Metacat

#!/usr/bin/perl -w

 #

 #  '$RCSfile$'

 #  Copyright: 2001 Regents of the University of California

 #

 #   '$Author$'

 #     '$Date$'

 # '$Revision$'

 #

 # This program is free software; you can redistribute it and/or modify

 # it under the terms of the GNU General Public License as published by

 # the Free Software Foundation; either version 2 of the License, or

 # (at your option) any later version.

 #

 # This program is distributed in the hope that it will be useful,

 # but WITHOUT ANY WARRANTY; without even the implied warranty of

 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 # GNU General Public License for more details.

 #

 # You should have received a copy of the GNU General Public License

 # along with this program; if not, write to the Free Software

 # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 #

#

# This is a web-based application for allowing users to register a new

# account for Metacat access.  We currently only support LDAP even

# though metacat could potentially support other types of directories.

#

use strict;       # turn on strict syntax checking.

use Template;     # load the template-toolkit module.

use CGI;          # load the CGI module.

use Net::LDAP;    # load the LDAP net libraries

use Net::SMTP;    # load the SMTP net libraries

use Digest::SHA1; # for creating the password hash

use MIME::Base64; # for creating the password hash

use URI;          # for parsing URL syntax

use AppConfig qw(:expand :argcount);

# Set up our default configuration

my $ldapurl = "@ldapurl@";

my $rootpw = "@password@";

my $searchBase = "@ldapSearchBase@";

my $templatesDir = "@templates.dir@";

my $mailhost = "@mailhost@";

my $sender = "@sender@";

# Get the CGI input variables

my $query = new CGI;

my $debug = 0;

#--------------------------------------------------------------------------80c->

# Set up the Template Toolkit to read html form templates

# set some configuration options for the template object

my $config_templates = {

             INCLUDE_PATH => $templatesDir,

             INTERPOLATE  => 0,

             POST_CHOMP   => 1,

             };

# create an instance of the template

my $template = Template->new($config_templates) || die $Template::ERROR, "\n";

# Read the ldapweb.cfg file

my $config = AppConfig->new({

    GLOBAL => { ARGCOUNT => ARGCOUNT_ONE, } });

$config->define("ldapurl", { ARGCOUNT => ARGCOUNT_HASH} );

$config->define("ldapsearchbase", { ARGCOUNT => ARGCOUNT_HASH} );

$config->define("dn", { ARGCOUNT => ARGCOUNT_HASH} );

$config->define("filter", { ARGCOUNT => ARGCOUNT_HASH} );

$config->define("user", { ARGCOUNT => ARGCOUNT_HASH} );

$config->define("password", { ARGCOUNT => ARGCOUNT_HASH} );

my $cfgfile = "ldapweb.cfg";

$config->file($cfgfile);

my $config_ldapurl = $config->get('ldapurl');

my $config_ldapsearchbase = $config->get('ldapsearchbase');

my $config_dn = $config->get('dn');

my $config_filter = $config->get('filter');

my $config_user = $config->get('user');

my $config_password = $config->get('password');

my @orglist;

foreach my $neworg (keys %$config_dn) {

    push(@orglist, $neworg);

    debug($neworg);

}

#--------------------------------------------------------------------------80c->

# Define the main program logic that calls subroutines to do the work

#--------------------------------------------------------------------------80c->

# The processing step we are handling

my $stage = $query->param('stage') || '@defaultStage@';

my $cfg = $query->param('cfg');

# define the possible stages

my %stages = (

              'initregister'      => \&handleInitRegister,

              'register'          => \&handleRegister,

              'registerconfirmed' => \&handleRegisterConfirmed,

              'simplesearch'      => \&handleSimpleSearch,

              'initaddentry'      => \&handleInitAddEntry,

              'addentry'          => \&handleAddEntry,

              'initmodifyentry'   => \&handleInitModifyEntry,

              'modifyentry'       => \&handleModifyEntry,

              'initchangepass'    => \&handleInitialChangePassword,

# call the appropriate routine based on the stage

if ( $stages{$stage} ) {

  $stages{$stage}->();

} else {

  &handleResponseMessage();

}

#--------------------------------------------------------------------------80c->

# Define the subroutines to do the work

#--------------------------------------------------------------------------80c->

#

# create the initial registration form

#

sub handleInitRegister {

  my $vars = shift;

  print "Content-type: text/html\n\n";

  # process the template files:

  my $templateVars = { stage => "register", cfg => $cfg };

  $template->process( "@defaultHeader@", $templateVars);

  $template->process( "@register@", $templateVars);

  $template->process( "@defaultFooter@", $templateVars);

  exit();

}

#

# process input from the register stage, which occurs when

# a user submits form data to create a new account

#

sub handleRegister {

    print "Content-type: text/html\n\n";

    my $allParams = { 'givenName' => $query->param('givenName'),

                      'sn' => $query->param('sn'),

                      'o' => $query->param('o'),

                      'mail' => $query->param('mail'),

                      'uid' => $query->param('uid'),

                      'userPassword' => $query->param('userPassword'),

                      'userPassword2' => $query->param('userPassword2'),

                      'title' => $query->param('title'),

                      'telephoneNumber' => $query->param('telephoneNumber') };

    # Check that all required fields are provided and not null

    my @requiredParams = ( 'givenName', 'sn', 'o', 'mail',

                           'uid', 'userPassword', 'userPassword2');

    if (! paramsAreValid(@requiredParams)) {

        my $errorMessage = "Required information is missing. " .

            "Please fill in all required fields and resubmit the form.";

        my $templateVars = { stage => "register",

                             cfg => $cfg,

                             allParams => $allParams,

                             errorMessage => $errorMessage };

        $template->process( "@register@", $templateVars);

        $template->process( "@defaultFooter@", $templateVars);

        exit(0);

    } else {

        $ldapurl = $config_ldapurl->{$o};

        $searchBase = $config_ldapsearchbase->{$o};

    # Search LDAP for matching entries that already exist

    # Some forms use a single text search box, whereas others search per

    # attribute.

    my $filter;

    if ($query->param('searchField')) {

      $filter = "(|" .

                "(uid=" . $query->param('searchField') . ") " .

                "(mail=" . $query->param('searchField') . ")" .

                "(&(sn=" . $query->param('searchField') . ") " .

                "(givenName=" . $query->param('searchField') . "))" .

                ")";

    } else {

      $filter = "(|" .

                "(uid=" . $query->param('uid') . ") " .

                "(mail=" . $query->param('mail') . ")" .

                "(&(sn=" . $query->param('sn') . ") " .

                "(givenName=" . $query->param('givenName') . "))" .

                ")";

    }

    my @attrs = [ 'uid', 'o', 'cn', 'mail', 'telephoneNumber', 'title' ];

    my $found = findExistingAccounts($ldapurl, $searchBase, $filter, \@attrs);

    # If entries match, send back a request to confirm new-user creation

    if ($found) {

      my $templateVars = { stage => "registerconfirmed",

                           cfg => $cfg,

                           allParams => $allParams,

                           foundAccounts => $found };

      $$templateVars{'orgList'} = \@orglist;

      $template->process( "@defaultHeader@", $templateVars);

      $template->process( "@registerMatch@", $templateVars);

      $template->process( "@register@", $templateVars);

      $template->process( "@defaultFooter@", $templateVars);

    # Otherwise, create a new user in the LDAP directory

    } else {

    }

    exit();

}

#

# process input from the registerconfirmed stage, which occurs when

# a user chooses to create an account despite similarities to other

# existing accounts

#

sub handleRegisterConfirmed {

    my $allParams = { 'givenName' => $query->param('givenName'),

                      'sn' => $query->param('sn'),

                      'o' => 'unaffiliated',

                      'uid' => $query->param('uid'),

                      'userPassword' => $query->param('userPassword'),

                      'userPassword2' => $query->param('userPassword2'),

                      'title' => $query->param('title'),

                      'telephoneNumber' => $query->param('telephoneNumber') };

    print "Content-type: text/html\n\n";

    createAccount($allParams);

    exit();

}

#

# change a user's password upon request

#

sub handleChangePassword {

    print "Content-type: text/html\n\n";

    my $allParams = { 'test' => "1", };

    if ($query->param('uid')) {

        $$allParams{'uid'} = $query->param('uid');

    }

    if ($query->param('o')) {

        $$allParams{'o'} = $query->param('o');

        $ldapurl = $config_ldapurl->{$o};

    }

    # Check that all required fields are provided and not null

    my @requiredParams = ( 'uid', 'o', 'oldpass',

                           'userPassword', 'userPassword2');

    if (! paramsAreValid(@requiredParams)) {

        my $errorMessage = "Required information is missing. " .

            "Please fill in all required fields and submit the form.";

        my $templateVars = { stage => "changepass",

                             cfg => $cfg,

                             allParams => $allParams,

                             errorMessage => $errorMessage };

        $template->process( "@defaultChangePass@", $templateVars);

        $template->process( "@defaultFooter@", $templateVars);

        exit(0);

    }

    # We have all of the info we need, so try to change the password

    if ($query->param('userPassword') =~ $query->param('userPassword2')) {

        $ldapurl = $config_ldapurl->{$o};

        $rootpw = $config_password->{$o};

        my $dn = "uid=" . $query->param('uid') . "," . $config_dn->{$o};;

        if ($query->param('o') =~ "LTER") {

            $template->process( "@defaultHeader@");

            $template->process( "@registerLter@");

            $template->process( "@defaultFooter@");

        } else {

            my $errorMessage = changePassword(

                    $dn, $query->param('userPassword'),

                    $dn, $query->param('oldpass'), $query->param('o'));

                                     cfg => $cfg,

                                     allParams => $allParams,

                                     errorMessage => $errorMessage };

                $template->process( "@defaultChangePass@", $templateVars);

                $template->process( "@defaultFooter@", $templateVars);

                exit(0);

            } else {

                                     cfg => $cfg,

                                     allParams => $allParams };

                $$templateVars{'orgList'} = \@orglist;

                $template->process( "@defaultHeader@", $templateVars);

                $template->process( "@changePassSuccess@", $templateVars);

                $template->process( "@defaultFooter@", $templateVars);

            }

        }

    } else {

        my $errorMessage = "The passwords do not match. Try again.";

        my $templateVars = { stage => "changepass",

                             cfg => $cfg,

                             allParams => $allParams,

                             errorMessage => $errorMessage };

        $template->process( "@defaultChangePass@", $templateVars);

        $template->process( "@defaultFooter@", $templateVars);

        exit(0);

    }

}

#

# only display chagepass template without any error

#

sub handleInitialChangePassword {

    print "Content-type: text/html\n\n";

    my $allParams = { 'test' => "1", };

    my $errorMessage = "";

    my $templateVars = { stage => "changepass",

                         cfg => $cfg,

                         allParams => $allParams,

                         errorMessage => $errorMessage };

    $$templateVars{'orgList'} = \@orglist;

    $template->process( "@defaultHeader@", $templateVars);

    $template->process( "@defaultChangePass@", $templateVars);

    $template->process( "@defaultFooter@", $templateVars);

    exit(0);

}

#

#

sub handleResetPassword {

    print "Content-type: text/html\n\n";

    my $allParams = { 'test' => "1", };

    if ($query->param('uid')) {

        $$allParams{'uid'} = $query->param('uid');

    }

    if ($query->param('o')) {

        $$allParams{'o'} = $query->param('o');

        $ldapurl = $config_ldapurl->{$o};

        $rootpw = $config_password->{$o};

    # Check that all required fields are provided and not null

    my @requiredParams = ( 'uid', 'o' );

    if (! paramsAreValid(@requiredParams)) {

        my $errorMessage = "Required information is missing. " .

            "Please fill in all required fields and submit the form.";

        my $templateVars = { stage => "resetpass",

                             cfg => $cfg,

                             allParams => $allParams,

                             errorMessage => $errorMessage };

        $template->process( "@defaultResetPass@", $templateVars);

        $template->process( "@defaultFooter@", $templateVars);

        exit(0);

    }

    # We have all of the info we need, so try to change the password

    my $o = $query->param('o');

    my $dn = "uid=" . $query->param('uid') . "," . $config_dn->{$o};

    if ($query->param('o') =~ "LTER") {

        $template->process( "@defaultHeader@");

        $template->process( "@registerLter@");

        $template->process( "@defaultFooter@");

        exit(0);

    } else {

        my $errorMessage = "";

        my $recipient;

        my $userPass;

        my $entry = getLdapEntry($ldapurl, $searchBase,

                $query->param('uid'), $query->param('o'));

        if ($entry) {

            $recipient = $entry->get_value('mail');

            $userPass = getRandomPassword();

            $errorMessage = changePassword($dn, $userPass, $root, $rootpw, $query->param('o'));

        } else {

            $errorMessage = "User not found in database.  Please try again.";

        }

        if ($errorMessage) {

            my $templateVars = { stage => "resetpass",

                                 cfg => $cfg,

                                 allParams => $allParams,

                                 errorMessage => $errorMessage };

            $template->process( "@defaultResetPass@", $templateVars);

            $template->process( "@defaultFooter@", $templateVars);

            exit(0);

        } else {

            my $errorMessage = sendPasswordNotification($query->param('uid'),

                                 cfg => $cfg,

                                 allParams => $allParams,

                                 errorMessage => $errorMessage };

            $template->process( "@resetPassSuccess@", $templateVars);

            $template->process( "@defaultFooter@", $templateVars);

            exit(0);

        }

    }

}

#

# only display resetpass template without any error

#

sub handleInitialResetPassword {

    print "Content-type: text/html\n\n";

    my $errorMessage = "";

    my $allParams = { 'test' => "1", };

    my $templateVars = { stage => "resetpass",

                         cfg => $cfg,

                         allParams => $allParams,

                         errorMessage => $errorMessage };

    $$templateVars{'orgList'} = \@orglist;

    $template->process( "@defaultHeader@", $templateVars);

    $template->process( "@defaultResetPass@", $templateVars);

    $template->process( "@defaultFooter@", $templateVars);

    exit(0);

}

#

#

sub getRandomPassword {

    my $length = shift;

    if (!$length) {

        $length = 8;

    }

    my $newPass = "";

    my @chars = ( "A" .. "Z", "a" .. "z", 0 .. 9, qw(! @ $ ^) );

    $newPass = join("", @chars[ map { rand @chars } ( 1 .. $length ) ]);

    return $newPass;

}

#

# Change a password to a new value, binding as the provided user

#

sub changePassword {

    my $userDN = shift;

    my $userPass = shift;

    my $bindDN = shift;

    my $bindPass = shift;

    my $o = shift;

    my $ldapurl = $config_ldapurl->{$o};

    my $searchBase = $config_ldapsearchbase->{$o};

    my $errorMessage = 0;

    my $ldap = Net::LDAP->new($ldapurl) or die "$@";

                      #cafile => '/usr/share/ssl/ldapcerts/cacert.pem');

    $ldap->start_tls( verify => 'none');

                                  password => $bindPass );

    if ($bindresult->code) {

        $errorMessage = "Failed to log in. Are you sure your old " .

                        "password is correct? Try again...";

        return $errorMessage;

    }

    # Find the user here and change their entry

    my $newpass = createSeededPassHash($userPass);

    my $modifications = { userPassword => $newpass };

    my $result = $ldap->modify( $userDN, replace => { %$modifications });

    if ($result->code()) {

        my $errorMessage = "There was an error changing the password." .

                           "<br />\n" . $result->error;

    }

    $ldap->unbind;   # take down session

    return $errorMessage;

}

#

# generate a Seeded SHA1 hash of a plaintext password

#

sub createSeededPassHash {

    my $secret = shift;

    my $salt = "";

    for (my $i=0; $i < 4; $i++) {

        $salt .= int(rand(10));

    }

    my $ctx = Digest::SHA1->new;

    $ctx->add($secret);

    $ctx->add($salt);

    my $hashedPasswd = '{SSHA}' . encode_base64($ctx->digest . $salt ,'');

    return $hashedPasswd;

}

#

# Look up an ldap entry for a user

#

sub getLdapEntry {

    my $ldapurl = shift;

    my $base = shift;

    my $username = shift;

    my $org = shift;

    my $entry = "";

    my $mesg;

    my $ldap = Net::LDAP->new($ldapurl) or die "$@";

    if ($bindresult->code) {

        return $entry;

    }

    if($config_filter->{$org}){

                filter => "(&(uid=$username)($config_filter->{$org}))");

    if ($mesg->count > 0) {

        $entry = $mesg->pop_entry;

        $ldap->unbind;   # take down session

    } else {

        $ldap->unbind;   # take down session

        # Follow references by recursive call to self

        my @references = $mesg->references();

        for (my $i = 0; $i <= $#references; $i++) {

            my $uri = URI->new($references[$i]);

            my $host = $uri->host();

            my $path = $uri->path();

            $path =~ s/^\///;

            $entry = &getLdapEntry($host, $path, $username, $org);

            if ($entry) {

                return $entry;

            }

        }

    }

    return $entry;

}

#

# send an email message notifying the user of the pw change

#

sub sendPasswordNotification {

    my $username = shift;

    my $org = shift;

    my $newPass = shift;

    my $recipient = shift;

    my $errorMessage = "";

    if ($recipient) {

        # Send the email message to them

        my $smtp = Net::SMTP->new($mailhost);

        $smtp->mail($sender);

        $smtp->to($recipient);

        my $message = <<"        ENDOFMESSAGE";

        To: $recipient

        From: $sender

        Subject: KNB Password Reset

        Somebody (hopefully you) requested that your KNB password be reset.

        This is generally done when somebody forgets their password.  Your

        password can be changed by visiting the following URL:

            Username: $username

        Organization: $org

        New Password: $newPass

        Thanks,

            The KNB Development Team

        ENDOFMESSAGE

        $message =~ s/^[ \t\r\f]+//gm;

        $smtp->data($message);

        $smtp->quit;

    } else {

        $errorMessage = "Failed to send password because I " .

                        "couldn't find a valid email address.";

    }

    return $errorMessage;

}

#

# search the LDAP directory to see if a similar account already exists

#

sub findExistingAccounts {

    my $ldapurl = shift;

    my $base = shift;

    my $filter = shift;

    my $attref = shift;

    my $foundAccounts = 0;

    if ($ldapurl =~ $mainldapurl){

        #if main ldap server is down, a html file containing warning message will be returned

        $ldap = Net::LDAP->new($ldapurl, timeout => $TIMEOUT) or handleMainLdapServerFailure();

    }

    else{

        #if a referral ldap server is down, we will ignore it silently

        $ldap = Net::LDAP->new($ldapurl, timeout => $TIMEOUT) or return;