summaryrefslogtreecommitdiff
path: root/module/mod_auth_singleid.c
diff options
context:
space:
mode:
authorStef Walter <stef@memberwebs.com>2009-07-07 20:05:34 +0000
committerStef Walter <stef@memberwebs.com>2009-07-07 20:05:34 +0000
commit30c217c0dca4c7a72ff4248fc4d4504fc1d85fc0 (patch)
treef7ed2d118fe99b815f493f22cd829101583e91c5 /module/mod_auth_singleid.c
parentcb6b40d3f4b09b48beeec979afe3d3270eb82755 (diff)
Store exchanged attributes in the cookie.
Diffstat (limited to 'module/mod_auth_singleid.c')
-rw-r--r--module/mod_auth_singleid.c273
1 files changed, 191 insertions, 82 deletions
diff --git a/module/mod_auth_singleid.c b/module/mod_auth_singleid.c
index e9d195a..41402ed 100644
--- a/module/mod_auth_singleid.c
+++ b/module/mod_auth_singleid.c
@@ -82,6 +82,16 @@ enum {
};
/*
+ * Per request information.
+ */
+
+typedef struct sid_session {
+ char *identifier;
+ apr_array_header_t *values;
+ time_t expiry;
+} sid_session_t;
+
+/*
* Per directory configuration.
*/
typedef struct sid_context {
@@ -114,6 +124,8 @@ get_token (apr_pool_t *pool, const char **line, const char *delims)
{
const char *beg, *end;
const char *str = *line;
+ char *result, *from, *at;
+ int quoted = 0;
/* Find first non-white byte */
while (*str && apr_isspace(*str))
@@ -136,6 +148,7 @@ get_token (apr_pool_t *pool, const char **line, const char *delims)
/* Trim the quotes if present */
if (beg + 1 < end && *beg == '"' && *(end - 1) == '"') {
+ quoted = 1;
++beg;
--end;
}
@@ -149,7 +162,23 @@ get_token (apr_pool_t *pool, const char **line, const char *delims)
++str;
*line = str;
- return apr_pstrndup (pool, beg, end - beg);
+ result = apr_pstrndup (pool, beg, end - beg);
+
+ /* Unquote vigorously */
+ if (quoted) {
+ at = from = result;
+ for (;;) {
+ if (from[0] == '\\' && from[1] != '\0')
+ *(at++) = *(++from);
+ else
+ *(at++) = *from;
+ if (*from == '\0')
+ break;
+ ++from;
+ }
+ }
+
+ return result;
}
/* -------------------------------------------------------------------------------
@@ -483,11 +512,6 @@ static const command_rec command_table[] = {
* COOKIE SESSIONS
*/
-typedef struct sid_session {
- char *identifier;
- time_t expiry;
-} sid_session_t;
-
/* Secret used to sign session cookies */
static unsigned char session_secret[40];
@@ -577,6 +601,7 @@ session_load_info (sid_context_t *ctx, request_rec *r)
const char *value;
char *token, *sig, *end;
char *identifier;
+ char **here;
long expiry;
value = session_cookie_value (r, ctx->cookie_name);
@@ -589,7 +614,7 @@ session_load_info (sid_context_t *ctx, request_rec *r)
/* The version of the session info, only 1 supported for now */
token = get_token (r->pool, &value, " ");
- if (!token || strcmp (token, "1") != 0)
+ if (!token || strcmp (token, "2") != 0)
return NULL;
token = get_token (r->pool, &value, " ");
@@ -610,20 +635,38 @@ session_load_info (sid_context_t *ctx, request_rec *r)
sess->expiry = expiry;
sess->identifier = identifier;
+ /* The remainder are values */
+ for (;;) {
+ token = get_token (r->pool, &value, " ");
+ if (!token)
+ break;
+ if (!sess->values)
+ sess->values = apr_array_make (r->pool, 8, sizeof (char*));
+ here = (char**)apr_array_push (sess->values);
+ *here = token;
+ }
+
return sess;
}
static void
session_send_info (sid_context_t *ctx, request_rec *r, sid_session_t *sess)
{
- char *cookie, *sig, *value;
+ char *cookie, *sig, *payload, *values;
+
+ /* All the values */
+ if (sess->values)
+ values = apr_array_pstrcat (r->pool, sess->values, ' ');
+ else
+ values = "";
/* Create the cookie value and sign it */
- value = apr_psprintf (r->pool, "1 %ld \"%s\"", (long)sess->expiry, ap_escape_quotes (r->pool, sess->identifier));
- sig = session_create_sig (r->pool, value);
+ payload = apr_psprintf (r->pool, "2 %ld \"%s\" %s", (long)sess->expiry,
+ ap_escape_quotes (r->pool, sess->identifier), values);
+ sig = session_create_sig (r->pool, payload);
/* Build up the full cookie spec */
- cookie = apr_psprintf (r->pool, "%s=%s %s; httponly; max-age=86400", ctx->cookie_name, sig, value);
+ cookie = apr_psprintf (r->pool, "%s=%s %s; httponly", ctx->cookie_name, sig, payload);
apr_table_addn (r->err_headers_out, "Set-Cookie", cookie);
}
@@ -631,8 +674,20 @@ static sid_session_t*
session_copy_info (apr_pool_t *p, sid_session_t *sess)
{
sid_session_t *copy = apr_pcalloc (p, sizeof (*sess));
+ char **data;
+ int i;
+
copy->expiry = sess->expiry;
copy->identifier = apr_pstrdup (p, sess->identifier);
+
+ /* Copy the values if necessary */
+ if (sess->values) {
+ copy->values = apr_array_copy (p, sess->values);
+ data = (char**)copy->values->elts;
+ for (i = 0; i < copy->values->nelts; ++i)
+ data[i] = apr_pstrdup (p, data[i]);
+ }
+
return copy;
}
@@ -643,9 +698,9 @@ session_copy_info (apr_pool_t *p, sid_session_t *sess)
struct sid_request {
int result;
request_rec *rec;
+ sid_session_t *sess;
};
-
void
sid_request_log_error (sid_request_t *req, const char *message, const char *detail)
{
@@ -714,81 +769,39 @@ sid_request_respond (sid_request_t *req, int code, const char *reason,
req->result = code;
}
-static void
-set_request_authenticated (sid_context_t *ctx, request_rec *r, sid_session_t *sess)
-{
- ap_regmatch_t matches[AP_MAX_REG_MATCH];
- char *user = NULL;
-
- /* Try and calculate a user name */
- switch (ctx->user_match) {
- case SUFFIX:
- if (ctx->identifier) {
- user = (char*)ap_stripprefix (sess->identifier, ctx->identifier);
- if (user != sess->identifier) {
- /* Some delimiters that we strip from between value and identifier */
- while (strchr ("?/#", *user))
- ++user;
- }
- }
- break;
-
- case REGEX:
- assert (ctx->converter);
- if (ap_regexec (ctx->converter, sess->identifier, AP_MAX_REG_MATCH, matches, 0) == 0)
- user = ap_pregsub (r->pool, "$1", sess->identifier, AP_MAX_REG_MATCH, matches);
- break;
- }
-
- if (!user)
- user = sess->identifier;
-
- r->user = user;
- r->ap_auth_type = SID_AUTHTYPE;
- apr_table_set (r->subprocess_env, "OPENID_IDENTIFIER", sess->identifier);
- ap_set_module_config (r->request_config, &auth_singleid_module, sess);
-}
-
void
sid_request_authenticated (sid_request_t *req, const char *identifier)
{
- sid_context_t *ctx;
sid_session_t *sess;
sess = apr_pcalloc (req->rec->pool, sizeof (sid_session_t));
sess->identifier = apr_pstrdup (req->rec->pool, identifier);
sess->expiry = time (NULL) + 86400;
-
- ctx = ap_get_module_config (req->rec->per_dir_config, &auth_singleid_module);
- assert (ctx);
-
- set_request_authenticated (ctx, req->rec, sess);
- session_send_info (ctx, req->rec, sess);
+ req->sess = sess;
}
void
-sid_request_attribute_values (sid_request_t *req, sid_attribute_t *attr, const char **values)
+sid_request_attribute_values (sid_request_t *req, sid_attribute_t *attr,
+ const char **values, size_t n_values)
{
+ sid_session_t *sess;
const char **val;
- char buf[64];
- char *name;
+ char **here;
int i = 0;
+ assert (req->sess);
+
+ /* Put all the values into the session array */
+ sess = req->sess;
+ if (!sess->values)
+ sess->values = apr_array_make (req->rec->pool, 8, sizeof (char*));
+
/* Setup all the values */
for (i = 0, val = values; *val; ++val, ++i) {
- snprintf (buf, sizeof (buf), "AX_VALUE_%s_%d", attr->alias, i);
- name = apr_pstrdup (req->rec->pool, buf);
- strupcase (name);
- apr_table_setn (req->rec->subprocess_env, name,
- apr_pstrdup (req->rec->pool, *val));
+ here = apr_array_push (sess->values);
+ *here = apr_psprintf (req->rec->pool, "%s:\"%s\"", attr->alias,
+ ap_escape_quotes (req->rec->pool, *val));
}
-
- /* Put in the count */
- snprintf (buf, sizeof (buf), "AX_COUNT_%s", attr->alias);
- name = apr_pstrdup (req->rec->pool, buf);
- strupcase (name);
- snprintf (buf, sizeof (buf), "%d", i);
- apr_table_set (req->rec->subprocess_env, name, apr_pstrdup (req->rec->pool, buf));
}
/* ---------------------------------------------------------------------------------------
@@ -813,6 +826,90 @@ hook_child (apr_pool_t *p, server_rec *s)
shared_child (p, s);
}
+static void
+set_authenticated (sid_context_t *ctx, request_rec *r, sid_session_t *sess)
+{
+ ap_regmatch_t matches[AP_MAX_REG_MATCH];
+ char *user = NULL;
+
+ /* Try and calculate a user name */
+ switch (ctx->user_match) {
+ case SUFFIX:
+ if (ctx->identifier) {
+ user = (char*)ap_stripprefix (sess->identifier, ctx->identifier);
+ if (user != sess->identifier) {
+ /* Some delimiters that we strip from between value and identifier */
+ while (strchr ("?/#", *user))
+ ++user;
+ }
+ }
+ break;
+
+ case REGEX:
+ assert (ctx->converter);
+ if (ap_regexec (ctx->converter, sess->identifier, AP_MAX_REG_MATCH, matches, 0) == 0)
+ user = ap_pregsub (r->pool, "$1", sess->identifier, AP_MAX_REG_MATCH, matches);
+ break;
+ }
+
+ if (!user)
+ user = apr_pstrdup (r->pool, sess->identifier);
+
+ r->user = user;
+ r->ap_auth_type = SID_AUTHTYPE;
+}
+
+static void
+set_env_variables (sid_context_t *ctx, request_rec *r, sid_session_t *sess)
+{
+ char *name, *value, *prev;
+ const char *line;
+ char **data;
+ int i, count;
+
+ apr_table_setn (r->subprocess_env, "OPENID_IDENTIFIER", sess->identifier);
+
+ if (sess->values) {
+ data = (char**)sess->values->elts;
+ prev = name = NULL;
+ count = 0;
+
+ for (i = 0; i < sess->values->nelts; ++i) {
+ line = data[i];
+
+ /* The two parts of the attribute value */
+ name = get_token (r->pool, &line, ":");
+ value = get_token (r->pool, &line, ":");
+ if (!name || !value)
+ continue;
+
+ strupcase (name);
+
+ /* Set the last count if necessary */
+ if (prev && strcmp (name, prev) != 0) {
+ apr_table_setn (r->subprocess_env,
+ apr_psprintf (r->pool, "AX_COUNT_%s", prev),
+ apr_psprintf (r->pool, "%d", count));
+ count = 0;
+ }
+
+ /* And dig out the value */
+ apr_table_setn (r->subprocess_env,
+ apr_psprintf (r->pool, "AX_VALUE_%s_%d", name, count), value);
+
+ prev = name;
+ ++count;
+ }
+
+ /* Set the last count if necessary */
+ if (name) {
+ apr_table_setn (r->subprocess_env,
+ apr_psprintf (r->pool, "AX_COUNT_%s", prev),
+ apr_psprintf (r->pool, "%d", count));
+ }
+ }
+}
+
static int
hook_authenticate (request_rec* r)
{
@@ -821,6 +918,7 @@ hook_authenticate (request_rec* r)
sid_request_t req;
const char* authtype;
request_rec* mainreq;
+ int authenticated = 0;
/* Make sure it's for us */
if (!(authtype = ap_auth_type (r)) || strcasecmp (SID_AUTHTYPE, authtype) != 0)
@@ -838,29 +936,40 @@ hook_authenticate (request_rec* r)
while (mainreq->prev != NULL)
mainreq = mainreq->prev;
+ req.result = OK;
+ req.rec = r;
+ req.sess = NULL;
+
/* Check if we've already authenticated this request */
sess = ap_get_module_config (mainreq->request_config, &auth_singleid_module);
if (sess != NULL) {
- if (mainreq != r) {
+ if (mainreq != r)
sess = session_copy_info (r->pool, sess);
- set_request_authenticated (ctx, r, sess);
- }
- return OK;
}
/* Load the session info from the request and see if we've authenticated */
- sess = session_load_info (ctx, r);
- if (sess != NULL) {
- set_request_authenticated (ctx, r, sess);
- return OK;
+ if (sess == NULL)
+ sess = session_load_info (ctx, r);
+
+ /* Allocate a new empty session info */
+ if (sess == NULL) {
+ /* Do the OpenID magic */
+ sid_consumer_authenticate (&req, ctx->store, ctx->trust_root,
+ ctx->identifier, ctx->attributes);
+ authenticated = 1;
+ sess = req.sess;
}
- req.result = OK;
- req.rec = r;
+ /* Setup the request response */
+ if (sess != NULL && req.result == OK) {
+ set_authenticated (ctx, r, sess);
+ set_env_variables (ctx, r, sess);
+ ap_set_module_config (r->request_config, &auth_singleid_module, sess);
- /* Do the OpenID magic */
- sid_consumer_authenticate (&req, ctx->store, ctx->trust_root,
- ctx->identifier, ctx->attributes);
+ /* If we actually authenticated the user, then set the cookie */
+ if (authenticated)
+ session_send_info (ctx, r, sess);
+ }
return req.result;
}