544 lines
14 KiB
Perl
544 lines
14 KiB
Perl
package Apache::Authn::Redmine;
|
|
|
|
=head1 Apache::Authn::Redmine
|
|
|
|
Redmine - a mod_perl module to authenticate webdav subversion users
|
|
against redmine database
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
This module allow anonymous users to browse public project and
|
|
registred users to browse and commit their project. Authentication is
|
|
done against the redmine database or the LDAP configured in redmine.
|
|
|
|
This method is far simpler than the one with pam_* and works with all
|
|
database without an hassle but you need to have apache/mod_perl on the
|
|
svn server.
|
|
|
|
=head1 INSTALLATION
|
|
|
|
For this to automagically work, you need to have a recent reposman.rb
|
|
(after r860) and if you already use reposman, read the last section to
|
|
migrate.
|
|
|
|
Sorry ruby users but you need some perl modules, at least mod_perl2,
|
|
DBI and DBD::mysql (or the DBD driver for you database as it should
|
|
work on allmost all databases).
|
|
|
|
On debian/ubuntu you must do :
|
|
|
|
aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
|
|
|
|
If your Redmine users use LDAP authentication, you will also need
|
|
Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
|
|
|
|
aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
|
|
|
|
=head1 CONFIGURATION
|
|
|
|
## This module has to be in your perl path
|
|
## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm
|
|
PerlLoadModule Apache::Authn::Redmine
|
|
<Location /svn>
|
|
DAV svn
|
|
SVNParentPath "/var/svn"
|
|
|
|
AuthType Basic
|
|
AuthName redmine
|
|
Require valid-user
|
|
|
|
PerlAuthenHandler Apache::Authn::Redmine::authen_handler
|
|
PerlAuthzHandler Apache::Authn::Redmine::authz_handler
|
|
|
|
## for mysql
|
|
RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
|
|
## for postgres
|
|
# RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
|
|
|
|
RedmineDbUser "redmine"
|
|
RedmineDbPass "password"
|
|
## Optional where clause (fulltext search would be slow and
|
|
## database dependant).
|
|
# RedmineDbWhereClause "and members.role_id IN (1,2)"
|
|
## Optional credentials cache size
|
|
# RedmineCacheCredsMax 50
|
|
</Location>
|
|
|
|
To be able to browse repository inside redmine, you must add something
|
|
like that :
|
|
|
|
<Location /svn-private>
|
|
DAV svn
|
|
SVNParentPath "/var/svn"
|
|
Order deny,allow
|
|
Deny from all
|
|
# only allow reading orders
|
|
<Limit GET PROPFIND OPTIONS REPORT>
|
|
Allow from redmine.server.ip
|
|
</Limit>
|
|
</Location>
|
|
|
|
and you will have to use this reposman.rb command line to create repository :
|
|
|
|
reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
|
|
|
|
=head1 MIGRATION FROM OLDER RELEASES
|
|
|
|
If you use an older reposman.rb (r860 or before), you need to change
|
|
rights on repositories to allow the apache user to read and write
|
|
S<them :>
|
|
|
|
sudo chown -R www-data /var/svn/*
|
|
sudo chmod -R u+w /var/svn/*
|
|
|
|
And you need to upgrade at least reposman.rb (after r860).
|
|
|
|
=cut
|
|
|
|
use strict;
|
|
use warnings FATAL => 'all', NONFATAL => 'redefine';
|
|
|
|
use DBI;
|
|
use Digest::SHA1;
|
|
# optional module for LDAP authentication
|
|
my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
|
|
|
|
# Reload ourself (disable in production)
|
|
use Apache2::Reload;
|
|
|
|
use Apache2::Module;
|
|
use Apache2::Access;
|
|
use Apache2::ServerRec qw();
|
|
use Apache2::RequestRec qw();
|
|
use Apache2::RequestUtil qw();
|
|
use Apache2::Const qw(:common :override :cmd_how);
|
|
use Apache2::Log;
|
|
use APR::Pool ();
|
|
use APR::Table ();
|
|
|
|
# use Apache2::Directive qw();
|
|
|
|
my @directives = (
|
|
{
|
|
name => 'RedmineDSN',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Redmine database DSN in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
|
|
},
|
|
{
|
|
name => 'RedmineDbUser',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Redmine database user',
|
|
},
|
|
{
|
|
name => 'RedmineDbPass',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Redmine database password',
|
|
},
|
|
{
|
|
name => 'RedmineDbWhereClause',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Additionnal where clause used when checking for user permissions',
|
|
},
|
|
{
|
|
name => 'RedmineProject',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Identifier (short name) of a Redmine project. If undefined, extract the project identifier from the location.',
|
|
},
|
|
{
|
|
name => 'RedmineReadPermissions',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => ITERATE,
|
|
errmsg => 'Permissions to check for read access. Defaults to :browse_repository.',
|
|
},
|
|
{
|
|
name => 'RedmineWritePermissions',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => ITERATE,
|
|
errmsg => 'Permissions to check for write access. Defaults to :commit_access.',
|
|
},
|
|
{
|
|
name => 'RedmineCacheCredsMax',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Maximum number of credentials to cache. Set to 0 to disable credential caching.',
|
|
},
|
|
{
|
|
name => 'RedmineCacheCredsMaxAge',
|
|
req_override => OR_AUTHCFG,
|
|
args_how => TAKE1,
|
|
errmsg => 'Maximum age of cached credentials. Defaults to 300. Set to 0 to disable credential expiration.',
|
|
},
|
|
);
|
|
|
|
sub RedmineDSN {
|
|
my ($cfg, $parms, $arg) = @_;
|
|
$cfg->{DSN} = $arg;
|
|
$cfg->{Query} = trim("
|
|
SELECT permissions FROM users, members, member_roles, roles
|
|
WHERE users.login = ?
|
|
AND users.id = members.user_id
|
|
AND users.status = 1
|
|
AND members.project_id = ?
|
|
AND members.id = member_roles.member_id
|
|
AND member_roles.role_id = roles.id
|
|
");
|
|
}
|
|
|
|
sub RedmineDbUser { set_val('DbUser', @_); }
|
|
sub RedmineDbPass { set_val('DbPass', @_); }
|
|
sub RedmineCacheCredsMaxAge { set_val('CacheCredsMaxAge', @_); }
|
|
sub RedmineProject { set_val('Project', @_); }
|
|
|
|
sub RedmineDbWhereClause {
|
|
my ($cfg, $parms, $arg) = @_;
|
|
$cfg->{Query} = trim($cfg->{Query}.($arg || "")." ");
|
|
}
|
|
|
|
sub RedmineCacheCredsMax {
|
|
my ($cfg, $parms, $arg) = @_;
|
|
if ($arg) {
|
|
$cfg->{CachePool} = APR::Pool->new;
|
|
$cfg->{CacheCreds} = APR::Table::make($cfg->{CachePool}, $arg);
|
|
$cfg->{CacheCredsCount} = 0;
|
|
$cfg->{CacheCredsMax} = $arg;
|
|
$cfg->{CacheCredsMaxAge} ||= 300;
|
|
}
|
|
}
|
|
|
|
|
|
sub RedmineReadPermissions {
|
|
my ( $cfg, $parms, $arg ) = @_;
|
|
push @{ $cfg->{ReadPermissions} }, $arg;
|
|
}
|
|
|
|
sub RedmineWritePermissions {
|
|
my ( $cfg, $parms, $arg ) = @_;
|
|
push @{ $cfg->{WritePermissions} }, $arg;
|
|
}
|
|
|
|
sub trim {
|
|
my $string = shift;
|
|
$string =~ s/\s{2,}/ /g;
|
|
return $string;
|
|
}
|
|
|
|
sub set_val {
|
|
my ($key, $self, $parms, $arg) = @_;
|
|
$self->{$key} = $arg;
|
|
}
|
|
|
|
Apache2::Module::add(__PACKAGE__, \@directives);
|
|
|
|
my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
|
|
my @default_read_permissions = ( ':browse_repository' );
|
|
my @default_write_permissions = ( ':commit_access' );
|
|
|
|
sub authen_handler {
|
|
my $r = shift;
|
|
|
|
unless ($r->some_auth_required) {
|
|
$r->log_reason("No authentication has been configured");
|
|
return FORBIDDEN;
|
|
}
|
|
|
|
my ($res, $password) = $r->get_basic_auth_pw();
|
|
my $reason;
|
|
|
|
if($res == OK) {
|
|
# Got user and password
|
|
|
|
# Used cached credentials if possible
|
|
my $cache_key = get_cache_key($r, $password);
|
|
if(cache_get($r, $cache_key)) {
|
|
$r->log->debug("reusing cached credentials for user '", $r->user, "'");
|
|
$r->set_handlers(PerlAuthzHandler => undef);
|
|
|
|
} else {
|
|
# Else check them
|
|
my $dbh = connect_database($r);
|
|
($res, $reason) = check_login($r, $dbh, $password);
|
|
$dbh->disconnect();
|
|
|
|
# Store the cache key for latter use
|
|
$r->pnotes("RedmineCacheKey" => $cache_key) if $res == OK;
|
|
}
|
|
|
|
} elsif($res == AUTH_REQUIRED) {
|
|
my $dbh = connect_database($r);
|
|
if(is_authentication_forced($dbh)) {
|
|
# We really want an user
|
|
$reason = 'anonymous access disabled';
|
|
} else {
|
|
# Anonymous is allowed
|
|
$res = OK;
|
|
}
|
|
$dbh->disconnect();
|
|
|
|
}
|
|
|
|
$r->log_reason($reason) if defined($reason);
|
|
$r->note_basic_auth_failure unless $res == OK;
|
|
|
|
return $res;
|
|
}
|
|
|
|
|
|
sub check_login {
|
|
my ($r, $dbh, $password) = @_;
|
|
my $user = $r->user;
|
|
|
|
my ($hashed_password, $status, $auth_source_id, $salt) = $dbh->selectrow_arrayref('SELECT hashed_password, status, auth_source_id, salt FROM users WHERE login = ?', $user);
|
|
|
|
# Not found
|
|
return (AUTH_REQUIRED, "unknown user '$user'") unless defined($hashed_password);
|
|
|
|
# Check password
|
|
if($auth_source_id) {
|
|
# LDAP authentication
|
|
|
|
# Ensure Authen::Simple::LDAP is available
|
|
return (SERVER_ERROR, "Redmine LDAP authentication requires Authen::Simple::LDAP")
|
|
unless $CanUseLDAPAuth;
|
|
|
|
# Get LDAP server informations
|
|
my($host, $port, $tls, $account, $account_password, $base_dn, $attr_login) = query_fetch_first(
|
|
$dbh,
|
|
"SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?",
|
|
$auth_source_id
|
|
);
|
|
|
|
# Check them
|
|
return (SERVER_ERROR, "Undefined authentication source for '$user'")
|
|
unless defined $host;
|
|
|
|
# Connect to the LDAP server
|
|
my $ldap = Authen::Simple::LDAP->new(
|
|
host => is_true($tls) ? "ldaps://$host:$port" : $host,
|
|
port => $port,
|
|
basedn => $base_dn,
|
|
binddn => $account || "",
|
|
bindpw => $account_password || "",
|
|
filter => '('.$attr_login.'=%s)'
|
|
);
|
|
|
|
# Finally check user login
|
|
return (AUTH_REQUIRED, "LDAP authentication failed (user: '$user', server: '$host')")
|
|
unless $ldap->authenticate($user, $password);
|
|
|
|
} else {
|
|
# Database authentication
|
|
my $pass_digest = Digest::SHA1::sha1_hex($password);
|
|
return (AUTH_REQUIRED, "wrong password for '$user'")
|
|
unless $hashed_password eq Digest::SHA1::sha1_hex($salt.$pass_digest);
|
|
}
|
|
|
|
# Password is ok, check if account if locked
|
|
return (FORBIDDEN, "inactive account: '$user'") unless $status == 1;
|
|
|
|
$r->log->debug("successfully authenticated as active redmine user '$user'");
|
|
|
|
# Everything's ok
|
|
return OK;
|
|
}
|
|
|
|
# check if authentication is forced
|
|
sub is_authentication_forced {
|
|
my $dbh = shift;
|
|
return is_true($dbh->selectrow_arrayref("SELECT value FROM settings WHERE settings.name = 'login_required'"));
|
|
}
|
|
|
|
sub authz_handler {
|
|
my $r = shift;
|
|
|
|
unless ($r->some_auth_required) {
|
|
$r->log_reason("No authentication has been configured");
|
|
return FORBIDDEN;
|
|
}
|
|
|
|
my $dbh = connect_database($r);
|
|
|
|
my ($identifier, $project_id, $is_public, $status) = get_project_data($r, $dbh);
|
|
$is_public = is_true($is_public);
|
|
|
|
my($res, $reason) = FORBIDDEN;
|
|
|
|
unless(defined($project_id)) {
|
|
# Unknown project
|
|
$res = DECLINED;
|
|
$reason = "not a redmine project";
|
|
|
|
} elsif($status != 1 && !is_read_request($r)) {
|
|
# Write operation on archived project is forbidden
|
|
$reason = "write operations on inactive project '$identifier' are forbidden";
|
|
|
|
} elsif(!$r->user) {
|
|
# Anonymous access
|
|
$res = AUTH_REQUIRED;
|
|
$reason = "anonymous access to '$identifier' denied";
|
|
|
|
if($is_public) {
|
|
# Check anonymous permissions
|
|
my ($permissions) = $dbh->selectrow_arrayref("SELECT permissions FROM roles WHERE builtin = 2");
|
|
$res = OK if check_permissions($r, $permissions);
|
|
}
|
|
|
|
# Force login if failed
|
|
$r->note_auth_failure unless $res == OK;
|
|
|
|
} else {
|
|
# Logged in user
|
|
my @permissions = ();
|
|
my $user = $r->user;
|
|
|
|
# Membership permissions
|
|
if(my @membership = $dbh->selectcol_arrayref($cfg->{Query}, $user, $project_id)) {
|
|
push @permissions, @membership;
|
|
}
|
|
|
|
if($is_public) {
|
|
# Add non-member permissions for public projects
|
|
if(my ($non_member) = $dbh->selectrow_arrayref("SELECT permissions FROM roles WHERE builtin = 1")) {
|
|
push @permissions, $non_member;
|
|
}
|
|
}
|
|
|
|
if(check_permissions($r, @permissions)) {
|
|
$res = OK;
|
|
|
|
my $cache_key = $r->pnotes("RedmineCacheKey");
|
|
cache_set($r, $cache_key) if defined $cache_key;
|
|
|
|
} else {
|
|
$reason = "insufficient permissions (user: '$user', project: '$identifier', required: '$required')";
|
|
}
|
|
}
|
|
|
|
$r->log->debug("access granted: user '", ($r->user || 'anonymous'), "', project '$identifier', method: '", $r->method, "'") if $res == OK;
|
|
|
|
$r->log_reason($reason) if $res != OK && defined $reason;
|
|
|
|
return $res;
|
|
}
|
|
|
|
# get the project identifier
|
|
sub get_project_identifier {
|
|
my ($r, $dbh) = @_;
|
|
|
|
my $cfg = get_config($r);
|
|
my $identifier = $cfg->{Project};
|
|
unless($identifier) {
|
|
my $location = $r->location;
|
|
($identifier) = $r->uri =~ m{^\Q$location\E/*([^/]+)};
|
|
}
|
|
|
|
return $identifier;
|
|
}
|
|
|
|
# tell if the given request is a read operation
|
|
sub is_read_request {
|
|
my $r = shift;
|
|
|
|
return defined $read_only_methods{$r->method};
|
|
}
|
|
|
|
# check if one of the required permissions is in the passed list
|
|
sub check_permissions {
|
|
my $r = shift;
|
|
|
|
my $permissions = join(' ', @_)
|
|
or return 0;
|
|
|
|
$cfg = get_config($r);
|
|
my @required;
|
|
if(is_read_request($r)) {
|
|
@required = $cfg->{ReadPermissions} || @default_read_permissions;
|
|
} else {
|
|
@required = $cfg->{WritePermissions} || @default_write_permissions;
|
|
}
|
|
|
|
foreach (@required) {
|
|
return 1 if $permissions =~ m{\Q$_\E};
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
# get information about the project
|
|
sub get_project_data {
|
|
my $r = shift;
|
|
my $dbh = shift;
|
|
|
|
my $identifier = get_project_identifier($r);
|
|
return $identifier, $dbh->selectrow_arrayref("SELECT id, is_public, status FROM projects WHERE identifier = ?", $identifier);
|
|
}
|
|
|
|
# return module configuration for current directory
|
|
sub get_config {
|
|
my $r = shift;
|
|
|
|
return Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
|
|
}
|
|
|
|
# get a connection to the redmine database
|
|
sub connect_database {
|
|
my $r = shift;
|
|
|
|
my $cfg = get_config($r);
|
|
return DBI->connect($cfg->{DSN}, $cfg->{DbUser}, $cfg->{DbPass});
|
|
}
|
|
|
|
# tell if a value returned from SQL is "true"
|
|
sub is_true {
|
|
my $value = shift;
|
|
return defined($value) && ($value == 1 || $value eq "t");
|
|
}
|
|
|
|
# build credential cache key
|
|
sub get_cache_key {
|
|
my ($r, $password) = @_;
|
|
return Digest::SHA1::sha1_hex(join(':', get_project_identifier($r), $r->user, $password, is_read_request($r) ? 'read' : 'write');
|
|
}
|
|
|
|
# check if credentials exist in cache
|
|
sub cache_get {
|
|
my($r, $key) = @_;
|
|
|
|
my $cfg = get_config($r);
|
|
my $cache = $cfg->{CacheCreds};
|
|
return unless $cache;
|
|
|
|
my $time = $cache->get($key)
|
|
or return 0;
|
|
|
|
if($cfg->{CacheCredsMaxAge} && ($r->request_time - $time) > $cfg->{CacheCredsMaxAge}) {
|
|
$cache->unset($key);
|
|
$cfg->{CacheCredsCount}--;
|
|
return 0;
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
# put credentials in cache
|
|
sub cache_set {
|
|
my($r, $key) = @_;
|
|
|
|
my $cfg = get_config($r);
|
|
my $cache = $cfg->{CacheCreds};
|
|
return unless $cache;
|
|
|
|
if($cfg->{CacheCredsCount} >= $cfg->{CacheCredsMax}) {
|
|
$cache->clear;
|
|
$cfg->{CacheCredsCount} = 0;
|
|
}
|
|
$cache->set($key, $r->request_time);
|
|
$cfg->{CacheCredsCount}++;
|
|
}
|
|
|
|
1;
|
|
|