view mod_auth_pam/mod_auth_pam.lua @ 5818:d3b69859553a

mod_password_policy: Change error type from 'cancel' to 'modify' This makes more sense, as the problem relates to the data that has been entered, and therefore the request could be retried with different data.
author Matthew Wild <mwild1@gmail.com>
date Mon, 08 Jan 2024 17:28:39 +0000
parents 57bb2497fadc
children
line wrap: on
line source

-- PAM authentication for Prosody
-- Copyright (C) 2013 Kim Alvefur
--
-- Requires https://github.com/devurandom/lua-pam
-- and LuaPosix

local posix = require "posix";
local pam = require "pam";
local new_sasl = require "util.sasl".new;

function user_exists(username)
	return not not posix.getpasswd(username);
end

function test_password(username, password)
	local h, err = pam.start("xmpp", username, {
		function (t)
			if #t == 1 and t[1][1] == pam.PROMPT_ECHO_OFF then
				return { { password, 0} };
			end
		end
	});
	if h and h:authenticate() and h:endx(pam.SUCCESS) then
		return user_exists(username), true;
	end
	return nil, true;
end

function get_sasl_handler()
	return new_sasl(module.host, {
		plain_test = function(sasl, ...)
			return test_password(...)
		end
	});
end

module:provides"auth";