File Coverage

blib/lib/Dancer2/Plugin/Auth/ActiveDirectory.pm

Criterion	Covered	Total	%
statement	43	43	100.0
branch	10	12	83.3
condition			n/a
subroutine	15	15	100.0
pod			n/a
total	68	70	97.1

package Dancer2::Plugin::Auth::ActiveDirectory;

=head1 NAME

Dancer2::Plugin::Auth::ActiveDirectory - Dancer2 plugin for MS ActiveDirectory

=head1 VERSION

Version 0.03

=cut

our $VERSION = '0.03';

use 5.10.0;
use strict;
use warnings FATAL => 'all';
use Dancer2::Plugin;
use Auth::ActiveDirectory;

# -----------------------------------------------
# Preloaded methods go here.
# -----------------------------------------------
# Encapsulated class data.
my $_settings = undef;

=head1 PRIVATE METHODS

=cut

{

=head2 _load_settings

Load plugin settings from environment.

=cut

    sub _load_settings() {
        return $_settings if $_settings;
        $_settings = plugin_setting;
        return $_settings;
    }

=head2 _in_list

Simple list in list comparision sub.

=cut

    sub _in_list {
        !!grep {
            exists { map { $_ => 1 } @{ $_[1] } }->{$_}
        } @{ $_[0] };
    }

=head2 _rights

Get defined rights from environment

=cut

    sub _rights { _load_settings->{rights} || {} }

=head2 _connect_to_ad

Creates a new L object including
ldap connection to AD server.

=cut

    sub _connect_to_ad {
        return Auth::ActiveDirectory->new( @{ [ %{ _load_settings() } ] } );
    }

=head2 _rights_by_user_groups

Returns a hashref with the possible rights.
Based on the AD groups where the user is included.

=cut

    sub _rights_by_user {
        my ( $dsl, $user ) = @_;
        return _rights_by_user_groups( $dsl, $user->{groups} );
    }

=head2 _rights_by_user_groups

Returns a hashref with the possible rights.
Based on the AD groups where the user is included.

=cut

    sub _rights_by_user_groups {
        my ( $dsl, $user_groups ) = @_;
        my $rights = _rights($dsl);
        return { map { _in_list( $user_groups, ( ref $rights->{$_} ne 'ARRAY' ) ? [ $rights->{$_} ] : $rights->{$_} ) ? ( $_ => 1 ) : () } keys %{$rights} };
    }
}

=head1 SYNOPSIS

Configuration:

    plugins:
      Auth::ActiveDirectory:
        host: 0.0.0.0
        principal: yourprincpal
        domain: somedomain
        rights:
          definedright1: ad-group
          definedright2: ad-group
          definedright3: another-ad-group
          definedright4: another-ad-group

Code:

    post '/login' => sub {
        session 'user' => authenticate( params->{user}, params->{pass} );
        return template 'index', { html_error => 'Authentication failed!!' }
            unless ( session('user') );
        return template 'index', { html_error => 'No right for this page!!' }
            if( !has_right( session('user'), 'definedright1') );
        template 'index', { loggedin => 1 };
    };

=head1 SUBROUTINES/METHODS

=head2 authenticate

Basicaly the subroutine for authentication in the ActiveDirectory

=cut

register authenticate => sub {
    my ( $dsl, $name, $pass ) = @_;
    my $user = _connect_to_ad($dsl)->authenticate( $name, $pass );
    return $user if $user->{error};
    my $user_groups = [ map { $_->name } @{ $user->groups } ];
    return {
        uid          => $user->uid,
        firstname    => $user->firstname,
        surname      => $user->surname,
        mail         => $user->mail,
        display_name => $user->display_name,
        user         => $user->user,
        groups       => $user_groups,
        rights       => _rights_by_user_groups( $dsl, $user_groups ),
    };
};

=head2 authenticate_config

Subroutine to get configuration for ActiveDirectory

=cut

register authenticate_config => \&_load_settings;

=head2 has_right

Check if loged in user has one of the configured rights

=cut

register has_right => sub {
    return $_[1]->{rights}->{ $_[2] } ? 1:0;
};

=head2 list_users

=cut

register list_users => sub { _connect_to_ad(shift)->list_users(@_) };

=head2 rights

Subroutine to get configurated rights

=cut

register rights => \&_rights;

=head2 rights_by_user

Subroutine to get configurated rights

=cut

register rights_by_user => sub { _rights_by_user( $_[0], $_[1] ) };

=head2 for_versions

=cut

register_plugin for_versions => [2];

1;    # Dancer2::Plugin::Auth::ActiveDirectory

__END__