Changeset 888 for LATMOS-Accounts-Web/lib/Catalyst/Authentication/Credential/La.pm

Timestamp:

01/26/12 16:14:06 (12 years ago)

Author:

nanardon

Message:

• allow ssl login, match user using email address, this still allow basic authentication

File:

• LATMOS-Accounts-Web/lib/Catalyst/Authentication/Credential/La.pm (modified) (2 diffs)

LATMOS-Accounts-Web/lib/Catalyst/Authentication/Credential/La.pm

@@ -3 +3 @@
 use strict;
 use warnings;
+use MIME::Base64;
 
 sub new {
@@ -9 +10 @@
 }
 
-sub authenticate {
+sub _search_user {
+    my ($self, $c, $attribute, $value) = @_;
+
+    my $base = $c->model('Accounts')->db;
+    # quick prefilter
+    my @res = $base->search_objects(
+        'user',
+        sprintf('%s~%s', $attribute, $value)
+    );
+
+    @res = grep {
+        my $o = $base->get_object('user', $_);
+        $o && grep { lc($_) eq lc($value) } $o->get_attributes($attribute);    
+    } @res;
+
+    if (@res == 1) {
+        return $res[0];
+    } else {
+        $c->log->error(sprintf
+            "Can't identify `%s' user from `%s' attributes, multiple user found: %s",
+            $value,
+            $attribute,
+            join(', ', @res),
+        );
+        return;
+    }
+}
+
+sub _ssl_auth {
     my ($self, $c, $realm, $authinfo) = @_;
-    return $realm->find_user($authinfo)
+    if ($ENV{HTTP_SSL_CLIENT_S_DN_EMAIL}) {
+        $c->log->debug(sprintf
+            'Trying to find user `%s\' from env `%s\'',
+            $ENV{HTTP_SSL_CLIENT_S_DN_EMAIL},
+            'HTTP_SSL_CLIENT_S_DN_EMAIL'
+        );
+        if (my $u = $self->_search_user($c, 'mail', $ENV{HTTP_SSL_CLIENT_S_DN_EMAIL})) {
+            $c->log->info(sprintf 'SSL auth for %s as %s', $ENV{HTTP_SSL_CLIENT_S_DN_EMAIL}, $u);
+            $authinfo->{username} = $u;
+            return 1;
+        } else {
+            return;
+        }
+    }
+}
+
+sub _login_auth {
+    my ($self, $c, $realm, $authinfo) = @_;
+    my $authheader = $c->req->headers->header('Authorization');
+    # TODO check auth type
+    my ($type, $base64) = $authheader =~ /(\w+) (\S+)/;
+    ($authinfo->{username}, $authinfo->{password})
+        = decode_base64($base64) =~ /^([^:]+):(.*)/;
+    
     if($c->model('Accounts')->db->connect(
         $authinfo->{username},
         $authinfo->{password}
-    ));
-    return;
+    )) {
+        $c->log->info(sprintf 'basic auth for %s', $authinfo->{username});
+        return $realm->find_user($authinfo)
+    } else {
+        return;
+        $c->log->error(sprintf
+            'Invalid password or user for user %s',
+            $authinfo->{username} ||
+            '(none)'
+        );
+    }
+}
+
+sub authenticate {
+    my ($self, $c, $realm, $authinfo) = @_;
+    if (! (
+        $self->_ssl_auth  ($c, $realm, $authinfo) ||
+        $self->_login_auth($c, $realm, $authinfo)
+        )) { return; }
+
+    $c->model('Accounts')->db->{_user} = $authinfo->{username};
+    return $realm->find_user($authinfo);
 }