Merge branch 'release_1.101'

Author: aploshay

app/controllers/sessions_controller.rb

@@ -1,50 +1,55 @@
 # Does not inherit from ApplicationController to avoid requiring sign-in here
 class SessionsController < ActionController::Base
   require 'net/http'
-
-  def cas_reg
-    "https://cas-reg.uits.iu.edu"
-  end
-  def cas
-    "https://cas.iu.edu"
-  end
-
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
   include SessionsHelper
+  before_action :set_cas_ticket, only: [:new, :validate_login]
+  before_action :set_cas_user, only: [:validate_login]
 
   def new
-    redirect_to("#{cas}/cas/login?cassvc=ANY&casurl=#{root_url}sessions/validate_login")
+    @cas_ticket.present? ? validate_login : redirect_to(cas_url(:login, service: secure_root_url))
   end
 
   def validate_login
-    @casticket=params[:casticket]
-    uri = URI.parse("#{cas}/cas/validate?cassvc=ANY&casticket=#{@casticket}&casurl=#{root_url}")
-    request = Net::HTTP.new(uri.host, uri.port)
-    request.use_ssl = true
-    request.verify_mode = OpenSSL::SSL::VERIFY_NONE
-    response = request.get("#{cas}/cas/validate?cassvc=ANY&casticket=#{@casticket}&casurl=#{root_url}")
-    @resp = response.body
-    if @resp.slice(0,3) == 'yes'
-      @resp_true = @resp.slice(0,3)
-      @nlength=@resp.length - 7
-      @resp_user=@resp.slice(5,@nlength)
-      if User.authenticate(@resp_user)
-        sign_in(@resp_user) 
-        redirect_back_or_to root_url
-      else
-        redirect_to "#{root_url}denied.html"
-      end
+    set_cas_user if @cas_user.blank?
+    if @cas_user.present? && User.authenticate(@cas_user)
+      sign_in(@cas_user) 
+      redirect_back_or_to secure_root_url
     else
-      @resp_true = @resp.slice(0,2)
-      redirect_to "#{root_url}denied.html"
+      redirect_to "#{secure_root_url}denied.html"
     end
   end
 
   def destroy
     sign_out
-    redirect_to 'https://cas.iu.edu/cas/logout'
+    redirect_to(cas_url(:logout))
   end
 
+  private
+    def cas_url(action = nil, **keywords)
+      url_string = Pod.config[:auth][:cas_host] + Pod.config[:auth]["cas_#{action}_url"].to_s
+      url_string += ("?" + keywords.map { |k, v| "#{k}=#{v}" }.join('&')) if keywords.any?
+      url_string
+    end
+
+    def set_cas_ticket
+      @cas_ticket = params[:ticket]
+    end
+
+    def set_cas_user
+      begin
+        uri = URI.parse(cas_url(:validate, ticket: @cas_ticket, service: secure_root_url))
+        request = Net::HTTP.new(uri.host, uri.port)
+        request.use_ssl = true
+        request.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        response = request.get(uri.to_s)
+        @resp = response.body
+        @xml = Nokogiri::XML(@resp)
+        @cas_user = @xml.xpath('/cas:serviceResponse/cas:authenticationSuccess/cas:user').text
+      rescue
+        @cas_user ||= ''
+      end
+    end
 end

app/helpers/sessions_helper.rb

@@ -24,7 +24,7 @@ def current_user
   def signed_in_user
     unless signed_in?
       store_location
-      redirect_to signin_url
+      redirect_to signin_url(ticket: params[:ticket])
     end
   end
 
@@ -37,11 +37,16 @@ def sign_out
   end
 
   def store_location
+    return if session[:return_to].present?
     session[:return_to] = request.url if request.get?
   end
 
-  def redirect_back_or_to(default=root_url)
+  def redirect_back_or_to(default = secure_root_url)
     redirect_to(session[:return_to] || default)
     session.delete(:return_to)
   end
+
+  def secure_root_url
+    root_url(protocol: :https)
+  end
 end

config/config.yml

@@ -1,9 +1,22 @@
+auth: &auth
+  cas_host: https://idp-stg.login.iu.edu
+  cas_login_url: /idp/profile/cas/login
+  cas_validate_url: /idp/profile/cas/serviceValidate
+  cas_logout_url: /idp/profile/cas/logout
+  cas_callback_url: /users/auth/cas/callback
+
 development:
+  auth:
+    <<: *auth
   filmdb_update_url: 'http://sycamore.dlib.indiana.edu:8527/services/update_batch/'
 
 test:
+  auth:
+    <<: *auth
   filmdb_update_url: 'http://sycamore.dlib.indiana.edu:8529/services/update_batch/'
 
 production:
+  auth:
+    <<: *auth
+    cas_host: https://idp.login.iu.edu
   filmdb_update_url: 'http://sycamore.dlib.indiana.edu:8528/services/update_batch/'
-

spec/controllers/sessions_controller_spec.rb

@@ -1,65 +1,119 @@
 describe SessionsController do
   before(:each) { request.env['HTTP_REFERER'] = 'source_page' }
+  let(:success) { 
+    '<?xml version="1.0" encoding="UTF-8"?>
+     <cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
+       <cas:authenticationSuccess>
+         <cas:user>web_admin</cas:user>
+       </cas:authenticationSuccess>
+      </cas:serviceResponse>' }
+  let(:failure) {
+    '<?xml version="1.0" encoding="UTF-8"?>
+     <cas:serviceResponse xmlns:cas="http://www.yale.edu/tp/cas">
+       <cas:authenticationFailure code=''INVALID_TICKET''>
+         E_TICKET_EXPIRED
+       </cas:authenticationFailure>
+     </cas:serviceResponse>' }
+  let(:secure_root_url) { root_url(protocol: :https) }
 
-  describe "#cas_reg" do
-    it "returns a cas-reg URL" do
-      expect(SessionsController.new.cas_reg).to match /https.*cas-reg/
-    end
-  end
-
-  describe "#cas" do
-    it "returns a cas URL" do
-      expect(SessionsController.new.cas_reg).to match /https.*cas/
+  describe "url helpers" do
+    describe "#cas" do
+      context "with no arguments" do
+        it "returns a cas service root URL" do
+          expect(SessionsController.new.send(:cas_url)).to match /https.*login/
+        end
+      end
+      context "with invalid action" do
+        it "returns a cas service root URL" do
+          expect(SessionsController.new.send(:cas_url, :foo)).to eq SessionsController.new.send(:cas_url)
+        end
+      end
+      context "with :logout" do
+        it "returns a cas service logout URL" do
+          expect(SessionsController.new.send(:cas_url, :logout)).to match /https.*login.*logout/
+        end
+      end
+      context "with :login" do
+        it "returns a cas service login URL" do
+          expect(SessionsController.new.send(:cas_url, :login, service: 'foo')).to match /https.*login.*login.*foo/
+        end
+      end
+      context "with :validate" do
+        it "returns a cas service login URL" do
+          expect(SessionsController.new.send(:cas_url, :validate, ticket: 'foo', service: 'bar')).to match /https.*login.*serviceValidate.*foo.*bar/
+        end
+      end
     end
   end
 
   describe "#new" do
     before(:each) do
-      stub_request(:get, /cas.iu.edu/).
+      stub_request(:get, /idp-stg.login.iu.edu/).
         with(headers: {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'User-Agent'=>'Ruby'}).
-        to_return(status: 200, body: "yes", headers: {})
+        to_return(status: 200, body: success, headers: {})
     end
     before(:each) { get :new }
-    let(:cas) { "https://cas.iu.edu" }
     it "redirects to cas login" do
-      expect(response).to redirect_to "#{cas}/cas/login?cassvc=ANY&casurl=#{root_url}sessions/validate_login"
+      expect(response).to redirect_to SessionsController.new.send(:cas_url, :login, service: secure_root_url)
     end
   end
   describe "#validate_login" do
-    context "with invalid casticket" do
+    context "with invalid ticket" do
       before(:each) do
-        stub_request(:get, /cas.iu.edu/).
+        stub_request(:get, /idp.*login.iu.edu/).
           with(headers: {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'User-Agent'=>'Ruby'}).
-          to_return(status: 200, body: "no", headers: {})
+          to_return(status: 200, body: failure, headers: {})
       end
-      before(:each) { get :validate_login, casticket: casticket }
-      let(:casticket) { 'foo' }
-      it "assigns @casticket" do
-        expect(assigns(:casticket)).to eq casticket
+      before(:each) { get :validate_login, ticket: cas_ticket }
+      let(:cas_ticket) { 'foo' }
+      it "assigns @cas_ticket" do
+        expect(assigns(:cas_ticket)).to eq cas_ticket
       end
-      it "assigns @resp=no" do
-        expect(assigns(:resp)).to match /^no/
+      it "assigns @cas_user blank" do
+        expect(assigns(:cas_user)).to be_blank
       end
       it "redirects to denial page" do
-        expect(response).to redirect_to "#{root_url}denied.html"
+        expect(response).to redirect_to "#{secure_root_url}denied.html"
       end
     end
-    context "with valid casticket" do
+    context "with invalid response" do
       before(:each) do
-        stub_request(:get, /cas.iu.edu/).
+        stub_request(:get, /idp.*login.iu.edu/).
           with(headers: {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'User-Agent'=>'Ruby'}).
-          to_return(status: 200, body: "yes--web_admin--", headers: {})
+          to_return(status: 200, body: 'non-parsing response', headers: {})
+      end
+      before(:each) { get :validate_login, ticket: cas_ticket }
+      let(:cas_ticket) { 'foo' }
+      it "assigns @cas_ticket" do
+        expect(assigns(:cas_ticket)).to eq cas_ticket
+      end
+      it "assigns @cas_user blank" do
+        expect(assigns(:cas_user)).to be_blank
+      end
+      it "redirects to denial page" do
+        expect(response).to redirect_to "#{secure_root_url}denied.html"
+      end
+    end
+    context "with valid ticket" do
+      before(:each) do
+        stub_request(:get, /idp.*login.iu.edu/).
+          with(headers: {'Accept'=>'*/*', 'Accept-Encoding'=>'gzip;q=1.0,deflate;q=0.6,identity;q=0.3', 'User-Agent'=>'Ruby'}).
+          to_return(status: 200, body: success, headers: {})
+      end
+      before(:each) { get :validate_login, ticket: cas_ticket }
+      after(:each) do
+        sign_out
+        Thread.current[:current_username] = nil
       end
-      before(:each) { get :validate_login, casticket: casticket }
-      let(:casticket) { 'valid' }
-      it "assigns @casticket" do
-        expect(assigns(:casticket)).to eq casticket
+      let(:cas_ticket) { 'valid' }
+      it "assigns @cas_ticket" do
+        expect(assigns(:cas_ticket)).to eq cas_ticket
       end
-      it "assigns @resp=yes" do
-        expect(assigns(:resp)).to match /^yes/
+      it "assigns @cas_user" do
+        expect(assigns(:cas_user)).not_to be_blank
       end
-      it "redirects to root_url" do
-        expect(response).to redirect_to root_url
+      it "redirects to secure_root_url" do
+        expect(response).to redirect_to secure_root_url
       end
     end
   end
@@ -72,9 +126,9 @@
       destroy_session
       expect(session[:username]).to be_nil
     end
-    it "redirects to 'https://cas.iu.edu/cas/logout'" do
+    it "redirects to logout service'" do
       destroy_session
-      expect(response).to redirect_to 'https://cas.iu.edu/cas/logout'
+      expect(response).to redirect_to SessionsController.new.send(:cas_url, :logout)
     end
   end
 

spec/helpers/sessions_helper_spec.rb

@@ -71,7 +71,7 @@
       expect(session[:return_to]).to eq 'http://test.host'
     end
   end
-  describe "#redirect_back_or_to(default=root_url)" do
+  describe "#redirect_back_or_to(default = secure_root_url)" do
     context "with a session[:return_to]" do
       before(:each) { session[:return_to] = 'http://test.host' }
       skip "cannot directly test redirect_to in helper test"

spec/models/user_spec.rb

@@ -95,11 +95,11 @@
   end
 
   describe ".current_username=" do
+    after(:each) { Thread.current[:current_username] = nil }
     it "sets Thread.current[:current_username]" do
       expect(Thread.current[:current_username]).to be_nil
       User.current_username = "test_user"
       expect(Thread.current[:current_username]).to eq "test_user" 
-      Thread.current[:current_username] = nil
     end
   end