Apache-AuthCookiePAM
view release on metacpan or search on metacpan
AuthCookiePAM.pm view on Meta::CPAN
AuthType Apache::AuthCookiePAM
AuthName WhatEver
SetHandler perl-script
PerlHandler Apache::AuthCookiePAM->changepwd
</Files>
=head1 DESCRIPTION
This module is an authentication handler that uses the basic mechanism
provided by Apache::AuthCookie with PAM (based on DBI) . It is based on
two tokens being provided, a username and password, which can be any
strings (there are no illegal characters for either). The username is
used to set the remote user as if Basic Authentication was used.
On an attempt to access a protected location without a valid cookie being
provided, the module prints an HTML login form (produced by a CGI or any
other handler; this can be a static file if you want to always send people
to the same entry page when they log in). This login form has fields for
username and password. On submitting it, the username and password are verfied
using PAM. If this succeeds, the user is issued a ticket. This ticket contains
the username, an issue time, an expire time, and an MD5 checksum of those and a
secret key for the server. It can optionally be encrypted before returning it
to the client in the cookie;
encryption is only useful for preventing the client from seeing the expire
time. If you wish to protect passwords in transport, use an SSL-encrypted
connection. The ticket is given in a cookie that the browser stores.
After a login the user is redirected to the location they originally wished
to view (or to a fixed page if the login "script" was really a static file).
On this access and any subsequent attempt to access a protected document, the
browser returns the ticket to the server. The server unencrypts it if
encrypted tickets are enabled, then extracts the username, issue time, expire
time and checksum. A new checksum is calculated of the username, issue time,
expire time and the secret key again; if it agrees with the checksum that
AuthCookiePAM.pm view on Meta::CPAN
=cut
$c{ PAM_sessionlifetime }
= _dir_config_var( $r, 'PAM_SessionLifetime' ) || '00-24-00-00';
=item C<WhatEverPAM_EncryptionType>
What kind of encryption to use to prevent the user from looking at the fields
in the ticket we give them. This is almost completely useless, so don't
switch it on unless you really know you need it. It does not provide any
protection of the password in transport; use SSL for that. It can be 'none',
'des', 'idea', 'blowfish', or 'blowfish_pp'.
This is not required and defaults to 'none'.
=cut
$c{ PAM_encryptiontype } = _dir_config_var( $r, 'PAM_EncryptionType' )
|| 'none';
# If we used encryption we need to pull in Crypt::CBC.
if ( $c{ PAM_encryptiontype } ne 'none' ) {
AuthCookiePAM.pm view on Meta::CPAN
# Username goes in credential_0
my $user; $user = $credentials[ 0 ];
$user=~ tr/A-Z/a-z/;
unless ( $user =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no username supplied for auth realm $auth_name", $r->uri );
$r->subprocess_env('AuthenReason', 'No username provided. Try again.');
return undef;
}
# Password goes in credential_1
my $password; $password = $credentials[ 1 ];
unless ( $password =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no password supplied for auth realm $auth_name", $r->uri );
$r->subprocess_env('AuthenReason', 'No password provided. Try again.');
return undef;
}
# service to be used for authentication
my $service; $service = $c{PAM_service};
my ($pamh,$res,$funcref);
$funcref=create_conv_func($r,$user,$password);
ref($pamh = new Authen::PAM($service, $user,$funcref)) || die "Error code $pamh during PAM init!";
# call auth module to authenticate user
$res = $pamh->pam_authenticate;
$funcref=0;
if ( $res != PAM_SUCCESS()) {
$r->log_error("ERROR: Authentication for $user Failed\n");
$r->subprocess_env('AuthenReason', 'Authentication failed. Username/Password provided incorrect.');
$pamh=0;
undef $pamh;
AuthCookiePAM.pm view on Meta::CPAN
}
else { # Now check if account is valid
$res = $pamh->pam_acct_mgmt();
if ( $res == PAM_ACCT_EXPIRED() ) {
$r->log_error("ERROR: Account for $user is locked. Contact your Administrator.\n");
$r->subprocess_env('AuthenReason', 'Account for $user is locked. Contact your Administrator.');
return 'bad';
}
if ( $res == PAM_NEW_AUTHTOK_REQD() ) {
$r->log_error("ERROR: PAssword for $user expired. Change Password\n");
$r->subprocess_env('AuthenReason', 'Password Expired. Please Change your password.');
return $r->auth_type->changepwd_form ($user);
}
if ( $res == PAM_SUCCESS() ) {
# Create the expire time for the ticket.
my $expire_time;
# expire time in a zillion years if it's forever.
if ( lc $c{ PAM_sessionlifetime } eq 'forever' ) {
$expire_time = '9999-01-01-01-01-01';
} else {
my( $deltaday, $deltahour, $deltaminute, $deltasecond ) = split /-/, $c{ PAM_sessionlifetime };
AuthCookiePAM.pm view on Meta::CPAN
}
$pamh=0;
undef $pamh;
return $encrypted_session_key;
}
}
}
#-------------------------------------------------------------------------------
# Conversation function for PAM - authentication and change of password
sub create_conv_func
{
my ($r,$user,$pass,$newpass,$confpass);
($r,$user,$pass,$newpass,$confpass) = @_;
my $state; $state = 0;
return sub {
my (@res);
while ( @_ )
AuthCookiePAM.pm view on Meta::CPAN
# Get the credentials from the data posted by the client
my @credentials;
#user in credential_0
my $user; $user = $args{"credential_0"};
$user=~ tr/A-Z/a-z/;
unless ( $user =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no username supplied for auth realm $auth_name", $r->uri );
}
# Old Password goes in credential_1
my $oldpassword; $oldpassword = $args{"credential_1"};
unless ( $oldpassword =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no password supplied ", $r->uri );
}
# New Password goes in credential_2
my $newpassword ; $newpassword = $args{"credential_2"};
unless ( $newpassword =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: no password supplied ", $r->uri );
}
# Repeat Password goes in credential_3
my $confirmpassword; $confirmpassword = $args{"credential_3"};
unless ( $confirmpassword =~ /^.+$/ ) {
$r->log_reason( "Apache::AuthCookiePAM: passwords don't match", $r->uri );
}
# Now do password change
#
my ($pamh,$res);
my $funcref;
$funcref=create_conv_func($r,$user,$oldpassword,$newpassword,$confirmpassword);
my %c; %c = _config_vars $r;
my $service; $service = $c{PAM_service};
ref($pamh = new Authen::PAM($service, $user,$funcref)) || die "Error code $pamh during PAM init!";
$res = $pamh->pam_chauthtok();
$pamh=0;
undef $pamh;
if ( $res == PAM_SUCCESS()) {
$r->subprocess_env('AuthenReason', 'Password Updated. Please login with your new password');
$r->log_reason("AuthenCookiePAM:". $args{'destination'}."Password for $user Updated. Please login with your new password");
#
$auth_type->logout($r);
$r->err_header_out("Location" => $args{'destination'});
return REDIRECT;
}
else {
$r->subprocess_env('AuthenReason', "Password Not Updated. New password did not satisfy specified rules or failed authentication");
$r->log_reason("AuthenCookiePAM: Password for $user Not Updated. ");
return $auth_type->changepwd_form($user);
}
}
#-------------------------------------------------------------------------------
# Take a list of groups and make sure that the current remote user is a member
# of one of them.
__END__
Apache::AuthCookiePAM is a module that subclasses Apache::AuthCookie and is
designed to be directly used for authentication in a mod_perl server.
It is a ticket-issuing system that looks up username/passwords usin PAM
issues MD5-checksummed tickets valid for a configurable time period.
Incoming requests with tickets are checksummed and expire-time checked.
techspec.txt view on Meta::CPAN
$Id: techspec.txt,v 1.2 2000/04/05 19:02:49 jacob Exp $
Apache::AuthCookiePAM Technical Specification
* Description.
This module will allow cookie-based authentication backed by PAM,
using usernames and passwords for authentication.
* Authentication.
Authentication is based on a username and password. These are supplied in
plaintext by the user in a form submission through Apache::AuthCookie. These
are then passed on to the pam sytem.
* Account Management
When a user successfully authenticates A call to Pam account management is
made to check if the account is allowed to get access to the system. The
account could be locked or requires to change password.
If account is locked user is prompted to login again. If the account requires
a new password then the user is presented with the specified password change form.
* Tickets.
When a user successfully authenticates, they are issued a cookie with a
session value. This value consists of a serialized version of
the userid, an issue time, an expiration date, and a two-round MD5 checksum
of the userid and times and a server secret key. This checksum
ensures that when the ticket is returned we can see that it has not been
tampered with since in order to generate the checksum you must have the secret
( run in 0.949 second using v1.01-cache-2.11-cpan-49f99fa48dc )