Changeset 888

Timestamp:

01/26/12 16:14:06 (12 years ago)

Author:

nanardon

Message:

• allow ssl login, match user using email address, this still allow basic authentication

Location:

LATMOS-Accounts-Web

Files:

• apache (added)
• apache/proxy.conf (added)
• lib/Catalyst/Authentication/Credential/La.pm (modified) (2 diffs)
• lib/LATMOS/Accounts/Web/Controller/Root.pm (modified) (2 diffs)
• root/html/includes/header.tt (modified) (1 diff)

LATMOS-Accounts-Web/lib/Catalyst/Authentication/Credential/La.pm

@@ -3 +3 @@
 use strict;
 use warnings;
+use MIME::Base64;
 
 sub new {
@@ -9 +10 @@
 }
 
-sub authenticate {
+sub _search_user {
+    my ($self, $c, $attribute, $value) = @_;
+
+    my $base = $c->model('Accounts')->db;
+    # quick prefilter
+    my @res = $base->search_objects(
+        'user',
+        sprintf('%s~%s', $attribute, $value)
+    );
+
+    @res = grep {
+        my $o = $base->get_object('user', $_);
+        $o && grep { lc($_) eq lc($value) } $o->get_attributes($attribute);    
+    } @res;
+
+    if (@res == 1) {
+        return $res[0];
+    } else {
+        $c->log->error(sprintf
+            "Can't identify `%s' user from `%s' attributes, multiple user found: %s",
+            $value,
+            $attribute,
+            join(', ', @res),
+        );
+        return;
+    }
+}
+
+sub _ssl_auth {
     my ($self, $c, $realm, $authinfo) = @_;
-    return $realm->find_user($authinfo)
+    if ($ENV{HTTP_SSL_CLIENT_S_DN_EMAIL}) {
+        $c->log->debug(sprintf
+            'Trying to find user `%s\' from env `%s\'',
+            $ENV{HTTP_SSL_CLIENT_S_DN_EMAIL},
+            'HTTP_SSL_CLIENT_S_DN_EMAIL'
+        );
+        if (my $u = $self->_search_user($c, 'mail', $ENV{HTTP_SSL_CLIENT_S_DN_EMAIL})) {
+            $c->log->info(sprintf 'SSL auth for %s as %s', $ENV{HTTP_SSL_CLIENT_S_DN_EMAIL}, $u);
+            $authinfo->{username} = $u;
+            return 1;
+        } else {
+            return;
+        }
+    }
+}
+
+sub _login_auth {
+    my ($self, $c, $realm, $authinfo) = @_;
+    my $authheader = $c->req->headers->header('Authorization');
+    # TODO check auth type
+    my ($type, $base64) = $authheader =~ /(\w+) (\S+)/;
+    ($authinfo->{username}, $authinfo->{password})
+        = decode_base64($base64) =~ /^([^:]+):(.*)/;
+    
     if($c->model('Accounts')->db->connect(
         $authinfo->{username},
         $authinfo->{password}
-    ));
-    return;
+    )) {
+        $c->log->info(sprintf 'basic auth for %s', $authinfo->{username});
+        return $realm->find_user($authinfo)
+    } else {
+        return;
+        $c->log->error(sprintf
+            'Invalid password or user for user %s',
+            $authinfo->{username} ||
+            '(none)'
+        );
+    }
+}
+
+sub authenticate {
+    my ($self, $c, $realm, $authinfo) = @_;
+    if (! (
+        $self->_ssl_auth  ($c, $realm, $authinfo) ||
+        $self->_login_auth($c, $realm, $authinfo)
+        )) { return; }
+
+    $c->model('Accounts')->db->{_user} = $authinfo->{username};
+    return $realm->find_user($authinfo);
 }
 

LATMOS-Accounts-Web/lib/LATMOS/Accounts/Web/Controller/Root.pm

@@ -4 +4 @@
 use warnings;
 use base 'Catalyst::Controller';
-use MIME::Base64;
 
 #
@@ -37 +36 @@
     my ( $self, $c ) = @_;
 
+    require Data::Dumper;
     if ($c->user_exists) {
         # Set login user:
-        warn $c->model('Accounts')->db->{_user} = $c->user->{username};
+        $c->model('Accounts')->db->{_user} = $c->user->{username};
     } else {
         # No need to login for About section
-        if ($c->namespace ne 'about') {
-            if ($c->authenticate({}, 'remote')) {
-                # Set login user:
-                $c->model('Accounts')->db->{_user} = $c->user->{username};
-            } elsif (my $authheader = $c->req->headers->header('Authorization')) {
-                # TODO check auth type
-                my ($type, $base64) = $authheader =~ /(\w+) (\S+)/;
-                my ($login, $pass) = decode_base64($base64) =~ /^([^:]+):(.*)/;
-                if (!$c->authenticate({ 
-                            username => $login,
-                            password => $pass }, 'la')) {
-                    $c->forward('auth_required');
-                    return;
-                }
-            } else {
-                $c->forward('auth_required');
-                return;
-            }
+        if (!$c->authenticate({}, 'la')) {
+            $c->forward('auth_required');
+            return;
         }
     }

LATMOS-Accounts-Web/root/html/includes/header.tt

@@ -178 +178 @@
         <span>
             [% luri = c.uri_for('/logout') %]
-            [% luri.userinfo('none:x') %]
+            [% luri.userinfo(c.user.username _ ':x') %]
             <a href="[% luri %]"
             onMouseOver="document.getElementById('menui').innerHTML='Se déconnecter';"