jasonallen / ruote-rest Goto Github PK

** Note : most of this documentation got integrated into README.txt
   Thanks to Gonzalo and Nando for all their work ! **


This is a draft for a new authentication model in ruote-rest.

authors: Gonzalo <[email protected]>
         "Nando Sola"<[email protected]>

Our main goal was to avoid storing passwords in plain text (conf/authentication.yaml)
All authentication info is stored in "ruoterest_#{stage}" - The following tables are created 

USERS (inspired by ruote-web2)
+------------+--------------+------+-----+---------+----------------+
| Field      | Type         | Null | Key | Default | Extra          |
+------------+--------------+------+-----+---------+----------------+
| id         | int(11)      | NO   | PRI | NULL    | auto_increment | 
| login      | varchar(255) | YES  | UNI | NULL    |                | 
| name       | varchar(255) | YES  | MUL | NULL    |                | 
| password   | varchar(255) | YES  |     | NULL    |                | 
| email      | varchar(255) | YES  | MUL | NULL    |                | 
| created_at | datetime     | YES  | MUL | NULL    |                | 
| updated_at | datetime     | YES  | MUL | NULL    |                | 
+------------+--------------+------+-----+---------+----------------+

HOSTS (IP whitelisting and ToD filter)
+---------+--------------+------+-----+---------+----------------+
| Field   | Type         | Null | Key | Default | Extra          |
+---------+--------------+------+-----+---------+----------------+
| id      | int(11)      | NO   | PRI | NULL    | auto_increment | 
| ip      | varchar(255) | YES  |     | NULL    |                | 
| trusted | varchar(255) | YES  |     | NULL    |                | 
| from    | varchar(255) | YES  |     | NULL    |                | 
| to      | varchar(255) | YES  |     | NULL    |                | 
+---------+--------------+------+-----+---------+----------------+

Passwords
---------
So far, we've successfully implemented the following password storage schemes:

  * {SSHA}
  * {SMD5}
  * {...} It's easily extensible

An 8-byte salt is included in the b64 passwd string (a la Directory Server)


Hosts table:
------------
attributes:
* 'ip': as for now, every host making requests to ruote-rest must be stored in this table.
* 'trusted': 'false' or 'true' for whitelist inclussion, thus disabling ToD and user/passwd checks.
* 'from' - 'to': Time of Day filter. Set a valid interval to use ruote-rest or NULL.

Included files:
---------------
./newauth-ruoterest
  +tasks
    authmodel.rake
    +fixtures
      users.yml
      hosts.yml
  +test
    test_newauth.rb
  README
  +conf
    auth_models.rb
    password.rb
    auth.rb

Usage:
------
git clone git://github.com/jmettraux/ruote-rest.git
cp newauth.tar ruote-rest; tar xvf newauth.tar

edit Rakefile:
     50 load 'tasks/ruote.rake'
     51 load 'tasks/mysql.rake'
---> 52 load 'tasks/authmodel.rake'

edit tasks/fixtures/hosts.yaml and make sure everything looks OK

gem install rest-client in order to run our tests
rake ruote:install

edit conf/database.yaml and tasks/mysql.rake and make the appropriate changes to db_name, :user and :passwd

rake mysql:setup; rake authmodel:setup; rake authmodel:fixtures

Now lets rock!
ruby lib/start.rb & or daemonize

Now we can roll the unit tests:
cd test
ruby test_newauth.rb - they aren't complete yet, but the main features are tested. 

Test users:
-----------
username: charly, bob, admin, alice
password: secret

Test hosts:
-----------

st_01:
    id: 1
    ip: "192.168.168.1"
    trusted: false 
    from: 9 
    to: 17

host_02:
    id: 2
    ip: "192.168.168.128"
    trusted: false
    from: NULL 
    to: NULL

host_03:
    id: 3
    ip: "127.0.0.1"
    trusted: true
    from: NULL 
    to: NULL

******
Feel free to play with them, i.e. adding/deleting/modifying on the fly.
If you wanna use a real REST client from a remote host, try: http://code.google.com/p/rest-client/

******
Post any suggestions/corrections at the list

    http://groups.google.com/group/openwferu-users

Thanks John for this great project