Mercurial > prosody-modules
annotate mod_auth_ldap/mod_auth_ldap.lua @ 3148:8c7b8b2c3237
mod_slack_webhooks: Add a special webhook target for debugging
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 03 Jun 2018 02:18:02 +0200 |
parents | a81456a13797 |
children | 5c3f3f5a4377 |
rev | line source |
---|---|
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
1 -- mod_auth_ldap |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
2 |
2056
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
3 local jid_split = require "util.jid".split; |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
4 local new_sasl = require "util.sasl".new; |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
5 local lualdap = require "lualdap"; |
2774
41565a743cad
mod_auth_ldap: Split long line into many [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2056
diff
changeset
|
6 |
41565a743cad
mod_auth_ldap: Split long line into many [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2056
diff
changeset
|
7 local function ldap_filter_escape(s) |
41565a743cad
mod_auth_ldap: Split long line into many [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2056
diff
changeset
|
8 return (s:gsub("[*()\\%z]", function(c) return ("\\%02x"):format(c:byte()) end)); |
41565a743cad
mod_auth_ldap: Split long line into many [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2056
diff
changeset
|
9 end |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
10 |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
11 -- Config options |
1162
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
12 local ldap_server = module:get_option_string("ldap_server", "localhost"); |
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
13 local ldap_rootdn = module:get_option_string("ldap_rootdn", ""); |
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
14 local ldap_password = module:get_option_string("ldap_password", ""); |
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
15 local ldap_tls = module:get_option_boolean("ldap_tls"); |
1987
6d7699eda594
mod_auth_ldap: Change default of ldap_scope from onelevel to subtree which seems to match many deployments
Kim Alvefur <zash@zash.se>
parents:
1611
diff
changeset
|
16 local ldap_scope = module:get_option_string("ldap_scope", "subtree"); |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
17 local ldap_filter = module:get_option_string("ldap_filter", "(uid=$user)"):gsub("%%s", "$user", 1); |
1162
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
18 local ldap_base = assert(module:get_option_string("ldap_base"), "ldap_base is a required option for ldap"); |
1479
9a0a0cfd3710
mod_auth_ldap: Change default for ldap_mode to "bind", everyone seems to be using that
Kim Alvefur <zash@zash.se>
parents:
1478
diff
changeset
|
19 local ldap_mode = module:get_option_string("ldap_mode", "bind"); |
2056
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
20 local ldap_admins = module:get_option_string("ldap_admin_filter"); |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
21 local host = ldap_filter_escape(module:get_option_string("realm", module.host)); |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
22 |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
23 -- Initiate connection |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
24 local ld = nil; |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
25 module.unload = function() if ld then pcall(ld, ld.close); end end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
26 |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
27 function ldap_do_once(method, ...) |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
28 if ld == nil then |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
29 local err; |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
30 ld, err = lualdap.open_simple(ldap_server, ldap_rootdn, ldap_password, ldap_tls); |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
31 if not ld then return nil, err, "reconnect"; end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
32 end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
33 |
2775
8407137c0a3b
mod_auth_ldap: Add annotations to ignore harmless warnings [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2774
diff
changeset
|
34 -- luacheck: ignore 411/success |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
35 local success, iterator, invariant, initial = pcall(ld[method], ld, ...); |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
36 if not success then ld = nil; return nil, iterator, "search"; end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
37 |
3098
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
38 module:log("debug", "success = %s, invariant = %s", |
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
39 tostring(success), |
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
40 tostring(invariant)); |
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
41 |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
42 local success, dn, attr = pcall(iterator, invariant, initial); |
3098
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
43 module:log("debug", "success = %s, dn = %s, attr = %s", |
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
44 tostring(success), |
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
45 tostring(dn), |
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
46 tostring(attr)); |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
47 if not success then ld = nil; return success, dn, "iter"; end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
48 |
3098
a81456a13797
mod_client_proxy: a Jabber Address Translation implementation
Jonas Wielicki <jonas@wielicki.name>
parents:
2851
diff
changeset
|
49 |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
50 return dn, attr, "return"; |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
51 end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
52 |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
53 function ldap_do(method, retry_count, ...) |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
54 local dn, attr, where; |
2775
8407137c0a3b
mod_auth_ldap: Add annotations to ignore harmless warnings [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2774
diff
changeset
|
55 for _=1,1+retry_count do |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
56 dn, attr, where = ldap_do_once(method, ...); |
1609
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
57 if dn or not(attr) then break; end -- nothing or something found |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
58 module:log("warn", "LDAP: %s %s (in %s)", tostring(dn), tostring(attr), where); |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
59 -- otherwise retry |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
60 end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
61 if not dn and attr then |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
62 module:log("error", "LDAP: %s", tostring(attr)); |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
63 end |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
64 return dn, attr; |
5f139770061e
mod_auth_ldap: Connect to LDAP lazily, and add support for reconnects on error.
Waqas Hussain <waqas20@gmail.com>
parents:
1479
diff
changeset
|
65 end |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
66 |
2851
4b10636bd743
"Export" get_user from mod_auth_ldap
Jonas Wielicki <jonas@wielicki.name>
parents:
2775
diff
changeset
|
67 function get_user(username) |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
68 module:log("debug", "get_user(%q)", username); |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
69 return ldap_do("search", 2, { |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
70 base = ldap_base; |
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
71 scope = ldap_scope; |
1375
90bde50b3915
mod_auth_ldap: Limit results in user lookup query to 1
Kim Alvefur <zash@zash.se>
parents:
1374
diff
changeset
|
72 sizelimit = 1; |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
73 filter = ldap_filter:gsub("%$(%a+)", { |
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
74 user = ldap_filter_escape(username); |
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
75 host = host; |
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
76 }); |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
77 }); |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
78 end |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
79 |
814
881ec9919144
mod_auth_*: Use module:provides(), and don't explicitly specify provider.name.
Waqas Hussain <waqas20@gmail.com>
parents:
342
diff
changeset
|
80 local provider = {}; |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
81 |
2775
8407137c0a3b
mod_auth_ldap: Add annotations to ignore harmless warnings [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2774
diff
changeset
|
82 function provider.create_user(username, password) -- luacheck: ignore 212 |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
83 return nil, "Account creation not available with LDAP."; |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
84 end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
85 |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
86 function provider.user_exists(username) |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
87 return not not get_user(username); |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
88 end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
89 |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
90 function provider.set_password(username, password) |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
91 local dn, attr = get_user(username); |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
92 if not dn then return nil, attr end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
93 if attr.userPassword == password then return true end |
1611
770236ea9678
mod_auth_ldap: Fix use of ldap_search, and generalize it to support password modification as well.
Waqas Hussain <waqas20@gmail.com>
parents:
1610
diff
changeset
|
94 return ldap_do("modify", 2, dn, { '=', userPassword = password }); |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
95 end |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
96 |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
97 if ldap_mode == "getpasswd" then |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
98 function provider.get_password(username) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
99 local dn, attr = get_user(username); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
100 if dn and attr then |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
101 return attr.userPassword; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
102 end |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
103 end |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
104 |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
105 function provider.test_password(username, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
106 return provider.get_password(username) == password; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
107 end |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
108 |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
109 function provider.get_sasl_handler() |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
110 return new_sasl(module.host, { |
2775
8407137c0a3b
mod_auth_ldap: Add annotations to ignore harmless warnings [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2774
diff
changeset
|
111 plain = function(sasl, username) -- luacheck: ignore 212/sasl |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
112 local password = provider.get_password(username); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
113 if not password then return "", nil; end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
114 return password, true; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
115 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
116 }); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
117 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
118 elseif ldap_mode == "bind" then |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
119 local function test_password(userdn, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
120 return not not lualdap.open_simple(ldap_server, userdn, password, ldap_tls); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
121 end |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
122 |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
123 function provider.test_password(username, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
124 local dn = get_user(username); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
125 if not dn then return end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
126 return test_password(dn, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
127 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
128 |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
129 function provider.get_sasl_handler() |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
130 return new_sasl(module.host, { |
2775
8407137c0a3b
mod_auth_ldap: Add annotations to ignore harmless warnings [luacheck]
Kim Alvefur <zash@zash.se>
parents:
2774
diff
changeset
|
131 plain_test = function(sasl, username, password) -- luacheck: ignore 212/sasl |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
132 return provider.test_password(username, password), true; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
133 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
134 }); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
135 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
136 else |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
137 module:log("error", "Unsupported ldap_mode %s", tostring(ldap_mode)); |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
138 end |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
139 |
2056
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
140 if ldap_admins then |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
141 function provider.is_admin(jid) |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
142 local username = jid_split(jid); |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
143 return ldap_do("search", 2, { |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
144 base = ldap_base; |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
145 scope = ldap_scope; |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
146 sizelimit = 1; |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
147 filter = ldap_admins:gsub("%$(%a+)", { |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
148 user = ldap_filter_escape(username); |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
149 host = host; |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
150 }); |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
151 }); |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
152 end |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
153 end |
e16593e7d482
mod_auth_ldap: Add support for having admin status indicated in LDAP
Kim Alvefur <zash@zash.se>
parents:
1987
diff
changeset
|
154 |
814
881ec9919144
mod_auth_*: Use module:provides(), and don't explicitly specify provider.name.
Waqas Hussain <waqas20@gmail.com>
parents:
342
diff
changeset
|
155 module:provides("auth", provider); |