Catalyst

The Raven-related software described on this page is NOT supported or maintained by University Information Services. It is provided here in the hope that it may be useful, but it may contain bugs and security vulnerabilities. It may be supported and maintained by others. You should evaluate whether it meets you particular needs before using it.

A Ucam-Webauth authentication plugin for Catalyst has been written by Michael Gray, formerly from Engineering. It's available at

http://raven.cam.ac.uk/project/catalyst/files/

as Catalyst-Plugin-Authentication-Credential-Raven-0.01.tar.gz. Note that it requires the Ucam-WebAuth-AA Perl module which, to avoid a bug leading to warning messages when using the plugin, should be at least version 1.02.

Jon Warbrick has discovered that by default Catalyst's session cookies do not expire at the end of the session, but instead have a two hour lifetime. This can be confusing for users. I'll look at how this might be tackled in the plugin, but meanwhile, adding the following stanza to your Catalyst app's config file (my_app.yml) should solve this issue:

session:
    cookie_expires: 0

Note the following from jw35:

I've just got to the bottom of a bug, manifesting in your Catalyst/Raven
plugin and caused by an unfortunate interaction between Catalyst and
Ucam::WebAuth::AA.

In essence, Catalyst returns 'http://foo.com?a=b' as $c->request->uri when
actually asked for 'http://foo.com/?a=b' (note the extra '/'). Becasue of
this, if you protect the root of a site with your plugin then
authentication fails if the first thing you access is the root URL,
becasue it appears that the URL in the ticket doesn't match the requested
URL. Thanks to a bug in Ucam::WebAuth::AA, this failure doesn't produce a
useful error message :-((

The patch below works around the problem, though I'm not convinced it
really the right way to fix it.

*** Raven.pm.orig       2006-10-10 15:15:28.000000000 +0100
--- Raven.pm    2006-10-10 15:16:03.000000000 +0100
***************
*** 237,243 ****

  sub this_url {
      my $self = shift;
!     return $self->context->request->uri;
  }

  # We don't need to supply a secure() method since it is only used
--- 237,248 ----

 sub this_url {
      my $self = shift;
!     my $url = $self->context->request->uri;
!     unless ($url->path) {
!         $url = $url->clone;
!         $url->path('/');
!     }
!     return $url;
  }

  # We don't need to supply a secure() method since it is only used

Note also that the module depends on UNIVERSAL::require but doesn't mention this in it's dependancies.

Tim Rayner subsequently Michael's code to account for changes to Catalyst - he writes:

I've been using the Catalyst Raven authentication plugin
(https://wiki.csx.cam.ac.uk/raven/Catalyst) for a new web application I'm
developing. I ran into some problems with the current version (0.01) which I
believe were caused by the changes which have been made to the Catalyst
authentication system over the last year or so. I've modified to the code to
get it to work, and I think it's now functioning as it should. I've attached
the updated code in case you have any comments, or indeed if other people
would like to use it. I'd certainly appreciate feedback on any
authentication mistakes I may have made! 

His patched version of the module (v 0.011a) can be found at

http://raven.cam.ac.uk/project/catalyst/files/

as Raven.pm-0.011a.

Line 210 has a missing bracket. Should be:

for my $m ( qw(status success msg issue expire id auth sso url) ) {