prosody-modules: mod_auth_ldap/mod_auth

annotate mod_auth_ldap/mod_auth_ldap.lua @ 735:c1b0f0c33c6a

mod_archive: Fix hour offset in stored message date os.date expect a timestamp in local time, that is subject to daylight saving. But since we pass an UTC timestamp to os.date one hour is (wrongly) added in the summer. The only sensible thing is to call the os.date only once with the ! parametter. And then parsing this sting to get the utc_timestamp. Calling os.date with an UTC timestamp is not possible, and calling os.date twice without timestamp could give different results.

author	Olivier Goffart <ogoffart@woboq.com>
date	Wed, 04 Jul 2012 13:49:57 +0200
parents	8e9e5c7d97ff
children	881ec9919144

rev	line source
293 d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	1
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	2 local new_sasl = require "util.sasl".new;
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	3 local nodeprep = require "util.encodings".stringprep.nodeprep;
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	4 local log = require "util.logger".init("auth_ldap");
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	5
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	6 local ldap_server = module:get_option("ldap_server") or "localhost";
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	7 local ldap_rootdn = module:get_option("ldap_rootdn") or "";
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	8 local ldap_password = module:get_option("ldap_password") or "";
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	9 local ldap_tls = module:get_option("ldap_tls");
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	10 local ldap_base = assert(module:get_option("ldap_base"), "ldap_base is a required option for ldap");
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	11
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	12 local lualdap = require "lualdap";
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	13 local ld = assert(lualdap.open_simple(ldap_server, ldap_rootdn, ldap_password, ldap_tls));
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	14 module.unload = function() ld:close(); end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	15
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	16 function do_query(query)
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	17 for dn, attribs in ld:search(query) do
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	18 return true; -- found a result
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	19 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	20 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	21
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	22 local provider = { name = "ldap" };
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	23
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	24 local function ldap_filter_escape(s) return (s:gsub("[\\*\\(\\)\\\\%z]", function(c) return ("\\%02x"):format(c:byte()) end)); end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	25 function provider.test_password(username, password)
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	26 return do_query({
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	27 base = ldap_base;
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	28 filter = "(&(uid="..ldap_filter_escape(username)..")(userPassword="..ldap_filter_escape(password)..")(accountStatus=active))";
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	29 });
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	30 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	31 function provider.user_exists(username)
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	32 return do_query({
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	33 base = ldap_base;
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	34 filter = "(uid="..ldap_filter_escape(username)..")";
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	35 });
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	36 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	37
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	38 function provider.get_password(username) return nil, "Passwords unavailable for LDAP."; end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	39 function provider.set_password(username, password) return nil, "Passwords unavailable for LDAP."; end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	40 function provider.create_user(username, password) return nil, "Account creation/modification not available with LDAP."; end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	41
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	42 function provider.get_sasl_handler()
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	43 local testpass_authentication_profile = {
305 4c3abf1a9b5a mod_auth_, mod_saslauth_muc: Update SASL callbacks to take SASL handler as first argument. Waqas Hussain <waqas20@gmail.com>* parents: 293 diff changeset	44 plain_test = function(sasl, username, password, realm)
293 d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	45 local prepped_username = nodeprep(username);
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	46 if not prepped_username then
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	47 log("debug", "NODEprep failed on username: %s", username);
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	48 return "", nil;
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	49 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	50 return provider.test_password(prepped_username, password), true;
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	51 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	52 };
342 8e9e5c7d97ff mod_auth_: Get rid of undocumented and broken 'sasl_realm' config option. Waqas Hussain <waqas20@gmail.com>* parents: 305 diff changeset	53 return new_sasl(module.host, testpass_authentication_profile);
293 d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	54 end
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	55
d76f47a608ab mod_auth_ldap: Convert to real line endings Matthew Wild <mwild1@gmail.com> parents: 286 diff changeset	56 module:add_item("auth-provider", provider);

Mercurial > prosody-modules

annotate mod_auth_ldap/mod_auth_ldap.lua @ 735:c1b0f0c33c6a