Chris@0
|
1 package Apache::Authn::Redmine;
|
Chris@0
|
2
|
Chris@0
|
3 =head1 Apache::Authn::Redmine
|
Chris@0
|
4
|
Chris@0
|
5 Redmine - a mod_perl module to authenticate webdav subversion users
|
Chris@0
|
6 against redmine database
|
Chris@0
|
7
|
Chris@0
|
8 =head1 SYNOPSIS
|
Chris@0
|
9
|
Chris@0
|
10 This module allow anonymous users to browse public project and
|
Chris@0
|
11 registred users to browse and commit their project. Authentication is
|
Chris@0
|
12 done against the redmine database or the LDAP configured in redmine.
|
Chris@0
|
13
|
Chris@0
|
14 This method is far simpler than the one with pam_* and works with all
|
Chris@0
|
15 database without an hassle but you need to have apache/mod_perl on the
|
Chris@0
|
16 svn server.
|
Chris@0
|
17
|
Chris@0
|
18 =head1 INSTALLATION
|
Chris@0
|
19
|
Chris@0
|
20 For this to automagically work, you need to have a recent reposman.rb
|
Chris@0
|
21 (after r860) and if you already use reposman, read the last section to
|
Chris@0
|
22 migrate.
|
Chris@0
|
23
|
Chris@0
|
24 Sorry ruby users but you need some perl modules, at least mod_perl2,
|
Chris@0
|
25 DBI and DBD::mysql (or the DBD driver for you database as it should
|
Chris@0
|
26 work on allmost all databases).
|
Chris@0
|
27
|
Chris@0
|
28 On debian/ubuntu you must do :
|
Chris@0
|
29
|
Chris@0
|
30 aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
|
Chris@0
|
31
|
Chris@0
|
32 If your Redmine users use LDAP authentication, you will also need
|
Chris@0
|
33 Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
|
Chris@0
|
34
|
Chris@0
|
35 aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
|
Chris@0
|
36
|
Chris@0
|
37 =head1 CONFIGURATION
|
Chris@0
|
38
|
Chris@0
|
39 ## This module has to be in your perl path
|
Chris@0
|
40 ## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm
|
Chris@0
|
41 PerlLoadModule Apache::Authn::Redmine
|
Chris@0
|
42 <Location /svn>
|
Chris@0
|
43 DAV svn
|
Chris@0
|
44 SVNParentPath "/var/svn"
|
Chris@0
|
45
|
Chris@0
|
46 AuthType Basic
|
Chris@0
|
47 AuthName redmine
|
Chris@0
|
48 Require valid-user
|
Chris@0
|
49
|
Chris@0
|
50 PerlAccessHandler Apache::Authn::Redmine::access_handler
|
Chris@0
|
51 PerlAuthenHandler Apache::Authn::Redmine::authen_handler
|
Chris@0
|
52
|
Chris@0
|
53 ## for mysql
|
Chris@0
|
54 RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
|
Chris@0
|
55 ## for postgres
|
Chris@0
|
56 # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
|
Chris@0
|
57
|
Chris@0
|
58 RedmineDbUser "redmine"
|
Chris@0
|
59 RedmineDbPass "password"
|
Chris@0
|
60 ## Optional where clause (fulltext search would be slow and
|
Chris@0
|
61 ## database dependant).
|
Chris@0
|
62 # RedmineDbWhereClause "and members.role_id IN (1,2)"
|
Chris@0
|
63 ## Optional credentials cache size
|
Chris@0
|
64 # RedmineCacheCredsMax 50
|
Chris@0
|
65 </Location>
|
Chris@0
|
66
|
Chris@0
|
67 To be able to browse repository inside redmine, you must add something
|
Chris@0
|
68 like that :
|
Chris@0
|
69
|
Chris@0
|
70 <Location /svn-private>
|
Chris@0
|
71 DAV svn
|
Chris@0
|
72 SVNParentPath "/var/svn"
|
Chris@0
|
73 Order deny,allow
|
Chris@0
|
74 Deny from all
|
Chris@0
|
75 # only allow reading orders
|
Chris@0
|
76 <Limit GET PROPFIND OPTIONS REPORT>
|
Chris@0
|
77 Allow from redmine.server.ip
|
Chris@0
|
78 </Limit>
|
Chris@0
|
79 </Location>
|
Chris@0
|
80
|
Chris@0
|
81 and you will have to use this reposman.rb command line to create repository :
|
Chris@0
|
82
|
Chris@0
|
83 reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
|
Chris@0
|
84
|
Chris@0
|
85 =head1 MIGRATION FROM OLDER RELEASES
|
Chris@0
|
86
|
Chris@0
|
87 If you use an older reposman.rb (r860 or before), you need to change
|
Chris@0
|
88 rights on repositories to allow the apache user to read and write
|
Chris@0
|
89 S<them :>
|
Chris@0
|
90
|
Chris@0
|
91 sudo chown -R www-data /var/svn/*
|
Chris@0
|
92 sudo chmod -R u+w /var/svn/*
|
Chris@0
|
93
|
Chris@0
|
94 And you need to upgrade at least reposman.rb (after r860).
|
Chris@0
|
95
|
Chris@0
|
96 =cut
|
Chris@0
|
97
|
Chris@0
|
98 use strict;
|
Chris@0
|
99 use warnings FATAL => 'all', NONFATAL => 'redefine';
|
Chris@0
|
100
|
Chris@0
|
101 use DBI;
|
Chris@0
|
102 use Digest::SHA1;
|
Chris@0
|
103 # optional module for LDAP authentication
|
Chris@0
|
104 my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
|
Chris@0
|
105
|
Chris@0
|
106 use Apache2::Module;
|
Chris@0
|
107 use Apache2::Access;
|
Chris@0
|
108 use Apache2::ServerRec qw();
|
Chris@0
|
109 use Apache2::RequestRec qw();
|
Chris@0
|
110 use Apache2::RequestUtil qw();
|
Chris@0
|
111 use Apache2::Const qw(:common :override :cmd_how);
|
Chris@0
|
112 use APR::Pool ();
|
Chris@0
|
113 use APR::Table ();
|
Chris@0
|
114
|
Chris@0
|
115 # use Apache2::Directive qw();
|
Chris@0
|
116
|
Chris@0
|
117 my @directives = (
|
Chris@0
|
118 {
|
Chris@0
|
119 name => 'RedmineDSN',
|
Chris@0
|
120 req_override => OR_AUTHCFG,
|
Chris@0
|
121 args_how => TAKE1,
|
Chris@0
|
122 errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
|
Chris@0
|
123 },
|
Chris@0
|
124 {
|
Chris@0
|
125 name => 'RedmineDbUser',
|
Chris@0
|
126 req_override => OR_AUTHCFG,
|
Chris@0
|
127 args_how => TAKE1,
|
Chris@0
|
128 },
|
Chris@0
|
129 {
|
Chris@0
|
130 name => 'RedmineDbPass',
|
Chris@0
|
131 req_override => OR_AUTHCFG,
|
Chris@0
|
132 args_how => TAKE1,
|
Chris@0
|
133 },
|
Chris@0
|
134 {
|
Chris@0
|
135 name => 'RedmineDbWhereClause',
|
Chris@0
|
136 req_override => OR_AUTHCFG,
|
Chris@0
|
137 args_how => TAKE1,
|
Chris@0
|
138 },
|
Chris@0
|
139 {
|
Chris@0
|
140 name => 'RedmineCacheCredsMax',
|
Chris@0
|
141 req_override => OR_AUTHCFG,
|
Chris@0
|
142 args_how => TAKE1,
|
Chris@0
|
143 errmsg => 'RedmineCacheCredsMax must be decimal number',
|
Chris@0
|
144 },
|
Chris@0
|
145 );
|
Chris@0
|
146
|
Chris@0
|
147 sub RedmineDSN {
|
Chris@0
|
148 my ($self, $parms, $arg) = @_;
|
Chris@0
|
149 $self->{RedmineDSN} = $arg;
|
Chris@0
|
150 my $query = "SELECT
|
Chris@0
|
151 hashed_password, auth_source_id, permissions
|
Chris@0
|
152 FROM members, projects, users, roles, member_roles
|
Chris@0
|
153 WHERE
|
Chris@0
|
154 projects.id=members.project_id
|
Chris@0
|
155 AND member_roles.member_id=members.id
|
Chris@0
|
156 AND users.id=members.user_id
|
Chris@0
|
157 AND roles.id=member_roles.role_id
|
Chris@0
|
158 AND users.status=1
|
Chris@0
|
159 AND login=?
|
Chris@0
|
160 AND identifier=? ";
|
Chris@0
|
161 $self->{RedmineQuery} = trim($query);
|
Chris@0
|
162 }
|
Chris@0
|
163
|
Chris@0
|
164 sub RedmineDbUser { set_val('RedmineDbUser', @_); }
|
Chris@0
|
165 sub RedmineDbPass { set_val('RedmineDbPass', @_); }
|
Chris@0
|
166 sub RedmineDbWhereClause {
|
Chris@0
|
167 my ($self, $parms, $arg) = @_;
|
Chris@0
|
168 $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
|
Chris@0
|
169 }
|
Chris@0
|
170
|
Chris@0
|
171 sub RedmineCacheCredsMax {
|
Chris@0
|
172 my ($self, $parms, $arg) = @_;
|
Chris@0
|
173 if ($arg) {
|
Chris@0
|
174 $self->{RedmineCachePool} = APR::Pool->new;
|
Chris@0
|
175 $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
|
Chris@0
|
176 $self->{RedmineCacheCredsCount} = 0;
|
Chris@0
|
177 $self->{RedmineCacheCredsMax} = $arg;
|
Chris@0
|
178 }
|
Chris@0
|
179 }
|
Chris@0
|
180
|
Chris@0
|
181 sub trim {
|
Chris@0
|
182 my $string = shift;
|
Chris@0
|
183 $string =~ s/\s{2,}/ /g;
|
Chris@0
|
184 return $string;
|
Chris@0
|
185 }
|
Chris@0
|
186
|
Chris@0
|
187 sub set_val {
|
Chris@0
|
188 my ($key, $self, $parms, $arg) = @_;
|
Chris@0
|
189 $self->{$key} = $arg;
|
Chris@0
|
190 }
|
Chris@0
|
191
|
Chris@0
|
192 Apache2::Module::add(__PACKAGE__, \@directives);
|
Chris@0
|
193
|
Chris@0
|
194
|
Chris@0
|
195 my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
|
Chris@0
|
196
|
Chris@0
|
197 sub access_handler {
|
Chris@0
|
198 my $r = shift;
|
Chris@0
|
199
|
Chris@0
|
200 unless ($r->some_auth_required) {
|
Chris@0
|
201 $r->log_reason("No authentication has been configured");
|
Chris@0
|
202 return FORBIDDEN;
|
Chris@0
|
203 }
|
Chris@0
|
204
|
Chris@0
|
205 my $method = $r->method;
|
Chris@0
|
206 return OK unless defined $read_only_methods{$method};
|
Chris@0
|
207
|
Chris@0
|
208 my $project_id = get_project_identifier($r);
|
Chris@0
|
209
|
Chris@0
|
210 $r->set_handlers(PerlAuthenHandler => [\&OK])
|
Chris@0
|
211 if is_public_project($project_id, $r);
|
Chris@0
|
212
|
Chris@0
|
213 return OK
|
Chris@0
|
214 }
|
Chris@0
|
215
|
Chris@0
|
216 sub authen_handler {
|
Chris@0
|
217 my $r = shift;
|
Chris@0
|
218
|
Chris@0
|
219 my ($res, $redmine_pass) = $r->get_basic_auth_pw();
|
Chris@0
|
220 return $res unless $res == OK;
|
Chris@0
|
221
|
Chris@0
|
222 if (is_member($r->user, $redmine_pass, $r)) {
|
Chris@0
|
223 return OK;
|
Chris@0
|
224 } else {
|
Chris@0
|
225 $r->note_auth_failure();
|
Chris@0
|
226 return AUTH_REQUIRED;
|
Chris@0
|
227 }
|
Chris@0
|
228 }
|
Chris@0
|
229
|
Chris@0
|
230 # check if authentication is forced
|
Chris@0
|
231 sub is_authentication_forced {
|
Chris@0
|
232 my $r = shift;
|
Chris@0
|
233
|
Chris@0
|
234 my $dbh = connect_database($r);
|
Chris@0
|
235 my $sth = $dbh->prepare(
|
Chris@0
|
236 "SELECT value FROM settings where settings.name = 'login_required';"
|
Chris@0
|
237 );
|
Chris@0
|
238
|
Chris@0
|
239 $sth->execute();
|
Chris@0
|
240 my $ret = 0;
|
Chris@0
|
241 if (my @row = $sth->fetchrow_array) {
|
Chris@0
|
242 if ($row[0] eq "1" || $row[0] eq "t") {
|
Chris@0
|
243 $ret = 1;
|
Chris@0
|
244 }
|
Chris@0
|
245 }
|
Chris@0
|
246 $sth->finish();
|
Chris@0
|
247 undef $sth;
|
Chris@0
|
248
|
Chris@0
|
249 $dbh->disconnect();
|
Chris@0
|
250 undef $dbh;
|
Chris@0
|
251
|
Chris@0
|
252 $ret;
|
Chris@0
|
253 }
|
Chris@0
|
254
|
Chris@0
|
255 sub is_public_project {
|
Chris@0
|
256 my $project_id = shift;
|
Chris@0
|
257 my $r = shift;
|
Chris@0
|
258
|
Chris@0
|
259 if (is_authentication_forced($r)) {
|
Chris@0
|
260 return 0;
|
Chris@0
|
261 }
|
Chris@0
|
262
|
Chris@0
|
263 my $dbh = connect_database($r);
|
Chris@0
|
264 my $sth = $dbh->prepare(
|
Chris@0
|
265 "SELECT is_public FROM projects WHERE projects.identifier = ?;"
|
Chris@0
|
266 );
|
Chris@0
|
267
|
Chris@0
|
268 $sth->execute($project_id);
|
Chris@0
|
269 my $ret = 0;
|
Chris@0
|
270 if (my @row = $sth->fetchrow_array) {
|
Chris@0
|
271 if ($row[0] eq "1" || $row[0] eq "t") {
|
Chris@0
|
272 $ret = 1;
|
Chris@0
|
273 }
|
Chris@0
|
274 }
|
Chris@0
|
275 $sth->finish();
|
Chris@0
|
276 undef $sth;
|
Chris@0
|
277 $dbh->disconnect();
|
Chris@0
|
278 undef $dbh;
|
Chris@0
|
279
|
Chris@0
|
280 $ret;
|
Chris@0
|
281 }
|
Chris@0
|
282
|
Chris@0
|
283 # perhaps we should use repository right (other read right) to check public access.
|
Chris@0
|
284 # it could be faster BUT it doesn't work for the moment.
|
Chris@0
|
285 # sub is_public_project_by_file {
|
Chris@0
|
286 # my $project_id = shift;
|
Chris@0
|
287 # my $r = shift;
|
Chris@0
|
288
|
Chris@0
|
289 # my $tree = Apache2::Directive::conftree();
|
Chris@0
|
290 # my $node = $tree->lookup('Location', $r->location);
|
Chris@0
|
291 # my $hash = $node->as_hash;
|
Chris@0
|
292
|
Chris@0
|
293 # my $svnparentpath = $hash->{SVNParentPath};
|
Chris@0
|
294 # my $repos_path = $svnparentpath . "/" . $project_id;
|
Chris@0
|
295 # return 1 if (stat($repos_path))[2] & 00007;
|
Chris@0
|
296 # }
|
Chris@0
|
297
|
Chris@0
|
298 sub is_member {
|
Chris@0
|
299 my $redmine_user = shift;
|
Chris@0
|
300 my $redmine_pass = shift;
|
Chris@0
|
301 my $r = shift;
|
Chris@0
|
302
|
Chris@0
|
303 my $dbh = connect_database($r);
|
Chris@0
|
304 my $project_id = get_project_identifier($r);
|
Chris@0
|
305
|
Chris@0
|
306 my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
|
Chris@0
|
307
|
Chris@0
|
308 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
|
Chris@0
|
309 my $usrprojpass;
|
Chris@0
|
310 if ($cfg->{RedmineCacheCredsMax}) {
|
Chris@0
|
311 $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);
|
Chris@0
|
312 return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
|
Chris@0
|
313 }
|
Chris@0
|
314 my $query = $cfg->{RedmineQuery};
|
Chris@0
|
315 my $sth = $dbh->prepare($query);
|
Chris@0
|
316 $sth->execute($redmine_user, $project_id);
|
Chris@0
|
317
|
Chris@0
|
318 my $ret;
|
Chris@0
|
319 while (my ($hashed_password, $auth_source_id, $permissions) = $sth->fetchrow_array) {
|
Chris@0
|
320
|
Chris@0
|
321 unless ($auth_source_id) {
|
Chris@0
|
322 my $method = $r->method;
|
Chris@0
|
323 if ($hashed_password eq $pass_digest && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
|
Chris@0
|
324 $ret = 1;
|
Chris@0
|
325 last;
|
Chris@0
|
326 }
|
Chris@0
|
327 } elsif ($CanUseLDAPAuth) {
|
Chris@0
|
328 my $sthldap = $dbh->prepare(
|
Chris@0
|
329 "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
|
Chris@0
|
330 );
|
Chris@0
|
331 $sthldap->execute($auth_source_id);
|
Chris@0
|
332 while (my @rowldap = $sthldap->fetchrow_array) {
|
Chris@0
|
333 my $ldap = Authen::Simple::LDAP->new(
|
Chris@0
|
334 host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]" : $rowldap[0],
|
Chris@0
|
335 port => $rowldap[1],
|
Chris@0
|
336 basedn => $rowldap[5],
|
Chris@0
|
337 binddn => $rowldap[3] ? $rowldap[3] : "",
|
Chris@0
|
338 bindpw => $rowldap[4] ? $rowldap[4] : "",
|
Chris@0
|
339 filter => "(".$rowldap[6]."=%s)"
|
Chris@0
|
340 );
|
Chris@0
|
341 my $method = $r->method;
|
Chris@0
|
342 $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
|
Chris@0
|
343
|
Chris@0
|
344 }
|
Chris@0
|
345 $sthldap->finish();
|
Chris@0
|
346 undef $sthldap;
|
Chris@0
|
347 }
|
Chris@0
|
348 }
|
Chris@0
|
349 $sth->finish();
|
Chris@0
|
350 undef $sth;
|
Chris@0
|
351 $dbh->disconnect();
|
Chris@0
|
352 undef $dbh;
|
Chris@0
|
353
|
Chris@0
|
354 if ($cfg->{RedmineCacheCredsMax} and $ret) {
|
Chris@0
|
355 if (defined $usrprojpass) {
|
Chris@0
|
356 $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
|
Chris@0
|
357 } else {
|
Chris@0
|
358 if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
|
Chris@0
|
359 $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
|
Chris@0
|
360 $cfg->{RedmineCacheCredsCount}++;
|
Chris@0
|
361 } else {
|
Chris@0
|
362 $cfg->{RedmineCacheCreds}->clear();
|
Chris@0
|
363 $cfg->{RedmineCacheCredsCount} = 0;
|
Chris@0
|
364 }
|
Chris@0
|
365 }
|
Chris@0
|
366 }
|
Chris@0
|
367
|
Chris@0
|
368 $ret;
|
Chris@0
|
369 }
|
Chris@0
|
370
|
Chris@0
|
371 sub get_project_identifier {
|
Chris@0
|
372 my $r = shift;
|
Chris@0
|
373
|
Chris@0
|
374 my $location = $r->location;
|
Chris@0
|
375 my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
|
Chris@0
|
376 $identifier;
|
Chris@0
|
377 }
|
Chris@0
|
378
|
Chris@0
|
379 sub connect_database {
|
Chris@0
|
380 my $r = shift;
|
Chris@0
|
381
|
Chris@0
|
382 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
|
Chris@0
|
383 return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
|
Chris@0
|
384 }
|
Chris@0
|
385
|
Chris@0
|
386 1;
|