You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tuscany.apache.org by js...@apache.org on 2012/07/16 08:47:51 UTC
svn commit: r1361915 [1/2] - in /tuscany/sca-cpp/trunk: ./ components/cache/
hosting/server/ hosting/server/data/accounts/admin/
hosting/server/data/accounts/jane/
hosting/server/data/accounts/jane@localhost/
hosting/server/data/accounts/jane@sca-store...
Author: jsdelfino
Date: Mon Jul 16 06:47:49 2012
New Revision: 1361915
URL: http://svn.apache.org/viewvc?rev=1361915&view=rev
Log:
Add an HTTPD auth provider allowing the authentication logic to be implemented by a component, and cleanup the SSL and mod-security config a bit.
Added:
tuscany/sca-cpp/trunk/hosting/server/authn.py (contents, props changed)
- copied, changed from r1361914, tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf
tuscany/sca-cpp/trunk/hosting/server/data/accounts/admin/
tuscany/sca-cpp/trunk/hosting/server/data/accounts/admin/user.account
tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane/
tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane/user.account
tuscany/sca-cpp/trunk/hosting/server/data/accounts/john/
tuscany/sca-cpp/trunk/hosting/server/data/accounts/john/user.account
tuscany/sca-cpp/trunk/hosting/server/delete-auth
- copied, changed from r1361914, tuscany/sca-cpp/trunk/modules/http/basic-auth-conf
tuscany/sca-cpp/trunk/hosting/server/get-auth
- copied, changed from r1361914, tuscany/sca-cpp/trunk/modules/http/basic-auth-conf
tuscany/sca-cpp/trunk/hosting/server/put-auth (with props)
tuscany/sca-cpp/trunk/modules/http/httpd-tunnel-ssl-conf
- copied, changed from r1361914, tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf
tuscany/sca-cpp/trunk/modules/oauth/oauth12-conf
- copied, changed from r1361914, tuscany/sca-cpp/trunk/modules/oauth/oauth-conf
Removed:
tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane@localhost/
tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane@sca-store.com/
tuscany/sca-cpp/trunk/hosting/server/data/accounts/john@localhost/
tuscany/sca-cpp/trunk/hosting/server/data/accounts/john@sca-store.com/
Modified:
tuscany/sca-cpp/trunk/.gitignore
tuscany/sca-cpp/trunk/components/cache/memcached-ssl-test
tuscany/sca-cpp/trunk/hosting/server/Makefile.am
tuscany/sca-cpp/trunk/hosting/server/server.composite
tuscany/sca-cpp/trunk/hosting/server/ssl-start
tuscany/sca-cpp/trunk/hosting/server/user.py
tuscany/sca-cpp/trunk/modules/http/basic-auth-conf
tuscany/sca-cpp/trunk/modules/http/cert-auth-conf
tuscany/sca-cpp/trunk/modules/http/form-auth-conf
tuscany/sca-cpp/trunk/modules/http/httpd-ssl-conf
tuscany/sca-cpp/trunk/modules/http/mod-openauth.cpp
tuscany/sca-cpp/trunk/modules/http/mod-security-conf
tuscany/sca-cpp/trunk/modules/http/open-auth-conf
tuscany/sca-cpp/trunk/modules/http/openauth.hpp
tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf
tuscany/sca-cpp/trunk/modules/oauth/Makefile.am
tuscany/sca-cpp/trunk/modules/oauth/mod-oauth1.cpp
tuscany/sca-cpp/trunk/modules/oauth/mod-oauth2.cpp
tuscany/sca-cpp/trunk/modules/oauth/oauth-conf
tuscany/sca-cpp/trunk/modules/oauth/start-mixed-test
tuscany/sca-cpp/trunk/modules/oauth/start-test
tuscany/sca-cpp/trunk/modules/openid/openid-conf
tuscany/sca-cpp/trunk/modules/openid/start-test
tuscany/sca-cpp/trunk/modules/server/mod-eval.hpp
tuscany/sca-cpp/trunk/samples/store-cluster/tunnel-ssl-conf
Modified: tuscany/sca-cpp/trunk/.gitignore
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/.gitignore?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/.gitignore (original)
+++ tuscany/sca-cpp/trunk/.gitignore Mon Jul 16 06:47:49 2012
@@ -148,6 +148,7 @@ hosting/server/nuvem
hosting/server/lib
hosting/server/data/apps/*/nuvem
hosting/server/data/apps/*/lib
+hosting/server/data/authn
chat-send
opencl-shell
opencl-test
Modified: tuscany/sca-cpp/trunk/components/cache/memcached-ssl-test
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/components/cache/memcached-ssl-test?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/components/cache/memcached-ssl-test (original)
+++ tuscany/sca-cpp/trunk/components/cache/memcached-ssl-test Mon Jul 16 06:47:49 2012
@@ -29,6 +29,7 @@ rm -rf tmp
../../modules/http/httpd-conf tmp/tunnel localhost 8089 htdocs
../../modules/http/httpd-event-conf tmp/tunnel
+../../modules/http/httpd-tunnel-ssl-conf tmp/tunnel
tar -C tmp/ssl -c `../../modules/http/ssl-cert-find tmp/ssl` | tar -C tmp/tunnel -x
../../modules/http/tunnel-ssl-conf tmp/tunnel 11211 localhost 8453 11411
../../modules/http/tunnel-ssl-conf tmp/tunnel 11212 localhost 8453 11412
@@ -39,6 +40,7 @@ tar -C tmp/ssl -c `../../modules/http/ss
../../modules/http/httpd-event-conf tmp/server
tar -C tmp/ssl -c `../../modules/http/ssl-cert-find tmp/ssl` | tar -C tmp/server -x
../../modules/http/httpd-ssl-conf tmp/server 8453
+../../modules/http/httpd-tunnel-ssl-conf tmp/server
../../modules/http/cert-auth-conf tmp/server
../../modules/http/httpd-start tmp/server
sleep 1
Modified: tuscany/sca-cpp/trunk/hosting/server/Makefile.am
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/Makefile.am?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/Makefile.am (original)
+++ tuscany/sca-cpp/trunk/hosting/server/Makefile.am Mon Jul 16 06:47:49 2012
@@ -18,16 +18,18 @@
if WANT_PYTHON
moddir = $(prefix)/hosting/server
-dist_mod_SCRIPTS = start stop ssl-start mkapplinks config-backup data-backup
+dist_mod_SCRIPTS = start stop ssl-start mkapplinks config-backup data-backup put-auth get-auth delete-auth
-not_minified = htdocs/public/iframe.html htdocs/create/index.html htdocs/page/index.html htdocs/login/index.html htdocs/public/notfound/index.html htdocs/public/oops/index.html htdocs/proxy/public/oops/index.html htdocs/graph/index.html htdocs/public/notauth/index.html htdocs/account/index.html htdocs/home/index.html htdocs/index.html htdocs/public/notyet/index.html htdocs/clone/index.html htdocs/delete/index.html htdocs/stats/index.html htdocs/app/index.html htdocs/store/index.html htdocs/config.js htdocs/public/config.js
+not_minified = htdocs/public/iframe.html htdocs/create/index.html htdocs/page/index.html htdocs/login/index.html htdocs/public/notfound/index.html htdocs/public/oops/index.html htdocs/proxy/public/oops/index.html htdocs/graph/index.html htdocs/public/notauth/index.html htdocs/account/index.html htdocs/home/index.html htdocs/index.html htdocs/public/notyet/index.html htdocs/clone/index.html htdocs/delete/index.html htdocs/stats/index.html htdocs/app/index.html htdocs/store/index.html htdocs/config.js htdocs/public/config.js htdocs/cache-template.cmf htdocs/app/cache-template.cmf htdocs/cache-template.cmf htdocs/app/cache-template.cmf
minified = htdocs/public/iframe-min.html htdocs/create/index-min.html htdocs/page/index-min.html htdocs/login/index-min.html htdocs/public/notfound/index-min.html htdocs/public/oops/index-min.html htdocs/proxy/public/oops/index-min.html htdocs/graph/index-min.html htdocs/public/notauth/index-min.html htdocs/account/index-min.html htdocs/home/index-min.html htdocs/index-min.html htdocs/public/notyet/index-min.html htdocs/clone/index-min.html htdocs/delete/index-min.html htdocs/stats/index-min.html htdocs/app/index-min.html htdocs/store/index-min.html htdocs/config-min.js htdocs/public/config-min.js
-resources = server.composite *.py htdocs/*.cmf htdocs/*.ico htdocs/home/*.png htdocs/app/*.cmf htdocs/home/*.b64 htdocs/*.txt htdocs/public/*.png htdocs/public/*.b64 data/palettes/*/palette.composite data/accounts/*/*.account data/apps/*/app.composite data/apps/*/app.stats data/apps/*/htdocs/app.html data/dashboards/*/user.apps data/store/*/store.apps ${not_minified} ${minified}
+js_minified = ../../modules/js/htdocs/all-min.js ../../modules/js/htdocs/ui-min.css
+
+resources = server.composite *.py data/palettes/*/palette.composite data/accounts/*/*.account data/apps/*/app.composite data/apps/*/app.stats data/apps/*/htdocs/app.html data/dashboards/*/user.apps data/store/*/store.apps htdocs/cache-manifest.cmf htdocs/app/cache-manifest.cmf htdocs/*.ico htdocs/home/*.png htdocs/home/*.b64 htdocs/*.txt htdocs/public/*.png htdocs/public/*.b64 ${minified}
nobase_dist_mod_DATA = ${resources}
-EXTRA_DIST = ${resources}
+EXTRA_DIST = ${resources} ${not_minified}
SUFFIXES = -min.html -min.js
.html-min.html:
@@ -36,9 +38,29 @@ SUFFIXES = -min.html -min.js
.js-min.js:
../../modules/http/minify-js $< $@
-CLEANFILES = ${minified}
+htdocs/cache-manifest.cmf: htdocs/cache-template.cmf ${minified} ${js_minified}
+ ../../modules/http/cache-manifest htdocs $^
+
+htdocs/app/cache-manifest.cmf: htdocs/app/cache-template.cmf ${minified} ${js_minified}
+ ../../modules/http/cache-manifest htdocs/app $^
+
+nuvem:
+ ln -s "../../../nuvem/nuvem-parallel/nuvem" "nuvem"
+
+lib:
+ ln -s "../../components" "lib"
+
+install-data-hook:
+ cd $(moddir); rm -f nuvem; ln -s "../../../nuvem/nuvem-parallel/nuvem" "nuvem"
+ cd $(moddir); rm -f lib; ln -s "../../components" "lib"
+
+CLEANFILES = ${minified} nuvem lib htdocs/cache-manifest.cmf htdocs/app/cache-manifest.cmf
+
+client_test_SOURCES = client-test.cpp
+client_test_LDFLAGS = -lxml2 -lcurl -lmozjs
-dist_noinst_SCRIPTS = server-test test.py
-TESTS = server-test
+dist_noinst_SCRIPTS = logic-test server-test test.py
+noinst_PROGRAMS = client-test
+TESTS = logic-test
endif
Copied: tuscany/sca-cpp/trunk/hosting/server/authn.py (from r1361914, tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf)
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/authn.py?p2=tuscany/sca-cpp/trunk/hosting/server/authn.py&p1=tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf&r1=1361914&r2=1361915&rev=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf (original)
+++ tuscany/sca-cpp/trunk/hosting/server/authn.py Mon Jul 16 06:47:49 2012
@@ -1,5 +1,3 @@
-#!/bin/sh
-
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
@@ -17,15 +15,26 @@
# specific language governing permissions and limitations
# under the License.
-here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
-mkdir -p $1
-root=`echo "import os; print os.path.realpath('$1')" | python`
-user=$2
-pass=$3
-
-httpd_prefix=`cat $here/httpd.prefix`
-
-# Create password file
-touch $root/conf/httpd.passwd
-$httpd_prefix/bin/htpasswd -b $root/conf/httpd.passwd $user $pass 2>/dev/null
+# User authenticator implementation
+from time import strftime
+from util import *
+
+# Convert a particular user id to an authentication id
+def authnid(id):
+ return append(append(('authn',), id), ('user.authn',))
+
+# Get a user's authentication
+def get(id, cache):
+ authn = cache.get(authnid(id))
+ if isNil(authn) or authn is None:
+ return None
+ return authn
+
+# Update a user's authentication
+def put(id, authn, cache):
+ return cache.put(authnid(id), authn)
+
+# Delete a user's authentication
+def delete(id, cache):
+ return cache.delete(authnid(id))
Added: tuscany/sca-cpp/trunk/hosting/server/data/accounts/admin/user.account
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/data/accounts/admin/user.account?rev=1361915&view=auto
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/data/accounts/admin/user.account (added)
+++ tuscany/sca-cpp/trunk/hosting/server/data/accounts/admin/user.account Mon Jul 16 06:47:49 2012
@@ -0,0 +1 @@
+((entry (title "Admin") (id "admin")))
Added: tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane/user.account
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane/user.account?rev=1361915&view=auto
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane/user.account (added)
+++ tuscany/sca-cpp/trunk/hosting/server/data/accounts/jane/user.account Mon Jul 16 06:47:49 2012
@@ -0,0 +1 @@
+((entry (title "Jane Doe") (id "jane") (content (account (description "This is Jane") (keys (key (((@name "key1") (@value "value1")) ((@name "key2") (@value "value2")) ((@name "key3") (@value "value3")) ((@name "") (@value "")) ((@name "") (@value "")))))))))
Added: tuscany/sca-cpp/trunk/hosting/server/data/accounts/john/user.account
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/data/accounts/john/user.account?rev=1361915&view=auto
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/data/accounts/john/user.account (added)
+++ tuscany/sca-cpp/trunk/hosting/server/data/accounts/john/user.account Mon Jul 16 06:47:49 2012
@@ -0,0 +1 @@
+((entry (title "John Doe") (id "john") (content (account (description "This is John") (keys (key (((@name "key1") (@value "value1")) ((@name "key2") (@value "value2")) ((@name "key3") (@value "value3")) ((@name "key4") (@value "value4")) ((@name "key5") (@value "value5")))))))))
Copied: tuscany/sca-cpp/trunk/hosting/server/delete-auth (from r1361914, tuscany/sca-cpp/trunk/modules/http/basic-auth-conf)
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/delete-auth?p2=tuscany/sca-cpp/trunk/hosting/server/delete-auth&p1=tuscany/sca-cpp/trunk/modules/http/basic-auth-conf&r1=1361914&r2=1361915&rev=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/basic-auth-conf (original)
+++ tuscany/sca-cpp/trunk/hosting/server/delete-auth Mon Jul 16 06:47:49 2012
@@ -17,44 +17,45 @@
# specific language governing permissions and limitations
# under the License.
-# Generate a minimal HTTPD basic authentication configuration
here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
mkdir -p $1
root=`echo "import os; print os.path.realpath('$1')" | python`
+admin=$2
+apass=$3
+user=$4
-conf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-conf"`
-host=`echo $conf | awk '{ print $6 }'`
-
-loc=$2
-if [ "$loc" = "" ]; then
- loc="/"
-fi
+httpd_prefix=`cat $here/../../modules/http/httpd.prefix`
+conf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-conf"`
sslconf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-ssl-conf"`
if [ "$sslconf" = "" ]; then
- sslsuffix=""
+ scheme="http"
+ addr=`echo $conf | awk '{ print $7 }'`
+ host=`$here/../../modules/http/httpd-addr ip $addr`
+ if [ "$host" = "" ]; then
+ host="localhost"
+ fi
+ port=`$here/../../modules/http/httpd-addr port $addr`
else
- sslsuffix="-ssl"
+ scheme="https"
+ ssladdr=`echo $sslconf | awk '{ print $6 }'`
+ host=`$here/../../modules/http/httpd-addr ip $ssladdr`
+ if [ "$host" = "" ]; then
+ host="localhost"
+ fi
+ port=`$here/../../modules/http/httpd-addr port $ssladdr`
fi
-# Disallow public access to server resources
-cat >$root/conf/noauth$sslsuffix.conf <<EOF
-# Generated by: basic-auth-conf $*
-# Disallow public access to server resources
-
-EOF
-
-# Generate basic authentication configuration
-cat >>$root/conf/locauth$sslsuffix.conf <<EOF
-# Generated by: basic-auth-conf $*
-# Require clients to present a userid + password for HTTP
-# basic authentication
-<Location $loc>
-AuthType Basic
-AuthName "$host"
-AuthBasicProvider file
-Require valid-user
-</Location>
+# Compute user id
+slash=`echo $user | grep "/"`
+if [ "$slash" = "" ]; then
+ id="\"$user\""
+ upath=$user
+else
+ id=`echo $user | awk -F "/" '{ printf "\"%s\" \"%s\"", $2, $3 }'`
+ upath=`echo $user | awk -F "/" '{ printf "%s/%s", $2, $3 }'`
+fi
-EOF
+# Delete user auth
+curl -k -L -u $admin:$apass -X DELETE -H "X-Forwarded-Server: $host" $scheme://$host:$port/c/Authenticator/$upath
Copied: tuscany/sca-cpp/trunk/hosting/server/get-auth (from r1361914, tuscany/sca-cpp/trunk/modules/http/basic-auth-conf)
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/get-auth?p2=tuscany/sca-cpp/trunk/hosting/server/get-auth&p1=tuscany/sca-cpp/trunk/modules/http/basic-auth-conf&r1=1361914&r2=1361915&rev=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/basic-auth-conf (original)
+++ tuscany/sca-cpp/trunk/hosting/server/get-auth Mon Jul 16 06:47:49 2012
@@ -17,44 +17,46 @@
# specific language governing permissions and limitations
# under the License.
-# Generate a minimal HTTPD basic authentication configuration
here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
mkdir -p $1
root=`echo "import os; print os.path.realpath('$1')" | python`
+admin=$2
+apass=$3
+user=$4
-conf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-conf"`
-host=`echo $conf | awk '{ print $6 }'`
+httpd_prefix=`cat $here/../../modules/http/httpd.prefix`
-loc=$2
-if [ "$loc" = "" ]; then
- loc="/"
-fi
+conf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-conf"`
sslconf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-ssl-conf"`
if [ "$sslconf" = "" ]; then
- sslsuffix=""
+ scheme="http"
+ addr=`echo $conf | awk '{ print $7 }'`
+ host=`$here/../../modules/http/httpd-addr ip $addr`
+ if [ "$host" = "" ]; then
+ host="localhost"
+ fi
+ port=`$here/../../modules/http/httpd-addr port $addr`
else
- sslsuffix="-ssl"
+ scheme="https"
+ ssladdr=`echo $sslconf | awk '{ print $6 }'`
+ host=`$here/../../modules/http/httpd-addr ip $ssladdr`
+ if [ "$host" = "" ]; then
+ host="localhost"
+ fi
+ port=`$here/../../modules/http/httpd-addr port $ssladdr`
fi
-# Disallow public access to server resources
-cat >$root/conf/noauth$sslsuffix.conf <<EOF
-# Generated by: basic-auth-conf $*
-# Disallow public access to server resources
-
-EOF
-
-# Generate basic authentication configuration
-cat >>$root/conf/locauth$sslsuffix.conf <<EOF
-# Generated by: basic-auth-conf $*
-# Require clients to present a userid + password for HTTP
-# basic authentication
-<Location $loc>
-AuthType Basic
-AuthName "$host"
-AuthBasicProvider file
-Require valid-user
-</Location>
+# Compute user id
+slash=`echo $user | grep "/"`
+if [ "$slash" = "" ]; then
+ id="\"$user\""
+ upath=$user
+else
+ id=`echo $user | awk -F "/" '{ printf "\"%s\" \"%s\"", $2, $3 }'`
+ upath=`echo $user | awk -F "/" '{ printf "%s/%s", $2, $3 }'`
+fi
-EOF
+# Get user auth
+curl -k -L -u $admin:$apass -H "X-Forwarded-Server: $host" $scheme://$host:$port/c/Authenticator/$upath
Added: tuscany/sca-cpp/trunk/hosting/server/put-auth
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/put-auth?rev=1361915&view=auto
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/put-auth (added)
+++ tuscany/sca-cpp/trunk/hosting/server/put-auth Mon Jul 16 06:47:49 2012
@@ -0,0 +1,80 @@
+#!/bin/sh
+
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
+mkdir -p $1
+root=`echo "import os; print os.path.realpath('$1')" | python`
+admin=$2
+apass=$3
+user=$4
+upass=$5
+
+httpd_prefix=`cat $here/../../modules/http/httpd.prefix`
+
+conf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-conf"`
+sslconf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-ssl-conf"`
+if [ "$sslconf" = "" ]; then
+ scheme="http"
+ addr=`echo $conf | awk '{ print $7 }'`
+ host=`$here/../../modules/http/httpd-addr ip $addr`
+ if [ "$host" = "" ]; then
+ host="localhost"
+ fi
+ port=`$here/../../modules/http/httpd-addr port $addr`
+else
+ scheme="https"
+ ssladdr=`echo $sslconf | awk '{ print $6 }'`
+ host=`$here/../../modules/http/httpd-addr ip $ssladdr`
+ if [ "$host" = "" ]; then
+ host="localhost"
+ fi
+ port=`$here/../../modules/http/httpd-addr port $ssladdr`
+fi
+
+# Get password hash
+rm -f $root/conf/auth.passwd
+touch $root/conf/auth.passwd
+$httpd_prefix/bin/htpasswd -b $root/conf/auth.passwd "$user" "$upass" 2>/dev/null
+hash=`cat $root/conf/auth.passwd | awk -F ":" '{ print $2 }'`
+rm -f $root/conf/auth.passwd
+
+# Compute user id
+slash=`echo $user | grep "/"`
+if [ "$slash" = "" ]; then
+ id="\"$user\""
+ upath=$user
+else
+ id=`echo $user | awk -F "/" '{ printf "\"%s\" \"%s\"", $2, $3 }'`
+ upath=`echo $user | awk -F "/" '{ printf "%s/%s", $2, $3 }'`
+fi
+
+# Put user auth
+cat >$root/conf/auth.entry <<EOF
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns="http://www.w3.org/2005/Atom">
+ <title type="text">$user</title>
+ <id>$user</id>
+ <content type="application/xml">
+ <hash>$hash</hash>
+ </content>
+</entry>
+EOF
+curl -k -L -u $admin:$apass -X PUT -H "X-Forwarded-Server: $host" --data-binary @$root/conf/auth.entry $scheme://$host:$port/c/Authenticator/$upath
+rm $root/conf/auth.entry
+
Propchange: tuscany/sca-cpp/trunk/hosting/server/put-auth
------------------------------------------------------------------------------
svn:executable = *
Modified: tuscany/sca-cpp/trunk/hosting/server/server.composite
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/server.composite?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/server.composite (original)
+++ tuscany/sca-cpp/trunk/hosting/server/server.composite Mon Jul 16 06:47:49 2012
@@ -31,12 +31,9 @@
<property name="lastname">?</property>
<property name="realm">?</property>
<property name="host">?</property>
- <service name="User">
- <binding.http uri="user"/>
- </service>
</component>
- <component name="EditWidget">
+ <component name="Editor">
<implementation.widget location="/index.html"/>
<reference name="user" target="User"/>
<reference name="accounts" target="Accounts"/>
@@ -49,7 +46,7 @@
<reference name="log" target="Log"/>
</component>
- <component name="AppWidget">
+ <component name="App">
<implementation.widget location="/app/index.html"/>
<reference name="user" target="User"/>
<reference name="pages" target="Pages"/>
@@ -59,18 +56,17 @@
<component name="Accounts">
<implementation.python script="accounts.py"/>
- <service name="Accounts">
- <binding.http uri="accounts"/>
- </service>
<reference name="user" target="User"/>
<reference name="cache" target="Cache"/>
</component>
+ <component name="Authenticator">
+ <implementation.python script="authn.py"/>
+ <reference name="cache" target="Cache"/>
+ </component>
+
<component name="Dashboards">
<implementation.python script="dashboards.py"/>
- <service name="Dashboards">
- <binding.http uri="dashboards"/>
- </service>
<reference name="user" target="User"/>
<reference name="cache" target="Cache"/>
<reference name="apps" target="Apps"/>
@@ -78,9 +74,6 @@
<component name="AppStore">
<implementation.python script="store.py"/>
- <service name="AppStore">
- <binding.http uri="appstore"/>
- </service>
<reference name="user" target="User"/>
<reference name="cache" target="Cache"/>
<reference name="apps" target="Apps"/>
@@ -88,9 +81,6 @@
<component name="Apps">
<implementation.python script="apps.py"/>
- <service name="Apps">
- <binding.http uri="apps"/>
- </service>
<reference name="user" target="User"/>
<reference name="cache" target="Cache"/>
<reference name="dashboard" target="Dashboards"/>
@@ -101,9 +91,6 @@
<component name="Composites">
<implementation.python script="composites.py"/>
- <service name="Composites">
- <binding.http uri="composites"/>
- </service>
<reference name="user" target="User"/>
<reference name="cache" target="Doccache"/>
<reference name="apps" target="Apps"/>
@@ -111,9 +98,6 @@
<component name="Pages">
<implementation.python script="pages.py"/>
- <service name="Pages">
- <binding.http uri="pages"/>
- </service>
<reference name="user" target="User"/>
<reference name="cache" target="Doccache"/>
<reference name="apps" target="Apps"/>
@@ -121,17 +105,11 @@
<component name="Palettes">
<implementation.python script="palettes.py"/>
- <service name="Palettes">
- <binding.http uri="palettes"/>
- </service>
<reference name="cache" target="Doccache"/>
</component>
<component name="Cache">
<implementation.cpp path="../../components/cache" library="libdatacache"/>
- <service name="Cache">
- <binding.http uri="cache"/>
- </service>
<reference name="l1reader" target="Memcache"/>
<reference name="l1writer" target="Memcache"/>
<reference name="l2reader" target="Database"/>
@@ -140,9 +118,6 @@
<component name="Doccache">
<implementation.cpp path="../../components/cache" library="libdatacache"/>
- <service name="Doccache">
- <binding.http uri="doccache"/>
- </service>
<reference name="l1reader" target="Memcache"/>
<reference name="l1writer" target="Memcache"/>
<reference name="l2reader" target="Documents"/>
@@ -151,9 +126,6 @@
<component name="Memcache">
<implementation.cpp path="../../components/cache" library="libmemcache"/>
- <service name="Memcache">
- <binding.http uri="memcache"/>
- </service>
<property name="server">localhost:11211</property>
<property name="server">localhost:11212</property>
</component>
@@ -162,25 +134,16 @@
<implementation.cpp path="../../components/filedb" library="libfiledb"/>
<property name="dbname">data</property>
<property name="format">scheme</property>
- <service name="Database">
- <binding.http uri="database"/>
- </service>
</component>
<component name="Documents">
<implementation.cpp path="../../components/filedb" library="libfiledb"/>
<property name="dbname">data</property>
<property name="format">xml</property>
- <service name="Documents">
- <binding.http uri="documents"/>
- </service>
</component>
<component name="Log">
<implementation.python script="log.py"/>
- <service name="Log">
- <binding.http uri="log"/>
- </service>
</component>
</composite>
Modified: tuscany/sca-cpp/trunk/hosting/server/ssl-start
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/ssl-start?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/ssl-start (original)
+++ tuscany/sca-cpp/trunk/hosting/server/ssl-start Mon Jul 16 06:47:49 2012
@@ -22,7 +22,6 @@
# 127.0.0.1 www.example.com
here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
-jsprefix=`echo "import os; print os.path.realpath('$here/../../modules/js')" | python`
host=`hostname`
# Create SSL certificates
@@ -41,39 +40,33 @@ fi
../../components/cache/memcached-start tmp 11211
../../components/cache/memcached-start tmp 11212
+# Clear document cache
+rm -rf tmp/cache
+
# Configure server
../../modules/http/httpd-conf tmp www.example.com 8090 htdocs
+../../modules/http/alt-host-conf tmp ww1.example.com
+../../modules/http/alt-host-conf tmp ww2.example.com
../../modules/http/httpd-event-conf tmp
+#../../modules/http/cache-conf tmp
../../modules/http/httpd-ssl-conf tmp 8453
+#../../modules/http/cache-ssl-conf tmp
# Configure HTTP basic auth
-../../modules/http/basic-auth-conf tmp
+../../modules/http/basic-auth-conf tmp component
# Configure OAuth authentication
# Configure your OAuth app keys here
-../../modules/oauth/oauth-conf tmp
+../../modules/oauth/oauth-conf tmp component
../../modules/oauth/oauth-memcached-conf tmp localhost 11212
../../modules/oauth/oauth2-appkey-conf tmp facebook.com 12345 67890
../../modules/oauth/oauth2-appkey-conf tmp google.com 12345 67890
-# Configure password authentication
-../../modules/http/open-auth-conf tmp
-../../modules/http/passwd-auth-conf tmp john john
-../../modules/http/passwd-auth-conf tmp jane jane
-../../modules/http/passwd-auth-conf tmp admin admin
-
-# Configure OpenID step2 authentication
-../../modules/openid/openid-conf tmp
-../../modules/openid/openid-step2-conf tmp
-../../modules/openid/openid-memcached-conf tmp localhost 11212
+# Configure form-based authentication
+../../modules/http/open-auth-conf tmp component 80b67f38-b79e-4a72-bb5c-22c69fb00820
-# Configure authorized users
-../../modules/http/group-auth-conf tmp john
-../../modules/http/group-auth-conf tmp jane
-../../modules/http/group-auth-conf tmp admin
-# Configure the email addresses associated with your OpenID and OAuth ids here
-../../modules/http/group-auth-conf tmp john@example.com
-../../modules/http/group-auth-conf tmp jane@example.com
+# Configure authorized admins
+../../modules/http/passwd-auth-conf tmp admin admin
# Configure mod-security
#../../modules/http/mod-security-conf tmp
@@ -103,26 +96,6 @@ SecAuditLog "|$here/../../components/log
EOF
-else
- cat >tmp/conf/log.conf <<EOF
-# Generated by: ssl=start $*
-ErrorLog $here/tmp/logs/error_log
-CustomLog $here/tmp/logs/access_log combined
-
-EOF
-
- cat >tmp/conf/log-ssl.conf <<EOF
-# Generated by: ssl-start $*
-CustomLog $here/tmp/logs/ssl_access_log sslcombined
-
-EOF
-
- cat >tmp/conf/mod-security-log.conf <<EOF
-# Generated by: ssl-start $*
-SecAuditLog $here/tmp/logs/secaudit_log
-
-EOF
-
fi
#../../modules/http/httpd-loglevel-conf tmp debug
@@ -143,10 +116,11 @@ cat >>tmp/conf/svhost-ssl.conf <<EOF
ErrorDocument 404 /public/notfound/
ErrorDocument 401 /public/notauth/
ErrorDocument 403 /public/notauth/
+ErrorDocument 400 /public/oops/
+ErrorDocument 405 /public/oops/
ErrorDocument 500 /public/oops/
ErrorDocument 502 /public/oops/
ErrorDocument 503 /public/oops/
-ErrorDocument 405 /public/oops/
EOF
@@ -160,6 +134,12 @@ SCAComposite server.composite
# Configure SCA Composite for mass dynamic virtual Hosting
SCAVirtualContributor Composites
+# Configure SCA Authenticator component
+SCAAuthenticator Authenticator
+
+# Configure SCA wiring timeout
+SCAWiringTimeout 10
+
EOF
# Configure resource aliases
@@ -172,14 +152,6 @@ Alias /proxy/public/config-min.js $here/
EOF
-# Create app implementation resource links
-if [ ! -e "nuvem" ]; then
- ln -s "../../../nuvem/nuvem-parallel/nuvem" "nuvem"
-fi
-if [ ! -e "lib" ]; then
- ln -s "../../components" "lib"
-fi
-
# Configure app resource aliases
cat >>tmp/conf/svhost-ssl.conf <<EOF
# Generated by: ssl-start $*
@@ -188,6 +160,49 @@ AliasMatch /v/([^/]+)(.*)$ $here/htdocs/
EOF
+# Configure admin access to server status and info
+cat >tmp/conf/adminauth.conf <<EOF
+# Generated by: ssl-start $*
+# Allow the server admin to view the server status and info
+<Location /server-status>
+AuthType None
+Require all granted
+</Location>
+
+<Location /server-info>
+AuthType None
+Require all granted
+</Location>
+
+EOF
+
+# Configure admin access to components
+cat >>tmp/conf/locauth-ssl.conf <<EOF
+# Generated by: ssl-start $*
+# Allow the server admin to access all components
+<Location /c>
+Require user admin
+</Location>
+<Location /r>
+Require user admin
+</Location>
+<Location /r/Editor>
+Require valid-user
+</Location>
+<Location /r/App>
+Require valid-user
+</Location>
+EOF
+
# Start server
../../modules/http/httpd-start tmp
+sleep 2
+
+# Configure authorized users
+./put-auth tmp admin admin admin admin
+./put-auth tmp admin admin john john
+./put-auth tmp admin admin jane jane
+# Configure the email addresses associated with your OAuth ids here
+./put-auth tmp admin admin /oauth1/john@example.com password
+./put-auth tmp admin admin /oauth2/jane@example.com password
Modified: tuscany/sca-cpp/trunk/hosting/server/user.py
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/hosting/server/user.py?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/hosting/server/user.py (original)
+++ tuscany/sca-cpp/trunk/hosting/server/user.py Mon Jul 16 06:47:49 2012
@@ -21,9 +21,7 @@
def get(i, user, email, nick, full, first, last, realm, host):
if email.eval() != '?':
return email.eval()
- if nick.eval() != '?':
- return nick.eval() + '@' + realm.eval()
if user.eval() != '?':
- return user.eval() + '@' + realm.eval()
- return 'anonymous@' + host.eval();
+ return user.eval()
+ return 'anonymous'
Modified: tuscany/sca-cpp/trunk/modules/http/basic-auth-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/basic-auth-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/basic-auth-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/basic-auth-conf Mon Jul 16 06:47:49 2012
@@ -25,9 +25,16 @@ root=`echo "import os; print os.path.rea
conf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-conf"`
host=`echo $conf | awk '{ print $6 }'`
-loc=$2
-if [ "$loc" = "" ]; then
+if [ "$2" = "" ]; then
+ providers="file"
+else
+ providers="$2 file"
+fi
+
+if [ "$3" = "" ]; then
loc="/"
+else
+ loc="$3"
fi
sslconf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-ssl-conf"`
@@ -52,7 +59,9 @@ cat >>$root/conf/locauth$sslsuffix.conf
<Location $loc>
AuthType Basic
AuthName "$host"
-AuthBasicProvider file
+AuthBasicProvider socache $providers
+AuthnCacheProvideFor $providers
+AuthnCacheContext /
Require valid-user
</Location>
Modified: tuscany/sca-cpp/trunk/modules/http/cert-auth-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/cert-auth-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/cert-auth-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/cert-auth-conf Mon Jul 16 06:47:49 2012
@@ -32,6 +32,12 @@ else
sslsuffix="-ssl"
fi
+if [ "$2" = "" ]; then
+ providers="file"
+else
+ providers="$2 file"
+fi
+
# Disallow public access to server resources
cat >$root/conf/noauth$sslsuffix.conf <<EOF
# Generated by: cert-auth-conf $*
@@ -49,7 +55,9 @@ SSLVerifyDepth 1
<Location />
AuthType Basic
AuthName "$host"
-AuthBasicProvider file
+AuthBasicProvider socache $providers
+AuthnCacheProvideFor $providers
+AuthnCacheContext /
Require valid-user
</Location>
Modified: tuscany/sca-cpp/trunk/modules/http/form-auth-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/form-auth-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/form-auth-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/form-auth-conf Mon Jul 16 06:47:49 2012
@@ -26,9 +26,15 @@ conf=`cat $root/conf/httpd.conf | grep "
host=`echo $conf | awk '{ print $6 }'`
if [ "$2" = "" ]; then
+ providers="file"
+else
+ providers="$2 file"
+fi
+
+if [ "$3" = "" ]; then
pw=`cat $root/cert/ca.key | head -2 | tail -1`
else
- pw="$2"
+ pw="$3"
fi
sslconf=`cat $root/conf/httpd.conf | grep "# Generated by: httpd-ssl-conf"`
@@ -53,8 +59,10 @@ cat >>$root/conf/locauth$sslsuffix.conf
<Location />
AuthType Form
AuthName "$host"
-AuthFormProvider file
-AuthFormLoginRequiredLocation /login
+AuthFormProvider socache $providers
+AuthnCacheProvideFor $providers
+AuthnCacheContext /
+AuthFormLoginRequiredLocation /login/
AuthFormLogoutLocation /
Session On
SessionCookieName TuscanyFormAuth domain=.$host; path=/
Modified: tuscany/sca-cpp/trunk/modules/http/httpd-ssl-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/httpd-ssl-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/httpd-ssl-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/httpd-ssl-conf Mon Jul 16 06:47:49 2012
@@ -43,6 +43,15 @@ htdocs=`echo $conf | awk '{ print $8 }'`
mkdir -p $htdocs
htdocs=`echo "import os; print os.path.realpath('$htdocs')" | python`
+uname=`uname -s`
+if [ $uname = "Darwin" ]; then
+ libsuffix=".dylib"
+else
+ libsuffix=".so"
+fi
+
+modules_prefix=`cat $here/httpd-modules.prefix`
+
# Extract organization name from our CA certificate
org=`openssl x509 -noout -subject -nameopt multiline -in $root/cert/ca.crt | grep organizationName | awk -F "= " '{ print $2 }'`
@@ -69,7 +78,7 @@ ServerName https://$host$sslpportsuffix
<Location />
RewriteEngine on
-RewriteCond %{HTTP_HOST} !^$host [NC]
+Include conf/hostcond.conf
RewriteCond %{HTTP:X-Forwarded-Server} ^$ [NC]
RewriteCond %{REQUEST_URI} !^/server-status [NC]
RewriteCond %{REQUEST_URI} !^/balancer-manager [NC]
@@ -176,7 +185,7 @@ Include conf/log-ssl.conf
# Enable HTTPS reverse proxy
ProxyRequests Off
-ProxyPreserveHost Off
+ProxyPreserveHost On
ProxyStatus On
SSLProxyEngine on
SSLProxyCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
@@ -222,11 +231,6 @@ CustomLog $root/logs/ssl_access_log sslc
EOF
# Configure virtual hosts
-proxycert="server"
-if [ "$proxyconf" != "" ]; then
- proxycert="proxy"
-fi
-
cat >$root/conf/svhost-ssl.conf <<EOF
# Generated by: httpd-ssl-conf $*
# Static virtual host configuration
@@ -238,10 +242,6 @@ SSLCertificateChainFile "$root/cert/ca.c
SSLCertificateFile "$root/cert/server.crt"
SSLCertificateKeyFile "$root/cert/server.key"
-# Declare proxy SSL client certificates
-SSLProxyCACertificateFile "$root/cert/ca.crt"
-SSLProxyMachineCertificateFile "$root/cert/$proxycert.pem"
-
EOF
cat >$root/conf/dvhost-ssl.conf <<EOF
@@ -255,9 +255,5 @@ SSLCertificateChainFile "$root/cert/ca.c
SSLCertificateFile "$root/cert/vhost.crt"
SSLCertificateKeyFile "$root/cert/vhost.key"
-# Declare proxy SSL client certificates
-SSLProxyCACertificateFile "$root/cert/ca.crt"
-SSLProxyMachineCertificateFile "$root/cert/$proxycert.pem"
-
EOF
Copied: tuscany/sca-cpp/trunk/modules/http/httpd-tunnel-ssl-conf (from r1361914, tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf)
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/httpd-tunnel-ssl-conf?p2=tuscany/sca-cpp/trunk/modules/http/httpd-tunnel-ssl-conf&p1=tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf&r1=1361914&r2=1361915&rev=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/httpd-tunnel-ssl-conf Mon Jul 16 06:47:49 2012
@@ -17,15 +17,22 @@
# specific language governing permissions and limitations
# under the License.
+# Generate a minimal HTTPD SSL Tunnel configuration
here=`echo "import os; print os.path.realpath('$0')" | python`; here=`dirname $here`
mkdir -p $1
root=`echo "import os; print os.path.realpath('$1')" | python`
-user=$2
-pass=$3
-httpd_prefix=`cat $here/httpd.prefix`
+uname=`uname -s`
+if [ $uname = "Darwin" ]; then
+ libsuffix=".dylib"
+else
+ libsuffix=".so"
+fi
-# Create password file
-touch $root/conf/httpd.passwd
-$httpd_prefix/bin/htpasswd -b $root/conf/httpd.passwd $user $pass 2>/dev/null
+# Generate required modules list
+cat >>$root/conf/modules.conf <<EOF
+# Generated by: httpd-tunnel-ssl-conf $*
+LoadModule mod_tuscany_ssltunnel $here/libmod_tuscany_ssltunnel$libsuffix
+
+EOF
Modified: tuscany/sca-cpp/trunk/modules/http/mod-openauth.cpp
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/mod-openauth.cpp?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/mod-openauth.cpp (original)
+++ tuscany/sca-cpp/trunk/modules/http/mod-openauth.cpp Mon Jul 16 06:47:49 2012
@@ -44,6 +44,7 @@
#include "http.hpp"
#include "openauth.hpp"
+
extern "C" {
extern module AP_MODULE_DECLARE_DATA mod_tuscany_openauth;
}
@@ -64,6 +65,20 @@ public:
};
/**
+ * Authentication provider configuration.
+ */
+class AuthnProviderConf {
+public:
+ AuthnProviderConf() : name(), provider(NULL) {
+ }
+ AuthnProviderConf(const string name, const authn_provider* provider) : name(name), provider(provider) {
+ }
+
+ string name;
+ const authn_provider* provider;
+};
+
+/**
* Directory configuration.
*/
class DirConf {
@@ -75,6 +90,7 @@ public:
const char* dir;
bool enabled;
string login;
+ list<AuthnProviderConf> apcs;
};
#ifdef WANT_MAINTAINER_LOG
@@ -101,10 +117,39 @@ const bool debugSession(request_rec* r,
#endif
/**
+ * Run the authnz hooks to authenticate a request.
+ */
+const failable<int> checkAuthnzProviders(const string& user, const string& pw, request_rec* r, const list<AuthnProviderConf>& apcs) {
+ if (isNil(apcs))
+ return mkfailure<int>("Authentication failure for: " + user);
+ const AuthnProviderConf apc = car<AuthnProviderConf>(apcs);
+ if (apc.provider == NULL || !apc.provider->check_password)
+ return checkAuthnzProviders(user, pw, r, cdr(apcs));
+
+ apr_table_setn(r->notes, AUTHN_PROVIDER_NAME_NOTE, c_str(apc.name));
+ const authn_status auth_result = apc.provider->check_password(r, c_str(user), c_str(pw));
+ apr_table_unset(r->notes, AUTHN_PROVIDER_NAME_NOTE);
+ if (auth_result != AUTH_GRANTED)
+ return checkAuthnzProviders(user, pw, r, cdr(apcs));
+ return OK;
+}
+
+const failable<int> checkAuthnz(const string& user, const string& pw, request_rec* r, const DirConf& dc) {
+ if (substr(user, 0, 1) == "/" && pw == "password")
+ return mkfailure<int>(string("Encountered FakeBasicAuth spoof: ") + user, HTTP_UNAUTHORIZED);
+
+ if (isNil(dc.apcs)) {
+ const authn_provider* provider = (const authn_provider*)ap_lookup_provider(AUTHN_PROVIDER_GROUP, AUTHN_DEFAULT_PROVIDER, AUTHN_PROVIDER_VERSION);
+ return checkAuthnzProviders(user, pw, r, mklist<AuthnProviderConf>(AuthnProviderConf(AUTHN_DEFAULT_PROVIDER, provider)));
+ }
+ return checkAuthnzProviders(user, pw, r, dc.apcs);
+}
+
+/**
* Return the user info from a form auth encrypted session cookie.
*/
static int (*ap_session_load_fn) (request_rec * r, session_rec ** z) = NULL;
-static void (*ap_session_get_fn) (request_rec * r, session_rec * z, const char *key, const char **value) = NULL;
+static int (*ap_session_get_fn) (request_rec * r, session_rec * z, const char *key, const char **value) = NULL;
const failable<value> userInfoFromSession(const string& realm, request_rec* r) {
debug("modopenauth::userInfoFromSession");
@@ -186,36 +231,23 @@ const failable<int> authenticated(const
}
/**
- * Run the authnz hooks to try to authenticate a request.
- */
-const failable<int> checkAuthnz(const string& user, const string& pw, request_rec* r) {
- const authn_provider* provider = (const authn_provider*)ap_lookup_provider(AUTHN_PROVIDER_GROUP, AUTHN_DEFAULT_PROVIDER, AUTHN_PROVIDER_VERSION);
- if (!provider || !provider->check_password)
- return mkfailure<int>("No Authn provider configured");
- apr_table_setn(r->notes, AUTHN_PROVIDER_NAME_NOTE, AUTHN_DEFAULT_PROVIDER);
- const authn_status auth_result = provider->check_password(r, c_str(user), c_str(pw));
- apr_table_unset(r->notes, AUTHN_PROVIDER_NAME_NOTE);
- if (auth_result != AUTH_GRANTED)
- return mkfailure<int>("Authentication failure for: " + user);
- return OK;
-}
-
-/**
* Check user authentication.
*/
static int checkAuthn(request_rec *r) {
+ gc_scoped_pool pool(r->pool);
+
// Decline if we're not enabled or AuthType is not set to Open
const DirConf& dc = httpd::dirConf<DirConf>(r, &mod_tuscany_openauth);
if (!dc.enabled)
return DECLINED;
const char* atype = ap_auth_type(r);
- debug(atype, "modopenauth::checkAuthn::auth_type");
if (atype == NULL || strcasecmp(atype, "Open"))
return DECLINED;
-
- // Create a scoped memory pool
- gc_scoped_pool pool(r->pool);
debug_httpdRequest(r, "modopenauth::checkAuthn::input");
+ debug(atype, "modopenauth::checkAuthn::auth_type");
+
+ // Get the request args
+ const list<list<value> > args = httpd::queryArgs(r);
// Get session id from the request
const maybe<string> sid = sessionID(r, "TuscanyOpenAuth");
@@ -231,17 +263,17 @@ static int checkAuthn(request_rec *r) {
return httpd::reportStatus(mkfailure<int>("Missing AuthName"));
// Extract user info from the session id
- const failable<value> info = userInfoFromCookie(content(sid), aname, r);
- if (hasContent(info)) {
+ const failable<value> userinfo = userInfoFromCookie(content(sid), aname, r);
+ if (hasContent(userinfo)) {
// Try to authenticate the request
- const value uinfo = content(info);
- const failable<int> authz = checkAuthnz(cadr(assoc<value>("id", uinfo)), cadr(assoc<value>("password", uinfo)), r);
+ const value uinfo = content(userinfo);
+ const failable<int> authz = checkAuthnz(cadr(assoc<value>("id", uinfo)), cadr(assoc<value>("password", uinfo)), r, dc);
if (!hasContent(authz)) {
// Authentication failed, redirect to login page
r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(login(dc.login, r));
+ return httpd::reportStatus(login(dc.login, value(), 1, r));
}
// Successfully authenticated, store the user info in the request
@@ -265,12 +297,12 @@ static int checkAuthn(request_rec *r) {
// Try to authenticate the request
const value uinfo = content(info);
- const failable<int> authz = checkAuthnz(cadr(assoc<value>("id", uinfo)), cadr(assoc<value>("password", uinfo)), r);
+ const failable<int> authz = checkAuthnz(cadr(assoc<value>("id", uinfo)), cadr(assoc<value>("password", uinfo)), r, dc);
if (!hasContent(authz)) {
// Authentication failed, redirect to login page
r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(login(dc.login, r));
+ return httpd::reportStatus(login(dc.login, value(), 1, r));
}
// Successfully authenticated, store the user info in the request
@@ -279,9 +311,6 @@ static int checkAuthn(request_rec *r) {
}
}
- // Get the request args
- const list<list<value> > args = httpd::queryArgs(r);
-
// Decline if the request is for another authentication provider
if (!isNil(assoc<value>("openid_identifier", args)))
return DECLINED;
@@ -291,57 +320,59 @@ static int checkAuthn(request_rec *r) {
hasContent(sessionID(r, "TuscanyOAuth1")) ||
hasContent(sessionID(r, "TuscanyOAuth2")))
return DECLINED;
+
r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(login(dc.login, r));
+ return httpd::reportStatus(login(dc.login, value(), value(), r));
}
/**
- * Fixup cache control.
+ * Save the auth session cookie in the response.
*/
-bool filterCacheControl(const string& tok) {
- return tok != "no-cache";
-}
+static int sessionCookieSave(request_rec* r, session_rec* z) {
+ gc_scoped_pool pool(r->pool);
-static apr_status_t outputFilter(ap_filter_t * f, apr_bucket_brigade * in) {
- request_rec *r = f->r->main;
- if (!r)
- r = f->r;
- for (; r != NULL; r = r->next) {
- if (r->status != HTTP_OK && r->status != HTTP_NOT_MODIFIED) {
+ const DirConf& dc = httpd::dirConf<DirConf>(r, &mod_tuscany_openauth);
+ if (!dc.enabled)
+ return DECLINED;
- // Don't cache errors and redirects
- debug("no-cache", "modopenauth::outputFilter::nokCacheControl");
- apr_table_set(r->headers_out, "Cache-Control", "no-cache");
- continue;
- }
+ debug(c_str(cookie("TuscanyOpenAuth", z->encoded, httpd::hostName(r))), "modopenauth::setcookie");
+ apr_table_set(r->err_headers_out, "Set-Cookie", c_str(cookie("TuscanyOpenAuth", z->encoded, httpd::hostName(r))));
+ return OK;
+}
- // Cache OK content
- const char* cc = apr_table_get(r->headers_out, "Cache-Control");
- if (cc == NULL) {
- debug("modopenauth::outputFilter::noCacheControl");
- continue;
- }
- debug(cc, "modopenauth::outputFilter::cacheControl");
- const string ncc = join(", ", filter<string>(filterCacheControl, tokenize(", ", cc)));
- if (length(ncc) == 0) {
- debug("modopenauth::outputFilter::noCacheControl");
- apr_table_unset(r->headers_out, "Cache-Control");
- continue;
- }
+/**
+ * Load the auth session cookie from the request. Similar
+ */
+static int sessionCookieLoad(request_rec* r, session_rec** z) {
+ gc_scoped_pool pool(r->pool);
- debug(ncc, "modopenauth::outputFilter::okCacheControl");
- apr_table_set(r->headers_out, "Cache-Control", c_str(ncc));
+ const DirConf& dc = httpd::dirConf<DirConf>(r, &mod_tuscany_openauth);
+ if (!dc.enabled)
+ return DECLINED;
+
+ // First look in the notes
+ const char* note = apr_pstrcat(r->pool, "mod_openauth", "TuscanyOpenAuth", NULL);
+ session_rec* zz = (session_rec*)(void*)apr_table_get(r->notes, note);
+ if (zz != NULL) {
+ *z = zz;
+ return OK;
}
- ap_remove_output_filter(f);
- return ap_pass_brigade(f->next, in);
-}
+ // Parse the cookie
+ const maybe<string> sid = openauth::sessionID(r, "TuscanyOpenAuth");
-/**
- * Insert our cache control output filter.
- */
-static void insertOutputFilter(request_rec * r) {
- ap_add_output_filter("mod_openauth", NULL, r, r->connection);
+ // Create a new session
+ zz = (session_rec*)apr_pcalloc(r->pool, sizeof(session_rec));
+ zz->pool = r->pool;
+ zz->entries = apr_table_make(r->pool, 10);
+ zz->encoded = hasContent(sid)? c_str(content(sid)) : NULL;
+ zz->uuid = (apr_uuid_t *) apr_pcalloc(r->pool, sizeof(apr_uuid_t));
+ *z = zz;
+
+ // Store it in the notes
+ apr_table_setn(r->notes, note, (char*)zz);
+
+ return OK;
}
/**
@@ -357,6 +388,7 @@ int postConfigMerge(ServerConf& mainsc,
int postConfig(apr_pool_t* p, unused apr_pool_t* plog, unused apr_pool_t* ptemp, server_rec* s) {
gc_scoped_pool pool(p);
+
ServerConf& sc = httpd::serverConf<ServerConf>(s, &mod_tuscany_openauth);
debug(httpd::serverName(s), "modopenauth::postConfig::serverName");
@@ -369,6 +401,7 @@ int postConfig(apr_pool_t* p, unused apr
*/
void childInit(apr_pool_t* p, server_rec* s) {
gc_scoped_pool pool(p);
+
ServerConf* psc = (ServerConf*)ap_get_module_config(s->module_config, &mod_tuscany_openauth);
if(psc == NULL) {
cfailure << "[Tuscany] Due to one or more errors mod_tuscany_openauth loading failed. Causing apache to stop loading." << endl;
@@ -395,11 +428,25 @@ const char* confLogin(cmd_parms *cmd, vo
dc.login = arg;
return NULL;
}
+const char* confAuthnProvider(cmd_parms *cmd, void *c, const char* arg) {
+ gc_scoped_pool pool(cmd->pool);
+ DirConf& dc = httpd::dirConf<DirConf>(c);
+
+ // Lookup and cache the Authn provider
+ const authn_provider* provider = (authn_provider*)ap_lookup_provider(AUTHN_PROVIDER_GROUP, arg, AUTHN_PROVIDER_VERSION);
+ if (provider == NULL)
+ return apr_psprintf(cmd->pool, "Unknown Authn provider: %s", arg);
+ if (!provider->check_password)
+ return apr_psprintf(cmd->pool, "The '%s' Authn provider doesn't support password authentication", arg);
+ dc.apcs = append<AuthnProviderConf>(dc.apcs, mklist<AuthnProviderConf>(AuthnProviderConf(arg, provider)));
+ return NULL;
+}
/**
* HTTP server module declaration.
*/
const command_rec commands[] = {
+ AP_INIT_ITERATE("AuthOpenAuthProvider", (const char*(*)())confAuthnProvider, NULL, OR_AUTHCFG, "Auth providers for a directory or location"),
AP_INIT_FLAG("AuthOpenAuth", (const char*(*)())confEnabled, NULL, OR_AUTHCFG, "Tuscany Open Auth authentication On | Off"),
AP_INIT_TAKE1("AuthOpenAuthLoginPage", (const char*(*)())confLogin, NULL, OR_AUTHCFG, "Tuscany Open Auth login page"),
{NULL, NULL, NULL, 0, NO_ARGS, NULL}
@@ -409,8 +456,8 @@ void registerHooks(unused apr_pool_t *p)
ap_hook_post_config(postConfig, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_child_init(childInit, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_check_authn(checkAuthn, NULL, NULL, APR_HOOK_MIDDLE, AP_AUTH_INTERNAL_PER_CONF);
- ap_register_output_filter("mod_openauth", outputFilter, NULL, AP_FTYPE_CONTENT_SET);
- ap_hook_insert_filter(insertOutputFilter, NULL, NULL, APR_HOOK_LAST);
+ ap_hook_session_load(sessionCookieLoad, NULL, NULL, APR_HOOK_MIDDLE);
+ ap_hook_session_save(sessionCookieSave, NULL, NULL, APR_HOOK_MIDDLE);
}
}
Modified: tuscany/sca-cpp/trunk/modules/http/mod-security-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/mod-security-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/mod-security-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/mod-security-conf Mon Jul 16 06:47:49 2012
@@ -51,8 +51,8 @@ SecDefaultAction "phase:2,pass,nolog,aud
#SecDebugLog $root/logs//modsec_debug_log
#SecDebugLogLevel 3
-# Allow mod-security to access request bodies
-SecRequestBodyAccess On
+# Process request bodies
+SecRequestBodyAccess Off
SecRule REQUEST_HEADERS:Content-Type "text/xml" "phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRule REQUEST_HEADERS:Content-Type "application/xml" "phase:1,t:none,t:lowercase,pass,nolog,ctl:requestBodyProcessor=XML"
SecRequestBodyLimit 13107200
@@ -90,8 +90,8 @@ SecRule RESPONSE_STATUS "@streq 408" "ph
SecRule IP:SLOW_DOS_COUNTER "@gt 5" "phase:1,t:none,log,drop, msg:'Client Connection Dropped due to high # of slow DoS alerts'"
SecWriteStateLimit 50
-# Allow mod-security to access response bodies
-SecResponseBodyAccess On
+# Process response bodies
+SecResponseBodyAccess Off
SecResponseBodyMimeType text/plain text/html text/xml application/xml
SecResponseBodyLimit 524288
SecResponseBodyLimitAction ProcessPartial
@@ -157,28 +157,28 @@ SecRule &TX:REAL_IP "@eq 0" "phase:1,id
# Include all base mod-security CRS rules
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_20_protocol_violations.conf
-Include ${modsecurity_prefix}/base_rules/modsecurity_crs_41_xss_attacks.conf
-Include ${modsecurity_prefix}/base_rules/modsecurity_crs_50_outbound.conf
+#Include ${modsecurity_prefix}/base_rules/modsecurity_crs_41_xss_attacks.conf
+#Include ${modsecurity_prefix}/base_rules/modsecurity_crs_50_outbound.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_35_bad_robots.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_47_common_exceptions.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_60_correlation.conf
-Include ${modsecurity_prefix}/base_rules/modsecurity_crs_40_generic_attacks.conf
+#Include ${modsecurity_prefix}/base_rules/modsecurity_crs_40_generic_attacks.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_21_protocol_anomalies.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_30_http_policy.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_49_inbound_blocking.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_41_sql_injection_attacks.conf
-Include ${modsecurity_prefix}/base_rules/modsecurity_crs_45_trojans.conf
+#Include ${modsecurity_prefix}/base_rules/modsecurity_crs_45_trojans.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_59_outbound_blocking.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_23_request_limits.conf
Include ${modsecurity_prefix}/base_rules/modsecurity_crs_42_tight_security.conf
# Include some optional mod-security CRS rules
-Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_10_ignore_static.conf
-Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_13_xml_enabler.conf
-Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_25_cc_known.conf
-Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_42_comment_spam.conf
-Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_47_skip_outbound_checks.conf
-Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_55_application_defects.conf
+#Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_10_ignore_static.conf
+#Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_13_xml_enabler.conf
+#Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_25_cc_known.conf
+#Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_42_comment_spam.conf
+#Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_47_skip_outbound_checks.conf
+#Include ${modsecurity_prefix}/optional_rules/modsecurity_crs_55_application_defects.conf
EOF
Modified: tuscany/sca-cpp/trunk/modules/http/open-auth-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/open-auth-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/open-auth-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/open-auth-conf Mon Jul 16 06:47:49 2012
@@ -40,14 +40,20 @@ else
fi
if [ "$2" = "" ]; then
+ providers="file"
+else
+ providers="$2 file"
+fi
+
+if [ "$3" = "" ]; then
pw=`cat $root/cert/ca.key | head -2 | tail -1`
else
- pw="$2"
+ pw="$3"
fi
# Configure HTTPD mod_tuscany_openauth module
cat >>$root/conf/modules.conf <<EOF
-# Generated by: openauth-conf $*
+# Generated by: open-auth-conf $*
# Load support for Open authentication
LoadModule mod_tuscany_openauth $here/libmod_tuscany_openauth$libsuffix
@@ -67,11 +73,13 @@ cat >>$root/conf/locauth$sslsuffix.conf
<Location />
AuthType Open
AuthName "$host"
+AuthOpenAuthProvider socache $providers
+AuthnCacheProvideFor $providers
+AuthnCacheContext /
Session On
-SessionCookieName TuscanyOpenAuth domain=.$host; path=/
SessionCryptoPassphrase $pw
AuthOpenAuth On
-AuthOpenAuthLoginPage /login
+AuthOpenAuthLoginPage /login/
Require valid-user
</Location>
@@ -79,8 +87,10 @@ Require valid-user
<Location /login/dologin>
AuthType Form
AuthName "$host"
-AuthFormProvider file
-AuthFormLoginRequiredLocation /login
+AuthFormProvider socache $providers
+AuthnCacheProvideFor $providers
+AuthnCacheContext /
+AuthFormLoginRequiredLocation /login/?openauth_attempt=1
AuthFormLogoutLocation /
Require valid-user
SetHandler form-login-handler
Modified: tuscany/sca-cpp/trunk/modules/http/openauth.hpp
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/openauth.hpp?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/openauth.hpp (original)
+++ tuscany/sca-cpp/trunk/modules/http/openauth.hpp Mon Jul 16 06:47:49 2012
@@ -77,7 +77,7 @@ const string cookie(const string& key, c
const time_t t = time(NULL) + 86400;
char exp[32];
strftime(exp, 32, "%a, %d-%b-%Y %H:%M:%S GMT", gmtime(&t));
- const string c = key + string("=") + sid + "; expires=" + string(exp) + "; domain=." + domain + "; path=/";
+ const string c = key + string("=") + sid + "; expires=" + string(exp) + "; domain=." + httpd::realm(domain) + "; path=/";
debug(c, "openauth::cookie");
return c;
}
@@ -85,9 +85,11 @@ const string cookie(const string& key, c
/**
* Redirect to the configured login page.
*/
-const failable<int> login(const string& page, request_rec* r) {
- const list<list<value> > largs = mklist<list<value> >(mklist<value>("openauth_referrer", httpd::escape(httpd::url(r->uri, r))));
- const string loc = httpd::url(page, r) + string("?") + http::queryString(largs);
+const failable<int> login(const string& page, const value& ref, const value& attempt, request_rec* r) {
+ const list<list<value> > rarg = ref == string("/")? list<list<value> >() : mklist<list<value> >(mklist<value>("openauth_referrer", httpd::escape(httpd::url(isNil(ref)? r->uri : ref, r))));
+ const list<list<value> > aarg = isNil(attempt)? list<list<value> >() : mklist<list<value> >(mklist<value>("openauth_attempt", attempt));
+ const list<list<value> > largs = append<list<value> >(rarg, aarg);
+ const string loc = isNil(largs)? httpd::url(page, r) : httpd::url(page, r) + string("?") + http::queryString(largs);
debug(loc, "openauth::login::uri");
return httpd::externalRedirect(loc, r);
}
Modified: tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf (original)
+++ tuscany/sca-cpp/trunk/modules/http/passwd-auth-conf Mon Jul 16 06:47:49 2012
@@ -27,5 +27,5 @@ httpd_prefix=`cat $here/httpd.prefix`
# Create password file
touch $root/conf/httpd.passwd
-$httpd_prefix/bin/htpasswd -b $root/conf/httpd.passwd $user $pass 2>/dev/null
+$httpd_prefix/bin/htpasswd -b $root/conf/httpd.passwd "$user" "$pass" 2>/dev/null
Modified: tuscany/sca-cpp/trunk/modules/oauth/Makefile.am
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/oauth/Makefile.am?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/oauth/Makefile.am (original)
+++ tuscany/sca-cpp/trunk/modules/oauth/Makefile.am Mon Jul 16 06:47:49 2012
@@ -19,7 +19,7 @@ if WANT_OAUTH
INCLUDES = -I${HTTPD_INCLUDE} -I${LIBOAUTH_INCLUDE}
-dist_mod_SCRIPTS = oauth-conf oauth-memcached-conf oauth1-appkey-conf oauth2-appkey-conf
+dist_mod_SCRIPTS = oauth-conf oauth12-conf oauth-memcached-conf oauth1-appkey-conf oauth2-appkey-conf
moddir=$(prefix)/modules/oauth
mod_LTLIBRARIES = libmod_tuscany_oauth1.la libmod_tuscany_oauth2.la
Modified: tuscany/sca-cpp/trunk/modules/oauth/mod-oauth1.cpp
URL: http://svn.apache.org/viewvc/tuscany/sca-cpp/trunk/modules/oauth/mod-oauth1.cpp?rev=1361915&r1=1361914&r2=1361915&view=diff
==============================================================================
--- tuscany/sca-cpp/trunk/modules/oauth/mod-oauth1.cpp (original)
+++ tuscany/sca-cpp/trunk/modules/oauth/mod-oauth1.cpp Mon Jul 16 06:47:49 2012
@@ -71,6 +71,20 @@ public:
};
/**
+ * Authentication provider configuration.
+ */
+class AuthnProviderConf {
+public:
+ AuthnProviderConf() : name(), provider(NULL) {
+ }
+ AuthnProviderConf(const string name, const authn_provider* provider) : name(name), provider(provider) {
+ }
+
+ string name;
+ const authn_provider* provider;
+};
+
+/**
* Directory configuration.
*/
class DirConf {
@@ -83,9 +97,39 @@ public:
bool enabled;
string login;
list<list<value> > scopeattrs;
+ list<AuthnProviderConf> apcs;
};
/**
+ * Run the authnz hooks to authenticate a request.
+ */
+const failable<int> checkAuthnzProviders(const string& user, request_rec* r, const list<AuthnProviderConf>& apcs) {
+ if (isNil(apcs))
+ return mkfailure<int>("Authentication failure for: " + user, HTTP_UNAUTHORIZED);
+ const AuthnProviderConf apc = car<AuthnProviderConf>(apcs);
+ if (apc.provider == NULL || !apc.provider->check_password)
+ return checkAuthnzProviders(user, r, cdr(apcs));
+
+ apr_table_setn(r->notes, AUTHN_PROVIDER_NAME_NOTE, c_str(apc.name));
+ const authn_status auth_result = apc.provider->check_password(r, c_str(string("/oauth1/") + user), "password");
+ apr_table_unset(r->notes, AUTHN_PROVIDER_NAME_NOTE);
+ if (auth_result != AUTH_GRANTED)
+ return checkAuthnzProviders(user, r, cdr(apcs));
+ return OK;
+}
+
+const failable<int> checkAuthnz(const string& user, request_rec* r, const list<AuthnProviderConf>& apcs) {
+ if (substr(user, 0, 1) == "/")
+ return mkfailure<int>(string("Encountered FakeBasicAuth spoof: ") + user, HTTP_UNAUTHORIZED);
+
+ if (isNil(apcs)) {
+ const authn_provider* provider = (const authn_provider*)ap_lookup_provider(AUTHN_PROVIDER_GROUP, AUTHN_DEFAULT_PROVIDER, AUTHN_PROVIDER_VERSION);
+ return checkAuthnzProviders(user, r, mklist<AuthnProviderConf>(AuthnProviderConf(AUTHN_DEFAULT_PROVIDER, provider)));
+ }
+ return checkAuthnzProviders(user, r, apcs);
+}
+
+/**
* Return the user info for a session.
*/
const failable<value> userInfo(const value& sid, const memcache::MemCached& mc) {
@@ -95,27 +139,31 @@ const failable<value> userInfo(const val
/**
* Handle an authenticated request.
*/
-const failable<int> authenticated(const list<list<value> >& attrs, const list<list<value> >& info, request_rec* r) {
- debug(info, "modoauth1::authenticated::info");
+const failable<int> authenticated(const list<list<value> >& userinfo, const bool check, request_rec* r, const list<list<value> >& scopeattrs, const list<AuthnProviderConf>& apcs) {
+ debug(userinfo, "modoauth2::authenticated::userinfo");
- if (isNil(attrs)) {
+ if (isNil(scopeattrs)) {
// Store user id in an environment variable
- const list<value> id = assoc<value>("id", info);
+ const list<value> id = assoc<value>("id", userinfo);
if (isNil(id) || isNil(cdr(id)))
return mkfailure<int>("Couldn't retrieve user id");
- apr_table_set(r->subprocess_env, "OAUTH1_ID", apr_pstrdup(r->pool, c_str(cadr(id))));
+ apr_table_set(r->subprocess_env, "OAUTH2_ID", apr_pstrdup(r->pool, c_str(cadr(id))));
// If the request user field has not been mapped to another attribute, map the
// OAuth id attribute to it
if (r->user == NULL || r->user[0] == '\0')
r->user = apr_pstrdup(r->pool, c_str(cadr(id)));
+
+ // Run the authnz hooks to check the authenticated user
+ if (check)
+ return checkAuthnz(r->user == NULL? "" : r->user, r, apcs);
return OK;
}
- // Store each configure OAuth scope attribute in an environment variable
- const list<value> a = car(attrs);
- const list<value> v = assoc<value>(cadr(a), info);
+ // Store each configured OAuth scope attribute in an environment variable
+ const list<value> a = car(scopeattrs);
+ const list<value> v = assoc<value>(cadr(a), userinfo);
if (!isNil(v) && !isNil(cdr(v))) {
// Map the REMOTE_USER attribute to the request user field
@@ -124,7 +172,7 @@ const failable<int> authenticated(const
else
apr_table_set(r->subprocess_env, apr_pstrdup(r->pool, c_str(car(a))), apr_pstrdup(r->pool, c_str(cadr(v))));
}
- return authenticated(cdr(attrs), info, r);
+ return authenticated(userinfo, check, r, cdr(scopeattrs), apcs);
}
/**
@@ -297,7 +345,8 @@ const failable<list<value> > profileUser
/**
* Handle an access_token request.
*/
-const failable<int> accessToken(const list<list<value> >& args, request_rec* r, const list<list<value> >& appkeys, const memcache::MemCached& mc) {
+const failable<int> accessToken(const list<list<value> >& args, request_rec* r, const list<list<value> >& appkeys, const list<list<value> >& scopeattrs, const list<AuthnProviderConf>& apcs, const memcache::MemCached& mc) {
+
// Extract access_token URI, client ID and verification code
const list<value> ref = assoc<value>("openauth_referrer", args);
if (isNil(ref) || isNil(cdr(ref)))
@@ -372,13 +421,18 @@ const failable<int> accessToken(const li
debug(profres, "modoauth1::access_token::profres");
// Retrieve the user info from the profile
- const failable<list<value> > iv = profileUserInfo(cadr(cid), profres);
- if (!hasContent(iv))
- return mkfailure<int>(iv);
+ const failable<list<value> > userinfo = profileUserInfo(cadr(cid), profres);
+ if (!hasContent(userinfo))
+ return mkfailure<int>(userinfo);
+
+ // Validate the authenticated user
+ const failable<int> authrc = authenticated(content(userinfo), true, r, scopeattrs, apcs);
+ if (!hasContent(authrc))
+ return authrc;
// Store user info in memcached keyed by session ID
const value sid = string("OAuth1_") + mkrand();
- const failable<bool> prc = memcache::put(mklist<value>("tuscanyOAuth1", sid), content(iv), mc);
+ const failable<bool> prc = memcache::put(mklist<value>("tuscanyOAuth1", sid), content(userinfo), mc);
if (!hasContent(prc))
return mkfailure<int>(prc);
@@ -392,20 +446,19 @@ const failable<int> accessToken(const li
* Check user authentication.
*/
static int checkAuthn(request_rec *r) {
+ gc_scoped_pool pool(r->pool);
+
// Decline if we're not enabled or AuthType is not set to Open
const DirConf& dc = httpd::dirConf<DirConf>(r, &mod_tuscany_oauth1);
if (!dc.enabled)
return DECLINED;
const char* atype = ap_auth_type(r);
- debug(atype, "modopenauth::checkAuthn::auth_type");
if (atype == NULL || strcasecmp(atype, "Open"))
return DECLINED;
-
- // Create a scoped memory pool
- gc_scoped_pool pool(r->pool);
+ debug_httpdRequest(r, "modoauth1::checkAuthn::input");
+ debug(atype, "modopenauth::checkAuthn::auth_type");
// Get the server configuration
- debug_httpdRequest(r, "modoauth1::checkAuthn::input");
const ServerConf& sc = httpd::serverConf<ServerConf>(r, &mod_tuscany_oauth1);
// Get session id from the request
@@ -415,24 +468,33 @@ static int checkAuthn(request_rec *r) {
if (substr(content(sid), 0, 7) != "OAuth1_")
return DECLINED;
- // If we're authenticated store the user info in the request
- const failable<value> info = userInfo(content(sid), sc.mc);
- if (hasContent(info)) {
- r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(authenticated(dc.scopeattrs, content(info), r));
- }
+ // Extract the user info from the auth session
+ const failable<value> userinfo = userInfo(content(sid), sc.mc);
+ if (!hasContent(userinfo))
+ return httpd::reportStatus(mkfailure<int>(userinfo));
+ r->ap_auth_type = const_cast<char*>(atype);
+ return httpd::reportStatus(authenticated(content(userinfo), false, r, dc.scopeattrs, dc.apcs));
}
+ // Get the request args
+ const list<list<value> > args = httpd::queryArgs(r);
+
// Handle OAuth authorize request step
if (string(r->uri) == "/oauth1/authorize/") {
r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(authorize(httpd::queryArgs(r), r, sc.appkeys, sc.mc));
+ return httpd::reportStatus(authorize(args, r, sc.appkeys, sc.mc));
}
// Handle OAuth access_token request step
if (string(r->uri) == "/oauth1/access_token/") {
r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(accessToken(httpd::queryArgs(r), r, sc.appkeys, sc.mc));
+ const failable<int> authrc = accessToken(args, r, sc.appkeys, dc.scopeattrs, dc.apcs, sc.mc);
+
+ // Redirect to the login page if user is not authorized
+ if (!hasContent(authrc) && rcode(authrc) == HTTP_UNAUTHORIZED)
+ return httpd::reportStatus(openauth::login(dc.login, string("/"), 1, r));
+
+ return httpd::reportStatus(authrc);
}
// Redirect to the login page, unless we have a session id or an authorization
@@ -443,10 +505,11 @@ static int checkAuthn(request_rec *r) {
hasContent(openauth::sessionID(r, "TuscanyOpenAuth")) ||
hasContent(openauth::sessionID(r, "TuscanyOAuth2")))
return DECLINED;
- if ((substr(string(r->uri), 0, 8) == "/oauth2/") || !isNil(assoc<value>("openid_identifier", httpd::queryArgs(r))))
+ if ((substr(string(r->uri), 0, 8) == "/oauth2/") || !isNil(assoc<value>("openid_identifier", args)))
return DECLINED;
+
r->ap_auth_type = const_cast<char*>(atype);
- return httpd::reportStatus(openauth::login(dc.login, r));
+ return httpd::reportStatus(openauth::login(dc.login, value(), value(), r));
}
/**
@@ -471,6 +534,7 @@ int postConfigMerge(ServerConf& mainsc,
int postConfig(apr_pool_t* p, unused apr_pool_t* plog, unused apr_pool_t* ptemp, server_rec* s) {
gc_scoped_pool pool(p);
+
ServerConf& sc = httpd::serverConf<ServerConf>(s, &mod_tuscany_oauth1);
debug(httpd::serverName(s), "modoauth1::postConfig::serverName");
@@ -487,7 +551,7 @@ public:
}
const gc_ptr<http::CURLSession> operator()() const {
- return new (gc_new<http::CURLSession>()) http::CURLSession(ca, cert, key, "");
+ return new (gc_new<http::CURLSession>()) http::CURLSession(ca, cert, key, "", 0);
}
private:
@@ -501,6 +565,7 @@ private:
*/
void childInit(apr_pool_t* p, server_rec* s) {
gc_scoped_pool pool(p);
+
ServerConf* psc = (ServerConf*)ap_get_module_config(s->module_config, &mod_tuscany_oauth1);
if(psc == NULL) {
cfailure << "[Tuscany] Due to one or more errors mod_tuscany_oauth1 loading failed. Causing apache to stop loading." << endl;
@@ -572,11 +637,25 @@ const char* confScopeAttr(cmd_parms *cmd
dc.scopeattrs = cons<list<value> >(mklist<value>(arg1, arg2), dc.scopeattrs);
return NULL;
}
+const char* confAuthnProvider(cmd_parms *cmd, void *c, const char* arg) {
+ gc_scoped_pool pool(cmd->pool);
+ DirConf& dc = httpd::dirConf<DirConf>(c);
+
+ // Lookup and cache the Authn provider
+ const authn_provider* provider = (authn_provider*)ap_lookup_provider(AUTHN_PROVIDER_GROUP, arg, AUTHN_PROVIDER_VERSION);
+ if (provider == NULL)
+ return apr_psprintf(cmd->pool, "Unknown Authn provider: %s", arg);
+ if (!provider->check_password)
+ return apr_psprintf(cmd->pool, "The '%s' Authn provider doesn't support password authentication", arg);
+ dc.apcs = append<AuthnProviderConf>(dc.apcs, mklist<AuthnProviderConf>(AuthnProviderConf(arg, provider)));
+ return NULL;
+}
/**
* HTTP server module declaration.
*/
const command_rec commands[] = {
+ AP_INIT_ITERATE("AuthOAuthProvider", (const char*(*)())confAuthnProvider, NULL, OR_AUTHCFG, "Auth providers for a directory or location"),
AP_INIT_TAKE3("AddAuthOAuth1AppKey", (const char*(*)())confAppKey, NULL, RSRC_CONF, "OAuth 1.0 name app-id app-key"),
AP_INIT_ITERATE("AddAuthOAuthMemcached", (const char*(*)())confMemcached, NULL, RSRC_CONF, "Memcached server host:port"),
AP_INIT_FLAG("AuthOAuth", (const char*(*)())confEnabled, NULL, OR_AUTHCFG, "OAuth 1.0 authentication On | Off"),