Merge lp:~fallenpegasus/drizzle/auth_http into lp:~drizzle-trunk/drizzle/development

[Mark Atwood]

[Mark Atwood (fallenpegasus)]

Authenticate against an HTTP server

Adds
--auth-http-enable=true
--auth-http-url=http://example.com/test/

Requires current rev of libdrizzle so that the password is not hashed

=== added directory 'plugin/auth_http'
=== added file 'plugin/auth_http/AUTHORS'
--- plugin/auth_http/AUTHORS	1970-01-01 00:00:00 +0000
+++ plugin/auth_http/AUTHORS	2009-04-08 01:22:11 +0000
@@ -0,0 +1,2 @@
+Brian Aker <[e-mail]>
+Mark Atwood <[e-mail]>
\ No newline at end of file

=== added file 'plugin/auth_http/ChangeLog'
--- plugin/auth_http/ChangeLog	1970-01-01 00:00:00 +0000
+++ plugin/auth_http/ChangeLog	2009-04-08 01:22:11 +0000
@@ -0,0 +1,2 @@
+0.1
+  - Added

=== added file 'plugin/auth_http/Makefile.am'
--- plugin/auth_http/Makefile.am	1970-01-01 00:00:00 +0000
+++ plugin/auth_http/Makefile.am	2009-04-08 01:22:11 +0000
@@ -0,0 +1,13 @@
+if BUILD_AUTH_HTTP
+
+EXTRA_LTLIBRARIES = libauth_http.la
+pkgplugin_LTLIBRARIES =	@plugin_auth_http_shared_target@
+libauth_http_la_LDFLAGS = -module -avoid-version -rpath $(pkgplugindir)
+libauth_http_la_CPPFLAGS = $(AM_CPPFLAGS) -DDRIZZLE_DYNAMIC_PLUGIN
+libauth_http_la_SOURCES = auth_http.cc
+
+EXTRA_LIBRARIES = libauth_http.a
+noinst_LIBRARIES = @plugin_auth_http_static_target@
+libauth_http_a_SOURCES = $(libauth_http_la_SOURCES)
+
+endif

=== added file 'plugin/auth_http/auth_http.cc'
--- plugin/auth_http/auth_http.cc	1970-01-01 00:00:00 +0000
+++ plugin/auth_http/auth_http.cc	2009-04-08 01:22:11 +0000
@@ -0,0 +1,146 @@
+/*
+ -*- mode: c++; c-basic-offset: 2; indent-tabs-mode: nil; -*-
+ *  vim:expandtab:shiftwidth=2:tabstop=2:smarttab:
+*/
+
+#include <drizzled/server_includes.h>
+#include <drizzled/session.h>
+#include <drizzled/plugin/authentication.h>
+#include <drizzled/gettext.h>
+
+#include <curl/curl.h>
+
+CURL *curl_handle;
+
+static bool sysvar_auth_http_enable= false;
+static char* sysvar_auth_http_url= NULL;
+
+size_t curl_cb_read(void *ptr, size_t size, size_t nmemb, void *stream)
+{
+  (void) ptr;
+  (void) stream;
+  return (size * nmemb);
+}
+
+
+class Auth_http : public Authentication
+{
+public:
+  virtual bool authenticate(Session *session, const char *password)
+  {
+    CURLcode rv;
+    long http_response_code;
+
+    if (sysvar_auth_http_enable == false)
+      return true;
+
+    assert(session->security_ctx.user.c_str());
+    assert(password);
+
+    // turn off curl stuff that might mess us up
+    rv= curl_easy_setopt(curl_handle, CURLOPT_NOPROGRESS, 1);
+    rv= curl_easy_setopt(curl_handle, CURLOPT_NOSIGNAL, 1);
+    rv= curl_easy_setopt(curl_handle, CURLOPT_VERBOSE, 0);
+
+    // do a HEAD instead of a default GET
+    rv= curl_easy_setopt(curl_handle, CURLOPT_NOBODY, 1);
+
+    // set the read callback.  this shouldnt get called, because we are doing a HEAD
+    rv= curl_easy_setopt(curl_handle, CURLOPT_READFUNCTION, curl_cb_read);
+
+    // set the parameters: url, username, password
+    rv= curl_easy_setopt(curl_handle, CURLOPT_URL, sysvar_auth_http_url);
+    rv= curl_easy_setopt(curl_handle, CURLOPT_USERNAME, session->security_ctx.user.c_str());
+    rv= curl_easy_setopt(curl_handle, CURLOPT_PASSWORD, password);
+
+    // do it
+    rv= curl_easy_perform(curl_handle);
+
+    // what did we get? goes into http_response_code
+    rv= curl_easy_getinfo(curl_handle, CURLINFO_RESPONSE_CODE, &http_response_code);
+
+    // so here is an interesting question.
+    // return true if the response_code is 2XX, or return false if its 4XX
+    // for now, return false for 401, true otherwise
+    // this means that if the url breaks, then anyone can log in
+    // this might be the wrong thing
+
+    if (http_response_code == 401)
+      return false;
+    return true;
+  }
+};
+
+static int initialize(void *p)
+{
+  Authentication **auth= static_cast<Authentication **>(p);
+
+  CURLcode rv;
+
+  *auth= new Auth_http();
+
+  // we are trusting that plugin initializers are called singlethreaded at startup
+  // if something else also calls curl_global_init() in a threadrace while we are here,
+  // we will crash the server. 
+  curl_handle= curl_easy_init();
+
+  rv= curl_easy_setopt(curl_handle, CURLOPT_NOPROGRESS, 1);
+  rv= curl_easy_setopt(curl_handle, CURLOPT_NOSIGNAL, 1);
+  rv= curl_easy_setopt(curl_handle, CURLOPT_NOBODY, 1);
+
+  return 0;
+}
+
+static int finalize(void *p)
+{
+  Auth_http *auth= static_cast<Auth_http *>(p);
+
+  if (auth)
+    delete auth;
+
+  curl_easy_cleanup(curl_handle);
+
+  return 0;
+}
+
+static DRIZZLE_SYSVAR_BOOL(
+  enable,
+  sysvar_auth_http_enable,
+  PLUGIN_VAR_NOCMDARG,
+  N_("Enable HTTP Auth check"),
+  NULL, /* check func */
+  NULL, /* update func */
+  false /* default */);
+
+
+static DRIZZLE_SYSVAR_STR(
+  url,
+  sysvar_auth_http_url,
+  PLUGIN_VAR_READONLY,
+  N_("URL for HTTP Auth check"),
+  NULL, /* check func */
+  NULL, /* update func*/
+  "http://localhost/" /* default */);
+
+static struct st_mysql_sys_var* auth_http_system_variables[]= {
+  DRIZZLE_SYSVAR(enable),
+  DRIZZLE_SYSVAR(url),
+  NULL
+};
+
+
+drizzle_declare_plugin(auth_http)
+{
+  DRIZZLE_AUTH_PLUGIN,
+  "auth_http",
+  "0.1",
+  "Mark Atwood",
+  "PAM based authenication.",
+  PLUGIN_LICENSE_GPL,
+  initialize, /* Plugin Init */
+  finalize, /* Plugin Deinit */
+  NULL,   /* status variables */
+  auth_http_system_variables,
+  NULL    /* config options */
+}
+drizzle_declare_plugin_end;

=== added file 'plugin/auth_http/configure.in'
--- plugin/auth_http/configure.in	1970-01-01 00:00:00 +0000
+++ plugin/auth_http/configure.in	2009-04-08 01:22:11 +0000
@@ -0,0 +1,7 @@
+AC_INIT(auth_http, 0.1)
+AM_INIT_AUTOMAKE
+AC_DISABLE_STATIC
+AC_PROG_LIBTOOL
+AC_CONFIG_FILES([Makefile])
+AC_OUTPUT
+

=== added file 'plugin/auth_http/plug.in'
--- plugin/auth_http/plug.in	1970-01-01 00:00:00 +0000
+++ plugin/auth_http/plug.in	2009-04-08 01:22:11 +0000
@@ -0,0 +1,18 @@
+DRIZZLE_PLUGIN(auth_http,[HTTP Authentication Plugin],
+        [HTTP based authentications])
+DRIZZLE_PLUGIN_DYNAMIC(auth_http, [libauth_http.la])
+DRIZZLE_PLUGIN_STATIC(auth_http, [libauth_http.a])
+DRIZZLE_PLUGIN_MANDATORY(auth_http)  dnl Default
+
+DRIZZLE_PLUGIN_ACTIONS(auth_http, [
+  AC_LIB_HAVE_LINKFLAGS(curl,,
+    [#include <curl/curl.h>],
+    [
+      CURL *handle;
+      handle=curl_easy_init();
+    ])
+    AS_IF([test "x$ac_cv_libcurl" = "xno"],
+          AC_MSG_WARN([libcurl not working: not building auth_http plugin]))
+  DRIZZLED_PLUGIN_DEP_LIBS="${DRIZZLED_PLUGIN_DEP_LIBS} ${LIBCURL}"
+  AM_CONDITIONAL(BUILD_AUTH_HTTP,[test "${ac_cv_libcurl}" = "yes"])
+])

=== modified file 'po/POTFILES.in'
--- po/POTFILES.in	2009-04-01 01:00:08 +0000
+++ po/POTFILES.in	2009-04-08 01:22:11 +0000
@@ -37,6 +37,7 @@
 mysys/errors.cc
 mysys/my_error.cc
 mysys/my_getopt.cc
+plugin/auth_http/auth_http.cc
 plugin/errmsg_stderr/errmsg_stderr.cc
 plugin/logging_gearman/logging_gearman.cc
 plugin/logging_query/logging_query.cc