Auth-Yubikey_WebClient-4.01/0000755000175000017500000000000012777652334014404 5ustar philphilAuth-Yubikey_WebClient-4.01/META.json0000664000175000017500000000203612777652334016030 0ustar philphil{ "abstract" : "Authenticating the Yubikey against the Yubico Web API", "author" : [ "Phil Massyn " ], "dynamic_config" : 1, "generated_by" : "ExtUtils::MakeMaker version 7.0401, CPAN::Meta::Converter version 2.150001", "license" : [ "unknown" ], "meta-spec" : { "url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec", "version" : "2" }, "name" : "Auth-Yubikey_WebClient", "no_index" : { "directory" : [ "t", "inc" ] }, "prereqs" : { "build" : { "requires" : { "ExtUtils::MakeMaker" : "0" } }, "configure" : { "requires" : { "ExtUtils::MakeMaker" : "0" } }, "runtime" : { "requires" : { "Digest::HMAC_SHA1" : "1", "LWP::UserAgent" : "1", "MIME::Base64" : "1", "Test::More" : "0", "URI::Escape" : "1" } } }, "release_status" : "stable", "version" : "4.01" } Auth-Yubikey_WebClient-4.01/Changes0000755000175000017500000000017211477701415015671 0ustar philphilRevision history for Auth-Yubikey_WebClient 0.01 Date/time First version, released on an unsuspecting world. Auth-Yubikey_WebClient-4.01/t/0000755000175000017500000000000012777652334014647 5ustar philphilAuth-Yubikey_WebClient-4.01/t/00-load.t0000755000175000017500000000026311477701415016163 0ustar philphil#!perl -T use Test::More tests => 1; BEGIN { use_ok( 'Auth::Yubikey_WebClient' ); } diag( "Testing Auth::Yubikey_WebClient $Auth::Yubikey_WebClient::VERSION, Perl $], $^X" ); Auth-Yubikey_WebClient-4.01/t/pod.t0000755000175000017500000000035011477701415015606 0ustar philphil#!perl -T use strict; use warnings; use Test::More; # Ensure a recent version of Test::Pod my $min_tp = 1.22; eval "use Test::Pod $min_tp"; plan skip_all => "Test::Pod $min_tp required for testing POD" if $@; all_pod_files_ok(); Auth-Yubikey_WebClient-4.01/t/pod-coverage.t0000755000175000017500000000104711477701415017403 0ustar philphiluse strict; use warnings; use Test::More; # Ensure a recent version of Test::Pod::Coverage my $min_tpc = 1.08; eval "use Test::Pod::Coverage $min_tpc"; plan skip_all => "Test::Pod::Coverage $min_tpc required for testing POD coverage" if $@; # Test::Pod::Coverage doesn't require a minimum Pod::Coverage version, # but older versions don't recognize some common documentation styles my $min_pc = 0.18; eval "use Pod::Coverage $min_pc"; plan skip_all => "Pod::Coverage $min_pc required for testing POD coverage" if $@; all_pod_coverage_ok(); Auth-Yubikey_WebClient-4.01/META.yml0000664000175000017500000000115612777652334015662 0ustar philphil--- abstract: 'Authenticating the Yubikey against the Yubico Web API' author: - 'Phil Massyn ' build_requires: ExtUtils::MakeMaker: '0' configure_requires: ExtUtils::MakeMaker: '0' dynamic_config: 1 generated_by: 'ExtUtils::MakeMaker version 7.0401, CPAN::Meta::Converter version 2.150001' license: unknown meta-spec: url: http://module-build.sourceforge.net/META-spec-v1.4.html version: '1.4' name: Auth-Yubikey_WebClient no_index: directory: - t - inc requires: Digest::HMAC_SHA1: '1' LWP::UserAgent: '1' MIME::Base64: '1' Test::More: '0' URI::Escape: '1' version: '4.01' Auth-Yubikey_WebClient-4.01/lib/0000755000175000017500000000000012777652334015152 5ustar philphilAuth-Yubikey_WebClient-4.01/lib/Auth/0000755000175000017500000000000012777652334016053 5ustar philphilAuth-Yubikey_WebClient-4.01/lib/Auth/Yubikey_WebClient.pm0000755000175000017500000002132212777652201021762 0ustar philphilpackage Auth::Yubikey_WebClient; use warnings; use strict; use MIME::Base64; use Digest::HMAC_SHA1 qw(hmac_sha1 hmac_sha1_hex); use LWP::UserAgent; use URI::Escape; =head1 NAME Auth::Yubikey_WebClient - Authenticating the Yubikey against the Yubico Web API =head1 VERSION Version 4.01 =cut our $VERSION = '4.01'; =head1 SYNOPSIS Authenticate against the Yubico server via the Web API in Perl Sample CGI script :- #!/usr/bin/perl use CGI; use strict; my $cgi = new CGI; my $otp = $cgi->param("otp"); print $cgi->header(); print "\n"; print "
Yubikey :
\n"; use Auth::Yubikey_WebClient; my $id = ""; my $api = ""; my $nonce = ""; if($otp) { my $result = Auth::Yubikey_WebClient::yubikey_webclient($otp,$id,$api,$nonce); # result can be either ERR or OK print "Authentication result : $result
"; } print "\n"; =head1 FUNCTIONS =head2 new Creates a new Yubikey Webclient connection use Auth::Yubikey_WebClient; my $yubi = Auth::Yubikey_WebClient->new({ id => , api => '' , nonce => '', verify_hostname => 0 # optional - defaults to 1. Can be set to 0 if you do not want to check the validity of the SSL certificate when querying the Yubikey server }); You can overwrite the URL called if you want to call an alternate authentication server as well :- use Auth::Yubikey_WebClient; my $yubi = Auth::Yubikey_WebClient->new({ id => , api => '' , nonce => '', url => 'http://www.otherserver.com/webapi.php' }); =cut sub new { my ($class,$options_ref) = @_; my $self = {}; bless $self, ref $class || $class; if(! defined $options_ref) { die "You did not pass any parameters to the Yubikey Web Client initialization"; } my %options = %{$options_ref}; # grab the variables from the initialization if(defined $options{id}) { $self->{id} = $options{id}; } else { die "Can not start without a Yubikey ID"; } if(defined $options{api}) { $self->{api} = $options{api}; if(length($self->{api}) % 4 != 0) { die "Your API key must be in 4 byte lengths"; } } else { die "Can not start without a Yubikey API key"; } $self->{nonce} = defined $options{nonce} ? $options{nonce} : ''; $self->{url} = defined $options{url} ? $options{url} : 'https://api2.yubico.com/wsapi/2.0/verify'; $self->{verify_hostname} = defined $options{verify_hostname} ? $options{verify_hostname} : 1; return $self; } =head2 debug Displays the debug info $yubi->debug(); Prints out some debug information. Useful to be called after authentication to see what Yubico sent back. You can also call the variables yourself, for example if you'd like to see what the token ID is, call $yubi->{publicid}. The same goes for all the other variables printed in debug. =cut sub debug { my ($self) = @_; print "id = $self->{id}\n"; print "api = $self->{api}\n"; print "url = $self->{url}\n"; print "nonce = $self->{nonce}\n"; print "params = $self->{params}\n"; print "status = $self->{status}\n"; print "otp = $self->{otp}\n"; print "publicid = $self->{publicid}\n"; print "t = $self->{t}\n"; print "sl = $self->{sl}\n"; print "timestamp = $self->{timestamp}\n"; print "sessioncounter = $self->{sessioncounter}\n"; print "sessionuse = $self->{sessionuse}\n"; # print "response = $self->{response}\n"; } =head2 yubikey_webclient =cut sub yubikey_webclient { my ($otp,$id,$api,$nonce) = @_; my $yubi_tmp = new Auth::Yubikey_WebClient ( { id => $id, api => $api, nonce => $nonce } ); return $yubi_tmp->otp($otp); } =head2 otp Check a OTP for validity $result = $yubi->otp($otp); Call the otp procedure with the input from the yubikey. It will return the result. This function will also setup a few internal variables that was returned from Yubico. =cut sub otp { my ($self,$otp) = @_; chomp($otp); $self->{otp} = $otp; # lets do a basic sanity check on the otp, before we blast it off to yubico... if($self->{otp} !~ /[cbdefghijklnrtuv]/i || length($self->{otp}) < 32) { $self->{status} = "ERR_BAD_OTP"; return $self->{status}; } # Generate nonce unless passed $self->{nonce} = hmac_sha1_hex(time, rand()) unless $self->{nonce}; # Start generating the parameters $self->{params} = "id=$self->{id}&nonce=$self->{nonce}&otp=" . uri_escape($self->{otp}) . "×tamp=1"; $self->{params} .= '&h=' . uri_escape(encode_base64(hmac_sha1($self->{params}, decode_base64($self->{api})), '')); # pass the request to yubico my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => $self->{verify_hostname} }); my $req = HTTP::Request->new(GET => $self->{url} . "?$self->{params}"); my $res = $ua->request($req); if($res->is_success) { $self->{response} = $res->content; } else { print $res->status_line . "\n"; } chomp($self->{response}); if($self->{response} !~ /status=ok/i) { # If the status is not ok, let's not even go through the rest... $self->{response} =~ m/status=(.+)/; $self->{status} = "ERR_$1"; $self->{status} =~ s/\s//g; return $self->{status}; } #extract each of the lines, and store in a hash... my %result; foreach (split(/\n/,$self->{response})) { chomp; if($_ =~ /=/) { ($a,$b) = split(/=/,$_,2); $b =~ s/\s//g; $result{$a} = $b; $self->{$a} = $b; } } # save the h parameter, that's what we'll be comparing to my $signatur=$result{h}; delete $result{h}; my $datastring=''; my $key; foreach $key (sort keys %result) { $result{$key} =~ s/\s//g; $datastring .= "$key=$result{$key}&"; } $datastring = substr($datastring,0,length($datastring)-1); # Check that nonce and OTP are the ones we asked for $self->{status} = "ERR_MSG_AUTH"; return "ERR_MSG_AUTH" unless ($self->{nonce} eq $result{nonce} and $self->{otp} eq $result{otp}); my $hmac = encode_base64(hmac_sha1($datastring,decode_base64($self->{api}))); chomp($hmac); if($hmac eq $signatur) { $self->{publicid} = substr(lc($self->{otp}),0,12); $self->{status} = "OK"; return "OK"; } else { $self->{status} = "ERR_HMAC"; return "ERR_HMAC"; } } =head1 USAGE Before you can use this module, you need to register for an API key at Yubico. This is as simple as logging onto and entering your Yubikey's OTP and your email address. Once you have the API and ID, you need to provide those details to the module to work. =head1 AUTHOR Phil Massyn, C<< >> =head1 BUGS Please report any bugs or feature requests to C, or through the web interface at L. I will be notified, and then you'll automatically be notified of progress on your bug as I make changes. =head1 SUPPORT You can find documentation for this module with the perldoc command. perldoc Auth::Yubikey_WebClient You can also look for information at: =over 4 =item * RT: CPAN's request tracker L =item * AnnoCPAN: Annotated CPAN documentation L =item * CPAN Ratings L =item * Search CPAN L =back =head1 Version history 0.04 - Fixed bug L 1.00 - Added validation of the request to Yubico (Thanks to Kirill Miazine) 2.00 - Added nounce coding (Thanks to Ludvig af Klinteberg) 2.01 - Response turning into an array due to \r bug (Thanks to Peter Norin) 3.00 - Major update 4.01 - 13.10.2016 - Requested by Peter Norin - update to use LWP::UserAgent, and the option to overwrite a valid SSL certificate (verify_hostname). The API default server is changed to ssl. =head1 ACKNOWLEDGEMENTS =head1 COPYRIGHT & LICENSE Copyright 2016 Phil Massyn, all rights reserved. This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself. =cut ; # End of Auth::Yubikey_WebClient Auth-Yubikey_WebClient-4.01/Makefile.PL0000755000175000017500000000115612777650352016362 0ustar philphiluse strict; use warnings; use ExtUtils::MakeMaker; WriteMakefile( NAME => 'Auth::Yubikey_WebClient', AUTHOR => 'Phil Massyn ', VERSION_FROM => 'lib/Auth/Yubikey_WebClient.pm', ABSTRACT_FROM => 'lib/Auth/Yubikey_WebClient.pm', PL_FILES => {}, PREREQ_PM => { 'Test::More' => 0, 'LWP::UserAgent' => 1, 'MIME::Base64' => 1, 'Digest::HMAC_SHA1' => 1, 'URI::Escape' => 1 }, dist => { COMPRESS => 'gzip -9f', SUFFIX => 'gz', }, clean => { FILES => 'Auth-Yubikey_WebClient-*' }, ); Auth-Yubikey_WebClient-4.01/MANIFEST0000755000175000017500000000041212777652334015535 0ustar philphilChanges MANIFEST Makefile.PL README lib/Auth/Yubikey_WebClient.pm t/00-load.t t/pod-coverage.t t/pod.t META.yml Module meta-data (added by MakeMaker) META.json Module JSON meta-data (added by MakeMaker) Auth-Yubikey_WebClient-4.01/README0000755000175000017500000000266111477701417015265 0ustar philphilAuth-Yubikey_WebClient The README is used to introduce the module and provide instructions on how to install the module, any machine dependencies it may have (for example C compilers and installed libraries) and any other information that should be provided before the module is installed. A README file is required for CPAN modules since CPAN extracts the README file from a module distribution so that people browsing the archive can use it to get an idea of the module's uses. It is usually a good idea to provide version information here so that people can decide whether fixes for the module are worth downloading. INSTALLATION To install this module, run the following commands: perl Makefile.PL make make test make install SUPPORT AND DOCUMENTATION After installing, you can find documentation for this module with the perldoc command. perldoc Auth::Yubikey_WebClient You can also look for information at: RT, CPAN's request tracker http://rt.cpan.org/NoAuth/Bugs.html?Dist=Auth-Yubikey_WebClient AnnoCPAN, Annotated CPAN documentation http://annocpan.org/dist/Auth-Yubikey_WebClient CPAN Ratings http://cpanratings.perl.org/d/Auth-Yubikey_WebClient Search CPAN http://search.cpan.org/dist/Auth-Yubikey_WebClient COPYRIGHT AND LICENCE Copyright (C) 2009 Phil Massyn This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.