OpenNebula

    x509_login_desc = <<-EOT.unindent

        Generates an X509-based authenication proxy based on a user certificate.

        oneauth x509_login <username> [<lifetime in seconds>]

    EOT

    command 'x509_login', x509_login_desc, :userid, :lifetime do

        user=args[0]

        time=args[1]

        if time

            time=time.to_i

        else

            time=3600

        end

        x509=X509Auth.new

        x509.login(user, time)

        exit_with_code 0

    end

    host_login_desc = <<-EOT.unindent

        Generates an X509-based authenication proxy based on a host certificate.

        oneauth host_login [<username>] [<lifetime in seconds>] [<login_file>]

    EOT

    command 'host_login', host_login_desc, :userid, :lifetime :loginfile do

        user=args[0]

        time=args[1]

	login_file=args[2]

        if !user

            user='oneadmin'

        end

        if time

            time=time.to_i

        else

            time=0

        end

        if !login_file

            login_file=''

        end

        x509=X509Auth.new

        x509.host_login(login_file, time, user)

        exit_with_code 0

    end

end

	    string plain_tok = "plain:";

            if(pass.find(plain_tok) == 0)

	    {

	        size_t pt_length = plain_tok.length();

                if(pass.length() == pt_length)

		{

		    throw runtime_error("Empty password for auth token in the form "

                                    "<username>:plain:<password>");

		}

		else

		{

		    string plain_pass = pass.substr(pt_length);

                    one_auth = user + ":" + plain_pass;

		}

	    }

	    else

	    {

	        string sha1_pass = SSLTools::sha1_digest(pass);

                one_auth = user + ":" + sha1_pass;

	    }

ONE_LOCATION = ENV["ONE_LOCATION"]

if !ONE_LOCATION

    LOG_LOCATION = "/var/log/one"

    VAR_LOCATION = "/var/lib/one"

    RUBY_LIB_LOCATION = "/usr/lib/one/ruby"

    ETC_LOCATION="/etc/one/"

else

    VAR_LOCATION = ONE_LOCATION+"/var"

    LOG_LOCATION = ONE_LOCATION+"/var"

    RUBY_LIB_LOCATION = ONE_LOCATION+"/lib/ruby"

    ETC_LOCATION=ONE_LOCATION+"/etc/"

end

$: << RUBY_LIB_LOCATION

$: << File.dirname(__FILE__)

require 'models/OpenNebulaJSON'

require 'openssl'

require 'base64'

    def self.load_config (config=nil)   

        if (config == nil)          

	    default_hostkey = '/etc/grid-security/hostkey.pem'

	    auth_conf = ETC_LOCATION+'/auth/auth.conf'

	    if File.readable?(auth_conf)

                config_data=File.read(auth_conf)

	        config=YAML::load(config_data)

	        if !config[:hostkey]

                    config[:hostkey] = default_hostkey

                end

	    else

                default_config = ":hostkey: " + default_hostkey

                config=YAML.load(default_config)

	    end	

	end

	return config

    end

    def self.authorize(user="", sha1_pass="", env="")

        failed = 'Authentication failed. '

        # For https, the web service should be set to include the user cert in the environment.

	cert_line_in = env['HTTP_SSL_CLIENT_CERT']

        if cert_line_in ==""

	    # Use the secret key for authentication.

            if user.empty? || sha1_pass.empty?

                return [401, false]

            end

            user_pass   =  user_pool["USER[NAME=\"#{user}\"]/PASSWORD"]

            user_id     =  user_pool["USER[NAME=\"#{user}\"]/ID"]

            user_gid    =  user_pool["USER[NAME=\"#{user}\"]/GID"]

            user_gname  =  user_pool["USER[NAME=\"#{user}\"]/GNAME"]

            if user_pass == sha1_pass

                return [204, [user_id, user_gid, user_gname]]

            else

                return [401, nil]

            end

	else

        #  Use the https credentials for authentication

            # Get the DN from the certificate

            begin

                cert_array=cert_line_in.scan(/([^\s]*)\s/)

                cert_array = cert_array[2..-3]

                cert_array.unshift('-----BEGIN CERTIFICATE-----').push('-----END CERTIFICATE-----')

                user_cert = cert_array.join("\n")

                user_cert = OpenSSL::X509::Certificate.new(user_cert)

		subjectname = user_cert.subject.to_s

                subjectname_nosp = subjectname.gsub(/\s/, '')

            rescue

                return [401, failed + "Could not create X509 certificate from " + user_cert]

            end

            # Check that the DN corresponds to the password of a user

            begin

                username = user_pool["USER[PASSWORD=\"#{subjectname_nosp}\"]/NAME"]

	        if (username == nil)

	            # Check if the DN is part of a |-separted multi-DN password

	            user_elts = Array.new

	            user_pool.each {|e| user_elts << e['PASSWORD']}

	            multiple_users = user_elts.select {|e| e=~ /\|/ }

	            matched = nil

	            multiple_users.each do |e|

	               e.to_s.split('|').each do |w|

	                   if (w == subjectname_nosp)

	                       matched=e

		               break

	                   end

	               end

	               break if matched

	            end

	            if matched

	                password = matched.to_s

	            end

                    username = user_pool["USER[PASSWORD=\"#{password}\"]/NAME"]

	        end	

            rescue

                return [401, failed + "User with DN " + subjectname + " not found."]

            end

	    config = self.load_config

	    hostkey_path = config[:hostkey]

            # Sign the message and compose the special login token

            # Get the host private key

            begin

                host_cert = File.read(hostkey_path)

            rescue

                return [401, failed + "Could not read " + hostkey_path]

            end

            begin

                host_cert_array=host_cert.split("\n")

                begin_lines=host_cert_array.select{|l| l.match(/BEGIN RSA PRIVATE KEY/)}

                begin_index=host_cert_array.index(begin_lines[0])

                begin_line=host_cert_array[begin_index].to_s

                end_lines=host_cert_array.select{|l| l.match(/END RSA PRIVATE KEY/)}

                end_index=host_cert_array.index(end_lines[0])

                end_line=host_cert_array[end_index].to_s

                host_key_array=host_cert_array[begin_index..end_index]

                private_key=host_key_array.join("\n")

            rescue

                return [401, failed + "Could not get private key from " + hostkey_path]

            end

            begin

                rsa=OpenSSL::PKey::RSA.new(private_key)

            rescue

                return [401, failed + "Could not create RSA key from " + hostkey_path]

            end

            # Sign with timestamp

            time=Time.now.to_i+7*24*3600

            text_to_sign="#{username}:#{subjectname}:#{time}"

            begin

                special_token=Base64::encode64(rsa.private_encrypt(text_to_sign)).gsub!(/\n/, '').strip

            rescue

                return [401, failed + "Could not create host-signed token for " + subjectname]

            end

            user_id     =  user_pool["USER[NAME=\"#{user}\"]/ID"]

            user_gid    =  user_pool["USER[NAME=\"#{user}\"]/GID"]

            user_gname  =  user_pool["USER[NAME=\"#{user}\"]/GNAME"]

            return [204, [user_id, user_gid, user_gname, "#{username}", "host-signed:#{special_token}}"]]

    end    

            rc = SunstoneServer.authorize(user, sha1_pass, request.env)

                if rc[1][3]

                    session[:user]     = rc[1][3]

                else

                    session[:user]     = user

                end

                if rc[1][4]

                    session[:password] = rc[1][4]

                else

                    session[:password] = sha1_pass

                end

    if authorized?

        time = Time.now + 60

        response.set_cookie("one-user",

        response.set_cookie("one-user_id",

        p = SunstonePlugins.new

        @plugins = p.authorized_plugins(session[:user], session[:user_gname])

        erb :index

    else

        cert_line_in = env['HTTP_SSL_CLIENT_CERT']

        if cert_line_in ==""

            redirect '/login'

        else

            encoded_login = ["dummy:dummy"].pack("m*")

            env['HTTP_AUTHORIZATION'] =  "Basic #{encoded_login}"

            rc = build_session

            if rc[0] == 204

                redirect "https://#{request.host}:#{request.port}/"

            else

                redirect "https://#{request.host}:#{request.port}/login"

            end

        end

    end