annotate extra/svn/.svn/text-base/Redmine.pm.svn-base @ 1172:60d42b9850d2 bug_367

Close obsolete branch bug_367
author Chris Cannam
date Fri, 03 Feb 2012 15:20:50 +0000
parents 051f544170fe
children
rev   line source
Chris@0 1 package Apache::Authn::Redmine;
Chris@0 2
Chris@0 3 =head1 Apache::Authn::Redmine
Chris@0 4
Chris@0 5 Redmine - a mod_perl module to authenticate webdav subversion users
Chris@0 6 against redmine database
Chris@0 7
Chris@0 8 =head1 SYNOPSIS
Chris@0 9
Chris@0 10 This module allow anonymous users to browse public project and
Chris@0 11 registred users to browse and commit their project. Authentication is
Chris@0 12 done against the redmine database or the LDAP configured in redmine.
Chris@0 13
Chris@0 14 This method is far simpler than the one with pam_* and works with all
Chris@0 15 database without an hassle but you need to have apache/mod_perl on the
Chris@0 16 svn server.
Chris@0 17
Chris@0 18 =head1 INSTALLATION
Chris@0 19
Chris@0 20 For this to automagically work, you need to have a recent reposman.rb
Chris@0 21 (after r860) and if you already use reposman, read the last section to
Chris@0 22 migrate.
Chris@0 23
Chris@0 24 Sorry ruby users but you need some perl modules, at least mod_perl2,
Chris@0 25 DBI and DBD::mysql (or the DBD driver for you database as it should
Chris@0 26 work on allmost all databases).
Chris@0 27
Chris@0 28 On debian/ubuntu you must do :
Chris@0 29
Chris@0 30 aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
Chris@0 31
Chris@0 32 If your Redmine users use LDAP authentication, you will also need
Chris@0 33 Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
Chris@0 34
Chris@0 35 aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
Chris@0 36
Chris@0 37 =head1 CONFIGURATION
Chris@0 38
Chris@0 39 ## This module has to be in your perl path
Chris@0 40 ## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm
Chris@0 41 PerlLoadModule Apache::Authn::Redmine
Chris@0 42 <Location /svn>
Chris@0 43 DAV svn
Chris@0 44 SVNParentPath "/var/svn"
Chris@0 45
Chris@0 46 AuthType Basic
Chris@0 47 AuthName redmine
Chris@0 48 Require valid-user
Chris@0 49
Chris@0 50 PerlAccessHandler Apache::Authn::Redmine::access_handler
Chris@0 51 PerlAuthenHandler Apache::Authn::Redmine::authen_handler
Chris@0 52
Chris@0 53 ## for mysql
Chris@0 54 RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
Chris@0 55 ## for postgres
Chris@0 56 # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
Chris@0 57
Chris@0 58 RedmineDbUser "redmine"
Chris@0 59 RedmineDbPass "password"
Chris@0 60 ## Optional where clause (fulltext search would be slow and
Chris@0 61 ## database dependant).
Chris@0 62 # RedmineDbWhereClause "and members.role_id IN (1,2)"
Chris@0 63 ## Optional credentials cache size
Chris@0 64 # RedmineCacheCredsMax 50
Chris@0 65 </Location>
Chris@0 66
Chris@0 67 To be able to browse repository inside redmine, you must add something
Chris@0 68 like that :
Chris@0 69
Chris@0 70 <Location /svn-private>
Chris@0 71 DAV svn
Chris@0 72 SVNParentPath "/var/svn"
Chris@0 73 Order deny,allow
Chris@0 74 Deny from all
Chris@0 75 # only allow reading orders
Chris@0 76 <Limit GET PROPFIND OPTIONS REPORT>
Chris@0 77 Allow from redmine.server.ip
Chris@0 78 </Limit>
Chris@0 79 </Location>
Chris@0 80
Chris@0 81 and you will have to use this reposman.rb command line to create repository :
Chris@0 82
Chris@0 83 reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
Chris@0 84
Chris@0 85 =head1 MIGRATION FROM OLDER RELEASES
Chris@0 86
Chris@0 87 If you use an older reposman.rb (r860 or before), you need to change
Chris@0 88 rights on repositories to allow the apache user to read and write
Chris@0 89 S<them :>
Chris@0 90
Chris@0 91 sudo chown -R www-data /var/svn/*
Chris@0 92 sudo chmod -R u+w /var/svn/*
Chris@0 93
Chris@0 94 And you need to upgrade at least reposman.rb (after r860).
Chris@0 95
Chris@0 96 =cut
Chris@0 97
Chris@0 98 use strict;
Chris@0 99 use warnings FATAL => 'all', NONFATAL => 'redefine';
Chris@0 100
Chris@0 101 use DBI;
Chris@0 102 use Digest::SHA1;
Chris@0 103 # optional module for LDAP authentication
Chris@0 104 my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
Chris@0 105
Chris@0 106 use Apache2::Module;
Chris@0 107 use Apache2::Access;
Chris@0 108 use Apache2::ServerRec qw();
Chris@0 109 use Apache2::RequestRec qw();
Chris@0 110 use Apache2::RequestUtil qw();
Chris@0 111 use Apache2::Const qw(:common :override :cmd_how);
Chris@0 112 use APR::Pool ();
Chris@0 113 use APR::Table ();
Chris@0 114
Chris@0 115 # use Apache2::Directive qw();
Chris@0 116
Chris@0 117 my @directives = (
Chris@0 118 {
Chris@0 119 name => 'RedmineDSN',
Chris@0 120 req_override => OR_AUTHCFG,
Chris@0 121 args_how => TAKE1,
Chris@0 122 errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
Chris@0 123 },
Chris@0 124 {
Chris@0 125 name => 'RedmineDbUser',
Chris@0 126 req_override => OR_AUTHCFG,
Chris@0 127 args_how => TAKE1,
Chris@0 128 },
Chris@0 129 {
Chris@0 130 name => 'RedmineDbPass',
Chris@0 131 req_override => OR_AUTHCFG,
Chris@0 132 args_how => TAKE1,
Chris@0 133 },
Chris@0 134 {
Chris@0 135 name => 'RedmineDbWhereClause',
Chris@0 136 req_override => OR_AUTHCFG,
Chris@0 137 args_how => TAKE1,
Chris@0 138 },
Chris@0 139 {
Chris@0 140 name => 'RedmineCacheCredsMax',
Chris@0 141 req_override => OR_AUTHCFG,
Chris@0 142 args_how => TAKE1,
Chris@0 143 errmsg => 'RedmineCacheCredsMax must be decimal number',
Chris@0 144 },
Chris@0 145 );
Chris@0 146
Chris@0 147 sub RedmineDSN {
Chris@0 148 my ($self, $parms, $arg) = @_;
Chris@0 149 $self->{RedmineDSN} = $arg;
Chris@0 150 my $query = "SELECT
Chris@245 151 hashed_password, salt, auth_source_id, permissions
Chris@0 152 FROM members, projects, users, roles, member_roles
Chris@0 153 WHERE
Chris@0 154 projects.id=members.project_id
Chris@0 155 AND member_roles.member_id=members.id
Chris@0 156 AND users.id=members.user_id
Chris@0 157 AND roles.id=member_roles.role_id
Chris@0 158 AND users.status=1
Chris@0 159 AND login=?
Chris@0 160 AND identifier=? ";
Chris@0 161 $self->{RedmineQuery} = trim($query);
Chris@0 162 }
Chris@0 163
Chris@0 164 sub RedmineDbUser { set_val('RedmineDbUser', @_); }
Chris@0 165 sub RedmineDbPass { set_val('RedmineDbPass', @_); }
Chris@0 166 sub RedmineDbWhereClause {
Chris@0 167 my ($self, $parms, $arg) = @_;
Chris@0 168 $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
Chris@0 169 }
Chris@0 170
Chris@0 171 sub RedmineCacheCredsMax {
Chris@0 172 my ($self, $parms, $arg) = @_;
Chris@0 173 if ($arg) {
Chris@0 174 $self->{RedmineCachePool} = APR::Pool->new;
Chris@0 175 $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
Chris@0 176 $self->{RedmineCacheCredsCount} = 0;
Chris@0 177 $self->{RedmineCacheCredsMax} = $arg;
Chris@0 178 }
Chris@0 179 }
Chris@0 180
Chris@0 181 sub trim {
Chris@0 182 my $string = shift;
Chris@0 183 $string =~ s/\s{2,}/ /g;
Chris@0 184 return $string;
Chris@0 185 }
Chris@0 186
Chris@0 187 sub set_val {
Chris@0 188 my ($key, $self, $parms, $arg) = @_;
Chris@0 189 $self->{$key} = $arg;
Chris@0 190 }
Chris@0 191
Chris@0 192 Apache2::Module::add(__PACKAGE__, \@directives);
Chris@0 193
Chris@0 194
Chris@0 195 my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
Chris@0 196
Chris@0 197 sub access_handler {
Chris@0 198 my $r = shift;
Chris@0 199
Chris@0 200 unless ($r->some_auth_required) {
Chris@0 201 $r->log_reason("No authentication has been configured");
Chris@0 202 return FORBIDDEN;
Chris@0 203 }
Chris@0 204
Chris@0 205 my $method = $r->method;
Chris@0 206 return OK unless defined $read_only_methods{$method};
Chris@0 207
Chris@0 208 my $project_id = get_project_identifier($r);
Chris@0 209
Chris@0 210 $r->set_handlers(PerlAuthenHandler => [\&OK])
Chris@0 211 if is_public_project($project_id, $r);
Chris@0 212
Chris@0 213 return OK
Chris@0 214 }
Chris@0 215
Chris@0 216 sub authen_handler {
Chris@0 217 my $r = shift;
Chris@0 218
Chris@0 219 my ($res, $redmine_pass) = $r->get_basic_auth_pw();
Chris@0 220 return $res unless $res == OK;
Chris@0 221
Chris@0 222 if (is_member($r->user, $redmine_pass, $r)) {
Chris@0 223 return OK;
Chris@0 224 } else {
Chris@0 225 $r->note_auth_failure();
Chris@0 226 return AUTH_REQUIRED;
Chris@0 227 }
Chris@0 228 }
Chris@0 229
Chris@0 230 # check if authentication is forced
Chris@0 231 sub is_authentication_forced {
Chris@0 232 my $r = shift;
Chris@0 233
Chris@0 234 my $dbh = connect_database($r);
Chris@0 235 my $sth = $dbh->prepare(
Chris@0 236 "SELECT value FROM settings where settings.name = 'login_required';"
Chris@0 237 );
Chris@0 238
Chris@0 239 $sth->execute();
Chris@0 240 my $ret = 0;
Chris@0 241 if (my @row = $sth->fetchrow_array) {
Chris@0 242 if ($row[0] eq "1" || $row[0] eq "t") {
Chris@0 243 $ret = 1;
Chris@0 244 }
Chris@0 245 }
Chris@0 246 $sth->finish();
Chris@0 247 undef $sth;
Chris@0 248
Chris@0 249 $dbh->disconnect();
Chris@0 250 undef $dbh;
Chris@0 251
Chris@0 252 $ret;
Chris@0 253 }
Chris@0 254
Chris@0 255 sub is_public_project {
Chris@0 256 my $project_id = shift;
Chris@0 257 my $r = shift;
Chris@0 258
Chris@0 259 if (is_authentication_forced($r)) {
Chris@0 260 return 0;
Chris@0 261 }
Chris@0 262
Chris@0 263 my $dbh = connect_database($r);
Chris@0 264 my $sth = $dbh->prepare(
Chris@0 265 "SELECT is_public FROM projects WHERE projects.identifier = ?;"
Chris@0 266 );
Chris@0 267
Chris@0 268 $sth->execute($project_id);
Chris@0 269 my $ret = 0;
Chris@0 270 if (my @row = $sth->fetchrow_array) {
Chris@0 271 if ($row[0] eq "1" || $row[0] eq "t") {
Chris@0 272 $ret = 1;
Chris@0 273 }
Chris@0 274 }
Chris@0 275 $sth->finish();
Chris@0 276 undef $sth;
Chris@0 277 $dbh->disconnect();
Chris@0 278 undef $dbh;
Chris@0 279
Chris@0 280 $ret;
Chris@0 281 }
Chris@0 282
Chris@0 283 # perhaps we should use repository right (other read right) to check public access.
Chris@0 284 # it could be faster BUT it doesn't work for the moment.
Chris@0 285 # sub is_public_project_by_file {
Chris@0 286 # my $project_id = shift;
Chris@0 287 # my $r = shift;
Chris@0 288
Chris@0 289 # my $tree = Apache2::Directive::conftree();
Chris@0 290 # my $node = $tree->lookup('Location', $r->location);
Chris@0 291 # my $hash = $node->as_hash;
Chris@0 292
Chris@0 293 # my $svnparentpath = $hash->{SVNParentPath};
Chris@0 294 # my $repos_path = $svnparentpath . "/" . $project_id;
Chris@0 295 # return 1 if (stat($repos_path))[2] & 00007;
Chris@0 296 # }
Chris@0 297
Chris@0 298 sub is_member {
Chris@0 299 my $redmine_user = shift;
Chris@0 300 my $redmine_pass = shift;
Chris@0 301 my $r = shift;
Chris@0 302
Chris@0 303 my $dbh = connect_database($r);
Chris@0 304 my $project_id = get_project_identifier($r);
Chris@0 305
Chris@0 306 my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
Chris@0 307
Chris@0 308 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
Chris@0 309 my $usrprojpass;
Chris@0 310 if ($cfg->{RedmineCacheCredsMax}) {
Chris@0 311 $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);
Chris@0 312 return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
Chris@0 313 }
Chris@0 314 my $query = $cfg->{RedmineQuery};
Chris@0 315 my $sth = $dbh->prepare($query);
Chris@0 316 $sth->execute($redmine_user, $project_id);
Chris@0 317
Chris@0 318 my $ret;
Chris@245 319 while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) {
Chris@0 320
Chris@0 321 unless ($auth_source_id) {
Chris@245 322 my $method = $r->method;
Chris@245 323 my $salted_password = Digest::SHA1::sha1_hex($salt.$pass_digest);
Chris@245 324 if ($hashed_password eq $salted_password && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
Chris@0 325 $ret = 1;
Chris@0 326 last;
Chris@0 327 }
Chris@0 328 } elsif ($CanUseLDAPAuth) {
Chris@0 329 my $sthldap = $dbh->prepare(
Chris@0 330 "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
Chris@0 331 );
Chris@0 332 $sthldap->execute($auth_source_id);
Chris@0 333 while (my @rowldap = $sthldap->fetchrow_array) {
Chris@0 334 my $ldap = Authen::Simple::LDAP->new(
chris@37 335 host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],
Chris@0 336 port => $rowldap[1],
Chris@0 337 basedn => $rowldap[5],
Chris@0 338 binddn => $rowldap[3] ? $rowldap[3] : "",
Chris@0 339 bindpw => $rowldap[4] ? $rowldap[4] : "",
Chris@0 340 filter => "(".$rowldap[6]."=%s)"
Chris@0 341 );
Chris@0 342 my $method = $r->method;
Chris@0 343 $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
Chris@0 344
Chris@0 345 }
Chris@0 346 $sthldap->finish();
Chris@0 347 undef $sthldap;
Chris@0 348 }
Chris@0 349 }
Chris@0 350 $sth->finish();
Chris@0 351 undef $sth;
Chris@0 352 $dbh->disconnect();
Chris@0 353 undef $dbh;
Chris@0 354
Chris@0 355 if ($cfg->{RedmineCacheCredsMax} and $ret) {
Chris@0 356 if (defined $usrprojpass) {
Chris@0 357 $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
Chris@0 358 } else {
Chris@0 359 if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
Chris@0 360 $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
Chris@0 361 $cfg->{RedmineCacheCredsCount}++;
Chris@0 362 } else {
Chris@0 363 $cfg->{RedmineCacheCreds}->clear();
Chris@0 364 $cfg->{RedmineCacheCredsCount} = 0;
Chris@0 365 }
Chris@0 366 }
Chris@0 367 }
Chris@0 368
Chris@0 369 $ret;
Chris@0 370 }
Chris@0 371
Chris@0 372 sub get_project_identifier {
Chris@0 373 my $r = shift;
Chris@0 374
Chris@0 375 my $location = $r->location;
Chris@0 376 my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
Chris@0 377 $identifier;
Chris@0 378 }
Chris@0 379
Chris@0 380 sub connect_database {
Chris@0 381 my $r = shift;
Chris@0 382
Chris@0 383 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
Chris@0 384 return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
Chris@0 385 }
Chris@0 386
Chris@0 387 1;