File apache2-mod_authn_otp.spec of Package apache2-mod_authn_otp

#
# spec file for package apache2-mod_authn_otp
#
# Copyright (c) 2017 SUSE LINUX GmbH, Nuernberg, Germany.
# Copyright (c) 2012 Archie L. Cobbs <archie@dellroad.org>
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via http://bugs.opensuse.org/
#


%define mod_name           mod_authn_otp
Name:           apache2-%{mod_name}
Version:        1.1.8
Release:        0
Summary:        Apache module for one-time password authentication
License:        Apache-2.0
Group:          Productivity/Networking/Web/Servers
Url:            http://mod-authn-otp.googlecode.com/
Source:         https://s3.amazonaws.com/archie-public/mod-authn-otp/%{mod_name}-%{version}.tar.gz
BuildRequires:  apache-rpm-macros
BuildRequires:  apache2-devel
BuildRequires:  curl
Requires:       %{apache_mmn}
Requires:       %{apache_suse_maintenance_mmn}
Provides:       otptool = %{version}
BuildRoot:      %{_tmppath}/%{name}-%{version}-build
%if 0%{?suse_version} >= 1100
BuildRequires:  libopenssl-devel
BuildRequires:  openssl
%else
BuildRequires:  openssl-devel
%endif

%description
mod_authn_otp is an Apache web server module for two-factor authentication
using one-time passwords (OTP) generated via the HOTP/OATH algorithm
defined in RFC 4226. This creates a simple way to protect a web site with
one-time passwords, using any RFC 4226-compliant hardware or software
token device. mod_authn_otp also supports the Mobile-OTP algorithm.

mod_authn_otp supports both event and time based one-time passwords. It
also supports "lingering" which allows the repeated re-use of a previously
used one-time password up to a configurable maximum linger time. This
allows one-time passwords to be used directly in HTTP authentication
without forcing the user to enter a new one-time password for every
page load.

mod_authn_otp supports both basic and digest authentication, and will
auto-synchronize with the user's token within a configurable maximum
offset (auto-synchronization is not supported with digest authentication).

mod_authn_otp is especially useful for setting up protected web sites
that require more security than simple username/password authentication
yet also don't require users to install special VPN software, and is
compatible with software tokens that run on cell phones.

Also included is otptool, a one-time password command line utility.
otptool can be used on a simple call-out basis to integrate two-factor
authentication into any existing authentication solution.

%prep
%setup -q -n %{mod_name}-%{version}

%build
%configure
make %{?_smp_mflags}

%install
install -d %{buildroot}%{apache_libexecdir}
make DESTDIR=%{buildroot} install %{?_smp_mflags}

%check
# see https://github.com/archiecobbs/mod-authn-otp/blob/master/README.md
# for details
set +x
# secret token
test_token='a4d8acbddef654fccc418db4cc2f85cea6339f00'
test_user='wilma'
mkdir -p %{apache_test_module_dir}/htdocs/protected
# create protected document
cat << EOF > %{apache_test_module_dir}/htdocs/protected/index.html
RESTRICTED AREA BY OTP
EOF
# create initial UsersFile
echo "HOTP $test_user - $test_token" > %{apache_test_module_dir}/users-file
# create module configuration
cat << EOF > %{apache_test_module_dir}/mod_authn_otp-test.conf
<Directory %{apache_test_module_dir}/htdocs/protected>
  AuthType           basic
  AuthName          "Very Secret Area"
  AuthBasicProvider OTP
  Require           valid-user
  OTPAuthUsersFile %{apache_test_module_dir}/users-file
  OTPAuthMaxLinger 2
</Directory>
EOF
exit_code=0
%if %{apache_branch} >= 204
# 2.4 and up
base_authn_module='authn_core'
%else
base_authn_module='authn_default'
%endif
# start apache test instance
%apache_test_module_start_apache -m $base_authn_module:authz_user:authn_otp -i mod_authn_otp-test.conf
echo
echo 'Testing protected/index.html output'
# figure out password for first access
pass=$(./otptool -c 0 a4d8acbddef654fccc418db4cc2f85cea6339f00 | sed 's@.*:[ \t]*\([0-9]*\)[ \t]*.*@\1@')
echo 'Test 1: testing first password'
%apache_test_module_curl -u $test_user:$pass -d /protected/ -o output.txt
grep 'RESTRICTED AREA BY OTP' output.txt || exit_code=1
# next access with the same password within the linger time should be allowed
echo 'Test 2: testing first password in linger time'
%apache_test_module_curl -u $test_user:$pass -d /protected/ -o output.txt
grep 'RESTRICTED AREA BY OTP' output.txt || exit_code=2
# sleeping to get after linger time
sleep 2
# next access with the same password after linger time should not be allowed
echo 'Test 3: testing first password after linger time'
%apache_test_module_curl -u $test_user:$pass -d /protected/ -o output.txt
grep '<title>.*401.*</title>' output.txt || exit_code=3
# figure out second password (counter increased by one)
echo 'Test 4: testing second password'
pass=$(./otptool -c 1 a4d8acbddef654fccc418db4cc2f85cea6339f00 | sed 's@.*:[ \t]*\([0-9]*\)[ \t]*.*@\1@')
%apache_test_module_curl -u $test_user:$pass -d /protected/ -o output.txt
grep 'RESTRICTED AREA BY OTP' output.txt || exit_code=4
# increasing counter again, generating new password
echo 'Test 5: testing third password in linger time of second password'
pass=$(./otptool -c 2 a4d8acbddef654fccc418db4cc2f85cea6339f00 | sed 's@.*:[ \t]*\([0-9]*\)[ \t]*.*@\1@')
# access with the third password should be allowed even if linger time
# of the previous one have not expired
%apache_test_module_curl -u $test_user:$pass -d /protected/ -o output.txt
grep 'RESTRICTED AREA BY OTP' output.txt || exit_code=5
echo -n 'Result: '
if [ $exit_code -eq 0 ]; then
  echo 'SUCCESS'
else
  echo "FAILED (last failed test: $exit_code), error_log:"
  cat %{apache_test_module_dir}/error_log
fi
echo
%apache_test_module_stop_apache
set -x
exit $exit_code

%files
%defattr(-,root,root,-)
%{apache_libexecdir}/%{mod_name}.so
%{_bindir}/otptool
%{_mandir}/man1/otptool.1.gz
%doc CHANGES LICENSE README users.sample

%changelog