Redmine

require 'osx/cocoa'

OSX.require_framework 'Collaboration'

module AuthSourcesIdsHelper

  # localized to the server, not the web app user

  def authorities

    @@authorities ||= [ OSX::CBIdentityAuthority.defaultIdentityAuthority.localizedName,

                        OSX::CBIdentityAuthority.managedIdentityAuthority.localizedName,

                        OSX::CBIdentityAuthority.localIdentityAuthority.localizedName ]

  end

  def ids_authority_select(auth_source)

    select("auth_source","host",authorities.collect { |x| [ x, x ] })

  end

end

# Support for Mac OS X v10.5 Identity Services

require 'osx/cocoa'

OSX.require_framework 'Collaboration'

class AuthSourceIds < AuthSource 

  validates_presence_of :host

  validates_length_of :name, :attr_login, :maximum => 60, :allow_nil => true

  def authenticate(login, password)

    return nil if login.blank? || password.blank?

    attrs = []

    # get authority

    authority = authority_for_name!(self.host)

    # search for user

    identity = OSX::CBIdentity.identityWithName_authority(login, authority)

    return nil if identity.nil? || !identity.is_a?(OSX::CBUserIdentity)

    # get attributes if creating new user

    if onthefly_register?

      first, last = fullname_to_first_last(fullname_for_identity(identity))

      attrs = [:firstname => first,

               :lastname => last,

               :mail => mail_for_identity(identity),

               :auth_source_id => self.id]

    end

    # authenticate user

    return nil unless identity.authenticateWithPassword(password)

    # filter users

    return nil unless self.attr_login.empty? || identity.isMemberOfGroup(group_for_name!(self.attr_login, authority))

    # return attributes

    attrs

  end

  def auth_method_name

    "Identity Services"

  end

  def test_connection

    authority = authority_for_name!(self.host)

    # also check filtered group

    group_for_name!(self.attr_login, authority) unless self.attr_login.empty?

  end

  private

  def group_for_name!(group_name, authority)

    group = group_for_name(group_name, authority)

    raise "Identity Services Group \"#{group_name}\" not found" if group.nil?

    group

  end

  def group_for_name(group_name, authority)

      group = OSX::CBIdentity.identityWithName_authority(group_name, authority)

      group.is_a?(OSX::CBGroupIdentity) ? group : nil

  end

  def authority_for_name!(auth_name)

    authority = authority_for_name(auth_name)

    raise "Identity Services Authority \"#{auth_name}\" not found" if authority.nil?

    authority

  end

  def authority_for_name(auth_name)

    case auth_name

    when OSX::CBIdentityAuthority.defaultIdentityAuthority.localizedName: OSX::CBIdentityAuthority.defaultIdentityAuthority

    when OSX::CBIdentityAuthority.managedIdentityAuthority.localizedName: OSX::CBIdentityAuthority.managedIdentityAuthority

    when OSX::CBIdentityAuthority.localIdentityAuthority.localizedName: OSX::CBIdentityAuthority.localIdentityAuthority

    else nil

    end

  end

  def fullname_for_identity(identity)

    fullname = identity.fullName

    fullname && fullname.to_ruby 

  end

  def mail_for_identity(identity)

    email = identity.emailAddress

    return nil if email.nil?

    preferred_email = email.to_ruby

    if self.tls       # try for local address if possible

      user_aliases = identity.aliases.to_ruby

      host_parts = Socket.gethostname.split(".")

      while host_parts.size > 1

        suffix = "@" + host_parts.join(".")

        user_aliases.each do |a|

          if a[-suffix.length, suffix.length] == suffix

            preferred_email = a

            break

          end

        end

        host_parts.delete_at(0)

      end

    end

    preferred_email

  end  

  def part_is_suffix(part)

    @@suffixes ||= [ "JR.", "SR.", "JR", "SR", "II", "III", "3RD","IV", "V", "VI", "VII" ]

    @@suffixes.include?(part.upcase)

  end

  def part_is_lastname(part)

    @@lastnames ||= [ "DE", "DER", "DI", "LA", "LE", "MAC", "MC", "VAN", "VON", "PONCE" ]

    @@lastnames.include?(part.upcase)

  end

  def fullname_to_first_last(fullname)

    return [nil, nil] if fullname.nil?

    suffix = nil

    firstname = ""

    lastname = ""

    # split on comma

    parts = fullname.split(",").map { |i| i.strip }

    # got at least one comma - check for suffix

    if parts.size > 1 && part_is_suffix(parts[-1])

      suffix = ", " + parts.slice!(-1)

    end

    if parts.size == 1

      firstparts = []

      lastparts = []

      # need to determine where first and last name splits

      parts = parts.first.split(" ")

      # take care of suffix (if any)

      if parts.size > 1 && part_is_suffix(parts[-1])

        suffix = " " + parts.slice!(-1)

      end

      # last name

      if parts.size > 0

        lastparts.unshift(parts.slice!(-1))

      end

      # first name

      if parts.size > 0

        firstparts.push(parts.slice!(0))

      end

      # all the rest

      while parts.size > 0 && part_is_lastname(parts.slice(-1))

        lastparts.unshift(parts.slice!(-1))

      end

      # make strings

      firstparts.push(parts) if parts.size > 0

      firstname = firstparts.join(" ")

      firstname += suffix unless suffix.nil?

      lastname = lastparts.join(" ")

    elsif parts.size > 1

      # now have last, first

      lastname = parts.slice!(0)

      firstname = parts.join(", ")

      firstname += suffix unless suffix.nil?

    end

    [firstname, lastname]

  end

end

  helper :auth_sources_ids

    @auth_source = case params[:type]   # parameter passed in url

      when  "AuthSourceIds":  AuthSourceIds.new

      else  AuthSourceLdap.new

    end

    @auth_source = case params[:auth_source][:type]

      when  "AuthSourceIds":  AuthSourceIds.new(params[:auth_source])

      else  AuthSourceLdap.new(params[:auth_source])

    end

<%= link_to l(:label_auth_source_new_ldap), {:action => 'new'}, :class => 'icon icon-add' %>

<%= link_to l(:label_auth_source_new_ids), {:action => 'new', :type => 'AuthSourceIds'}, :class => 'icon icon-add' %>

	  <th><%=l(:field_host_authority)%></th>

<%= error_messages_for 'auth_source' %>

<div class="box">

<!--[form:auth_source]-->

<%= hidden_field 'auth_source', 'type' %>

<p><label for="auth_source_name"><%=l(:field_name)%> <span class="required">*</span></label>

<%= text_field 'auth_source', 'name'  %></p>

<p><label for="auth_source_host"><%=l(:field_authority)%> <span class="required">*</span></label>

<%= ids_authority_select(@auth_source.host) %></p>

<p><label for="auth_source_onthefly_register"><%=l(:field_onthefly)%></label>

<%= check_box 'auth_source', 'onthefly_register' %></p>

</div>

<fieldset class="box"><legend><%=l(:label_options)%></legend>

<p><label for="auth_source_tls"><%=l(:field_prefer_local_email)%></label>

<%= check_box 'auth_source', 'tls'  %></p>

<p><label for="auth_source_attr_login"><%=l(:field_restrict_user_group)%></label>

<%= text_field 'auth_source', 'attr_login', :size => 30  %></p>

</fieldset>

<!--[eoform:auth_source]-->

  <%= render :partial => 'form_' + @auth_source.class.to_s %>

<%= hidden_field 'auth_source', 'type' %>

  <%= render :partial => 'form_' + @auth_source.class.to_s %>

field_host_authority: Host/Authority

field_authority: Authority

field_prefer_local_email: Prefer local email

field_restrict_user_group: Restrict Users to Group

field_auth_source: Authentication source

label_auth_source: Authentication source

label_auth_source_new: New authentication source

label_auth_source_new_ldap: New LDAP authentication source

label_auth_source_new_ids: New Identity Services authentication source

label_auth_source_plural: Authentication sources

label_ldap_authentication: External authentication