• Your recent searches
Apache2-AuthAny
1 match

 view release on metacpan or  search on metacpan

lib/Apache2/AuthAny/RequestConfig.pm  view on Meta::CPAN 

use Apache2::AuthAny::AuthUtil ();
our $aaDB;
our $VERSION = '0.201';

my @system_skip_auth = qw(/Shibboleth);

sub handler {
    my $r = shift;

    my $cf = Apache2::Module::get_config('Apache2::AuthAny',
                                         $r->server,
                                         $r->per_dir_config) || {};

    my $uri = $r->uri;
    my $user_gate = $cf->{AuthAnyGateURL} || '';
    my $gate_dir = $user_gate;
    $gate_dir =~ s{/[^/]*$}{};

    if ($uri eq $user_gate || ($gate_dir && $uri =~ m{^$gate_dir}) ) {
        # Prevent any authentication attempt on the gate page.
        $r->log->info("RequestConfig: On gate page, '$uri'");
        $r->set_handlers(PerlAuthenHandler => "sub {Apache2::Const::OK}");
        $r->set_handlers(PerlAuthzHandler  => "sub {Apache2::Const::OK}");
    } elsif ($uri =~ m{/aa_auth/(.*?)/}) {
        my $provider_string = $1;
        my ($auth_provider, $logout_key) = split("_aa-key_", $provider_string);
        $r->log->info("Apache2::AuthAny::RequestConfig: Authenticating with '$auth_provider'");

        if  (lc($r->auth_type) eq 'auth-any') {
            # This auth provider does not use the Authen/Authz phases. To prevent
            # errors from DocumentRoot level Require directives, disable the
            # Authen/Authz phases
            $r->set_handlers(PerlAuthenHandler => "sub {Apache2::Const::OK}");
            $r->set_handlers(PerlAuthzHandler  => "sub {Apache2::Const::OK}");
        }

        my $pid = Apache2::AuthAny::Cookie::pid($r);
        $r->pnotes(pid => $pid);

        if ($auth_provider ne 'google') { # Google auth using PHP
            $r->handler('perl-script');
            $r->set_handlers(PerlResponseHandler => 'Apache2::AuthAny::Cookie::post_login');
        }

        if (lc($r->auth_type) eq 'basic') {
            # The AuthName randomizer is needed for IE to keep it
            # from skipping the challenge when a known AuthName is sent.
            my $auth_name = $r->auth_name() || 'Private';
            my $rand_int = int(100000 * (1 + rand(4)));
            $r->auth_name($auth_name . $rand_int);

            # Make sure the auth request is going to the current directory
            if ($logout_key ne $pid->{logoutKey}) {
                Apache2::AuthAny::AuthUtil::goToGATE($r, 'tech', {msg => "mismatching logout keys."})
            }

            # After successful authentication, set a new logoutKey
            $r->set_handlers(PerlFixupHandler => 'Apache2::AuthAny::FixupHandler::update_logout_key');

            # Go to meta redirect to GATE instead of showing ugly browser message
            # if user chooses "Cancel" on challenge popup.
            my $req = Apache2::Request->new($r);
            my $request = $req->param('req');
            my $custom_response = <<"RESPONSE";
<html>
<head>
<meta http-equiv="refresh" content="0;url=$request">
</head>
<body>
<!-- Click <a href="$request">here</a> to continue -->
</body>
</html>
RESPONSE
            $r->custom_response(Apache2::Const::HTTP_UNAUTHORIZED, $custom_response);
            $r->log->info("Apache2::AuthAny::RequestConfig: Basic custom_response set");
        }

    } elsif (lc($r->auth_type) eq 'auth-any') {
        $aaDB = Apache2::AuthAny::DB->new() unless $aaDB;

        my $pid;
        my $scripted_pid = get_scripted_pid($r, $cf);

        # First, check for scripted access by looking in "Authorization" header
        if ($scripted_pid) {
            $pid = $scripted_pid;
        } else {
            $pid = Apache2::AuthAny::Cookie::pid($r);
        }
        $r->pnotes(pid => $pid);

        my $req = Apache2::Request->new($r);
        if (defined $req->param('aalogout') ) {
            return Apache2::AuthAny::AuthUtil::logout($r, $pid);
        }

        if (defined $req->param('aalogin') ) {
            return Apache2::AuthAny::AuthUtil::goToGATE($r, 'first_access');
        }

        my $skip_patterns = $cf->{AuthAnySkipAuthentication} || [];
        push @$skip_patterns, @system_skip_auth;
        my @matching_patterns = grep {$r->uri =~ m!$_!} @$skip_patterns;
        if (@matching_patterns) {
            $r->set_handlers(PerlAuthenHandler => "sub {Apache2::Const::OK}");
            $r->set_handlers(PerlAuthzHandler => "sub {Apache2::Const::OK}");
        } else {
            $r->set_handlers(PerlAuthenHandler => 'Apache2::AuthAny::AuthenHandler');
            $r->set_handlers(PerlAuthzHandler => 'Apache2::AuthAny::AuthzHandler');
        }
        # If we make it through authen and authz, update the last access
        $r->set_handlers(PerlFixupHandler => 'Apache2::AuthAny::FixupHandler');
        set_env($r, $pid, $cf);
    }
    return Apache2::Const::DECLINED;
}

sub set_env {
    my ($r, $pid, $cf) = @_;

    my ($authId, $authProvider);



( run in 0.823 second using v1.01-cache-2.11-cpan-364913b4093 )