view release on metacpan or  search on metacpan

lib/Apache2/AuthAny/RequestConfig.pm  view on Meta::CPAN

package Apache2::AuthAny::RequestConfig;

use strict;
use Apache2::Module ();
use Apache2::Access ();
use Apache2::Request ();
use URI::Escape;
use Digest::MD5 qw(md5_hex);
use MIME::Base64;

use Apache2::Const -compile => qw(OK DECLINED REDIRECT HTTP_UNAUTHORIZED);
use Data::Dumper("Dumper");
use CGI;
use CGI::Cookie;
use Apache2::AuthAny::Cookie ();
use Apache2::AuthAny::DB ();
use Apache2::AuthAny::AuthUtil ();
our $aaDB;
our $VERSION = '0.201';

my @system_skip_auth = qw(/Shibboleth);

sub handler {
    my $r = shift;

    my $cf = Apache2::Module::get_config('Apache2::AuthAny',
                                         $r->server,
                                         $r->per_dir_config) || {};

    my $uri = $r->uri;
    my $user_gate = $cf->{AuthAnyGateURL} || '';
    my $gate_dir = $user_gate;
    $gate_dir =~ s{/[^/]*$}{};

    if ($uri eq $user_gate || ($gate_dir && $uri =~ m{^$gate_dir}) ) {
        # Prevent any authentication attempt on the gate page.
        $r->log->info("RequestConfig: On gate page, '$uri'");
        $r->set_handlers(PerlAuthenHandler => "sub {Apache2::Const::OK}");
        $r->set_handlers(PerlAuthzHandler  => "sub {Apache2::Const::OK}");
    } elsif ($uri =~ m{/aa_auth/(.*?)/}) {
        my $provider_string = $1;
        my ($auth_provider, $logout_key) = split("_aa-key_", $provider_string);
        $r->log->info("Apache2::AuthAny::RequestConfig: Authenticating with '$auth_provider'");

        if  (lc($r->auth_type) eq 'auth-any') {
            # This auth provider does not use the Authen/Authz phases. To prevent
            # errors from DocumentRoot level Require directives, disable the
            # Authen/Authz phases
            $r->set_handlers(PerlAuthenHandler => "sub {Apache2::Const::OK}");
            $r->set_handlers(PerlAuthzHandler  => "sub {Apache2::Const::OK}");
        }

        my $pid = Apache2::AuthAny::Cookie::pid($r);
        $r->pnotes(pid => $pid);

        if ($auth_provider ne 'google') { # Google auth using PHP
            $r->handler('perl-script');
            $r->set_handlers(PerlResponseHandler => 'Apache2::AuthAny::Cookie::post_login');
        }

        if (lc($r->auth_type) eq 'basic') {
            # The AuthName randomizer is needed for IE to keep it
            # from skipping the challenge when a known AuthName is sent.
            my $auth_name = $r->auth_name() || 'Private';
            my $rand_int = int(100000 * (1 + rand(4)));
            $r->auth_name($auth_name . $rand_int);

            # Make sure the auth request is going to the current directory
            if ($logout_key ne $pid->{logoutKey}) {
                Apache2::AuthAny::AuthUtil::goToGATE($r, 'tech', {msg => "mismatching logout keys."})
            }