BasicOIDC/src/controllers/login_controller.rs

399 lines
12 KiB
Rust
Raw Normal View History

2022-03-30 10:41:22 +00:00
use actix::Addr;
2022-03-30 14:58:00 +00:00
use actix_identity::Identity;
2022-04-05 15:23:26 +00:00
use actix_web::{HttpResponse, Responder, web};
2022-03-30 08:29:10 +00:00
use askama::Template;
use crate::actors::{bruteforce_actor, users_actor};
use crate::actors::bruteforce_actor::BruteForceActor;
2022-04-03 13:50:49 +00:00
use crate::actors::users_actor::{ChangePasswordResult, LoginResult, UsersActor};
use crate::constants::{APP_NAME, MAX_FAILED_LOGIN_ATTEMPTS, MIN_PASS_LEN};
use crate::controllers::base_controller::{build_fatal_error_page, redirect_user, redirect_user_for_login};
2022-04-19 17:30:14 +00:00
use crate::data::login_redirect::LoginRedirect;
2022-04-05 15:23:26 +00:00
use crate::data::remote_ip::RemoteIP;
2022-04-02 06:30:01 +00:00
use crate::data::session_identity::{SessionIdentity, SessionStatus};
use crate::data::user::{FactorID, TwoFactor, TwoFactorType, User};
2022-04-23 16:56:14 +00:00
use crate::data::webauthn_manager::WebAuthManagerReq;
2022-03-30 08:29:10 +00:00
2022-04-19 17:30:14 +00:00
struct BaseLoginPage<'a> {
2022-04-19 15:49:57 +00:00
danger: Option<String>,
success: Option<String>,
2022-03-30 09:00:20 +00:00
page_title: &'static str,
app_name: &'static str,
2022-04-19 17:30:14 +00:00
redirect_uri: &'a LoginRedirect,
2022-03-30 09:00:20 +00:00
}
2022-03-30 08:29:10 +00:00
#[derive(Template)]
#[template(path = "login/login.html")]
2022-04-19 17:30:14 +00:00
struct LoginTemplate<'a> {
_p: BaseLoginPage<'a>,
2022-03-30 10:41:22 +00:00
login: String,
2022-03-30 08:29:10 +00:00
}
2022-04-02 06:30:01 +00:00
#[derive(Template)]
#[template(path = "login/password_reset.html")]
2022-04-19 17:30:14 +00:00
struct PasswordResetTemplate<'a> {
_p: BaseLoginPage<'a>,
2022-04-02 06:30:01 +00:00
min_pass_len: usize,
}
2022-04-19 16:27:21 +00:00
#[derive(Template)]
#[template(path = "login/choose_second_factor.html")]
struct ChooseSecondFactorTemplate<'a> {
2022-04-19 17:30:14 +00:00
_p: BaseLoginPage<'a>,
2022-04-19 16:27:21 +00:00
factors: &'a [TwoFactor],
}
2022-04-19 17:24:07 +00:00
#[derive(Template)]
#[template(path = "login/opt_input.html")]
struct LoginWithOTPTemplate<'a> {
2022-04-19 17:30:14 +00:00
_p: BaseLoginPage<'a>,
2022-04-19 17:24:07 +00:00
factor: &'a TwoFactor,
}
2022-04-23 16:56:14 +00:00
#[derive(Template)]
#[template(path = "login/webauthn_input.html")]
struct LoginWithWebauthnTemplate<'a> {
_p: BaseLoginPage<'a>,
factor: &'a TwoFactor,
opaque_state: String,
challenge_json: String,
}
2022-04-19 16:27:21 +00:00
2022-03-30 10:41:22 +00:00
#[derive(serde::Deserialize)]
2022-04-01 17:05:40 +00:00
pub struct LoginRequestBody {
2022-03-30 10:41:22 +00:00
login: String,
password: String,
}
2022-04-01 17:05:40 +00:00
#[derive(serde::Deserialize)]
pub struct LoginRequestQuery {
logout: Option<bool>,
2022-04-19 15:49:57 +00:00
#[serde(default)]
2022-04-19 17:30:14 +00:00
redirect: LoginRedirect,
2022-04-01 17:05:40 +00:00
}
2022-03-30 10:41:22 +00:00
/// Authenticate user
2022-04-03 13:50:49 +00:00
pub async fn login_route(
2022-04-05 15:23:26 +00:00
remote_ip: RemoteIP,
2022-04-03 13:50:49 +00:00
users: web::Data<Addr<UsersActor>>,
bruteforce: web::Data<Addr<BruteForceActor>>,
2022-04-03 13:50:49 +00:00
query: web::Query<LoginRequestQuery>,
req: Option<web::Form<LoginRequestBody>>,
id: Identity,
) -> impl Responder {
2022-04-19 15:49:57 +00:00
let mut danger = None;
let mut success = None;
2022-03-30 10:41:22 +00:00
let mut login = String::new();
2022-04-05 15:23:26 +00:00
let failed_attempts = bruteforce.send(bruteforce_actor::CountFailedAttempt { ip: remote_ip.into() })
.await.unwrap();
if failed_attempts > MAX_FAILED_LOGIN_ATTEMPTS {
2022-04-03 15:48:55 +00:00
return HttpResponse::TooManyRequests().body(
build_fatal_error_page("Too many failed login attempts, please try again later!")
);
}
2022-04-01 17:05:40 +00:00
// Check if user session must be closed
if let Some(true) = query.logout {
id.forget();
2022-04-19 15:49:57 +00:00
success = Some("Goodbye!".to_string());
2022-04-01 17:05:40 +00:00
}
2022-04-01 16:59:17 +00:00
// Check if user is already authenticated
2022-04-01 20:51:33 +00:00
if SessionIdentity(&id).is_authenticated() {
2022-04-19 15:49:57 +00:00
return redirect_user(query.redirect.get());
2022-04-01 16:59:17 +00:00
}
2022-04-19 15:49:57 +00:00
// Check if the password of the user has to be changed
if SessionIdentity(&id).need_new_password() {
return redirect_user(&format!("/reset_password?redirect={}", query.redirect.get_encoded()));
2022-04-02 06:30:01 +00:00
}
2022-04-19 15:49:57 +00:00
2022-04-19 16:27:21 +00:00
// Check if the user has to valide a second factor
if SessionIdentity(&id).need_2fa_auth() {
return redirect_user(&format!("/2fa_auth?redirect={}", query.redirect.get_encoded()));
}
2022-03-30 10:41:22 +00:00
// Try to authenticate user
2022-04-19 15:49:57 +00:00
if let Some(req) = &req {
2022-03-30 10:41:22 +00:00
login = req.login.clone();
2022-04-03 13:50:49 +00:00
let response: LoginResult = users
.send(users_actor::LoginRequest {
login: login.clone(),
password: req.password.clone(),
})
.await
.unwrap();
2022-03-30 10:41:22 +00:00
2022-04-01 16:59:17 +00:00
match response {
LoginResult::Success(user) => {
2022-04-01 20:51:33 +00:00
SessionIdentity(&id).set_user(&user);
2022-04-01 16:59:17 +00:00
2022-04-19 15:49:57 +00:00
return if user.need_reset_password {
2022-04-02 06:30:01 +00:00
SessionIdentity(&id).set_status(SessionStatus::NeedNewPassword);
2022-04-19 15:49:57 +00:00
redirect_user(&format!("/reset_password?redirect={}", query.redirect.get_encoded()))
2022-04-19 16:27:21 +00:00
} else if user.has_two_factor() {
SessionIdentity(&id).set_status(SessionStatus::Need2FA);
redirect_user(&format!("/2fa_auth?redirect={}", query.redirect.get_encoded()))
2022-04-02 06:30:01 +00:00
} else {
2022-04-19 15:49:57 +00:00
redirect_user(query.redirect.get())
};
2022-04-01 16:59:17 +00:00
}
2022-04-03 12:42:16 +00:00
LoginResult::AccountDisabled => {
log::warn!("Failed login for username {} : account is disabled", login);
2022-04-19 15:49:57 +00:00
danger = Some("Your account is disabled!".to_string());
2022-04-03 12:42:16 +00:00
}
2022-04-01 16:59:17 +00:00
c => {
2022-04-18 15:13:41 +00:00
log::warn!("Failed login for ip {:?} / username {}: {:?}", remote_ip, login, c);
2022-04-19 15:49:57 +00:00
danger = Some("Login failed.".to_string());
2022-04-05 15:23:26 +00:00
bruteforce.send(bruteforce_actor::RecordFailedAttempt { ip: remote_ip.into() }).await.unwrap();
2022-04-01 16:59:17 +00:00
}
}
2022-03-30 10:41:22 +00:00
}
2022-04-03 13:50:49 +00:00
HttpResponse::Ok().content_type("text/html").body(
LoginTemplate {
2022-04-18 15:13:41 +00:00
_p: BaseLoginPage {
2022-03-30 09:00:20 +00:00
page_title: "Login",
2022-03-30 10:41:22 +00:00
danger,
2022-04-01 17:05:40 +00:00
success,
2022-03-30 09:00:20 +00:00
app_name: APP_NAME,
2022-04-19 17:30:14 +00:00
redirect_uri: &query.redirect,
2022-03-30 09:00:20 +00:00
},
2022-03-30 10:41:22 +00:00
login,
2022-04-03 13:50:49 +00:00
}
.render()
.unwrap(),
2022-04-03 13:50:49 +00:00
)
2022-04-01 17:05:40 +00:00
}
/// Sign out user
pub async fn logout_route() -> impl Responder {
redirect_user("/login?logout=true")
2022-04-03 13:50:49 +00:00
}
2022-04-19 15:49:57 +00:00
#[derive(serde::Deserialize)]
pub struct ChangePasswordRequestBody {
password: String,
}
#[derive(serde::Deserialize)]
pub struct PasswordResetQuery {
#[serde(default)]
2022-04-19 17:30:14 +00:00
redirect: LoginRedirect,
2022-04-19 15:49:57 +00:00
}
/// Reset user password route
pub async fn reset_password_route(id: Identity, query: web::Query<PasswordResetQuery>,
req: Option<web::Form<ChangePasswordRequestBody>>,
2022-04-19 16:27:21 +00:00
users: web::Data<Addr<UsersActor>>) -> impl Responder {
2022-04-19 15:49:57 +00:00
let mut danger = None;
if !SessionIdentity(&id).need_new_password() {
return redirect_user_for_login(query.redirect.get());
}
// Check if user is setting a new password
if let Some(req) = &req {
if req.password.len() < MIN_PASS_LEN {
danger = Some("Password is too short!".to_string());
} else {
let res: ChangePasswordResult = users
.send(users_actor::ChangePasswordRequest {
user_id: SessionIdentity(&id).user_id(),
new_password: req.password.clone(),
temporary: false,
})
.await
.unwrap();
if !res.0 {
danger = Some("Failed to change password!".to_string());
} else {
SessionIdentity(&id).set_status(SessionStatus::SignedIn);
return redirect_user(query.redirect.get());
}
}
}
HttpResponse::Ok().content_type("text/html").body(
PasswordResetTemplate {
_p: BaseLoginPage {
page_title: "Password reset",
danger,
success: None,
app_name: APP_NAME,
2022-04-19 17:30:14 +00:00
redirect_uri: &query.redirect,
2022-04-19 15:49:57 +00:00
},
min_pass_len: MIN_PASS_LEN,
}
.render()
.unwrap(),
)
2022-04-19 16:27:21 +00:00
}
#[derive(serde::Deserialize)]
pub struct ChooseSecondFactorQuery {
#[serde(default)]
2022-04-19 17:30:14 +00:00
redirect: LoginRedirect,
#[serde(default = "bool::default")]
force_display: bool,
2022-04-19 16:27:21 +00:00
}
/// Let the user select the factor to use to authenticate
pub async fn choose_2fa_method(id: Identity, query: web::Query<ChooseSecondFactorQuery>,
users: web::Data<Addr<UsersActor>>) -> impl Responder {
if !SessionIdentity(&id).need_2fa_auth() {
return redirect_user_for_login(query.redirect.get());
}
let user: User = users.send(users_actor::GetUserRequest(SessionIdentity(&id).user_id()))
.await.unwrap().0.expect("Could not find user!");
// Automatically choose factor if there is only one factor
if user.two_factor.len() == 1 && !query.force_display {
return redirect_user(&user.two_factor[0].login_url(&query.redirect));
}
2022-04-19 16:27:21 +00:00
HttpResponse::Ok().content_type("text/html").body(
ChooseSecondFactorTemplate {
_p: BaseLoginPage {
page_title: "Two factor authentication",
danger: None,
success: None,
app_name: APP_NAME,
2022-04-19 17:30:14 +00:00
redirect_uri: &query.redirect,
2022-04-19 16:27:21 +00:00
},
factors: &user.two_factor,
}
.render()
.unwrap(),
)
2022-04-19 17:24:07 +00:00
}
#[derive(serde::Deserialize)]
pub struct LoginWithOTPQuery {
#[serde(default)]
2022-04-19 17:30:14 +00:00
redirect: LoginRedirect,
2022-04-19 17:24:07 +00:00
id: FactorID,
}
#[derive(serde::Deserialize)]
pub struct LoginWithOTPForm {
code: String,
}
2022-04-19 17:24:07 +00:00
/// Login with OTP
pub async fn login_with_otp(id: Identity, query: web::Query<LoginWithOTPQuery>,
form: Option<web::Form<LoginWithOTPForm>>,
2022-04-19 17:24:07 +00:00
users: web::Data<Addr<UsersActor>>) -> impl Responder {
let mut danger = None;
2022-04-19 17:24:07 +00:00
if !SessionIdentity(&id).need_2fa_auth() {
return redirect_user_for_login(query.redirect.get());
}
let user: User = users.send(users_actor::GetUserRequest(SessionIdentity(&id).user_id()))
.await.unwrap().0.expect("Could not find user!");
let factor = match user.find_factor(&query.id) {
Some(f) => f,
None => return HttpResponse::Ok().body(build_fatal_error_page("Factor not found!"))
2022-04-19 17:24:07 +00:00
};
let key = match &factor.kind {
TwoFactorType::TOTP(key) => key,
_ => {
return HttpResponse::Ok().body(build_fatal_error_page("Factor is not a TOTP key!"));
}
};
if let Some(form) = form {
if !key.check_code(&form.code).unwrap_or(false) {
danger = Some("Specified code is invalid!".to_string());
} else {
SessionIdentity(&id).set_status(SessionStatus::SignedIn);
return redirect_user(query.redirect.get());
}
}
2022-04-19 17:24:07 +00:00
HttpResponse::Ok().body(LoginWithOTPTemplate {
_p: BaseLoginPage {
danger,
2022-04-19 17:24:07 +00:00
success: None,
page_title: "Two-Factor Auth",
app_name: APP_NAME,
2022-04-19 17:30:14 +00:00
redirect_uri: &query.redirect,
2022-04-19 17:24:07 +00:00
},
factor,
}.render().unwrap())
2022-04-23 16:56:14 +00:00
}
#[derive(serde::Deserialize)]
pub struct LoginWithWebauthnQuery {
#[serde(default)]
redirect: LoginRedirect,
id: FactorID,
}
/// Login with Webauthn
pub async fn login_with_webauthn(id: Identity, query: web::Query<LoginWithWebauthnQuery>,
manager: WebAuthManagerReq,
users: web::Data<Addr<UsersActor>>) -> impl Responder {
if !SessionIdentity(&id).need_2fa_auth() {
return redirect_user_for_login(query.redirect.get());
}
let user: User = users.send(users_actor::GetUserRequest(SessionIdentity(&id).user_id()))
.await.unwrap().0.expect("Could not find user!");
let factor = match user.find_factor(&query.id) {
Some(f) => f,
None => return HttpResponse::Ok().body(build_fatal_error_page("Factor not found!"))
2022-04-23 16:56:14 +00:00
};
let key = match &factor.kind {
TwoFactorType::WEBAUTHN(key) => key,
_ => {
return HttpResponse::Ok()
.body(build_fatal_error_page("Factor is not a Webauthn key!"));
2022-04-23 16:56:14 +00:00
}
};
let challenge = match manager.start_authentication(&user.uid, key) {
Ok(c) => c,
Err(e) => {
log::error!("Failed to generate webauthn challenge! {:?}", e);
return HttpResponse::InternalServerError()
.body(build_fatal_error_page("Failed to generate webauthn challenge"));
2022-04-23 16:56:14 +00:00
}
};
let challenge_json = match serde_json::to_string(&challenge.login_challenge) {
Ok(r) => r,
Err(e) => {
log::error!("Failed to serialize challenge! {:?}", e);
return HttpResponse::InternalServerError().body("Failed to serialize challenge!");
}
};
HttpResponse::Ok().body(LoginWithWebauthnTemplate {
_p: BaseLoginPage {
danger: None,
success: None,
page_title: "Two-Factor Auth",
app_name: APP_NAME,
redirect_uri: &query.redirect,
},
factor,
opaque_state: challenge.opaque_state,
challenge_json: urlencoding::encode(&challenge_json).to_string(),
}.render().unwrap())
2022-04-19 15:49:57 +00:00
}