aboutsummaryrefslogtreecommitdiffstats
path: root/plugins/mod_hashpassauth.lua
diff options
context:
space:
mode:
Diffstat (limited to 'plugins/mod_hashpassauth.lua')
-rw-r--r--plugins/mod_hashpassauth.lua38
1 files changed, 26 insertions, 12 deletions
diff --git a/plugins/mod_hashpassauth.lua b/plugins/mod_hashpassauth.lua
index 3c5cd291..8f38f03f 100644
--- a/plugins/mod_hashpassauth.lua
+++ b/plugins/mod_hashpassauth.lua
@@ -32,22 +32,28 @@ function new_hashpass_provider(host)
log("debug", "initializing hashpass authentication provider for host '%s'", host);
function provider.test_password(username, password)
- log("debug", "test password for user %s at host %s", username, module.host);
if is_cyrus(host) then return nil, "Legacy auth not supported with Cyrus SASL."; end
local credentials = datamanager.load(username, host, "accounts") or {};
- if credentials.hashpass == nil or credentials.iteration_count == nil or credentials.salt == nil then
- return nil, "Auth failed. Stored credential information is not complete.";
+ if credentials.iteration_count == nil or credentials.salt == nil or string.len(credentials.salt) == 0 then
+ return nil, "Auth failed. Stored salt and iteration count information is not complete.";
+ end
+
+ if credentials.password ~= nil and string.len(credentials.password) ~= 0 then
+ if credentials.password ~= password then
+ return nil, "Auth failed. Provided password is incorrect.";
+ end
+
+ if provider.set_password(username, credentials.password) == nil then
+ return nil, "Auth failed. Could not set hashed password from plaintext.";
+ else
+ return true;
+ end
end
local valid, binpass = saltedPasswordSHA1(password, credentials.salt, credentials.iteration_count);
local hexpass = binpass:gsub(".", function (c) return ("%02x"):format(c:byte()); end);
- if valid then
- log("debug", "salted password returned valid");
- else
- log("debug", "salted password returned not valid");
- end
- log("debug", "hexpass is '%s', stored pass is '%s'", hexpass, credentials.hashpass);
+
if valid and hexpass == credentials.hashpass then
return true;
else
@@ -56,9 +62,16 @@ function new_hashpass_provider(host)
end
function provider.get_password(username)
- log("debug", "get_password for username '%s' at host '%s'", username, module.host);
if is_cyrus(host) then return nil, "Passwords unavailable for Cyrus SASL."; end
- return (datamanager.load(username, host, "accounts") or {}).hashpass;
+ local credentials = datamanager.load(username, host, "accounts") or {};
+ if(credentials.password ~= nil or (credentials.password ~= nil and string.len(credentials.password) ~= 0)) then
+ if provider.set_password(username, credentials.password) == nil then
+ return nil, "Problem setting plaintext password to hashed password.";
+ end
+ credentials = datamanager.load(username, host, "accounts");
+ return credentials.hashpass;
+ end
+ return credentials.hashpass;
end
function provider.set_password(username, password)
@@ -77,6 +90,7 @@ function new_hashpass_provider(host)
local hexpass = binpass:gsub(".", function (c) return ("%02x"):format(c:byte()); end);
account.hashpass = hexpass;
+ account.password = nil;
return datamanager.store(username, host, "accounts", account);
end
return nil, "Account not available.";
@@ -89,7 +103,7 @@ function new_hashpass_provider(host)
log("debug", "account not found for username '%s' at host '%s'", username, module.host);
return nil, "Auth failed. Invalid username";
end
- if account.hashpass == nil or string.len(account.hashpass) == 0 then
+ if (account.hashpass == nil or string.len(account.hashpass) == 0) and (account.password == nil or string.len(account.password) == 0) then
log("debug", "account password not set or zero-length for username '%s' at host '%s'", username, module.host);
return nil, "Auth failed. Password invalid.";
end