Apache-AuthCookiePAM
view release on metacpan or search on metacpan
AuthCookiePAM.pm view on Meta::CPAN
#===============================================================================
#
# Apache::AuthCookiePAM
#
# An AuthCookie module backed by a PAM.
#
# Copyright (C) 2002 SF Interactive.
#
# Author: Vandana Awasthi
#
# This library is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
AuthCookiePAM.pm view on Meta::CPAN
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with this library; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
#
#===============================================================================
package Apache::AuthCookiePAM;
use strict;
use 5.004;
use vars qw( $VERSION );
( $VERSION ) = '$Revision: 1.0 $' =~ /([\d.]+)/;
use Apache;
use Apache::Table;
use Apache::Constants qw(:common M_GET FORBIDDEN REDIRECT);
use Apache::AuthCookie::Util;
use Apache::Util qw(escape_uri);
use Apache::AuthCookie;
use Authen::PAM;
use vars qw( @ISA );
@ISA = qw( Apache::AuthCookie );
use Apache::File;
use Digest::MD5 qw( md5_hex );
use Date::Calc qw( Today_and_Now Add_Delta_DHMS );
# Also uses Crypt::CBC if you're using encrypted cookies.
#===============================================================================
# F U N C T I O N D E C L A R A T I O N S
#===============================================================================
AuthCookiePAM.pm view on Meta::CPAN
}
}
}
#===============================================================================
# P E R L D O C
#===============================================================================
=head1 NAME
Apache::AuthCookiePAM - An AuthCookie module backed by a PAM .
=head1 VERSION
$Revision: 1.0 $
=head1 SYNOPSIS
# In httpd.conf or .htaccess
# This PerlSetVar MUST precede the PerlModule line because the
# key is read in a BEGIN block when the module is loaded.
PerlSetVar WhatEverPaM_SecretKeyFile /etc/httpd/acme.com.key
PerlSetVar WhatEverPAM_service login
PerlModule Apache::AuthCookiePAM
PerlSetVar WhatEverPath /
PerlSetVar WhatEverLoginScript /login.pl
# Optional, to share tickets between servers.
PerlSetVar WhatEverDomain .domain.com
PerlSetVar WhatEverChangePwdScript /changepwd.pl
# These are optional, the module sets sensible defaults.
PerlSetVar WhatEverPAM_SessionLifetime 00-24-00-00
# Protected by AuthCookiePAM.
<Directory /www/domain.com/authcookiepam>
AuthType Apache::AuthCookiePAM
AuthName WhatEver
PerlAuthenHandler Apache::AuthCookiePAM->authenticate
PerlAuthzHandler Apache::AuthCookiePAM->authorize
require valid-user
</Directory>
# Login location. *** DEBUG *** I still think this is screwy
<Files LOGIN>
AuthType Apache::AuthCookiePAM
AuthName WhatEver
SetHandler perl-script
PerlHandler Apache::AuthCookiePAM->login
</Files>
<Files ChangePwd>
AuthType Apache::AuthCookiePAM
AuthName WhatEver
SetHandler perl-script
PerlHandler Apache::AuthCookiePAM->changepwd
</Files>
=head1 DESCRIPTION
This module is an authentication handler that uses the basic mechanism
provided by Apache::AuthCookie with PAM (based on DBI) . It is based on
two tokens being provided, a username and password, which can be any
strings (there are no illegal characters for either). The username is
used to set the remote user as if Basic Authentication was used.
On an attempt to access a protected location without a valid cookie being
provided, the module prints an HTML login form (produced by a CGI or any
other handler; this can be a static file if you want to always send people
to the same entry page when they log in). This login form has fields for
username and password. On submitting it, the username and password are verfied
using PAM. If this succeeds, the user is issued a ticket. This ticket contains
AuthCookiePAM.pm view on Meta::CPAN
# P R I V A T E F U N C T I O N S
#===============================================================================
#-------------------------------------------------------------------------------
# _log_not_set -- Log that a particular authentication variable was not set.
sub _log_not_set($$)
{
my( $r, $variable ) = @_;
my $auth_name; $auth_name = $r->auth_name;
$r->log_error( "Apache::AuthCookiePAM: $variable not set for auth realm
$auth_name", $r->uri );
}
#-------------------------------------------------------------------------------
# _dir_config_var -- Get a particular authentication variable.
sub _dir_config_var($$)
{
my( $r, $variable ) = @_;
my $auth_name; $auth_name = $r->auth_name;
AuthCookiePAM.pm view on Meta::CPAN
=head1 APACHE CONFIGURATION DIRECTIVES
All configuration directives for this module are passed in PerlSetVars. These
PerlSetVars must begin with the AuthName that you are describing, so if your
AuthName is PrivateBankingSystem they will look like:
PerlSetVar ProvateBankingSystemLoginScript /bvsm/login.pl
See also L<Apache::Authcookie> for the directives required for any kind
of Apache::AuthCookie-based authentication system.
In the following descriptions, replace "WhatEver" with your particular
AuthName. The available configuration directives are as follows:
=over 4
=item C<WhatEverPAM_SecretKeyFile>
The file that contains the secret key (on the first line of the file). This
is required and has no default value. This key should be owned and only
AuthCookiePAM.pm view on Meta::CPAN
unless (
$c{ PAM_secretkeyfile } = _dir_config_var $r, 'PAM_SecretKeyFile'
) {
_log_not_set $r, 'PAM_SecretKeyFile';
return undef;
}
=item C<WhatEverPAM_SessionLifetime>
How long tickets are good for after being issued. Note that presently
Apache::AuthCookie does not set a client-side expire time, which means that
most clients will only keep the cookie until the user quits the browser.
However, if you wish to force people to log in again sooner than that, set
this value. This can be 'forever' or a life time specified as:
DD-hh-mm-ss -- Days, hours, minute and seconds to live.
This is not required and defaults to '00-24-00-00' or 24 hours.
=cut
AuthCookiePAM.pm view on Meta::CPAN
my( $self, $r, @credentials ) ;
( $self, $r, @credentials ) = @_;
my $auth_name; $auth_name = $r->auth_name;
my %c ; %c = _config_vars $r;
# Username goes in credential_0
my $user; $user = $credentials[ 0 ];
$user=~ tr/A-Z/a-z/;
unless ( $user =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no username supplied for auth realm $auth_name", $r->uri );
$r->subprocess_env('AuthenReason', 'No username provided. Try again.');
return undef;
}
# Password goes in credential_1
my $password; $password = $credentials[ 1 ];
unless ( $password =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no password supplied for auth realm $auth_name", $r->uri );
$r->subprocess_env('AuthenReason', 'No password provided. Try again.');
return undef;
}
# service to be used for authentication
my $service; $service = $c{PAM_service};
my ($pamh,$res,$funcref);
$funcref=create_conv_func($r,$user,$password);
ref($pamh = new Authen::PAM($service, $user,$funcref)) || die "Error code $pamh during PAM init!";
# call auth module to authenticate user
AuthCookiePAM.pm view on Meta::CPAN
# OK, now we stick the username and the current time and the expire
# time together to make the public part of the session key:
my $current_time; $current_time = _now_year_month_day_hour_minute_second;
my $public_part; $public_part = "$enc_user:$current_time:$expire_time";
# Now we calculate the hash of this and the secret key and then
# calculate the hash of *that* and the secret key again.
my $secret_key; $secret_key = $SECRET_KEYS{ $auth_name };
unless ( defined $secret_key ) {
$r->log_reason( "Apache::AuthCookiePAM: didn't have the secret key for auth realm $auth_name", $r->uri );
return 'bad';
}
my $hash ; $hash = md5_hex( join ':', $secret_key, md5_hex(
join ':', $public_part, $secret_key
) );
# Now we add this hash to the end of the public part.
my $session_key; $session_key = "$public_part:$hash";
# Now we encrypt this and return it.
AuthCookiePAM.pm view on Meta::CPAN
my( $self, $r, $encrypted_session_key ) = @_;
my $auth_name ; $auth_name = $r->auth_name;
# Get the configuration information.
my %c; %c = _config_vars $r;
# Get the secret key.
my $secret_key; $secret_key = $SECRET_KEYS{ $auth_name };
unless ( defined $secret_key ) {
$r->log_reason( "Apache::AuthCookiePAM: didn't the secret key from for auth realm $auth_name", $r->uri );
return undef;
}
# Decrypt the session key.
my $session_key;
if ( $c{ PAM_encryptiontype } eq 'none' ) {
$session_key = $encrypted_session_key;
} else {
# Check that this looks like an encrypted hex-encoded string.
unless ( $encrypted_session_key =~ /^[0-9a-fA-F]+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: encrypted session key $encrypted_session_key doesn't look like it's properly hex-encoded for auth realm $auth_name", $r->uri );
return undef;
}
# Get the cipher from the cache, or create a new one if the
# cached cipher hasn't been created, & decrypt the session key.
my $cipher;
if ( lc $c{ PAM_encryptiontype } eq 'des' ) {
$cipher = $CIPHERS{ "des:$auth_name" }
||= Crypt::CBC->new( $secret_key, 'DES' );
} elsif ( lc $c{ PAM_encryptiontype } eq 'idea' ) {
$cipher = $CIPHERS{ "idea:$auth_name" }
||= Crypt::CBC->new( $secret_key, 'IDEA' );
} elsif ( lc $c{ PAM_encryptiontype } eq 'blowfish' ) {
$cipher = $CIPHERS{ "blowfish:$auth_name" }
||= Crypt::CBC->new( $secret_key, 'Blowfish' );
} elsif ( lc $c{ PAM_encryptiontype } eq 'blowfish_pp' ) {
$cipher = $CIPHERS{ "blowfish_pp:$auth_name" }
||= Crypt::CBC->new( $secret_key, 'Blowfish_PP' );
} else {
$r->log_reason( "Apache::AuthCookiePAM: unknown encryption type $c{ PAM_encryptiontype } for auth realm $auth_name", $r->uri );
return undef;
}
$session_key = $cipher->decrypt_hex( $encrypted_session_key );
}
# Break up the session key.
my( $enc_user, $issue_time, $expire_time, $supplied_hash )
= split /:/, $session_key;
# Let's check that we got passed sensible values in the cookie.
unless ( $enc_user =~ /^[a-zA-Z0-9_\%]+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: bad percent-encoded user $enc_user recovered from session ticket for auth_realm $auth_name", $r->uri );
return undef;
}
# decode the user
my $user; $user = _percent_decode $enc_user;
unless ( $issue_time =~ /^\d{4}-\d{2}-\d{2}-\d{2}-\d{2}-\d{2}$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: bad issue time $issue_time recovered from ticket for user $user for auth_realm $auth_name", $r->uri );
return undef;
}
unless ( $expire_time =~ /^\d{4}-\d{2}-\d{2}-\d{2}-\d{2}-\d{2}$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: bad expire time $expire_time recovered from ticket for user $user for auth_realm $auth_name", $r->uri );
return undef;
}
unless ( $supplied_hash =~ /^[0-9a-fA-F]{32}$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: bad hash $supplied_hash recovered from ticket for user $user for auth_realm $auth_name", $r->uri );
return undef;
}
# Calculate the hash of the user, issue time, expire_time and
# the secret key and then the hash of that and the secret key again.
my $hash; $hash = md5_hex( join ':', $secret_key, md5_hex(
join ':', $enc_user, $issue_time, $expire_time, $secret_key
) );
# Compare it to the hash they gave us.
unless ( $hash eq $supplied_hash ) {
$r->log_reason( "Apache::AuthCookiePAM: hash in cookie did not match calculated hash of contents for user $user for auth realm $auth_name", $r->uri );
return undef;
}
# Check that their session hasn't timed out.
if ( _now_year_month_day_hour_minute_second gt $expire_time ) {
$r->log_reason( "Apache:AuthCookiePAM: expire time $expire_time has passed for user $user for auth realm $auth_name", $r->uri );
return undef;
}
# If we're being paranoid about timing-out long-lived sessions,
# check that the issue time + the current (server-set) session lifetime
# hasn't passed too (in case we issued long-lived session tickets
# in the past that we want to get rid of). *** DEBUG ***
# if ( lc $c{ PAM_AlwaysUseCurrentSessionLifetime } eq 'on' )
# They must be okay, so return the user.
AuthCookiePAM.pm view on Meta::CPAN
return REDIRECT;
}
sub _convert_to_get
{
my ($self, $r, $args) ;
($self, $r, $args) = @_;
return unless $r->method eq 'POST';
my $debug ; $debug = $r->dir_config("AuthCookieDebug") || 0;
$r->log_error("Converting POST -> GET") if $debug >= 2;
my @pairs ; @pairs =();
my ($name, $value);
while ( ($name, $value) = each %$args) {
# we dont want to copy login data, only extra data
next if $name eq 'destination'
or $name =~ /^credential_\d+$/;
AuthCookiePAM.pm view on Meta::CPAN
$r->method('GET');
$r->method_number(M_GET);
$r->headers_in->unset('Content-Length');
}
sub changepwd ($$)
{
my ($self, $r) ;
($self, $r) = @_;
my $debug; $debug = $r->dir_config("AuthCookieDebug") || 0;
my ($auth_type, $auth_name);
($auth_type, $auth_name) = ($r->auth_type, $r->auth_name);
my %args; %args = $r->method eq 'POST' ? $r->content : $r->args;
$self->_convert_to_get($r, \%args) if $r->method eq 'POST';
unless (exists $args{'destination'}) {
$r->log_error("No key 'destination' found in form data");
AuthCookiePAM.pm view on Meta::CPAN
return $auth_type->login_form;
}
$r->subprocess_env('AuthenReason', 'Password Change requested/required');
# Get the credentials from the data posted by the client
my @credentials;
#user in credential_0
my $user; $user = $args{"credential_0"};
$user=~ tr/A-Z/a-z/;
unless ( $user =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no username supplied for auth realm $auth_name", $r->uri );
}
# Old Password goes in credential_1
my $oldpassword; $oldpassword = $args{"credential_1"};
unless ( $oldpassword =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no password supplied ", $r->uri );
}
# New Password goes in credential_2
my $newpassword ; $newpassword = $args{"credential_2"};
unless ( $newpassword =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no password supplied ", $r->uri );
}
# Repeat Password goes in credential_3
my $confirmpassword; $confirmpassword = $args{"credential_3"};
unless ( $confirmpassword =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: passwords don't match", $r->uri );
}
# Now do password change
#
my ($pamh,$res);
my $funcref;
$funcref=create_conv_func($r,$user,$oldpassword,$newpassword,$confirmpassword);
my %c; %c = _config_vars $r;
my $service; $service = $c{PAM_service};
ref($pamh = new Authen::PAM($service, $user,$funcref)) || die "Error code $pamh during PAM init!";
$res = $pamh->pam_chauthtok();
$pamh=0;
undef $pamh;
if ( $res == PAM_SUCCESS()) {
$r->subprocess_env('AuthenReason', 'Password Updated. Please login with your new password');
$r->log_reason("AuthenCookiePAM:". $args{'destination'}."Password for $user Updated. Please login with your new password");
#
$auth_type->logout($r);
$r->err_header_out("Location" => $args{'destination'});
return REDIRECT;
}
else {
$r->subprocess_env('AuthenReason', "Password Not Updated. New password did not satisfy specified rules or failed authentication");
$r->log_reason("AuthenCookiePAM: Password for $user Not Updated. ");
return $auth_type->changepwd_form($user);
}
}
#-------------------------------------------------------------------------------
# Take a list of groups and make sure that the current remote user is a member
# of one of them.
__END__
AuthCookiePAM.pm view on Meta::CPAN
License along with this library; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
=head1 AUTHOR
Vandana Awasthi
=head1 SEE ALSO
Apache::AuthCookie(1)
=cut
Revision history for Perl extension Apache::AuthCookieDBI.
1.00 Mon Feb 13 10:00:00 2006
- original version;
AuthCookiePAM.pm
Changes
MANIFEST
README
LICENSE
Makefile.PL
test.pl
generic_reg_auth_scheme.txt
techspec.txt
schema.sql
eg/html/login.html
Makefile.PL view on Meta::CPAN
use ExtUtils::MakeMaker;
# See lib/ExtUtils/MakeMaker.pm for details of how to influence
# the contents of the Makefile that is written.
WriteMakefile(
'NAME' => 'Apache::AuthCookiePAM',
'VERSION_FROM' => 'AuthCookiePAM.pm', # finds $VERSION
);
Apache::AuthCookiePAM is a module that subclasses Apache::AuthCookie and is
designed to be directly used for authentication in a mod_perl server.
It is a ticket-issuing system that looks up username/passwords usin PAM
issues MD5-checksummed tickets valid for a configurable time period.
Incoming requests with tickets are checksummed and expire-time checked.
eg/public-pl/changepwd.pl view on Meta::CPAN
my $t = new Text::TagTemplate;
my $r = Apache->request();
my $destination;
my $authcookiereason;
if ( $r->prev() ) { # we are called as a subrequest.
$destination = $r->prev()->args()
? $r->prev()->uri() . '?' . $r->prev->args()
: $r->prev()->uri();
$authcookiereason = $r->prev()->subprocess_env( 'AuthCookieReason' );
} else {
$destination = $r->args( 'destination' );
$authcookiereason = $r->args( 'AuthCookieReason' );
}
$t->add_tag( DESTINATION => $destination );
$t->template_file( "../html/changepwd.html" );
$r->send_http_header;
print $t->parse_file unless $r->header_only;
eg/public-pl/login.pl view on Meta::CPAN
my $t = new Text::TagTemplate;
my $r = Apache->request();
my $destination;
my $authcookiereason;
if ( $r->prev() ) { # we are called as a subrequest.
$destination = $r->prev()->args()
? $r->prev()->uri() . '?' . $r->prev->args()
: $r->prev()->uri();
$authcookiereason = $r->prev()->subprocess_env( 'AuthCookieReason' );
} else {
$destination = $r->args( 'destination' );
$authcookiereason = $r->args( 'AuthCookieReason' );
}
$t->add_tag( DESTINATION => $destination );
unless ( $authcookiereason eq 'bad_cookie' ) {
$t->template_file( "../html/login.html" );
} else {
$t->template_file( "../html/login-failed.html" );
}
$r->send_http_header;
techspec.txt view on Meta::CPAN
$Id: techspec.txt,v 1.2 2000/04/05 19:02:49 jacob Exp $
Apache::AuthCookiePAM Technical Specification
* Description.
This module will allow cookie-based authentication backed by PAM,
using usernames and passwords for authentication.
* Authentication.
Authentication is based on a username and password. These are supplied in
plaintext by the user in a form submission through Apache::AuthCookie. These
are then passed on to the pam sytem.
* Account Management
When a user successfully authenticates A call to Pam account management is
made to check if the account is allowed to get access to the system. The
account could be locked or requires to change password.
If account is locked user is prompted to login again. If the account requires
a new password then the user is presented with the specified password change form.
# Before `make install' is performed this script should be runnable with
# `make test'. After `make install' it should work as `perl test.pl'
######################### We start with some black magic to print on failure.
# Change 1..1 below to 1..last_test_to_print .
# (It may become useful if the test is moved to ./t subdirectory.)
BEGIN { $| = 1; print "1..1\n"; }
END {print "not ok 1\n" unless $loaded;}
use Apache::AuthCookiePAM;
$loaded = 1;
print "ok 1\n";
######################### End of black magic.
# Insert your test code below (better if it prints "ok 13"
# (correspondingly "not ok 13") depending on the success of chunk 13
# of the test code):
( run in 1.593 second using v1.01-cache-2.11-cpan-e9199f4ba4c )