Class: OmniAuth::Strategies::Raven

Inherits:
Object
  • Object
show all
Includes:
OmniAuth::Strategy
Defined in:
lib/omniauth/strategies/raven.rb

Instance Method Summary collapse

Instance Method Details

#callback_phase ⇒ Object 



51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
 
# File 'lib/omniauth/strategies/raven.rb', line 51

def callback_phase

  return fail!("null_response") if request.params['WLS-Response'] == ""
    
      wls_response = request.params['WLS-Response'].to_s
      ver, status, msg, issue, id, url, principal, auth, sso, life, params, kid, sig = wls_response.split('!')

      #Check the protocol version
      return fail!("invalid_protocol_version") unless ver == options[:raven_opt][:version]
      
      #Check the url
      return fail!("mismatched urls", Exception.new("url: " + url + " vs callback: " + callback_url) ) unless url == callback_url.split('?').first
    
      #Check the time skew
      issuetime = timeforRFC3339( issue )
      skew = issuetime - Time.now
      return fail!("time_skew") unless skew.abs < options[:raven_opt][:max_skew]

      #Optionally check that interaction with the user took place
      return fail!(:invalid_response, Exception.new("No raven interaction took place, but it was requested") ) if ( options[:raven_opt][:iact] == 'yes' &&  auth == "" )
      
      #Optionally check that this response matches a request
      if @match_response_and_request
        response_id = unescape( params )
        request_id = session['request_id']
        return fail!("mismatched_response", Exception.new("req_id:" + request_id + " vs resp_id:" + response_id) ) unless request_id == response_id
      end
      
      #If we got here, and status is 200, then yield the principal
      if status == '200'
        #Check that the Key Id is one we currently accept
        publickey = OmniAuth.raven_pubkey
        return fail!("invalid_keyno") unless kid == OmniAuth.raven_keyno
        
        #Check the signature
        length_to_drop = -(sig.length + kid.length + 3)
        signedbit = wls_response[ 0 .. length_to_drop]
        return fail!("mismatched_signature") unless publickey.verify( OpenSSL::Digest::SHA1.new, Base64.decode64(sig.tr('-._','+/=')), signedbit) 

        # Return the status
        @name = principal
        @email = principal+"@cam.ac.uk"

        super
      else
        #And return the error code if it is something else.
        return fail!(:invalid_credentials, Exception.new("Raven status:" + status) )
      end
      
end

#request_phase ⇒ Object 



34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/omniauth/strategies/raven.rb', line 34

def request_phase

      params = session['request_id'] = rand( 999999 ).to_s

  auth_url = options[:raven_opt][:url] + 
         "?ver="    + uriescape(options[:raven_opt][:version]) +
         ";url="    + uriescape(callback_url) +
         ";desc="   + uriescape(options[:raven_opt][:desc]) +
         ";msg="    + uriescape(options[:raven_opt][:msg]) +
         ";iact="   + uriescape(options[:raven_opt][:iact]) +
         ";aauth="  + uriescape(options[:raven_opt][:aauth]) +
         ";params=" + uriescape(params) +
         ";fail="   + uriescape(options[:raven_opt][:fail])

      return redirect auth_url
end