|
3
|
1 local usermanager = require "core.usermanager" |
|
|
2 local httpserver = require "net.httpserver" |
|
|
3 local jidutil = require "util.jid" |
|
|
4 local hmac = require "hmac" |
|
|
5 |
|
|
6 local base64 = require "util.encodings".base64 |
|
|
7 |
|
|
8 local humane = require "util.serialization".serialize |
|
|
9 |
|
|
10 -- Configuration |
|
|
11 local base = "openid" |
|
|
12 local openidns = "http://specs.openid.net/auth/2.0" -- [#4.1.2] |
|
|
13 local response_404 = { status = "404 Not Found", body = "<h1>Page Not Found</h1>Sorry, we couldn't find what you were looking for :(" }; |
|
|
14 |
|
|
15 local associations = {} |
|
|
16 |
|
|
17 local function genkey(length) |
|
|
18 -- FIXME not cryptographically secure |
|
|
19 str = {} |
|
|
20 |
|
|
21 for i = 1,length do |
|
|
22 local rand = math.random(33, 126) |
|
|
23 table.insert(str, string.char(rand)) |
|
|
24 end |
|
|
25 |
|
|
26 return table.concat(str) |
|
|
27 end |
|
|
28 |
|
|
29 local function tokvstring(dict) |
|
|
30 -- key-value encoding for a dictionary [#4.1.3] |
|
|
31 local str = "" |
|
|
32 |
|
|
33 for k,v in pairs(dict) do |
|
|
34 str = str..k..":"..v.."\n" |
|
|
35 end |
|
|
36 |
|
|
37 return str |
|
|
38 end |
|
|
39 |
|
|
40 local function newassoc(key, shared) |
|
|
41 -- TODO don't use genkey here |
|
|
42 local handle = genkey(16) |
|
|
43 associations[handle] = {} |
|
|
44 associations[handle]["key"] = key |
|
|
45 associations[handle]["shared"] = shared |
|
|
46 associations[handle]["time"] = os.time() |
|
|
47 return handle |
|
|
48 end |
|
|
49 |
|
|
50 local function split(str, sep) |
|
|
51 local splits = {} |
|
|
52 str:gsub("([^.."..sep.."]*)"..sep, function(c) table.insert(splits, c) end) |
|
|
53 return splits |
|
|
54 end |
|
|
55 |
|
|
56 local function sign(response, key) |
|
|
57 local fields = {} |
|
|
58 |
|
|
59 for _,field in pairs(split(response["openid.signed"],",")) do |
|
|
60 fields[field] = response["openid."..field] |
|
|
61 end |
|
|
62 |
|
|
63 -- [#10.1] |
|
|
64 return base64.encode(hmac.sha256(key, tokvstring(fields))) |
|
|
65 end |
|
|
66 |
|
|
67 local function urlencode(s) |
|
|
68 return (string.gsub(s, "%W", |
|
|
69 function(str) |
|
|
70 return string.format("%%%02X", string.byte(str)) |
|
|
71 end)) |
|
|
72 end |
|
|
73 |
|
|
74 local function urldecode(s) |
|
|
75 return(string.gsub(string.gsub(s, "+", " "), "%%(%x%x)", |
|
|
76 function(str) |
|
|
77 return string.char(tonumber(str,16)) |
|
|
78 end)) |
|
|
79 end |
|
|
80 |
|
|
81 local function utctime() |
|
|
82 local now = os.time() |
|
|
83 local diff = os.difftime(now, os.time(os.date("!*t", now))) |
|
|
84 return now-diff |
|
|
85 end |
|
|
86 |
|
|
87 local function nonce() |
|
|
88 -- generate a response nonce [#10.1] |
|
|
89 local random = "" |
|
|
90 for i=0,10 do |
|
|
91 random = random..string.char(math.random(33,126)) |
|
|
92 end |
|
|
93 |
|
|
94 local timestamp = os.date("%Y-%m-%dT%H:%M:%SZ", utctime()) |
|
|
95 |
|
|
96 return timestamp..random |
|
|
97 end |
|
|
98 |
|
|
99 local function query_params(query) |
|
|
100 if type(query) == "string" and #query > 0 then |
|
|
101 if query:match("=") then |
|
|
102 local params = {} |
|
|
103 for k, v in query:gmatch("&?([^=%?]+)=([^&%?]+)&?") do |
|
|
104 if k and v then |
|
|
105 params[urldecode(k)] = urldecode(v) |
|
|
106 end |
|
|
107 end |
|
|
108 return params |
|
|
109 else |
|
|
110 return urldecode(query) |
|
|
111 end |
|
|
112 end |
|
|
113 end |
|
|
114 |
|
|
115 local function split_host_port(combined) |
|
|
116 local host = combined |
|
|
117 local port = "" |
|
|
118 local cpos = string.find(combined, ":") |
|
|
119 if cpos ~= nil then |
|
|
120 host = string.sub(combined, 0, cpos-1) |
|
|
121 port = string.sub(combined, cpos+1) |
|
|
122 end |
|
|
123 |
|
|
124 return host, port |
|
|
125 end |
|
|
126 |
|
|
127 local function toquerystring(dict) |
|
|
128 -- query string encoding for a dictionary [#4.1.3] |
|
|
129 local str = "" |
|
|
130 |
|
|
131 for k,v in pairs(dict) do |
|
|
132 str = str..urlencode(k).."="..urlencode(v).."&" |
|
|
133 end |
|
|
134 |
|
|
135 return string.sub(str, 0, -1) |
|
|
136 end |
|
|
137 |
|
|
138 local function match_realm(url, realm) |
|
|
139 -- FIXME do actual match [#9.2] |
|
|
140 return true |
|
|
141 end |
|
|
142 |
|
|
143 local function handle_endpoint(method, body, request) |
|
|
144 module:log("debug", "Request at OpenID provider endpoint") |
|
|
145 |
|
|
146 local params = nil |
|
|
147 |
|
|
148 if method == "GET" then |
|
|
149 params = query_params(request.url.query) |
|
|
150 elseif method == "POST" then |
|
|
151 params = query_params(body) |
|
|
152 else |
|
|
153 -- TODO error |
|
|
154 return response_404 |
|
|
155 end |
|
|
156 |
|
|
157 module:log("debug", "Request Parameters:\n"..humane(params)) |
|
|
158 |
|
|
159 if params["openid.ns"] == openidns then |
|
|
160 -- OpenID 2.0 request [#5.1.1] |
|
|
161 if params["openid.mode"] == "associate" then |
|
|
162 -- Associate mode [#8] |
|
|
163 -- TODO implement association |
|
|
164 |
|
|
165 -- Error response [#8.2.4] |
|
|
166 local openidresponse = { |
|
|
167 ["ns"] = openidns, |
|
|
168 ["session_type"] = params["openid.session_type"], |
|
|
169 ["assoc_type"] = params["openid.assoc_type"], |
|
|
170 ["error"] = "Association not supported... yet", |
|
|
171 ["error_code"] = "unsupported-type", |
|
|
172 } |
|
|
173 |
|
|
174 local kvresponse = tokvstring(openidresponse) |
|
|
175 module:log("debug", "OpenID Response:\n"..kvresponse) |
|
|
176 return { |
|
|
177 headers = { |
|
|
178 ["Content-Type"] = "text/plain" |
|
|
179 }, |
|
|
180 body = kvresponse |
|
|
181 } |
|
|
182 elseif params["openid.mode"] == "checkid_setup" or params["openid.mode"] == "checkid_immediate" then |
|
|
183 -- Requesting authentication [#9] |
|
|
184 if not params["openid.realm"] then |
|
|
185 -- set realm to default value of return_to [#9.1] |
|
|
186 if params["openid.return_to"] then |
|
|
187 params["openid.realm"] = params["openid.return_to"] |
|
|
188 else |
|
|
189 -- neither was sent, error [#9.1] |
|
|
190 -- FIXME return proper error |
|
|
191 return response_404 |
|
|
192 end |
|
|
193 end |
|
|
194 |
|
|
195 if params["openid.return_to"] then |
|
|
196 -- Assure that the return_to url matches the realm [#9.2] |
|
|
197 if not match_realm(params["openid.return_to"], params["openid.realm"]) then |
|
|
198 -- FIXME return proper error |
|
|
199 return response_404 |
|
|
200 end |
|
|
201 |
|
|
202 -- Verify the return url [#9.2.1] |
|
|
203 -- TODO implement return url verification |
|
|
204 end |
|
|
205 |
|
|
206 if params["openid.claimed_id"] and params["openid.identity"] then |
|
|
207 -- asserting an identifier [#9.1] |
|
|
208 |
|
|
209 if params["openid.identity"] == "http://specs.openid.net/auth/2.0/identifier_select" then |
|
|
210 -- automatically select an identity [#9.1] |
|
|
211 params["openid.identity"] = params["openid.claimed_id"] |
|
|
212 end |
|
|
213 |
|
|
214 if params["openid.mode"] == "checkid_setup" then |
|
|
215 -- Check ID Setup mode |
|
|
216 -- TODO implement: NEXT STEP |
|
|
217 local head = "<title>Prosody OpenID : Login</title>" |
|
|
218 local body = string.format([[ |
|
|
219 <p>Open ID Authentication<p> |
|
|
220 <p>Identifier: <tt>%s</tt></p> |
|
|
221 <p>Realm: <tt>%s</tt></p> |
|
|
222 <p>Return: <tt>%s</tt></p> |
|
|
223 <form method="POST" action="%s"> |
|
|
224 Jabber ID: <input type="text" name="jid"/><br/> |
|
|
225 Password: <input type="password" name="password"/><br/> |
|
|
226 <input type="hidden" name="openid.return_to" value="%s"/> |
|
|
227 <input type="submit" value="Authenticate"/> |
|
|
228 </form> |
|
|
229 ]], params["openid.claimed_id"], params["openid.realm"], params["openid.return_to"], base, params["openid.return_to"]) |
|
|
230 |
|
|
231 return string.format([[ |
|
|
232 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" |
|
|
233 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> |
|
|
234 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> |
|
|
235 <head> |
|
|
236 <meta http-equiv="Content-type" content="text/html;charset=UTF-8" /> |
|
|
237 %s |
|
|
238 </head> |
|
|
239 <body> |
|
|
240 %s |
|
|
241 </body> |
|
|
242 </html> |
|
|
243 ]], head, body) |
|
|
244 elseif params["openid.mode"] == "checkid_immediate" then |
|
|
245 -- Check ID Immediate mode [#9.3] |
|
|
246 -- TODO implement check id immediate |
|
|
247 end |
|
|
248 else |
|
|
249 -- not asserting an identifier [#9.1] |
|
|
250 -- used for extensions |
|
|
251 -- TODO implement common extensions |
|
|
252 end |
|
|
253 elseif params["openid.mode"] == "check_authentication" then |
|
|
254 module:log("debug", "OpenID Check Authentication Mode") |
|
|
255 local assoc = associations[params["openid.assoc_handle"]] |
|
|
256 module:log("debug", "Checking Association Handle: "..params["openid.assoc_handle"]) |
|
|
257 if assoc and not assoc["shared"] then |
|
|
258 module:log("debug", "Found valid association") |
|
|
259 local sig = sign(params, assoc["key"]) |
|
|
260 |
|
|
261 local is_valid = "false" |
|
|
262 if sig == params["openid.sig"] then |
|
|
263 is_valid = "true" |
|
|
264 end |
|
|
265 |
|
|
266 module:log("debug", "Signature is: "..is_valid) |
|
|
267 |
|
|
268 openidresponse = { |
|
|
269 ns = openidns, |
|
|
270 is_valid = is_valid, |
|
|
271 } |
|
|
272 |
|
|
273 -- Delete this association |
|
|
274 associations[params["openid.assoc_handle"]] = nil |
|
|
275 return { |
|
|
276 headers = { |
|
|
277 ["Content-Type"] = "text/plain" |
|
|
278 }, |
|
|
279 body = tokvstring(openidresponse), |
|
|
280 } |
|
|
281 else |
|
|
282 module:log("debug", "No valid association") |
|
|
283 -- TODO return error |
|
|
284 -- Invalidate the handle [#11.4.2.2] |
|
|
285 end |
|
|
286 else |
|
|
287 -- Some other mode |
|
|
288 -- TODO error |
|
|
289 end |
|
|
290 elseif params["password"] then |
|
|
291 -- User is authenticating |
|
|
292 local user, domain = jidutil.split(params["jid"]) |
|
|
293 module:log("debug", "Authenticating "..params["jid"].." ("..user..","..domain..") with password: "..params["password"]) |
|
|
294 local valid = usermanager.validate_credentials(domain, user, params["password"], "PLAIN") |
|
|
295 if valid then |
|
|
296 module:log("debug", "Authentication Succeeded: "..params["jid"]) |
|
|
297 if params["openid.return_to"] ~= "" then |
|
|
298 -- TODO redirect the user to return_to with the openid response |
|
|
299 -- included, need to handle the case if its a GET, that there are |
|
|
300 -- existing query parameters on the return_to URL [#10.1] |
|
|
301 local host, port = split_host_port(request.headers.host) |
|
|
302 local endpointurl = "" |
|
|
303 if port == '' then |
|
|
304 endpointurl = string.format("http://%s/%s", host, base) |
|
|
305 else |
|
|
306 endpointurl = string.format("http://%s:%s/%s", host, port, base) |
|
|
307 end |
|
|
308 |
|
|
309 local nonce = nonce() |
|
|
310 local key = genkey(32) |
|
|
311 local assoc_handle = newassoc(key) |
|
|
312 |
|
|
313 local openidresponse = { |
|
|
314 ["openid.ns"] = openidns, |
|
|
315 ["openid.mode"] = "id_res", |
|
|
316 ["openid.op_endpoint"] = endpointurl, |
|
|
317 ["openid.claimed_id"] = endpointurl.."/"..user, |
|
|
318 ["openid.identity"] = endpointurl.."/"..user, |
|
|
319 ["openid.return_to"] = params["openid.return_to"], |
|
|
320 ["openid.response_nonce"] = nonce, |
|
|
321 ["openid.assoc_handle"] = assoc_handle, |
|
|
322 ["openid.signed"] = "op_endpoint,identity,claimed_id,return_to,assoc_handle,response_nonce", -- FIXME |
|
|
323 ["openid.sig"] = nil, |
|
|
324 } |
|
|
325 |
|
|
326 openidresponse["openid.sig"] = sign(openidresponse, key) |
|
|
327 |
|
|
328 queryresponse = toquerystring(openidresponse) |
|
|
329 |
|
|
330 redirecturl = params["openid.return_to"] |
|
|
331 -- add the parameters to the return_to |
|
|
332 if redirecturl:match("?") then |
|
|
333 redirecturl = redirecturl.."&" |
|
|
334 else |
|
|
335 redirecturl = redirecturl.."?" |
|
|
336 end |
|
|
337 |
|
|
338 redirecturl = redirecturl..queryresponse |
|
|
339 |
|
|
340 module:log("debug", "Open ID Positive Assertion Response Table:\n"..humane(openidresponse)) |
|
|
341 module:log("debug", "Open ID Positive Assertion Response URL:\n"..queryresponse) |
|
|
342 module:log("debug", "Redirecting User to:\n"..redirecturl) |
|
|
343 return { |
|
|
344 status = "303 See Other", |
|
|
345 headers = { |
|
|
346 Location = redirecturl, |
|
|
347 }, |
|
|
348 body = "Redirecting to: "..redirecturl -- TODO Include a note with a hyperlink to redirect |
|
|
349 } |
|
|
350 else |
|
|
351 -- TODO Do something useful is there is no return_to |
|
|
352 end |
|
|
353 else |
|
|
354 module:log("debug", "Authentication Failed: "..params["jid"]) |
|
|
355 -- TODO let them try again |
|
|
356 end |
|
|
357 else |
|
|
358 -- Not an Open ID request, do something useful |
|
|
359 -- TODO |
|
|
360 end |
|
|
361 |
|
|
362 return response_404 |
|
|
363 end |
|
|
364 |
|
|
365 local function handle_identifier(method, body, request, id) |
|
|
366 module:log("debug", "Request at OpenID identifier") |
|
|
367 local host, port = split_host_port(request.headers.host) |
|
|
368 |
|
|
369 local user_name = "" |
|
|
370 local user_domain = "" |
|
|
371 local apos = string.find(id, "@") |
|
|
372 if apos == nil then |
|
|
373 user_name = id |
|
|
374 user_domain = host |
|
|
375 else |
|
|
376 user_name = string.sub(id, 0, apos-1) |
|
|
377 user_domain = string.sub(id, apos+1) |
|
|
378 end |
|
|
379 |
|
|
380 user, domain = jidutil.split(id) |
|
|
381 |
|
|
382 local exists = usermanager.user_exists(user_name, user_domain) |
|
|
383 |
|
|
384 if not exists then |
|
|
385 return response_404 |
|
|
386 end |
|
|
387 |
|
|
388 local endpointurl = "" |
|
|
389 if port == '' then |
|
|
390 endpointurl = string.format("http://%s/%s", host, base) |
|
|
391 else |
|
|
392 endpointurl = string.format("http://%s:%s/%s", host, port, base) |
|
|
393 end |
|
|
394 |
|
|
395 local head = string.format("<title>Prosody OpenID : %s@%s</title>", user_name, user_domain) |
|
|
396 -- OpenID HTML discovery [#7.3] |
|
|
397 head = head .. string.format('<link rel="openid2.provider" href="%s" />', endpointurl) |
|
|
398 |
|
|
399 local content = 'request.url.path: ' .. request.url.path .. '<br/>' |
|
|
400 content = content .. 'host+port: ' .. request.headers.host .. '<br/>' |
|
|
401 content = content .. 'host: ' .. tostring(host) .. '<br/>' |
|
|
402 content = content .. 'port: ' .. tostring(port) .. '<br/>' |
|
|
403 content = content .. 'user_name: ' .. user_name .. '<br/>' |
|
|
404 content = content .. 'user_domain: ' .. user_domain .. '<br/>' |
|
|
405 content = content .. 'exists: ' .. tostring(exists) .. '<br/>' |
|
|
406 |
|
|
407 local body = string.format('<p>%s</p>', content) |
|
|
408 |
|
|
409 local data = string.format([[ |
|
|
410 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" |
|
|
411 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> |
|
|
412 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> |
|
|
413 <head> |
|
|
414 <meta http-equiv="Content-type" content="text/html;charset=UTF-8" /> |
|
|
415 %s |
|
|
416 </head> |
|
|
417 <body> |
|
|
418 %s |
|
|
419 </body> |
|
|
420 </html> |
|
|
421 ]], head, body) |
|
|
422 return data; |
|
|
423 end |
|
|
424 |
|
|
425 local function handle_request(method, body, request) |
|
|
426 module:log("debug", "Received request") |
|
|
427 |
|
|
428 -- Make sure the host is enabled |
|
|
429 local host = split_host_port(request.headers.host) |
|
|
430 if not hosts[host] then |
|
|
431 return response_404 |
|
|
432 end |
|
|
433 |
|
|
434 if request.url.path == "/"..base then |
|
|
435 -- OpenID Provider Endpoint |
|
|
436 return handle_endpoint(method, body, request) |
|
|
437 else |
|
|
438 local id = request.url.path:match("^/"..base.."/(.+)$") |
|
|
439 if id then |
|
|
440 -- OpenID Identifier |
|
|
441 return handle_identifier(method, body, request, id) |
|
|
442 else |
|
|
443 return response_404 |
|
|
444 end |
|
|
445 end |
|
|
446 end |
|
|
447 |
|
|
448 httpserver.new{ port = 5280, base = base, handler = handle_request, ssl = false} |
