Redmine

package Apache::Authn::Redmine;

=head1 Apache::Authn::Redmine

Redmine - a mod_perl module to authenticate webdav subversion users

against redmine database

=head1 SYNOPSIS

This module allows anonymous users to browse public project 

repositories if platform authentication is disabled. Authenticated 

user with browse_repository permission (reporter, developer, manager,

non-members) are allowed to read the repository, authenticated users 

with commit_repository permissions (developer, manager) are allowed 

to write to the repository.

This method is far simpler than the one with pam_* and works with all

database without an hassle but you need to have apache/mod_perl on the

svn server.

=head1 INSTALLATION

For this to automagically work, you need to have a recent reposman.rb

(after r860) and if you already use reposman, read the last section to

migrate.

Sorry ruby users but you need some perl modules, at least mod_perl2,

DBI and DBD::mysql (or the DBD driver for you database as it should

work on allmost all databases).

On debian/ubuntu you must do :

  aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl

If your Redmine users use LDAP authentication, you will also need

Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):

  aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl

=head1 CONFIGURATION

   ## This module has to be in your perl path

   ## eg:  /usr/lib/perl5/Apache/Authn/Redmine.pm

   PerlLoadModule Apache::Authn::Redmine

   <Location /svn>

     DAV svn

     SVNParentPath "/var/svn"

     AuthType Basic

     AuthName redmine

     Require valid-user

     PerlAccessHandler Apache::Authn::Redmine::access_handler

     PerlAuthenHandler Apache::Authn::Redmine::authen_handler

     ## for mysql

     RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"

     ## for postgres

     # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"

     RedmineDbUser "redmine"

     RedmineDbPass "password"

     ## Optional credentials cache size

     # RedmineCacheCredsMax 50

  </Location>

To be able to browse repository inside redmine, you must add something

like that :

   <Location /svn-private>

     DAV svn

     SVNParentPath "/var/svn"

     Order deny,allow

     Deny from all

     # only allow reading orders

     <Limit GET PROPFIND OPTIONS REPORT>

       Allow from redmine.server.ip

     </Limit>

   </Location>

and you will have to use this reposman.rb command line to create repository :

  reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/

=head1 MIGRATION FROM OLDER RELEASES

If you use an older reposman.rb (r860 or before), you need to change

rights on repositories to allow the apache user to read and write

S<them :>

  sudo chown -R www-data /var/svn/*

  sudo chmod -R u+w /var/svn/*

And you need to upgrade at least reposman.rb (after r860).

=cut

use strict;

use warnings FATAL => 'all', NONFATAL => 'redefine';

use DBI;

use Digest::SHA1;

# optional module for LDAP authentication

my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");

use Apache2::Module;

use Apache2::Access;

use Apache2::ServerRec qw();

use Apache2::RequestRec qw();

use Apache2::RequestUtil qw();

use Apache2::Const qw(:common :override :cmd_how);

use APR::Pool  ();

use APR::Table ();

# use Apache2::Directive qw();

my @directives = (

	{   name         => 'RedmineDSN',

		req_override => OR_AUTHCFG,

		args_how     => TAKE1,

		errmsg =>

			'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',

	},

	{   name         => 'RedmineDbUser',

		req_override => OR_AUTHCFG,

		args_how     => TAKE1,

	},

	{   name         => 'RedmineDbPass',

		req_override => OR_AUTHCFG,

		args_how     => TAKE1,

	},

	{   name         => 'RedmineCacheCredsMax',

		req_override => OR_AUTHCFG,

		args_how     => TAKE1,

		errmsg       => 'RedmineCacheCredsMax must be decimal number',

	},

);

sub RedmineDSN {

	my ( $self, $parms, $arg ) = @_;

	$self->{RedmineDSN} = $arg;

}

sub RedmineDbUser {

	set_val( 'RedmineDbUser', @_ );

}

sub RedmineDbPass {

	set_val( 'RedmineDbPass', @_ );

}

sub RedmineCacheCredsMax {

	my ( $self, $parms, $arg ) = @_;

	if ($arg) {

		$self->{RedmineCachePool} = APR::Pool->new;

		$self->{RedmineCacheCreds}

			= APR::Table::make( $self->{RedmineCachePool}, $arg );

		$self->{RedmineCacheCredsCount} = 0;

		$self->{RedmineCacheCredsMax}   = $arg;

	}

}

sub trim {

	my $string = shift;

	$string =~ s/\s{2,}/ /g;

	return $string;

}

sub set_val {

	my ( $key, $self, $parms, $arg ) = @_;

	$self->{$key} = $arg;

}

Apache2::Module::add( __PACKAGE__, \@directives );

my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;

sub access_handler {

	my $r = shift;

	# return FORBIDDEN if no authentication has been configured (means: if no auth is required here)

	# default security

	unless ( $r->some_auth_required ) {

		return FORBIDDEN;

	}

	# return OK if method requested is not one of the read only methods

	my $method = $r->method;

	unless ( defined $read_only_methods{$method} ) {

		return OK;

	}

	# Disable authentication for public projects if authentication is not forced

	# write method requests will not reach till here

	my $project_id = get_project_identifier($r);

	if ( is_public_project( $project_id, $r )

		&& !( is_authentication_forced($r) ) )

	{

		$r->set_handlers( PerlAuthenHandler => [ \&OK ] );

	}

	#Fall-through OK

	return OK;

}

sub authen_handler {

	my $r = shift;

	# Get password from request header, return error if failed

	my ( $res, $apache_password ) = $r->get_basic_auth_pw();

	unless ( $res == OK ) {

		return $res;

	}

	my $apache_user = $r->user;

	# is user authorised? check authentication & authorisation with respect to public projects

	if ( is_authorised( $apache_user, $apache_password, $r ) ) {

		return OK;

	}

	# Fall-through AUTH_REQUIRED

	$r->note_auth_failure();

	return AUTH_REQUIRED;

}

# check if platfrom authentication is forced

sub is_authentication_forced {

	my $r   = shift;

	my $dbh = connect_database($r);

	my $sth = $dbh->prepare(

		"SELECT value FROM settings where settings.name = 'login_required';");

	$sth->execute();

	my $ret = 0;

	if ( my @row = $sth->fetchrow_array ) {

		if ( $row[0] eq "1" || $row[0] eq "t" ) {

			$ret = 1;

		}

	}

	$sth->finish();

	undef $sth;

	$dbh->disconnect();

	undef $dbh;

	return $ret;

}

# obtain project identifier

sub get_project_identifier {

	my $r        = shift;

	my $location = $r->location;

	my ($identifier) = $r->uri =~ m{$location/*([^/]+)};

	return $identifier;

}

# check if public project

sub is_public_project {

	my $project_id = shift;

	my $r          = shift;

	my $dbh        = connect_database($r);

	my $sth        = $dbh->prepare(

		"SELECT is_public FROM projects WHERE projects.identifier = ?;");

	$sth->execute($project_id);

	my $ret = 0;

	if ( my @row = $sth->fetchrow_array ) {

		if ( $row[0] eq "1" || $row[0] eq "t" ) {

			$ret = 1;

		}

	}

	$sth->finish();

	undef $sth;

	$dbh->disconnect();

	undef $dbh;

	return $ret;

}

# get the authentication source of the user

sub get_auth_source_id {

	my $r           = shift;

	my $apache_user = shift;

	my $ret         = 0;

	my $dbh         = connect_database($r);

	my $sth

		= $dbh->prepare("SELECT auth_source_id FROM users u WHERE login= ?;");

	$sth->execute($apache_user);

	if ( my @row = $sth->fetchrow_array ) {

		$ret = $row[0];

	}

	$sth->finish();

	undef $sth;

	$dbh->disconnect();

	undef $dbh;

	return $ret;

}

# get the project permissions of the user

sub get_permissions {

	my $r           = shift;

	my $apache_user = shift;

	my $project_id  = shift;

	my $ret         = "";

	my $dbh         = connect_database($r);

	my $query       = trim(

		"SELECT permissions

	    FROM members, projects, users, roles, member_roles 

	    WHERE projects.id=members.project_id 

	    AND member_roles.member_id=members.id 

	    AND users.id=members.user_id 

	    AND roles.id=member_roles.role_id 

	    AND users.status=1 

	    AND login=?

	    AND identifier=?"

	);

	my $sth = $dbh->prepare($query);

	$sth->execute( $apache_user, $project_id );

	if ( my @row = $sth->fetchrow_array ) {

		$ret = $row[0];

	}

	$sth->finish();

	undef $sth;

	$dbh->disconnect();

	undef $dbh;

	return $ret;

}

# check user credentials (ldap first, where most of our users live; you may want to change this)

sub is_authenticated {

	my $r               = shift;

	my $apache_user     = shift;

	my $apache_password = shift;

	my $ret = (is_authenticated_in_ldap( $r, $apache_user, $apache_password )

			|| is_authenticated_in_db( $r, $apache_user, $apache_password ) );

	return $ret;

}

# check database for authenticatin

sub is_authenticated_in_db {

	my $r                      = shift;

	my $apache_user            = shift;

	my $apache_password        = shift;

	my $apache_password_digest = Digest::SHA1::sha1_hex($apache_password);

	my $dbh                    = connect_database($r);

	my $sth                    = $dbh->prepare(

		"SELECT hashed_password FROM users u WHERE login = ?;");

	$sth->execute($apache_user);

	my $ret = 0;

	if ( my @row = $sth->fetchrow_array ) {

		if ( $row[0] eq $apache_password_digest ) {

			$ret = 1;

		}

	}

	$sth->finish();

	undef $sth;

	$dbh->disconnect();

	undef $dbh;

	return $ret;

}

# check ldap directory for authentication

sub is_authenticated_in_ldap {

	my $r               = shift;

	my $apache_user     = shift;

	my $apache_password = shift;

	my $auth_source_id  = get_auth_source_id( $r, $apache_user );

	my $ret             = 0;

	my $dbh             = connect_database($r);

	my $sthldap

		= $dbh->prepare(

		"SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"

		);

	$sthldap->execute($auth_source_id);

	while ( my @rowldap = $sthldap->fetchrow_array ) {

		my $ldap = Authen::Simple::LDAP->new(

			host => ( $rowldap[2] eq "1" || $rowldap[2] eq "t" )

			? "ldaps://$rowldap[0]"

			: $rowldap[0],

			port   => $rowldap[1],

			basedn => $rowldap[5],

			binddn => $rowldap[3] ? $rowldap[3] : "",

			bindpw => $rowldap[4] ? $rowldap[4] : "",

			filter => "(" . $rowldap[6] . "=%s)"

		);

		if ( $ldap->authenticate( $apache_user, $apache_password ) ) {

			$ret = 1;

		}

	}

	$sthldap->finish();

	undef $sthldap;

	$dbh->disconnect();

	undef $dbh;

	return $ret;

}

# check authorisation (and authentication) with respect to public projects

sub is_authorised {

	my $apache_user     = shift;

	my $apache_password = shift;

	my $r               = shift;

	my $cfg = Apache2::Module::get_config( __PACKAGE__, $r->server,

		$r->per_dir_config );

	my $project_id             = get_project_identifier($r);

	my $method                 = $r->method;

	my $apache_password_digest = Digest::SHA1::sha1_hex($apache_password);

	my $cache_password_digest;

	my $authorised = 0;

	# look in cache first

	if ( $cfg->{RedmineCacheCredsMax} ) {

		$cache_password_digest = $cfg->{RedmineCacheCreds}

			->get( $apache_user . ":" . $project_id . ":" . $method );

		if ( defined $cache_password_digest

			and ( $cache_password_digest eq $apache_password_digest ) )

		{

			return 1;

		}

	}

	# get permissions

	my $permissions = get_permissions( $r, $apache_user, $project_id );

	# check if authenticated and has required permissions in project

	if (is_authenticated( $r, $apache_user, $apache_password )

		&& ((   defined $read_only_methods{$method}

				&& ( $permissions =~ /:browse_repository/

					|| is_public_project( $project_id, $r ) )

			)

			|| $permissions =~ /:commit_access/

		)

		)

	{

		$authorised = 1;

	}

	# update cache

	if ( $cfg->{RedmineCacheCredsMax} and $authorised ) {

		if ( defined $cache_password_digest ) {

			$cfg->{RedmineCacheCreds}

				->set( $apache_user . ":" . $project_id . ":" . $method,

				$apache_password_digest );

		}

		else {

			if ( $cfg->{RedmineCacheCredsCount}

				< $cfg->{RedmineCacheCredsMax} )

			{

				$cfg->{RedmineCacheCreds}

					->set( $apache_user . ":" . $project_id . ":" . $method,

					$apache_password_digest );

				$cfg->{RedmineCacheCredsCount}++;

			}

			else {

				$cfg->{RedmineCacheCreds}->clear();

				$cfg->{RedmineCacheCredsCount} = 0;

			}

		}

	}

	return $authorised;

}

# database connection

sub connect_database {

	my $r   = shift;

	my $cfg = Apache2::Module::get_config( __PACKAGE__, $r->server,

		$r->per_dir_config );

	return DBI->connect( $cfg->{RedmineDSN}, $cfg->{RedmineDbUser},

		$cfg->{RedmineDbPass} );

}

1;