aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_auth_internal_hashed.lua
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/mod_auth_internal_hashed.lua')
-rw-r--r--plugins/mod_auth_internal_hashed.lua70
1 files changed, 55 insertions, 15 deletions
diff --git a/plugins/mod_auth_internal_hashed.lua b/plugins/mod_auth_internal_hashed.lua
index cf851eef..806eb9bd 100644
--- a/plugins/mod_auth_internal_hashed.lua
+++ b/plugins/mod_auth_internal_hashed.lua
@@ -9,26 +9,27 @@
local max = math.max;
-local scram_hashers = require "util.sasl.scram".hashers;
-local usermanager = require "core.usermanager";
-local generate_uuid = require "util.uuid".generate;
-local new_sasl = require "util.sasl".new;
-local hex = require"util.hex";
+local scram_hashers = require "prosody.util.sasl.scram".hashers;
+local generate_uuid = require "prosody.util.uuid".generate;
+local new_sasl = require "prosody.util.sasl".new;
+local hex = require"prosody.util.hex";
local to_hex, from_hex = hex.encode, hex.decode;
-local saslprep = require "util.encodings".stringprep.saslprep;
-local secure_equals = require "util.hashes".equals;
+local saslprep = require "prosody.util.encodings".stringprep.saslprep;
+local secure_equals = require "prosody.util.hashes".equals;
local log = module._log;
local host = module.host;
local accounts = module:open_store("accounts");
-local hash_name = module:get_option_string("password_hash", "SHA-1");
+local hash_name = module:get_option_enum("password_hash", "SHA-1", "SHA-256");
local get_auth_db = assert(scram_hashers[hash_name], "SCRAM-"..hash_name.." not supported by SASL library");
local scram_name = "scram_"..hash_name:gsub("%-","_"):lower();
-- Default; can be set per-user
-local default_iteration_count = module:get_option_number("default_iteration_count", 10000);
+local default_iteration_count = module:get_option_integer("default_iteration_count", 10000, 4096);
+
+local tokenauth = module:depends("tokenauth");
-- define auth provider
local provider = {};
@@ -36,6 +37,9 @@ local provider = {};
function provider.test_password(username, password)
log("debug", "test password for user '%s'", username);
local credentials = accounts:get(username) or {};
+ if credentials.disabled then
+ return nil, "Account disabled.";
+ end
password = saslprep(password);
if not password then
return nil, "Password fails SASLprep.";
@@ -86,11 +90,22 @@ function provider.set_password(username, password)
account.server_key = server_key_hex
account.password = nil;
+ account.updated = os.time();
return accounts:set(username, account);
end
return nil, "Account not available.";
end
+function provider.get_account_info(username)
+ local account = accounts:get(username);
+ if not account then return nil, "Account not available"; end
+ return {
+ created = account.created;
+ password_updated = account.updated;
+ enabled = not account.disabled;
+ };
+end
+
function provider.user_exists(username)
local account = accounts:get(username);
if not account then
@@ -100,13 +115,36 @@ function provider.user_exists(username)
return true;
end
+function provider.is_enabled(username) -- luacheck: ignore 212
+ local info, err = provider.get_account_info(username);
+ if not info then return nil, err; end
+ return info.enabled;
+end
+
+function provider.enable(username)
+ -- TODO map store?
+ local account = accounts:get(username);
+ account.disabled = nil;
+ account.updated = os.time();
+ return accounts:set(username, account);
+end
+
+function provider.disable(username, meta)
+ local account = accounts:get(username);
+ account.disabled = true;
+ account.disabled_meta = meta;
+ account.updated = os.time();
+ return accounts:set(username, account);
+end
+
function provider.users()
return accounts:users();
end
function provider.create_user(username, password)
+ local now = os.time();
if password == nil then
- return accounts:set(username, {});
+ return accounts:set(username, { created = now; updated = now; disabled = true });
end
local salt = generate_uuid();
local valid, stored_key, server_key = get_auth_db(password, salt, default_iteration_count);
@@ -117,7 +155,8 @@ function provider.create_user(username, password)
local server_key_hex = to_hex(server_key);
return accounts:set(username, {
stored_key = stored_key_hex, server_key = server_key_hex,
- salt = salt, iteration_count = default_iteration_count
+ salt = salt, iteration_count = default_iteration_count,
+ created = now, updated = now;
});
end
@@ -127,8 +166,8 @@ end
function provider.get_sasl_handler()
local testpass_authentication_profile = {
- plain_test = function(_, username, password, realm)
- return usermanager.test_password(username, realm, password), true;
+ plain_test = function(_, username, password)
+ return provider.test_password(username, password), provider.is_enabled(username);
end,
[scram_name] = function(_, username)
local credentials = accounts:get(username);
@@ -145,8 +184,9 @@ function provider.get_sasl_handler()
local iteration_count, salt = credentials.iteration_count, credentials.salt;
stored_key = stored_key and from_hex(stored_key);
server_key = server_key and from_hex(server_key);
- return stored_key, server_key, iteration_count, salt, true;
- end
+ return stored_key, server_key, iteration_count, salt, not credentials.disabled;
+ end;
+ oauthbearer = tokenauth.sasl_handler(provider, "oauth2", module:shared("tokenauth/oauthbearer_config"));
};
return new_sasl(host, testpass_authentication_profile);
end