mirror of
https://github.com/OpenNebula/one.git
synced 2026-11-10 14:35:43 +09:00
feature #4111: Generic user check methos for Auth classes. Moved x509
and Remote to new method. Now RemoteCloudAuth works for users with
driver public.
(cherry picked from commit dc399e0a44)
This commit is contained in:
1 parent
b69831fbd6
commit
7c44af97dd
3 files changed
+28
-12
No files matched your search
@@ -143,21 +143,17 @@ class CloudAuth
|
||||
retrieve_from_userpool(xpath)
|
||||
end
|
||||
|
||||
# Gets the username associated with a password
|
||||
# password:: _String_ the password
|
||||
# [return] _Hash_ with the username
|
||||
def get_username(password)
|
||||
# Trying to match password with each
|
||||
# of the pipe-separated DNs stored in USER/PASSWORD
|
||||
# Selects the username that matches the driver and evaluates to true the
|
||||
# block passed to the function
|
||||
# block:: { |user| true or false }
|
||||
# [return] the username or nil
|
||||
def select_username(password)
|
||||
@lock.synchronize do
|
||||
@user_pool.each_with_xpath(
|
||||
"USER[contains(PASSWORD, \"#{password}\")]") do |user|
|
||||
return user["NAME"] if user["AUTH_DRIVER"] == "x509" &&
|
||||
user["PASSWORD"].split('|').include?(password)
|
||||
return user["NAME"] if yield user, password
|
||||
end
|
||||
end
|
||||
|
||||
nil
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
@@ -16,6 +16,15 @@
|
||||
|
||||
|
||||
module RemoteCloudAuth
|
||||
|
||||
# Gets the username associated with a password for users with driver public
|
||||
# It just matches the password.
|
||||
def get_username(password)
|
||||
select_username(password) { |u, p|
|
||||
u["AUTH_DRIVER"] == "public" && u["PASSWORD"] == p
|
||||
}
|
||||
end
|
||||
|
||||
def do_auth(env, params={})
|
||||
# For Kerberos, the web service should be set to include the remote_user in the environment.
|
||||
remote_user = env['REMOTE_USER']
|
||||
@@ -24,7 +33,7 @@ module RemoteCloudAuth
|
||||
# Use the https credentials for authentication
|
||||
unless remote_user.nil?
|
||||
# Password should be REMOTE_USER itself.
|
||||
username = get_username(remote_user)
|
||||
username = get_remote_username(remote_user)
|
||||
if username
|
||||
return username
|
||||
else
|
||||
|
||||
@@ -17,8 +17,19 @@
|
||||
require 'opennebula/x509_auth'
|
||||
|
||||
module X509CloudAuth
|
||||
|
||||
# Gets the username associated with a password for x509 driver
|
||||
# It matches the password with each of the pipe-separated DNs stored
|
||||
# in USER/PASSWORD
|
||||
def get_username(password)
|
||||
select_username(password) { |u, p|
|
||||
u["AUTH_DRIVER"] == "x509" && u["PASSWORD"].split('|').include?(p)
|
||||
}
|
||||
end
|
||||
|
||||
def do_auth(env, params={})
|
||||
# For https, the web service should be set to include the user cert in the environment.
|
||||
# For https, the web service should be set to include the user cert in
|
||||
# the environment.
|
||||
cert_line = env['HTTP_SSL_CLIENT_CERT']
|
||||
cert_line = nil if cert_line == '(null)' # For Apache mod_ssl
|
||||
chain_index = 0
|
||||
|
||||
Reference in new issue
Block a user