Move LDAP code to LDAPAuthenticator. Use Authenticator for token_exchange with grant_type as well

This commit is contained in:
link0ff 2019-03-03 21:20:36 +02:00
parent 19e2b85247
commit 88a672fe88
4 changed files with 55 additions and 32 deletions

View File

@ -336,3 +336,8 @@ config :auto_linker,
* `sslopts`: additional SSL options * `sslopts`: additional SSL options
* `base`: LDAP base, e.g. "dc=example,dc=com" * `base`: LDAP base, e.g. "dc=example,dc=com"
* `uid`: attribute type to authenticate the user, e.g. when "cn", the filter will be "cn=username,base" * `uid`: attribute type to authenticate the user, e.g. when "cn", the filter will be "cn=username,base"
## Pleroma.Web.Auth.Authenticator
* `Pleroma.Web.Auth.PleromaAuthenticator`: default database authenticator
* `Pleroma.Web.Auth.LDAPAuthenticator`: LDAP authentication

View File

@ -2,15 +2,51 @@
# Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/> # Copyright © 2017-2019 Pleroma Authors <https://pleroma.social/>
# SPDX-License-Identifier: AGPL-3.0-only # SPDX-License-Identifier: AGPL-3.0-only
defmodule Pleroma.LDAP do defmodule Pleroma.Web.Auth.LDAPAuthenticator do
alias Pleroma.User alias Pleroma.User
require Logger require Logger
@behaviour Pleroma.Web.Auth.Authenticator
@connection_timeout 10_000 @connection_timeout 10_000
@search_timeout 10_000 @search_timeout 10_000
def get_user(name, password) do def get_user(%Plug.Conn{} = conn) do
if Pleroma.Config.get([:ldap, :enabled]) do
{name, password} =
case conn.params do
%{"authorization" => %{"name" => name, "password" => password}} ->
{name, password}
%{"grant_type" => "password", "username" => name, "password" => password} ->
{name, password}
end
case ldap_user(name, password) do
%User{} = user ->
{:ok, user}
{:error, {:ldap_connection_error, _}} ->
# When LDAP is unavailable, try default authenticator
Pleroma.Web.Auth.PleromaAuthenticator.get_user(conn)
error ->
error
end
else
# Fall back to default authenticator
Pleroma.Web.Auth.PleromaAuthenticator.get_user(conn)
end
end
def handle_error(%Plug.Conn{} = _conn, error) do
error
end
def auth_template, do: nil
defp ldap_user(name, password) do
ldap = Pleroma.Config.get(:ldap, []) ldap = Pleroma.Config.get(:ldap, [])
host = Keyword.get(ldap, :host, "localhost") host = Keyword.get(ldap, :host, "localhost")
port = Keyword.get(ldap, :port, 389) port = Keyword.get(ldap, :port, 389)
@ -50,7 +86,7 @@ def get_user(name, password) do
end end
end end
def register_user(connection, base, uid, name, password) do defp register_user(connection, base, uid, name, password) do
case :eldap.search(connection, [ case :eldap.search(connection, [
{:base, to_charlist(base)}, {:base, to_charlist(base)},
{:filter, :eldap.equalityMatch(to_charlist(uid), to_charlist(name))}, {:filter, :eldap.equalityMatch(to_charlist(uid), to_charlist(name))},

View File

@ -9,7 +9,14 @@ defmodule Pleroma.Web.Auth.PleromaAuthenticator do
@behaviour Pleroma.Web.Auth.Authenticator @behaviour Pleroma.Web.Auth.Authenticator
def get_user(%Plug.Conn{} = conn) do def get_user(%Plug.Conn{} = conn) do
%{"authorization" => %{"name" => name, "password" => password}} = conn.params {name, password} =
case conn.params do
%{"authorization" => %{"name" => name, "password" => password}} ->
{name, password}
%{"grant_type" => "password", "username" => name, "password" => password} ->
{name, password}
end
with {_, %User{} = user} <- {:user, User.get_by_nickname_or_email(name)}, with {_, %User{} = user} <- {:user, User.get_by_nickname_or_email(name)},
{_, true} <- {:checkpw, Pbkdf2.checkpw(password, user.password_hash)} do {_, true} <- {:checkpw, Pbkdf2.checkpw(password, user.password_hash)} do

View File

@ -11,7 +11,6 @@ defmodule Pleroma.Web.OAuth.OAuthController do
alias Pleroma.Web.OAuth.App alias Pleroma.Web.OAuth.App
alias Pleroma.Repo alias Pleroma.Repo
alias Pleroma.User alias Pleroma.User
alias Comeonin.Pbkdf2
import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2] import Pleroma.Web.ControllerHelper, only: [oauth_scopes: 2]
@ -126,10 +125,10 @@ def token_exchange(conn, %{"grant_type" => "authorization_code"} = params) do
def token_exchange( def token_exchange(
conn, conn,
%{"grant_type" => "password", "username" => name, "password" => password} = params %{"grant_type" => "password"} = params
) do ) do
with %App{} = app <- get_app_from_request(conn, params), with {_, {:ok, %User{} = user}} <- {:get_user, Authenticator.get_user(conn)},
%User{} = user <- get_user(name, password), %App{} = app <- get_app_from_request(conn, params),
{:auth_active, true} <- {:auth_active, User.auth_active?(user)}, {:auth_active, true} <- {:auth_active, User.auth_active?(user)},
scopes <- oauth_scopes(params, app.scopes), scopes <- oauth_scopes(params, app.scopes),
[] <- scopes -- app.scopes, [] <- scopes -- app.scopes,
@ -213,28 +212,4 @@ defp get_app_from_request(conn, params) do
nil nil
end end
end end
defp get_user(name, password) do
if Pleroma.Config.get([:ldap, :enabled]) do
case Pleroma.LDAP.get_user(name, password) do
%User{} = user ->
user
{:error, {:ldap_connection_error, _}} ->
# When LDAP is unavailable, try default login
with %User{} = user <- User.get_by_nickname_or_email(name),
true <- Pbkdf2.checkpw(password, user.password_hash) do
user
end
error ->
error
end
else
with %User{} = user <- User.get_by_nickname_or_email(name),
true <- Pbkdf2.checkpw(password, user.password_hash) do
user
end
end
end
end end