2016-01-30 13:26:14 +01:00
|
|
|
# PSGI authentication package written for Nginx. It replace
|
2017-02-16 08:37:40 +01:00
|
|
|
# Lemonldap::NG::Handler::Server to manage Nginx behaviour
|
2017-02-11 08:47:22 +01:00
|
|
|
package Lemonldap::NG::Handler::Server::Nginx;
|
2016-01-30 13:26:14 +01:00
|
|
|
|
|
|
|
use strict;
|
|
|
|
use Mouse;
|
2017-02-11 08:47:22 +01:00
|
|
|
use Lemonldap::NG::Handler::Server::Main;
|
2016-01-30 13:26:14 +01:00
|
|
|
|
|
|
|
extends 'Lemonldap::NG::Handler::PSGI';
|
|
|
|
|
2016-03-17 23:19:44 +01:00
|
|
|
sub init {
|
|
|
|
my $self = shift;
|
2017-02-11 08:47:22 +01:00
|
|
|
$self->api('Lemonldap::NG::Handler::Server::Main');
|
2016-04-04 22:39:22 +02:00
|
|
|
my $tmp = $self->SUPER::init(@_);
|
2016-03-17 23:19:44 +01:00
|
|
|
}
|
|
|
|
|
2016-01-31 23:53:23 +01:00
|
|
|
## @method void _run()
|
2016-01-30 13:26:14 +01:00
|
|
|
# Return a subroutine that call _authAndTrace() and tranform redirection
|
|
|
|
# response code from 302 to 401 (not authenticated) ones. This is required
|
|
|
|
# because Nginx "auth_request" parameter does not accept it. The Nginx
|
|
|
|
# configuration file should transform them back to 302 using:
|
|
|
|
#
|
|
|
|
# auth_request_set $lmlocation $upstream_http_location;
|
|
|
|
# error_page 401 $lmlocation;
|
|
|
|
#
|
|
|
|
#@return subroutine that will be called to manage FastCGI queries
|
|
|
|
sub _run {
|
|
|
|
my $self = shift;
|
|
|
|
return sub {
|
|
|
|
my $req = $_[0];
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug('New request');
|
2016-01-30 13:26:14 +01:00
|
|
|
my $res = $self->_authAndTrace(
|
2016-01-31 23:53:23 +01:00
|
|
|
Lemonldap::NG::Common::PSGI::Request->new($req) );
|
2016-01-30 13:26:14 +01:00
|
|
|
|
|
|
|
# Transform 302 responses in 401 since Nginx refuse it
|
|
|
|
if ( $res->[0] == 302 or $res->[0] == 303 ) {
|
|
|
|
$res->[0] = 401;
|
|
|
|
}
|
|
|
|
return $res;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
2016-02-11 07:00:35 +01:00
|
|
|
## @method PSGI-Response handler()
|
2016-01-30 13:26:14 +01:00
|
|
|
# Transform headers returned by handler main process:
|
|
|
|
# each "Name: value" is transformed to:
|
|
|
|
# - Headername<i>: Name
|
|
|
|
# - Headervalue<i>: value
|
|
|
|
# where <i> is an integer starting from 1
|
|
|
|
# It can be used in Nginx virtualhost configuration:
|
|
|
|
#
|
|
|
|
# auth_request_set $headername1 $upstream_http_headername1;
|
|
|
|
# auth_request_set $headervalue1 $upstream_http_headervalue1;
|
|
|
|
# #proxy_set_header $headername1 $headervalue1;
|
|
|
|
# # OR
|
|
|
|
# #fastcgi_param $fheadername1 $headervalue1;
|
|
|
|
#
|
2017-02-11 08:47:22 +01:00
|
|
|
# LLNG::Handler::Server::Main add also a header called Lm-Remote-User set to
|
2016-01-31 23:53:23 +01:00
|
|
|
# whatToTrace value that can be used in Nginx virtualhost configuration to
|
|
|
|
# insert user id in logs
|
2016-01-30 13:26:14 +01:00
|
|
|
#
|
|
|
|
# auth_request_set $llremoteuser $upstream_http_lm_remote_user
|
|
|
|
#
|
|
|
|
#@param $req Lemonldap::NG::Common::PSGI::Request
|
2016-02-11 07:00:35 +01:00
|
|
|
sub handler {
|
2016-01-30 13:26:14 +01:00
|
|
|
my ( $self, $req ) = @_;
|
2016-01-31 23:53:23 +01:00
|
|
|
my $hdrs = $req->{respHeaders};
|
2016-04-04 22:39:22 +02:00
|
|
|
$req->{respHeaders} = [];
|
2016-02-17 10:06:54 +01:00
|
|
|
my @convertedHdrs =
|
2017-01-04 17:36:54 +01:00
|
|
|
( 'Content-Length' => 0, Cookie => ( $req->env->{HTTP_COOKIE} // '' ) );
|
2016-01-30 13:26:14 +01:00
|
|
|
my $i = 0;
|
2016-04-29 09:27:26 +02:00
|
|
|
while ( my $k = shift @$hdrs ) {
|
2016-04-04 22:39:22 +02:00
|
|
|
my $v = shift @$hdrs;
|
2016-02-03 07:43:11 +01:00
|
|
|
if ( $k =~ /^(?:Lm-Remote-User|Cookie)$/ ) {
|
2016-04-04 22:39:22 +02:00
|
|
|
push @convertedHdrs, $k, $v;
|
2016-01-31 23:53:23 +01:00
|
|
|
}
|
|
|
|
else {
|
|
|
|
$i++;
|
2016-04-04 22:39:22 +02:00
|
|
|
push @convertedHdrs, "Headername$i", $k, "Headervalue$i", $v, $k,
|
|
|
|
$v;
|
2016-01-31 23:53:23 +01:00
|
|
|
}
|
2016-01-30 13:26:14 +01:00
|
|
|
}
|
|
|
|
return [ 200, \@convertedHdrs, [] ];
|
|
|
|
}
|
|
|
|
|
|
|
|
1;
|