Mercurial > prosody-modules

annotate mod_auth_ldap/mod_auth_ldap.lua @ 1286:9700c89f7bf6

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_manifesto: Fix traceback when user doesn't have a roster (?)
author Matthew Wild <mwild1@gmail.com>
date Thu, 23 Jan 2014 20:27:14 +0000
parents 4b15437d6c56
children da2e593317d7
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1273
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
1 -- mod_auth_ldap
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
2
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
3 local new_sasl = require "util.sasl".new;
1273
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
4 local lualdap = require "lualdap";
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
5
1273
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
6 -- Config options
1162
8e3420d48508 mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents: 902
diff changeset
7 local ldap_server = module:get_option_string("ldap_server", "localhost");
8e3420d48508 mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents: 902
diff changeset
8 local ldap_rootdn = module:get_option_string("ldap_rootdn", "");
8e3420d48508 mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents: 902
diff changeset
9 local ldap_password = module:get_option_string("ldap_password", "");
8e3420d48508 mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents: 902
diff changeset
10 local ldap_tls = module:get_option_boolean("ldap_tls");
1163
52bee1247014 mod_auth_ldap: Add a configurable scope, defaulting to onelevel
Kim Alvefur <zash@zash.se>
parents: 1162
diff changeset
11 local ldap_scope = module:get_option_string("ldap_scope", "onelevel");
1190
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
12 local ldap_filter = module:get_option_string("ldap_filter", "(uid=%s)");
1162
8e3420d48508 mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents: 902
diff changeset
13 local ldap_base = assert(module:get_option_string("ldap_base"), "ldap_base is a required option for ldap");
1274
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
14 local ldap_mode = module:get_option_string("ldap_mode", "getpasswd");
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
15
1273
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
16 -- Initiate connection
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
17 local ld = assert(lualdap.open_simple(ldap_server, ldap_rootdn, ldap_password, ldap_tls));
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
18 module.unload = function() ld:close(); end
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
19
1190
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
20 local function ldap_filter_escape(s) return (s:gsub("[\\*\\(\\)\\\\%z]", function(c) return ("\\%02x"):format(c:byte()) end)); end
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
21
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
22 local function get_user(username)
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
23 module:log("debug", "get_user(%q)", username);
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
24 return ld:search({
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
25 base = ldap_base;
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
26 scope = ldap_scope;
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
27 filter = ldap_filter:format(ldap_filter_escape(username));
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
28 })();
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
29 end
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
30
814
881ec9919144 mod_auth_*: Use module:provides(), and don't explicitly specify provider.name.
Waqas Hussain <waqas20@gmail.com>
parents: 342
diff changeset
31 local provider = {};
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
32
1273
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
33 function provider.create_user(username, password)
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
34 return nil, "Account creation not available with LDAP.";
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
35 end
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
36
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
37 function provider.user_exists(username)
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
38 return not not get_user(username);
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
39 end
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
40
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
41 function provider.set_password(username, password)
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
42 local dn, attr = get_user(username);
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
43 if not dn then return nil, attr end
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
44 if attr.userPassword == password then return true end
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
45 return ld:modify(dn, { '=', userPassword = password })();
1b543060f31e mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents: 1221
diff changeset
46 end
1274
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
47
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
48 if ldap_mode == "getpasswd" then
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
49 function provider.get_password(username)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
50 local dn, attr = get_user(username);
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
51 if dn and attr then
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
52 return attr.userPassword;
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
53 end
1190
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
54 end
1274
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
55
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
56 function provider.test_password(username, password)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
57 return provider.get_password(username) == password;
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
58 end
1190
c99d8b666eb4 mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents: 1163
diff changeset
59
1274
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
60 function provider.get_sasl_handler()
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
61 return new_sasl(module.host, {
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
62 plain = function(sasl, username)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
63 local password = provider.get_password(username);
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
64 if not password then return "", nil; end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
65 return password, true;
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
66 end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
67 });
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
68 end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
69 elseif ldap_mode == "bind" then
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
70 local function test_password(userdn, password)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
71 return not not lualdap.open_simple(ldap_server, userdn, password, ldap_tls);
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
72 end
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
73
1274
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
74 function provider.test_password(username, password)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
75 local dn = get_user(username);
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
76 if not dn then return end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
77 return test_password(dn, password)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
78 end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
79
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
80 function provider.get_sasl_handler()
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
81 return new_sasl(module.host, {
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
82 plain_test = function(sasl, username, password)
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
83 return provider.test_password(username, password), true;
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
84 end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
85 });
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
86 end
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
87 else
4b15437d6c56 mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents: 1273
diff changeset
88 module:log("error", "Unsupported ldap_mode %s", tostring(ldap_mode));
293
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
89 end
d76f47a608ab mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents: 286
diff changeset
90
814
881ec9919144 mod_auth_*: Use module:provides(), and don't explicitly specify provider.name.
Waqas Hussain <waqas20@gmail.com>
parents: 342
diff changeset
91 module:provides("auth", provider);