Redmine.pm
429 lines
| 11.8 KiB
| text/x-perl
|
PerlLexer
Nicolas Chuche
|
r903 | package Apache::Authn::Redmine; | ||
| =head1 Apache::Authn::Redmine | ||||
| Redmine - a mod_perl module to authenticate webdav subversion users | ||||
| against redmine database | ||||
| =head1 SYNOPSIS | ||||
| This module allow anonymous users to browse public project and | ||||
Jean-Philippe Lang
|
r1321 | registred users to browse and commit their project. Authentication is | ||
| done against the redmine database or the LDAP configured in redmine. | ||||
|
Nicolas Chuche
|
r903 | |||
| This method is far simpler than the one with pam_* and works with all | ||||
| database without an hassle but you need to have apache/mod_perl on the | ||||
| svn server. | ||||
| =head1 INSTALLATION | ||||
| For this to automagically work, you need to have a recent reposman.rb | ||||
| (after r860) and if you already use reposman, read the last section to | ||||
| migrate. | ||||
| Sorry ruby users but you need some perl modules, at least mod_perl2, | ||||
| DBI and DBD::mysql (or the DBD driver for you database as it should | ||||
| work on allmost all databases). | ||||
| On debian/ubuntu you must do : | ||||
| aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl | ||||
|
Jean-Philippe Lang
|
r1321 | If your Redmine users use LDAP authentication, you will also need | ||
|
Jean-Philippe Lang
|
r1322 | Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used): | ||
| aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl | ||||
|
Jean-Philippe Lang
|
r1321 | |||
|
Nicolas Chuche
|
r903 | =head1 CONFIGURATION | ||
Liwiusz Ociepa
|
r1410 | ## This module has to be in your perl path | ||
| ## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm | ||||
| PerlLoadModule Apache::Authn::Redmine | ||||
|
Nicolas Chuche
|
r903 | <Location /svn> | ||
| DAV svn | ||||
| SVNParentPath "/var/svn" | ||||
| AuthType Basic | ||||
| AuthName redmine | ||||
| Require valid-user | ||||
| PerlAccessHandler Apache::Authn::Redmine::access_handler | ||||
| PerlAuthenHandler Apache::Authn::Redmine::authen_handler | ||||
Toshi MARUYAMA
|
r7895 | |||
|
Nicolas Chuche
|
r903 | ## for mysql | ||
|
Liwiusz Ociepa
|
r1410 | RedmineDSN "DBI:mysql:database=databasename;host=my.db.server" | ||
|
Liwiusz Ociepa
|
r1423 | ## for postgres | ||
| # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server" | ||||
|
Liwiusz Ociepa
|
r1410 | |||
| RedmineDbUser "redmine" | ||||
| RedmineDbPass "password" | ||||
| ## Optional where clause (fulltext search would be slow and | ||||
| ## database dependant). | ||||
| # RedmineDbWhereClause "and members.role_id IN (1,2)" | ||||
| ## Optional credentials cache size | ||||
| # RedmineCacheCredsMax 50 | ||||
|
Nicolas Chuche
|
r903 | </Location> | ||
| To be able to browse repository inside redmine, you must add something | ||||
| like that : | ||||
| <Location /svn-private> | ||||
| DAV svn | ||||
| SVNParentPath "/var/svn" | ||||
| Order deny,allow | ||||
| Deny from all | ||||
| # only allow reading orders | ||||
| <Limit GET PROPFIND OPTIONS REPORT> | ||||
| Allow from redmine.server.ip | ||||
| </Limit> | ||||
| </Location> | ||||
| and you will have to use this reposman.rb command line to create repository : | ||||
| reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/ | ||||
|
Jean-Philippe Lang
|
r9136 | =head1 REPOSITORIES NAMING | ||
| A projet repository must be named with the projet identifier. In case | ||||
| of multiple repositories for the same project, use the project identifier | ||||
| and the repository identifier separated with a dot: | ||||
| /var/svn/foo | ||||
| /var/svn/foo.otherrepo | ||||
|
Nicolas Chuche
|
r903 | =head1 MIGRATION FROM OLDER RELEASES | ||
| If you use an older reposman.rb (r860 or before), you need to change | ||||
| rights on repositories to allow the apache user to read and write | ||||
| S<them :> | ||||
| sudo chown -R www-data /var/svn/* | ||||
| sudo chmod -R u+w /var/svn/* | ||||
| And you need to upgrade at least reposman.rb (after r860). | ||||
| =cut | ||||
| use strict; | ||||
|
Liwiusz Ociepa
|
r1410 | use warnings FATAL => 'all', NONFATAL => 'redefine'; | ||
|
Nicolas Chuche
|
r903 | |||
| use DBI; | ||||
|
Jean-Philippe Lang
|
r8762 | use Digest::SHA; | ||
|
Jean-Philippe Lang
|
r1321 | # optional module for LDAP authentication | ||
| my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1"); | ||||
|
Nicolas Chuche
|
r903 | |||
| use Apache2::Module; | ||||
| use Apache2::Access; | ||||
| use Apache2::ServerRec qw(); | ||||
| use Apache2::RequestRec qw(); | ||||
| use Apache2::RequestUtil qw(); | ||||
|
Liwiusz Ociepa
|
r1410 | use Apache2::Const qw(:common :override :cmd_how); | ||
| use APR::Pool (); | ||||
| use APR::Table (); | ||||
|
Nicolas Chuche
|
r903 | # use Apache2::Directive qw(); | ||
|
Liwiusz Ociepa
|
r1410 | my @directives = ( | ||
| { | ||||
| name => 'RedmineDSN', | ||||
| req_override => OR_AUTHCFG, | ||||
| args_how => TAKE1, | ||||
| errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"', | ||||
| }, | ||||
| { | ||||
| name => 'RedmineDbUser', | ||||
| req_override => OR_AUTHCFG, | ||||
| args_how => TAKE1, | ||||
| }, | ||||
| { | ||||
| name => 'RedmineDbPass', | ||||
| req_override => OR_AUTHCFG, | ||||
| args_how => TAKE1, | ||||
| }, | ||||
| { | ||||
| name => 'RedmineDbWhereClause', | ||||
| req_override => OR_AUTHCFG, | ||||
| args_how => TAKE1, | ||||
| }, | ||||
| { | ||||
| name => 'RedmineCacheCredsMax', | ||||
| req_override => OR_AUTHCFG, | ||||
| args_how => TAKE1, | ||||
| errmsg => 'RedmineCacheCredsMax must be decimal number', | ||||
| }, | ||||
| ); | ||||
|
Toshi MARUYAMA
|
r7895 | sub RedmineDSN { | ||
|
Liwiusz Ociepa
|
r1410 | my ($self, $parms, $arg) = @_; | ||
| $self->{RedmineDSN} = $arg; | ||||
| my $query = "SELECT | ||||
|
Jean-Philippe Lang
|
r4816 | hashed_password, salt, auth_source_id, permissions | ||
|
Jean-Philippe Lang
|
r7714 | FROM projects, users, roles | ||
|
Liwiusz Ociepa
|
r1410 | WHERE | ||
|
Jean-Philippe Lang
|
r7714 | users.login=? | ||
| AND projects.identifier=? | ||||
|
Liwiusz Ociepa
|
r1410 | AND users.status=1 | ||
|
Jean-Philippe Lang
|
r7714 | AND ( | ||
| roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id) | ||||
| OR | ||||
| (roles.builtin=1 AND cast(projects.is_public as CHAR) IN ('t', '1')) | ||||
| ) "; | ||||
|
Liwiusz Ociepa
|
r1410 | $self->{RedmineQuery} = trim($query); | ||
| } | ||||
|
Jean-Philippe Lang
|
r2633 | |||
|
Liwiusz Ociepa
|
r1410 | sub RedmineDbUser { set_val('RedmineDbUser', @_); } | ||
| sub RedmineDbPass { set_val('RedmineDbPass', @_); } | ||||
|
Toshi MARUYAMA
|
r7895 | sub RedmineDbWhereClause { | ||
|
Liwiusz Ociepa
|
r1410 | my ($self, $parms, $arg) = @_; | ||
| $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." "); | ||||
| } | ||||
|
Toshi MARUYAMA
|
r7895 | sub RedmineCacheCredsMax { | ||
|
Liwiusz Ociepa
|
r1410 | my ($self, $parms, $arg) = @_; | ||
| if ($arg) { | ||||
| $self->{RedmineCachePool} = APR::Pool->new; | ||||
| $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg); | ||||
| $self->{RedmineCacheCredsCount} = 0; | ||||
| $self->{RedmineCacheCredsMax} = $arg; | ||||
| } | ||||
| } | ||||
| sub trim { | ||||
| my $string = shift; | ||||
| $string =~ s/\s{2,}/ /g; | ||||
| return $string; | ||||
| } | ||||
| sub set_val { | ||||
| my ($key, $self, $parms, $arg) = @_; | ||||
| $self->{$key} = $arg; | ||||
| } | ||||
| Apache2::Module::add(__PACKAGE__, \@directives); | ||||
|
Nicolas Chuche
|
r903 | my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/; | ||
| sub access_handler { | ||||
| my $r = shift; | ||||
| unless ($r->some_auth_required) { | ||||
| $r->log_reason("No authentication has been configured"); | ||||
| return FORBIDDEN; | ||||
| } | ||||
| my $method = $r->method; | ||||
|
Nicolas Chuche
|
r1775 | return OK unless defined $read_only_methods{$method}; | ||
|
Nicolas Chuche
|
r903 | |||
| my $project_id = get_project_identifier($r); | ||||
| $r->set_handlers(PerlAuthenHandler => [\&OK]) | ||||
|
Toshi MARUYAMA
|
r7459 | if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r); | ||
|
Nicolas Chuche
|
r903 | |||
| return OK | ||||
| } | ||||
| sub authen_handler { | ||||
| my $r = shift; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Nicolas Chuche
|
r903 | my ($res, $redmine_pass) = $r->get_basic_auth_pw(); | ||
| return $res unless $res == OK; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Nicolas Chuche
|
r903 | if (is_member($r->user, $redmine_pass, $r)) { | ||
| return OK; | ||||
| } else { | ||||
| $r->note_auth_failure(); | ||||
| return AUTH_REQUIRED; | ||||
| } | ||||
| } | ||||
Eric Davis
|
r3717 | # check if authentication is forced | ||
| sub is_authentication_forced { | ||||
| my $r = shift; | ||||
| my $dbh = connect_database($r); | ||||
| my $sth = $dbh->prepare( | ||||
| "SELECT value FROM settings where settings.name = 'login_required';" | ||||
| ); | ||||
| $sth->execute(); | ||||
| my $ret = 0; | ||||
| if (my @row = $sth->fetchrow_array) { | ||||
| if ($row[0] eq "1" || $row[0] eq "t") { | ||||
| $ret = 1; | ||||
| } | ||||
| } | ||||
| $sth->finish(); | ||||
| undef $sth; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Eric Davis
|
r3717 | $dbh->disconnect(); | ||
| undef $dbh; | ||||
| $ret; | ||||
| } | ||||
|
Nicolas Chuche
|
r903 | sub is_public_project { | ||
| my $project_id = shift; | ||||
| my $r = shift; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Jean-Philippe Lang
|
r7693 | if (is_authentication_forced($r)) { | ||
| return 0; | ||||
| } | ||||
|
Nicolas Chuche
|
r903 | |||
| my $dbh = connect_database($r); | ||||
| my $sth = $dbh->prepare( | ||||
|
Jean-Philippe Lang
|
r3132 | "SELECT is_public FROM projects WHERE projects.identifier = ?;" | ||
|
Nicolas Chuche
|
r903 | ); | ||
| $sth->execute($project_id); | ||||
|
Jean-Philippe Lang
|
r3132 | my $ret = 0; | ||
| if (my @row = $sth->fetchrow_array) { | ||||
| if ($row[0] eq "1" || $row[0] eq "t") { | ||||
| $ret = 1; | ||||
| } | ||||
| } | ||||
|
Jean-Philippe Lang
|
r1525 | $sth->finish(); | ||
|
Jean-Philippe Lang
|
r3186 | undef $sth; | ||
|
Nicolas Chuche
|
r903 | $dbh->disconnect(); | ||
|
Jean-Philippe Lang
|
r3186 | undef $dbh; | ||
|
Nicolas Chuche
|
r903 | |||
| $ret; | ||||
| } | ||||
|
Jean-Philippe Lang
|
r7693 | sub anonymous_role_allows_browse_repository { | ||
|
Toshi MARUYAMA
|
r7459 | my $r = shift; | ||
|
Toshi MARUYAMA
|
r7895 | |||
|
Toshi MARUYAMA
|
r7459 | my $dbh = connect_database($r); | ||
| my $sth = $dbh->prepare( | ||||
|
Jean-Philippe Lang
|
r7693 | "SELECT permissions FROM roles WHERE builtin = 2;" | ||
|
Toshi MARUYAMA
|
r7459 | ); | ||
|
Toshi MARUYAMA
|
r7895 | |||
|
Jean-Philippe Lang
|
r7693 | $sth->execute(); | ||
|
Toshi MARUYAMA
|
r7459 | my $ret = 0; | ||
| if (my @row = $sth->fetchrow_array) { | ||||
| if ($row[0] =~ /:browse_repository/) { | ||||
| $ret = 1; | ||||
| } | ||||
| } | ||||
| $sth->finish(); | ||||
| undef $sth; | ||||
| $dbh->disconnect(); | ||||
| undef $dbh; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Toshi MARUYAMA
|
r7459 | $ret; | ||
| } | ||||
|
Nicolas Chuche
|
r903 | # perhaps we should use repository right (other read right) to check public access. | ||
| # it could be faster BUT it doesn't work for the moment. | ||||
| # sub is_public_project_by_file { | ||||
| # my $project_id = shift; | ||||
| # my $r = shift; | ||||
| # my $tree = Apache2::Directive::conftree(); | ||||
| # my $node = $tree->lookup('Location', $r->location); | ||||
| # my $hash = $node->as_hash; | ||||
| # my $svnparentpath = $hash->{SVNParentPath}; | ||||
| # my $repos_path = $svnparentpath . "/" . $project_id; | ||||
| # return 1 if (stat($repos_path))[2] & 00007; | ||||
| # } | ||||
| sub is_member { | ||||
| my $redmine_user = shift; | ||||
| my $redmine_pass = shift; | ||||
| my $r = shift; | ||||
| my $dbh = connect_database($r); | ||||
| my $project_id = get_project_identifier($r); | ||||
|
Jean-Philippe Lang
|
r8762 | my $pass_digest = Digest::SHA::sha1_hex($redmine_pass); | ||
|
Toshi MARUYAMA
|
r7895 | |||
|
Jean-Philippe Lang
|
r7689 | my $access_mode = defined $read_only_methods{$r->method} ? "R" : "W"; | ||
|
Nicolas Chuche
|
r903 | |||
|
Liwiusz Ociepa
|
r1410 | my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); | ||
| my $usrprojpass; | ||||
| if ($cfg->{RedmineCacheCredsMax}) { | ||||
|
Jean-Philippe Lang
|
r7689 | $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id.":".$access_mode); | ||
|
Liwiusz Ociepa
|
r1410 | return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest)); | ||
| } | ||||
| my $query = $cfg->{RedmineQuery}; | ||||
| my $sth = $dbh->prepare($query); | ||||
|
Nicolas Chuche
|
r903 | $sth->execute($redmine_user, $project_id); | ||
| my $ret; | ||||
|
Jean-Philippe Lang
|
r4816 | while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) { | ||
|
Jean-Philippe Lang
|
r1812 | |||
| unless ($auth_source_id) { | ||||
|
Jean-Philippe Lang
|
r4816 | my $method = $r->method; | ||
|
Jean-Philippe Lang
|
r8762 | my $salted_password = Digest::SHA::sha1_hex($salt.$pass_digest); | ||
|
Jean-Philippe Lang
|
r7689 | if ($hashed_password eq $salted_password && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) { | ||
|
Jean-Philippe Lang
|
r1320 | $ret = 1; | ||
| last; | ||||
| } | ||||
|
Jean-Philippe Lang
|
r1321 | } elsif ($CanUseLDAPAuth) { | ||
|
Jean-Philippe Lang
|
r1320 | my $sthldap = $dbh->prepare( | ||
|
Jean-Philippe Lang
|
r1321 | "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;" | ||
|
Jean-Philippe Lang
|
r1320 | ); | ||
|
Jean-Philippe Lang
|
r1812 | $sthldap->execute($auth_source_id); | ||
|
Jean-Philippe Lang
|
r1320 | while (my @rowldap = $sthldap->fetchrow_array) { | ||
|
Jean-Philippe Lang
|
r9574 | my $bind_as = $rowldap[3] ? $rowldap[3] : ""; | ||
| my $bind_pw = $rowldap[4] ? $rowldap[4] : ""; | ||||
| if ($bind_as =~ m/\$login/) { | ||||
| # replace $login with $redmine_user and use $redmine_pass | ||||
| $bind_as =~ s/\$login/$redmine_user/g; | ||||
| $bind_pw = $redmine_pass | ||||
| } | ||||
|
Jean-Philippe Lang
|
r1320 | my $ldap = Authen::Simple::LDAP->new( | ||
Jean-Baptiste Barth
|
r4195 | host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0], | ||
|
Jean-Philippe Lang
|
r1321 | port => $rowldap[1], | ||
| basedn => $rowldap[5], | ||||
|
Jean-Philippe Lang
|
r9574 | binddn => $bind_as, | ||
| bindpw => $bind_pw, | ||||
|
Jean-Philippe Lang
|
r1321 | filter => "(".$rowldap[6]."=%s)" | ||
| ); | ||||
|
Eric Davis
|
r3718 | my $method = $r->method; | ||
|
Jean-Philippe Lang
|
r7689 | $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/)); | ||
|
Eric Davis
|
r3718 | |||
|
Jean-Philippe Lang
|
r1320 | } | ||
| $sthldap->finish(); | ||||
|
Jean-Philippe Lang
|
r3186 | undef $sthldap; | ||
|
Nicolas Chuche
|
r903 | } | ||
| } | ||||
|
Jean-Philippe Lang
|
r1320 | $sth->finish(); | ||
|
Jean-Philippe Lang
|
r3186 | undef $sth; | ||
|
Nicolas Chuche
|
r903 | $dbh->disconnect(); | ||
|
Jean-Philippe Lang
|
r3186 | undef $dbh; | ||
|
Nicolas Chuche
|
r903 | |||
|
Liwiusz Ociepa
|
r1410 | if ($cfg->{RedmineCacheCredsMax} and $ret) { | ||
| if (defined $usrprojpass) { | ||||
|
Jean-Philippe Lang
|
r7689 | $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest); | ||
|
Liwiusz Ociepa
|
r1410 | } else { | ||
| if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) { | ||||
|
Jean-Philippe Lang
|
r7689 | $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest); | ||
|
Liwiusz Ociepa
|
r1410 | $cfg->{RedmineCacheCredsCount}++; | ||
| } else { | ||||
| $cfg->{RedmineCacheCreds}->clear(); | ||||
| $cfg->{RedmineCacheCredsCount} = 0; | ||||
| } | ||||
| } | ||||
| } | ||||
|
Nicolas Chuche
|
r903 | $ret; | ||
| } | ||||
| sub get_project_identifier { | ||||
| my $r = shift; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Nicolas Chuche
|
r903 | my $location = $r->location; | ||
|
Jean-Philippe Lang
|
r9136 | my ($identifier) = $r->uri =~ m{$location/*([^/.]+)}; | ||
|
Nicolas Chuche
|
r903 | $identifier; | ||
| } | ||||
| sub connect_database { | ||||
| my $r = shift; | ||||
|
Toshi MARUYAMA
|
r7895 | |||
|
Liwiusz Ociepa
|
r1410 | my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config); | ||
| return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass}); | ||||
|
Nicolas Chuche
|
r903 | } | ||
| 1; | ||||