jro_apps/redmine Commit - r7999:f252108f3063

1

package Apache::Authn::Redmine;

1

package Apache::Authn::Redmine;

2

3

=head1 Apache::Authn::Redmine

3

=head1 Apache::Authn::Redmine

4

5

Redmine - a mod_perl module to authenticate webdav subversion users

5

Redmine - a mod_perl module to authenticate webdav subversion users

6

against redmine database

6

against redmine database

7

8

=head1 SYNOPSIS

8

=head1 SYNOPSIS

9

10

This module allow anonymous users to browse public project and

10

This module allow anonymous users to browse public project and

11

registred users to browse and commit their project. Authentication is

11

registred users to browse and commit their project. Authentication is

12

done against the redmine database or the LDAP configured in redmine.

12

done against the redmine database or the LDAP configured in redmine.

13

14

This method is far simpler than the one with pam_* and works with all

14

This method is far simpler than the one with pam_* and works with all

15

database without an hassle but you need to have apache/mod_perl on the

15

database without an hassle but you need to have apache/mod_perl on the

16

svn server.

16

svn server.

17

18

=head1 INSTALLATION

18

=head1 INSTALLATION

19

20

For this to automagically work, you need to have a recent reposman.rb

20

For this to automagically work, you need to have a recent reposman.rb

21

(after r860) and if you already use reposman, read the last section to

21

(after r860) and if you already use reposman, read the last section to

22

migrate.

22

migrate.

23

24

Sorry ruby users but you need some perl modules, at least mod_perl2,

24

Sorry ruby users but you need some perl modules, at least mod_perl2,

25

DBI and DBD::mysql (or the DBD driver for you database as it should

25

DBI and DBD::mysql (or the DBD driver for you database as it should

26

work on allmost all databases).

26

work on allmost all databases).

27

28

On debian/ubuntu you must do :

28

On debian/ubuntu you must do :

29

30

aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl

30

aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl

31

32

If your Redmine users use LDAP authentication, you will also need

32

If your Redmine users use LDAP authentication, you will also need

33

Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):

33

Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):

34

35

aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl

35

aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl

36

37

=head1 CONFIGURATION

37

=head1 CONFIGURATION

38

39

## This module has to be in your perl path

39

## This module has to be in your perl path

40

## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm

40

## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm

41

PerlLoadModule Apache::Authn::Redmine

41

PerlLoadModule Apache::Authn::Redmine

42

42

43

DAV svn

43

DAV svn

44

SVNParentPath "/var/svn"

44

SVNParentPath "/var/svn"

45

46

AuthType Basic

46

AuthType Basic

47

AuthName redmine

47

AuthName redmine

48

Require valid-user

48

Require valid-user

49

50

PerlAccessHandler Apache::Authn::Redmine::access_handler

50

PerlAccessHandler Apache::Authn::Redmine::access_handler

51

PerlAuthenHandler Apache::Authn::Redmine::authen_handler

51

PerlAuthenHandler Apache::Authn::Redmine::authen_handler

52

53

## for mysql

53

## for mysql

54

RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"

54

RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"

55

## for postgres

55

## for postgres

56

# RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"

56

# RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"

57

58

RedmineDbUser "redmine"

58

RedmineDbUser "redmine"

59

RedmineDbPass "password"

59

RedmineDbPass "password"

60

## Optional where clause (fulltext search would be slow and

60

## Optional where clause (fulltext search would be slow and

61

## database dependant).

61

## database dependant).

62

# RedmineDbWhereClause "and members.role_id IN (1,2)"

62

# RedmineDbWhereClause "and members.role_id IN (1,2)"

63

## Optional credentials cache size

63

## Optional credentials cache size

64

# RedmineCacheCredsMax 50

64

# RedmineCacheCredsMax 50

65

</Location>

65

</Location>

66

67

To be able to browse repository inside redmine, you must add something

67

To be able to browse repository inside redmine, you must add something

68

like that :

68

like that :

69

70

70

71

DAV svn

71

DAV svn

72

SVNParentPath "/var/svn"

72

SVNParentPath "/var/svn"

73

Order deny,allow

73

Order deny,allow

74

Deny from all

74

Deny from all

75

# only allow reading orders

75

# only allow reading orders

76

76

77

Allow from redmine.server.ip

77

Allow from redmine.server.ip

78

</Limit>

78

</Limit>

79

</Location>

79

</Location>

80

81

and you will have to use this reposman.rb command line to create repository :

81

and you will have to use this reposman.rb command line to create repository :

82

83

reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/

83

reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/

84

85

=head1 MIGRATION FROM OLDER RELEASES

85

=head1 MIGRATION FROM OLDER RELEASES

86

87

If you use an older reposman.rb (r860 or before), you need to change

87

If you use an older reposman.rb (r860 or before), you need to change

88

rights on repositories to allow the apache user to read and write

88

rights on repositories to allow the apache user to read and write

89

S<them :>

89

S<them :>

90

91

sudo chown -R www-data /var/svn/*

91

sudo chown -R www-data /var/svn/*

92

sudo chmod -R u+w /var/svn/*

92

sudo chmod -R u+w /var/svn/*

93

94

And you need to upgrade at least reposman.rb (after r860).

94

And you need to upgrade at least reposman.rb (after r860).

95

96

=cut

96

=cut

97

98

use strict;

98

use strict;

99

use warnings FATAL => 'all', NONFATAL => 'redefine';

99

use warnings FATAL => 'all', NONFATAL => 'redefine';

100

101

use DBI;

101

use DBI;

102

use Digest::SHA1;

102

use Digest::SHA1;

103

# optional module for LDAP authentication

103

# optional module for LDAP authentication

104

my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");

104

my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");

105

106

use Apache2::Module;

106

use Apache2::Module;

107

use Apache2::Access;

107

use Apache2::Access;

108

use Apache2::ServerRec qw();

108

use Apache2::ServerRec qw();

109

use Apache2::RequestRec qw();

109

use Apache2::RequestRec qw();

110

use Apache2::RequestUtil qw();

110

use Apache2::RequestUtil qw();

111

use Apache2::Const qw(:common :override :cmd_how);

111

use Apache2::Const qw(:common :override :cmd_how);

112

use APR::Pool ();

112

use APR::Pool ();

113

use APR::Table ();

113

use APR::Table ();

114

115

# use Apache2::Directive qw();

115

# use Apache2::Directive qw();

116

117

my @directives = (

117

my @directives = (

118

{

118

{

119

name => 'RedmineDSN',

119

name => 'RedmineDSN',

120

req_override => OR_AUTHCFG,

120

req_override => OR_AUTHCFG,

121

args_how => TAKE1,

121

args_how => TAKE1,

122

errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',

122

errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',

123

},

123

},

124

{

124

{

125

name => 'RedmineDbUser',

125

name => 'RedmineDbUser',

126

req_override => OR_AUTHCFG,

126

req_override => OR_AUTHCFG,

127

args_how => TAKE1,

127

args_how => TAKE1,

128

},

128

},

129

{

129

{

130

name => 'RedmineDbPass',

130

name => 'RedmineDbPass',

131

req_override => OR_AUTHCFG,

131

req_override => OR_AUTHCFG,

132

args_how => TAKE1,

132

args_how => TAKE1,

133

},

133

},

134

{

134

{

135

name => 'RedmineDbWhereClause',

135

name => 'RedmineDbWhereClause',

136

req_override => OR_AUTHCFG,

136

req_override => OR_AUTHCFG,

137

args_how => TAKE1,

137

args_how => TAKE1,

138

},

138

},

139

{

139

{

140

name => 'RedmineCacheCredsMax',

140

name => 'RedmineCacheCredsMax',

141

req_override => OR_AUTHCFG,

141

req_override => OR_AUTHCFG,

142

args_how => TAKE1,

142

args_how => TAKE1,

143

errmsg => 'RedmineCacheCredsMax must be decimal number',

143

errmsg => 'RedmineCacheCredsMax must be decimal number',

144

},

144

},

145

);

145

);

146

147

sub RedmineDSN {

147

sub RedmineDSN {

148

my ($self, $parms, $arg) = @_;

148

my ($self, $parms, $arg) = @_;

149

$self->{RedmineDSN} = $arg;

149

$self->{RedmineDSN} = $arg;

150

my $query = "SELECT

150

my $query = "SELECT

151

hashed_password, salt, auth_source_id, permissions

151

hashed_password, salt, auth_source_id, permissions

152

FROM ~~members,~~ projects, users, roles~~, member_roles~~

152

FROM projects, users, roles

153

WHERE

153

WHERE

154

~~projects.id=members.project_id~~

154

users.login=?

155

AND member_roles.member_id=members.id

155

AND projects.identifier=?

156

AND users.id=members.user_id

157

AND roles.id=member_roles.role_id

158

AND users.status=1

156

AND users.status=1

159

AND ~~login=?~~

157

AND (

160

AND identifier=? ";

158

roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id)

159

OR

160

(roles.builtin=1 AND cast(projects.is_public as CHAR) IN ('t', '1'))

161

) ";

161

$self->{RedmineQuery} = trim($query);

162

$self->{RedmineQuery} = trim($query);

162

}

163

}

163

164

sub RedmineDbUser { set_val('RedmineDbUser', @_); }

165

sub RedmineDbUser { set_val('RedmineDbUser', @_); }

165

sub RedmineDbPass { set_val('RedmineDbPass', @_); }

166

sub RedmineDbPass { set_val('RedmineDbPass', @_); }

166

sub RedmineDbWhereClause {

167

sub RedmineDbWhereClause {

167

my ($self, $parms, $arg) = @_;

168

my ($self, $parms, $arg) = @_;

168

$self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");

169

$self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");

169

}

170

}

170

171

sub RedmineCacheCredsMax {

172

sub RedmineCacheCredsMax {

172

my ($self, $parms, $arg) = @_;

173

my ($self, $parms, $arg) = @_;

173

if ($arg) {

174

if ($arg) {

174

$self->{RedmineCachePool} = APR::Pool->new;

175

$self->{RedmineCachePool} = APR::Pool->new;

175

$self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);

176

$self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);

176

$self->{RedmineCacheCredsCount} = 0;

177

$self->{RedmineCacheCredsCount} = 0;

177

$self->{RedmineCacheCredsMax} = $arg;

178

$self->{RedmineCacheCredsMax} = $arg;

178

}

179

}

179

}

180

}

180

181

sub trim {

182

sub trim {

182

my $string = shift;

183

my $string = shift;

183

$string =~ s/\s{2,}/ /g;

184

$string =~ s/\s{2,}/ /g;

184

return $string;

185

return $string;

185

}

186

}

186

187

sub set_val {

188

sub set_val {

188

my ($key, $self, $parms, $arg) = @_;

189

my ($key, $self, $parms, $arg) = @_;

189

$self->{$key} = $arg;

190

$self->{$key} = $arg;

190

}

191

}

191

192

Apache2::Module::add(__PACKAGE__, \@directives);

193

Apache2::Module::add(__PACKAGE__, \@directives);

193

194

195

my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;

196

my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;

196

197

sub access_handler {

198

sub access_handler {

198

my $r = shift;

199

my $r = shift;

199

200

unless ($r->some_auth_required) {

201

unless ($r->some_auth_required) {

201

$r->log_reason("No authentication has been configured");

202

$r->log_reason("No authentication has been configured");

202

return FORBIDDEN;

203

return FORBIDDEN;

203

}

204

}

204

205

my $method = $r->method;

206

my $method = $r->method;

206

return OK unless defined $read_only_methods{$method};

207

return OK unless defined $read_only_methods{$method};

207

208

my $project_id = get_project_identifier($r);

209

my $project_id = get_project_identifier($r);

209

210

$r->set_handlers(PerlAuthenHandler => [\&OK])

211

$r->set_handlers(PerlAuthenHandler => [\&OK])

211

if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);

212

if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);

212

213

return OK

214

return OK

214

}

215

}

215

216

sub authen_handler {

217

sub authen_handler {

217

my $r = shift;

218

my $r = shift;

218

219

my ($res, $redmine_pass) = $r->get_basic_auth_pw();

220

my ($res, $redmine_pass) = $r->get_basic_auth_pw();

220

return $res unless $res == OK;

221

return $res unless $res == OK;

221

222

if (is_member($r->user, $redmine_pass, $r)) {

223

if (is_member($r->user, $redmine_pass, $r)) {

223

return OK;

224

return OK;

224

} else {

225

} else {

225

$r->note_auth_failure();

226

$r->note_auth_failure();

226

return AUTH_REQUIRED;

227

return AUTH_REQUIRED;

227

}

228

}

228

}

229

}

229

230

# check if authentication is forced

231

# check if authentication is forced

231

sub is_authentication_forced {

232

sub is_authentication_forced {

232

my $r = shift;

233

my $r = shift;

233

234

my $dbh = connect_database($r);

235

my $dbh = connect_database($r);

235

my $sth = $dbh->prepare(

236

my $sth = $dbh->prepare(

236

"SELECT value FROM settings where settings.name = 'login_required';"

237

"SELECT value FROM settings where settings.name = 'login_required';"

237

);

238

);

238

239

$sth->execute();

240

$sth->execute();

240

my $ret = 0;

241

my $ret = 0;

241

if (my @row = $sth->fetchrow_array) {

242

if (my @row = $sth->fetchrow_array) {

242

if ($row[0] eq "1" || $row[0] eq "t") {

243

if ($row[0] eq "1" || $row[0] eq "t") {

243

$ret = 1;

244

$ret = 1;

244

}

245

}

245

}

246

}

246

$sth->finish();

247

$sth->finish();

247

undef $sth;

248

undef $sth;

248

249

$dbh->disconnect();

250

$dbh->disconnect();

250

undef $dbh;

251

undef $dbh;

251

252

$ret;

253

$ret;

253

}

254

}

254

255

sub is_public_project {

256

sub is_public_project {

256

my $project_id = shift;

257

my $project_id = shift;

257

my $r = shift;

258

my $r = shift;

258

259

if (is_authentication_forced($r)) {

260

if (is_authentication_forced($r)) {

260

return 0;

261

return 0;

261

}

262

}

262

263

my $dbh = connect_database($r);

264

my $dbh = connect_database($r);

264

my $sth = $dbh->prepare(

265

my $sth = $dbh->prepare(

265

"SELECT is_public FROM projects WHERE projects.identifier = ?;"

266

"SELECT is_public FROM projects WHERE projects.identifier = ?;"

266

);

267

);

267

268

$sth->execute($project_id);

269

$sth->execute($project_id);

269

my $ret = 0;

270

my $ret = 0;

270

if (my @row = $sth->fetchrow_array) {

271

if (my @row = $sth->fetchrow_array) {

271

if ($row[0] eq "1" || $row[0] eq "t") {

272

if ($row[0] eq "1" || $row[0] eq "t") {

272

$ret = 1;

273

$ret = 1;

273

}

274

}

274

}

275

}

275

$sth->finish();

276

$sth->finish();

276

undef $sth;

277

undef $sth;

277

$dbh->disconnect();

278

$dbh->disconnect();

278

undef $dbh;

279

undef $dbh;

279

280

$ret;

281

$ret;

281

}

282

}

282

283

sub anonymous_role_allows_browse_repository {

284

sub anonymous_role_allows_browse_repository {

284

my $r = shift;

285

my $r = shift;

285

286

my $dbh = connect_database($r);

287

my $dbh = connect_database($r);

287

my $sth = $dbh->prepare(

288

my $sth = $dbh->prepare(

288

"SELECT permissions FROM roles WHERE builtin = 2;"

289

"SELECT permissions FROM roles WHERE builtin = 2;"

289

);

290

);

290

291

$sth->execute();

292

$sth->execute();

292

my $ret = 0;

293

my $ret = 0;

293

if (my @row = $sth->fetchrow_array) {

294

if (my @row = $sth->fetchrow_array) {

294

if ($row[0] =~ /:browse_repository/) {

295

if ($row[0] =~ /:browse_repository/) {

295

$ret = 1;

296

$ret = 1;

296

}

297

}

297

}

298

}

298

$sth->finish();

299

$sth->finish();

299

undef $sth;

300

undef $sth;

300

$dbh->disconnect();

301

$dbh->disconnect();

301

undef $dbh;

302

undef $dbh;

302

303

$ret;

304

$ret;

304

}

305

}

305

306

# perhaps we should use repository right (other read right) to check public access.

307

# perhaps we should use repository right (other read right) to check public access.

307

# it could be faster BUT it doesn't work for the moment.

308

# it could be faster BUT it doesn't work for the moment.

308

# sub is_public_project_by_file {

309

# sub is_public_project_by_file {

309

# my $project_id = shift;

310

# my $project_id = shift;

310

# my $r = shift;

311

# my $r = shift;

311

312

# my $tree = Apache2::Directive::conftree();

313

# my $tree = Apache2::Directive::conftree();

313

# my $node = $tree->lookup('Location', $r->location);

314

# my $node = $tree->lookup('Location', $r->location);

314

# my $hash = $node->as_hash;

315

# my $hash = $node->as_hash;

315

316

# my $svnparentpath = $hash->{SVNParentPath};

317

# my $svnparentpath = $hash->{SVNParentPath};

317

# my $repos_path = $svnparentpath . "/" . $project_id;

318

# my $repos_path = $svnparentpath . "/" . $project_id;

318

# return 1 if (stat($repos_path))[2] & 00007;

319

# return 1 if (stat($repos_path))[2] & 00007;

319

# }

320

# }

320

321

sub is_member {

322

sub is_member {

322

my $redmine_user = shift;

323

my $redmine_user = shift;

323

my $redmine_pass = shift;

324

my $redmine_pass = shift;

324

my $r = shift;

325

my $r = shift;

325

326

my $dbh = connect_database($r);

327

my $dbh = connect_database($r);

327

my $project_id = get_project_identifier($r);

328

my $project_id = get_project_identifier($r);

328

329

my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);

330

my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);

330

331

my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

332

my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

332

my $usrprojpass;

333

my $usrprojpass;

333

if ($cfg->{RedmineCacheCredsMax}) {

334

if ($cfg->{RedmineCacheCredsMax}) {

334

$usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);

335

$usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);

335

return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));

336

return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));

336

}

337

}

337

my $query = $cfg->{RedmineQuery};

338

my $query = $cfg->{RedmineQuery};

338

my $sth = $dbh->prepare($query);

339

my $sth = $dbh->prepare($query);

339

$sth->execute($redmine_user, $project_id);

340

$sth->execute($redmine_user, $project_id);

340

341

my $ret;

342

my $ret;

342

while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) {

343

while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) {

343

344

unless ($auth_source_id) {

345

unless ($auth_source_id) {

345

my $method = $r->method;

346

my $method = $r->method;

346

my $salted_password = Digest::SHA1::sha1_hex($salt.$pass_digest);

347

my $salted_password = Digest::SHA1::sha1_hex($salt.$pass_digest);

347

if ($hashed_password eq $salted_password && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {

348

if ($hashed_password eq $salted_password && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {

348

$ret = 1;

349

$ret = 1;

349

last;

350

last;

350

}

351

}

351

} elsif ($CanUseLDAPAuth) {

352

} elsif ($CanUseLDAPAuth) {

352

my $sthldap = $dbh->prepare(

353

my $sthldap = $dbh->prepare(

353

"SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"

354

"SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"

354

);

355

);

355

$sthldap->execute($auth_source_id);

356

$sthldap->execute($auth_source_id);

356

while (my @rowldap = $sthldap->fetchrow_array) {

357

while (my @rowldap = $sthldap->fetchrow_array) {

357

my $ldap = Authen::Simple::LDAP->new(

358

my $ldap = Authen::Simple::LDAP->new(

358

host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],

359

host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],

359

port => $rowldap[1],

360

port => $rowldap[1],

360

basedn => $rowldap[5],

361

basedn => $rowldap[5],

361

binddn => $rowldap[3] ? $rowldap[3] : "",

362

binddn => $rowldap[3] ? $rowldap[3] : "",

362

bindpw => $rowldap[4] ? $rowldap[4] : "",

363

bindpw => $rowldap[4] ? $rowldap[4] : "",

363

filter => "(".$rowldap[6]."=%s)"

364

filter => "(".$rowldap[6]."=%s)"

364

);

365

);

365

my $method = $r->method;

366

my $method = $r->method;

366

$ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));

367

$ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));

367

368

}

369

}

369

$sthldap->finish();

370

$sthldap->finish();

370

undef $sthldap;

371

undef $sthldap;

371

}

372

}

372

}

373

}

373

$sth->finish();

374

$sth->finish();

374

undef $sth;

375

undef $sth;

375

$dbh->disconnect();

376

$dbh->disconnect();

376

undef $dbh;

377

undef $dbh;

377

378

if ($cfg->{RedmineCacheCredsMax} and $ret) {

379

if ($cfg->{RedmineCacheCredsMax} and $ret) {

379

if (defined $usrprojpass) {

380

if (defined $usrprojpass) {

380

$cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);

381

$cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);

381

} else {

382

} else {

382

if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {

383

if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {

383

$cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);

384

$cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);

384

$cfg->{RedmineCacheCredsCount}++;

385

$cfg->{RedmineCacheCredsCount}++;

385

} else {

386

} else {

386

$cfg->{RedmineCacheCreds}->clear();

387

$cfg->{RedmineCacheCreds}->clear();

387

$cfg->{RedmineCacheCredsCount} = 0;

388

$cfg->{RedmineCacheCredsCount} = 0;

388

}

389

}

389

}

390

}

390

}

391

}

391

392

$ret;

393

$ret;

393

}

394

}

394

395

sub get_project_identifier {

396

sub get_project_identifier {

396

my $r = shift;

397

my $r = shift;

397

398

my $location = $r->location;

399

my $location = $r->location;

399

my ($identifier) = $r->uri =~ m{$location/*([^/]+)};

400

my ($identifier) = $r->uri =~ m{$location/*([^/]+)};

400

$identifier;

401

$identifier;

401

}

402

}

402

403

sub connect_database {

404

sub connect_database {

404

my $r = shift;

405

my $r = shift;

405

406

my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

407

my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);

407

return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});

408

return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});

408

}

409

}

409

410

1;

411

1;

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

             package Apache::Authn::Redmine;
             =head1 Apache::Authn::Redmine
             Redmine - a mod_perl module to authenticate webdav subversion users
             against redmine database
             =head1 SYNOPSIS
             This module allow anonymous users to browse public project and
             registred users to browse and commit their project. Authentication is
             done against the redmine database or the LDAP configured in redmine.
             This method is far simpler than the one with pam_* and works with all
             database without an hassle but you need to have apache/mod_perl on the
             svn server.
             =head1 INSTALLATION
             For this to automagically work, you need to have a recent reposman.rb
             (after r860) and if you already use reposman, read the last section to
             migrate.
             Sorry ruby users but you need some perl modules, at least mod_perl2,
             DBI and DBD::mysql (or the DBD driver for you database as it should
             work on allmost all databases).
             On debian/ubuntu you must do :
               aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
             If your Redmine users use LDAP authentication, you will also need
             Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
               aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
             =head1 CONFIGURATION
                ## This module has to be in your perl path
                ## eg:  /usr/lib/perl5/Apache/Authn/Redmine.pm
                PerlLoadModule Apache::Authn::Redmine
                <Location /svn>
                  DAV svn
                  SVNParentPath "/var/svn"
                  AuthType Basic
                  AuthName redmine
                  Require valid-user
                  PerlAccessHandler Apache::Authn::Redmine::access_handler
                  PerlAuthenHandler Apache::Authn::Redmine::authen_handler
                  ## for mysql
                  RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
                  ## for postgres
                  # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
                  RedmineDbUser "redmine"
                  RedmineDbPass "password"
                  ## Optional where clause (fulltext search would be slow and
                  ## database dependant).
                  # RedmineDbWhereClause "and members.role_id IN (1,2)"
                  ## Optional credentials cache size
                  # RedmineCacheCredsMax 50
               </Location>
             To be able to browse repository inside redmine, you must add something
             like that :
                <Location /svn-private>
                  DAV svn
                  SVNParentPath "/var/svn"
                  Order deny,allow
                  Deny from all
                  # only allow reading orders
                  <Limit GET PROPFIND OPTIONS REPORT>
                    Allow from redmine.server.ip
                  </Limit>
                </Location>
             and you will have to use this reposman.rb command line to create repository :
               reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
             =head1 MIGRATION FROM OLDER RELEASES
             If you use an older reposman.rb (r860 or before), you need to change
             rights on repositories to allow the apache user to read and write
             S<them :>
               sudo chown -R www-data /var/svn/*
               sudo chmod -R u+w /var/svn/*
             And you need to upgrade at least reposman.rb (after r860).
             =cut
             use strict;
             use warnings FATAL => 'all', NONFATAL => 'redefine';
             use DBI;
             use Digest::SHA1;
             # optional module for LDAP authentication
             my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
             use Apache2::Module;
             use Apache2::Access;
             use Apache2::ServerRec qw();
             use Apache2::RequestRec qw();
             use Apache2::RequestUtil qw();
             use Apache2::Const qw(:common :override :cmd_how);
             use APR::Pool ();
             use APR::Table ();
             # use Apache2::Directive qw();
             my @directives = (
               {
                 name => 'RedmineDSN',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
                 errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
               },
               {
                 name => 'RedmineDbUser',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineDbPass',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineDbWhereClause',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineCacheCredsMax',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
                 errmsg => 'RedmineCacheCredsMax must be decimal number',
               },
             );
             sub RedmineDSN {
               my ($self, $parms, $arg) = @_;
               $self->{RedmineDSN} = $arg;
               my $query = "SELECT
                              hashed_password, salt, auth_source_id, permissions
-                          FROM members, projects, users, roles, member_roles
+                          FROM projects, users, roles
                           WHERE
-                            projects.id=members.project_id
+                            users.login=?
-                            AND member_roles.member_id=members.id
+                            AND projects.identifier=?
-                            AND users.id=members.user_id
-                            AND roles.id=member_roles.role_id
                             AND users.status=1
-                            AND login=?
+                            AND (
-                            AND identifier=? ";
+                              roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id)
+                              OR
+                              (roles.builtin=1 AND cast(projects.is_public as CHAR) IN ('t', '1'))
+                            ) ";
               $self->{RedmineQuery} = trim($query);
             }
             sub RedmineDbUser { set_val('RedmineDbUser', @_); }
             sub RedmineDbPass { set_val('RedmineDbPass', @_); }
             sub RedmineDbWhereClause {
               my ($self, $parms, $arg) = @_;
               $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
             }
             sub RedmineCacheCredsMax {
               my ($self, $parms, $arg) = @_;
               if ($arg) {
                 $self->{RedmineCachePool} = APR::Pool->new;
                 $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
                 $self->{RedmineCacheCredsCount} = 0;
                 $self->{RedmineCacheCredsMax} = $arg;
               }
             }
             sub trim {
               my $string = shift;
               $string =~ s/\s{2,}/ /g;
               return $string;
             }
             sub set_val {
               my ($key, $self, $parms, $arg) = @_;
               $self->{$key} = $arg;
             }
             Apache2::Module::add(__PACKAGE__, \@directives);
             my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
             sub access_handler {
               my $r = shift;
               unless ($r->some_auth_required) {
                   $r->log_reason("No authentication has been configured");
                   return FORBIDDEN;
               }
               my $method = $r->method;
               return OK unless defined $read_only_methods{$method};
               my $project_id = get_project_identifier($r);
               $r->set_handlers(PerlAuthenHandler => [\&OK])
                   if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
               return OK
             }
             sub authen_handler {
               my $r = shift;
               my ($res, $redmine_pass) =  $r->get_basic_auth_pw();
               return $res unless $res == OK;
               if (is_member($r->user, $redmine_pass, $r)) {
                   return OK;
               } else {
                   $r->note_auth_failure();
                   return AUTH_REQUIRED;
               }
             }
             # check if authentication is forced
             sub is_authentication_forced {
               my $r = shift;
               my $dbh = connect_database($r);
               my $sth = $dbh->prepare(
                 "SELECT value FROM settings where settings.name = 'login_required';"
               );
               $sth->execute();
               my $ret = 0;
               if (my @row = $sth->fetchrow_array) {
                 if ($row[0] eq "1" || $row[0] eq "t") {
                   $ret = 1;
                 }
               }
               $sth->finish();
               undef $sth;
               $dbh->disconnect();
               undef $dbh;
               $ret;
             }
             sub is_public_project {
                 my $project_id = shift;
                 my $r = shift;
                 if (is_authentication_forced($r)) {
                   return 0;
                 }
                 my $dbh = connect_database($r);
                 my $sth = $dbh->prepare(
                     "SELECT is_public FROM projects WHERE projects.identifier = ?;"
                 );
                 $sth->execute($project_id);
                 my $ret = 0;
                 if (my @row = $sth->fetchrow_array) {
                 	if ($row[0] eq "1" || $row[0] eq "t") {
                 		$ret = 1;
                 	}
                 }
                 $sth->finish();
                 undef $sth;
                 $dbh->disconnect();
                 undef $dbh;
                 $ret;
             }
             sub anonymous_role_allows_browse_repository {
               my $r = shift;
               my $dbh = connect_database($r);
               my $sth = $dbh->prepare(
                   "SELECT permissions FROM roles WHERE builtin = 2;"
               );
               $sth->execute();
               my $ret = 0;
               if (my @row = $sth->fetchrow_array) {
                 if ($row[0] =~ /:browse_repository/) {
                   $ret = 1;
                 }
               }
               $sth->finish();
               undef $sth;
               $dbh->disconnect();
               undef $dbh;
               $ret;
             }
             # perhaps we should use repository right (other read right) to check public access.
             # it could be faster BUT it doesn't work for the moment.
             # sub is_public_project_by_file {
             #     my $project_id = shift;
             #     my $r = shift;
             #     my $tree = Apache2::Directive::conftree();
             #     my $node = $tree->lookup('Location', $r->location);
             #     my $hash = $node->as_hash;
             #     my $svnparentpath = $hash->{SVNParentPath};
             #     my $repos_path = $svnparentpath . "/" . $project_id;
             #     return 1 if (stat($repos_path))[2] & 00007;
             # }
             sub is_member {
               my $redmine_user = shift;
               my $redmine_pass = shift;
               my $r = shift;
               my $dbh         = connect_database($r);
               my $project_id  = get_project_identifier($r);
               my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
               my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
               my $usrprojpass;
               if ($cfg->{RedmineCacheCredsMax}) {
                 $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);
                 return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
               }
               my $query = $cfg->{RedmineQuery};
               my $sth = $dbh->prepare($query);
               $sth->execute($redmine_user, $project_id);
               my $ret;
               while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) {
                   unless ($auth_source_id) {
             	  			my $method = $r->method;
                       my $salted_password = Digest::SHA1::sha1_hex($salt.$pass_digest);
             					if ($hashed_password eq $salted_password && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
                           $ret = 1;
                           last;
                       }
                   } elsif ($CanUseLDAPAuth) {
                       my $sthldap = $dbh->prepare(
                           "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
                       );
                       $sthldap->execute($auth_source_id);
                       while (my @rowldap = $sthldap->fetchrow_array) {
                         my $ldap = Authen::Simple::LDAP->new(
                             host    =>      ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],
                             port    =>      $rowldap[1],
                             basedn  =>      $rowldap[5],
                             binddn  =>      $rowldap[3] ? $rowldap[3] : "",
                             bindpw  =>      $rowldap[4] ? $rowldap[4] : "",
                             filter  =>      "(".$rowldap[6]."=%s)"
                         );
                         my $method = $r->method;
                         $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
                       }
                       $sthldap->finish();
                       undef $sthldap;
                   }
               }
               $sth->finish();
               undef $sth;
               $dbh->disconnect();
               undef $dbh;
               if ($cfg->{RedmineCacheCredsMax} and $ret) {
                 if (defined $usrprojpass) {
                   $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                 } else {
                   if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
                     $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                     $cfg->{RedmineCacheCredsCount}++;
                   } else {
                     $cfg->{RedmineCacheCreds}->clear();
                     $cfg->{RedmineCacheCredsCount} = 0;
                   }
                 }
               }
               $ret;
             }
             sub get_project_identifier {
                 my $r = shift;
                 my $location = $r->location;
                 my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
                 $identifier;
             }
             sub connect_database {
                 my $r = shift;
                 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
                 return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
             }
 ;