Apache2-AuthTicketLDAP

 view release on metacpan or  search on metacpan

AuthTicketLDAP.pm  view on Meta::CPAN

package Apache2::AuthTicketLDAP;
BEGIN {
  $Apache2::AuthTicketLDAP::VERSION = '0.02';
}

# ABSTRACT: Cookie Based Access with LDAP Authentication

use strict;
use base qw(Apache2::AuthTicket);
use Apache2::Const qw(OK HTTP_FORBIDDEN);
use Apache2::ServerUtil;
use CHI;
use DBI;
use Digest::SHA qw/sha512_hex/;
use Net::LDAP;
use Net::LDAP::Entry; # Necessary to find methods for cached entries
use SQL::Abstract;

our (%DEFAULTS);
$DEFAULTS{'LDAPURL'} = 'ldap://ldap.example.com:389';
$DEFAULTS{'LDAPDN'} = 'dc=example,dc=com';
$DEFAULTS{'LDAPScope'} = 'sub';
$DEFAULTS{'LDAPFilter'} = 'uid=MYUSER';
$DEFAULTS{'TicketDBAutoCommit'} = 1;
$DEFAULTS{'TicketThreshold'} = 0;

our $_ldap_handle;
our $CACHE_ENTRY_DELIMITER = q{!/|*};

our $_ldap_entry_cache = CHI->new(
    driver     => 'FastMmap',
    root_dir   => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPCacheDir'),
    cache_size => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPCacheSize'),
    page_size => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPCachePageSize'),
    expire_time => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPCacheTTL'),
    namespace => 'LDAPCache',
);

our $_stmt_cache = CHI->new(
    driver     => 'FastMmap',
    root_dir   => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPCacheDir'),
    cache_size => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPStmtCacheSize'),
    page_size => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPStmtCachePageSize'),
    expire_time => Apache2::ServerUtil->server->dir_config('AuthTicketLDAPStmtCacheTTL'),
    namespace => 'StmtCache',
);

sub hash_for {
    my $self = shift;
    return Digest::SHA::sha512_hex(@_);
}

sub ldap {
    my ($self) = @_;
    if ($_ldap_handle && $_ldap_handle->socket->connected) {
        return $_ldap_handle;
    }
    # Get LDAP config from Apache
    my $ldapurl = $self->get_config('LDAPURL');
    # Query LDAP for user
    $_ldap_handle = Net::LDAP->new($ldapurl)
        or die "$@"; 
    return $_ldap_handle;
}

sub ldap_search {

AuthTicketLDAP.pm  view on Meta::CPAN

    my ($query, @bind) = $self->sql->update($table,
        {$ts_field   => $time},
        {$tick_field => $hash});

    eval {
        my $sth = $dbh->do($query, undef, @bind);
        $dbh->commit unless $dbh->{AutoCommit};
    };
    if ($@) {
        $dbh->rollback;
        die $@;
    }
}

# We do a local connection. Username/Password not required.
# Have to override to make this happen.
# Added configuration for setting AutoCommit Y/N
# Set isolation and lock mode options
sub dbi_connect {
    my $self = shift;

    my $r         = $self->request;
    my $auth_name = $r->auth_name;

    my ($db, $user, $pass, $autocomm) = map {
        $self->get_config($_)
    } qw/TicketDB TicketDBUser TicketDBPassword TicketDBAutoCommit/;

    my $dboptions = {};

    if (defined $autocomm && ($autocomm || $autocomm == 0)) {
        $dboptions->{AutoCommit} = $autocomm;
    }

    $user = $user eq 'test' ? undef $user : $user;
    $pass = $pass eq 'test' ? undef $pass : $pass;

    my $dbh = DBI->connect_cached($db, $user, $pass, $dboptions)
        or die "DBI Connect failure: ", DBI->errstr, "\n";

    my ($scheme, $driver) = DBI->parse_dsn($db)
        or die "DBI DSN parsing failure: ", DBI->errstr, "\n";

    if ($driver eq 'Informix') {
        $dbh->do('SET ISOLATION TO DIRTY READ')
            or die "SET ISOLATION failed: ", DBI->errstr, "\n";
        $dbh->do('SET LOCK MODE TO WAIT 2')
            or die "SET LOCK MODE failed: ", DBI->errstr, "\n";
    }

    return $dbh;
}

1;

=pod

=head1 NAME

Apache2::AuthTicketLDAP - Cookie Ticketing with LDAP Authentication

=head1 VERSION

version 0.02

=head1 SYNOPSIS

 The documentation is largely the same as I<Apache2::AuthTicket>, however, with 
 a few addenda. A typical installation will look like:

 # in httpd.conf
 PerlModule Apache2::AuthTicketLDAP
 PerlSetVar AuthCookieDebug 3 #Useful for debugging
 PerlSetVar AuthTicketLDAPCacheDir "/var/cache/apache"
 PerlSetVar AuthTicketLDAPCacheSize "4m"
 PerlSetVar AuthTicketLDAPCachePageSize "4096"
 PerlSetVar AuthTicketLDAPCacheTTL "10m"
 PerlSetVar AuthTicketLDAPStmtCacheSize "4m"
 PerlSetVar AuthTicketLDAPStmtCachePageSize "4096"
 PerlSetVar AuthTicketLDAPStmtCacheTTL "1m"
 PerlSetVar FooCookieName "MyCookie"
 PerlSetVar FooSatisfy any
 PerlSetVar FooTicketDB dbi:mysql:database=mschout;host=testbed
 PerlSetVar FooTicketDBAutoCommit 0
 PerlSetVar FooTicketDBUser test
 PerlSetVar FooTicketDBPassword secret
 PerlSetVar FooTicketTable tickets:ticket_hash:ts
 PerlSetVar FooTicketSecretTable ticket_secrets:sec_data:sec_version
 PerlSetVar FooTicketExpires 45
 PerlSetVar FooTicketIdleTimeout 30
 PerlSetVar FooTicketThreshold 60
 PerlSetVar FooTicketLogoutURI /foo/index.html
 PerlSetVar FooTicketLoginHandler /foologin
 PerlSetVar FooLoginScript /foologinform
 PerlSetVar FooPath /
 PerlSetVar FooDomain .foo.com
 PerlSetVar FooSecure 1
 PerlSetVar FooLDAPURL "ldap://ldap.foo.com:389"
 PerlSetVar FooLDAPDN "dc=foo,dc=com"
 PerlSetVar FooLDAPScope "one"
 PerlSetVar FooLDAPFilter "uid=MYUSER"

 <Location /foo>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     PerlAuthenHandler Apache2::AuthTicketLDAP->authenticate
     PerlAuthzHandler Apache2::AuthTicketLDAP->authorize
     require ldap_attribute allowedFoo=Yes
     require valid-user
 </Location>
 
 <Location /foologinform>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     SetHandler perl-script
     PerlResponseHandler Apache2::AuthTicketLDAP->login_screen
 </Location>

 # Or for a mod_perl script to handle logins, store /foologinform in here and 
 # change:  PerlSetVar FooLoginScript /my/path/cgi-bin/foologinform
 <Directory /my/path/cgi-bin>
     Options ExecCGI
     SetHandler perl-script
     PerlResponseHandler ModPerl::Registry
     PerlOptions +ParseHeaders
     AllowOverride none
     Order allow,deny
     Allow from all
 </Directory>
 
 <Location /foologin>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     SetHandler perl-script
     PerlResponseHandler Apache2::AuthTicketLDAP->login
 </Location>
 
 <Location /foo/logout>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     SetHandler perl-script

AuthTicketLDAP.pm  view on Meta::CPAN

There are four blocks that need to be entered into httpd.conf.  The first of
these is the block specifying your access restrictions.  This block should look
somrthing like this:

 <Location /foo>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     PerlAuthenHandler Apache2::AuthTicketLDAP->authenticate
     PerlAuthzHandler Apache2::AuthTicketLDAP->authorize
     require valid-user
     require ldap_attribute myAttrib=Foo
 </Location>

The remaining blocks control how to display the login form, and the login and
logout URLs.  These blocks should look similar to this:

 <Location /foologinform>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     SetHandler perl-script
     PerlResponseHandler Apache2::AuthTicketLDAP->login_screen
 </Location>
 
 # Or for a mod_perl script to handle logins, store /foologinform in here and 
 # change:  PerlSetVar FooLoginScript /my/path/cgi-bin/foologinform
 <Directory /my/path/cgi-bin>
     Options ExecCGI
     SetHandler perl-script
     PerlResponseHandler ModPerl::Registry
     PerlOptions +ParseHeaders
     AllowOverride none
     Order allow,deny
     Allow from all
 </Directory>

 <Location /foologin>
     AuthType    Apache2::AuthTicketLDAP
     AuthName    Foo
     SetHandler  perl-script
     PerlResponseHandler Apache2::AuthTicketLDAP->login
 </Location>
 
 <Location /foo/logout>
     AuthType Apache2::AuthTicketLDAP
     AuthName Foo
     SetHandler perl-script
     PerlResponseHandler Apache2::AuthTicketLDAP->logout
 </Location>

=head2 Apache Configuration - startup.pl

Any non-global I<Apache2::AuthTicketLDAP> configuration items can be set in
startup.pl. You can configure an AuthName like this:

 Apache2::AuthTicketLDAP->configure(String auth_name, *Hash config)

When configuring this way, you don't prefix the configuration items with the 
AuthName value like you do when using PerlSetVar directives.

You must still include I<Apache2::AuthCookie> configuration directives and
I<Apache2::AuthTicketLDAP> global variables in httpd.conf when configuring the
server this way.  These items include:

  * PerlSetVar FooPath /
  * PerlSetVar FooDomain .foo.com
  * PerlSetVar FooSecure 1
  * PerlSetVar FooLoginScript /foologinform
  * PerlSetVar AuthTicketLDAPCacheDir "/var/cache/apache"
  * PerlSetVar AuthTicketLDAPCacheSize "4m"
  * PerlSetVar AuthTicketLDAPCachePageSize "4096"
  * PerlSetVar AuthTicketLDAPCacheTTL "10m"
  * PerlSetVar AuthTicketLDAPStmtCacheSize "4m"
  * PerlSetVar AuthTicketLDAPStmtCachePageSize "4096"
  * PerlSetVar AuthTicketLDAPStmtCacheTTL "1m"

Example of configure():
 Apache2::AuthTicketLDAP->configure('Foo', {
     TicketDB            => 'DBI:mysql:database=test;host=foo',
     TicketDBUser        => 'mschout',
     TicketDBPassword    => 'secret',
     TicketTable         => 'tickets:ticket_hash:ts',
     TicketSecretTable   => 'ticket_secrets:sec_data:sec_version',
     TicketExpires       => '15',
     TicketLogoutURI     => '/foo/index.html',
     TicketLoginHandler  => '/foologin',
     TicketIdleTimeout   => 5,
     TicketThreshold     => 60,
     LDAPURL             => 'ldap://ldap.foo.com:389',
     LDAPDN              => 'dc=foo,dc=com',
     LDAPScope           => 'one',
     LDAPFilter          => 'uid=MYUSER',
     TicketDBAutoCommit  => 0,
 });

Configuration is the same as with I<Apache2::AuthTicket> and 
I<Apache2::AuthCookie>, though B<TicketUserTable> and B<TicketPasswordStyle>
are ignored.

The following directives are added by this module:

=over 3

=item B<TicketThreshold>

This directive tells the module to only update the database when a ticket 
timestamp is at least X seconds old. Reduces database updates.

 Example: 60
 Default: 0 (always update)
 Required: No

=item B<TicketDBAutoCommit>

This directive tells whether to start the database connection in AutoCommit 
mode or not.

 Example: 0
 Default: 1
 Required: No

=item B<AuthTicketLDAPCacheDir>

Set the file path of the cache directory to be used by I<CHI>. It is the same
for both the statement and LDAP entry caches.

 Example: /var/cache/apache
 Default: <none>
 Required: Yes

=item B<AuthTicketLDAPCacheSize>

Set the size of the LDAP entry cache. You can use 1k or 1m for kilobytes or 
megabytes, respectively.

 Example: 4m
 Default: <none>
 Required: Yes

=item B<AuthTicketLDAPCachePageSize>

Set the page size of the LDAP entry cache. In bytes.

 Example: 4096
 Default: <none>
 Required: Yes

=item B<AuthTicketLDAPCacheTTL>

Set the maximum time a cached LDAP entry is considered "good". You can use 1m,
1h, or 1d for minutes, hours, days, respectively. N.b., expired entries remain
in the cache. They are ignored until their space is needed.

 Example: 10m
 Default: <none>
 Required: Yes

AuthTicketLDAP.pm  view on Meta::CPAN

=item B<LDAPFilter>

Set the LDAP filter for searching. The text MYUSER will be replaced with the
supplied login name.

 Example: uid=MYUSER
 Default: uid=MYUSER
 Required: No

=back

=head2 Database Configuration

Only the tickets and secrets tables from I<Apache2::AuthTicket> are needed for
this module. Please refer to that module's documentation for detailed 
implementation details.

One important difference is that due to this module's usage of SHA512, the 
ticket size is 128.

The following is just a summary:

=over 3

=item B<tickets table>

 Example:

 CREATE TABLE tickets (
    ticket_hash CHAR(128) NOT NULL,
    ts          INT NOT NULL,
    PRIMARY KEY (ticket_hash)
 );

=item B<secrets table>

 Example:

 CREATE TABLE ticketsecrets (
     sec_version  SERIAL,
     sec_data     TEXT NOT NULL
 );

=back

=head1 METHODS

=over

=back

=head1 CREDITS

Many thanks to Michael Schout for writing I<Apache2::AuthTicket>. Additional 
thanks to St. Edward's University for providing the resources to write this 
module.

=head1 SEE ALSO

L<Apache2::AuthTicket>, L<Apache2::AuthCookie>, L<Net::LDAP>, L<CHI>, L<CHI::Driver::FastMmap>

=head1 AUTHOR

Stephen Olander-Waters <stephenw@stedwards.edu>

=head1 COPYRIGHT AND LICENSE

This software is copyright (c) 2012 by St. Edward's University.

This is free software; you can redistribute it and/or modify it under
the same terms as the Perl 5 programming language system itself.

=cut


__END__