Module: Stellar::Auth

Extended by:
Auth
Included in:
Auth, Client
Defined in:
lib/stellar/auth.rb,
lib/stellar/auth.rb

Overview

:nodoc: class methods

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.get_certificate(kerberos) ⇒ Hash

Obtains a certificate using a Kerberos credentials.

Parameters:

  • kerberos (Hash) —

    MIT Kerberos credentials

Options Hash (kerberos):

  • :user (String) —

    the Kerberos username (e.g. “costan”)

  • :pass (String) —

    the Kerberos password (handle with care!)

  • :mit_id (String) —

    9-character string or 9-digit number starting with 9 (9.….…)

  • :ttl (Fixnum) —

    certificate lifetime, in days (optional; defaults to 1 day)

Returns:

  • (Hash) —

    a Hash with a :cert key (the OpenSSL::X509::Certificate) and a :key key (the matching OpenSSL::PKey::PKey private key)



91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
 
# File 'lib/stellar/auth.rb', line 91

def get_certificate(kerberos)
  mech = Mechanize.new do |m|
    m.user_agent_alias = 'Linux Firefox'
    # NOTE: ca.mit.edu uses a Geotrust certificate, not the self-signed one
  end
   = mech.get 'https://ca.mit.edu/ca/'
   = .form_with :action => /login/
  .field_with(:name => /login/).value = kerberos[:user]
  .field_with(:name => /pass/).value = kerberos[:pass]
  .field_with(:name => /mitid/).value = kerberos[:mit_id]
  keygen_page = .submit .buttons.first

  keygen_form = keygen_page.form_with(:action => /ca/)
  if /login/ =~ keygen_form.action
    raise ArgumentError, 'Invalid Kerberos credentials'
  end
  keygen_form.field_with(:name => /life/).value = kerberos[:ttl] || 1
  key_pair = keygen_form.keygens.first.key
  response_page = keygen_form.submit keygen_form.buttons.first
  
  cert_frame = response_page.frame_with(:name => /download/)
  cert_bytes = mech.get_file cert_frame.uri
  cert = OpenSSL::X509::Certificate.new cert_bytes
  {:key => key_pair, :cert => cert}
end

Instance Method Details

#auth(options = {}) ⇒ Stellar::Client

Authenticates using some credentials, e.g. an MIT certificate.

Parameters:

  • options (Hash) (defaults to: {}) —

    credentials to be used for authentication

Options Hash (options):

  • :cert (String) —

    path to MIT client certificate for the user

  • :kerberos:: (Hash) —

    Kerberos credentials, encoded as a Hash with :user and :pass keys

Returns:



20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/stellar/auth.rb', line 20

def auth(options = {})
  # Create new Mechanize instance to drop any old credentials.
  
  if options[:cert]
    key = options[:cert][:key]
    if key.respond_to?(:to_str) && !File.exist?(key)
      key = OpenSSL::PKey::RSA.new key
    end
    cert = options[:cert][:cert]
    if cert.respond_to?(:to_str) && !File.exist?(cert)
      cert = OpenSSL::X509::Certificate.new cert
    end
    
    @mech = mech do |m|
      m.key = key
      m.cert = cert
    end
  else
    @mech = mech
  end
  
  # Go to a page that is guaranteed to redirect to shitoleth.
  step1_page = get '/atstellar'
  # Fill in the form.
  step1_form = step1_page.form_with :action => /WAYF/
  step1_form.checkbox_with(:name => /perm/).checked = :checked
  step2_page = step1_form.submit step1_form.buttons.first
  # Click through the stupid confirmation form.
  step2_form = step2_page.form_with :action => /WAYF/
  cred_page = step2_form.submit step2_form.button_with(:name => /select/i)
  
  # Fill in the credentials form.
  if options[:cert]
    cred_form = cred_page.form_with :action => /certificate/i
    cred_form.checkbox_with(:name => /pref/).checked = :checked
  elsif options[:kerberos]
    cred_form = cred_page.form_with :action => /username/i
    cred_form.field_with(:name => /user/).value = options[:kerberos][:user]
    cred_form.field_with(:name => /pass/).value = options[:kerberos][:pass]
  else
    raise ArgumentError, 'Unsupported credentials'
  end
  
  # Click through the SAML response form.
  saml_page = cred_form.submit cred_form.buttons.first
  unless saml_form = saml_page.form_with(:action => /SAML/)
    raise ArgumentError, 'Authentication failed due to invalid credentials'
  end
  saml_form.submit
  
  self
end

#mitca_path ⇒ Object

Path to the MIT CA self-signed certificate.



9
10
11
 
# File 'lib/stellar/auth.rb', line 9

def mitca_path
  File.join File.dirname(__FILE__), 'mitca.crt'
end