Merge branch 'master' into fujin/chef-169

Conflicts:

	chef/lib/chef/config.rb

Author: adamhjk

chef-server-slice/Rakefile

@@ -48,12 +48,12 @@ end
 
 desc "Install the gem"
 task :install do
-  Merb::RakeHelper.install(GEM_NAME, :version => CHEF_SERVER_VERSION)
+  sh %{sudo gem install pkg/#{GEM_NAME}-#{CHEF_SERVER_VERSION} --no-rdoc --no-ri}
 end
 
 desc "Uninstall the gem"
 task :uninstall do
-  Merb::RakeHelper.uninstall(GEM_NAME, :version => CHEF_SERVER_VERSION)
+  sh %{sudo gem uninstall #{GEM_NAME} -x -v #{CHEF_SERVER_VERSION} }
 end
 
 desc "Create a gemspec file"

chef-server-slice/app/controllers/openid_consumer.rb

@@ -18,9 +18,8 @@
 #
 
 require 'pathname'
-
-require "openid"
-require 'openid/store/filesystem'
+require 'openid'
+require (Chef::Config[:openid_cstore_couchdb] ?   'openid-store-couchdb' : 'openid/store/filesystem')
 
 class ChefServerSlice::OpenidConsumer < ChefServerSlice::Application
 
@@ -29,14 +28,19 @@ class ChefServerSlice::OpenidConsumer < ChefServerSlice::Application
   def index
     render
   end
-
+  
   def start
-    check_valid_openid_provider(params[:openid_identifier])
+    oid = params[:openid_identifier]
+    providers = Chef::Config[:openid_providers]
+    raise(Unauthorized, "Sorry, #{openid} is not an authorized OpenID.") unless is_authorized_openid_identifier?(oid, providers)    
+    raise(Unauthorized, "Sorry, #{openid} is not an allowed OpenID Provider.") unless is_valid_openid_provider?(oid,providers)
+    
     begin
-      oidreq = consumer.begin(params[:openid_identifier])
+      oidreq = consumer.begin(oid)
     rescue OpenID::OpenIDError => e
       raise BadRequest, "Discovery failed for #{params[:openid_identifier]}: #{e}"
     end
+    
     return_to = absolute_slice_url(:openid_consumer_complete)
     realm = absolute_slice_url(:openid_consumer)
 
@@ -49,36 +53,17 @@ def start
   end
 
   def login
-  	check_authorized_openid_identifier(params[:openid_identifier])
-    check_valid_openid_provider(params[:openid_identifier])
-    begin
-      oidreq = consumer.begin(params[:openid_identifier])
-    rescue OpenID::OpenIDError => e
-      raise BadRequest, "Discovery failed for #{params[:openid_identifier]}: #{e}"
-    end
-    return_to = absolute_slice_url(:openid_consumer_complete)
-    realm = absolute_slice_url(:openid_consumer)
-
-    if oidreq.send_redirect?(realm, return_to, params[:immediate])
-      return redirect(oidreq.redirect_url(realm, return_to, params[:immediate]))
-    else
-      @form_text = oidreq.form_markup(realm, return_to, params[:immediate], {'id' => 'openid_form'})
-      render
-    end
+    start
   end
-
+  
   def complete
     # FIXME - url_for some action is not necessarily the current URL.
     current_url = absolute_slice_url(:openid_consumer_complete)
     parameters = params.reject{|k,v| k == "controller" || k == "action"}
     oidresp = consumer.complete(parameters, current_url)
     case oidresp.status
       when OpenID::Consumer::FAILURE
-        if oidresp.display_identifier
-          raise BadRequest, "Verification of #{oidresp.display_identifier} failed: #{oidresp.message}"
-        else
-          raise BadRequest, "Verification failed: #{oidresp.message}"
-        end
+        raise BadRequest, "Verification failed: #{oidresp.message}" + (oidresp.display_identifier ? " for identifier '#{oidresp.display_identifier}'" : "")
       when OpenID::Consumer::SUCCESS
         session[:openid] = oidresp.identity_url
         if oidresp.display_identifier =~ /openid\/server\/node\/(.+)$/
@@ -102,56 +87,31 @@ def complete
   end
 
   def logout
-    session[:openid] = nil    if session.has_key?(:openid)
-    session[:level] = nil     if session.has_key?(:level)
-    session[:node_name] = nil if session.has_key?(:node_name)
+    [:openid,:level,:node_name].each { |n| session.delete(n) }
     redirect slice_url(:top)
   end
 
   private
-
+  #      
+  #    
+  
   # Returns true if the openid is at a valid provider, based on whether :openid_providers is
   # defined.  Raises an exception if it is not an allowed provider.
-  def check_valid_openid_provider(openid)
-    if Chef::Config[:openid_providers]
-      fp = Chef::Config[:openid_providers].detect do |p|
-        case openid
-        when /^https?:\/\/#{p}/, /^#{p}/
-          true
-        else
-          false
-        end
-      end
-      unless fp
-        raise Unauthorized, "Sorry, #{openid} is not an allowed OpenID Provider."
-      end
-    end
-    true
-  end
+  def is_valid_openid_provider?(openid,providers)
+    (providers && providers.detect {|p| openid =~ /^https?:\/\/#{p}/ or openid =~ /^#{p}/}) || true
+   end
 
-  def check_authorized_openid_identifier(openid)
-    if Chef::Config[:authorized_openid_identifiers]
-      fp = Chef::Config[:authorized_openid_identifiers].detect do |p|
-        case openid
-        when p
-          true
-        else
-          false
-        end
-      end
-      unless fp
-        raise Unauthorized, "Sorry, #{openid} is not an authorized OpenID."
-      end
-    end
-    true
+  def is_authorized_openid_identifier?(openid,providers)
+    (providers && providers.detect { |p| openid==p }) || true
   end
 
   def consumer
-    if @consumer.nil?
-      dir = Chef::Config[:openid_cstore_path]
-      store = OpenID::Store::Filesystem.new(dir)
-      @consumer = OpenID::Consumer.new(session, store)
-    end
-    return @consumer
+    @consumer ||= OpenID::Consumer.new(session,
+                                       if Chef::Config[:openid_cstore_couchdb]
+                                         OpenID::Store::CouchDB.new(Chef::Config[:couchdb_url])
+                                       else
+                                         OpenID::Store::Filesystem.new(Chef::Config[:openid_cstore_path])
+                                       end)
   end
+                                       
 end

chef-server-slice/app/controllers/openid_server.rb

@@ -26,7 +26,6 @@
 #rescue LoadError
 require "openid"
 require "openid/consumer/discovery"
-require 'openid/store/filesystem'
 require 'json'
 require 'chef' / 'openid_registration'
 #end
@@ -175,8 +174,14 @@ def encrypt_password(salt, password)
   def server
     if @server.nil?
       server_url = absolute_slice_url(:openid_server)
-      dir = Chef::Config[:openid_store_path]
-      store = OpenID::Store::Filesystem.new(dir)
+      if Chef::Config[:openid_store_couchdb]
+        require 'openid-store-couchdb'
+        store = OpenID::Store::CouchDB.new(Chef::Config[:couchdb_url])
+      else
+        require 'openid/store/filesystem'
+        dir = Chef::Config[:openid_store_path]
+        store = OpenID::Store::Filesystem.new(dir)
+      end
       @server = Server.new(store, server_url)
     end
     return @server

chef-server-slice/lib/chef-server-slice.rb

@@ -34,6 +34,18 @@ module ChefServerSlice
     def self.loaded
       Chef::Queue.connect
 
+      # create the couch databases for openid association and nonce storage, if configured
+      if Chef::Config[:openid_store_couchdb] || Chef::Config[:openid_cstore_couchdb]
+        rest = Chef::REST.new(Chef::Config[:couchdb_url])
+        @database_list = rest.get_rest("_all_dbs")
+        unless @database_list.detect { |db| db == 'associations' }
+          response = rest.put_rest('associations', Hash.new)
+        end
+        unless @database_list.detect { |db| db == 'nonces' }
+          response = rest.put_rest('nonces', Hash.new)
+        end
+      end
+      
       # create the couch design docs for nodes and openid registrations
       Chef::Node.create_design_document
       Chef::OpenIDRegistration.create_design_document

chef-server/bin/chef-server

@@ -64,6 +64,8 @@ class Config
       :search_url => "http://localhost:4000",
       :couchdb_database => "chef",
       :couchdb_version => nil,
+      :openid_store_couchdb => false,
+      :openid_cstore_couchdb => false,
       :openid_store_path => "/var/chef/openid/db",
       :openid_cstore_path => "/var/chef/openid/cstore",
       :file_cache_path => "/var/chef/cache",