view mod_auth_pam/mod_auth_pam.lua @ 5420:aa068449b0b6

mod_http_oauth2: Bail out of implicit flow on invalid or missing redirect Probably hasn't been tested, and maybe never will since it's disabled and more or less deprecated in OAuth 2.1
author Kim Alvefur <zash@zash.se>
date Sat, 06 May 2023 12:23:22 +0200
parents 57bb2497fadc
children
line wrap: on
line source

-- PAM authentication for Prosody
-- Copyright (C) 2013 Kim Alvefur
--
-- Requires https://github.com/devurandom/lua-pam
-- and LuaPosix

local posix = require "posix";
local pam = require "pam";
local new_sasl = require "util.sasl".new;

function user_exists(username)
	return not not posix.getpasswd(username);
end

function test_password(username, password)
	local h, err = pam.start("xmpp", username, {
		function (t)
			if #t == 1 and t[1][1] == pam.PROMPT_ECHO_OFF then
				return { { password, 0} };
			end
		end
	});
	if h and h:authenticate() and h:endx(pam.SUCCESS) then
		return user_exists(username), true;
	end
	return nil, true;
end

function get_sasl_handler()
	return new_sasl(module.host, {
		plain_test = function(sasl, ...)
			return test_password(...)
		end
	});
end

module:provides"auth";