X509 authentication class. It can be used as a driver for auth_mad as auth method is defined. It also holds some helper methods to be used by oneauth command
# File lib/opennebula/x509_auth.rb, line 45 def self.escape_dn(dn) dn.gsub(/\s/) { |s| "\\"+s[0].ord.to_s(16) } end
Initialize x509Auth object
@param [Hash] default options for path @option options [String] :certs_pem
cert chain array in colon-separated pem format
@option options [String] :key_pem
key in pem format
@option options [String] :ca_dir
directory of trusted CA's. Needed for auth method, not for login.
# File lib/opennebula/x509_auth.rb, line 63 def initialize(options={}) @options ||= X509_DEFAULTS @options.merge!(options) load_options(X509_AUTH_CONF_PATH) @cert_chain = @options[:certs_pem].collect do |cert_pem| OpenSSL::X509::Certificate.new(cert_pem) end if @options[:key_pem] @key = OpenSSL::PKey::RSA.new(@options[:key_pem]) end end
Server side
auth method for auth_mad
# File lib/opennebula/x509_auth.rb, line 123 def authenticate(user, pass, signed_text) begin # Decryption demonstrates that the user posessed the private key. _user, expires = decrypt(signed_text).split(':') return "User name missmatch" if user != _user return "x509 proxy expired" if Time.now.to_i >= expires.to_i # Some DN in the chain must match a DN in the password dn_ok = @cert_chain.each do |cert| if pass.split('|').include?( self.class.escape_dn(cert.subject.to_s)) break true end end unless dn_ok == true return "Certificate subject missmatch" end validate return true rescue => e return e.message end end
Creates the login file for x509 authentication at ~/.one/one_x509. By default it is valid as long as the certificate is valid. It can be changed to any number of seconds with expire parameter (sec.)
# File lib/opennebula/x509_auth.rb, line 85 def login(user, expire=0) write_login(login_token(user,expire)) end
Generates a login token in the form: user_name:x509:user_name:time_expires:cert_chain
- user_name:time_expires is encrypted with the user certificate - user_name:time_expires:cert_chain is base64 encoded
# File lib/opennebula/x509_auth.rb, line 99 def login_token(user, expire) if expire != 0 expires = Time.now.to_i + expire.to_i else expires = @cert_chain[0].not_after.to_i end text_to_sign = "#{user}:#{expires}" signed_text = encrypt(text_to_sign) certs_pem = @cert_chain.collect{|cert| cert.to_pem}.join(":") token = "#{signed_text}:#{certs_pem}" token64 = Base64::encode64(token).strip.delete("\n") login_out = "#{user}:#{token64}" login_out end
Generated with the Darkfish Rdoc Generator 2.