# File lib/mixlib/authentication/signatureverification.rb, line 53 def initialize(request=nil) @auth_request = HTTPAuthenticationRequest.new(request) if request @valid_signature, @valid_timestamp, @valid_content_hash = false, false, false @hashed_body = nil end
Takes the request, boils down the pieces we are interested in, looks up the user, generates a signature, and compares to the signature in the request
X-Ops-Sign: algorithm=sha1;version=1.0; X-Ops-UserId: <user_id> X-Ops-Timestamp: X-Ops-Content-Hash: X-Ops-Authorization-#{line_number}
# File lib/mixlib/authentication/signatureverification.rb, line 77 def authenticate_request(user_secret, time_skew=(15*60)) Mixlib::Authentication::Log.debug "Initializing header auth : #{request.inspect}" @user_secret = user_secret @allowed_time_skew = time_skew # in seconds begin parts = parse_signing_description # version 1.0 clients don't include their algorithm in the # signing description, so default to sha1 parts[:algorithm] ||= 'sha1' verify_signature(parts[:algorithm], parts[:version]) verify_timestamp verify_content_hash rescue StandardError=>se raise AuthenticationError,"Failed to authenticate user request. Check your client key and clock: #{se.message}", se.backtrace end if valid_request? SignatureResponse.new(user_id) else nil end end
# File lib/mixlib/authentication/signatureverification.rb, line 62 def authenticate_user_request(request, user_lookup, time_skew=(15*60)) @auth_request = HTTPAuthenticationRequest.new(request) authenticate_request(user_lookup, time_skew) end
The authorization header is a Base64-encoded version of an RSA signature. The client sent it on multiple header lines, starting at index 1 - X-Ops-Authorization-1, X-Ops-Authorization-2, etc. Pull them out and concatenate.
# File lib/mixlib/authentication/signatureverification.rb, line 125 def headers @headers ||= request.env.inject({ }) { |memo, kv| memo[$2.gsub(%r\-/,"_").downcase.to_sym] = kv[1] if kv[0] =~ %r^(HTTP_)(.*)/; memo } end
# File lib/mixlib/authentication/signatureverification.rb, line 113 def valid_content_hash? @valid_content_hash end
# File lib/mixlib/authentication/signatureverification.rb, line 117 def valid_request? valid_signature? && valid_timestamp? && valid_content_hash? end
# File lib/mixlib/authentication/signatureverification.rb, line 105 def valid_signature? @valid_signature end
# File lib/mixlib/authentication/signatureverification.rb, line 109 def valid_timestamp? @valid_timestamp end