major source structure and module name changes
This commit is contained in:
soochoi
478
CASA-auth-token/server/ApacheSupport/2.2/mod_authn_casa.c
Normal file
478
CASA-auth-token/server/ApacheSupport/2.2/mod_authn_casa.c
Normal file
@@ -0,0 +1,478 @@
|
||||
/***********************************************************************
|
||||
*
|
||||
* Copyright (C) 2006 Novell, Inc. All Rights Reserved.
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU Lesser General Public
|
||||
* License as published by the Free Software Foundation; version 2.1
|
||||
* of the License.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
* Library Lesser General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Lesser General Public
|
||||
* License along with this library; if not, Novell, Inc.
|
||||
*
|
||||
* To contact Novell about this file by physical or electronic mail,
|
||||
* you may find current contact information at www.novell.com.
|
||||
*
|
||||
* Author: Juan Carlos Luciani <jluciani@novell.com>
|
||||
*
|
||||
***********************************************************************/
|
||||
|
||||
#include <stdbool.h>
|
||||
|
||||
#include "apr_strings.h"
|
||||
#include "ap_config.h"
|
||||
#include "ap_provider.h"
|
||||
#include "httpd.h"
|
||||
#include "http_config.h"
|
||||
#include "http_core.h"
|
||||
#include "http_log.h"
|
||||
#include "http_protocol.h"
|
||||
#include "http_request.h"
|
||||
|
||||
#include "mod_auth.h"
|
||||
|
||||
#include "casa_s_authtoken.h"
|
||||
|
||||
//
|
||||
// Module per-dir configuration structure.
|
||||
//
|
||||
typedef struct _authn_casa_dir_cfg
|
||||
{
|
||||
int performUsernameCheck;
|
||||
|
||||
} authn_casa_dir_cfg;
|
||||
|
||||
|
||||
//
|
||||
// Forward declaration of our module structure.
|
||||
//
|
||||
module AP_MODULE_DECLARE_DATA authn_casa_module;
|
||||
|
||||
//
|
||||
// Environment variables set by module
|
||||
//
|
||||
static char CasaIdentityIdEnvVar[] = "IdentityId";
|
||||
static char CasaIdentitySourceNameEnvVar[] = "IdentityDataSourceName";
|
||||
static char CasaIdentitySourceUrlEnvVar[] = "IdentityDataSourceUrl";
|
||||
|
||||
//
|
||||
// Function: create_per_dir_config()
|
||||
//
|
||||
// Create per-dir configuration structure.
|
||||
//
|
||||
static void*
|
||||
create_per_dir_config(
|
||||
apr_pool_t *p,
|
||||
char *x)
|
||||
{
|
||||
authn_casa_dir_cfg *pDirConfig;
|
||||
|
||||
// Allocate space for our configuration structure
|
||||
pDirConfig = (authn_casa_dir_cfg*) apr_palloc(p, sizeof(*pDirConfig));
|
||||
|
||||
// Return our new configuration structure
|
||||
return (void*) pDirConfig;
|
||||
}
|
||||
|
||||
/* ************************************************************************
|
||||
* set_authn_casa_uname_check()
|
||||
*
|
||||
* Process UsernameCheck configuration directive..
|
||||
*
|
||||
* L2
|
||||
* ************************************************************************/
|
||||
static const char*
|
||||
set_authn_casa_uname_check(
|
||||
cmd_parms *cmd,
|
||||
void *cfg,
|
||||
int arg)
|
||||
{
|
||||
authn_casa_dir_cfg *pDirConfig = (authn_casa_dir_cfg*) cfg;
|
||||
|
||||
// Record the value in our structure
|
||||
pDirConfig->performUsernameCheck = arg;
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
//
|
||||
// Configuration directives array structure.
|
||||
//
|
||||
static const command_rec authn_casa_cmds[] =
|
||||
{
|
||||
AP_INIT_FLAG("UsernameCheck", // tbd - May be this directive should be on a per-directory or per-location basis
|
||||
set_authn_casa_uname_check,
|
||||
NULL,
|
||||
OR_AUTHCFG,
|
||||
"Check for username == CasaPrincipal (Value limited to 'on' or 'off')"),
|
||||
{NULL}
|
||||
};
|
||||
|
||||
/* ************************************************************************
|
||||
* check_password()
|
||||
*
|
||||
* Given a user and password, expected to return AUTH_GRANTED if we
|
||||
* can validate the user/password combination.
|
||||
*
|
||||
* L2
|
||||
* ************************************************************************/
|
||||
static authn_status
|
||||
check_password(
|
||||
request_rec *r,
|
||||
const char *user,
|
||||
const char *password)
|
||||
{
|
||||
authn_status retStatus;
|
||||
authn_casa_dir_cfg *pDirConfig;
|
||||
bool userNameChecked = false;
|
||||
int i;
|
||||
char *pLocationName;
|
||||
|
||||
// First determine the length of the name of the location being protected
|
||||
i = 0;
|
||||
while (r->uri[i] != '\0')
|
||||
{
|
||||
if (r->uri[i] == '/')
|
||||
{
|
||||
// Ignore the slash if it is at the beginning of the uri
|
||||
if (i != 0)
|
||||
{
|
||||
// The slash is not at the beggining of the uri, stop.
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
i++;
|
||||
}
|
||||
|
||||
// Now get a copy of the location being protected
|
||||
if (i > 1)
|
||||
{
|
||||
pLocationName = apr_palloc(r->pool, i);
|
||||
if (pLocationName)
|
||||
{
|
||||
memset(pLocationName, 0, i);
|
||||
memcpy(pLocationName, &(r->uri[1]), i - 1); // Do not include the slashes
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
|
||||
return AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
// We are protecting the server root
|
||||
pLocationName = "apache_root";
|
||||
}
|
||||
|
||||
// Get access to our per-dir configuration structure
|
||||
pDirConfig = ap_get_module_config(r->per_dir_config,
|
||||
&authn_casa_module);
|
||||
if (pDirConfig)
|
||||
{
|
||||
// Assume success
|
||||
retStatus = AUTH_GRANTED;
|
||||
|
||||
// Check if we must perform the username check
|
||||
if (pDirConfig->performUsernameCheck != 0)
|
||||
{
|
||||
// Remember that we performed this check
|
||||
userNameChecked = true;
|
||||
|
||||
// Check if the username matches the name what we are expecting
|
||||
if (strcmp(user, "CasaPrincipal") != 0)
|
||||
{
|
||||
// The username does not match, allow other providers to get
|
||||
// a crack to it.
|
||||
retStatus = AUTH_USER_NOT_FOUND;
|
||||
}
|
||||
}
|
||||
|
||||
// Check the token if a problem has not been found
|
||||
if (retStatus == AUTH_GRANTED)
|
||||
{
|
||||
CasaStatus casaStatus;
|
||||
PrincipalIf *pPrincipalIf;
|
||||
|
||||
// Validate the token
|
||||
casaStatus = ValidateAuthToken(pLocationName,
|
||||
password,
|
||||
strlen(password),
|
||||
&pPrincipalIf);
|
||||
if (CASA_SUCCESS(casaStatus))
|
||||
{
|
||||
|
||||
int buffLen = 0;
|
||||
apr_table_t *e = r->subprocess_env;
|
||||
|
||||
// Associate necessary environment variables with the request block
|
||||
casaStatus = pPrincipalIf->getIdentityId(pPrincipalIf,
|
||||
NULL,
|
||||
&buffLen);
|
||||
if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
|
||||
{
|
||||
char *pBuff;
|
||||
|
||||
// Allocate buffer to obtain the Identity Id
|
||||
pBuff = apr_pcalloc(r->pool, buffLen);
|
||||
if (pBuff)
|
||||
{
|
||||
// Read the value into our buffer
|
||||
if (CASA_SUCCESS(pPrincipalIf->getIdentityId(pPrincipalIf,
|
||||
pBuff,
|
||||
&buffLen)))
|
||||
{
|
||||
// Now set the environment variable
|
||||
apr_table_setn(e, CasaIdentityIdEnvVar, pBuff);
|
||||
|
||||
// Also, update the username within the request block with the identity id
|
||||
r->user = pBuff;
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity id");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error obtaining identity id, %08X", casaStatus);
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
|
||||
if (retStatus == AUTH_GRANTED)
|
||||
{
|
||||
buffLen = 0;
|
||||
casaStatus = pPrincipalIf->getSourceName(pPrincipalIf,
|
||||
NULL,
|
||||
&buffLen);
|
||||
if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
|
||||
{
|
||||
char *pBuff;
|
||||
|
||||
// Allocate buffer to obtain the Identity Source Name
|
||||
pBuff = apr_pcalloc(r->pool, buffLen);
|
||||
if (pBuff)
|
||||
{
|
||||
// Read the value into our buffer
|
||||
if (CASA_SUCCESS(pPrincipalIf->getSourceName(pPrincipalIf,
|
||||
pBuff,
|
||||
&buffLen)))
|
||||
{
|
||||
// Now set the environment variable
|
||||
apr_table_setn(e, CasaIdentitySourceNameEnvVar, pBuff);
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity source name");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error obtaining identity source name, %08X", casaStatus);
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
if (retStatus == AUTH_GRANTED)
|
||||
{
|
||||
buffLen = 0;
|
||||
casaStatus = pPrincipalIf->getSourceUrl(pPrincipalIf,
|
||||
NULL,
|
||||
&buffLen);
|
||||
if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
|
||||
{
|
||||
char *pBuff;
|
||||
|
||||
// Allocate buffer to obtain the Identity Source Url
|
||||
pBuff = apr_pcalloc(r->pool, buffLen);
|
||||
if (pBuff)
|
||||
{
|
||||
// Read the value into our buffer
|
||||
if (CASA_SUCCESS(pPrincipalIf->getSourceUrl(pPrincipalIf,
|
||||
pBuff,
|
||||
&buffLen)))
|
||||
{
|
||||
// Now set the environment variable
|
||||
apr_table_setn(e, CasaIdentitySourceUrlEnvVar, pBuff);
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity source url");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error obtaining identity source url, %08X", casaStatus);
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
if (retStatus == AUTH_GRANTED)
|
||||
{
|
||||
char *pAttribNameBuff, *pAttribValueBuff;
|
||||
int enumHandle = 0;
|
||||
int attribNameBuffLen, attribValueBuffLen;
|
||||
|
||||
while (retStatus == AUTH_GRANTED)
|
||||
{
|
||||
// Get attribute lengths
|
||||
attribNameBuffLen = attribValueBuffLen = 0;
|
||||
casaStatus = pPrincipalIf->attributeEnumerate(pPrincipalIf,
|
||||
&enumHandle,
|
||||
NULL,
|
||||
&attribNameBuffLen,
|
||||
NULL,
|
||||
&attribValueBuffLen);
|
||||
if (CasaStatusCode(casaStatus) == CASA_STATUS_BUFFER_OVERFLOW)
|
||||
{
|
||||
// Allocate buffers to obtain the attribute data
|
||||
pAttribNameBuff = apr_pcalloc(r->pool, attribNameBuffLen);
|
||||
pAttribValueBuff = apr_pcalloc(r->pool, attribValueBuffLen);
|
||||
if (pAttribNameBuff && pAttribValueBuff)
|
||||
{
|
||||
// Read the attribute into our buffer
|
||||
if (CASA_SUCCESS(pPrincipalIf->attributeEnumerate(pPrincipalIf,
|
||||
&enumHandle,
|
||||
pAttribNameBuff,
|
||||
&attribNameBuffLen,
|
||||
pAttribValueBuff,
|
||||
&attribValueBuffLen)))
|
||||
{
|
||||
// Now set the environment variable
|
||||
apr_table_setn(e, pAttribNameBuff, pAttribValueBuff);
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Unable to obtain identity attribute");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Memory allocation failure");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
// Check if we are done going through the attributes
|
||||
if (CasaStatusCode(casaStatus) == CASA_STATUS_NO_MORE_ENTRIES)
|
||||
{
|
||||
// Done
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Un-expected error during attribute enumeration, %08X", casaStatus);
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Release the principal interface instance
|
||||
pPrincipalIf->releaseReference(pPrincipalIf);
|
||||
}
|
||||
else
|
||||
{
|
||||
// Check if the token validation failed for a CasaPrincipal
|
||||
if (userNameChecked)
|
||||
{
|
||||
// Token validation failed for a CasaPrincipal, always return AUTH_DENIED.
|
||||
retStatus = AUTH_DENIED;
|
||||
}
|
||||
else
|
||||
{
|
||||
// We did not check the username, set the return status based on the status
|
||||
// returned by ValidateAuthToken().
|
||||
if (CasaStatusCode(casaStatus) == CASA_STATUS_AUTHENTICATION_FAILURE)
|
||||
{
|
||||
// Authentication failed
|
||||
retStatus = AUTH_DENIED;
|
||||
}
|
||||
else
|
||||
{
|
||||
// Allow other providers to get a crack to it
|
||||
retStatus = AUTH_USER_NOT_FOUND;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
ap_log_rerror(APLOG_MARK, APLOG_ALERT, 0, r, "Did not get module per-server config structure");
|
||||
retStatus = AUTH_GENERAL_ERROR;
|
||||
}
|
||||
|
||||
return retStatus;
|
||||
}
|
||||
|
||||
//
|
||||
// Authentication Provider Function Table
|
||||
//
|
||||
static const authn_provider authn_casa_provider =
|
||||
{
|
||||
&check_password,
|
||||
NULL, // We do not support Digest Authentication
|
||||
};
|
||||
|
||||
/* ************************************************************************
|
||||
* register_hooks()
|
||||
*
|
||||
* Register all of the module hooks.
|
||||
*
|
||||
* L2
|
||||
* ************************************************************************/
|
||||
static void
|
||||
register_hooks(
|
||||
apr_pool_t *p)
|
||||
{
|
||||
// Register as an authentication provider
|
||||
ap_register_provider(p,
|
||||
AUTHN_PROVIDER_GROUP, // Provider group
|
||||
"casa", // Provider name
|
||||
"0", // Provider version
|
||||
&authn_casa_provider); // Authentication Provider function table
|
||||
}
|
||||
|
||||
//
|
||||
// Declare ourselves to the HTTPD core.
|
||||
//
|
||||
module AP_MODULE_DECLARE_DATA authn_casa_module =
|
||||
{
|
||||
STANDARD20_MODULE_STUFF,
|
||||
create_per_dir_config, // Create per-dir config structures
|
||||
NULL, // merge per-dir config structures
|
||||
NULL, // Create per-server config structures
|
||||
NULL, // merge per-server config structures
|
||||
authn_casa_cmds, // command handlers
|
||||
register_hooks // register hooks
|
||||
};
|
||||
Reference in New Issue
Block a user