ToDo: Authentication Web App Sample

[adeutscher]

The cobbler's children have no shoes, and similarly I currently cannot make use of DirectoryTools on my own home network.

My main use case for DirectoryTools at the moment is OpenVPN authentication. Because I don't want to cram Python on my OpenWRT router, I'm still using the BASH scripts that I threw together before writing DirectoryTools to authenticate users against OpenLDAP.

To use DirectoryTools I need to do the following:

• Set up a simple Python web-app with mod_python, mod_wsgi, or similar that will accept POST data and call DirectoryTools in order to authenticate.
• Make this available on a web server (hopefully over HTTPS!)
• Use curl, wget, or similar to make calls to this web app once it's set up.
• Document setup steps and include them in Git project, in case someone else has the same use case.

[adeutscher]

Added server script. Still working out the details of how to implement the client.

[adeutscher]

Most of my problems with the client is figuring out how to URL encode the strings in case anyone used any special characters in their password. I do not have Perl available to me on my home router.

Will investigate next session, but http://stackoverflow.com/questions/296536/urlencode-from-a-bash-script (Alternate link: https://github.com/8devices/packages/blob/master/net/ddns-scripts/files/usr/lib/ddns/url_escape.sed ) looks like my best solution.

My other solution was to make a static binary in C that would draw off of environment variables to perform URL escaping. This got tied up in learning how to cross-compile.

url_escape.sed usage:

replace_value=$(echo $replace_value | sed -f /usr/lib/ddns/url_escape.sed)

Content of url_escape.sed for reference:

# sed url escaping
s:%:%25:g
s: :%20:g
s:<:%3C:g
s:>:%3E:g
s:#:%23:g
s:{:%7B:g
s:}:%7D:g
s:|:%7C:g
s:\\:%5C:g
s:\^:%5E:g
s:~:%7E:g
s:\[:%5B:g
s:\]:%5D:g
s:`:%60:g
s:;:%3B:g
s:/:%2F:g
s:?:%3F:g
s^:^%3A^g
s:@:%40:g
s:=:%3D:g
s:&:%26:g
s:\$:%24:g
s:\!:%21:g
s:\*:%2A:g

ToDo: Are these really the only characters that need to be escaped?

[adeutscher]

Additional kick in the pants to get this done: My current BASH script for VPN requires ldapsearch, which is eating up much more space than I would like on the home router (4 150KB+ library files and several 50KB+ binaries, with only 3MB of space available in total). These space hogs are preventing me from implementing a separate project.

[adeutscher]

The home network has used the authentication system suggested by this change for a number of months, but I've only now gotten around to committing a version with example values (7638f78dd9).

Before I close this ticket, I will test and implement using sed to escape out troublesome characters.