aboutsummaryrefslogtreecommitdiffstats
path: root/core/usermanager.lua
Commit message (Collapse)AuthorAgeFilesLines
* core.usermanager: Link to docs for new role API to make warning more actionableKim Alvefur2022-08-271-0/+1
|
* core.usermanager: Update argument name in authz fallback methodKim Alvefur2022-08-181-1/+1
| | | | It's not plural
* core.usermanager: Remove obsolete authz fallback methodKim Alvefur2022-08-181-1/+0
|
* core.usermanager: Add missing methods to fallback authz providerKim Alvefur2022-08-181-0/+3
|
* core.usermanager: Add scoped luacheck ignore rule to reduce clutterKim Alvefur2022-08-181-11/+12
|
* mod_authz_internal: Expose convenience method to test if user can assume roleMatthew Wild2022-08-181-0/+8
|
* mod_authz_internal, and more: New iteration of role APIMatthew Wild2022-08-171-19/+49
| | | | | | | | | | | These changes to the API (hopefully the last) introduce a cleaner separation between the user's primary (default) role, and their secondary (optional) roles. To keep the code sane and reduce complexity, a data migration is needed for people using stored roles in 0.12. This can be performed with prosodyctl mod_authz_internal migrate <host>
* usermanager: Add back temporary is_admin to warn about deprecated API usageMatthew Wild2022-08-151-0/+19
| | | | | | | | | | | | | | | | | | | | | | | | Goal: Introduce role-auth with minimal disruption is_admin() is unsafe in a system with per-session permissions, so it has been deprecated. Roll-out approach: 1) First, log a warning when is_admin() is used. It should continue to function normally, backed by the new role API. Nothing is really using per-session authz yet, so there is minimal security concern. The 'strict_deprecate_is_admin' global setting can be set to 'true' to force a hard failure of is_admin() attempts (it will log an error and always return false). 2) In some time (at least 1 week), but possibly longer depending on the number of affected deployments: switch 'strict_deprecate_is_admin' to 'true' by default. It can still be disabled for systems that need it. 3) Further in the future, before the next release, the option will be removed and is_admin() will be permanently disabled.
* usermanager: Remove concept of global authz providerMatthew Wild2022-08-121-46/+12
| | | | | | | | | | | | | | | Rationale: - Removes a bunch of code! - We don't have many cases where an actor is not bound to one of our hosts - A notable exception is the admin shell, but if we ever attempt to lock those sessions down, there is a load of other work that also has to be done. And it's not clear if we would need a global authz provider for that anyway. - Removes an extra edge case from the necessary mental model for operators - Sessions that aren't bound to a host generally are anonymous or have an alternative auth model (such as by IP addres). - With the encapsulation now provided by util.roles, ad-hoc "detached roles" can still be created anyway by code that needs them.
* usermanager: Fix method name of global authz provider (thanks Zash)Matthew Wild2022-08-121-1/+1
|
* usermanager: Remove obsolete function from global authz providerMatthew Wild2022-08-111-5/+0
|
* usermanager: Handle local JIDs being passed to get/set_jid_role()Matthew Wild2022-08-011-1/+9
| | | | | There is no reasonable fallback for set_jid_role() because users may have multiple roles, so that's an error.
* core.usermanager: Add missing stub authz methods to global authz providerKim Alvefur2022-07-201-0/+7
| | | | Except, should we have a global authz provider at all?
* mod_authz_internal: Use util.roles, some API changes and config supportMatthew Wild2022-07-191-31/+49
| | | | | | | | | | | | | | | | This commit was too awkward to split (hg record didn't like it), so: - Switch to the new util.roles lib to provide a consistent representation of a role object. - Change API method from get_role_info() to get_role_by_name() (touches sessionmanager and usermanager) - Change get_roles() to get_user_roles(), take a username instead of a JID This is more consistent with all other usermanager API methods. - Support configuration of custom roles and permissions via the config file (to be documented).
* usermanager, mod_auth_*: Add get_account_info() returning creation/update timeMatthew Wild2022-07-121-0/+7
| | | | | | | This is useful for a number of things. For example, listing users that need to rotate their passwords after some event. It also provides a safer way for code to determine that a user password has changed without needing to set a handler for the password change event (which is a more fragile approach).
* Switch to a new role-based authorization framework, removing is_admin()Matthew Wild2022-06-151-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We began moving away from simple "is this user an admin?" permission checks before 0.12, with the introduction of mod_authz_internal and the ability to dynamically change the roles of individual users. The approach in 0.12 still had various limitations however, and apart from the introduction of roles other than "admin" and the ability to pull that info from storage, not much actually changed. This new framework shakes things up a lot, though aims to maintain the same functionality and behaviour on the surface for a default Prosody configuration. That is, if you don't take advantage of any of the new features, you shouldn't notice any change. The biggest change visible to developers is that usermanager.is_admin() (and the auth provider is_admin() method) have been removed. Gone. Completely. Permission checks should now be performed using a new module API method: module:may(action_name, context) This method accepts an action name, followed by either a JID (string) or (preferably) a table containing 'origin'/'session' and 'stanza' fields (e.g. the standard object passed to most events). It will return true if the action should be permitted, or false/nil otherwise. Modules should no longer perform permission checks based on the role name. E.g. a lot of code previously checked if the user's role was prosody:admin before permitting some action. Since many roles might now exist with similar permissions, and the permissions of prosody:admin may be redefined dynamically, it is no longer suitable to use this method for permission checks. Use module:may(). If you start an action name with ':' (recommended) then the current module's name will automatically be used as a prefix. To define a new permission, use the new module API: module:default_permission(role_name, action_name) module:default_permissions(role_name, { action_name[, action_name...] }) This grants the specified role permission to execute the named action(s) by default. This may be overridden via other mechanisms external to your module. The built-in roles that developers should use are: - prosody:user (normal user) - prosody:admin (host admin) - prosody:operator (global admin) The new prosody:operator role is intended for server-wide actions (such as shutting down Prosody). Finally, all usage of is_admin() in modules has been fixed by this commit. Some of these changes were trickier than others, but no change is expected to break existing deployments. EXCEPT: mod_auth_ldap no longer supports the ldap_admin_filter option. It's very possible nobody is using this, but if someone is then we can later update it to pull roles from LDAP somehow.
* usermanager, mod_saslauth: Default to internal_hashed if no auth module ↵Matthew Wild2022-02-101-1/+1
| | | | | | | | | | specified The default config was updated in this way long ago, but if no option was present in the config, Prosody would load internal_plain. This change can result in changes (for the better) for people using very old configuration files lacking an 'authentication' setting.
* core.usermanager: Implement noop role writes on global authz providerKim Alvefur2021-12-061-0/+2
| | | | So that the methods are there and don't cause an error.
* usermanager: Fire user-roles-changed event when updating roles of a local userMatthew Wild2021-11-121-1/+7
|
* usermanager, mod_authz_internal: Add methods to fetch users/JIDs of given roleMatthew Wild2021-08-261-0/+24
|
* usermanager: expose set_roles through APIJonas Schäfer2021-03-221-0/+18
|
* usermanager: Fix traceback when checking admin status of host-only JIDs ↵Matthew Wild2020-03-191-1/+1
| | | | (fixes #1508)
* usermanager, mod_authz_*: Merge mod_authz_config and mod_authz_internal into ↵Matthew Wild2020-02-231-1/+1
| | | | the latter
* usermanager: Add get_roles() functionMatthew Wild2020-02-051-1/+7
|
* mod_authz_internal, usermanager: Rename to mod_authz_configMatthew Wild2020-01-271-1/+1
|
* usermanager: Load authz providers on components alsoMatthew Wild2020-01-271-4/+6
|
* usermanager, mod_authz_internal: Move admin-checking functionality into a ↵Matthew Wild2020-01-271-30/+32
| | | | | | | module. Fixes #517 (ish). Note: Removes the ability for mod_auth_* providers to determine user admin status. Such modules will need to have their is_admin methods ported to be a mod_authz_* provider.
* core: Use prosody.hosts instead of _G.hosts for consistencyKim Alvefur2018-03-291-1/+1
|
* vairious: Add annotation when an empty environment is set [luacheck]Kim Alvefur2018-02-281-0/+1
|
* core.usermanager, various modules: Disconnect other resources on password ↵Kim Alvefur2017-07-281-2/+6
| | | | change (thanks waqas) (fixes #512)
* usermanager: Shortcircuit user existence check if they have existing sessionsKim Alvefur2016-02-211-0/+1
|
* core.usermanager: Return as soon as possible once admin status is knownKim Alvefur2015-12-061-9/+6
|
* core.*: Remove use of module() functionKim Alvefur2015-02-211-14/+27
|
* portmanager, s2smanager, sessionmanager, stanza_router, storagemanager, ↵Matthew Wild2015-05-061-1/+1
| | | | usermanager, util.xml: Add luacheck annotations
* usermanager: Capitalize log messageKim Alvefur2015-04-251-1/+1
|
* usermanager: Remove unused import of pairs()Matthew Wild2013-08-131-1/+0
|
* Remove all trailing whitespaceFlorian Zeitz2013-08-091-5/+5
|
* core.*: Complete removal of all traces of the "core" section and ↵Kim Alvefur2013-03-231-6/+6
| | | | section-related code.
* usermanager: Add support for iterating over accountsKim Alvefur2012-09-211-0/+4
|
* storagemanager: Add purge() for purging user data from all backends in useKim Alvefur2012-09-161-1/+1
|
* core.usermanager: Don't close sessions ourselves when deleting users. ↵Kim Alvefur2012-08-251-6/+1
| | | | Instead, fire an event that modules can hook.
* usermanager: Add method for deleting a userKim Alvefur2012-07-281-1/+11
|
* usermanager: Pass session on to auth provider (missing half of commit ↵Matthew Wild2012-07-071-2/+2
| | | | 0545a574667b) (thanks Zash)
* usermanager: Add log error for use of COMPAT config option ↵Matthew Wild2012-04-281-1/+4
| | | | 'anonymous_login'. To be removed in next version.
* usermanager: Prep admin JIDs (fixes issue#276).Waqas Hussain2011-12-141-2/+4
|
* usermanager: Check host exists before trying to look up admins for itMatthew Wild2011-04-051-0/+2
|
* usermanager: Add delete_user methodMatthew Wild2011-01-041-0/+4
|
* usermanager: Have methods not implemented in the active provider fall back ↵Matthew Wild2011-01-041-1/+3
| | | | to the null provider (later we can add support for chains of providers)
* usermanager: Change dummy provider method to return an error string also ↵Matthew Wild2011-01-041-2/+4
| | | | (method not implemented)
* usermanager: Assume authentication="anonymous" when anonymous_login=true.Waqas Hussain2010-12-271-0/+2
|