From 7c44af97dd00fe904faebfecf2783ca83bdbe029 Mon Sep 17 00:00:00 2001
From: "Ruben S. Montero" <rsmontero@opennebula.org>
Date: Thu, 19 Nov 2015 16:45:01 +0100
Subject: [PATCH] feature #4111: Generic user check methos for Auth classes.
 Moved x509 and Remote to new method. Now RemoteCloudAuth works for users with
 driver public.

(cherry picked from commit dc399e0a441b50bb99c230ba79095775d1cf68e8)
---
 src/cloud/common/CloudAuth.rb                 | 16 ++++++----------
 src/cloud/common/CloudAuth/RemoteCloudAuth.rb | 11 ++++++++++-
 src/cloud/common/CloudAuth/X509CloudAuth.rb   | 13 ++++++++++++-
 3 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/src/cloud/common/CloudAuth.rb b/src/cloud/common/CloudAuth.rb
index 60fc963d9b..d849e5e37b 100644
--- a/src/cloud/common/CloudAuth.rb
+++ b/src/cloud/common/CloudAuth.rb
@@ -143,21 +143,17 @@ class CloudAuth
         retrieve_from_userpool(xpath)
     end
 
-    # Gets the username associated with a password
-    # password:: _String_ the password
-    # [return] _Hash_ with the username
-    def get_username(password)
-        # Trying to match password with each
-        # of the pipe-separated DNs stored in USER/PASSWORD
+    # Selects the username that matches the driver and evaluates to true the 
+    # block passed to the function
+    # block:: { |user| true or false }
+    # [return] the username or nil
+    def select_username(password)
         @lock.synchronize do
             @user_pool.each_with_xpath(
                 "USER[contains(PASSWORD, \"#{password}\")]") do |user|
-                return user["NAME"] if user["AUTH_DRIVER"] == "x509" &&
-                    user["PASSWORD"].split('|').include?(password)
+                    return user["NAME"] if yield user, password
             end
         end
-
-        nil
     end
 
     private
diff --git a/src/cloud/common/CloudAuth/RemoteCloudAuth.rb b/src/cloud/common/CloudAuth/RemoteCloudAuth.rb
index 496e59c8a3..13af48bc92 100644
--- a/src/cloud/common/CloudAuth/RemoteCloudAuth.rb
+++ b/src/cloud/common/CloudAuth/RemoteCloudAuth.rb
@@ -16,6 +16,15 @@
 
 
 module RemoteCloudAuth
+
+    # Gets the username associated with a password for users with driver public
+    # It just matches the password.
+    def get_username(password)
+      select_username(password) { |u, p|
+        u["AUTH_DRIVER"] == "public" && u["PASSWORD"] == p
+      }
+    end
+
     def do_auth(env, params={})
         # For Kerberos, the web service should be set to include the remote_user in the environment.
         remote_user   = env['REMOTE_USER']
@@ -24,7 +33,7 @@ module RemoteCloudAuth
         # Use the https credentials for authentication
         unless remote_user.nil?
             # Password should be REMOTE_USER itself.
-            username = get_username(remote_user)
+            username = get_remote_username(remote_user)
             if username
                 return username
             else
diff --git a/src/cloud/common/CloudAuth/X509CloudAuth.rb b/src/cloud/common/CloudAuth/X509CloudAuth.rb
index 4107a38788..bed6eb8091 100644
--- a/src/cloud/common/CloudAuth/X509CloudAuth.rb
+++ b/src/cloud/common/CloudAuth/X509CloudAuth.rb
@@ -17,8 +17,19 @@
 require 'opennebula/x509_auth'
 
 module X509CloudAuth
+
+    # Gets the username associated with a password for x509 driver
+    # It matches the  password with each of the pipe-separated DNs stored
+    # in USER/PASSWORD
+    def get_username(password)
+      select_username(password) { |u, p|
+        u["AUTH_DRIVER"] == "x509" && u["PASSWORD"].split('|').include?(p)
+      }
+    end
+
     def do_auth(env, params={})
-        # For https, the web service should be set to include the user cert in the environment.
+        # For https, the web service should be set to include the user cert in
+        # the environment.
         cert_line   = env['HTTP_SSL_CLIENT_CERT']
         cert_line   = nil if cert_line == '(null)' # For Apache mod_ssl
         chain_index = 0