annotate .svn/pristine/7f/7f2b03891b8623abed7eda3f27f2af99b02de39f.svn-base @ 929:5f33065ddc4b redmine-1.3

Update to Redmine SVN rev 9414 on 1.3-stable branch
author Chris Cannam
date Wed, 27 Jun 2012 14:54:18 +0100
parents cbb26bc654de
children
rev   line source
Chris@909 1 package Apache::Authn::Redmine;
Chris@909 2
Chris@909 3 =head1 Apache::Authn::Redmine
Chris@909 4
Chris@909 5 Redmine - a mod_perl module to authenticate webdav subversion users
Chris@909 6 against redmine database
Chris@909 7
Chris@909 8 =head1 SYNOPSIS
Chris@909 9
Chris@909 10 This module allow anonymous users to browse public project and
Chris@909 11 registred users to browse and commit their project. Authentication is
Chris@909 12 done against the redmine database or the LDAP configured in redmine.
Chris@909 13
Chris@909 14 This method is far simpler than the one with pam_* and works with all
Chris@909 15 database without an hassle but you need to have apache/mod_perl on the
Chris@909 16 svn server.
Chris@909 17
Chris@909 18 =head1 INSTALLATION
Chris@909 19
Chris@909 20 For this to automagically work, you need to have a recent reposman.rb
Chris@909 21 (after r860) and if you already use reposman, read the last section to
Chris@909 22 migrate.
Chris@909 23
Chris@909 24 Sorry ruby users but you need some perl modules, at least mod_perl2,
Chris@909 25 DBI and DBD::mysql (or the DBD driver for you database as it should
Chris@909 26 work on allmost all databases).
Chris@909 27
Chris@909 28 On debian/ubuntu you must do :
Chris@909 29
Chris@909 30 aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
Chris@909 31
Chris@909 32 If your Redmine users use LDAP authentication, you will also need
Chris@909 33 Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
Chris@909 34
Chris@909 35 aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
Chris@909 36
Chris@909 37 =head1 CONFIGURATION
Chris@909 38
Chris@909 39 ## This module has to be in your perl path
Chris@909 40 ## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm
Chris@909 41 PerlLoadModule Apache::Authn::Redmine
Chris@909 42 <Location /svn>
Chris@909 43 DAV svn
Chris@909 44 SVNParentPath "/var/svn"
Chris@909 45
Chris@909 46 AuthType Basic
Chris@909 47 AuthName redmine
Chris@909 48 Require valid-user
Chris@909 49
Chris@909 50 PerlAccessHandler Apache::Authn::Redmine::access_handler
Chris@909 51 PerlAuthenHandler Apache::Authn::Redmine::authen_handler
Chris@909 52
Chris@909 53 ## for mysql
Chris@909 54 RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
Chris@909 55 ## for postgres
Chris@909 56 # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
Chris@909 57
Chris@909 58 RedmineDbUser "redmine"
Chris@909 59 RedmineDbPass "password"
Chris@909 60 ## Optional where clause (fulltext search would be slow and
Chris@909 61 ## database dependant).
Chris@909 62 # RedmineDbWhereClause "and members.role_id IN (1,2)"
Chris@909 63 ## Optional credentials cache size
Chris@909 64 # RedmineCacheCredsMax 50
Chris@909 65 </Location>
Chris@909 66
Chris@909 67 To be able to browse repository inside redmine, you must add something
Chris@909 68 like that :
Chris@909 69
Chris@909 70 <Location /svn-private>
Chris@909 71 DAV svn
Chris@909 72 SVNParentPath "/var/svn"
Chris@909 73 Order deny,allow
Chris@909 74 Deny from all
Chris@909 75 # only allow reading orders
Chris@909 76 <Limit GET PROPFIND OPTIONS REPORT>
Chris@909 77 Allow from redmine.server.ip
Chris@909 78 </Limit>
Chris@909 79 </Location>
Chris@909 80
Chris@909 81 and you will have to use this reposman.rb command line to create repository :
Chris@909 82
Chris@909 83 reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
Chris@909 84
Chris@909 85 =head1 MIGRATION FROM OLDER RELEASES
Chris@909 86
Chris@909 87 If you use an older reposman.rb (r860 or before), you need to change
Chris@909 88 rights on repositories to allow the apache user to read and write
Chris@909 89 S<them :>
Chris@909 90
Chris@909 91 sudo chown -R www-data /var/svn/*
Chris@909 92 sudo chmod -R u+w /var/svn/*
Chris@909 93
Chris@909 94 And you need to upgrade at least reposman.rb (after r860).
Chris@909 95
Chris@909 96 =cut
Chris@909 97
Chris@909 98 use strict;
Chris@909 99 use warnings FATAL => 'all', NONFATAL => 'redefine';
Chris@909 100
Chris@909 101 use DBI;
Chris@909 102 use Digest::SHA1;
Chris@909 103 # optional module for LDAP authentication
Chris@909 104 my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
Chris@909 105
Chris@909 106 use Apache2::Module;
Chris@909 107 use Apache2::Access;
Chris@909 108 use Apache2::ServerRec qw();
Chris@909 109 use Apache2::RequestRec qw();
Chris@909 110 use Apache2::RequestUtil qw();
Chris@909 111 use Apache2::Const qw(:common :override :cmd_how);
Chris@909 112 use APR::Pool ();
Chris@909 113 use APR::Table ();
Chris@909 114
Chris@909 115 # use Apache2::Directive qw();
Chris@909 116
Chris@909 117 my @directives = (
Chris@909 118 {
Chris@909 119 name => 'RedmineDSN',
Chris@909 120 req_override => OR_AUTHCFG,
Chris@909 121 args_how => TAKE1,
Chris@909 122 errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
Chris@909 123 },
Chris@909 124 {
Chris@909 125 name => 'RedmineDbUser',
Chris@909 126 req_override => OR_AUTHCFG,
Chris@909 127 args_how => TAKE1,
Chris@909 128 },
Chris@909 129 {
Chris@909 130 name => 'RedmineDbPass',
Chris@909 131 req_override => OR_AUTHCFG,
Chris@909 132 args_how => TAKE1,
Chris@909 133 },
Chris@909 134 {
Chris@909 135 name => 'RedmineDbWhereClause',
Chris@909 136 req_override => OR_AUTHCFG,
Chris@909 137 args_how => TAKE1,
Chris@909 138 },
Chris@909 139 {
Chris@909 140 name => 'RedmineCacheCredsMax',
Chris@909 141 req_override => OR_AUTHCFG,
Chris@909 142 args_how => TAKE1,
Chris@909 143 errmsg => 'RedmineCacheCredsMax must be decimal number',
Chris@909 144 },
Chris@909 145 );
Chris@909 146
Chris@909 147 sub RedmineDSN {
Chris@909 148 my ($self, $parms, $arg) = @_;
Chris@909 149 $self->{RedmineDSN} = $arg;
Chris@909 150 my $query = "SELECT
Chris@909 151 hashed_password, salt, auth_source_id, permissions
Chris@909 152 FROM projects, users, roles
Chris@909 153 WHERE
Chris@909 154 users.login=?
Chris@909 155 AND projects.identifier=?
Chris@909 156 AND users.status=1
Chris@909 157 AND (
Chris@909 158 roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id)
Chris@909 159 OR
Chris@909 160 (roles.builtin=1 AND cast(projects.is_public as CHAR) IN ('t', '1'))
Chris@909 161 ) ";
Chris@909 162 $self->{RedmineQuery} = trim($query);
Chris@909 163 }
Chris@909 164
Chris@909 165 sub RedmineDbUser { set_val('RedmineDbUser', @_); }
Chris@909 166 sub RedmineDbPass { set_val('RedmineDbPass', @_); }
Chris@909 167 sub RedmineDbWhereClause {
Chris@909 168 my ($self, $parms, $arg) = @_;
Chris@909 169 $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
Chris@909 170 }
Chris@909 171
Chris@909 172 sub RedmineCacheCredsMax {
Chris@909 173 my ($self, $parms, $arg) = @_;
Chris@909 174 if ($arg) {
Chris@909 175 $self->{RedmineCachePool} = APR::Pool->new;
Chris@909 176 $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
Chris@909 177 $self->{RedmineCacheCredsCount} = 0;
Chris@909 178 $self->{RedmineCacheCredsMax} = $arg;
Chris@909 179 }
Chris@909 180 }
Chris@909 181
Chris@909 182 sub trim {
Chris@909 183 my $string = shift;
Chris@909 184 $string =~ s/\s{2,}/ /g;
Chris@909 185 return $string;
Chris@909 186 }
Chris@909 187
Chris@909 188 sub set_val {
Chris@909 189 my ($key, $self, $parms, $arg) = @_;
Chris@909 190 $self->{$key} = $arg;
Chris@909 191 }
Chris@909 192
Chris@909 193 Apache2::Module::add(__PACKAGE__, \@directives);
Chris@909 194
Chris@909 195
Chris@909 196 my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
Chris@909 197
Chris@909 198 sub access_handler {
Chris@909 199 my $r = shift;
Chris@909 200
Chris@909 201 unless ($r->some_auth_required) {
Chris@909 202 $r->log_reason("No authentication has been configured");
Chris@909 203 return FORBIDDEN;
Chris@909 204 }
Chris@909 205
Chris@909 206 my $method = $r->method;
Chris@909 207 return OK unless defined $read_only_methods{$method};
Chris@909 208
Chris@909 209 my $project_id = get_project_identifier($r);
Chris@909 210
Chris@909 211 $r->set_handlers(PerlAuthenHandler => [\&OK])
Chris@909 212 if is_public_project($project_id, $r) && anonymous_role_allows_browse_repository($r);
Chris@909 213
Chris@909 214 return OK
Chris@909 215 }
Chris@909 216
Chris@909 217 sub authen_handler {
Chris@909 218 my $r = shift;
Chris@909 219
Chris@909 220 my ($res, $redmine_pass) = $r->get_basic_auth_pw();
Chris@909 221 return $res unless $res == OK;
Chris@909 222
Chris@909 223 if (is_member($r->user, $redmine_pass, $r)) {
Chris@909 224 return OK;
Chris@909 225 } else {
Chris@909 226 $r->note_auth_failure();
Chris@909 227 return AUTH_REQUIRED;
Chris@909 228 }
Chris@909 229 }
Chris@909 230
Chris@909 231 # check if authentication is forced
Chris@909 232 sub is_authentication_forced {
Chris@909 233 my $r = shift;
Chris@909 234
Chris@909 235 my $dbh = connect_database($r);
Chris@909 236 my $sth = $dbh->prepare(
Chris@909 237 "SELECT value FROM settings where settings.name = 'login_required';"
Chris@909 238 );
Chris@909 239
Chris@909 240 $sth->execute();
Chris@909 241 my $ret = 0;
Chris@909 242 if (my @row = $sth->fetchrow_array) {
Chris@909 243 if ($row[0] eq "1" || $row[0] eq "t") {
Chris@909 244 $ret = 1;
Chris@909 245 }
Chris@909 246 }
Chris@909 247 $sth->finish();
Chris@909 248 undef $sth;
Chris@909 249
Chris@909 250 $dbh->disconnect();
Chris@909 251 undef $dbh;
Chris@909 252
Chris@909 253 $ret;
Chris@909 254 }
Chris@909 255
Chris@909 256 sub is_public_project {
Chris@909 257 my $project_id = shift;
Chris@909 258 my $r = shift;
Chris@909 259
Chris@909 260 if (is_authentication_forced($r)) {
Chris@909 261 return 0;
Chris@909 262 }
Chris@909 263
Chris@909 264 my $dbh = connect_database($r);
Chris@909 265 my $sth = $dbh->prepare(
Chris@909 266 "SELECT is_public FROM projects WHERE projects.identifier = ?;"
Chris@909 267 );
Chris@909 268
Chris@909 269 $sth->execute($project_id);
Chris@909 270 my $ret = 0;
Chris@909 271 if (my @row = $sth->fetchrow_array) {
Chris@909 272 if ($row[0] eq "1" || $row[0] eq "t") {
Chris@909 273 $ret = 1;
Chris@909 274 }
Chris@909 275 }
Chris@909 276 $sth->finish();
Chris@909 277 undef $sth;
Chris@909 278 $dbh->disconnect();
Chris@909 279 undef $dbh;
Chris@909 280
Chris@909 281 $ret;
Chris@909 282 }
Chris@909 283
Chris@909 284 sub anonymous_role_allows_browse_repository {
Chris@909 285 my $r = shift;
Chris@909 286
Chris@909 287 my $dbh = connect_database($r);
Chris@909 288 my $sth = $dbh->prepare(
Chris@909 289 "SELECT permissions FROM roles WHERE builtin = 2;"
Chris@909 290 );
Chris@909 291
Chris@909 292 $sth->execute();
Chris@909 293 my $ret = 0;
Chris@909 294 if (my @row = $sth->fetchrow_array) {
Chris@909 295 if ($row[0] =~ /:browse_repository/) {
Chris@909 296 $ret = 1;
Chris@909 297 }
Chris@909 298 }
Chris@909 299 $sth->finish();
Chris@909 300 undef $sth;
Chris@909 301 $dbh->disconnect();
Chris@909 302 undef $dbh;
Chris@909 303
Chris@909 304 $ret;
Chris@909 305 }
Chris@909 306
Chris@909 307 # perhaps we should use repository right (other read right) to check public access.
Chris@909 308 # it could be faster BUT it doesn't work for the moment.
Chris@909 309 # sub is_public_project_by_file {
Chris@909 310 # my $project_id = shift;
Chris@909 311 # my $r = shift;
Chris@909 312
Chris@909 313 # my $tree = Apache2::Directive::conftree();
Chris@909 314 # my $node = $tree->lookup('Location', $r->location);
Chris@909 315 # my $hash = $node->as_hash;
Chris@909 316
Chris@909 317 # my $svnparentpath = $hash->{SVNParentPath};
Chris@909 318 # my $repos_path = $svnparentpath . "/" . $project_id;
Chris@909 319 # return 1 if (stat($repos_path))[2] & 00007;
Chris@909 320 # }
Chris@909 321
Chris@909 322 sub is_member {
Chris@909 323 my $redmine_user = shift;
Chris@909 324 my $redmine_pass = shift;
Chris@909 325 my $r = shift;
Chris@909 326
Chris@909 327 my $dbh = connect_database($r);
Chris@909 328 my $project_id = get_project_identifier($r);
Chris@909 329
Chris@909 330 my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
Chris@909 331
Chris@909 332 my $access_mode = defined $read_only_methods{$r->method} ? "R" : "W";
Chris@909 333
Chris@909 334 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
Chris@909 335 my $usrprojpass;
Chris@909 336 if ($cfg->{RedmineCacheCredsMax}) {
Chris@909 337 $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id.":".$access_mode);
Chris@909 338 return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
Chris@909 339 }
Chris@909 340 my $query = $cfg->{RedmineQuery};
Chris@909 341 my $sth = $dbh->prepare($query);
Chris@909 342 $sth->execute($redmine_user, $project_id);
Chris@909 343
Chris@909 344 my $ret;
Chris@909 345 while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) {
Chris@909 346
Chris@909 347 unless ($auth_source_id) {
Chris@909 348 my $method = $r->method;
Chris@909 349 my $salted_password = Digest::SHA1::sha1_hex($salt.$pass_digest);
Chris@909 350 if ($hashed_password eq $salted_password && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
Chris@909 351 $ret = 1;
Chris@909 352 last;
Chris@909 353 }
Chris@909 354 } elsif ($CanUseLDAPAuth) {
Chris@909 355 my $sthldap = $dbh->prepare(
Chris@909 356 "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
Chris@909 357 );
Chris@909 358 $sthldap->execute($auth_source_id);
Chris@909 359 while (my @rowldap = $sthldap->fetchrow_array) {
Chris@909 360 my $ldap = Authen::Simple::LDAP->new(
Chris@909 361 host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],
Chris@909 362 port => $rowldap[1],
Chris@909 363 basedn => $rowldap[5],
Chris@909 364 binddn => $rowldap[3] ? $rowldap[3] : "",
Chris@909 365 bindpw => $rowldap[4] ? $rowldap[4] : "",
Chris@909 366 filter => "(".$rowldap[6]."=%s)"
Chris@909 367 );
Chris@909 368 my $method = $r->method;
Chris@909 369 $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
Chris@909 370
Chris@909 371 }
Chris@909 372 $sthldap->finish();
Chris@909 373 undef $sthldap;
Chris@909 374 }
Chris@909 375 }
Chris@909 376 $sth->finish();
Chris@909 377 undef $sth;
Chris@909 378 $dbh->disconnect();
Chris@909 379 undef $dbh;
Chris@909 380
Chris@909 381 if ($cfg->{RedmineCacheCredsMax} and $ret) {
Chris@909 382 if (defined $usrprojpass) {
Chris@909 383 $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest);
Chris@909 384 } else {
Chris@909 385 if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
Chris@909 386 $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest);
Chris@909 387 $cfg->{RedmineCacheCredsCount}++;
Chris@909 388 } else {
Chris@909 389 $cfg->{RedmineCacheCreds}->clear();
Chris@909 390 $cfg->{RedmineCacheCredsCount} = 0;
Chris@909 391 }
Chris@909 392 }
Chris@909 393 }
Chris@909 394
Chris@909 395 $ret;
Chris@909 396 }
Chris@909 397
Chris@909 398 sub get_project_identifier {
Chris@909 399 my $r = shift;
Chris@909 400
Chris@909 401 my $location = $r->location;
Chris@909 402 my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
Chris@909 403 $identifier;
Chris@909 404 }
Chris@909 405
Chris@909 406 sub connect_database {
Chris@909 407 my $r = shift;
Chris@909 408
Chris@909 409 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
Chris@909 410 return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
Chris@909 411 }
Chris@909 412
Chris@909 413 1;