Parent

Mixlib::Authentication::SignatureVerification

Public Class Methods

new(request=nil) click to toggle source
# File lib/mixlib/authentication/signatureverification.rb, line 53
def initialize(request=nil)
  @auth_request = HTTPAuthenticationRequest.new(request) if request

  @valid_signature, @valid_timestamp, @valid_content_hash = false, false, false

  @hashed_body = nil
end

Public Instance Methods

authenticate_request(user_secret, time_skew=(15*60)) click to toggle source

Takes the request, boils down the pieces we are interested in, looks up the user, generates a signature, and compares to the signature in the request

Headers

X-Ops-Sign: algorithm=sha1;version=1.0; X-Ops-UserId: <user_id> X-Ops-Timestamp: X-Ops-Content-Hash: X-Ops-Authorization-#{line_number}

# File lib/mixlib/authentication/signatureverification.rb, line 77
def authenticate_request(user_secret, time_skew=(15*60))
  Mixlib::Authentication::Log.debug "Initializing header auth : #{request.inspect}"

  @user_secret       = user_secret
  @allowed_time_skew = time_skew # in seconds

  begin
    parts = parse_signing_description

    # version 1.0 clients don't include their algorithm in the
    # signing description, so default to sha1
    parts[:algorithm] ||= 'sha1'

    verify_signature(parts[:algorithm], parts[:version])
    verify_timestamp
    verify_content_hash

  rescue StandardError=>se
    raise AuthenticationError,"Failed to authenticate user request. Check your client key and clock: #{se.message}", se.backtrace
  end

  if valid_request?
    SignatureResponse.new(user_id)
  else
    nil
  end
end
authenticate_user_request(request, user_lookup, time_skew=(15*60)) click to toggle source
# File lib/mixlib/authentication/signatureverification.rb, line 62
def authenticate_user_request(request, user_lookup, time_skew=(15*60))
  @auth_request = HTTPAuthenticationRequest.new(request)
  authenticate_request(user_lookup, time_skew)
end
headers() click to toggle source

The authorization header is a Base64-encoded version of an RSA signature. The client sent it on multiple header lines, starting at index 1 - X-Ops-Authorization-1, X-Ops-Authorization-2, etc. Pull them out and concatenate.

# File lib/mixlib/authentication/signatureverification.rb, line 125
def headers
  @headers ||= request.env.inject({ }) { |memo, kv| memo[$2.gsub(/\-/,"_").downcase.to_sym] = kv[1] if kv[0] =~ /^(HTTP_)(.*)/; memo }
end
valid_content_hash?() click to toggle source
# File lib/mixlib/authentication/signatureverification.rb, line 113
def valid_content_hash?
  @valid_content_hash
end
valid_request?() click to toggle source
# File lib/mixlib/authentication/signatureverification.rb, line 117
def valid_request?
  valid_signature? && valid_timestamp? && valid_content_hash?
end
valid_signature?() click to toggle source
# File lib/mixlib/authentication/signatureverification.rb, line 105
def valid_signature?
  @valid_signature
end
valid_timestamp?() click to toggle source
# File lib/mixlib/authentication/signatureverification.rb, line 109
def valid_timestamp?
  @valid_timestamp
end

[Validate]

Generated with the Darkfish Rdoc Generator 2.