gitea/models/login.go

514 lines
12 KiB
Go
Raw Normal View History

// Copyright 2014 The Gogs Authors. All rights reserved.
2014-05-05 11:32:47 +02:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
2014-04-26 08:21:04 +02:00
package models
2014-05-03 04:48:14 +02:00
import (
2014-05-15 20:46:04 +02:00
"crypto/tls"
2014-05-03 04:48:14 +02:00
"encoding/json"
2014-05-05 10:40:25 +02:00
"errors"
2014-05-11 09:49:36 +02:00
"fmt"
"net/smtp"
"net/textproto"
2014-05-11 08:12:45 +02:00
"strings"
2014-05-03 04:48:14 +02:00
"time"
2014-04-26 08:21:04 +02:00
2015-09-11 18:03:08 +02:00
"github.com/Unknwon/com"
2014-05-03 04:48:14 +02:00
"github.com/go-xorm/core"
2014-05-05 10:40:25 +02:00
"github.com/go-xorm/xorm"
2014-05-05 11:32:47 +02:00
2014-05-03 04:48:14 +02:00
"github.com/gogits/gogs/modules/auth/ldap"
2015-04-23 13:58:57 +02:00
"github.com/gogits/gogs/modules/auth/pam"
2014-05-15 16:34:36 +02:00
"github.com/gogits/gogs/modules/log"
2014-05-03 04:48:14 +02:00
)
2014-04-26 08:21:04 +02:00
type LoginType int
2015-09-10 21:03:14 +02:00
// Note: new type must be added at the end of list to maintain compatibility.
2014-05-05 10:40:25 +02:00
const (
LOGIN_NOTYPE LoginType = iota
LOGIN_PLAIN
LOGIN_LDAP
LOGIN_SMTP
LOGIN_PAM
LOGIN_DLDAP
2014-05-05 10:40:25 +02:00
)
var (
ErrAuthenticationAlreadyExist = errors.New("Authentication already exist")
ErrAuthenticationUserUsed = errors.New("Authentication has been used by some users")
)
2015-09-10 23:11:41 +02:00
var LoginNames = map[LoginType]string{
LOGIN_LDAP: "LDAP (via BindDN)",
LOGIN_DLDAP: "LDAP (simple auth)",
LOGIN_SMTP: "SMTP",
LOGIN_PAM: "PAM",
2014-05-05 10:40:25 +02:00
}
2014-04-26 08:21:04 +02:00
2014-12-07 02:22:48 +01:00
// Ensure structs implemented interface.
2014-05-12 17:02:36 +02:00
var (
_ core.Conversion = &LDAPConfig{}
_ core.Conversion = &SMTPConfig{}
2015-04-23 13:58:57 +02:00
_ core.Conversion = &PAMConfig{}
2014-05-12 17:02:36 +02:00
)
2014-04-26 08:21:04 +02:00
type LDAPConfig struct {
2015-09-14 21:48:51 +02:00
*ldap.Source
2014-04-26 08:21:04 +02:00
}
func (cfg *LDAPConfig) FromDB(bs []byte) error {
2015-09-14 21:48:51 +02:00
return json.Unmarshal(bs, &cfg)
2014-04-26 08:21:04 +02:00
}
func (cfg *LDAPConfig) ToDB() ([]byte, error) {
2015-09-14 21:48:51 +02:00
return json.Marshal(cfg)
2014-04-26 08:21:04 +02:00
}
2014-05-11 09:49:36 +02:00
type SMTPConfig struct {
Auth string
Host string
Port int
AllowedDomains string `xorm:"TEXT"`
TLS bool
SkipVerify bool
2014-05-11 09:49:36 +02:00
}
func (cfg *SMTPConfig) FromDB(bs []byte) error {
return json.Unmarshal(bs, cfg)
}
func (cfg *SMTPConfig) ToDB() ([]byte, error) {
return json.Marshal(cfg)
}
2015-04-23 13:58:57 +02:00
type PAMConfig struct {
ServiceName string // pam service (e.g. system-auth)
}
func (cfg *PAMConfig) FromDB(bs []byte) error {
return json.Unmarshal(bs, &cfg)
}
func (cfg *PAMConfig) ToDB() ([]byte, error) {
return json.Marshal(cfg)
}
2014-04-26 08:21:04 +02:00
type LoginSource struct {
ID int64 `xorm:"pk autoincr"`
Type LoginType
Name string `xorm:"UNIQUE"`
IsActived bool `xorm:"NOT NULL DEFAULT false"`
Cfg core.Conversion `xorm:"TEXT"`
Created time.Time `xorm:"CREATED"`
Updated time.Time `xorm:"UPDATED"`
2014-05-03 04:48:14 +02:00
}
func (source *LoginSource) BeforeSet(colName string, val xorm.Cell) {
switch colName {
case "type":
switch LoginType((*val).(int64)) {
case LOGIN_LDAP, LOGIN_DLDAP:
source.Cfg = new(LDAPConfig)
case LOGIN_SMTP:
source.Cfg = new(SMTPConfig)
case LOGIN_PAM:
source.Cfg = new(PAMConfig)
2015-09-11 18:03:08 +02:00
default:
panic("unrecognized login source type: " + com.ToStr(*val))
}
}
}
2015-09-10 23:11:41 +02:00
func (source *LoginSource) TypeName() string {
return LoginNames[source.Type]
2014-05-05 10:40:25 +02:00
}
2015-09-11 18:03:08 +02:00
func (source *LoginSource) IsLDAP() bool {
return source.Type == LOGIN_LDAP
2015-09-11 18:03:08 +02:00
}
func (source *LoginSource) IsDLDAP() bool {
return source.Type == LOGIN_DLDAP
2015-09-11 18:03:08 +02:00
}
func (source *LoginSource) IsSMTP() bool {
return source.Type == LOGIN_SMTP
2015-09-11 18:03:08 +02:00
}
func (source *LoginSource) IsPAM() bool {
return source.Type == LOGIN_PAM
2015-09-11 18:03:08 +02:00
}
func (source *LoginSource) UseTLS() bool {
switch source.Type {
case LOGIN_LDAP, LOGIN_DLDAP:
2015-09-11 18:03:08 +02:00
return source.LDAP().UseSSL
case LOGIN_SMTP:
2015-09-11 18:03:08 +02:00
return source.SMTP().TLS
}
return false
}
2015-09-14 21:48:51 +02:00
func (source *LoginSource) SkipVerify() bool {
switch source.Type {
case LOGIN_LDAP, LOGIN_DLDAP:
2015-09-14 21:48:51 +02:00
return source.LDAP().SkipVerify
case LOGIN_SMTP:
2015-09-14 21:48:51 +02:00
return source.SMTP().SkipVerify
}
return false
}
2014-05-05 10:40:25 +02:00
func (source *LoginSource) LDAP() *LDAPConfig {
return source.Cfg.(*LDAPConfig)
}
2014-05-11 09:49:36 +02:00
func (source *LoginSource) SMTP() *SMTPConfig {
return source.Cfg.(*SMTPConfig)
}
2015-04-23 13:58:57 +02:00
func (source *LoginSource) PAM() *PAMConfig {
return source.Cfg.(*PAMConfig)
}
2015-09-10 21:45:03 +02:00
// CountLoginSources returns number of login sources.
func CountLoginSources() int64 {
count, _ := x.Count(new(LoginSource))
return count
}
func CreateSource(source *LoginSource) error {
2014-06-21 06:51:41 +02:00
_, err := x.Insert(source)
return err
}
func LoginSources() ([]*LoginSource, error) {
auths := make([]*LoginSource, 0, 5)
return auths, x.Find(&auths)
2014-05-03 04:48:14 +02:00
}
2015-12-05 23:13:13 +01:00
// GetLoginSourceByID returns login source by given ID.
func GetLoginSourceByID(id int64) (*LoginSource, error) {
2014-05-05 10:40:25 +02:00
source := new(LoginSource)
2014-06-21 06:51:41 +02:00
has, err := x.Id(id).Get(source)
2014-05-05 10:40:25 +02:00
if err != nil {
return nil, err
} else if !has {
2015-12-05 23:13:13 +01:00
return nil, ErrAuthenticationNotExist{id}
2014-05-05 10:40:25 +02:00
}
return source, nil
}
2014-05-11 12:10:37 +02:00
func UpdateSource(source *LoginSource) error {
_, err := x.Id(source.ID).AllCols().Update(source)
2014-05-03 04:48:14 +02:00
return err
}
2015-09-11 18:03:08 +02:00
func DeleteSource(source *LoginSource) error {
count, err := x.Count(&User{LoginSource: source.ID})
2014-05-05 10:40:25 +02:00
if err != nil {
return err
2015-09-11 18:03:08 +02:00
} else if count > 0 {
2014-05-05 10:40:25 +02:00
return ErrAuthenticationUserUsed
}
2015-09-11 18:03:08 +02:00
_, err = x.Id(source.ID).Delete(new(LoginSource))
2014-05-03 04:48:14 +02:00
return err
2014-04-26 08:21:04 +02:00
}
2014-05-11 08:12:45 +02:00
// .____ ________ _____ __________
// | | \______ \ / _ \\______ \
// | | | | \ / /_\ \| ___/
// | |___ | ` \/ | \ |
// |_______ \/_______ /\____|__ /____|
// \/ \/ \/
2014-05-11 08:12:45 +02:00
// LoginUserLDAPSource queries if loginName/passwd can login against the LDAP directory pool,
2015-11-21 18:58:31 +01:00
// and create a local user if success when enabled.
// It returns the same LoginUserPlain semantic.
func LoginUserLDAPSource(u *User, loginName, passwd string, source *LoginSource, autoRegister bool) (*User, error) {
2015-09-05 05:39:23 +02:00
cfg := source.Cfg.(*LDAPConfig)
directBind := (source.Type == LOGIN_DLDAP)
name, fn, sn, mail, admin, logged := cfg.SearchEntry(loginName, passwd, directBind)
2014-05-11 08:12:45 +02:00
if !logged {
2014-12-06 00:08:09 +01:00
// User not in LDAP, do nothing
return nil, ErrUserNotExist{0, loginName}
2014-05-11 08:12:45 +02:00
}
2014-05-11 08:12:45 +02:00
if !autoRegister {
2014-07-26 06:24:27 +02:00
return u, nil
2014-05-11 08:12:45 +02:00
}
2014-12-06 00:08:09 +01:00
// Fallback.
if len(name) == 0 {
name = loginName
}
2014-12-06 00:08:09 +01:00
if len(mail) == 0 {
mail = fmt.Sprintf("%s@localhost", name)
2014-12-06 00:08:09 +01:00
}
2014-07-26 06:24:27 +02:00
u = &User{
LowerName: strings.ToLower(name),
2014-12-06 00:08:09 +01:00
Name: name,
FullName: composeFullName(fn, sn, name),
2015-09-05 05:39:23 +02:00
LoginType: source.Type,
LoginSource: source.ID,
LoginName: loginName,
2014-05-11 08:12:45 +02:00
Email: mail,
IsAdmin: admin,
2014-12-06 00:08:09 +01:00
IsActive: true,
2014-05-11 08:12:45 +02:00
}
2014-12-06 00:08:09 +01:00
return u, CreateUser(u)
2014-05-11 08:12:45 +02:00
}
2014-05-11 09:49:36 +02:00
func composeFullName(firstName, surename, userName string) string {
switch {
case len(firstName) == 0 && len(surename) == 0:
return userName
case len(firstName) == 0:
return surename
case len(surename) == 0:
return firstName
default:
return firstName + " " + surename
}
}
// _________ __________________________
// / _____/ / \__ ___/\______ \
// \_____ \ / \ / \| | | ___/
// / \/ Y \ | | |
// /_______ /\____|__ /____| |____|
// \/ \/
2014-05-11 09:49:36 +02:00
type loginAuth struct {
username, password string
}
func LoginAuth(username, password string) smtp.Auth {
return &loginAuth{username, password}
}
func (a *loginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
return "LOGIN", []byte(a.username), nil
}
func (a *loginAuth) Next(fromServer []byte, more bool) ([]byte, error) {
if more {
switch string(fromServer) {
case "Username:":
return []byte(a.username), nil
case "Password:":
return []byte(a.password), nil
}
}
return nil, nil
}
const (
2014-05-11 12:10:37 +02:00
SMTP_PLAIN = "PLAIN"
SMTP_LOGIN = "LOGIN"
2014-05-11 09:49:36 +02:00
)
2015-09-10 23:11:41 +02:00
var SMTPAuths = []string{SMTP_PLAIN, SMTP_LOGIN}
func SMTPAuth(a smtp.Auth, cfg *SMTPConfig) error {
c, err := smtp.Dial(fmt.Sprintf("%s:%d", cfg.Host, cfg.Port))
2014-05-11 09:49:36 +02:00
if err != nil {
return err
}
defer c.Close()
2014-05-15 20:46:04 +02:00
if err = c.Hello("gogs"); err != nil {
return err
}
if cfg.TLS {
2014-05-11 14:04:28 +02:00
if ok, _ := c.Extension("STARTTLS"); ok {
if err = c.StartTLS(&tls.Config{
InsecureSkipVerify: cfg.SkipVerify,
ServerName: cfg.Host,
}); err != nil {
2014-05-11 14:04:28 +02:00
return err
}
} else {
2014-05-16 05:03:26 +02:00
return errors.New("SMTP server unsupports TLS")
2014-05-11 09:49:36 +02:00
}
}
if ok, _ := c.Extension("AUTH"); ok {
if err = c.Auth(a); err != nil {
return err
}
return nil
}
return ErrUnsupportedLoginType
2014-05-11 09:49:36 +02:00
}
2014-12-07 02:22:48 +01:00
// Query if name/passwd can login against the LDAP directory pool
2014-05-11 09:49:36 +02:00
// Create a local user if success
// Return the same LoginUserPlain semantic
func LoginUserSMTPSource(u *User, name, passwd string, sourceID int64, cfg *SMTPConfig, autoRegister bool) (*User, error) {
// Verify allowed domains.
if len(cfg.AllowedDomains) > 0 {
idx := strings.Index(name, "@")
if idx == -1 {
return nil, ErrUserNotExist{0, name}
} else if !com.IsSliceContainsStr(strings.Split(cfg.AllowedDomains, ","), name[idx+1:]) {
return nil, ErrUserNotExist{0, name}
}
}
2014-05-11 09:49:36 +02:00
var auth smtp.Auth
2014-05-11 12:10:37 +02:00
if cfg.Auth == SMTP_PLAIN {
2014-05-11 09:49:36 +02:00
auth = smtp.PlainAuth("", name, passwd, cfg.Host)
2014-05-11 12:10:37 +02:00
} else if cfg.Auth == SMTP_LOGIN {
2014-05-11 09:49:36 +02:00
auth = LoginAuth(name, passwd)
2014-05-11 14:04:28 +02:00
} else {
2014-05-15 20:46:04 +02:00
return nil, errors.New("Unsupported SMTP auth type")
2014-05-11 09:49:36 +02:00
}
if err := SMTPAuth(auth, cfg); err != nil {
// Check standard error format first,
// then fallback to worse case.
tperr, ok := err.(*textproto.Error)
if (ok && tperr.Code == 535) ||
strings.Contains(err.Error(), "Username and Password not accepted") {
return nil, ErrUserNotExist{0, name}
2014-05-15 20:46:04 +02:00
}
2014-05-11 09:49:36 +02:00
return nil, err
}
if !autoRegister {
2014-07-26 06:24:27 +02:00
return u, nil
2014-05-11 09:49:36 +02:00
}
2014-05-11 14:04:28 +02:00
var loginName = name
idx := strings.Index(name, "@")
if idx > -1 {
loginName = name[:idx]
}
2014-05-11 09:49:36 +02:00
// fake a local user creation
2014-07-26 06:24:27 +02:00
u = &User{
2014-05-11 14:04:28 +02:00
LowerName: strings.ToLower(loginName),
Name: strings.ToLower(loginName),
LoginType: LOGIN_SMTP,
LoginSource: sourceID,
2014-05-11 09:49:36 +02:00
LoginName: name,
IsActive: true,
Passwd: passwd,
Email: name,
}
2014-07-26 06:24:27 +02:00
err := CreateUser(u)
return u, err
2014-05-11 09:49:36 +02:00
}
2015-04-23 13:58:57 +02:00
// __________ _____ _____
// \______ \/ _ \ / \
// | ___/ /_\ \ / \ / \
// | | / | \/ Y \
// |____| \____|__ /\____|__ /
// \/ \/
2015-04-23 13:58:57 +02:00
// Query if name/passwd can login against PAM
// Create a local user if success
// Return the same LoginUserPlain semantic
func LoginUserPAMSource(u *User, name, passwd string, sourceID int64, cfg *PAMConfig, autoRegister bool) (*User, error) {
2015-04-23 13:58:57 +02:00
if err := pam.PAMAuth(cfg.ServiceName, name, passwd); err != nil {
if strings.Contains(err.Error(), "Authentication failure") {
2015-09-14 17:03:42 +02:00
return nil, ErrUserNotExist{0, name}
2015-04-23 13:58:57 +02:00
}
return nil, err
}
if !autoRegister {
return u, nil
}
// fake a local user creation
u = &User{
LowerName: strings.ToLower(name),
2015-11-24 02:43:04 +01:00
Name: name,
LoginType: LOGIN_PAM,
LoginSource: sourceID,
2015-04-23 13:58:57 +02:00
LoginName: name,
IsActive: true,
Passwd: passwd,
Email: name,
}
2015-11-24 02:43:04 +01:00
return u, CreateUser(u)
2015-04-23 13:58:57 +02:00
}
func ExternalUserLogin(u *User, name, passwd string, source *LoginSource, autoRegister bool) (*User, error) {
if !source.IsActived {
return nil, ErrLoginSourceNotActived
}
switch source.Type {
case LOGIN_LDAP, LOGIN_DLDAP:
return LoginUserLDAPSource(u, name, passwd, source, autoRegister)
case LOGIN_SMTP:
return LoginUserSMTPSource(u, name, passwd, source.ID, source.Cfg.(*SMTPConfig), autoRegister)
case LOGIN_PAM:
return LoginUserPAMSource(u, name, passwd, source.ID, source.Cfg.(*PAMConfig), autoRegister)
}
return nil, ErrUnsupportedLoginType
}
// UserSignIn validates user name and password.
func UserSignIn(uname, passwd string) (*User, error) {
var u *User
if strings.Contains(uname, "@") {
2015-11-24 02:43:04 +01:00
u = &User{Email: strings.ToLower(uname)}
} else {
u = &User{LowerName: strings.ToLower(uname)}
}
userExists, err := x.Get(u)
if err != nil {
return nil, err
}
if userExists {
switch u.LoginType {
case LOGIN_NOTYPE, LOGIN_PLAIN:
if u.ValidatePassword(passwd) {
return u, nil
}
return nil, ErrUserNotExist{u.Id, u.Name}
default:
var source LoginSource
hasSource, err := x.Id(u.LoginSource).Get(&source)
if err != nil {
return nil, err
} else if !hasSource {
return nil, ErrLoginSourceNotExist
}
return ExternalUserLogin(u, u.LoginName, passwd, &source, false)
}
}
var sources []LoginSource
if err = x.UseBool().Find(&sources, &LoginSource{IsActived: true}); err != nil {
return nil, err
}
for _, source := range sources {
u, err := ExternalUserLogin(nil, uname, passwd, &source, true)
if err == nil {
return u, nil
}
log.Warn("Failed to login '%s' via '%s': %v", uname, source.Name, err)
}
return nil, ErrUserNotExist{u.Id, u.Name}
}