Apache2-AuthenNTLM-Cookie
view release on metacpan or search on metacpan
use strict;
use warnings;
use Module::Build;
my $builder = Module::Build->new(
module_name => 'Apache2::AuthenNTLM::Cookie',
license => 'perl',
dist_author => 'Laurent Dami <la_____.da__@etat.ge.ch>',
dist_version_from => 'lib/Apache2/AuthenNTLM/Cookie.pm',
requires => {
'Apache2::RequestRec' => 0,
'Apache2::Request' => 0,
'Apache2::Cookie' => 0,
'Apache2::AuthenNTLM' => 0,
'Apache2::Directive' => 0,
'Digest::SHA1' => 0,
'MIME::Base64' => 0,
},
build_requires => {
'Test::More' => 0,
},
add_to_cleanup => [ 'Apache2-AuthenNTLM-Cookie-*' ],
);
$builder->create_build_script();
Revision history for Apache2-AuthenNTLM-Cookie
1.02 05.08.2010
Dropped inheritance from Apache2::AuthenNTLM
Directly deal with missing NTLM header, to avoid polluting error log
1.01 29.07.2010
Fix: APR::Request chokes on multipart/form-data with empty content
1.00 22.06.2010
Fixed bug on POST requests due to MSIE sending empty data
Build.PL
Changes
lib/Apache2/AuthenNTLM/Cookie.pm
MANIFEST
META.yml # Will be created by "make dist"
README
- 'Laurent Dami <la_____.da__@etat.ge.ch>'
build_requires:
Test::More: 0
configure_requires:
Module::Build: 0.36
generated_by: 'Module::Build version 0.3607'
license: perl
meta-spec:
url: http://module-build.sourceforge.net/META-spec-v1.4.html
version: 1.4
name: Apache2-AuthenNTLM-Cookie
provides:
Apache2::AuthenNTLM::Cookie:
file: lib/Apache2/AuthenNTLM/Cookie.pm
version: 1.02
requires:
Apache2::AuthenNTLM: 0
Apache2::Cookie: 0
Apache2::Directive: 0
Apache2::Request: 0
Apache2::RequestRec: 0
Digest::SHA1: 0
MIME::Base64: 0
resources:
license: http://dev.perl.org/licenses/
version: 1.02
Apache2-AuthenNTLM-Cookie
DESCRIPTION
This module extends L<Apache2::AuthenNTLM> with a cookie mechanism.
The parent module L<Apache2::AuthenNTLM> performs user authentication
via Microsoft's NTLM protocol; thanks to this mechanism, users are
automatically recognized from their Windows login, without having to
type a username and password. The server does not have to be a Windows
machine : it can be any platform, provided that it has access to a
Windows domain controller. On the client side, both Microsoft
Internet Explorer and Mozilla Firefox implement the NTLM protocol.
The NTLM handshake involves several packet exchanges, and furthermore
requires serialization through an internal semaphore. Therefore,
in order to improve performance, the present module saves the result
of that handshake in a cookie, so that the next request gets an
immediate answer.
A similar module was already published on CPAN for Apache1 / modperl1
(L<Apache::AuthCookieNTLM>). The present module is an implementation
for Apache2 / modperl2, and has a a different algorithm for cookie
generation, in order to prevent any attempt to forge a fake cookie.
INSTALLATION
To install this module, run the following commands:
perl Build.PL
./Build
./Build test
./Build install
SUPPORT AND DOCUMENTATION
After installing, you can find documentation for this module with the perldoc command.
perldoc Apache2::AuthenNTLM::Cookie
You can also look for information at:
Search CPAN
http://search.cpan.org/dist/Apache2-AuthenNTLM-Cookie
CPAN Request Tracker:
http://rt.cpan.org/NoAuth/Bugs.html?Dist=Apache2-AuthenNTLM-Cookie
AnnoCPAN, annotated CPAN documentation:
http://annocpan.org/dist/Apache2-AuthenNTLM-Cookie
CPAN Ratings:
http://cpanratings.perl.org/d/Apache2-AuthenNTLM-Cookie
COPYRIGHT AND LICENCE
Copyright (C) 2008 Laurent Dami
This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.
lib/Apache2/AuthenNTLM/Cookie.pm view on Meta::CPAN
# see doc at end of file
package Apache2::AuthenNTLM::Cookie;
use strict;
use warnings;
use Apache2::RequestRec ();
use Apache2::Request;
use Apache2::Cookie;
use Apache2::Directive ();
use Apache2::Const -compile => qw(OK HTTP_UNAUTHORIZED) ;
use Digest::SHA1 qw(sha1_hex);
use MIME::Base64 ();
use Apache2::AuthenNTLM;
our $VERSION = '1.02';
# constants from NTLM protocol
lib/Apache2/AuthenNTLM/Cookie.pm view on Meta::CPAN
my $self = bless {
request => $r,
secret => $r->dir_config('secret') || $class->default_secret,
refresh => $r->dir_config('refresh') || 14400, # in seconds
cookie_name => $r->dir_config('cookie_name') || 'NTLM_AUTHEN',
}, $class;
my $result;
# get the cookie
my $jar = Apache2::Cookie::Jar->new($r);
my $cookie = $jar->cookies($self->{cookie_name});
my $has_valid_cookie = $cookie && $self->validate_cookie($cookie->value);
# if cookie is present and valid
if ($has_valid_cookie) {
$result = Apache2::Const::OK;
# if MSIE "optimization" is activated, i.e. if this is a POST with an
# NTLM type1 message and without body ...
if ($r->method eq 'POST' && $self->has_empty_body && $self->is_NTLM_msg1) {
# ... then we must fake a type2 msg so that MSIE will post again
$r->log->debug("AuthenNTLM::Cookie: creating fake type2 msg");
$self->add_auth_header($self->fake_NTLM_msg2);
$result = Apache2::Const::HTTP_UNAUTHORIZED;
}
}
# otherwise (if cookie is absent or invalid)
else {
# if no NTLM message, directly ask for authentication (avoid calling
# Apache2::AuthenNTLM because it pollutes the error log)
if (!$self->get_NTLM_msg && $self->is_ntlmauthoritative) {
$self->ask_for_authentication;
$result = Apache2::Const::HTTP_UNAUTHORIZED;
}
# else invoke Apache2::AuthenNTLM to go through the NTLM handshake
else {
my $msg = $cookie ? "cookie invalidated" : "no cookie";
$r->log->debug("AuthenNTLM::Cookie: $msg, calling Apache2::AuthenNTLM");
$result = Apache2::AuthenNTLM->handler($r); # will set $r->user
# create the cookie if NTLM succeeded
$self->set_cookie if $result == Apache2::Const::OK;
}
}
return $result;
}
lib/Apache2/AuthenNTLM/Cookie.pm view on Meta::CPAN
my @cookie_args = (-name => $self->{cookie_name}, -value => $cookie_val);
# other cookie args may come from apache config
ARG:
foreach my $arg (qw/expires domain path/) {
my $val = $r->dir_config($arg) or next ARG;
push @cookie_args, -$arg => $val;
}
# send cookie
my $cookie = Apache2::Cookie->new($r, @cookie_args);
$cookie->bake($r);
$r->log->debug("AuthenNTLM::Cookie: baked cookie $cookie_val");
}
sub default_secret {
my ($class) = @_;
# default secret : mtime and i-node of Apache configuration file
my $config_file = Apache2::Directive::conftree->filename;
my ($mtime, $inode) = (stat $config_file)[9, 1];
return $mtime . $inode;
lib/Apache2/AuthenNTLM/Cookie.pm view on Meta::CPAN
sub is_ntlmauthoritative {
my $self = shift;
my $r = $self->{request};
my $config = $r->dir_config('ntlmauthoritative') || 'on';
return $config =~ /^(on|1)$/i;
}
1; # End of Apache2::AuthenNTLM::Cookie
__END__
=head1 NAME
Apache2::AuthenNTLM::Cookie - Store NTLM identity in a cookie
=head1 SYNOPSIS
<Location /my/secured/URL>
PerlAuthenHandler Apache2::AuthenNTLM::Cookie
AuthType ntlm
PerlAddVar ntdomain "domain primary_domain_controller other_controller"
... # see other configuration params in Apache2::AuthenNTLM
</Location>
=head1 DESCRIPTION
This module extends L<Apache2::AuthenNTLM> with a cookie mechanism.
The parent module L<Apache2::AuthenNTLM> performs user authentication
lib/Apache2/AuthenNTLM/Cookie.pm view on Meta::CPAN
Windows domain controller. On the client side, both Microsoft
Internet Explorer and Mozilla Firefox implement the NTLM protocol.
The NTLM handshake involves several packet exchanges, and furthermore
requires serialization through an internal semaphore. Therefore,
in order to improve performance, the present module saves the result
of that handshake in a cookie, so that the next request gets an
immediate answer.
A similar module was already published on CPAN for Apache1 / modperl1
(L<Apache::AuthCookieNTLM>). The present module is an implementation
for Apache2 / modperl2, and has a a different algorithm for cookie
generation, in order to prevent any attempt to forge a fake cookie.
Details about the NTLM authentication protocol can be found at
L<http://davenport.sourceforge.net/ntlm.html#ntlmHttpAuthentication>.
=head1 CONFIGURATION
Configuration directives for NTLM authentication are
just inherited from L<Apache2::AuthenNTLM>; see that module's
documentation. These are most probably all you need, namely
the minimal information for setting the handler,
specifying the C<AuthType> and specifying the names
of domain controllers :
<Location /my/secured/URL>
PerlAuthenHandler Apache2::AuthenNTLM::Cookie
AuthType ntlm
PerlAddVar ntdomain "domain primary_domain_controller other_controller"
</Location>
In addition to the inherited directives, some
optional C<PerlSetVar> directives
allow you to control various details of cookie generation :
PerlSetVar cookie_name my_cookie_name # default is NTLM_AUTHEN
PerlSetVar domain my_cookie_domain # default is none
PerlSetVar expires my_cookie_expires # default is none
PerlSetVar path my_cookie_path # default is none
PerlSetVar refresh some_seconds # default is 14400 (4 hours)
PerlSetVar secret my_secret_string # default from stat(config file)
See L<Apache2::Cookie> for explanation of variables
C<cookie_name>, C<domain>, C<expires>, and C<path>.
The only variables specific to the present module are
=over
=item refresh
This is the number of seconds after which the cookie becomes invalid
for authentication : it complements the C<expires> parameter. The
C<expires> value is a standard HTTP cookie mechanism which tells how
lib/Apache2/AuthenNTLM/Cookie.pm view on Meta::CPAN
=head1 AUTHOR
Laurent Dami, C<< <la_____.da__@etat.ge.ch> >>
=head1 BUGS
Please report any bugs or feature requests to
C<bug-apache2-authenntlm-cookie at rt.cpan.org>, or through the web
interface at
L<http://rt.cpan.org/NoAuth/ReportBug.html?Queue=Apache2-AuthenNTLM-Cookie>.
I will be notified, and then you'll automatically be notified of
progress on your bug as I make changes.
=head1 SUPPORT
You can find documentation for this module with the perldoc command.
perldoc Apache2::AuthenNTLM::Cookie
You can also look for information at:
=over 4
=item * AnnoCPAN: Annotated CPAN documentation
L<http://annocpan.org/dist/Apache2-AuthenNTLM-Cookie>
=item * CPAN Ratings
L<http://cpanratings.perl.org/d/Apache2-AuthenNTLM-Cookie>
=item * RT: CPAN's request tracker
L<http://rt.cpan.org/NoAuth/Bugs.html?Dist=Apache2-AuthenNTLM-Cookie>
=item * Search CPAN
L<http://search.cpan.org/dist/Apache2-AuthenNTLM-Cookie>
=back
=head1 TESTING NOTE
This module has no tests ... because I didn't manage to write
command-line tests that would successfully load the APR dynamic
libraries. Any hints welcome! Nevertheless, the module
has been successfully tested on Apache2.2/modperl2/solaris.
( run in 0.262 second using v1.01-cache-2.11-cpan-e9199f4ba4c )