Apache::AuthenN2 - Authenticate into the NT and NIS+ domains

   #httpd.conf
   <Files *challenge*>
      AuthName 'your nt or nis+ account'
      AuthType Basic
      PerlSetVar NISPlus_Passwd_Table passwd.org_dir.yoyodyne.com
      PerlSetVar NISPlus_Group_Table group.org_dir.yoyodyne.com
      PerlSetVar NT_Default_Domains 'eng corporate'
      PerlSetVar NT_Controllers 'bapdc:babdc njpdc:njbdc'
      PerlAuthenHandler Apache::AuthenN2
      require group eng
      require user john larry
   </Files>

   PerlModule Apache::AuthenCache
   <Files *challenge*>
      AuthName 'your nt or nis+ account'
      AuthType Basic
      PerlSetVar NISPlus_Passwd_Table passwd.org_dir.yoyodyne.com
      PerlSetVar NISPlus_Group_Table group.org_dir.yoyodyne.com
      PerlSetVar NT_Default_Domains 'eng corporate'
      PerlSetVar NT_Controllers 'bapdc:babdc nypdc:nybdc'
      PerlSetVar AuthenCache_casesensitive off
      PerlAuthenHandler Apache::AuthenCache Apache::AuthenN2 Apache::AuthenCache::manage_cache
      require group eng
      require user john larry
   </Files>

package Apache::AuthenN2;

use strict;
use Apache::Constants qw/:common/;
use vars qw/%ENV/;
use Authen::Smb;
use Net::NISPlus::Table;

$Apache::AuthenN2::VERSION = '0.06';
my $self="Apache::AuthenN2";

sub handler {

   # get request object
   my $r = shift;

   # service only the first internal request
   return OK unless $r->is_initial_req;

   # get password user entered in browser
   my($res, $sent_pwd) = $r->get_basic_auth_pw;

   # decline if not basic
   return $res if $res;

   # get user name
   my $name = $r->connection->user;

   # blank user name would cause problems
   unless($name){
      $r->note_basic_auth_failure;
      $r->log_reason($self . ': no username supplied', $r->uri);
      return AUTH_REQUIRED;
   }

   # load apache config vars
   my $dir_config = $r->dir_config;   

   # get nt controllers
   my $controllers = $r->dir_config('NT_Controllers') || '';
   $r->log_reason(
      $self . ': no NT_Controllers specified in config', $r->uri
   ) unless $controllers;
   my @controllers = split /\s+/, $controllers;
   
   # get nt domain name
   my @domains;
   if ($name =~ /^.*\\/){
      # user-specified domain name
      @domains = split /\\/, $name;
      $name = pop @domains;
   }
   else{
      # get list of default domains from config
      @domains = split /\s+/, $r->dir_config('NT_Default_Domains');
      $r->log_reason(
         $self . 
         ': user did not specify domain, and there are no NT_Default_Domains specified in config', $r->uri
      ) unless @domains;
   }

   # try nt
   my ($pdc, $bdc);
   foreach my $domain (@domains){
      foreach my $controller (@controllers){
         ($pdc, $bdc) = split /:/, $controller;
         $bdc = $pdc unless $bdc;
         unless (Authen::Smb::authen($name, $sent_pwd, $pdc, $bdc, $domain)){
            $r->push_handlers(PerlAuthzHandler => \&authz);
            return OK;
         }
      }
   }

   # try nis+
   # get passwd table name
   my $passwd_table = $dir_config->get('NISPlus_Passwd_Table');
   # get user password entry
   my $pwd_table = Net::NISPlus::Table->new($passwd_table);
   unless ($pwd_table){
      $r->note_basic_auth_failure;
      $r->log_reason($self . ': cannot get nis+ passwd table', $r->uri);
      return AUTH_REQUIRED;
   }
   my $pwd = '';
   my $group = '';
   # look for name match
   foreach ($pwd_table->lookup('[name=' . $name . ']')){
      $pwd = $_->{'passwd'};
      $group = $_->{'gid'};
      last;
   }
   # stash group id lookup for authorization check 
   $r->notes($name . 'Group', $group);
   unless($pwd){
      $r->note_basic_auth_failure;
      $r->log_reason(
         $self . ': user ' . $name .
         ' failed to authenticate in the nt domain(s) ' .
         join(' ', @domains) . ', and is not in ' . $passwd_table .
         ', either', $r->uri
      );
      return AUTH_REQUIRED;
   }
   unless(crypt($sent_pwd, $pwd) eq $pwd) {
      $r->note_basic_auth_failure;
      $r->log_reason(
         $self . ': user ' . $name .
         ' failed to authenticate in the nt domain(s) ' .
         join(' ', @domains) . ', or ' . $passwd_table, $r->uri
      );
      return AUTH_REQUIRED;
   }

   $r->push_handlers(PerlAuthzHandler => \&authz);
   return OK;
}

sub authz {
 
   # get request object
   my $r = shift;
   my $requires = $r->requires;
   return OK unless $requires;

   # get user name
   my $name = $r->connection->user;

   # get group table name
   my $dir_config = $r->dir_config;   
   my $group_table=$dir_config->get('NISPlus_Group_Table');

   for my $req (@$requires) {
      my($require, @rest) = split /\s+/, $req->{requirement};

      # ok if user is simply authenticated
      if($require eq 'valid-user'){return OK}

      # ok if user is one of these users
      elsif($require eq 'user') {return OK if grep $name eq $_, @rest}

      # ok if user is member of a required group. warning: this will fail 
      # if user is not in the nis+ domain, because there is no current
      # concept of nt domain groups in Authen::Smb
      elsif($require eq 'group') {
         my $group_table = Net::NISPlus::Table->new($group_table);
         unless ($group_table){
            $r->note_basic_auth_failure;
            $r->log_reason($self . ': cannot get nis+ group table', $r->uri);
            return AUTH_REQUIRED;
         }
         my %groups_to_gids;
         foreach ($group_table->list()){$groups_to_gids{@{$_}[0]} = @{$_}[2]}
         for my $group (@rest) {
            next unless exists $groups_to_gids{$group};
            return OK if $r->notes($name . 'Group') == $groups_to_gids{$group};
         }
      }
   }

   $r->note_basic_auth_failure;
   $r->log_reason(
      $self . ': user ' . $name . 
      ' not member of required group in ' . $group_table, $r->uri
   );
   return AUTH_REQUIRED;

}

1;

__END__