/usr/share/perl5/CGI/Application/Plugin/Authentication/Driver.pm is in libcgi-application-plugin-authentication-perl 0.20-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 | package CGI::Application::Plugin::Authentication::Driver;
use strict;
use warnings;
our $VERSION = '0.20';
use UNIVERSAL::require;
=head1 NAME
CGI::Application::Plugin::Authentication::Driver - Base module for building driver classes
for CGI::Application::Plugin::Authentication
=head1 VERSION
This document describes CGI::Application::Plugin::Authentication::Driver version 0.20
=head1 SYNOPSIS
package CGI::Application::Plugin::Authentication::Driver::MyDriver;
use base qw(CGI::Application::Plugin::Authentication::Driver);
sub verify_credentials {
my $self = shift;
my @credentials = @_;
if ( >>> Validate Credentials <<< ) {
return $credentials[0];
}
return;
}
=head1 DESCRIPTION
This module is a base class for all driver classes for the L<CGI::Application::Plugin::Authentication>
plugin. Each driver class is required to provide only one method to validate the given credentials.
Normally only two credentials will be passed in (username and password), but you can configure the plugin
to handle any number of credentials (for example you may require the user to enter a group name, or domain name
as well as a username and password).
=head1 FIELD FILTERS
It is quite common for passwords to be stored using some form of one way encryption. Unix crypt being the
old standard in the Unix community, however MD5 or SHA1 hashes are more popular today. In order to
simplify the validation routines some methods have been provided to help test these passwords. When
configuring a Driver (and if the driver supports it), you can specify which fields are encoded, and which
method is used for the encoding by specifying a filter on the field in question.
CREDENTIALS => ['authen_username', 'authen_password'],
DRIVERS => [ 'DBI',
DSN => '...',
TABLE => 'users',
CONSTRAINTS => {
username => '__CREDENTIAL_1__',
'MD5:password' => '__CREDENTIAL_2__',
}
],
Here we are saying that the password field is encoded using an MD5 hash, and should be checked accordingly.
=head2 Filter options
Some of the filters may have multiple forms. For example there are three forms of MD5 hashes: binary, base64 and hex.
You can specify these extra options by using an underscore to separate it from the filter name.
'MD5_base64:password'
=head2 Chained Filters
it is possible to chain multiple filters. This can be useful if your MD5 strings are stored in hex format. Hex numbers are
case insensitive, so the may be stored in either upper or lower case. To make this consistent, you can MD5 encode the
password first, and then upper case the results. The filters are applied from the inside out:
'uc:MD5_hex:password'
=head2 Custom Filters
If your field is encoded using a custom technique, then you can provide a custom filter function. This can be
be done by providing a FILTERS option that contains a hash of filter subroutines that are keyed by their name.
You can then use the filter name on any of the fields as if it was a builtin filter.
CREDENTIALS => ['authen_username', 'authen_password'],
DRIVERS => [ 'DBI',
DSN => '...',
TABLE => 'users',
CONSTRAINTS => {
username => '__CREDENTIAL_1__',
'rot13:password' => '__CREDENTIAL_2__',
}
FILTERS => { rot13 => \&rot13_filter },
],
sub rot13_filter {
my $param = shift;
my $value = shift;
$value =~ tr/A-Za-z/N-ZA-Mn-za-m/;
return $value;
}
Please see the documentation for the driver that you are using to make sure that it supports encoded
fields.
=head2 Builtin Filters
Here is a list of the filters that are provided with this module:
=over 4
=item crypt - provided by perl C<crypt> function
=item MD5 - requires Digest::MD5
=item SHA1 - requires Digest::SHA1
=item uc - provided by the perl C<uc> function
=item lc - provided by the perl C<lc> function
=item trim - removed whitespace from the start and end of the field
=back
=head1 METHODS
=head2 new
This is a constructor that can create a new Driver object. It requires an Authentication object as its
first parameter, and any number of other parameters that will be used as options depending on which
Driver object is being created. You shouldn't need to call this as the Authentication plugin takes care
of creating Driver objects.
=cut
sub new {
my $class = shift;
my $self = {};
my $authen = shift;
my @options = @_;
bless $self, $class;
$self->{authen} = $authen;
Scalar::Util::weaken($self->{authen}); # weaken circular reference
$self->{options} = \@options;
$self->initialize;
return $self;
}
=head2 initialize
This method will be called right after a new Driver object is created. So any startup customizations
can be dealt with here.
=cut
sub initialize {
my $self = shift;
# override this in the subclass if you need it
return;
}
=head2 options
This will return a list of options that were provided when this driver was configured by the user.
=cut
sub options { return (@{$_[0]->{options}}) }
=head2 authen
This will return the underlying L<CGI::Application::Plugin::Authentication> object. In most cases it will
not be necessary to access this.
=cut
sub authen { return $_[0]->{authen} }
=head2 find_option
This method will search the Driver options for a specific key and return
the value it finds.
=cut
sub find_option {
my $self = shift;
my $key = shift;
my @options = $self->options;
my $marker = 0;
foreach my $option (@options) {
if ($marker) {
return $option;
} elsif ($option eq $key) {
# We need the next element
$marker = 1;
}
}
return;
}
=head2 verify_credentials
This method needs to be provided by the driver class. It needs to be an object method that accepts a list of
credentials, and will verify that the credentials are valid, and return a username that will be used to identify
this login (usually you will just return the value of the first credential, however you are not bound to that)..
=cut
sub verify_credentials {
die "verify_credentials must be implemented in the subclass";
}
=head2 filter
This method can be used to filter a field (usually password fields) using a number of standard or
custom encoding techniques. See the section on Builtin Filters above to see what filters are available
When using a custom filter, you will need to provide a FILTERS option in the configuration of the DRIVER (See the
section on FIELD FILTERS above for an example). By default, if no filter is specified, it is
returned as is. This means that you can run all fields through this function even if they
don't have any filters to simplify the driver code.
my $filtered = $self->filter('MD5_hex:password', 'foobar');
- or -
# custom filter
my $filtered = $self->filter('foobar:password', 'foo');
- or -
# effectively a noop
my $filtered = $self->filter('username', 'foo');
=cut
sub filter {
my $self = shift;
my $field = shift;
my $plain = shift;
my @other = shift;
return unless defined $plain;
my @filters = split /\:/, $field;
my $fieldname = pop @filters;
my $filtered = $plain;
foreach my $filter (reverse @filters) {
my ($filter_name, $param) = split /_/, $filter;
my $class = 'CGI::Application::Plugin::Authentication::Driver::Filter::' . lc $filter_name;
if ( $class->require ) {
# found a filter
$filtered = $class->filter( $param, $filtered, @other );
} else {
# see if the configuration has a custom filter defined
my $custom_filters = $self->find_option('FILTERS');
if ( $custom_filters ) {
die "the FILTERS configuration option must be a hashref"
unless ref( $custom_filters ) eq 'HASH';
if ( $custom_filters->{$filter_name} ) {
die "the '$filter' filter listed in FILTERS must be a subroutine reference"
unless ref( $custom_filters->{$filter_name} ) eq 'CODE';
$filtered = $custom_filters->{$filter_name}->( $param, $filtered, @other );
} else {
die "No filter found for '$filter_name'";
}
} else {
die "No filters found for '$filter'";
}
}
}
return $filtered;
}
=head2 check_filtered
This method can be used to test filtered fields (usually password fields) against a number of standard or
custom encoding techniques. The following encoding techniques are provided: plain, MD5, SHA1, crypt.
When using a custom encoder, you will need to provide it in the configuration of the DRIVERS (See the
section on ENCODED PASSWORDS above for an example). By default, if no encoding is specified, it is
assumed to be 'plain'. This means that you can run all fields through this function even if they
don't have any encoding to simplify the driver code.
my $verified = $self->check_filtered('MD5:password', 'foobar', 'OFj2IjCsPJFfMAxmQxLGPw');
- or -
# custom encoder
my $verified = $self->check_filtered('foobar:password', 'foo', 'bar');
- or -
# a field that isn't filtered (effectively just checks for equality on second and third args)
my $verified = $self->check_filtered('username', 'foobar', 'foobar');
my $verified = $self->check_filtered('plain:username', 'foobar', 'foobar');
=cut
sub check_filtered {
my $self = shift;
my $field = shift;
my $plain = shift;
my $filtered = shift;
return ($self->filter($field, $plain, $filtered) eq $filtered) ? 1 : 0;
}
=head2 strip_field_names
This method will take a field name (or list of names) and strip off the leading encoding type.
For example if you passed in 'MD5:password' the method would return 'password'.
my $fieldname = $self->strip_field_names('MD5:password');
=cut
sub strip_field_names {
my $self = shift;
my @fields = @_;
foreach (@fields) {
s/^.*://;
}
if (wantarray()) {
return @fields;
} else {
return $fields[0];
}
}
=head1 SEE ALSO
L<CGI::Application::Plugin::Authentication>, perl(1)
=head1 AUTHOR
Cees Hek <ceeshek@gmail.com>
=head1 LICENCE AND COPYRIGHT
Copyright (c) 2005, SiteSuite. All rights reserved.
This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.
=head1 DISCLAIMER OF WARRANTY
BECAUSE THIS SOFTWARE IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE SOFTWARE, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE SOFTWARE "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE SOFTWARE IS WITH YOU. SHOULD THE SOFTWARE PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE SOFTWARE AS PERMITTED BY THE ABOVE LICENCE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE SOFTWARE (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE SOFTWARE TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
=cut
1;
|