view release on metacpan or  search on metacpan

lib/Apache/AuthCASSimple.pm  view on Meta::CPAN

package Apache::AuthCASSimple;

use strict;
use warnings;

use Apache::Constants qw(:common :response M_GET);
use Apache::ModuleConfig;
use Apache::Log;
use Apache::Session::Wrapper;
use DynaLoader ();
use Authen::CAS::Client;
use vars qw($VERSION);

$VERSION = '0.0.4';

if($ENV{MOD_PERL}) {
  no strict;
  @ISA = qw(DynaLoader);
  __PACKAGE__->bootstrap($VERSION);
}

#
# handler()
#
# Called by apache/mod_perl
#
sub handler ($) {
  my $r = shift;
  my $log = $r->log();


  # does it need to do something ?
  return DECLINED unless($r->auth_type() eq __PACKAGE__);

  $log->info(__PACKAGE__.": Entering into authentification process.:".$r->uri() ."--".$r->args());

  # Get module config (Apache directive values)
  my $cfg = Apache::ModuleConfig->get($r, __PACKAGE__);


  # Check for internal session
  my $user;
  if($cfg->{_cas_session_timeout} >= 0 && ($user = _get_user_from_session($r))) {
    $log->info(__PACKAGE__.": Session found for user $user.");
    $r->connection->user($user);
    return OK;
  }
  elsif($cfg->{_cas_session_timeout} >= 0) {
    $log->info(__PACKAGE__.": No session found.");
  }
  else {
    $log->info(__PACKAGE__.": Session disabled.");
  }

  # instance CAS object
  my ($cas, %options);
  $options{casUrl} = ($cfg->{_cas_ssl} ? 'https://' : 'http://').$cfg->{_cas_name}.':'.$cfg->{_cas_port}.$cfg->{_cas_path};
 # $options{CAFile} = $cfg->{_ca_file} if ($cfg->{_cas_ssl});

  unless($cas = Authen::CAS::Client->new($options{casUrl}, fatal => 1)) {
    $log->error(__PACKAGE__.": Unable to create CAS instance.");
    return SERVER_ERROR;
  }

  my $requested_url = _get_requested_url($r,$cfg);
  my $login_url = $requested_url;
  # TODO better clean url
  $login_url =~ s/\?/\&/;
  $login_url = $cas->login_url().$login_url;

  # redirect to CAS server unless ticket parameter
  my %args = $r->args();
  unless ($args{ticket}) {
    $log->info(__PACKAGE__.": No ticket, client redirected to CAS server.");
    $r->err_header_out("Location" => $login_url);
    return REDIRECT;
  }


  # Validate the ticket we received
  if ($args{ticket}=~/^PT/) {
      my $r = $cas->proxy_validate( $requested_url, $args{ticket} );
        if( $r->is_success() ) {
            $user=$r->user();
            $log->warn(__PACKAGE__.": Validate PT on CAS Proxy server. ".join ",", $r->proxies());
        };
  }
  else {
      my $r = $cas->service_validate( $requested_url, $args{ticket} );
      if ( $r->is_success() ) {
        $user = $r->user();
      }
  }

  unless ($user) {
    $log->warn(__PACKAGE__.": Unable to validate ticket ".$args{ticket}." on CAS server.");
    $r->err_header_out("Location" => $login_url);
    return REDIRECT;
    #return FORBIDDEN;
  }

  $log->info(__PACKAGE__.": Ticket ".$args{ticket}." succesfully validated.");

  if ( $user ) {
   $r->connection->user($user);

   $log->info(__PACKAGE__.": New session ".$r->uri() ."--".$r->args());

   # if we are there (and timeout is set), we can create session data and cookie
   _remove_ticket($r);
   _create_user_session($r) if($cfg->{_cas_session_timeout} >= 0);
   $r->err_header_out("Location" => $r->uri . ($r->args ? '?' . $r->args : '') );
   # if session, redirect remove ticket in url
   return ($cfg->{_cas_session_timeout}  >= 0)?REDIRECT:OK;
  }

  return FORBIDDEN;

lib/Apache/AuthCASSimple.pm  view on Meta::CPAN

    #$r->log()->info(__PACKAGE__.":CCCCIDIDIDID:".$s->{'session_id'});
  unless ($s) {
    $r->log()->warn(__PACKAGE__.": Unable to create session for ".$r->connection->user().".");
    return;
  }

  $s->session->{'CASUser'} = $r->connection->user();
  my $ip = ($cfg->{_mod_proxy})?$r->header_in('X-Forwarded-For'):$r->connection->remote_ip();
  $s->session->{'CASIP'} = $ip;
  $s->session->{'time'} = time();

};

#
# CASServerName()
#
# Callback for CASServerName apache directive
#
sub CASServerName ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CAS Server name $arg." unless ($arg =~ m/^(.+)$/);

  $cfg->{_cas_name} = $arg;
}

#
# CASServerPath()
#
# Callback for CASServerPath apache directive
#
sub CASServerPath ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CAS Server path $arg." unless ($arg =~ m/^\//);

  $arg = '' if $arg eq '/';
  $cfg->{_cas_path} = $arg;

}

#
# CASServerPort()
#
# Callback for CASServerPort apache directive
#
sub CASServerPort ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CAS Server port $arg." unless ($arg =~ m/^\d+$/);

  $cfg->{_cas_port} = $arg;
}

#
# CASServerNoSSL()
#
# Callback for CASServerNoSSL apache directive
#
sub CASServerNoSSL ($$) {
  shift->{_cas_ssl} = 0;
}


#
# CASSessionTimeout()
#
# Callback for CASSessionTimeout apache directive
#
sub CASSessionTimeout ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CAS session timeout $arg." unless ($arg =~ m/^-?\d+$/);

  $cfg->{_cas_session_timeout} = $arg;
}

#
# CASSessionDirectory()
#
# Callback for CASSessionTimeout apache directive
#
sub CASSessionDirectory ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CAS session directory $arg (does not exist or is not writable)." unless (-d $arg && -w $arg);

  $cfg->{_cas_session_dir} = $arg;
}

#
# CASCaFile()
#
# Callback for CASCaFile apache directive
#
sub CASCaFile ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CA file $arg." unless (-e $arg);

  $cfg->{_ca_file} = $arg;
}
#
# CASFixDirectory()
#
# Callback for CASFixDirectory apache directive
#
sub CASFixDirectory ($$$) {
  my ($cfg, $parms, $arg) = @_;

  die "Invalid CAS fix directory directive, path must begin with '/'." unless ($arg && $arg =~ m/^\//);

  $cfg->{_cas_cookie_path} = $arg;
}
#
# NOModProxy()
#
# Callback for NOModProxy apache directive
#
sub NOModProxy ($) {
  shift->{_mod_proxy} = 0;
}
#
# DIR_CREATE
#
# create default values 
#
sub DIR_CREATE {
  my $class = shift;
  my $self = {};

  $self->{_cas_name} = "my.cas-server.net";
  $self->{_cas_path} = "/cas";
  $self->{_cas_port} = "443";
  $self->{_cas_ssl} = 1;
  $self->{_cas_cookie_path} = "/";
  $self->{_ca_file} = "";
  $self->{_cas_session_dir} = "/tmp";
  $self->{_cas_session_timeout} = -1;
  $self->{_mod_proxy} = 1;

  return bless($self, $class);
}
#
# DIR_MERGE
#
# create default values 
#
sub DIR_MERGE {
  my ($parent, $current) = @_;

  my $new = {%$parent, %$current};

  return bless($new, ref($parent));
}

1;

__END__

=head1 NAME

Apache::AuthCASSimple - Apache module to authentificate trough a CAS server

=head1 DESCRIPTION

Apache::AuthCASSimple is a module for Apache/mod_perl. It allow you to
authentificate users trough a CAS server. It means you don't need
to give login/password if you've already be authentificate by the CAS
server, only tickets are exchanged between Web client, Apache server
and CAS server. If you not're authentificate yet, you'll be redirect
on the CAS server login form.

=head1 SYNOPSIS

  <Location /protected>
    AuthType Apache::AuthCASSimple
    PerlAuthenHandler Apache::AuthCASSimple

    CASServerName my.casserver.com
    CASServerPath /
    #CASServerPort 443
    # CASServerNoSSL
    CASSessionTimeout 60
    CASSessionDirectory /tmp
    # CASFixDirectory /
    # NOModProxy

    require valid-user
  </Location>

or require user xxx yyyy

=head1 CONFIGURATION