31,7 @@ module ASF
       "#{[attrs].flatten.join(' ')}"
     
     begin
-      result = @ldap.search2(base, LDAP::LDAP_SCOPE_ONELEVEL, filter, attrs)
+      result = @ldap.search2(base, ::LDAP::LDAP_SCOPE_ONELEVEL, filter, attrs)
     rescue
       result = []
     end
@@ -176,6 +160,10 @@ module ASF
       ASF::Member.status[name] or ASF.members.include? self
     end
 
+    def asf_committer?
+       ASF::Group.new('committers').include? self
+    end
+
     def banned?
       not attrs['loginShell'] or attrs['loginShell'].include? "/usr/bin/false"
     end
@@ -212,6 +200,15 @@ module ASF
       ASF.search_one(base, filter, 'cn').flatten.map {|cn| find(cn)}
     end
 
+    def include?(person)
+      filter = "(&(cn=#{name})(memberUid=#{person.name}))"
+      if ASF.search_one(base, filter, 'cn').empty?
+        return false
+      else
+        return true
+      end
+    end
+
     def members
       ASF.search_one(base, "cn=#{name}", 'memberUid').flatten.
         map {|uid| Person.find(uid)}
@@ -243,4 +240,57 @@ module ASF
         map {|uid| Person.find uid[/uid=(.*?),/,1]}
     end
   end
+
+  module LDAP
+    # select LDAP host
+    def self.host
+      # try whimsy config
+      host = ASF::Config.get(:ldap)
+
+      # check system configuration
+      unless host
+        conf = '/etc/ldap/ldap.conf'
+        if File.exist? conf
+        host = File.read(conf)[/^uri\s+(ldaps?:\/\/\S+?:\d+)/i, 1]
+        end
+      end
+
+      # if all else fails, pick one at random
+      unless host
+        # https://www.pingmybox.com/dashboard?location=304
+        host = %w(ldaps://ldap1-us-west.apache.org:636
+          ldaps://ldap1-eu-central.apache.org:636
+          ldaps://ldap2-us-west.apache.org:636
+          ldaps://ldap1-us-east.apache.org:636).sample
+      end
+
+      host
+    end
+
+    # query and extract cert from openssl output
+    def self.cert
+      host = LDAP.host[%r{//(.*?)(/|$)}, 1]
+      query = "openssl s_client -connect #{host} -showcerts"
+      output = `#{query} < /dev/null 2> /dev/null`
+      output[/^-+BEGIN.*?\n-+END[^\n]+\n/m]
+    end
+
+    # update /etc/ldap.conf. Usage:
+    #   sudo ruby -r whimsy/asf -e "ASF::LDAP.configure"
+    def self.configure
+      if not File.exist? "/etc/ldap/asf-ldap-client.pem"
+        File.write "/etc/ldap/asf-ldap-client.pem", self.cert
+      end
+
+      ldap_conf = '/etc/ldap/ldap.conf'
+      content = File.read(ldap_conf)
+      unless content.include? 'asf-ldap-client.pem'
+        content.gsub!(/^TLS_CACERT/, '# TLS_CACERT')
+        content += "TLS_CACERT /etc/ldap/asf-ldap-client.pem\n"
+        content += "uri #{LDAP.host}\n"
+        content += "base dc=apache,dc=org\n"
+        File.write(ldap_conf, content)
+      end
+    end
+  end
 end

data/lib/whimsy/asf/rack.rb

@@ -17,7 +17,7 @@ module ASF
     }
 
     # decode HTTP authorization, when present
-    def self.decode(env, user)
+    def self.decode(env)
       class << env; attr_accessor :user, :password; end
 
       if env['HTTP_AUTHORIZATION']
@@ -25,25 +25,25 @@ module ASF
         env.user, env.password = Base64.decode64(env['HTTP_AUTHORIZATION'][
           /^Basic ([A-Za-z0-9+\/=]+)$/,1]).split(':',2)
       else
-        env.user = user
+        env.user = env['REMOTE_USER'] ||= ENV['USER'] || Etc.getpwuid.name
       end
+
+      ASF::Person.new(env.user)
     end
 
     # Simply 'use' the following class in config.ru to limit access
     # to the application to ASF committers
     class Committers < Rack::Auth::Basic
       def initialize(app)
-        super(app, "ASF Members and Officers", &proc {})
+        super(app, "ASF Committers", &proc {})
       end
 
       def call(env)
         authorized = ( ENV['RACK_ENV'] == 'test' )
 
-        user = env['REMOTE_USER'] ||= ENV['USER'] || Etc.getpwuid.name
-        authorized ||= ASF::Person.new(user)
+        authorized ||= ASF::Auth.decode(env).asf_committer?
 
         if authorized
-          ASF::Auth.decode(env, user)
           @app.call(env)
         else
           unauthorized
@@ -61,21 +61,19 @@ module ASF
       def call(env)
         authorized = ( ENV['RACK_ENV'] == 'test' )
 
-        user = env['REMOTE_USER'] ||= ENV['USER'] || Etc.getpwuid.name
-        person = ASF::Person.new(user)
+        person = ASF::Auth.decode(env)
 
-        authorized ||= DIRECTORS[user]
+        authorized ||= DIRECTORS[env.user]
         authorized ||= person.asf_member?
         authorized ||= ASF.pmc_chairs.include? person
 
         if not authorized
           accounting = ASF::Authorization.new('pit').
             find {|group, list| group=='accounting'}
-          authorized = (accounting and accounting.last.include? user)
+          authorized = (accounting and accounting.last.include? env.user)
         end
 
         if authorized
-          ASF::Auth.decode(env, user)
           @app.call(env)
         else
           unauthorized

metadata

@@ -2,7 +2,7 @@
 name: whimsy-asf
 version: !ruby/object:Gem::Version
   prerelease: 
-  version: 0.0.24
+  version: 0.0.25
 platform: ruby
 authors:
 - Sam Ruby