MAN page from Old RedHat 7.X perl-Authen-Ticket-0.01-8.i386.rpm

Authen::Ticket::Server

Section: User Contributed Perl Documentation (3)
Updated: perl v5.6.0
Index

NAME

Authen::Ticket::Server - Perl extension for implementing ticket authentication.

DESCRIPTION

Authen::Ticket::Server is an abstract class which provides the skeleton uponwhich a full ticket issuing master authentication server may be built.With appropriate subroutine definitions, the resulting class may providedauthentication for either trusted or untrusted client sites.

The class may be used to implement a ticket server either asa mod_perl handler (see Authen::Ticket) or as a CGI script (using the object methods).

If the server class is a sub-class of Authen::Ticket::Signature (orcomparable class), the ticket will automatically be signed.

SERVER OBJECT

Authen::Ticket::Server provides an object encapsulating most of the informationrequired to authenticate a user and generate tickets. The followingvalues are contained in the object:

    $server = new Authen::Ticket::Server;    $$server{_r}     -> Apache request object iff running under mod_perl    $$server{stdout} -> object to print to for HTML pages    $$server{query}  -> CGI-like object for generating HTML and accessing                        form data    $$server{request_uri}

    $$server{TicketDomain}  -> domain for which ticket is valid    $$server{TicketExpires} -> default ticket lifetime

The class constructor will work with sub-classes without modification.Sub-class initialization should be placed in the initialize subroutine.

SUB-CLASSING

A sub-class is required to override any of the methods mentioned in thisdocumentation (e.g., authentication method, HTML forms). Two variablesare required in the sub-class package.

@ISA

This array determines the classes the sub-class will inherit from. Fora fully functioning server, this must include Authen::Ticket::Server. Ifthe tickets are to be signed, Authen::Ticket::Signature is recommended.

%DEFAULTS

This hash contains the default values (or undef) for the configurationoptions required by the sub-class. These are set in the httpd configurationwith the PerlSetVar directive. These are available in the $selfhash reference.

Example

  package My::Ticket::Server;

  @ISA = (qw/Authen::Ticket::Server Authen::Ticket::Signature/);

  %DEFAULTS = (    TicketUserDatabase => 'mysql:users',    TicketDatabaseUser => undef,    TicketDatabasePassword => undef,    TicketUserFields   => 'table:userfield:passwordfield',  );

GENERAL METHODS

The following methods need not be redefined in any sub-classes.

$server = new Authen::Ticket::Server([$r], [%options]): This will return an initialized server object. If $r is areference and the code is running under mod_perl, then $$server{_r} will be set to $r. Otherwise, all the arguments aretaken to belong to a hash defining the default configuration.
This method is used in Authen::Ticket->handler and is usefulin CGI scripts implementing a ticket server. However, the preferreduse of the Authen::Ticket modules is in a mod_perl environment.

SUB-CLASS FUNCTIONS

The following conventions are used in these sections:

  $server -> server object  $u      -> hashref of user authentication information  $t      -> hashref of ticket information  $s      -> additional information for inclusion in a message

SUB-CLASS REQUIRED FUNCTIONS

Any sub-class of Authen::Ticket::Server must define the following subroutines:

$t = $server->authenticate($u)

This subroutine returns a hashref of information to be placed in theticket if the user is authenticated. If the person is not authenticated,it should return undef.

The following values are added to $t by $server->handlerafter authenticated returnssuccessfully:

  fields -> comma separated list of fields in %$t  uid    -> $u->{user}  ip     -> browser IP information depending on $u->{security}  expiry -> expiration time of the ticket

The default implementation will place a warning in the log file (ifrunning under mod_perl) andrefuse authentication.

SUB-CLASS RECOMMENDED FUNCTIONS

Any sub-class of Authen::Ticket::Server should define the following subroutines:

$q = $server->get_query_object

This subroutine returns an object used to retrieve form values and formatHTML. This must be CGI or another class that implements the CGI interface(e.g., a sub-class of CGI).

The default implementation will return avalid CGI object.

This routine is used in the object constructor to initialize part of theobject.

$o = $server->get_stdout_object

This subroutine returns an object to be used as STDOUT. This must supportthe $o->print() syntax.

The default implementation will return thecurrent Apache object.

This routine is used in the object constructor to initialize part of theobject.

$u = $server->get_userinfo

This subroutine returns a hash reference to the information on theauthenticating person. Some massaging of the data may take place.This routine transfers data from the input form to an internalrepresentation for further processing.

The following fields are expected for correct authentication:

  user     -> username  password -> password  duration -> lifetime of the ticket  security -> {weak,medium,strong} extent to which the browser IP is used

The default implementation will pull the above values from the queryobject.

$c = $server->construct_cookie(%$t)

This subroutine returns an intermediate value for the ticket. This routine may combinethe values in %$t in any manner deemed necessary as longas the client website can deconstruct them.

$c = $server->encode_cookie($c)

This subroutine encodes the cookie. This may involve encryption orother transforms. However, Authen::Ticket::Signature provides thecode for signing tickets.

The default implementation base_64 encodes the cookie.

SUB-CLASS MISCELLANEOUS FUNCTIONS

Any sub-class of Authen::Ticket::Server may define the following subroutines:

$server->no_cookie_error_message($s): This subroutine returns an HTML page to be sent to the browser whenthe ticket server has detected a lack of support for cookies.
$server->no_user_password_error_message($s): This subroutine returns an HTML page to be sent to the browser whenthe server needs the authentication information from the user. Theoptional $s parameter will contain any error messages from the previousauthentication attempt if there was one. $uri is the URI of the pagethe server will return to when the user has successfully authenticated.
$server->go_to_uri_message: This subroutine returns an HTML page to be sent to the browser when theuser has successfully authenticated. This page does not need to redirectthe browser to $uri. $uri is provided to help those browsers that cannotredirect themselves automatically.

AUTHOR

James G. Smith <jgsmithAATTtamu.edu>

COPYRIGHT

Redistribution and use in source and binary forms, with or withoutmodification, are permitted provided that the following conditionsare met:

 1. Redistributions of source code must retain the above copyright     notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above     copyright notice, this list of conditions and the following     disclaimer in the documentation and/or other materials     provided with the distribution. 3. Neither the name of the University nor the names of its     contributors may be used to endorse or promote products     derived from this software without specific prior written     permission.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTERS ``AS IS''AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THEIMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSEARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDERS OR CONTRIBUTORS BELIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, ORCONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OFSUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESSINTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER INCONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THEPOSSIBILITY OF SUCH DAMAGE.

This document was created byman2html,using the manual pages.