Commit | Line | Data |
---|---|---|
7c87e995 MG |
1 | package Apache2::Authen::Passphrase; |
2 | ||
3 | our $VERSION = 0.002; | |
f4cc782b MG |
4 | |
5 | use 5.014000; | |
6 | use strict; | |
7 | use warnings; | |
8 | use parent qw/Exporter/; | |
788a3738 | 9 | use subs qw/OK HTTP_UNAUTHORIZED/; |
f4cc782b MG |
10 | |
11 | use constant +{ | |
12 | USER_REGEX => qr/^\w{2,20}$/pa, | |
13 | PASSPHRASE_VERSION => 1, | |
14 | INVALID_USER => "invalid-user\n", | |
15 | BAD_PASSWORD => "bad-password\n", | |
16 | }; | |
17 | ||
788a3738 MG |
18 | use if $ENV{MOD_PERL}, 'Apache2::RequestRec'; |
19 | use if $ENV{MOD_PERL}, 'Apache2::Access'; | |
20 | use if $ENV{MOD_PERL}, 'Apache2::Const' => qw/OK HTTP_UNAUTHORIZED/; | |
f4cc782b MG |
21 | use Authen::Passphrase; |
22 | use Authen::Passphrase::BlowfishCrypt; | |
23 | use YAML::Any qw/LoadFile DumpFile/; | |
24 | ||
25 | our @EXPORT_OK = qw/pwset pwcheck pwhash USER_REGEX PASSPHRASE_VERSION INVALID_USER BAD_PASSWORD/; | |
26 | ||
27 | ################################################## | |
28 | ||
7c87e995 | 29 | our $rootdir //= $ENV{AAP_ROOTDIR}; |
f4cc782b MG |
30 | |
31 | sub pwhash{ | |
32 | my ($pass)=@_; | |
33 | ||
34 | my $ppr=Authen::Passphrase::BlowfishCrypt->new( | |
35 | cost => 10, | |
36 | passphrase => $pass, | |
37 | salt_random => 1, | |
38 | ); | |
39 | ||
40 | $ppr->as_rfc2307 | |
41 | } | |
42 | ||
43 | sub pwset{ | |
44 | my ($user, $pass)=@_; | |
45 | ||
f7fdbaad | 46 | my $file = "$rootdir/$user.yml"; |
f4cc782b MG |
47 | my $conf = eval { LoadFile $file } // undef; |
48 | $conf->{passphrase}=pwhash $pass; | |
49 | $conf->{passphrase_version}=PASSPHRASE_VERSION; | |
50 | DumpFile $file, $conf; | |
51 | ||
52 | chmod 0660, $file; | |
53 | } | |
54 | ||
55 | sub pwcheck{ | |
56 | my ($user, $pass)=@_; | |
57 | die INVALID_USER unless $user =~ USER_REGEX; | |
58 | $user=${^MATCH};# Make taint shut up | |
f7fdbaad | 59 | my $conf=LoadFile "$rootdir/$user.yml"; |
f4cc782b MG |
60 | |
61 | die BAD_PASSWORD unless keys $conf;# Empty hash means no such user | |
62 | die BAD_PASSWORD unless Authen::Passphrase->from_rfc2307($conf->{passphrase})->match($pass); | |
63 | pwset $user, $pass if $conf->{passphrase_version} < PASSPHRASE_VERSION | |
64 | } | |
65 | ||
66 | sub handler{ | |
67 | my $r=shift; | |
f7fdbaad | 68 | local $rootdir = $r->dir_config('AuthenPassphraseRootdir'); |
f4cc782b MG |
69 | |
70 | my ($rc, $pass) = $r->get_basic_auth_pw; | |
71 | return $rc unless $rc == OK; | |
72 | ||
73 | my $user=$r->user; | |
74 | unless (eval { pwcheck $user, $pass; 1 }) { | |
75 | $r->note_basic_auth_failure; | |
76 | return HTTP_UNAUTHORIZED | |
77 | } | |
78 | ||
79 | OK | |
80 | } | |
81 | ||
82 | 1; | |
83 | __END__ | |
84 | ||
85 | =head1 NAME | |
86 | ||
87 | Apache2::Authen::Passphrase - basic authentication with Authen::Passphrase | |
88 | ||
89 | =head1 SYNOPSIS | |
90 | ||
91 | use Apache2::Authen::Passphrase qw/pwcheck pwset pwhash/; | |
f7fdbaad | 92 | $Apache2::Authen::Passphrase::rootdir = "/path/to/user/directory" |
f4cc782b MG |
93 | my $hash = pwhash $username, $password; |
94 | pwset $username, "pass123"; | |
95 | eval { pwcheck $username, "pass123" }; | |
96 | ||
97 | # In Apache2 config | |
98 | <Location /secret> | |
99 | PerlAuthenHandler Apache2::Authen::Passphrase | |
f7fdbaad | 100 | PerlSetVar AuthenPassphraseRootdir /path/to/user/directory |
f4cc782b MG |
101 | AuthName MyAuth |
102 | Require valid-user | |
103 | </Location> | |
104 | ||
105 | =head1 DESCRIPTION | |
106 | ||
107 | Apache2::Authen::Passphrase is a perl module which provides easy-to-use Apache2 authentication. It exports some utility functions and it contains a PerlAuthenHandler. | |
108 | ||
7c87e995 MG |
109 | The password hashes are stored in YAML files in an directory (called the C<rootdir>), one file per user. |
110 | ||
111 | Set the C<rootdir> like this: | |
112 | ||
113 | $Apache2::Authen::Passphrase::rootdir = '/path/to/rootdir'; | |
114 | ||
115 | or by setting the C<AAP_ROOTDIR> enviroment variable to the desired value. | |
116 | ||
f4cc782b MG |
117 | =head1 FUNCTIONS |
118 | ||
119 | =over | |
120 | ||
121 | =item B<pwhash>() | |
122 | ||
123 | Takes the password as a single argument and returns the password hash. | |
124 | ||
125 | =item B<pwset>(I<$username>, I<$password>) | |
126 | ||
127 | Sets the password of $username to $password. | |
128 | ||
129 | =item B<pwcheck>(I<$username>, I<$password>) | |
130 | ||
131 | Checks the given username and password, throwing an exception if the username is invalid or the password is incorrect. | |
132 | ||
133 | =item B<handler> | |
134 | ||
135 | The PerlAuthenHandler for use in apache2. It uses Basic Access Authentication. | |
136 | ||
137 | =item B<USER_REGEX> | |
138 | ||
139 | A regex that matches valid usernames. Usernames must be at least 2 characters, at most 20 characters, and they may only contain word characters (C<[A-Za-z0-9_]>). | |
140 | ||
141 | =item B<INVALID_USER> | |
142 | ||
143 | Exception thrown if the username does not match C<USER_REGEX>. | |
144 | ||
145 | =item B<BAD_PASSWORD> | |
146 | ||
147 | Exception thrown if the password is different from the one stored in the user's yml file. | |
148 | ||
149 | =item B<PASSPHRASE_VERSION> | |
150 | ||
151 | The version of the passphrase. It is incremented each time the passphrase hashing scheme is changed. Versions so far: | |
152 | ||
153 | =over | |
154 | ||
155 | =item Version 1 B<(current)> | |
156 | ||
157 | Uses C<Authen::Passphrase::BlowfishCrypt> with a cost factor of 10 | |
158 | ||
159 | =back | |
160 | ||
161 | =back | |
162 | ||
7c87e995 MG |
163 | =head1 ENVIRONMENT |
164 | ||
165 | =over | |
166 | ||
167 | =item AAP_ROOTDIR | |
168 | ||
169 | If the C<rootdir> is not explicitly set, it is taken from this environment variable. | |
170 | ||
171 | =back | |
172 | ||
f4cc782b MG |
173 | =head1 AUTHOR |
174 | ||
175 | Marius Gavrilescu, E<lt>marius@ieval.roE<gt> | |
176 | ||
177 | =head1 COPYRIGHT AND LICENSE | |
178 | ||
179 | Copyright (C) 2013 by Marius Gavrilescu | |
180 | ||
181 | This library is free software; you can redistribute it and/or modify | |
182 | it under the same terms as Perl itself, either Perl version 5.14.2 or, | |
183 | at your option, any later version of Perl 5 you may have available. | |
184 | ||
185 | ||
186 | =cut |