123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560 |
- package Apache::Authn::Redmine;
-
- =head1 Apache::Authn::Redmine
-
- Redmine - a mod_perl module to authenticate webdav subversion users
- against redmine database
-
- =head1 SYNOPSIS
-
- This module allow anonymous users to browse public project and
- registred users to browse and commit their project. Authentication is
- done against the redmine database or the LDAP configured in redmine.
-
- This method is far simpler than the one with pam_* and works with all
- database without an hassle but you need to have apache/mod_perl on the
- svn server.
-
- =head1 INSTALLATION
-
- For this to automagically work, you need to have a recent reposman.rb
- (after r860) and if you already use reposman, read the last section to
- migrate.
-
- Sorry ruby users but you need some perl modules, at least mod_perl2,
- DBI and DBD::mysql (or the DBD driver for you database as it should
- work on allmost all databases).
-
- On debian/ubuntu you must do :
-
- aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
-
- If your Redmine users use LDAP authentication, you will also need
- Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
-
- aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
-
- =head1 CONFIGURATION
-
- ## This module has to be in your perl path
- ## eg: /usr/lib/perl5/Apache/Authn/Redmine.pm
- PerlLoadModule Apache::Authn::Redmine
- <Location /svn>
- DAV svn
- SVNParentPath "/var/svn"
-
- AuthType Basic
- AuthName redmine
- Require valid-user
-
- PerlAccessHandler Apache::Authn::Redmine::access_handler
- PerlAuthenHandler Apache::Authn::Redmine::authen_handler
-
- ## for mysql
- RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
- ## for postgres
- # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
-
- RedmineDbUser "redmine"
- RedmineDbPass "password"
- ## Optional where clause (fulltext search would be slow and
- ## database dependant).
- # RedmineDbWhereClause "and members.role_id IN (1,2)"
- ## Optional credentials cache size
- # RedmineCacheCredsMax 50
- </Location>
-
- To be able to browse repository inside redmine, you must add something
- like that :
-
- <Location /svn-private>
- DAV svn
- SVNParentPath "/var/svn"
- Order deny,allow
- Deny from all
- # only allow reading orders
- <Limit GET PROPFIND OPTIONS REPORT>
- Allow from redmine.server.ip
- </Limit>
- </Location>
-
- and you will have to use this reposman.rb command line to create repository :
-
- reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
-
- =head1 REPOSITORIES NAMING
-
- A project repository must be named with the project identifier. In case
- of multiple repositories for the same project, use the project identifier
- and the repository identifier separated with a dot:
-
- /var/svn/foo
- /var/svn/foo.otherrepo
-
- =head1 MIGRATION FROM OLDER RELEASES
-
- If you use an older reposman.rb (r860 or before), you need to change
- rights on repositories to allow the apache user to read and write
- S<them :>
-
- sudo chown -R www-data /var/svn/*
- sudo chmod -R u+w /var/svn/*
-
- And you need to upgrade at least reposman.rb (after r860).
-
- =head1 GIT SMART HTTP SUPPORT
-
- Git's smart HTTP protocol (available since Git 1.7.0) will not work with the
- above settings. Redmine.pm normally does access control depending on the HTTP
- method used: read-only methods are OK for everyone in public projects and
- members with read rights in private projects. The rest require membership with
- commit rights in the project.
-
- However, this scheme doesn't work for Git's smart HTTP protocol, as it will use
- POST even for a simple clone. Instead, read-only requests must be detected using
- the full URL (including the query string): anything that doesn't belong to the
- git-receive-pack service is read-only.
-
- To activate this mode of operation, add this line inside your <Location /git>
- block:
-
- RedmineGitSmartHttp yes
-
- Here's a sample Apache configuration which integrates git-http-backend with
- a MySQL database and this new option:
-
- SetEnv GIT_PROJECT_ROOT /var/www/git/
- SetEnv GIT_HTTP_EXPORT_ALL
- ScriptAlias /git/ /usr/libexec/git-core/git-http-backend/
- <Location /git>
- Order allow,deny
- Allow from all
-
- AuthType Basic
- AuthName Git
- Require valid-user
-
- PerlAccessHandler Apache::Authn::Redmine::access_handler
- PerlAuthenHandler Apache::Authn::Redmine::authen_handler
- # for mysql
- RedmineDSN "DBI:mysql:database=redmine;host=127.0.0.1"
- RedmineDbUser "redmine"
- RedmineDbPass "xxx"
- RedmineGitSmartHttp yes
- </Location>
-
- Make sure that all the names of the repositories under /var/www/git/ have a
- matching identifier for some project: /var/www/git/myproject and
- /var/www/git/myproject.git will work. You can put both bare and non-bare
- repositories in /var/www/git, though bare repositories are strongly
- recommended. You should create them with the rights of the user running Redmine,
- like this:
-
- cd /var/www/git
- sudo -u user-running-redmine mkdir myproject
- cd myproject
- sudo -u user-running-redmine git init --bare
-
- Once you have activated this option, you have three options when cloning a
- repository:
-
- - Cloning using "http://user@host/git/repo(.git)" works, but will ask for the password
- all the time.
-
- - Cloning with "http://user:pass@host/git/repo(.git)" does not have this problem, but
- this could reveal accidentally your password to the console in some versions
- of Git, and you would have to ensure that .git/config is not readable except
- by the owner for each of your projects.
-
- - Use "http://host/git/repo(.git)", and store your credentials in the ~/.netrc
- file. This is the recommended solution, as you only have one file to protect
- and passwords will not be leaked accidentally to the console.
-
- IMPORTANT NOTE: It is *very important* that the file cannot be read by other
- users, as it will contain your password in cleartext. To create the file, you
- can use the following commands, replacing yourhost, youruser and yourpassword
- with the right values:
-
- touch ~/.netrc
- chmod 600 ~/.netrc
- echo -e "machine yourhost\nlogin youruser\npassword yourpassword" > ~/.netrc
-
- =cut
-
- use strict;
- use warnings FATAL => 'all', NONFATAL => 'redefine';
-
- use DBI;
- use Digest::SHA;
- # optional module for LDAP authentication
- my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
-
- use Apache2::Module;
- use Apache2::Access;
- use Apache2::ServerRec qw();
- use Apache2::RequestRec qw();
- use Apache2::RequestUtil qw();
- use Apache2::Const qw(:common :override :cmd_how);
- use APR::Pool ();
- use APR::Table ();
-
- # use Apache2::Directive qw();
-
- my @directives = (
- {
- name => 'RedmineDSN',
- req_override => OR_AUTHCFG,
- args_how => TAKE1,
- errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
- },
- {
- name => 'RedmineDbUser',
- req_override => OR_AUTHCFG,
- args_how => TAKE1,
- },
- {
- name => 'RedmineDbPass',
- req_override => OR_AUTHCFG,
- args_how => TAKE1,
- },
- {
- name => 'RedmineDbWhereClause',
- req_override => OR_AUTHCFG,
- args_how => TAKE1,
- },
- {
- name => 'RedmineCacheCredsMax',
- req_override => OR_AUTHCFG,
- args_how => TAKE1,
- errmsg => 'RedmineCacheCredsMax must be decimal number',
- },
- {
- name => 'RedmineGitSmartHttp',
- req_override => OR_AUTHCFG,
- args_how => TAKE1,
- },
- );
-
- sub RedmineDSN {
- my ($self, $parms, $arg) = @_;
- $self->{RedmineDSN} = $arg;
- my $query = "SELECT
- users.hashed_password, users.salt, users.auth_source_id, roles.permissions, projects.status
- FROM projects, users, roles
- WHERE
- users.login=?
- AND projects.identifier=?
- AND EXISTS (SELECT 1 FROM enabled_modules em WHERE em.project_id = projects.id AND em.name = 'repository')
- AND users.type='User'
- AND users.status=1
- AND (
- roles.id IN (SELECT member_roles.role_id FROM members, member_roles WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id)
- OR
- (cast(projects.is_public as CHAR) IN ('t', '1')
- AND (roles.builtin=1
- OR roles.id IN (SELECT member_roles.role_id FROM members, member_roles, users g
- WHERE members.user_id = g.id AND members.project_id = projects.id AND members.id = member_roles.member_id
- AND g.type = 'GroupNonMember'))
- )
- )
- AND roles.permissions IS NOT NULL";
- $self->{RedmineQuery} = trim($query);
- }
-
- sub RedmineDbUser { set_val('RedmineDbUser', @_); }
- sub RedmineDbPass { set_val('RedmineDbPass', @_); }
- sub RedmineDbWhereClause {
- my ($self, $parms, $arg) = @_;
- $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
- }
-
- sub RedmineCacheCredsMax {
- my ($self, $parms, $arg) = @_;
- if ($arg) {
- $self->{RedmineCachePool} = APR::Pool->new;
- $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
- $self->{RedmineCacheCredsCount} = 0;
- $self->{RedmineCacheCredsMax} = $arg;
- }
- }
-
- sub RedmineGitSmartHttp {
- my ($self, $parms, $arg) = @_;
- $arg = lc $arg;
-
- if ($arg eq "yes" || $arg eq "true") {
- $self->{RedmineGitSmartHttp} = 1;
- } else {
- $self->{RedmineGitSmartHttp} = 0;
- }
- }
-
- sub trim {
- my $string = shift;
- $string =~ s/\s{2,}/ /g;
- return $string;
- }
-
- sub set_val {
- my ($key, $self, $parms, $arg) = @_;
- $self->{$key} = $arg;
- }
-
- Apache2::Module::add(__PACKAGE__, \@directives);
-
-
- my %read_only_methods = map { $_ => 1 } qw/GET HEAD PROPFIND REPORT OPTIONS/;
-
- sub request_is_read_only {
- my ($r) = @_;
- my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
-
- # Do we use Git's smart HTTP protocol, or not?
- if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp}) {
- my $uri = $r->unparsed_uri;
- my $location = $r->location;
- my $is_read_only = $uri !~ m{^$location/*[^/]+/+(info/refs\?service=)?git\-receive\-pack$}o;
- return $is_read_only;
- } else {
- # Standard behaviour: check the HTTP method
- my $method = $r->method;
- return defined $read_only_methods{$method};
- }
- }
-
- sub access_handler {
- my $r = shift;
-
- unless ($r->some_auth_required) {
- $r->log_reason("No authentication has been configured");
- return FORBIDDEN;
- }
-
- return OK unless request_is_read_only($r);
-
- my $project_id = get_project_identifier($r);
-
- if (is_public_project($project_id, $r) && anonymous_allowed_to_browse_repository($project_id, $r)) {
- $r->user("");
- $r->set_handlers(PerlAuthenHandler => [\&OK]);
- }
-
- return OK
- }
-
- sub authen_handler {
- my $r = shift;
-
- my ($res, $redmine_pass) = $r->get_basic_auth_pw();
- return $res unless $res == OK;
-
- if (is_member($r->user, $redmine_pass, $r)) {
- return OK;
- } else {
- $r->note_auth_failure();
- return DECLINED;
- }
- }
-
- # check if authentication is forced
- sub is_authentication_forced {
- my $r = shift;
-
- my $dbh = connect_database($r);
- my $sth = $dbh->prepare(
- "SELECT value FROM settings where settings.name = 'login_required';"
- );
-
- $sth->execute();
- my $ret = 0;
- if (my @row = $sth->fetchrow_array) {
- if ($row[0] eq "1" || $row[0] eq "t") {
- $ret = 1;
- }
- }
- $sth->finish();
- undef $sth;
-
- $dbh->disconnect();
- undef $dbh;
-
- $ret;
- }
-
- sub is_public_project {
- my $project_id = shift;
- my $r = shift;
-
- if (is_authentication_forced($r)) {
- return 0;
- }
-
- my $dbh = connect_database($r);
- my $sth = $dbh->prepare(
- "SELECT is_public FROM projects
- WHERE projects.identifier = ? AND projects.status <> 9
- AND EXISTS (SELECT 1 FROM enabled_modules em WHERE em.project_id = projects.id AND em.name = 'repository');"
- );
-
- $sth->execute($project_id);
- my $ret = 0;
- if (my @row = $sth->fetchrow_array) {
- if ($row[0] eq "1" || $row[0] eq "t") {
- $ret = 1;
- }
- }
- $sth->finish();
- undef $sth;
- $dbh->disconnect();
- undef $dbh;
-
- $ret;
- }
-
- sub anonymous_allowed_to_browse_repository {
- my $project_id = shift;
- my $r = shift;
-
- my $dbh = connect_database($r);
- my $sth = $dbh->prepare(
- "SELECT permissions FROM roles WHERE permissions like '%browse_repository%'
- AND (roles.builtin = 2
- OR roles.id IN (SELECT member_roles.role_id FROM projects, members, member_roles, users
- WHERE members.user_id = users.id AND members.project_id = projects.id AND members.id = member_roles.member_id
- AND projects.identifier = ? AND users.type = 'GroupAnonymous'));"
- );
-
- $sth->execute($project_id);
- my $ret = 0;
- if (my @row = $sth->fetchrow_array) {
- if ($row[0] =~ /:browse_repository/) {
- $ret = 1;
- }
- }
- $sth->finish();
- undef $sth;
- $dbh->disconnect();
- undef $dbh;
-
- $ret;
- }
-
- # perhaps we should use repository right (other read right) to check public access.
- # it could be faster BUT it doesn't work for the moment.
- # sub is_public_project_by_file {
- # my $project_id = shift;
- # my $r = shift;
-
- # my $tree = Apache2::Directive::conftree();
- # my $node = $tree->lookup('Location', $r->location);
- # my $hash = $node->as_hash;
-
- # my $svnparentpath = $hash->{SVNParentPath};
- # my $repos_path = $svnparentpath . "/" . $project_id;
- # return 1 if (stat($repos_path))[2] & 00007;
- # }
-
- sub is_member {
- my $redmine_user = shift;
- my $redmine_pass = shift;
- my $r = shift;
-
- my $project_id = get_project_identifier($r);
-
- my $pass_digest = Digest::SHA::sha1_hex($redmine_pass);
-
- my $access_mode = request_is_read_only($r) ? "R" : "W";
-
- my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
- my $usrprojpass;
- if ($cfg->{RedmineCacheCredsMax}) {
- $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id.":".$access_mode);
- return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
- }
- my $dbh = connect_database($r);
- my $query = $cfg->{RedmineQuery};
- my $sth = $dbh->prepare($query);
- $sth->execute($redmine_user, $project_id);
-
- my $ret;
- while (my ($hashed_password, $salt, $auth_source_id, $permissions, $project_status) = $sth->fetchrow_array) {
- if ($project_status eq "9" || ($project_status ne "1" && $access_mode eq "W")) {
- last;
- }
-
- unless ($auth_source_id) {
- my $method = $r->method;
- my $salted_password = Digest::SHA::sha1_hex($salt.$pass_digest);
- if ($hashed_password eq $salted_password && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
- $ret = 1;
- last;
- }
- } elsif ($CanUseLDAPAuth) {
- my $sthldap = $dbh->prepare(
- "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
- );
- $sthldap->execute($auth_source_id);
- while (my @rowldap = $sthldap->fetchrow_array) {
- my $bind_as = $rowldap[3] ? $rowldap[3] : "";
- my $bind_pw = $rowldap[4] ? $rowldap[4] : "";
- if ($bind_as =~ m/\$login/) {
- # replace $login with $redmine_user and use $redmine_pass
- $bind_as =~ s/\$login/$redmine_user/g;
- $bind_pw = $redmine_pass
- }
- my $ldap = Authen::Simple::LDAP->new(
- host => ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],
- port => $rowldap[1],
- basedn => $rowldap[5],
- binddn => $bind_as,
- bindpw => $bind_pw,
- filter => "(".$rowldap[6]."=%s)"
- );
- my $method = $r->method;
- $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && (($access_mode eq "R" && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
-
- }
- $sthldap->finish();
- undef $sthldap;
- }
- }
- $sth->finish();
- undef $sth;
- $dbh->disconnect();
- undef $dbh;
-
- if ($cfg->{RedmineCacheCredsMax} and $ret) {
- if (defined $usrprojpass) {
- $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest);
- } else {
- if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
- $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id.":".$access_mode, $pass_digest);
- $cfg->{RedmineCacheCredsCount}++;
- } else {
- $cfg->{RedmineCacheCreds}->clear();
- $cfg->{RedmineCacheCredsCount} = 0;
- }
- }
- }
-
- $ret;
- }
-
- sub get_project_identifier {
- my $r = shift;
-
- my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
- my $location = $r->location;
- $location =~ s/\.git$// if (defined $cfg->{RedmineGitSmartHttp} and $cfg->{RedmineGitSmartHttp});
- my ($identifier) = $r->uri =~ m{$location/*([^/.]+)};
- $identifier;
- }
-
- sub connect_database {
- my $r = shift;
-
- my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
- return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
- }
-
- 1;
|