Mercurial > prosody-modules
annotate mod_http_auth_check/mod_http_auth_check.lua @ 6319:04c3273cb81f
mod_auth_cyrus: Add empty 'profile' table to SASL handler objects
This is for compatibility with Prosody's built-in util.sasl objects.
A SASL profile table usually includes methods supported by the backend, which
can be used by SASL mechanism handlers to perform operations (such as testing
the password). It also optionally contains a 'cb' field with channel binding
method handlers.
The Cyrus backend doesn't support channel binding, and doesn't have the same
concept of auth backend methods (it handles all that internally, and Prosody
has no insight or control over it).
Thus, we create an empty profile which informs Prosody that the SASL handler
does not support any of the auth or channel binding methods. Some features
will not work, but they didn't work anyway. This just makes it explicit.
This fixes a traceback in mod_sasl2_fast, which expected SASL handlers to
always contain a 'profile' field.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 04 Sep 2025 10:14:46 +0100 |
| parents | 5ca6d53d3186 |
| children |
| rev | line source |
|---|---|
|
2884
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
1 -- HTTP Is User Valid |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
2 -- By Nicolas Cedilnik <nicoco@nicoco.fr> |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
3 |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
4 local jid_prep = require "util.jid".prep; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
5 local jid_split = require "util.jid".split; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
6 local test_password = require "core.usermanager".test_password; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
7 local b64_decode = require "util.encodings".base64.decode; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
8 local saslprep = require "util.encodings".stringprep.saslprep; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
9 local realm = module:get_host() .. "/" .. module:get_name(); |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
10 module:depends"http"; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
11 |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
12 local function authenticate (event, path) |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
13 local request = event.request; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
14 local response = event.response; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
15 local headers = request.headers; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
16 if not headers.authorization then |
|
2886
5ca6d53d3186
Return 401 with correct realm when no user/pass is provided
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
2884
diff
changeset
|
17 response.headers.www_authenticate = ("Basic realm=%q"):format(realm); |
|
5ca6d53d3186
Return 401 with correct realm when no user/pass is provided
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
2884
diff
changeset
|
18 return 401 |
|
2884
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
19 end |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
20 local from_jid, password = b64_decode(headers.authorization:match"[^ ]*$"):match"([^:]*):(.*)"; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
21 from_jid = jid_prep(from_jid); |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
22 password = saslprep(password); |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
23 if from_jid and password then |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
24 local user, host = jid_split(from_jid); |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
25 local ok, err = test_password(user, host, password); |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
26 if ok and user and host then |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
27 return 200 |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
28 elseif err then |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
29 return 401 |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
30 end |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
31 end |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
32 end |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
33 |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
34 module:provides("http", { |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
35 route = { |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
36 GET = authenticate |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
37 }; |
|
16e9f37b3f82
mod_http_auth_check: New HTTP module to test user credentials
Nicolas Cedilnik <nicoco@nicoco.fr>
parents:
diff
changeset
|
38 }); |
