File Coverage

lib/Mojolicious/Plugin/SPNEGO.pm

Criterion	Covered	Total	%
statement	12	70	17.1
branch	0	44	0.0
condition	0	22	0.0
subroutine	4	6	66.6
pod	1	1	100.0
total	17	143	11.8

package Mojolicious::Plugin::SPNEGO;
use Mojo::Base 'Mojolicious::Plugin';
use Net::LDAP::SPNEGO;
use IO::Socket::Timeout;
use Mojo::Util qw(b64_decode);
our $VERSION = '0.5.4';

my %cCache;

sub register {
    my $self = shift;
    my $app = shift;
    my $plugin_cfg = shift;

    $app->helper(
        ntlm_auth => sub {
            my $c = shift;
            my $helper_cfg = ref ${_}[0] eq 'HASH' ? ${_}[0] : { @_ };
            my $cfg = { %$plugin_cfg, %$helper_cfg };
            my $cId = $c->tx->connection;

            my $authorization = $c->req->headers->header(($cfg->{web_proxy_mode} ? 'Proxy-' : '' ) .'Authorization') // '';
            my ($AuthBase64) = ($authorization =~ /^NTLM\s(.+)$/);
            # $c->app->log->debug("AuthBase64: $AuthBase64") if $AuthBase64;

            my $cCache = $cCache{$cId} //= {
                status => $AuthBase64 ? 'expectType1' : 'init'
            };
            return 1 if $cCache->{status} eq 'authenticated';

            my ($status) = ($cCache->{status} =~ /^expect(Type[13])/);
            # $c->app->log->debug("status: $status") if $status;

            if ($AuthBase64 and $status){
                for ($status){
                    my $timeout = $cfg->{timeout} // 10;
                    my $ldap = $cCache->{ldapObj};
                    if (not $ldap) {
                        $ldap = $cCache->{ldapObj} = Net::LDAP::SPNEGO->new(
                            $cfg->{ad_server},
                            debug=>($cfg->{ldap_debug}//$ENV{SPNEGO_LDAP_DEBUG}//0),
                            onerror=> sub { my $msg = shift;
                                $c->log->error("LDAP ERROR: " . $msg->error);
                                return $msg
                            },
                            timeout=>$timeout,
                            verify => $cfg->{verify} // 'none'
                        ) or return 0;
                        if ($ldap->uri !~ m{^ldaps://}){
                            my $msg;
                            if ($cfg->{verify}){
                                $msg = $ldap->start_tls(verify => $cfg->{verify});
                            }
                            elsif ($cfg->{start_tls}){
                                $msg = $ldap->start_tls($cfg->{start_tls});
                            }
                            if ($msg and $msg->is_error()){
                                $c->log->error($msg->error);
                                return 0;
                            }
                        }
                        # Read/Write timeouts via setsockopt
                        my $socket = $ldap->socket(sasl_layer=>0);
                        IO::Socket::Timeout->enable_timeouts_on($socket);
                        $socket->read_timeout($timeout);
                        $socket->write_timeout($timeout);
                    }
                    /^Type1/ && do {
                        $c->app->log->debug("Bind Type1 ...");
                        my $mesg = $ldap->bind_type1($AuthBase64);
                        if ($mesg->{ntlm_type2_base64}){
                            $c->res->headers->header( ($cfg->{web_proxy_mode} ? 'Proxy' : 'WWW' ) . '-Authenticate' => 'NTLM '.$mesg->{ntlm_type2_base64});
                            $c->render( text => 'Waiting for Type3 NTLM Token', status => $cfg->{web_proxy_mode} ? 407 : 401);
                            $cCache->{status} = 'expectType3';
                            return 0;
                        }
                        # lets try with a new connection
                        $ldap->unbind;
                        delete $cCache->{ldapObj};
                    };
                    /^Type3/ && do {
                        $c->app->log->debug("Bind Type3 as user '".$ldap->_get_user_from_ntlm_type3(b64_decode($AuthBase64))."'");
                        my $mesg = $ldap->bind_type3($AuthBase64);
                        if (my $user = $mesg->{ldap_user_entry}){
                            if (my $cb = $cfg->{auth_success_cb}){
                                if (not $cb or $cb->($c,$user,$ldap)){
                                    $cCache->{status} = 'authenticated';
                                }
                            }
                        }
                        $ldap->unbind;
                        delete $cCache->{ldapObj};
                        return 1 if $cCache->{status} eq 'authenticated';
                    };
                }
            }
            $c->res->headers->header( ($cfg->{web_proxy_mode} ? 'Proxy' : 'WWW') . '-Authenticate' => 'NTLM' );
            $c->render( text => 'Waiting for Type 1 NTLM Token', status => $cfg->{web_proxy_mode} ? 407 : 401 );
            $cCache->{status} = 'expectType1';
            return 0;
        }
    );
}

1;

__END__