Mercurial > prosody-modules
annotate mod_auth_ldap/mod_auth_ldap.lua @ 1315:e8eebf281405
mod_mam_muc: Remove code that should have been removed in previous commit
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Thu, 20 Feb 2014 20:40:38 +0100 |
parents | da2e593317d7 |
children | ab638f6b53dc |
rev | line source |
---|---|
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
1 -- mod_auth_ldap |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
2 |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
3 local new_sasl = require "util.sasl".new; |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
4 local lualdap = require "lualdap"; |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
5 local function ldap_filter_escape(s) return (s:gsub("[\\*\\(\\)\\\\%z]", function(c) return ("\\%02x"):format(c:byte()) end)); end |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
6 |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
7 -- Config options |
1162
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
8 local ldap_server = module:get_option_string("ldap_server", "localhost"); |
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
9 local ldap_rootdn = module:get_option_string("ldap_rootdn", ""); |
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
10 local ldap_password = module:get_option_string("ldap_password", ""); |
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
11 local ldap_tls = module:get_option_boolean("ldap_tls"); |
1163
52bee1247014
mod_auth_ldap: Add a configurable scope, defaulting to onelevel
Kim Alvefur <zash@zash.se>
parents:
1162
diff
changeset
|
12 local ldap_scope = module:get_option_string("ldap_scope", "onelevel"); |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
13 local ldap_filter = module:get_option_string("ldap_filter", "(uid=$user)"):gsub("%%s", "$user", 1); |
1162
8e3420d48508
mod_auth_ldap: Switch to type-specific get_option variants
Kim Alvefur <zash@zash.se>
parents:
902
diff
changeset
|
14 local ldap_base = assert(module:get_option_string("ldap_base"), "ldap_base is a required option for ldap"); |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
15 local ldap_mode = module:get_option_string("ldap_mode", "getpasswd"); |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
16 local host = ldap_filter_escape(module:get_option_string("realm", module.host)); |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
17 |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
18 -- Initiate connection |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
19 local ld = assert(lualdap.open_simple(ldap_server, ldap_rootdn, ldap_password, ldap_tls)); |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
20 module.unload = function() ld:close(); end |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
21 |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
22 local function get_user(username) |
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
23 module:log("debug", "get_user(%q)", username); |
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
24 return ld:search({ |
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
25 base = ldap_base; |
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
26 scope = ldap_scope; |
1287
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
27 filter = ldap_filter:gsub("%$(%a+)", { |
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
28 user = ldap_filter_escape(username); |
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
29 host = host; |
da2e593317d7
mod_auth_ldap: Switch config format for ldap_filter to eg (uid=$user)
Kim Alvefur <zash@zash.se>
parents:
1274
diff
changeset
|
30 }); |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
31 })(); |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
32 end |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
33 |
814
881ec9919144
mod_auth_*: Use module:provides(), and don't explicitly specify provider.name.
Waqas Hussain <waqas20@gmail.com>
parents:
342
diff
changeset
|
34 local provider = {}; |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
35 |
1273
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
36 function provider.create_user(username, password) |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
37 return nil, "Account creation not available with LDAP."; |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
38 end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
39 |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
40 function provider.user_exists(username) |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
41 return not not get_user(username); |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
42 end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
43 |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
44 function provider.set_password(username, password) |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
45 local dn, attr = get_user(username); |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
46 if not dn then return nil, attr end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
47 if attr.userPassword == password then return true end |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
48 return ld:modify(dn, { '=', userPassword = password })(); |
1b543060f31e
mod_auth_ldap: Cleanup, reorder and some comments
Kim Alvefur <zash@zash.se>
parents:
1221
diff
changeset
|
49 end |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
50 |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
51 if ldap_mode == "getpasswd" then |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
52 function provider.get_password(username) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
53 local dn, attr = get_user(username); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
54 if dn and attr then |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
55 return attr.userPassword; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
56 end |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
57 end |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
58 |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
59 function provider.test_password(username, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
60 return provider.get_password(username) == password; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
61 end |
1190
c99d8b666eb4
mod_auth_ldap: Convert from plain_test to plain mode, allowing SCRAM and similar.
Kim Alvefur <zash@zash.se>
parents:
1163
diff
changeset
|
62 |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
63 function provider.get_sasl_handler() |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
64 return new_sasl(module.host, { |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
65 plain = function(sasl, username) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
66 local password = provider.get_password(username); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
67 if not password then return "", nil; end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
68 return password, true; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
69 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
70 }); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
71 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
72 elseif ldap_mode == "bind" then |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
73 local function test_password(userdn, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
74 return not not lualdap.open_simple(ldap_server, userdn, password, ldap_tls); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
75 end |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
76 |
1274
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
77 function provider.test_password(username, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
78 local dn = get_user(username); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
79 if not dn then return end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
80 return test_password(dn, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
81 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
82 |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
83 function provider.get_sasl_handler() |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
84 return new_sasl(module.host, { |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
85 plain_test = function(sasl, username, password) |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
86 return provider.test_password(username, password), true; |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
87 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
88 }); |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
89 end |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
90 else |
4b15437d6c56
mod_auth_ldap: Add support for binding
Kim Alvefur <zash@zash.se>
parents:
1273
diff
changeset
|
91 module:log("error", "Unsupported ldap_mode %s", tostring(ldap_mode)); |
293
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
92 end |
d76f47a608ab
mod_auth_ldap: Convert to real line endings
Matthew Wild <mwild1@gmail.com>
parents:
286
diff
changeset
|
93 |
814
881ec9919144
mod_auth_*: Use module:provides(), and don't explicitly specify provider.name.
Waqas Hussain <waqas20@gmail.com>
parents:
342
diff
changeset
|
94 module:provides("auth", provider); |