Compare commits

..

2 Commits
master ... ldap

Author SHA1 Message Date
4c87e88232 Ajout ref package LDAP à utiliser
Some checks failed
continuous-integration/drone/push Build is failing
2023-01-23 16:07:26 +01:00
e8aeb37f31 ldap configuration
Some checks failed
continuous-integration/drone/push Build is failing
2022-12-03 18:20:27 +01:00
69 changed files with 4948 additions and 13802 deletions

2457
Cargo.lock generated

File diff suppressed because it is too large Load Diff

View File

@ -1,42 +1,41 @@
[package] [package]
name = "basic-oidc" name = "basic-oidc"
version = "0.1.4" version = "0.1.3"
edition = "2021" edition = "2021"
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
[dependencies] [dependencies]
actix = "0.13.3" actix = "0.13.0"
actix-identity = "0.8.0" actix-identity = "0.5.2"
actix-web = "4.5.1" actix-web = "4"
actix-session = { version = "0.9.0", features = ["cookie-session"] } actix-session = { version = "0.7.2", features = ["cookie-session"] }
actix-remote-ip = "0.1.0" clap = { version = "4.0.27", features = ["derive", "env"] }
clap = { version = "4.5.17", features = ["derive", "env"] }
include_dir = "0.7.3" include_dir = "0.7.3"
log = "0.4.21" log = "0.4.17"
serde_json = "1.0.128" serde_json = "1.0.89"
serde_yaml = "0.9.34" serde_yaml = "0.9.14"
env_logger = "0.11.3" env_logger = "0.10.0"
serde = { version = "1.0.210", features = ["derive"] } serde = { version = "1.0.148", features = ["derive"] }
bcrypt = "0.15.1" bcrypt = "0.13.0"
uuid = { version = "1.8.0", features = ["v4"] } uuid = { version = "1.2.2", features = ["v4"] }
mime_guess = "2.0.4" mime_guess = "2.0.4"
askama = "0.12.1" askama = "0.11.1"
futures-util = "0.3.30" futures-util = "0.3.25"
urlencoding = "2.1.3" urlencoding = "2.1.2"
rand = "0.8.5" rand = "0.8.5"
base64 = "0.22.1" base64 = "0.13.1"
jwt-simple = { version = "0.12.10", default-features = false, features = ["pure-rust"] } jwt-simple = "0.11.2"
digest = "0.10.7" digest = "0.10.6"
sha2 = "0.10.8" sha2 = "0.10.6"
lazy-regex = "3.3.0" lazy-regex = "2.3.1"
totp_rfc6238 = "0.6.0" totp_rfc6238 = "0.5.1"
base32 = "0.5.0" base32 = "0.4.0"
qrcode-generator = "5.0.0" qrcode-generator = "4.1.6"
webauthn-rs = { version = "0.5.0", features = ["danger-allow-state-serialisation"] } webauthn-rs = { version = "0.4.8", features = ["danger-allow-state-serialisation"] }
url = "2.5.0" url = "2.3.1"
light-openid = { version = "1.0.2", features = ["crypto-wrapper"] } aes-gcm = { version = "0.10.1", features = ["aes"] }
bincode = "2.0.0-rc.3" bincode = "1.3.3"
chrono = "0.4.38" chrono = "0.4.23"
lazy_static = "1.4.0" lazy_static = "1.4.0"
mailchecker = "6.0.8" # ldap3 = "0.10.5"

View File

@ -1,9 +1,5 @@
FROM debian:bookworm-slim FROM debian:bullseye-slim
RUN apt-get update \
&& apt-get install -y libcurl4 \
&& rm -rf /var/lib/apt/lists/*
COPY basic-oidc /usr/local/bin/basic-oidc COPY basic-oidc /usr/local/bin/basic-oidc
ENTRYPOINT ["/usr/local/bin/basic-oidc"] ENTRYPOINT /usr/local/bin/basic-oidc

View File

@ -5,76 +5,32 @@ Basic & lightweight OpenID provider, written in Rust using the Actix framework.
**WARNING :** This tool has not been audited, use it at your own risks! **WARNING :** This tool has not been audited, use it at your own risks!
BasicOIDC operates without any database, just with three files : BasicOIDC operates without any database, just with two files :
* `clients.yaml`: a list of authorized relying parties. * `clients.yaml`: a list of authorized relying parties.
* `providers.yaml`: a list of upstream providers for authentication federation (this file is optional)
* `users.json`: a list of users, managed through a web UI. * `users.json`: a list of users, managed through a web UI.
## Configuration
You can configure a list of clients (Relying Parties) in a `clients.yaml` file with the following syntax : You can configure a list of clients (Relying Parties) in a `clients.yaml` file with the following syntax :
```yaml ```yaml
# Client ID
- id: gitea - id: gitea
# Client name
name: Gitea name: Gitea
# Client description
description: Git with a cup of tea description: Git with a cup of tea
# Client secret. Specify this value to use authorization code flow, remove it for implicit authentication flow
secret: TOP_SECRET secret: TOP_SECRET
# The URL where user shall be redirected after authentication
redirect_uri: https://mygit.mywebsite.com/ redirect_uri: https://mygit.mywebsite.com/
# Optional, If you want new accounts to be granted access to this client by default
default: true
# Optional, If you want the client to be granted to every user, regardless their account configuration
granted_to_all_users: true
# Optional, If you want users to have performed recent second factor authentication before accessing this client, set this setting to true
enforce_2fa_auth: true
# Optional, claims to be added to the ID token payload.
# The following placeholders can be set, they will the replaced when the token is created:
# * {username}: user name of the user
# * {mail}: email address of the user
# * {first_name}: first name of the user
# * {last_name}: last name of the user
# * {uid}: user id of the user
claims_id_token:
groups: ["group_{user}"]
service: "auth"
# Optional, claims to be added to the user info endpoint response
# The placeholders of `claims_id_token` can also be used here
claims_user_info:
groups: ["group_{user}"]
service: "auth"
``` ```
On the first run, BasicOIDC will create a new administrator with credentials `admin` / `admin`. On first login you will have to change these default credentials. On the first run, BasicOIDC will create a new administrator with credentials `admin` / `admin`. On first login you will have to change these default credentials.
In order to run BasicOIDC for development, you will need to create a least an empty `clients.yaml` file inside the storage directory. In order to run BasicOIDC for development, you will need to create a least an empty `clients.yaml` file inside the storage directory.
## Features Features :
* [x] `authorization_code` flow * [x] `authorization_code` flow
* [x] `implicit` flow
* [x] Client authentication using secrets * [x] Client authentication using secrets
* [x] Bruteforce protection * [x] Bruteforce protection
* [x] 2 factors authentication * [x] 2 factor authentication
* [x] TOTP (authenticator app) * [x] TOTP (authenticator app)
* [x] Using a security key (Webauthn) * [x] Using a security key (Webauthn)
* [ ] Fully responsive webui * [ ] Fully responsive webui
* [x] `robots.txt` prevents indexing * [x] `robots.txt` prevents indexing
* [x] Support authentication from upstream provider
## Add an upstream provider
You can add as much upstream provider as you want, using the following syntax in `providers.yaml`:
```yaml
- id: gitlab
name: GitLab
logo: gitlab # Can be either gitea, gitlab, github, microsoft, google or a full URL
client_id: CLIENT_ID_GIVEN_BY_PROVIDER
client_secret: CLIENT_SECRET_GIVEN_BY_PROVIDER
configuration_url: https://gitlab.com/.well-known/openid-configuration
```
> Warning! Self-registration has not been implemented, therfore the accounts must have been previously created through the administration.
## Compiling ## Compiling
You will need the Rust toolchain to compile this project. To build it for production, just run: You will need the Rust toolchain to compile this project. To build it for production, just run:
@ -82,31 +38,5 @@ You will need the Rust toolchain to compile this project. To build it for produc
cargo build --release cargo build --release
``` ```
## Testing with OAauth proxy
If you want to test the solution with OAuth proxy, you can try to adapt the following commands (considering `192.168.2.103` is your local IP address):
```bash
export IP=192.168.2.103
# In a shell, start BasicOID
RUST_LOG=debug cargo run -- -s storage -w "http://$IP.nip.io:8000"
# In another shell, run OAuth proxy
docker run --rm -p 4180:4180 quay.io/oauth2-proxy/oauth2-proxy:latest --provider=oidc --email-domain=* --client-id=oauthproxy --client-secret=secretoauth --cookie-secret=SECRETCOOKIE1234 --oidc-issuer-url=http://$IP.nip.io:8000 --http-address 0.0.0.0:4180 --upstream http://$IP --redirect-url http://$IP:4180/oauth2/callback --cookie-secure=false
```
Corresponding client configuration:
```yaml
- id: oauthproxy
name: Oauth proxy
description: oauth proxy
secret: secretoauth
redirect_uri: http://192.168.2.103:4180/
```
> Note: We do need to use real domain name instead of IP address due to the `webauthn-rs` crate limitations. We therefore use the `nip.io` domain helper.
OAuth proxy can then be access on this URL: http://192.168.2.103:4180/
## Contributing ## Contributing
If you wish to contribute to this software, feel free to send an email to contact@communiquons.org to get an account on my system, managed by BasicOIDC :) If you wish to contribute to this software, feel free to send an email to contact@communiquons.org to get an account on my system, managed by BasicOIDC :)

View File

@ -73,10 +73,3 @@ body {
.text-muted { .text-muted {
color: #c6c4c4 !important; color: #c6c4c4 !important;
} }
.form-floating > .form-control:focus ~ label::after,
.form-floating > .form-control:not(:placeholder-shown) ~ label::after,
.form-floating > .form-control-plaintext ~ label::after,
.form-floating > .form-select ~ label::after {
background-color: unset !important;
}

View File

@ -13,11 +13,3 @@ body {
padding: 3rem; padding: 3rem;
overflow-y: scroll; overflow-y: scroll;
} }
.nav-link.link-dark {
color: white !important;
}
.form-control::placeholder {
color: #555;
}

6919
assets/css/bootstrap.css vendored

File diff suppressed because it is too large Load Diff

View File

@ -1,12 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<svg version="1.1" id="main_outline" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 640 640" style="enable-background:new 0 0 640 640;" xml:space="preserve"><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-custom-link"/><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-general-link"/><style xmlns="" lang="en" type="text/css" id="dark-mode-custom-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-sheet"/>
<g>
<path id="teabag" style="fill:#FFFFFF" d="M395.9,484.2l-126.9-61c-12.5-6-17.9-21.2-11.8-33.8l61-126.9c6-12.5,21.2-17.9,33.8-11.8 c17.2,8.3,27.1,13,27.1,13l-0.1-109.2l16.7-0.1l0.1,117.1c0,0,57.4,24.2,83.1,40.1c3.7,2.3,10.2,6.8,12.9,14.4 c2.1,6.1,2,13.1-1,19.3l-61,126.9C423.6,484.9,408.4,490.3,395.9,484.2z"/>
<g>
<g>
<path style="fill:#609926" d="M622.7,149.8c-4.1-4.1-9.6-4-9.6-4s-117.2,6.6-177.9,8c-13.3,0.3-26.5,0.6-39.6,0.7c0,39.1,0,78.2,0,117.2 c-5.5-2.6-11.1-5.3-16.6-7.9c0-36.4-0.1-109.2-0.1-109.2c-29,0.4-89.2-2.2-89.2-2.2s-141.4-7.1-156.8-8.5 c-9.8-0.6-22.5-2.1-39,1.5c-8.7,1.8-33.5,7.4-53.8,26.9C-4.9,212.4,6.6,276.2,8,285.8c1.7,11.7,6.9,44.2,31.7,72.5 c45.8,56.1,144.4,54.8,144.4,54.8s12.1,28.9,30.6,55.5c25,33.1,50.7,58.9,75.7,62c63,0,188.9-0.1,188.9-0.1s12,0.1,28.3-10.3 c14-8.5,26.5-23.4,26.5-23.4s12.9-13.8,30.9-45.3c5.5-9.7,10.1-19.1,14.1-28c0,0,55.2-117.1,55.2-231.1 C633.2,157.9,624.7,151.8,622.7,149.8z M125.6,353.9c-25.9-8.5-36.9-18.7-36.9-18.7S69.6,321.8,60,295.4 c-16.5-44.2-1.4-71.2-1.4-71.2s8.4-22.5,38.5-30c13.8-3.7,31-3.1,31-3.1s7.1,59.4,15.7,94.2c7.2,29.2,24.8,77.7,24.8,77.7 S142.5,359.9,125.6,353.9z M425.9,461.5c0,0-6.1,14.5-19.6,15.4c-5.8,0.4-10.3-1.2-10.3-1.2s-0.3-0.1-5.3-2.1l-112.9-55 c0,0-10.9-5.7-12.8-15.6c-2.2-8.1,2.7-18.1,2.7-18.1L322,273c0,0,4.8-9.7,12.2-13c0.6-0.3,2.3-1,4.5-1.5c8.1-2.1,18,2.8,18,2.8 l110.7,53.7c0,0,12.6,5.7,15.3,16.2c1.9,7.4-0.5,14-1.8,17.2C474.6,363.8,425.9,461.5,425.9,461.5z"/>
<path style="fill:#609926" d="M326.8,380.1c-8.2,0.1-15.4,5.8-17.3,13.8c-1.9,8,2,16.3,9.1,20c7.7,4,17.5,1.8,22.7-5.4 c5.1-7.1,4.3-16.9-1.8-23.1l24-49.1c1.5,0.1,3.7,0.2,6.2-0.5c4.1-0.9,7.1-3.6,7.1-3.6c4.2,1.8,8.6,3.8,13.2,6.1 c4.8,2.4,9.3,4.9,13.4,7.3c0.9,0.5,1.8,1.1,2.8,1.9c1.6,1.3,3.4,3.1,4.7,5.5c1.9,5.5-1.9,14.9-1.9,14.9 c-2.3,7.6-18.4,40.6-18.4,40.6c-8.1-0.2-15.3,5-17.7,12.5c-2.6,8.1,1.1,17.3,8.9,21.3c7.8,4,17.4,1.7,22.5-5.3 c5-6.8,4.6-16.3-1.1-22.6c1.9-3.7,3.7-7.4,5.6-11.3c5-10.4,13.5-30.4,13.5-30.4c0.9-1.7,5.7-10.3,2.7-21.3 c-2.5-11.4-12.6-16.7-12.6-16.7c-12.2-7.9-29.2-15.2-29.2-15.2s0-4.1-1.1-7.1c-1.1-3.1-2.8-5.1-3.9-6.3c4.7-9.7,9.4-19.3,14.1-29 c-4.1-2-8.1-4-12.2-6.1c-4.8,9.8-9.7,19.7-14.5,29.5c-6.7-0.1-12.9,3.5-16.1,9.4c-3.4,6.3-2.7,14.1,1.9,19.8 C343.2,346.5,335,363.3,326.8,380.1z"/>
</g>
</g>
</g>
</svg>

Before

Width:  |  Height:  |  Size: 2.9 KiB

View File

@ -1 +0,0 @@
<svg width="98" height="96" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M48.854 0C21.839 0 0 22 0 49.217c0 21.756 13.993 40.172 33.405 46.69 2.427.49 3.316-1.059 3.316-2.362 0-1.141-.08-5.052-.08-9.127-13.59 2.934-16.42-5.867-16.42-5.867-2.184-5.704-5.42-7.17-5.42-7.17-4.448-3.015.324-3.015.324-3.015 4.934.326 7.523 5.052 7.523 5.052 4.367 7.496 11.404 5.378 14.235 4.074.404-3.178 1.699-5.378 3.074-6.6-10.839-1.141-22.243-5.378-22.243-24.283 0-5.378 1.94-9.778 5.014-13.2-.485-1.222-2.184-6.275.486-13.038 0 0 4.125-1.304 13.426 5.052a46.97 46.97 0 0 1 12.214-1.63c4.125 0 8.33.571 12.213 1.63 9.302-6.356 13.427-5.052 13.427-5.052 2.67 6.763.97 11.816.485 13.038 3.155 3.422 5.015 7.822 5.015 13.2 0 18.905-11.404 23.06-22.324 24.283 1.78 1.548 3.316 4.481 3.316 9.126 0 6.6-.08 11.897-.08 13.526 0 1.304.89 2.853 3.316 2.364 19.412-6.52 33.405-24.935 33.405-46.691C97.707 22 75.788 0 48.854 0z" fill="#fff"/></svg>

Before

Width:  |  Height:  |  Size: 960 B

View File

@ -1 +0,0 @@
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 380 380"><defs><style>.cls-1{fill:#e24329;}.cls-2{fill:#fc6d26;}.cls-3{fill:#fca326;}</style></defs><g id="LOGO"><path class="cls-1" d="M282.83,170.73l-.27-.69-26.14-68.22a6.81,6.81,0,0,0-2.69-3.24,7,7,0,0,0-8,.43,7,7,0,0,0-2.32,3.52l-17.65,54H154.29l-17.65-54A6.86,6.86,0,0,0,134.32,99a7,7,0,0,0-8-.43,6.87,6.87,0,0,0-2.69,3.24L97.44,170l-.26.69a48.54,48.54,0,0,0,16.1,56.1l.09.07.24.17,39.82,29.82,19.7,14.91,12,9.06a8.07,8.07,0,0,0,9.76,0l12-9.06,19.7-14.91,40.06-30,.1-.08A48.56,48.56,0,0,0,282.83,170.73Z"/><path class="cls-2" d="M282.83,170.73l-.27-.69a88.3,88.3,0,0,0-35.15,15.8L190,229.25c19.55,14.79,36.57,27.64,36.57,27.64l40.06-30,.1-.08A48.56,48.56,0,0,0,282.83,170.73Z"/><path class="cls-3" d="M153.43,256.89l19.7,14.91,12,9.06a8.07,8.07,0,0,0,9.76,0l12-9.06,19.7-14.91S209.55,244,190,229.25C170.45,244,153.43,256.89,153.43,256.89Z"/><path class="cls-2" d="M132.58,185.84A88.19,88.19,0,0,0,97.44,170l-.26.69a48.54,48.54,0,0,0,16.1,56.1l.09.07.24.17,39.82,29.82s17-12.85,36.57-27.64Z"/></g></svg>

Before

Width:  |  Height:  |  Size: 1.0 KiB

View File

@ -1 +0,0 @@
<svg xmlns="http://www.w3.org/2000/svg" width="705.6" height="720" viewBox="0 0 186.69 190.5" xmlns:v="https://vecta.io/nano"><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-custom-link"/><link xmlns="" type="text/css" rel="stylesheet" id="dark-mode-general-link"/><style xmlns="" lang="en" type="text/css" id="dark-mode-custom-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-style"/><style xmlns="" lang="en" type="text/css" id="dark-mode-native-sheet"/><g transform="translate(1184.583 765.171)"><path clip-path="none" mask="none" d="M-1089.333-687.239v36.888h51.262c-2.251 11.863-9.006 21.908-19.137 28.662l30.913 23.986c18.011-16.625 28.402-41.044 28.402-70.052 0-6.754-.606-13.249-1.732-19.483z" fill="#4285f4"/><path clip-path="none" mask="none" d="M-1142.714-651.791l-6.972 5.337-24.679 19.223h0c15.673 31.086 47.796 52.561 85.03 52.561 25.717 0 47.278-8.486 63.038-23.033l-30.913-23.986c-8.486 5.715-19.31 9.179-32.125 9.179-24.765 0-45.806-16.712-53.34-39.226z" fill="#34a853"/><path clip-path="none" mask="none" d="M-1174.365-712.61c-6.494 12.815-10.217 27.276-10.217 42.689s3.723 29.874 10.217 42.689c0 .086 31.693-24.592 31.693-24.592-1.905-5.715-3.031-11.776-3.031-18.098s1.126-12.383 3.031-18.098z" fill="#fbbc05"/><path d="M-1089.333-727.244c14.028 0 26.497 4.849 36.455 14.201l27.276-27.276c-16.539-15.413-38.013-24.852-63.731-24.852-37.234 0-69.359 21.388-85.032 52.561l31.692 24.592c7.533-22.514 28.575-39.226 53.34-39.226z" fill="#ea4335" clip-path="none" mask="none"/></g></svg>

Before

Width:  |  Height:  |  Size: 1.5 KiB

View File

@ -1 +0,0 @@
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 21 21"><path fill="#f35325" d="M0 0h10v10H0z"/><path fill="#81bc06" d="M11 0h10v10H11z"/><path fill="#05a6f0" d="M0 11h10v10H0z"/><path fill="#ffba08" d="M11 11h10v10H11z"/></svg>

Before

Width:  |  Height:  |  Size: 232 B

File diff suppressed because one or more lines are too long

View File

@ -1,9 +1,3 @@
{ {
"$schema": "https://docs.renovatebot.com/renovate-schema.json", "$schema": "https://docs.renovatebot.com/renovate-schema.json"
"packageRules": [
{
"matchUpdateTypes": ["major", "minor", "patch"],
"automerge": true
}
]
} }

View File

@ -1,4 +1,3 @@
pub mod bruteforce_actor; pub mod bruteforce_actor;
pub mod openid_sessions_actor; pub mod openid_sessions_actor;
pub mod providers_states_actor;
pub mod users_actor; pub mod users_actor;

View File

@ -1,130 +0,0 @@
//! # Providers state actor
//!
//! This actor stores the content of the states
//! during authentication with upstream providers
use crate::constants::{
MAX_OIDC_PROVIDERS_STATES, OIDC_PROVIDERS_STATE_DURATION, OIDC_PROVIDERS_STATE_LEN,
OIDC_STATES_CLEANUP_INTERVAL,
};
use actix::{Actor, AsyncContext, Context, Handler, Message};
use std::collections::hash_map::Entry;
use std::collections::HashMap;
use std::net::IpAddr;
use crate::data::login_redirect::LoginRedirect;
use crate::data::provider::ProviderID;
use crate::utils::string_utils::rand_str;
use crate::utils::time::time;
#[derive(Debug, Clone)]
pub struct ProviderLoginState {
pub provider_id: ProviderID,
pub state_id: String,
pub redirect: LoginRedirect,
pub expire: u64,
}
impl ProviderLoginState {
pub fn new(prov_id: &ProviderID, redirect: LoginRedirect) -> Self {
Self {
provider_id: prov_id.clone(),
state_id: rand_str(OIDC_PROVIDERS_STATE_LEN),
redirect,
expire: time() + OIDC_PROVIDERS_STATE_DURATION,
}
}
}
#[derive(Message)]
#[rtype(result = "()")]
pub struct RecordState {
pub ip: IpAddr,
pub state: ProviderLoginState,
}
#[derive(Message)]
#[rtype(result = "Option<ProviderLoginState>")]
pub struct ConsumeState {
pub ip: IpAddr,
pub state_id: String,
}
#[derive(Debug, Default)]
pub struct ProvidersStatesActor {
states: HashMap<IpAddr, Vec<ProviderLoginState>>,
}
impl ProvidersStatesActor {
/// Clean outdated states
fn clean_old_states(&mut self) {
#[allow(clippy::map_clone)]
let keys = self.states.keys().map(|i| *i).collect::<Vec<_>>();
for ip in keys {
// Remove old states
let states = self.states.get_mut(&ip).unwrap();
states.retain(|i| i.expire < time());
// Remove empty entry keys
if states.is_empty() {
self.states.remove(&ip);
}
}
}
/// Add a new provider login state
pub fn insert_state(&mut self, ip: IpAddr, state: ProviderLoginState) {
if let Entry::Vacant(e) = self.states.entry(ip) {
e.insert(vec![state]);
} else {
let states = self.states.get_mut(&ip).unwrap();
// We limit the number of states per IP address
if states.len() > MAX_OIDC_PROVIDERS_STATES {
states.remove(0);
}
states.push(state);
}
}
/// Get & consume a login state
pub fn consume_state(&mut self, ip: IpAddr, state_id: &str) -> Option<ProviderLoginState> {
let idx = self
.states
.get(&ip)?
.iter()
.position(|val| val.state_id.as_str() == state_id)?;
Some(self.states.get_mut(&ip)?.remove(idx))
}
}
impl Actor for ProvidersStatesActor {
type Context = Context<Self>;
fn started(&mut self, ctx: &mut Self::Context) {
// Clean up at a regular interval failed attempts
ctx.run_interval(OIDC_STATES_CLEANUP_INTERVAL, |act, _ctx| {
log::trace!("Cleaning up old states");
act.clean_old_states();
});
}
}
impl Handler<RecordState> for ProvidersStatesActor {
type Result = ();
fn handle(&mut self, req: RecordState, _ctx: &mut Self::Context) -> Self::Result {
self.insert_state(req.ip, req.state);
}
}
impl Handler<ConsumeState> for ProvidersStatesActor {
type Result = Option<ProviderLoginState>;
fn handle(&mut self, req: ConsumeState, _ctx: &mut Self::Context) -> Self::Result {
self.consume_state(req.ip, &req.state_id)
}
}

View File

@ -1,6 +1,5 @@
use std::net::IpAddr; use std::net::IpAddr;
use crate::data::provider::{Provider, ProviderID};
use actix::{Actor, Context, Handler, Message, MessageResult}; use actix::{Actor, Context, Handler, Message, MessageResult};
use crate::data::user::{FactorID, GeneralSettings, GrantedClients, TwoFactor, User, UserID}; use crate::data::user::{FactorID, GeneralSettings, GrantedClients, TwoFactor, User, UserID};
@ -9,7 +8,6 @@ use crate::utils::err::Res;
/// User storage interface /// User storage interface
pub trait UsersSyncBackend { pub trait UsersSyncBackend {
fn find_by_username_or_email(&self, u: &str) -> Res<Option<User>>; fn find_by_username_or_email(&self, u: &str) -> Res<Option<User>>;
fn find_by_email(&self, u: &str) -> Res<Option<User>>;
fn find_by_user_id(&self, id: &UserID) -> Res<Option<User>>; fn find_by_user_id(&self, id: &UserID) -> Res<Option<User>>;
fn get_entire_users_list(&self) -> Res<Vec<User>>; fn get_entire_users_list(&self) -> Res<Vec<User>>;
fn create_user_account(&mut self, settings: GeneralSettings) -> Res<UserID>; fn create_user_account(&mut self, settings: GeneralSettings) -> Res<UserID>;
@ -21,11 +19,6 @@ pub trait UsersSyncBackend {
fn save_new_successful_2fa_authentication(&mut self, id: &UserID, ip: IpAddr) -> Res; fn save_new_successful_2fa_authentication(&mut self, id: &UserID, ip: IpAddr) -> Res;
fn clear_2fa_login_history(&mut self, id: &UserID) -> Res; fn clear_2fa_login_history(&mut self, id: &UserID) -> Res;
fn delete_account(&mut self, id: &UserID) -> Res; fn delete_account(&mut self, id: &UserID) -> Res;
fn set_authorized_authentication_sources(
&mut self,
id: &UserID,
sources: AuthorizedAuthenticationSources,
) -> Res;
fn set_granted_2fa_clients(&mut self, id: &UserID, clients: GrantedClients) -> Res; fn set_granted_2fa_clients(&mut self, id: &UserID, clients: GrantedClients) -> Res;
} }
@ -35,25 +28,16 @@ pub enum LoginResult {
AccountNotFound, AccountNotFound,
InvalidPassword, InvalidPassword,
AccountDisabled, AccountDisabled,
LocalAuthForbidden,
AuthFromProviderForbidden,
Success(Box<User>), Success(Box<User>),
} }
#[derive(Message)] #[derive(Message)]
#[rtype(LoginResult)] #[rtype(LoginResult)]
pub struct LocalLoginRequest { pub struct LoginRequest {
pub login: String, pub login: String,
pub password: String, pub password: String,
} }
#[derive(Message)]
#[rtype(LoginResult)]
pub struct ProviderLoginRequest {
pub email: String,
pub provider: Provider,
}
#[derive(Message)] #[derive(Message)]
#[rtype(GetUserResult)] #[rtype(GetUserResult)]
pub struct GetUserRequest(pub UserID); pub struct GetUserRequest(pub UserID);
@ -104,16 +88,6 @@ pub struct AddSuccessful2FALogin(pub UserID, pub IpAddr);
#[rtype(result = "bool")] #[rtype(result = "bool")]
pub struct Clear2FALoginHistory(pub UserID); pub struct Clear2FALoginHistory(pub UserID);
#[derive(Eq, PartialEq, Debug, Clone)]
pub struct AuthorizedAuthenticationSources {
pub local: bool,
pub upstream: Vec<ProviderID>,
}
#[derive(Message)]
#[rtype(result = "bool")]
pub struct SetAuthorizedAuthenticationSources(pub UserID, pub AuthorizedAuthenticationSources);
#[derive(Message)] #[derive(Message)]
#[rtype(result = "bool")] #[rtype(result = "bool")]
pub struct SetGrantedClients(pub UserID, pub GrantedClients); pub struct SetGrantedClients(pub UserID, pub GrantedClients);
@ -145,10 +119,10 @@ impl Actor for UsersActor {
type Context = Context<Self>; type Context = Context<Self>;
} }
impl Handler<LocalLoginRequest> for UsersActor { impl Handler<LoginRequest> for UsersActor {
type Result = MessageResult<LocalLoginRequest>; type Result = MessageResult<LoginRequest>;
fn handle(&mut self, msg: LocalLoginRequest, _ctx: &mut Self::Context) -> Self::Result { fn handle(&mut self, msg: LoginRequest, _ctx: &mut Self::Context) -> Self::Result {
match self.manager.find_by_username_or_email(&msg.login) { match self.manager.find_by_username_or_email(&msg.login) {
Err(e) => { Err(e) => {
log::error!("Failed to find user! {}", e); log::error!("Failed to find user! {}", e);
@ -168,35 +142,6 @@ impl Handler<LocalLoginRequest> for UsersActor {
return MessageResult(LoginResult::AccountDisabled); return MessageResult(LoginResult::AccountDisabled);
} }
if !user.allow_local_login {
return MessageResult(LoginResult::LocalAuthForbidden);
}
MessageResult(LoginResult::Success(Box::new(user)))
}
}
}
}
impl Handler<ProviderLoginRequest> for UsersActor {
type Result = MessageResult<ProviderLoginRequest>;
fn handle(&mut self, msg: ProviderLoginRequest, _ctx: &mut Self::Context) -> Self::Result {
match self.manager.find_by_email(&msg.email) {
Err(e) => {
log::error!("Failed to find user! {}", e);
MessageResult(LoginResult::Error)
}
Ok(None) => MessageResult(LoginResult::AccountNotFound),
Ok(Some(user)) => {
if !user.can_login_from_provider(&msg.provider) {
return MessageResult(LoginResult::AuthFromProviderForbidden);
}
if !user.enabled {
return MessageResult(LoginResult::AccountDisabled);
}
MessageResult(LoginResult::Success(Box::new(user))) MessageResult(LoginResult::Success(Box::new(user)))
} }
} }
@ -296,29 +241,6 @@ impl Handler<Clear2FALoginHistory> for UsersActor {
} }
} }
impl Handler<SetAuthorizedAuthenticationSources> for UsersActor {
type Result = <SetAuthorizedAuthenticationSources as actix::Message>::Result;
fn handle(
&mut self,
msg: SetAuthorizedAuthenticationSources,
_ctx: &mut Self::Context,
) -> Self::Result {
match self
.manager
.set_authorized_authentication_sources(&msg.0, msg.1)
{
Ok(_) => true,
Err(e) => {
log::error!(
"Failed to set authorized authentication sources for user! {}",
e
);
false
}
}
}
}
impl Handler<SetGrantedClients> for UsersActor { impl Handler<SetGrantedClients> for UsersActor {
type Result = <SetGrantedClients as actix::Message>::Result; type Result = <SetGrantedClients as actix::Message>::Result;
fn handle(&mut self, msg: SetGrantedClients, _ctx: &mut Self::Context) -> Self::Result { fn handle(&mut self, msg: SetGrantedClients, _ctx: &mut Self::Context) -> Self::Result {

View File

@ -6,9 +6,6 @@ pub const USERS_LIST_FILE: &str = "users.json";
/// File in storage containing clients list /// File in storage containing clients list
pub const CLIENTS_LIST_FILE: &str = "clients.yaml"; pub const CLIENTS_LIST_FILE: &str = "clients.yaml";
/// File in storage containing providers list
pub const PROVIDERS_LIST_FILE: &str = "providers.yaml";
/// Default built-in credentials /// Default built-in credentials
pub const DEFAULT_ADMIN_USERNAME: &str = "admin"; pub const DEFAULT_ADMIN_USERNAME: &str = "admin";
pub const DEFAULT_ADMIN_PASSWORD: &str = "admin"; pub const DEFAULT_ADMIN_PASSWORD: &str = "admin";
@ -29,10 +26,6 @@ pub const MAX_SECOND_FACTOR_NAME_LEN: usize = 25;
/// exempted from this IP address to use 2FA /// exempted from this IP address to use 2FA
pub const SECOND_FACTOR_EXEMPTION_AFTER_SUCCESSFUL_LOGIN: u64 = 7 * 24 * 3600; pub const SECOND_FACTOR_EXEMPTION_AFTER_SUCCESSFUL_LOGIN: u64 = 7 * 24 * 3600;
/// The maximum acceptable interval of time between last two factors authentication of a user and
/// access to a critical route / a critical client
pub const SECOND_FACTOR_EXPIRATION_FOR_CRITICAL_OPERATIONS: u64 = 60 * 10;
/// Minimum password length /// Minimum password length
pub const MIN_PASS_LEN: usize = 4; pub const MIN_PASS_LEN: usize = 4;
@ -69,22 +62,9 @@ pub const OPEN_ID_AUTHORIZATION_CODE_LEN: usize = 120;
pub const OPEN_ID_AUTHORIZATION_CODE_TIMEOUT: u64 = 300; pub const OPEN_ID_AUTHORIZATION_CODE_TIMEOUT: u64 = 300;
pub const OPEN_ID_ACCESS_TOKEN_LEN: usize = 50; pub const OPEN_ID_ACCESS_TOKEN_LEN: usize = 50;
pub const OPEN_ID_ACCESS_TOKEN_TIMEOUT: u64 = 3600; pub const OPEN_ID_ACCESS_TOKEN_TIMEOUT: u64 = 3600;
pub const OPEN_ID_ID_TOKEN_TIMEOUT: u64 = 3600;
pub const OPEN_ID_REFRESH_TOKEN_LEN: usize = 120; pub const OPEN_ID_REFRESH_TOKEN_LEN: usize = 120;
pub const OPEN_ID_REFRESH_TOKEN_TIMEOUT: u64 = 360000; pub const OPEN_ID_REFRESH_TOKEN_TIMEOUT: u64 = 360000;
/// Webauthn constants /// Webauthn constants
pub const WEBAUTHN_REGISTER_CHALLENGE_EXPIRE: u64 = 3600; pub const WEBAUTHN_REGISTER_CHALLENGE_EXPIRE: u64 = 3600;
pub const WEBAUTHN_LOGIN_CHALLENGE_EXPIRE: u64 = 3600; pub const WEBAUTHN_LOGIN_CHALLENGE_EXPIRE: u64 = 3600;
/// OpenID providers login state constants
pub const OIDC_STATES_CLEANUP_INTERVAL: Duration = Duration::from_secs(60);
pub const MAX_OIDC_PROVIDERS_STATES: usize = 10;
pub const OIDC_PROVIDERS_STATE_LEN: usize = 40;
pub const OIDC_PROVIDERS_STATE_DURATION: u64 = 60 * 15;
/// OpenID providers configuration constants
pub const OIDC_PROVIDERS_LIFETIME: u64 = 3600;
/// OpenID provider callback URI
pub const OIDC_PROVIDER_CB_URI: &str = "/prov_cb";

View File

@ -4,10 +4,8 @@ use actix_web::{web, HttpResponse, Responder};
use crate::actors::users_actor::{DeleteUserRequest, FindUserByUsername, UsersActor}; use crate::actors::users_actor::{DeleteUserRequest, FindUserByUsername, UsersActor};
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::critical_route::CriticalRoute;
use crate::data::current_user::CurrentUser; use crate::data::current_user::CurrentUser;
use crate::data::user::UserID; use crate::data::user::UserID;
use crate::utils::string_utils;
#[derive(serde::Deserialize)] #[derive(serde::Deserialize)]
pub struct FindUserNameReq { pub struct FindUserNameReq {
@ -20,14 +18,9 @@ struct FindUserResult {
} }
pub async fn find_username( pub async fn find_username(
_critical: CriticalRoute,
req: web::Form<FindUserNameReq>, req: web::Form<FindUserNameReq>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
) -> impl Responder { ) -> impl Responder {
if !string_utils::is_acceptable_login(&req.username) {
return HttpResponse::BadRequest().json("Invalid login!");
}
let res = users let res = users
.send(FindUserByUsername(req.0.username)) .send(FindUserByUsername(req.0.username))
.await .await
@ -43,7 +36,6 @@ pub struct DeleteUserReq {
} }
pub async fn delete_user( pub async fn delete_user(
_critical: CriticalRoute,
user: CurrentUser, user: CurrentUser,
req: web::Form<DeleteUserReq>, req: web::Form<DeleteUserReq>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,

View File

@ -1,62 +1,45 @@
use std::ops::Deref; use std::ops::Deref;
use std::sync::Arc;
use actix::Addr; use actix::Addr;
use actix_web::{web, HttpResponse, Responder}; use actix_web::{web, HttpResponse, Responder};
use askama::Template; use askama::Template;
use crate::actors::users_actor; use crate::actors::users_actor;
use crate::actors::users_actor::{AuthorizedAuthenticationSources, UsersActor}; use crate::actors::users_actor::UsersActor;
use crate::constants::TEMPORARY_PASSWORDS_LEN; use crate::constants::TEMPORARY_PASSWORDS_LEN;
use crate::controllers::settings_controller::BaseSettingsPage; use crate::controllers::settings_controller::BaseSettingsPage;
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::app_config::AppConfig;
use crate::data::client::{Client, ClientID, ClientManager}; use crate::data::client::{Client, ClientID, ClientManager};
use crate::data::critical_route::CriticalRoute;
use crate::data::current_user::CurrentUser; use crate::data::current_user::CurrentUser;
use crate::data::provider::{Provider, ProviderID, ProvidersManager};
use crate::data::user::{GeneralSettings, GrantedClients, User, UserID}; use crate::data::user::{GeneralSettings, GrantedClients, User, UserID};
use crate::utils::string_utils;
use crate::utils::string_utils::rand_str; use crate::utils::string_utils::rand_str;
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/clients_list.html")] #[template(path = "settings/clients_list.html")]
struct ClientsListTemplate<'a> { struct ClientsListTemplate {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
clients: Vec<Client>, clients: Vec<Client>,
} }
#[derive(Template)]
#[template(path = "settings/providers_list.html")]
struct ProvidersListTemplate<'a> {
p: BaseSettingsPage<'a>,
providers: Vec<Provider>,
redirect_url: String,
}
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/users_list.html")] #[template(path = "settings/users_list.html")]
struct UsersListTemplate<'a> { struct UsersListTemplate {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
users: Vec<User>, users: Vec<User>,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/edit_user.html")] #[template(path = "settings/edit_user.html")]
struct EditUserTemplate<'a> { struct EditUserTemplate {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
u: User, u: User,
clients: Vec<Client>, clients: Vec<Client>,
providers: Vec<Provider>,
} }
pub async fn clients_route( pub async fn clients_route(user: CurrentUser, clients: web::Data<ClientManager>) -> impl Responder {
user: CurrentUser,
clients: web::Data<Arc<ClientManager>>,
) -> impl Responder {
HttpResponse::Ok().body( HttpResponse::Ok().body(
ClientsListTemplate { ClientsListTemplate {
p: BaseSettingsPage::get("Clients list", &user, None, None), _p: BaseSettingsPage::get("Clients list", &user, None, None),
clients: clients.cloned(), clients: clients.cloned(),
} }
.render() .render()
@ -64,21 +47,6 @@ pub async fn clients_route(
) )
} }
pub async fn providers_route(
user: CurrentUser,
providers: web::Data<Arc<ProvidersManager>>,
) -> impl Responder {
HttpResponse::Ok().body(
ProvidersListTemplate {
p: BaseSettingsPage::get("OpenID Providers list", &user, None, None),
providers: providers.cloned(),
redirect_url: AppConfig::get().oidc_provider_redirect_url(),
}
.render()
.unwrap(),
)
}
#[derive(serde::Deserialize, Debug)] #[derive(serde::Deserialize, Debug)]
pub struct UpdateUserQuery { pub struct UpdateUserQuery {
uid: UserID, uid: UserID,
@ -90,8 +58,6 @@ pub struct UpdateUserQuery {
enabled: Option<String>, enabled: Option<String>,
two_factor_exemption_after_successful_login: Option<String>, two_factor_exemption_after_successful_login: Option<String>,
admin: Option<String>, admin: Option<String>,
allow_local_login: Option<String>,
authorized_sources: String,
grant_type: String, grant_type: String,
granted_clients: String, granted_clients: String,
two_factor: String, two_factor: String,
@ -99,8 +65,7 @@ pub struct UpdateUserQuery {
} }
pub async fn users_route( pub async fn users_route(
_critical: CriticalRoute, user: CurrentUser,
admin: CurrentUser,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
update_query: Option<web::Form<UpdateUserQuery>>, update_query: Option<web::Form<UpdateUserQuery>>,
logger: ActionLogger, logger: ActionLogger,
@ -108,16 +73,7 @@ pub async fn users_route(
let mut danger = None; let mut danger = None;
let mut success = None; let mut success = None;
// Check update query for invalid input if let Some(update) = update_query {
if update_query
.as_ref()
.map(|l| string_utils::is_acceptable_login(&l.username))
== Some(false)
{
danger = Some("Invalid login provided, the modifications could not be saved!".to_string());
}
// Perform request (if any)
else if let Some(update) = update_query {
let edited_user: Option<User> = users let edited_user: Option<User> = users
.send(users_actor::GetUserRequest(update.uid.clone())) .send(users_actor::GetUserRequest(update.uid.clone()))
.await .await
@ -176,29 +132,6 @@ pub async fn users_route(
} }
} }
// Update the list of authorized authentication sources
let auth_sources = AuthorizedAuthenticationSources {
local: update.0.allow_local_login.is_some(),
upstream: match update.0.authorized_sources.as_str() {
"" => vec![],
s => s.split(',').map(|s| ProviderID(s.to_string())).collect(),
},
};
if edited_user.authorized_authentication_sources() != auth_sources {
logger.log(Action::AdminSetAuthorizedAuthenticationSources(
&edited_user,
&auth_sources,
));
users
.send(users_actor::SetAuthorizedAuthenticationSources(
edited_user.uid.clone(),
auth_sources,
))
.await
.unwrap();
}
// Update list of granted clients // Update list of granted clients
let granted_clients = match update.0.grant_type.as_str() { let granted_clients = match update.0.grant_type.as_str() {
"all_clients" => GrantedClients::AllClients, "all_clients" => GrantedClients::AllClients,
@ -292,7 +225,7 @@ pub async fn users_route(
HttpResponse::Ok().body( HttpResponse::Ok().body(
UsersListTemplate { UsersListTemplate {
p: BaseSettingsPage::get("Users list", &admin, danger, success), _p: BaseSettingsPage::get("Users list", &user, danger, success),
users, users,
} }
.render() .render()
@ -300,29 +233,12 @@ pub async fn users_route(
) )
} }
pub async fn create_user( pub async fn create_user(user: CurrentUser, clients: web::Data<ClientManager>) -> impl Responder {
_critical: CriticalRoute,
admin: CurrentUser,
clients: web::Data<Arc<ClientManager>>,
providers: web::Data<Arc<ProvidersManager>>,
) -> impl Responder {
let user = User {
authorized_clients: Some(
clients
.get_default_clients()
.iter()
.map(|u| u.id.clone())
.collect(),
),
..Default::default()
};
HttpResponse::Ok().body( HttpResponse::Ok().body(
EditUserTemplate { EditUserTemplate {
p: BaseSettingsPage::get("Create a new user", admin.deref(), None, None), _p: BaseSettingsPage::get("Create a new user", user.deref(), None, None),
u: user, u: Default::default(),
clients: clients.cloned(), clients: clients.cloned(),
providers: providers.cloned(),
} }
.render() .render()
.unwrap(), .unwrap(),
@ -335,10 +251,8 @@ pub struct EditUserQuery {
} }
pub async fn edit_user( pub async fn edit_user(
_critical: CriticalRoute, user: CurrentUser,
admin: CurrentUser, clients: web::Data<ClientManager>,
clients: web::Data<Arc<ClientManager>>,
providers: web::Data<Arc<ProvidersManager>>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
query: web::Query<EditUserQuery>, query: web::Query<EditUserQuery>,
) -> impl Responder { ) -> impl Responder {
@ -350,9 +264,9 @@ pub async fn edit_user(
HttpResponse::Ok().body( HttpResponse::Ok().body(
EditUserTemplate { EditUserTemplate {
p: BaseSettingsPage::get( _p: BaseSettingsPage::get(
"Edit user account", "Edit user account",
admin.deref(), user.deref(),
match edited_account.is_none() { match edited_account.is_none() {
true => Some("Could not find requested user!".to_string()), true => Some("Could not find requested user!".to_string()),
false => None, false => None,
@ -361,7 +275,6 @@ pub async fn edit_user(
), ),
u: edited_account.unwrap_or_default(), u: edited_account.unwrap_or_default(),
clients: clients.cloned(), clients: clients.cloned(),
providers: providers.cloned(),
} }
.render() .render()
.unwrap(), .unwrap(),

View File

@ -1,9 +1,9 @@
use crate::actors::users_actor; use crate::actors::users_actor;
use crate::actors::users_actor::UsersActor; use crate::actors::users_actor::UsersActor;
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::remote_ip::RemoteIP;
use actix::Addr; use actix::Addr;
use actix_identity::Identity; use actix_identity::Identity;
use actix_remote_ip::RemoteIP;
use actix_web::{web, HttpRequest, HttpResponse, Responder}; use actix_web::{web, HttpRequest, HttpResponse, Responder};
use webauthn_rs::prelude::PublicKeyCredential; use webauthn_rs::prelude::PublicKeyCredential;
@ -25,6 +25,10 @@ pub async fn auth_webauthn(
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
logger: ActionLogger, logger: ActionLogger,
) -> impl Responder { ) -> impl Responder {
if !SessionIdentity(Some(&id)).need_2fa_auth() {
return HttpResponse::Unauthorized().json("No 2FA required!");
}
let user_id = SessionIdentity(Some(&id)).user_id(); let user_id = SessionIdentity(Some(&id)).user_id();
match manager.finish_authentication(&user_id, &req.opaque_state, &req.credential) { match manager.finish_authentication(&user_id, &req.opaque_state, &req.credential) {
@ -37,9 +41,7 @@ pub async fn auth_webauthn(
.await .await
.unwrap(); .unwrap();
let session = SessionIdentity(Some(&id)); SessionIdentity(Some(&id)).set_status(&http_req, SessionStatus::SignedIn);
session.record_2fa_auth(&http_req);
session.set_status(&http_req, SessionStatus::SignedIn);
logger.log(Action::LoginWebauthnAttempt { logger.log(Action::LoginWebauthnAttempt {
success: true, success: true,
user_id, user_id,

View File

@ -1,9 +1,7 @@
use actix::Addr; use actix::Addr;
use actix_identity::Identity; use actix_identity::Identity;
use actix_remote_ip::RemoteIP;
use actix_web::{web, HttpRequest, HttpResponse, Responder}; use actix_web::{web, HttpRequest, HttpResponse, Responder};
use askama::Template; use askama::Template;
use std::sync::Arc;
use crate::actors::bruteforce_actor::BruteForceActor; use crate::actors::bruteforce_actor::BruteForceActor;
use crate::actors::users_actor::{LoginResult, UsersActor}; use crate::actors::users_actor::{LoginResult, UsersActor};
@ -13,54 +11,51 @@ use crate::controllers::base_controller::{
build_fatal_error_page, redirect_user, redirect_user_for_login, build_fatal_error_page, redirect_user, redirect_user_for_login,
}; };
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::force_2fa_auth::Force2FAAuth; use crate::data::login_redirect::LoginRedirect;
use crate::data::login_redirect::{get_2fa_url, LoginRedirect}; use crate::data::remote_ip::RemoteIP;
use crate::data::provider::{Provider, ProvidersManager};
use crate::data::session_identity::{SessionIdentity, SessionStatus}; use crate::data::session_identity::{SessionIdentity, SessionStatus};
use crate::data::user::User; use crate::data::user::User;
use crate::data::webauthn_manager::WebAuthManagerReq; use crate::data::webauthn_manager::WebAuthManagerReq;
use crate::utils::string_utils;
pub struct BaseLoginPage<'a> { struct BaseLoginPage<'a> {
pub danger: Option<String>, danger: Option<String>,
pub success: Option<String>, success: Option<String>,
pub page_title: &'static str, page_title: &'static str,
pub app_name: &'static str, app_name: &'static str,
pub redirect_uri: &'a LoginRedirect, redirect_uri: &'a LoginRedirect,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "login/login.html")] #[template(path = "login/login.html")]
struct LoginTemplate<'a> { struct LoginTemplate<'a> {
p: BaseLoginPage<'a>, _p: BaseLoginPage<'a>,
login: String, login: String,
providers: Vec<Provider>,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "login/password_reset.html")] #[template(path = "login/password_reset.html")]
struct PasswordResetTemplate<'a> { struct PasswordResetTemplate<'a> {
p: BaseLoginPage<'a>, _p: BaseLoginPage<'a>,
min_pass_len: usize, min_pass_len: usize,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "login/choose_second_factor.html")] #[template(path = "login/choose_second_factor.html")]
struct ChooseSecondFactorTemplate<'a> { struct ChooseSecondFactorTemplate<'a> {
p: BaseLoginPage<'a>, _p: BaseLoginPage<'a>,
user: &'a User, user: &'a User,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "login/otp_input.html")] #[template(path = "login/otp_input.html")]
struct LoginWithOTPTemplate<'a> { struct LoginWithOTPTemplate<'a> {
p: BaseLoginPage<'a>, _p: BaseLoginPage<'a>,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "login/webauthn_input.html")] #[template(path = "login/webauthn_input.html")]
struct LoginWithWebauthnTemplate<'a> { struct LoginWithWebauthnTemplate<'a> {
p: BaseLoginPage<'a>, _p: BaseLoginPage<'a>,
opaque_state: String, opaque_state: String,
challenge_json: String, challenge_json: String,
} }
@ -82,7 +77,6 @@ pub struct LoginRequestQuery {
#[allow(clippy::too_many_arguments)] #[allow(clippy::too_many_arguments)]
pub async fn login_route( pub async fn login_route(
remote_ip: RemoteIP, remote_ip: RemoteIP,
providers: web::Data<Arc<ProvidersManager>>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
bruteforce: web::Data<Addr<BruteForceActor>>, bruteforce: web::Data<Addr<BruteForceActor>>,
query: web::Query<LoginRequestQuery>, query: web::Query<LoginRequestQuery>,
@ -127,25 +121,18 @@ pub async fn login_route(
query.redirect.get_encoded() query.redirect.get_encoded()
)); ));
} }
// Check if the user has to validate a second factor // Check if the user has to valide a second factor
else if SessionIdentity(id.as_ref()).need_2fa_auth() { else if SessionIdentity(id.as_ref()).need_2fa_auth() {
return redirect_user(&get_2fa_url(&query.redirect, false)); return redirect_user(&format!(
} "/2fa_auth?redirect={}",
// Check if given login is not acceptable query.redirect.get_encoded()
else if req ));
.as_ref()
.map(|r| string_utils::is_acceptable_login(&r.login))
== Some(false)
{
danger = Some(
"Given login could not be processed, because it has an invalid format!".to_string(),
);
} }
// Try to authenticate user // Try to authenticate user
else if let Some(req) = &req { else if let Some(req) = &req {
login.clone_from(&req.login); login = req.login.clone();
let response: LoginResult = users let response: LoginResult = users
.send(users_actor::LocalLoginRequest { .send(users_actor::LoginRequest {
login: login.clone(), login: login.clone(),
password: req.password.clone(), password: req.password.clone(),
}) })
@ -176,12 +163,6 @@ pub async fn login_route(
danger = Some("Your account is disabled!".to_string()); danger = Some("Your account is disabled!".to_string());
} }
LoginResult::LocalAuthForbidden => {
log::warn!("Failed login for username {} : attempted to use local auth, but it is forbidden", &login);
logger.log(Action::TryLocalLoginFromUnauthorizedAccount(&login));
danger = Some("You cannot login from local auth with your account!".to_string());
}
LoginResult::Error => { LoginResult::Error => {
danger = Some("An unkown error occured while trying to sign you in!".to_string()); danger = Some("An unkown error occured while trying to sign you in!".to_string());
} }
@ -208,7 +189,7 @@ pub async fn login_route(
HttpResponse::Ok().content_type("text/html").body( HttpResponse::Ok().content_type("text/html").body(
LoginTemplate { LoginTemplate {
p: BaseLoginPage { _p: BaseLoginPage {
page_title: "Login", page_title: "Login",
danger, danger,
success, success,
@ -216,7 +197,6 @@ pub async fn login_route(
redirect_uri: &query.redirect, redirect_uri: &query.redirect,
}, },
login, login,
providers: providers.cloned(),
} }
.render() .render()
.unwrap(), .unwrap(),
@ -282,7 +262,7 @@ pub async fn reset_password_route(
HttpResponse::Ok().content_type("text/html").body( HttpResponse::Ok().content_type("text/html").body(
PasswordResetTemplate { PasswordResetTemplate {
p: BaseLoginPage { _p: BaseLoginPage {
page_title: "Password reset", page_title: "Password reset",
danger, danger,
success: None, success: None,
@ -309,9 +289,8 @@ pub async fn choose_2fa_method(
id: Option<Identity>, id: Option<Identity>,
query: web::Query<ChooseSecondFactorQuery>, query: web::Query<ChooseSecondFactorQuery>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
force2faauth: Force2FAAuth,
) -> impl Responder { ) -> impl Responder {
if !SessionIdentity(id.as_ref()).need_2fa_auth() && !force2faauth.force { if !SessionIdentity(id.as_ref()).need_2fa_auth() {
log::trace!("User does not require 2fa auth, redirecting"); log::trace!("User does not require 2fa auth, redirecting");
return redirect_user_for_login(query.redirect.get()); return redirect_user_for_login(query.redirect.get());
} }
@ -328,12 +307,12 @@ pub async fn choose_2fa_method(
// Automatically choose factor if there is only one factor // Automatically choose factor if there is only one factor
if user.get_distinct_factors_types().len() == 1 && !query.force_display { if user.get_distinct_factors_types().len() == 1 && !query.force_display {
log::trace!("User has only one factor, using it by default"); log::trace!("User has only one factor, using it by default");
return redirect_user(&user.two_factor[0].login_url(&query.redirect, true)); return redirect_user(&user.two_factor[0].login_url(&query.redirect));
} }
HttpResponse::Ok().content_type("text/html").body( HttpResponse::Ok().content_type("text/html").body(
ChooseSecondFactorTemplate { ChooseSecondFactorTemplate {
p: BaseLoginPage { _p: BaseLoginPage {
page_title: "Two factor authentication", page_title: "Two factor authentication",
danger: None, danger: None,
success: None, success: None,
@ -359,7 +338,6 @@ pub struct LoginWithOTPForm {
} }
/// Login with OTP /// Login with OTP
#[allow(clippy::too_many_arguments)]
pub async fn login_with_otp( pub async fn login_with_otp(
id: Option<Identity>, id: Option<Identity>,
query: web::Query<LoginWithOTPQuery>, query: web::Query<LoginWithOTPQuery>,
@ -368,11 +346,10 @@ pub async fn login_with_otp(
http_req: HttpRequest, http_req: HttpRequest,
remote_ip: RemoteIP, remote_ip: RemoteIP,
logger: ActionLogger, logger: ActionLogger,
force2faauth: Force2FAAuth,
) -> impl Responder { ) -> impl Responder {
let mut danger = None; let mut danger = None;
if !SessionIdentity(id.as_ref()).need_2fa_auth() && !force2faauth.force { if !SessionIdentity(id.as_ref()).need_2fa_auth() {
return redirect_user_for_login(query.redirect.get()); return redirect_user_for_login(query.redirect.get());
} }
@ -409,9 +386,7 @@ pub async fn login_with_otp(
.await .await
.unwrap(); .unwrap();
let session = SessionIdentity(id.as_ref()); SessionIdentity(id.as_ref()).set_status(&http_req, SessionStatus::SignedIn);
session.record_2fa_auth(&http_req);
session.set_status(&http_req, SessionStatus::SignedIn);
logger.log(Action::OTPLoginAttempt { logger.log(Action::OTPLoginAttempt {
success: true, success: true,
user: &user, user: &user,
@ -422,7 +397,7 @@ pub async fn login_with_otp(
HttpResponse::Ok().body( HttpResponse::Ok().body(
LoginWithOTPTemplate { LoginWithOTPTemplate {
p: BaseLoginPage { _p: BaseLoginPage {
danger, danger,
success: None, success: None,
page_title: "Two-Factor Auth", page_title: "Two-Factor Auth",
@ -447,9 +422,8 @@ pub async fn login_with_webauthn(
query: web::Query<LoginWithWebauthnQuery>, query: web::Query<LoginWithWebauthnQuery>,
manager: WebAuthManagerReq, manager: WebAuthManagerReq,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
force2faauth: Force2FAAuth,
) -> impl Responder { ) -> impl Responder {
if !SessionIdentity(id.as_ref()).need_2fa_auth() && !force2faauth.force { if !SessionIdentity(id.as_ref()).need_2fa_auth() {
return redirect_user_for_login(query.redirect.get()); return redirect_user_for_login(query.redirect.get());
} }
@ -488,7 +462,7 @@ pub async fn login_with_webauthn(
HttpResponse::Ok().body( HttpResponse::Ok().body(
LoginWithWebauthnTemplate { LoginWithWebauthnTemplate {
p: BaseLoginPage { _p: BaseLoginPage {
danger: None, danger: None,
success: None, success: None,
page_title: "Two-Factor Auth", page_title: "Two-Factor Auth",

View File

@ -5,7 +5,6 @@ pub mod base_controller;
pub mod login_api; pub mod login_api;
pub mod login_controller; pub mod login_controller;
pub mod openid_controller; pub mod openid_controller;
pub mod providers_controller;
pub mod settings_controller; pub mod settings_controller;
pub mod two_factor_api; pub mod two_factor_api;
pub mod two_factors_controller; pub mod two_factors_controller;

View File

@ -1,28 +1,24 @@
use std::fmt::Debug; use std::fmt::Debug;
use std::sync::Arc;
use actix::Addr; use actix::Addr;
use actix_identity::Identity; use actix_identity::Identity;
use actix_web::error::ErrorUnauthorized; use actix_web::error::ErrorUnauthorized;
use actix_web::{web, HttpRequest, HttpResponse, Responder}; use actix_web::{web, HttpRequest, HttpResponse, Responder};
use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
use base64::Engine as _;
use light_openid::primitives::{OpenIDConfig, OpenIDTokenResponse, OpenIDUserInfo};
use crate::actors::openid_sessions_actor::{OpenIDSessionsActor, Session, SessionID}; use crate::actors::openid_sessions_actor::{OpenIDSessionsActor, Session, SessionID};
use crate::actors::users_actor::UsersActor; use crate::actors::users_actor::UsersActor;
use crate::actors::{openid_sessions_actor, users_actor}; use crate::actors::{openid_sessions_actor, users_actor};
use crate::constants::*; use crate::constants::*;
use crate::controllers::base_controller::{build_fatal_error_page, redirect_user}; use crate::controllers::base_controller::build_fatal_error_page;
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::app_config::AppConfig; use crate::data::app_config::AppConfig;
use crate::data::client::{AdditionalClaims, AuthenticationFlow, ClientID, ClientManager}; use crate::data::client::{ClientID, ClientManager};
use crate::data::code_challenge::CodeChallenge; use crate::data::code_challenge::CodeChallenge;
use crate::data::current_user::CurrentUser; use crate::data::current_user::CurrentUser;
use crate::data::id_token::IdToken; use crate::data::id_token::IdToken;
use crate::data::jwt_signer::{JWTSigner, JsonWebKey}; use crate::data::jwt_signer::{JWTSigner, JsonWebKey};
use crate::data::login_redirect::{get_2fa_url, LoginRedirect}; use crate::data::open_id_user_info::OpenIDUserInfo;
use crate::data::openid_config::OpenIDConfig;
use crate::data::session_identity::SessionIdentity; use crate::data::session_identity::SessionIdentity;
use crate::data::user::User; use crate::data::user::User;
use crate::utils::string_utils::rand_str; use crate::utils::string_utils::rand_str;
@ -32,7 +28,6 @@ pub async fn get_configuration(req: HttpRequest) -> impl Responder {
let is_secure_request = req let is_secure_request = req
.headers() .headers()
.get("HTTP_X_FORWARDED_PROTO") .get("HTTP_X_FORWARDED_PROTO")
.or_else(|| req.headers().get("X-Forwarded-Proto"))
.map(|v| v.to_str().unwrap_or_default().to_lowercase().eq("https")) .map(|v| v.to_str().unwrap_or_default().to_lowercase().eq("https"))
.unwrap_or(false); .unwrap_or(false);
@ -54,32 +49,15 @@ pub async fn get_configuration(req: HttpRequest) -> impl Responder {
issuer: AppConfig::get().website_origin.clone(), issuer: AppConfig::get().website_origin.clone(),
authorization_endpoint: AppConfig::get().full_url(AUTHORIZE_URI), authorization_endpoint: AppConfig::get().full_url(AUTHORIZE_URI),
token_endpoint: curr_origin.clone() + TOKEN_URI, token_endpoint: curr_origin.clone() + TOKEN_URI,
userinfo_endpoint: Some(curr_origin.clone() + USERINFO_URI), userinfo_endpoint: curr_origin.clone() + USERINFO_URI,
jwks_uri: curr_origin + CERT_URI, jwks_uri: curr_origin + CERT_URI,
scopes_supported: Some(vec![ scopes_supported: vec!["openid", "profile", "email"],
"openid".to_string(), response_types_supported: vec!["code", "id_token", "token id_token"],
"profile".to_string(), subject_types_supported: vec!["public"],
"email".to_string(), id_token_signing_alg_values_supported: vec!["RS256"],
]), token_endpoint_auth_methods_supported: vec!["client_secret_post", "client_secret_basic"],
response_types_supported: vec![ claims_supported: vec!["sub", "name", "given_name", "family_name", "email"],
"code".to_string(), code_challenge_methods_supported: vec!["plain", "S256"],
"id_token".to_string(),
"token id_token".to_string(),
],
subject_types_supported: vec!["public".to_string()],
id_token_signing_alg_values_supported: vec!["RS256".to_string()],
token_endpoint_auth_methods_supported: Some(vec![
"client_secret_post".to_string(),
"client_secret_basic".to_string(),
]),
claims_supported: Some(vec![
"sub".to_string(),
"name".to_string(),
"given_name".to_string(),
"family_name".to_string(),
"email".to_string(),
]),
code_challenge_methods_supported: Some(vec!["plain".to_string(), "S256".to_string()]),
}) })
} }
@ -98,7 +76,7 @@ pub struct AuthorizeQuery {
redirect_uri: String, redirect_uri: String,
/// RECOMMENDED. Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie. /// RECOMMENDED. Opaque value used to maintain state between the request and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF) mitigation is done by cryptographically binding the value of this parameter with a browser cookie.
state: Option<String>, state: String,
/// OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values. /// OPTIONAL. String value used to associate a Client session with an ID Token, and to mitigate replay attacks. The value is passed through unmodified from the Authentication Request to the ID Token. Sufficient entropy MUST be present in the nonce values used to prevent attackers from guessing values.
nonce: Option<String>, nonce: Option<String>,
@ -119,78 +97,61 @@ fn error_redirect(query: &AuthorizeQuery, error: &str, description: &str) -> Htt
.append_header(( .append_header((
"Location", "Location",
format!( format!(
"{}?error={}?error_description={}{}", "{}?error={}?error_description={}&state={}",
query.redirect_uri, query.redirect_uri,
urlencoding::encode(error), urlencoding::encode(error),
urlencoding::encode(description), urlencoding::encode(description),
match &query.state { urlencoding::encode(&query.state)
Some(s) => format!("&state={}", urlencoding::encode(s)),
None => "".to_string(),
}
), ),
)) ))
.finish() .finish()
} }
#[allow(clippy::too_many_arguments)]
pub async fn authorize( pub async fn authorize(
req: HttpRequest,
user: CurrentUser, user: CurrentUser,
id: Identity, id: Identity,
query: web::Query<AuthorizeQuery>, query: web::Query<AuthorizeQuery>,
clients: web::Data<Arc<ClientManager>>, clients: web::Data<ClientManager>,
sessions: web::Data<Addr<OpenIDSessionsActor>>, sessions: web::Data<Addr<OpenIDSessionsActor>>,
logger: ActionLogger, logger: ActionLogger,
jwt_signer: web::Data<JWTSigner>, ) -> impl Responder {
) -> actix_web::Result<HttpResponse> {
let client = match clients.find_by_id(&query.client_id) { let client = match clients.find_by_id(&query.client_id) {
None => { None => {
return Ok( return HttpResponse::BadRequest().body(build_fatal_error_page("Client is invalid!"));
HttpResponse::BadRequest().body(build_fatal_error_page("Client is invalid!"))
);
} }
Some(c) => c, Some(c) => c,
}; };
// Check if 2FA is required
if client.enforce_2fa_auth && user.should_request_2fa_for_critical_functions() {
let uri = get_2fa_url(&LoginRedirect::from_req(&req), true);
return Ok(redirect_user(&uri));
}
// Validate specified redirect URI
let redirect_uri = query.redirect_uri.trim().to_string(); let redirect_uri = query.redirect_uri.trim().to_string();
if !redirect_uri.starts_with(&client.redirect_uri) { if !redirect_uri.starts_with(&client.redirect_uri) {
return Ok( return HttpResponse::BadRequest().body(build_fatal_error_page("Redirect URI is invalid!"));
HttpResponse::BadRequest().body(build_fatal_error_page("Redirect URI is invalid!"))
);
} }
if !query.scope.split(' ').any(|x| x == "openid") { if !query.scope.split(' ').any(|x| x == "openid") {
return Ok(error_redirect( return error_redirect(&query, "invalid_request", "openid scope missing!");
&query,
"invalid_request",
"openid scope missing!",
));
} }
if query.state.as_ref().map(String::is_empty).unwrap_or(false) { if !query.response_type.eq("code") {
return Ok(error_redirect( return error_redirect(
&query, &query,
"invalid_request", "invalid_request",
"State is specified but empty!", "Only code response type is supported!",
)); );
}
if query.state.is_empty() {
return error_redirect(&query, "invalid_request", "State is empty!");
} }
let code_challenge = match query.0.code_challenge.clone() { let code_challenge = match query.0.code_challenge.clone() {
Some(chal) => { Some(chal) => {
let meth = query.0.code_challenge_method.as_deref().unwrap_or("plain"); let meth = query.0.code_challenge_method.as_deref().unwrap_or("plain");
if !meth.eq("S256") && !meth.eq("plain") { if !meth.eq("S256") && !meth.eq("plain") {
return Ok(error_redirect( return error_redirect(
&query, &query,
"invalid_request", "invalid_request",
"Only S256 and plain code challenge methods are supported!", "Only S256 and plain code challenge methods are supported!",
)); );
} }
Some(CodeChallenge { Some(CodeChallenge {
code_challenge: chal, code_challenge: chal,
@ -201,25 +162,14 @@ pub async fn authorize(
}; };
// Check if user is authorized to access the application // Check if user is authorized to access the application
if !user.can_access_app(&client) { if !user.can_access_app(&client.id) {
return Ok(error_redirect( return error_redirect(
&query, &query,
"invalid_request", "invalid_request",
"User is not authorized to access this application!", "User is not authorized to access this application!",
)); );
} }
// Check that requested authorization flow is supported
if query.response_type != "code" && query.response_type != "id_token" {
return Ok(error_redirect(
&query,
"invalid_request",
"Unsupported authorization flow!",
));
}
match (client.auth_flow(), query.response_type.as_str()) {
(AuthenticationFlow::AuthorizationCode, "code") => {
// Save all authentication information in memory // Save all authentication information in memory
let session = Session { let session = Session {
session_id: SessionID(rand_str(OPEN_ID_SESSION_LEN)), session_id: SessionID(rand_str(OPEN_ID_SESSION_LEN)),
@ -244,69 +194,18 @@ pub async fn authorize(
log::trace!("New OpenID session: {:#?}", session); log::trace!("New OpenID session: {:#?}", session);
logger.log(Action::NewOpenIDSession { client: &client }); logger.log(Action::NewOpenIDSession { client: &client });
Ok(HttpResponse::Found() HttpResponse::Found()
.append_header(( .append_header((
"Location", "Location",
format!( format!(
"{}?{}session_state={}&code={}", "{}?state={}&session_state={}&code={}",
session.redirect_uri, session.redirect_uri,
match &query.0.state { urlencoding::encode(&query.0.state),
Some(state) => format!("state={}&", urlencoding::encode(state)),
None => "".to_string(),
},
urlencoding::encode(&session.session_id.0), urlencoding::encode(&session.session_id.0),
urlencoding::encode(&session.authorization_code) urlencoding::encode(&session.authorization_code)
), ),
)) ))
.finish()) .finish()
}
(AuthenticationFlow::Implicit, "id_token") => {
let id_token = IdToken {
issuer: AppConfig::get().website_origin.to_string(),
subject_identifier: user.uid.0.clone(),
audience: client.id.0.to_string(),
expiration_time: time() + OPEN_ID_ID_TOKEN_TIMEOUT,
issued_at: time(),
auth_time: SessionIdentity(Some(&id)).auth_time(),
nonce: query.nonce.clone(),
email: user.email.clone(),
additional_claims: client.claims_id_token(&user),
};
log::trace!("New OpenID id token: {:#?}", &id_token);
logger.log(Action::NewOpenIDSuccessfulImplicitAuth { client: &client });
Ok(HttpResponse::Found()
.append_header((
"Location",
format!(
"{}?{}token_type=bearer&id_token={}&expires_in={OPEN_ID_ID_TOKEN_TIMEOUT}",
client.redirect_uri,
match &query.0.state {
Some(state) => format!("state={}&", urlencoding::encode(state)),
None => "".to_string(),
},
jwt_signer.sign_token(id_token.to_jwt_claims())?
),
))
.finish())
}
(flow, code) => {
log::warn!(
"For client {:?}, configured with flow {:?}, made request with code {}",
client.id,
flow,
code
);
Ok(error_redirect(
&query,
"invalid_request",
"Requested authentication flow is unsupported / not configured for this client!",
))
}
}
} }
#[derive(serde::Serialize)] #[derive(serde::Serialize)]
@ -353,10 +252,20 @@ pub struct TokenQuery {
refresh_token_query: Option<TokenRefreshTokenQuery>, refresh_token_query: Option<TokenRefreshTokenQuery>,
} }
#[derive(Debug, serde::Serialize)]
pub struct TokenResponse {
access_token: String,
token_type: &'static str,
refresh_token: String,
expires_in: u64,
#[serde(skip_serializing_if = "Option::is_none")]
id_token: Option<String>,
}
pub async fn token( pub async fn token(
req: HttpRequest, req: HttpRequest,
query: web::Form<TokenQuery>, query: web::Form<TokenQuery>,
clients: web::Data<Arc<ClientManager>>, clients: web::Data<ClientManager>,
sessions: web::Data<Addr<OpenIDSessionsActor>>, sessions: web::Data<Addr<OpenIDSessionsActor>>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
jwt_signer: web::Data<JWTSigner>, jwt_signer: web::Data<JWTSigner>,
@ -371,21 +280,22 @@ pub async fn token(
} }
// Basic authentication // Basic authentication
(_, None, Some(v)) => { (None, None, Some(v)) => {
let token = match v.to_str().unwrap_or_default().strip_prefix("Basic ") { let token = match v.to_str().unwrap_or_default().strip_prefix("Basic ") {
None => { None => {
return Ok(error_response( return Ok(error_response(
&query, &query,
"invalid_request", "invalid_request",
&format!( &format!(
"Authorization header does not start with 'Basic ', got '{v:#?}'" "Authorization header does not start with 'Basic ', got '{:#?}'",
v
), ),
)); ));
} }
Some(v) => v, Some(v) => v,
}; };
let decode = String::from_utf8_lossy(&match BASE64_STANDARD.decode(token) { let decode = String::from_utf8_lossy(&match base64::decode(token) {
Ok(d) => d, Ok(d) => d,
Err(e) => { Err(e) => {
log::error!("Failed to decode authorization header: {:?}", e); log::error!("Failed to decode authorization header: {:?}", e);
@ -408,7 +318,7 @@ pub async fn token(
return Ok(error_response( return Ok(error_response(
&query, &query,
"invalid_request", "invalid_request",
"Client authentication method on token endpoint unsupported!", "Authentication method unknown!",
)); ));
} }
}; };
@ -417,8 +327,7 @@ pub async fn token(
.find_by_id(&client_id) .find_by_id(&client_id)
.ok_or_else(|| ErrorUnauthorized("Client not found"))?; .ok_or_else(|| ErrorUnauthorized("Client not found"))?;
// Retrieving token requires the client to have a defined secret if !client.secret.eq(&client_secret) {
if client.secret != Some(client_secret) {
return Ok(error_response( return Ok(error_response(
&query, &query,
"invalid_request", "invalid_request",
@ -535,15 +444,14 @@ pub async fn token(
issued_at: time(), issued_at: time(),
auth_time: session.auth_time, auth_time: session.auth_time,
nonce: session.nonce, nonce: session.nonce,
email: user.email.to_string(), email: user.email,
additional_claims: client.claims_id_token(&user),
}; };
OpenIDTokenResponse { TokenResponse {
access_token: session.access_token.expect("Missing access token!"), access_token: session.access_token.expect("Missing access token!"),
token_type: "Bearer".to_string(), token_type: "Bearer",
refresh_token: Some(session.refresh_token), refresh_token: session.refresh_token,
expires_in: Some(session.access_token_expire_at - time()), expires_in: session.access_token_expire_at - time(),
id_token: Some(jwt_signer.sign_token(id_token.to_jwt_claims())?), id_token: Some(jwt_signer.sign_token(id_token.to_jwt_claims())?),
} }
} }
@ -589,11 +497,11 @@ pub async fn token(
.await .await
.unwrap(); .unwrap();
OpenIDTokenResponse { TokenResponse {
access_token: session.access_token.expect("Missing access token!"), access_token: session.access_token.expect("Missing access token!"),
token_type: "Bearer".to_string(), token_type: "Bearer",
refresh_token: Some(session.refresh_token), refresh_token: session.refresh_token,
expires_in: Some(session.access_token_expire_at - time()), expires_in: session.access_token_expire_at - time(),
id_token: None, id_token: None,
} }
} }
@ -628,7 +536,10 @@ fn user_info_error(err: &str, description: &str) -> HttpResponse {
HttpResponse::Unauthorized() HttpResponse::Unauthorized()
.insert_header(( .insert_header((
"WWW-Authenticate", "WWW-Authenticate",
format!("Bearer error=\"{err}\", error_description=\"{description}\""), format!(
"Bearer error=\"{}\", error_description=\"{}\"",
err, description
),
)) ))
.finish() .finish()
} }
@ -644,7 +555,6 @@ pub async fn user_info_post(
query: web::Query<UserInfoQuery>, query: web::Query<UserInfoQuery>,
sessions: web::Data<Addr<OpenIDSessionsActor>>, sessions: web::Data<Addr<OpenIDSessionsActor>>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
clients: web::Data<Arc<ClientManager>>,
) -> impl Responder { ) -> impl Responder {
user_info( user_info(
req, req,
@ -653,7 +563,6 @@ pub async fn user_info_post(
.or(query.0.access_token), .or(query.0.access_token),
sessions, sessions,
users, users,
clients,
) )
.await .await
} }
@ -663,18 +572,8 @@ pub async fn user_info_get(
query: web::Query<UserInfoQuery>, query: web::Query<UserInfoQuery>,
sessions: web::Data<Addr<OpenIDSessionsActor>>, sessions: web::Data<Addr<OpenIDSessionsActor>>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
clients: web::Data<Arc<ClientManager>>,
) -> impl Responder { ) -> impl Responder {
user_info(req, query.0.access_token, sessions, users, clients).await user_info(req, query.0.access_token, sessions, users).await
}
#[derive(serde::Serialize)]
pub struct UserInfoWithCustomClaims {
#[serde(flatten)]
info: OpenIDUserInfo,
#[serde(skip_serializing_if = "Option::is_none")]
#[serde(flatten)]
additional_claims: Option<AdditionalClaims>,
} }
/// Authenticate request using RFC6750 <https://datatracker.ietf.org/doc/html/rfc6750>/// /// Authenticate request using RFC6750 <https://datatracker.ietf.org/doc/html/rfc6750>///
@ -683,7 +582,6 @@ async fn user_info(
token: Option<String>, token: Option<String>,
sessions: web::Data<Addr<OpenIDSessionsActor>>, sessions: web::Data<Addr<OpenIDSessionsActor>>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
clients: web::Data<Arc<ClientManager>>,
) -> impl Responder { ) -> impl Responder {
let token = match token { let token = match token {
Some(t) => t, Some(t) => t,
@ -703,7 +601,7 @@ async fn user_info(
return user_info_error( return user_info_error(
"invalid_request", "invalid_request",
"Header token does not start with 'Bearer '!", "Header token does not start with 'Bearer '!",
); )
} }
Some(t) => t, Some(t) => t,
}; };
@ -727,10 +625,6 @@ async fn user_info(
return user_info_error("invalid_request", "Access token has expired!"); return user_info_error("invalid_request", "Access token has expired!");
} }
let client = clients
.find_by_id(&session.client)
.expect("Could not extract client information!");
let user: Option<User> = users let user: Option<User> = users
.send(users_actor::GetUserRequest(session.user)) .send(users_actor::GetUserRequest(session.user))
.await .await
@ -743,16 +637,13 @@ async fn user_info(
Some(u) => u, Some(u) => u,
}; };
HttpResponse::Ok().json(UserInfoWithCustomClaims { HttpResponse::Ok().json(OpenIDUserInfo {
info: OpenIDUserInfo { name: user.full_name(),
name: Some(user.full_name()), sub: user.uid.0,
sub: user.uid.0.to_string(), given_name: user.first_name,
given_name: Some(user.first_name.to_string()), family_name: user.last_name,
family_name: Some(user.last_name.to_string()), preferred_username: user.username,
preferred_username: Some(user.username.to_string()), email: user.email,
email: Some(user.email.to_string()), email_verified: true,
email_verified: Some(true),
},
additional_claims: client.claims_user_info(&user),
}) })
} }

View File

@ -1,373 +0,0 @@
use std::sync::Arc;
use actix::Addr;
use actix_identity::Identity;
use actix_remote_ip::RemoteIP;
use actix_web::{web, HttpRequest, HttpResponse, Responder};
use askama::Template;
use crate::actors::bruteforce_actor::BruteForceActor;
use crate::actors::providers_states_actor::{ProviderLoginState, ProvidersStatesActor};
use crate::actors::users_actor::{LoginResult, UsersActor};
use crate::actors::{bruteforce_actor, providers_states_actor, users_actor};
use crate::constants::{APP_NAME, MAX_FAILED_LOGIN_ATTEMPTS};
use crate::controllers::base_controller::{build_fatal_error_page, redirect_user};
use crate::controllers::login_controller::BaseLoginPage;
use crate::data::action_logger::{Action, ActionLogger};
use crate::data::login_redirect::LoginRedirect;
use crate::data::provider::{ProviderID, ProvidersManager};
use crate::data::provider_configuration::ProviderConfigurationHelper;
use crate::data::session_identity::{SessionIdentity, SessionStatus};
#[derive(askama::Template)]
#[template(path = "login/prov_login_error.html")]
struct ProviderLoginError<'a> {
p: BaseLoginPage<'a>,
message: &'a str,
}
impl<'a> ProviderLoginError<'a> {
pub fn get(message: &'a str, redirect_uri: &'a LoginRedirect) -> HttpResponse {
let body = Self {
p: BaseLoginPage {
danger: None,
success: None,
page_title: "Upstream login",
app_name: APP_NAME,
redirect_uri,
},
message,
}
.render()
.unwrap();
HttpResponse::Unauthorized()
.content_type("text/html")
.body(body)
}
}
#[derive(serde::Deserialize)]
pub struct StartLoginQuery {
#[serde(default)]
redirect: LoginRedirect,
id: ProviderID,
}
/// Start user authentication using a provider
pub async fn start_login(
remote_ip: RemoteIP,
providers: web::Data<Arc<ProvidersManager>>,
states: web::Data<Addr<ProvidersStatesActor>>,
query: web::Query<StartLoginQuery>,
logger: ActionLogger,
id: Option<Identity>,
) -> impl Responder {
// Check if user is already authenticated
if SessionIdentity(id.as_ref()).is_authenticated() {
return redirect_user(query.redirect.get());
}
// Get provider information
let provider = match providers.find_by_id(&query.id) {
None => {
return HttpResponse::NotFound()
.body(build_fatal_error_page("Login provider not found!"));
}
Some(p) => p,
};
// Generate & save state
let state = ProviderLoginState::new(&provider.id, query.redirect.clone());
states
.send(providers_states_actor::RecordState {
ip: remote_ip.0,
state: state.clone(),
})
.await
.unwrap();
logger.log(Action::StartLoginAttemptWithOpenIDProvider {
provider_id: &provider.id,
state: &state.state_id,
});
// Get provider configuration
let config = match ProviderConfigurationHelper::get_configuration(&provider).await {
Ok(c) => c,
Err(e) => {
log::error!("Failed to load provider configuration! {}", e);
return HttpResponse::InternalServerError().body(build_fatal_error_page(
"Failed to load provider configuration!",
));
}
};
log::debug!("Provider configuration: {:?}", config);
let url = config.auth_url(&provider, &state);
log::debug!("Redirect user on {url} for authentication",);
// Redirect user
redirect_user(&url)
}
#[derive(serde::Deserialize)]
pub struct FinishLoginSuccess {
code: String,
state: String,
}
#[derive(serde::Deserialize)]
pub struct FinishLoginError {
error: String,
error_description: Option<String>,
}
#[derive(serde::Deserialize)]
pub struct FinishLoginQuery {
#[serde(flatten)]
success: Option<FinishLoginSuccess>,
#[serde(flatten)]
error: Option<FinishLoginError>,
}
/// Finish user authentication using a provider
#[allow(clippy::too_many_arguments)]
pub async fn finish_login(
remote_ip: RemoteIP,
providers: web::Data<Arc<ProvidersManager>>,
users: web::Data<Addr<UsersActor>>,
states: web::Data<Addr<ProvidersStatesActor>>,
bruteforce: web::Data<Addr<BruteForceActor>>,
query: web::Query<FinishLoginQuery>,
logger: ActionLogger,
id: Option<Identity>,
http_req: HttpRequest,
) -> impl Responder {
// Check if user is already authenticated
if SessionIdentity(id.as_ref()).is_authenticated() {
return redirect_user("/");
}
let query = match query.0.success {
Some(q) => q,
None => {
let error_message = query
.0
.error
.map(|e| e.error_description.unwrap_or(e.error))
.unwrap_or("Authentication failed (unspecified error)!".to_string());
logger.log(Action::ProviderError {
message: error_message.as_str(),
});
return ProviderLoginError::get(&error_message, &LoginRedirect::default());
}
};
// Get & consume state
let state = states
.send(providers_states_actor::ConsumeState {
ip: remote_ip.0,
state_id: query.state.clone(),
})
.await
.unwrap();
let state = match state {
Some(s) => s,
None => {
logger.log(Action::ProviderCBInvalidState {
state: query.state.as_str(),
});
log::warn!("User returned invalid state!");
return ProviderLoginError::get("Invalid state!", &LoginRedirect::default());
}
};
// We perform rate limiting before attempting to use authorization code
let failed_attempts = bruteforce
.send(bruteforce_actor::CountFailedAttempt {
ip: remote_ip.into(),
})
.await
.unwrap();
if failed_attempts > MAX_FAILED_LOGIN_ATTEMPTS {
logger.log(Action::ProviderRateLimited);
return HttpResponse::TooManyRequests().body(build_fatal_error_page(
"Too many failed login attempts, please try again later!",
));
}
// Retrieve provider information & configuration
let provider = providers
.find_by_id(&state.provider_id)
.expect("Unable to retrieve provider information!");
let provider_config = match ProviderConfigurationHelper::get_configuration(&provider).await {
Ok(c) => c,
Err(e) => {
log::error!("Failed to load provider configuration! {}", e);
return HttpResponse::InternalServerError().body(build_fatal_error_page(
"Failed to load provider configuration!",
));
}
};
// Get access token & user information
let token = provider_config.get_token(&provider, &query.code).await;
let token = match token {
Ok(t) => t,
Err(e) => {
log::error!("Failed to retrieve login token! {:?}", e);
bruteforce
.send(bruteforce_actor::RecordFailedAttempt {
ip: remote_ip.into(),
})
.await
.unwrap();
logger.log(Action::ProviderFailedGetToken {
state: &state,
code: query.code.as_str(),
});
return ProviderLoginError::get(
"Failed to retrieve login token from identity provider!",
&state.redirect,
);
}
};
// Use access token to get user information
let user_info = match provider_config.get_userinfo(&token).await {
Ok(info) => info,
Err(e) => {
log::error!("Failed to retrieve user information! {:?}", e);
logger.log(Action::ProviderFailedGetUserInfo {
provider: &provider,
});
return ProviderLoginError::get(
"Failed to retrieve user information from identity provider!",
&state.redirect,
);
}
};
// Check if user email is validated
if user_info.email_verified == Some(false) {
logger.log(Action::ProviderEmailNotValidated {
provider: &provider,
});
return ProviderLoginError::get(
&format!(
"{} indicated that your email address has not been validated!",
provider.name
),
&state.redirect,
);
}
// Check if email was provided by the userinfo endpoint
let email = match user_info.email {
Some(e) => e,
None => {
logger.log(Action::ProviderMissingEmailInResponse {
provider: &provider,
});
return ProviderLoginError::get(
&format!(
"{} did not provide your email address in its reply, so we could not identify you!",
provider.name
),
&state.redirect,
);
}
};
// Get user from local database
let result: LoginResult = users
.send(users_actor::ProviderLoginRequest {
email: email.clone(),
provider: provider.clone(),
})
.await
.unwrap();
let user = match result {
LoginResult::Success(u) => u,
LoginResult::AccountNotFound => {
logger.log(Action::ProviderAccountNotFound {
provider: &provider,
email: email.as_str(),
});
return ProviderLoginError::get(
&format!("The email address {email} was not found in the database!"),
&state.redirect,
);
}
LoginResult::AccountDisabled => {
logger.log(Action::ProviderAccountDisabled {
provider: &provider,
email: email.as_str(),
});
return ProviderLoginError::get(
&format!("The account associated with the email address {email} is disabled!"),
&state.redirect,
);
}
LoginResult::AuthFromProviderForbidden => {
logger.log(Action::ProviderAccountNotAllowedToLoginWithProvider {
provider: &provider,
email: email.as_str(),
});
return ProviderLoginError::get(
&format!(
"The account associated with the email address {email} is not allowed to sign in using this provider!"
),
&state.redirect,
);
}
c => {
log::error!(
"Login from provider {} failed with error {:?}",
provider.id.0,
c
);
logger.log(Action::ProviderLoginFailed {
provider: &provider,
email: email.as_str(),
});
return ProviderLoginError::get("Failed to complete login!", &state.redirect);
}
};
logger.log(Action::ProviderLoginSuccessful {
provider: &provider,
user: &user,
});
let status = if user.has_two_factor() && !user.can_bypass_two_factors_for_ip(remote_ip.0) {
logger.log(Action::UserNeed2FAOnLogin(&user));
SessionStatus::Need2FA
} else {
logger.log(Action::UserSuccessfullyAuthenticated(&user));
SessionStatus::SignedIn
};
SessionIdentity(id.as_ref()).set_user(&http_req, &user, status);
redirect_user(&format!("/login?redirect={}", state.redirect.get_encoded()))
}

View File

@ -1,5 +1,4 @@
use actix::Addr; use actix::Addr;
use actix_remote_ip::RemoteIP;
use actix_web::{web, HttpResponse, Responder}; use actix_web::{web, HttpResponse, Responder};
use askama::Template; use askama::Template;
@ -10,32 +9,34 @@ use crate::constants::{APP_NAME, MAX_FAILED_LOGIN_ATTEMPTS, MIN_PASS_LEN};
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::app_config::AppConfig; use crate::data::app_config::AppConfig;
use crate::data::current_user::CurrentUser; use crate::data::current_user::CurrentUser;
use crate::data::remote_ip::RemoteIP;
use crate::data::user::User; use crate::data::user::User;
pub(crate) struct BaseSettingsPage<'a> { pub(crate) struct BaseSettingsPage {
pub danger_message: Option<String>, pub danger_message: Option<String>,
pub success_message: Option<String>, pub success_message: Option<String>,
pub page_title: &'static str, pub page_title: &'static str,
pub app_name: &'static str, pub app_name: &'static str,
pub user: &'a User, pub is_admin: bool,
pub user_name: String,
pub version: &'static str, pub version: &'static str,
pub ip_location_api: Option<&'static str>, pub ip_location_api: Option<&'static str>,
} }
impl<'a> BaseSettingsPage<'a> { impl BaseSettingsPage {
pub fn get( pub fn get(
page_title: &'static str, page_title: &'static str,
user: &'a User, user: &User,
danger_message: Option<String>, danger_message: Option<String>,
success_message: Option<String>, success_message: Option<String>,
) -> BaseSettingsPage<'a> { ) -> BaseSettingsPage {
Self { Self {
danger_message, danger_message,
success_message, success_message,
page_title, page_title,
app_name: APP_NAME, app_name: APP_NAME,
user, is_admin: user.admin,
user_name: user.username.to_string(),
version: env!("CARGO_PKG_VERSION"), version: env!("CARGO_PKG_VERSION"),
ip_location_api: AppConfig::get().ip_location_service.as_deref(), ip_location_api: AppConfig::get().ip_location_service.as_deref(),
} }
@ -44,25 +45,25 @@ impl<'a> BaseSettingsPage<'a> {
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/account_details.html")] #[template(path = "settings/account_details.html")]
struct AccountDetailsPage<'a> { struct AccountDetailsPage {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
remote_ip: String, u: User,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/change_password.html")] #[template(path = "settings/change_password.html")]
struct ChangePasswordPage<'a> { struct ChangePasswordPage {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
min_pwd_len: usize, min_pwd_len: usize,
} }
/// Account details page /// Account details page
pub async fn account_settings_details_route(user: CurrentUser, ip: RemoteIP) -> impl Responder { pub async fn account_settings_details_route(user: CurrentUser) -> impl Responder {
let user = user.into(); let user = user.into();
HttpResponse::Ok().body( HttpResponse::Ok().body(
AccountDetailsPage { AccountDetailsPage {
p: BaseSettingsPage::get("Account details", &user, None, None), _p: BaseSettingsPage::get("Account details", &user, None, None),
remote_ip: ip.0.to_string(), u: user,
} }
.render() .render()
.unwrap(), .unwrap(),
@ -145,7 +146,7 @@ pub async fn change_password_route(
HttpResponse::Ok().body( HttpResponse::Ok().body(
ChangePasswordPage { ChangePasswordPage {
p: BaseSettingsPage::get("Change password", &user, danger, success), _p: BaseSettingsPage::get("Change password", &user, danger, success),
min_pwd_len: MIN_PASS_LEN, min_pwd_len: MIN_PASS_LEN,
} }
.render() .render()

View File

@ -7,7 +7,6 @@ use crate::actors::users_actor;
use crate::actors::users_actor::UsersActor; use crate::actors::users_actor::UsersActor;
use crate::constants::MAX_SECOND_FACTOR_NAME_LEN; use crate::constants::MAX_SECOND_FACTOR_NAME_LEN;
use crate::data::action_logger::{Action, ActionLogger}; use crate::data::action_logger::{Action, ActionLogger};
use crate::data::critical_route::CriticalRoute;
use crate::data::current_user::CurrentUser; use crate::data::current_user::CurrentUser;
use crate::data::totp_key::TotpKey; use crate::data::totp_key::TotpKey;
use crate::data::user::{FactorID, TwoFactor, TwoFactorType}; use crate::data::user::{FactorID, TwoFactor, TwoFactorType};
@ -30,7 +29,6 @@ pub struct AddTOTPRequest {
} }
pub async fn save_totp_factor( pub async fn save_totp_factor(
_critical: CriticalRoute,
user: CurrentUser, user: CurrentUser,
form: web::Json<AddTOTPRequest>, form: web::Json<AddTOTPRequest>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
@ -40,10 +38,9 @@ pub async fn save_totp_factor(
if !key.check_code(&form.first_code).unwrap_or(false) { if !key.check_code(&form.first_code).unwrap_or(false) {
return HttpResponse::BadRequest().body(format!( return HttpResponse::BadRequest().body(format!(
"Given code is invalid (expected {}, {} or {})!", "Given code is invalid (expected {} or {})!",
key.previous_code().unwrap_or_default(),
key.current_code().unwrap_or_default(), key.current_code().unwrap_or_default(),
key.following_code().unwrap_or_default(), key.previous_code().unwrap_or_default()
)); ));
} }
@ -79,7 +76,6 @@ pub struct AddWebauthnRequest {
} }
pub async fn save_webauthn_factor( pub async fn save_webauthn_factor(
_critical: CriticalRoute,
user: CurrentUser, user: CurrentUser,
form: web::Json<AddWebauthnRequest>, form: web::Json<AddWebauthnRequest>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
@ -124,7 +120,6 @@ pub struct DeleteFactorRequest {
} }
pub async fn delete_factor( pub async fn delete_factor(
_critical: CriticalRoute,
user: CurrentUser, user: CurrentUser,
form: web::Json<DeleteFactorRequest>, form: web::Json<DeleteFactorRequest>,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
@ -149,7 +144,6 @@ pub async fn delete_factor(
} }
pub async fn clear_login_history( pub async fn clear_login_history(
_critical: CriticalRoute,
user: CurrentUser, user: CurrentUser,
users: web::Data<Addr<UsersActor>>, users: web::Data<Addr<UsersActor>>,
logger: ActionLogger, logger: ActionLogger,

View File

@ -1,33 +1,28 @@
use std::ops::Deref; use std::ops::Deref;
use crate::constants::MAX_SECOND_FACTOR_NAME_LEN;
use actix_web::{HttpResponse, Responder}; use actix_web::{HttpResponse, Responder};
use askama::Template; use askama::Template;
use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
use base64::Engine as _;
use qrcode_generator::QrCodeEcc; use qrcode_generator::QrCodeEcc;
use crate::constants::MAX_SECOND_FACTOR_NAME_LEN;
use crate::controllers::settings_controller::BaseSettingsPage; use crate::controllers::settings_controller::BaseSettingsPage;
use crate::data::app_config::AppConfig; use crate::data::app_config::AppConfig;
use crate::data::critical_route::CriticalRoute;
use crate::data::current_user::CurrentUser; use crate::data::current_user::CurrentUser;
use crate::data::totp_key::TotpKey; use crate::data::totp_key::TotpKey;
use crate::data::user::User; use crate::data::user::User;
use crate::data::webauthn_manager::WebAuthManagerReq; use crate::data::webauthn_manager::WebAuthManagerReq;
use crate::utils::time::fmt_time;
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/two_factors_page.html")] #[template(path = "settings/two_factors_page.html")]
struct TwoFactorsPage<'a> { struct TwoFactorsPage<'a> {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
user: &'a User, user: &'a User,
last_2fa_auth: Option<String>,
} }
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/add_2fa_totp_page.html")] #[template(path = "settings/add_2fa_totp_page.html")]
struct AddTotpPage<'a> { struct AddTotpPage {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
qr_code: String, qr_code: String,
account_name: String, account_name: String,
secret_key: String, secret_key: String,
@ -36,20 +31,19 @@ struct AddTotpPage<'a> {
#[derive(Template)] #[derive(Template)]
#[template(path = "settings/add_webauthn_page.html")] #[template(path = "settings/add_webauthn_page.html")]
struct AddWebauhtnPage<'a> { struct AddWebauhtnPage {
p: BaseSettingsPage<'a>, _p: BaseSettingsPage,
opaque_state: String, opaque_state: String,
challenge_json: String, challenge_json: String,
max_name_len: usize, max_name_len: usize,
} }
/// Manage two factors authentication methods route /// Manage two factors authentication methods route
pub async fn two_factors_route(_critical: CriticalRoute, user: CurrentUser) -> impl Responder { pub async fn two_factors_route(user: CurrentUser) -> impl Responder {
HttpResponse::Ok().body( HttpResponse::Ok().body(
TwoFactorsPage { TwoFactorsPage {
p: BaseSettingsPage::get("Two factor auth", &user, None, None), _p: BaseSettingsPage::get("Two factor auth", &user, None, None),
user: user.deref(), user: user.deref(),
last_2fa_auth: user.last_2fa_auth.map(fmt_time),
} }
.render() .render()
.unwrap(), .unwrap(),
@ -57,7 +51,7 @@ pub async fn two_factors_route(_critical: CriticalRoute, user: CurrentUser) -> i
} }
/// Configure a new TOTP authentication factor /// Configure a new TOTP authentication factor
pub async fn add_totp_factor_route(_critical: CriticalRoute, user: CurrentUser) -> impl Responder { pub async fn add_totp_factor_route(user: CurrentUser) -> impl Responder {
let key = TotpKey::new_random(); let key = TotpKey::new_random();
let qr_code = qrcode_generator::to_png_to_vec( let qr_code = qrcode_generator::to_png_to_vec(
@ -75,8 +69,8 @@ pub async fn add_totp_factor_route(_critical: CriticalRoute, user: CurrentUser)
HttpResponse::Ok().body( HttpResponse::Ok().body(
AddTotpPage { AddTotpPage {
p: BaseSettingsPage::get("New authenticator app", &user, None, None), _p: BaseSettingsPage::get("New authenticator app", &user, None, None),
qr_code: BASE64_STANDARD.encode(qr_code), qr_code: base64::encode(qr_code),
account_name: key.account_name(&user, AppConfig::get()), account_name: key.account_name(&user, AppConfig::get()),
secret_key: key.get_secret(), secret_key: key.get_secret(),
max_name_len: MAX_SECOND_FACTOR_NAME_LEN, max_name_len: MAX_SECOND_FACTOR_NAME_LEN,
@ -88,7 +82,6 @@ pub async fn add_totp_factor_route(_critical: CriticalRoute, user: CurrentUser)
/// Configure a new security key factor /// Configure a new security key factor
pub async fn add_webauthn_factor_route( pub async fn add_webauthn_factor_route(
_critical: CriticalRoute,
user: CurrentUser, user: CurrentUser,
manager: WebAuthManagerReq, manager: WebAuthManagerReq,
) -> impl Responder { ) -> impl Responder {
@ -111,7 +104,7 @@ pub async fn add_webauthn_factor_route(
HttpResponse::Ok().body( HttpResponse::Ok().body(
AddWebauhtnPage { AddWebauhtnPage {
p: BaseSettingsPage::get("New security key", &user, None, None), _p: BaseSettingsPage::get("New security key", &user, None, None),
opaque_state: registration_request.opaque_state, opaque_state: registration_request.opaque_state,
challenge_json: urlencoding::encode(&challenge_json).to_string(), challenge_json: urlencoding::encode(&challenge_json).to_string(),

View File

@ -4,16 +4,13 @@ use std::pin::Pin;
use actix::Addr; use actix::Addr;
use actix_identity::Identity; use actix_identity::Identity;
use actix_remote_ip::RemoteIP;
use actix_web::dev::Payload; use actix_web::dev::Payload;
use actix_web::{web, Error, FromRequest, HttpRequest}; use actix_web::{web, Error, FromRequest, HttpRequest};
use crate::actors::providers_states_actor::ProviderLoginState;
use crate::actors::users_actor; use crate::actors::users_actor;
use crate::actors::users_actor::{AuthorizedAuthenticationSources, UsersActor}; use crate::actors::users_actor::UsersActor;
use crate::data::client::Client; use crate::data::client::Client;
use crate::data::provider::{Provider, ProviderID}; use crate::data::remote_ip::RemoteIP;
use crate::data::session_identity::SessionIdentity; use crate::data::session_identity::SessionIdentity;
use crate::data::user::{FactorID, GrantedClients, TwoFactor, User, UserID}; use crate::data::user::{FactorID, GrantedClients, TwoFactor, User, UserID};
@ -23,82 +20,22 @@ pub enum Action<'a> {
AdminDeleteUser(&'a User), AdminDeleteUser(&'a User),
AdminResetUserPassword(&'a User), AdminResetUserPassword(&'a User),
AdminRemoveUserFactor(&'a User, &'a TwoFactor), AdminRemoveUserFactor(&'a User, &'a TwoFactor),
AdminSetAuthorizedAuthenticationSources(&'a User, &'a AuthorizedAuthenticationSources),
AdminSetNewGrantedClientsList(&'a User, &'a GrantedClients), AdminSetNewGrantedClientsList(&'a User, &'a GrantedClients),
AdminClear2FAHistory(&'a User), AdminClear2FAHistory(&'a User),
LoginWebauthnAttempt { LoginWebauthnAttempt { success: bool, user_id: UserID },
success: bool,
user_id: UserID,
},
StartLoginAttemptWithOpenIDProvider {
provider_id: &'a ProviderID,
state: &'a str,
},
ProviderError {
message: &'a str,
},
ProviderCBInvalidState {
state: &'a str,
},
ProviderRateLimited,
ProviderFailedGetToken {
state: &'a ProviderLoginState,
code: &'a str,
},
ProviderFailedGetUserInfo {
provider: &'a Provider,
},
ProviderEmailNotValidated {
provider: &'a Provider,
},
ProviderMissingEmailInResponse {
provider: &'a Provider,
},
ProviderAccountNotFound {
provider: &'a Provider,
email: &'a str,
},
ProviderAccountDisabled {
provider: &'a Provider,
email: &'a str,
},
ProviderAccountNotAllowedToLoginWithProvider {
provider: &'a Provider,
email: &'a str,
},
ProviderLoginFailed {
provider: &'a Provider,
email: &'a str,
},
ProviderLoginSuccessful {
provider: &'a Provider,
user: &'a User,
},
Signout, Signout,
UserNeed2FAOnLogin(&'a User), UserNeed2FAOnLogin(&'a User),
UserSuccessfullyAuthenticated(&'a User), UserSuccessfullyAuthenticated(&'a User),
UserNeedNewPasswordOnLogin(&'a User), UserNeedNewPasswordOnLogin(&'a User),
TryLoginWithDisabledAccount(&'a str), TryLoginWithDisabledAccount(&'a str),
TryLocalLoginFromUnauthorizedAccount(&'a str),
FailedLoginWithBadCredentials(&'a str), FailedLoginWithBadCredentials(&'a str),
UserChangedPasswordOnLogin(&'a UserID), UserChangedPasswordOnLogin(&'a UserID),
OTPLoginAttempt { OTPLoginAttempt { user: &'a User, success: bool },
user: &'a User, NewOpenIDSession { client: &'a Client },
success: bool,
},
NewOpenIDSession {
client: &'a Client,
},
NewOpenIDSuccessfulImplicitAuth {
client: &'a Client,
},
ChangedHisPassword, ChangedHisPassword,
ClearedHisLoginHistory, ClearedHisLoginHistory,
AddNewFactor(&'a TwoFactor), AddNewFactor(&'a TwoFactor),
Removed2FAFactor { Removed2FAFactor { factor_id: &'a FactorID },
factor_id: &'a FactorID,
},
} }
impl<'a> Action<'a> { impl<'a> Action<'a> {
@ -127,42 +64,18 @@ impl<'a> Action<'a> {
Action::AdminClear2FAHistory(user) => { Action::AdminClear2FAHistory(user) => {
format!("cleared 2FA history of {}", user.quick_identity()) format!("cleared 2FA history of {}", user.quick_identity())
} }
Action::AdminSetAuthorizedAuthenticationSources(user, sources) => format!(
"update authorized authentication sources ({:?}) for user ({})",
sources,
user.quick_identity()
),
Action::AdminSetNewGrantedClientsList(user, clients) => format!( Action::AdminSetNewGrantedClientsList(user, clients) => format!(
"set new granted clients list ({:?}) for user ({})", "set new granted clients list ({:?}) for user ({})",
clients, clients,
user.quick_identity() user.quick_identity()
), ),
Action::LoginWebauthnAttempt { success, user_id } => match success { Action::LoginWebauthnAttempt { success, user_id } => match success {
true => format!("successfully performed webauthn attempt for user {user_id:?}"), true => format!(
false => format!("performed FAILED webauthn attempt for user {user_id:?}"), "successfully performed webauthn attempt for user {:?}",
}, user_id
Action::StartLoginAttemptWithOpenIDProvider { provider_id, state } => format!(
"started new authentication attempt through an OpenID provider (prov={} / state={state})", provider_id.0
), ),
Action::ProviderError { message } => false => format!("performed FAILED webauthn attempt for user {:?}", user_id),
format!("failed provider authentication with message '{message}'"), },
Action::ProviderCBInvalidState { state } =>
format!("provided invalid callback state after provider authentication: '{state}'"),
Action::ProviderRateLimited => "could not complete OpenID login because it has reached failed attempts rate limit!".to_string(),
Action::ProviderFailedGetToken {state, code} => format!("could not complete login from provider because the id_token could not be retrieved! (state={:?} code = {code})",state),
Action::ProviderFailedGetUserInfo {provider} => format!("could not get user information from userinfo endpoint of provider {}!", provider.id.0),
Action::ProviderEmailNotValidated {provider}=>format!("could not login using provider {} because its email was marked as not validated!", provider.id.0),
Action::ProviderMissingEmailInResponse {provider}=>format!("could not login using provider {} because the email was not provided by userinfo endpoint!", provider.id.0),
Action::ProviderAccountNotFound { provider, email } =>
format!("could not login using provider {} because the email {email} could not be associated to any account!", &provider.id.0),
Action::ProviderAccountDisabled { provider, email } =>
format!("could not login using provider {} because the account associated to the email {email} is disabled!", &provider.id.0),
Action::ProviderAccountNotAllowedToLoginWithProvider { provider, email } =>
format!("could not login using provider {} because the account associated to the email {email} is not allowed to authenticate using this provider!", &provider.id.0),
Action::ProviderLoginFailed { provider, email } =>
format!("could not login using provider {} with the email {email} for an unknown reason!", &provider.id.0),
Action::ProviderLoginSuccessful {provider, user} =>
format!("successfully authenticated using provider {} as {}", provider.id.0, user.quick_identity()),
Action::Signout => "signed out".to_string(), Action::Signout => "signed out".to_string(),
Action::UserNeed2FAOnLogin(user) => { Action::UserNeed2FAOnLogin(user) => {
format!( format!(
@ -177,17 +90,16 @@ impl<'a> Action<'a> {
"successfully authenticated as {}, but need to set a new password", "successfully authenticated as {}, but need to set a new password",
user.quick_identity() user.quick_identity()
), ),
Action::TryLoginWithDisabledAccount(login) => { Action::TryLoginWithDisabledAccount(login) => format!(
format!("successfully authenticated as {login}, but this is a DISABLED ACCOUNT") "successfully authenticated as {}, but this is a DISABLED ACCOUNT",
} login
Action::TryLocalLoginFromUnauthorizedAccount(login) => { ),
format!("successfully locally authenticated as {login}, but this is a FORBIDDEN for this account!") Action::FailedLoginWithBadCredentials(login) => format!(
} "attempted to authenticate as {} but with a WRONG PASSWORD",
Action::FailedLoginWithBadCredentials(login) => { login
format!("attempted to authenticate as {login} but with a WRONG PASSWORD") ),
}
Action::UserChangedPasswordOnLogin(user_id) => { Action::UserChangedPasswordOnLogin(user_id) => {
format!("set a new password at login as user {user_id:?}") format!("set a new password at login as user {:?}", user_id)
} }
Action::OTPLoginAttempt { user, success } => match success { Action::OTPLoginAttempt { user, success } => match success {
true => format!( true => format!(
@ -202,14 +114,13 @@ impl<'a> Action<'a> {
Action::NewOpenIDSession { client } => { Action::NewOpenIDSession { client } => {
format!("opened a new OpenID session with {:?}", client.id) format!("opened a new OpenID session with {:?}", client.id)
} }
Action::NewOpenIDSuccessfulImplicitAuth { client } => format!("finished an implicit flow connection for client {:?}", client.id),
Action::ChangedHisPassword => "changed his password".to_string(), Action::ChangedHisPassword => "changed his password".to_string(),
Action::ClearedHisLoginHistory => "cleared his login history".to_string(), Action::ClearedHisLoginHistory => "cleared his login history".to_string(),
Action::AddNewFactor(factor) => format!( Action::AddNewFactor(factor) => format!(
"added a new factor to his account : {}", "added a new factor to his account : {}",
factor.quick_description(), factor.quick_description(),
), ),
Action::Removed2FAFactor { factor_id } => format!("Removed his factor {factor_id:?}"), Action::Removed2FAFactor { factor_id } => format!("Removed his factor {:?}", factor_id),
} }
} }
} }

View File

@ -1,10 +1,25 @@
use std::path::{Path, PathBuf}; use std::path::{Path, PathBuf};
use clap::Parser; use clap::{Parser, ValueEnum};
use crate::constants::{ use crate::constants::{APP_NAME, CLIENTS_LIST_FILE, USERS_LIST_FILE};
APP_NAME, CLIENTS_LIST_FILE, OIDC_PROVIDER_CB_URI, PROVIDERS_LIST_FILE, USERS_LIST_FILE,
}; #[derive(ValueEnum, Default, Debug, Clone, Eq, PartialEq)]
pub enum UsersBackend {
#[default]
File,
Ldap,
}
#[derive(Debug, Clone)]
pub struct LdapConfiguration {
server_uri: &'static str,
bind_dn: &'static str,
bind_password: &'static str,
start_tls: bool,
root_dn: &'static str,
attr_map: &'static str,
}
/// Basic OIDC provider /// Basic OIDC provider
#[derive(Parser, Debug, Clone)] #[derive(Parser, Debug, Clone)]
@ -32,11 +47,54 @@ pub struct AppConfig {
/// IP location service API /// IP location service API
/// ///
/// Up instance of IP location service : https://gitlab.com/pierre42100/iplocationserver /// Up instance of IP location service : <https://gitlab.com/pierre42100/iplocationserver>
/// ///
/// Example: "https://api.geoip.rs" /// Example: "<https://api.geoip.rs>"
#[arg(long, short, env)] #[clap(long, short, env)]
pub ip_location_service: Option<String>, pub ip_location_service: Option<String>,
/// Users source backend
#[clap(value_enum, long, short, default_value = "file")]
pub backend: UsersBackend,
/// LDAP server URI
#[clap(
long,
env,
group = "ldap-server-uri",
requires = "ldap-dn",
requires = "ldap-password"
)]
pub ldap_server_uri: Option<String>,
/// LDAP user DN to bind as to perform searches
#[clap(long, env, group = "ldap-dn", requires = "ldap-server-uri")]
pub ldap_dn: Option<String>,
/// LDAP user DN to bind as to perform searches
#[clap(long, env, group = "ldap-password", requires = "ldap-server-uri")]
pub ldap_password: Option<String>,
// /// The LDAP user filter, using `{0}` as the username placeholder, e.g. `(|(cn={0})(mail={0}))`;
// /// uses standard LDAP search syntax. Default: `(uid={0})`.
// #[clap(long, env, default_value = "uid={0}")]
// pub ldap_search_filter: String,
/// Set this argument to enable LDAP StartTLS support. (disabled by default)
#[clap(long, env, default_value_t = false)]
pub ldap_start_tls: bool,
/// The LDAP search root DN, e.g. `dc=my,dc=domain,dc=com;` supports multiple entries in a
/// space-delimited list, e.g. `dc=users,dc=domain,dc=com dc=admins,dc=domain,dc=com.`
#[clap(long, env, requires = "ldap-server-uri")]
pub ldap_root_dn: Option<String>,
/// A mapping of user attributes to LDAP values
#[clap(
long,
env,
default_value = "first_name:givenName,last_name:sn,username:uid,email:mail"
)]
pub ldap_attr_map: String,
} }
lazy_static::lazy_static! { lazy_static::lazy_static! {
@ -74,10 +132,6 @@ impl AppConfig {
self.storage_path().join(CLIENTS_LIST_FILE) self.storage_path().join(CLIENTS_LIST_FILE)
} }
pub fn providers_file(&self) -> PathBuf {
self.storage_path().join(PROVIDERS_LIST_FILE)
}
pub fn full_url(&self, uri: &str) -> String { pub fn full_url(&self, uri: &str) -> String {
if uri.starts_with('/') { if uri.starts_with('/') {
format!("{}{}", self.website_origin, uri) format!("{}{}", self.website_origin, uri)
@ -86,20 +140,21 @@ impl AppConfig {
} }
} }
/// Get the URL where a upstream OpenID provider should redirect
/// the user after an authentication
pub fn oidc_provider_redirect_url(&self) -> String {
AppConfig::get().full_url(OIDC_PROVIDER_CB_URI)
}
pub fn domain_name(&self) -> &str { pub fn domain_name(&self) -> &str {
self.website_origin.split('/').nth(2).unwrap_or(APP_NAME) self.website_origin.split('/').nth(2).unwrap_or(APP_NAME)
} }
/// Get the domain without the port /// Get LDAP configuration, if available
pub fn domain_name_without_port(&self) -> &str { pub fn ldap_config(&'static self) -> LdapConfiguration {
let domain = self.domain_name(); assert_eq!(self.backend, UsersBackend::Ldap);
domain.split_once(':').map(|i| i.0).unwrap_or(domain) LdapConfiguration {
server_uri: self.ldap_server_uri.as_deref().unwrap(),
bind_dn: self.ldap_dn.as_deref().unwrap(),
bind_password: self.ldap_password.as_deref().unwrap(),
start_tls: self.ldap_start_tls,
root_dn: self.ldap_root_dn.as_deref().unwrap(),
attr_map: self.ldap_attr_map.as_str(),
}
} }
} }

View File

@ -1,55 +1,16 @@
use crate::data::entity_manager::EntityManager; use crate::data::entity_manager::EntityManager;
use crate::data::user::User;
use crate::utils::string_utils::apply_env_vars; use crate::utils::string_utils::apply_env_vars;
use serde_json::Value;
use std::collections::HashMap;
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize, Eq, PartialEq)] #[derive(Clone, Debug, serde::Serialize, serde::Deserialize, Eq, PartialEq)]
pub struct ClientID(pub String); pub struct ClientID(pub String);
#[derive(Debug, Copy, Clone, Eq, PartialEq)]
pub enum AuthenticationFlow {
AuthorizationCode,
Implicit,
}
pub type AdditionalClaims = HashMap<String, Value>;
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)] #[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
pub struct Client { pub struct Client {
/// The ID of the client
pub id: ClientID, pub id: ClientID,
/// The human-readable name of the client
pub name: String, pub name: String,
/// A short description of the service provided by the client
pub description: String, pub description: String,
pub secret: String,
/// The secret used by the client to retrieve authenticated users information
/// This value is absent if implicit authentication flow is used
pub secret: Option<String>,
/// The URI where the users should be redirected once authenticated
pub redirect_uri: String, pub redirect_uri: String,
/// Specify if the client must be allowed by default for new account
#[serde(default = "bool::default")]
pub default: bool,
/// Specify whether a client is granted to all users
#[serde(default = "bool::default")]
pub granted_to_all_users: bool,
/// Specify whether recent Second Factor Authentication is required to access this client
#[serde(default = "bool::default")]
pub enforce_2fa_auth: bool,
/// Additional claims to return with the id token
claims_id_token: Option<AdditionalClaims>,
/// Additional claims to return through the user info endpoint
claims_user_info: Option<AdditionalClaims>,
} }
impl PartialEq for Client { impl PartialEq for Client {
@ -60,78 +21,6 @@ impl PartialEq for Client {
impl Eq for Client {} impl Eq for Client {}
impl Client {
/// Get the client authentication flow
pub fn auth_flow(&self) -> AuthenticationFlow {
match self.secret {
None => AuthenticationFlow::Implicit,
Some(_) => AuthenticationFlow::AuthorizationCode,
}
}
/// Process a single claim value
fn process_claim_string(&self, user: &User, str: &str) -> String {
str.replace("{username}", &user.username)
.replace("{mail}", &user.email)
.replace("{first_name}", &user.first_name)
.replace("{last_name}", &user.last_name)
.replace("{uid}", &user.uid.0)
}
/// Recurse claims processing
fn recurse_claims_processing(&self, user: &User, value: &Value) -> Value {
match value {
Value::String(s) => Value::String(self.process_claim_string(user, s)),
Value::Array(arr) => Value::Array(
arr.iter()
.map(|v| self.recurse_claims_processing(user, v))
.collect(),
),
Value::Object(obj) => obj
.iter()
.map(|(k, v)| {
(
self.process_claim_string(user, k),
self.recurse_claims_processing(user, v),
)
})
.collect(),
v => v.clone(),
}
}
/// Process additional claims, processing placeholders
fn process_additional_claims(
&self,
user: &User,
claims: &Option<AdditionalClaims>,
) -> Option<AdditionalClaims> {
let claims = claims.as_ref()?;
let res = claims
.iter()
.map(|(k, v)| {
(
self.process_claim_string(user, k),
self.recurse_claims_processing(user, v),
)
})
.collect();
Some(res)
}
/// Get additional claims for id_token for a successful authentication
pub fn claims_id_token(&self, user: &User) -> Option<AdditionalClaims> {
self.process_additional_claims(user, &self.claims_id_token)
}
/// Get additional claims for user info for a successful authentication
pub fn claims_user_info(&self, user: &User) -> Option<AdditionalClaims> {
self.process_additional_claims(user, &self.claims_user_info)
}
}
pub type ClientManager = EntityManager<Client>; pub type ClientManager = EntityManager<Client>;
impl EntityManager<Client> { impl EntityManager<Client> {
@ -144,19 +33,12 @@ impl EntityManager<Client> {
None None
} }
/// Get the list of default clients.
///
/// i.e. the clients that are granted to new accounts by default
pub fn get_default_clients(&self) -> Vec<&Client> {
self.iter().filter(|u| u.default).collect()
}
pub fn apply_environment_variables(&mut self) { pub fn apply_environment_variables(&mut self) {
for c in self.iter_mut() { for c in self.iter_mut() {
c.id = ClientID(apply_env_vars(&c.id.0)); c.id = ClientID(apply_env_vars(&c.id.0));
c.name = apply_env_vars(&c.name); c.name = apply_env_vars(&c.name);
c.description = apply_env_vars(&c.description); c.description = apply_env_vars(&c.description);
c.secret = c.secret.as_deref().map(apply_env_vars); c.secret = apply_env_vars(&c.secret);
c.redirect_uri = apply_env_vars(&c.redirect_uri); c.redirect_uri = apply_env_vars(&c.redirect_uri);
} }
} }

View File

@ -1,5 +1,4 @@
use base64::engine::general_purpose::URL_SAFE_NO_PAD as BASE64_URL_SAFE_NO_PAD; use base64::URL_SAFE_NO_PAD;
use base64::Engine as _;
use crate::utils::crypt_utils::sha256; use crate::utils::crypt_utils::sha256;
@ -17,7 +16,8 @@ impl CodeChallenge {
match self.code_challenge_method.as_str() { match self.code_challenge_method.as_str() {
"plain" => code_verifer.eq(&self.code_challenge), "plain" => code_verifer.eq(&self.code_challenge),
"S256" => { "S256" => {
let encoded = BASE64_URL_SAFE_NO_PAD.encode(sha256(code_verifer.as_bytes())); let encoded =
base64::encode_config(sha256(code_verifer.as_bytes()), URL_SAFE_NO_PAD);
encoded.eq(&self.code_challenge) encoded.eq(&self.code_challenge)
} }

View File

@ -1,32 +0,0 @@
use crate::data::current_user::CurrentUser;
use crate::data::from_request_redirect::FromRequestRedirect;
use crate::data::login_redirect::{get_2fa_url, LoginRedirect};
use actix_web::dev::Payload;
use actix_web::{FromRequest, HttpRequest};
use std::future::Future;
use std::pin::Pin;
pub struct CriticalRoute;
impl FromRequest for CriticalRoute {
type Error = FromRequestRedirect;
type Future = Pin<Box<dyn Future<Output = Result<Self, Self::Error>>>>;
fn from_request(req: &HttpRequest, _: &mut Payload) -> Self::Future {
let req = req.clone();
Box::pin(async move {
let current_user = CurrentUser::from_request(&req, &mut Payload::None)
.await
.expect("Failed to extract user identity!");
if current_user.should_request_2fa_for_critical_functions() {
let uri = get_2fa_url(&LoginRedirect::from_req(&req), true);
return Err(FromRequestRedirect::new(uri));
}
Ok(Self)
})
}
}

View File

@ -0,0 +1,96 @@
use std::io::ErrorKind;
use aes_gcm::aead::{Aead, OsRng};
use aes_gcm::{Aes256Gcm, Key, KeyInit, Nonce};
use rand::Rng;
use serde::de::DeserializeOwned;
use serde::Serialize;
use crate::utils::err::Res;
const NONCE_LEN: usize = 12;
pub struct CryptoWrapper {
key: Key<Aes256Gcm>,
}
impl CryptoWrapper {
/// Generate a new memory wrapper
pub fn new_random() -> Self {
Self {
key: Aes256Gcm::generate_key(&mut OsRng),
}
}
/// Encrypt some data
pub fn encrypt<T: Serialize + DeserializeOwned>(&self, data: &T) -> Res<String> {
let aes_key = Aes256Gcm::new(&self.key);
let nonce_bytes = rand::thread_rng().gen::<[u8; NONCE_LEN]>();
let serialized_data = bincode::serialize(data)?;
let mut enc = aes_key
.encrypt(Nonce::from_slice(&nonce_bytes), serialized_data.as_slice())
.unwrap();
enc.extend_from_slice(&nonce_bytes);
Ok(base64::encode(enc))
}
/// Decrypt some data previously encrypted using the [`CryptoWrapper::encrypt`] method
pub fn decrypt<T: DeserializeOwned>(&self, input: &str) -> Res<T> {
let bytes = base64::decode(input)?;
if bytes.len() < NONCE_LEN {
return Err(Box::new(std::io::Error::new(
ErrorKind::Other,
"Input string is smaller than nonce!",
)));
}
let (enc, nonce) = bytes.split_at(bytes.len() - NONCE_LEN);
assert_eq!(nonce.len(), NONCE_LEN);
let aes_key = Aes256Gcm::new(&self.key);
let dec = match aes_key.decrypt(Nonce::from_slice(nonce), enc) {
Ok(d) => d,
Err(e) => {
log::error!("Failed to decrypt wrapped data! {:#?}", e);
return Err(Box::new(std::io::Error::new(
ErrorKind::Other,
"Failed to decrypt wrapped data!",
)));
}
};
Ok(bincode::deserialize(&dec)?)
}
}
#[cfg(test)]
mod test {
use crate::data::crypto_wrapper::CryptoWrapper;
#[derive(serde::Serialize, serde::Deserialize, Eq, PartialEq, Debug)]
struct Message(String);
#[test]
fn encrypt_and_decrypt() {
let wrapper = CryptoWrapper::new_random();
let msg = Message("Pierre was here".to_string());
let enc = wrapper.encrypt(&msg).unwrap();
let dec: Message = wrapper.decrypt(&enc).unwrap();
assert_eq!(dec, msg)
}
#[test]
fn encrypt_and_decrypt_invalid() {
let wrapper_1 = CryptoWrapper::new_random();
let wrapper_2 = CryptoWrapper::new_random();
let msg = Message("Pierre was here".to_string());
let enc = wrapper_1.encrypt(&msg).unwrap();
wrapper_2.decrypt::<Message>(&enc).unwrap_err();
}
}

View File

@ -10,30 +10,14 @@ use actix_web::{web, Error, FromRequest, HttpRequest};
use crate::actors::users_actor; use crate::actors::users_actor;
use crate::actors::users_actor::UsersActor; use crate::actors::users_actor::UsersActor;
use crate::constants::SECOND_FACTOR_EXPIRATION_FOR_CRITICAL_OPERATIONS;
use crate::data::session_identity::SessionIdentity; use crate::data::session_identity::SessionIdentity;
use crate::data::user::User; use crate::data::user::User;
use crate::utils::time::time;
pub struct CurrentUser { pub struct CurrentUser(User);
user: User,
pub auth_time: u64,
pub last_2fa_auth: Option<u64>,
}
impl CurrentUser {
pub fn should_request_2fa_for_critical_functions(&self) -> bool {
self.user.has_two_factor()
&& self
.last_2fa_auth
.map(|t| t + SECOND_FACTOR_EXPIRATION_FOR_CRITICAL_OPERATIONS < time())
.unwrap_or(true)
}
}
impl From<CurrentUser> for User { impl From<CurrentUser> for User {
fn from(user: CurrentUser) -> Self { fn from(user: CurrentUser) -> Self {
user.user user.0
} }
} }
@ -41,7 +25,7 @@ impl Deref for CurrentUser {
type Target = User; type Target = User;
fn deref(&self) -> &Self::Target { fn deref(&self) -> &Self::Target {
&self.user &self.0
} }
} }
@ -56,10 +40,7 @@ impl FromRequest for CurrentUser {
let identity: Identity = Identity::from_request(req, payload) let identity: Identity = Identity::from_request(req, payload)
.into_inner() .into_inner()
.expect("Failed to get identity!"); .expect("Failed to get identity!");
let id = SessionIdentity(Some(&identity)); let user_id = SessionIdentity(Some(&identity)).user_id();
let user_id = id.user_id();
let last_2fa_auth = id.last_2fa_auth();
let auth_time = id.auth_time();
Box::pin(async move { Box::pin(async move {
let user = match user_actor let user = match user_actor
@ -76,11 +57,7 @@ impl FromRequest for CurrentUser {
} }
}; };
Ok(CurrentUser { Ok(CurrentUser(user))
user,
auth_time,
last_2fa_auth,
})
}) })
} }
} }

View File

@ -1,45 +0,0 @@
use crate::data::current_user::CurrentUser;
use crate::data::session_identity::SessionIdentity;
use actix_identity::Identity;
use actix_web::dev::Payload;
use actix_web::{web, Error, FromRequest, HttpRequest};
use std::future::Future;
use std::pin::Pin;
#[derive(serde::Deserialize)]
pub struct Force2FAAuthQuery {
#[serde(default)]
force_2fa: bool,
}
pub struct Force2FAAuth {
pub force: bool,
}
impl FromRequest for Force2FAAuth {
type Error = Error;
type Future = Pin<Box<dyn Future<Output = Result<Self, Self::Error>>>>;
fn from_request(req: &HttpRequest, _: &mut Payload) -> Self::Future {
let req = req.clone();
Box::pin(async move {
// It is impossible to force authentication for an unauthenticated user
let identity = Identity::from_request(&req, &mut Payload::None)
.into_inner()
.ok();
if !SessionIdentity(identity.as_ref()).is_authenticated() {
return Ok(Self { force: false });
}
let query = web::Query::<Force2FAAuthQuery>::from_request(&req, &mut Payload::None)
.into_inner()?;
let user = CurrentUser::from_request(&req, &mut Payload::None).await?;
Ok(Self {
force: query.force_2fa && user.has_two_factor(),
})
})
}
}

View File

@ -1,32 +0,0 @@
use actix_web::body::BoxBody;
use actix_web::http::StatusCode;
use actix_web::{HttpResponse, ResponseError};
use std::fmt::{Debug, Display, Formatter};
#[derive(Debug)]
pub struct FromRequestRedirect {
url: String,
}
impl FromRequestRedirect {
pub fn new(url: String) -> Self {
Self { url }
}
}
impl Display for FromRequestRedirect {
fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
write!(f, "Redirect to {}", self.url)
}
}
impl ResponseError for FromRequestRedirect {
fn status_code(&self) -> StatusCode {
StatusCode::FOUND
}
fn error_response(&self) -> HttpResponse<BoxBody> {
HttpResponse::Found()
.insert_header(("Location", self.url.as_str()))
.body("Redirecting...")
}
}

View File

@ -1,8 +1,7 @@
use crate::data::client::AdditionalClaims;
use jwt_simple::claims::Audiences; use jwt_simple::claims::Audiences;
use jwt_simple::prelude::{Duration, JWTClaims}; use jwt_simple::prelude::{Duration, JWTClaims};
#[derive(serde::Serialize, Debug)] #[derive(serde::Serialize)]
pub struct IdToken { pub struct IdToken {
/// REQUIRED. Issuer Identifier for the Issuer of the response. The iss value is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components. /// REQUIRED. Issuer Identifier for the Issuer of the response. The iss value is a case sensitive URL using the https scheme that contains scheme, host, and optionally, port number and path components and no query or fragment components.
#[serde(rename = "iss")] #[serde(rename = "iss")]
@ -25,19 +24,12 @@ pub struct IdToken {
#[serde(skip_serializing_if = "Option::is_none")] #[serde(skip_serializing_if = "Option::is_none")]
pub nonce: Option<String>, pub nonce: Option<String>,
pub email: String, pub email: String,
/// Additional claims
#[serde(skip_serializing_if = "Option::is_none")]
#[serde(flatten)]
pub additional_claims: Option<AdditionalClaims>,
} }
#[derive(serde::Serialize, serde::Deserialize)] #[derive(serde::Serialize, serde::Deserialize)]
pub struct CustomIdTokenClaims { pub struct CustomIdTokenClaims {
auth_time: u64, auth_time: u64,
email: String, email: String,
#[serde(skip_serializing_if = "Option::is_none")]
#[serde(flatten)]
additional_claims: Option<AdditionalClaims>,
} }
impl IdToken { impl IdToken {
@ -54,7 +46,6 @@ impl IdToken {
custom: CustomIdTokenClaims { custom: CustomIdTokenClaims {
auth_time: self.auth_time, auth_time: self.auth_time,
email: self.email, email: self.email,
additional_claims: self.additional_claims,
}, },
} }
} }

View File

@ -4,17 +4,11 @@ use jwt_simple::prelude::RS256KeyPair;
use serde::de::DeserializeOwned; use serde::de::DeserializeOwned;
use serde::Serialize; use serde::Serialize;
use base64::engine::general_purpose::URL_SAFE as BASE64_URL_URL_SAFE;
use base64::engine::general_purpose::URL_SAFE_NO_PAD as BASE64_URL_SAFE_NO_PAD;
use base64::Engine as _;
use crate::utils::err::Res; use crate::utils::err::Res;
use crate::utils::string_utils::rand_str; use crate::utils::string_utils::rand_str;
const JWK_USE_SIGN: &str = "sig";
/// Json Web Key <https://datatracker.ietf.org/doc/html/rfc7517> /// Json Web Key <https://datatracker.ietf.org/doc/html/rfc7517>
#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)] #[derive(serde::Serialize, serde::Deserialize)]
pub struct JsonWebKey { pub struct JsonWebKey {
#[serde(rename = "alg")] #[serde(rename = "alg")]
algorithm: String, algorithm: String,
@ -26,8 +20,6 @@ pub struct JsonWebKey {
modulus: String, modulus: String,
#[serde(rename = "e")] #[serde(rename = "e")]
public_exponent: String, public_exponent: String,
#[serde(rename = "use", skip_serializing_if = "Option::is_none")]
usage: Option<String>,
} }
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
@ -46,9 +38,8 @@ impl JWTSigner {
algorithm: "RS256".to_string(), algorithm: "RS256".to_string(),
key_type: "RSA".to_string(), key_type: "RSA".to_string(),
key_id: self.0.key_id().as_ref().unwrap().to_string(), key_id: self.0.key_id().as_ref().unwrap().to_string(),
public_exponent: BASE64_URL_URL_SAFE.encode(components.e), public_exponent: base64::encode_config(components.e, base64::URL_SAFE),
modulus: BASE64_URL_SAFE_NO_PAD.encode(components.n), modulus: base64::encode_config(components.n, base64::URL_SAFE_NO_PAD),
usage: Some(JWK_USE_SIGN.to_string()),
} }
} }

View File

@ -1,13 +1,7 @@
use actix_web::HttpRequest;
#[derive(serde::Serialize, serde::Deserialize, Debug, Eq, PartialEq, Clone)] #[derive(serde::Serialize, serde::Deserialize, Debug, Eq, PartialEq, Clone)]
pub struct LoginRedirect(String); pub struct LoginRedirect(String);
impl LoginRedirect { impl LoginRedirect {
pub fn from_req(req: &HttpRequest) -> Self {
Self(req.uri().to_string())
}
pub fn get(&self) -> &str { pub fn get(&self) -> &str {
match self.0.starts_with('/') && !self.0.starts_with("//") { match self.0.starts_with('/') && !self.0.starts_with("//") {
true => self.0.as_str(), true => self.0.as_str(),
@ -25,11 +19,3 @@ impl Default for LoginRedirect {
Self("/".to_string()) Self("/".to_string())
} }
} }
/// Get the URL for 2FA authentication
pub fn get_2fa_url(redir: &LoginRedirect, force_2fa: bool) -> String {
format!(
"/2fa_auth?redirect={}&force_2fa={force_2fa}",
redir.get_encoded()
)
}

View File

@ -3,16 +3,15 @@ pub mod action_logger;
pub mod app_config; pub mod app_config;
pub mod client; pub mod client;
pub mod code_challenge; pub mod code_challenge;
pub mod critical_route; pub mod crypto_wrapper;
pub mod current_user; pub mod current_user;
pub mod entity_manager; pub mod entity_manager;
pub mod force_2fa_auth;
pub mod from_request_redirect;
pub mod id_token; pub mod id_token;
pub mod jwt_signer; pub mod jwt_signer;
pub mod login_redirect; pub mod login_redirect;
pub mod provider; pub mod open_id_user_info;
pub mod provider_configuration; pub mod openid_config;
pub mod remote_ip;
pub mod session_identity; pub mod session_identity;
pub mod totp_key; pub mod totp_key;
pub mod user; pub mod user;

View File

@ -0,0 +1,24 @@
/// Refer to <https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims> for more information
#[derive(Debug, serde::Serialize)]
pub struct OpenIDUserInfo {
/// Subject - Identifier for the End-User at the Issuer
pub sub: String,
/// End-User's full name in displayable form including all name parts, possibly including titles and suffixes, ordered according to the End-User's locale and preferences.
pub name: String,
/// Given name(s) or first name(s) of the End-User. Note that in some cultures, people can have multiple given names; all can be present, with the names being separated by space characters.
pub given_name: String,
/// Surname(s) or last name(s) of the End-User. Note that in some cultures, people can have multiple family names or no family name; all can be present, with the names being separated by space characters.
pub family_name: String,
/// Shorthand name by which the End-User wishes to be referred to at the RP, such as janedoe or j.doe. This value MAY be any valid JSON string including special characters such as @, /, or whitespace. The RP MUST NOT rely upon this value being unique, as discussed in
pub preferred_username: String,
/// End-User's preferred e-mail address. Its value MUST conform to the RFC 5322 RFC5322 addr-spec syntax. The RP MUST NOT rely upon this value being unique, as discussed in Section 5.7.
pub email: String,
/// True if the End-User's e-mail address has been verified; otherwise false. When this Claim Value is true, this means that the OP took affirmative steps to ensure that this e-mail address was controlled by the End-User at the time the verification was performed. The means by which an e-mail address is verified is context-specific, and dependent upon the trust framework or contractual agreements within which the parties are operating.
pub email_verified: bool,
}

37
src/data/openid_config.rs Normal file
View File

@ -0,0 +1,37 @@
#[derive(Debug, Clone, serde::Serialize)]
pub struct OpenIDConfig {
/// URL using the https scheme with no query or fragment component that the OP asserts as its Issuer Identifier. If Issuer discovery is supported (see Section 2), this value MUST be identical to the issuer value returned by WebFinger. This also MUST be identical to the iss Claim value in ID Tokens issued from this Issuer
pub issuer: String,
/// REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint `OpenID.Core`
pub authorization_endpoint: String,
/// URL of the OP's OAuth 2.0 Token Endpoint `OpenID.Core`. This is REQUIRED unless only the Implicit Flow is used.
pub token_endpoint: String,
/// RECOMMENDED. URL of the OP's UserInfo Endpoint `[`OpenID.Core`]`. This URL MUST use the https scheme and MAY contain port, path, and query parameter components
pub userinfo_endpoint: String,
/// REQUIRED. URL of the OP's JSON Web Key Set `[`JWK`]` document. This contains the signing key(s) the RP uses to validate signatures from the OP. The JWK Set MAY also contain the Server's encryption key(s), which are used by RPs to encrypt requests to the Server. When both signing and encryption keys are made available, a use (Key Use) parameter value is REQUIRED for all keys in the referenced JWK Set to indicate each key's intended usage. Although some algorithms allow the same key to be used for both signatures and encryption, doing so is NOT RECOMMENDED, as it is less secure. The JWK x5c parameter MAY be used to provide X.509 representations of keys provided. When used, the bare key values MUST still be present and MUST match those in the certificate.
pub jwks_uri: String,
/// RECOMMENDED. JSON array containing a list of the OAuth 2.0 `[`RFC6749`]` scope values that this server supports. The server MUST support the openid scope value. Servers MAY choose not to advertise some supported scope values even when this parameter is used, although those defined in `[`OpenID.Core`]` SHOULD be listed, if supported.
pub scopes_supported: Vec<&'static str>,
/// REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports. Dynamic OpenID Providers MUST support the code, id_token, and the token id_token Response Type values.
pub response_types_supported: Vec<&'static str>,
/// REQUIRED. JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.
pub subject_types_supported: Vec<&'static str>,
/// REQUIRED. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token to encode the Claims in a JWT `[`JWT`. The algorithm RS256 MUST be included. The value none MAY be supported, but MUST NOT be used unless the Response Type used returns no ID Token from the Authorization Endpoint (such as when using the Authorization Code Flow).
pub id_token_signing_alg_values_supported: Vec<&'static str>,
/// OPTIONAL. JSON array containing a list of Client Authentication methods supported by this Token Endpoint. The options are client_secret_post, client_secret_basic, client_secret_jwt, and private_key_jwt
pub token_endpoint_auth_methods_supported: Vec<&'static str>,
/// RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for. Note that for privacy or other reasons, this might not be an exhaustive list.
pub claims_supported: Vec<&'static str>,
pub code_challenge_methods_supported: Vec<&'static str>,
}

View File

@ -1,89 +0,0 @@
use crate::data::entity_manager::EntityManager;
use crate::data::login_redirect::LoginRedirect;
use crate::utils::string_utils::apply_env_vars;
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize, Eq, PartialEq)]
pub struct ProviderID(pub String);
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
pub struct Provider {
/// The ID of the provider
pub id: ProviderID,
/// The human-readable name of the client
pub name: String,
/// A logo presented to the users of the provider
pub logo: String,
/// The registration id of BasicOIDC on the provider
pub client_id: String,
/// The registration secret of BasicOIDC on the provider
pub client_secret: String,
/// Specify the URL of the OpenID configuration URL
///
/// (.well-known/openid-configuration endpoint)
pub configuration_url: String,
}
impl Provider {
/// Get URL-encoded provider id
pub fn id_encoded(&self) -> String {
urlencoding::encode(&self.id.0).to_string()
}
/// Get the URL where the logo can be located
pub fn logo_url(&self) -> &str {
match self.logo.as_str() {
"gitea" => "/assets/img/brands/gitea.svg",
"gitlab" => "/assets/img/brands/gitlab.svg",
"github" => "/assets/img/brands/github.svg",
"microsoft" => "/assets/img/brands/microsoft.svg",
"google" => "/assets/img/brands/google.svg",
s => s,
}
}
/// Get the URL to use to login with the provider
pub fn login_url(&self, redirect_url: &LoginRedirect) -> String {
format!(
"/login_with_prov?id={}&redirect={}",
self.id_encoded(),
redirect_url.get_encoded()
)
}
}
impl PartialEq for Provider {
fn eq(&self, other: &Self) -> bool {
self.id.eq(&other.id)
}
}
impl Eq for Provider {}
pub type ProvidersManager = EntityManager<Provider>;
impl EntityManager<Provider> {
pub fn find_by_id(&self, u: &ProviderID) -> Option<Provider> {
for entry in self.iter() {
if entry.id.eq(u) {
return Some(entry.clone());
}
}
None
}
pub fn apply_environment_variables(&mut self) {
for c in self.iter_mut() {
c.id = ProviderID(apply_env_vars(&c.id.0));
c.name = apply_env_vars(&c.name);
c.logo = apply_env_vars(&c.logo);
c.client_id = apply_env_vars(&c.client_id);
c.client_secret = apply_env_vars(&c.client_secret);
c.configuration_url = apply_env_vars(&c.configuration_url);
}
}
}

View File

@ -1,91 +0,0 @@
use std::cell::RefCell;
use std::collections::HashMap;
use light_openid::primitives::{OpenIDConfig, OpenIDTokenResponse, OpenIDUserInfo};
use crate::actors::providers_states_actor::ProviderLoginState;
use crate::constants::OIDC_PROVIDERS_LIFETIME;
use crate::data::app_config::AppConfig;
use crate::data::provider::Provider;
use crate::utils::err::Res;
use crate::utils::time::time;
/// Provider configuration
#[derive(Debug, Clone)]
pub struct ProviderConfiguration {
pub discovery: OpenIDConfig,
pub expire: u64,
}
impl ProviderConfiguration {
/// Get the URL where a user should be redirected to authenticate
pub fn auth_url(&self, provider: &Provider, state: &ProviderLoginState) -> String {
let authorization_url = &self.discovery.authorization_endpoint;
let client_id = urlencoding::encode(&provider.client_id).to_string();
let state = urlencoding::encode(&state.state_id).to_string();
let callback_url = AppConfig::get().oidc_provider_redirect_url();
format!("{authorization_url}?response_type=code&scope=openid%20profile%20email&client_id={client_id}&state={state}&redirect_uri={callback_url}")
}
/// Retrieve the authorization token after a successful authentication, using an authorization code
pub async fn get_token(
&self,
provider: &Provider,
authorization_code: &str,
) -> Res<OpenIDTokenResponse> {
let (token, _) = self
.discovery
.request_token(
&provider.client_id,
&provider.client_secret,
authorization_code,
&AppConfig::get().oidc_provider_redirect_url(),
)
.await?;
Ok(token)
}
/// Retrieve information about the user, using a given [OpenIDTokenResponse]
pub async fn get_userinfo(&self, token: &OpenIDTokenResponse) -> Res<OpenIDUserInfo> {
Ok(self.discovery.request_user_info(token).await?.0)
}
}
thread_local! {
static THREAD_CACHE: RefCell<HashMap<String, ProviderConfiguration>> = RefCell::new(Default::default());
}
pub struct ProviderConfigurationHelper {}
impl ProviderConfigurationHelper {
/// Get or refresh the configuration for a provider
pub async fn get_configuration(provider: &Provider) -> Res<ProviderConfiguration> {
let config = THREAD_CACHE.with(|i| i.borrow().get(&provider.configuration_url).cloned());
// Refresh config cache if needed
if config.is_none() || config.as_ref().unwrap().expire < time() {
let conf = Self::fetch_configuration(provider).await?;
THREAD_CACHE.with(|i| {
i.borrow_mut()
.insert(provider.configuration_url.clone(), conf.clone())
});
return Ok(conf);
}
// We can return immediately previously extracted value
Ok(config.unwrap())
}
/// Get fresh configuration from provider
async fn fetch_configuration(provider: &Provider) -> Res<ProviderConfiguration> {
Ok(ProviderConfiguration {
discovery: OpenIDConfig::load_from_url(&provider.configuration_url).await?,
expire: time() + OIDC_PROVIDERS_LIFETIME,
})
}
}

30
src/data/remote_ip.rs Normal file
View File

@ -0,0 +1,30 @@
use std::net::IpAddr;
use actix_web::dev::Payload;
use actix_web::{Error, FromRequest, HttpRequest};
use futures_util::future::{ready, Ready};
use crate::data::app_config::AppConfig;
use crate::utils::network_utils::get_remote_ip;
#[derive(Copy, Clone, Debug, Eq, PartialEq)]
pub struct RemoteIP(pub IpAddr);
impl From<RemoteIP> for IpAddr {
fn from(i: RemoteIP) -> Self {
i.0
}
}
impl FromRequest for RemoteIP {
type Error = Error;
type Future = Ready<Result<Self, Error>>;
#[inline]
fn from_request(req: &HttpRequest, _: &mut Payload) -> Self::Future {
ready(Ok(RemoteIP(get_remote_ip(
req,
AppConfig::get().proxy_ip.as_deref(),
))))
}
}

View File

@ -24,7 +24,6 @@ pub struct SessionIdentityData {
pub id: Option<UserID>, pub id: Option<UserID>,
pub is_admin: bool, pub is_admin: bool,
pub auth_time: u64, pub auth_time: u64,
pub last_2fa_auth: Option<u64>,
pub status: SessionStatus, pub status: SessionStatus,
} }
@ -76,7 +75,6 @@ impl<'a> SessionIdentity<'a> {
&SessionIdentityData { &SessionIdentityData {
id: Some(user.uid.clone()), id: Some(user.uid.clone()),
is_admin: user.admin, is_admin: user.admin,
last_2fa_auth: None,
auth_time: time(), auth_time: time(),
status, status,
}, },
@ -89,12 +87,6 @@ impl<'a> SessionIdentity<'a> {
self.set_session_data(req, &sess); self.set_session_data(req, &sess);
} }
pub fn record_2fa_auth(&self, req: &HttpRequest) {
let mut sess = self.get_session_data().unwrap_or_default();
sess.last_2fa_auth = Some(time());
self.set_session_data(req, &sess);
}
pub fn is_authenticated(&self) -> bool { pub fn is_authenticated(&self) -> bool {
self.get_session_data() self.get_session_data()
.map(|s| s.status == SessionStatus::SignedIn) .map(|s| s.status == SessionStatus::SignedIn)
@ -127,8 +119,4 @@ impl<'a> SessionIdentity<'a> {
pub fn auth_time(&self) -> u64 { pub fn auth_time(&self) -> u64 {
self.get_session_data().unwrap_or_default().auth_time self.get_session_data().unwrap_or_default().auth_time
} }
pub fn last_2fa_auth(&self) -> Option<u64> {
self.get_session_data().unwrap_or_default().last_2fa_auth
}
} }

View File

@ -9,7 +9,7 @@ use crate::data::user::User;
use crate::utils::err::Res; use crate::utils::err::Res;
use crate::utils::time::time; use crate::utils::time::time;
const BASE32_ALPHABET: Alphabet = Alphabet::Rfc4648 { padding: true }; const BASE32_ALPHABET: Alphabet = Alphabet::RFC4648 { padding: true };
const NUM_DIGITS: usize = 6; const NUM_DIGITS: usize = 6;
const PERIOD: u64 = 30; const PERIOD: u64 = 30;
@ -21,7 +21,7 @@ pub struct TotpKey {
impl TotpKey { impl TotpKey {
/// Generate a new TOTP key /// Generate a new TOTP key
pub fn new_random() -> Self { pub fn new_random() -> Self {
let random_bytes = rand::thread_rng().gen::<[u8; 20]>(); let random_bytes = rand::thread_rng().gen::<[u8; 10]>();
Self { Self {
encoded: base32::encode(BASE32_ALPHABET, &random_bytes), encoded: base32::encode(BASE32_ALPHABET, &random_bytes),
} }
@ -40,10 +40,10 @@ impl TotpKey {
pub fn url_for_user(&self, u: &User, conf: &AppConfig) -> String { pub fn url_for_user(&self, u: &User, conf: &AppConfig) -> String {
format!( format!(
"otpauth://totp/{}:{}?secret={}&issuer={}&algorithm=SHA1&digits={}&period={}", "otpauth://totp/{}:{}?secret={}&issuer={}&algorithm=SHA1&digits={}&period={}",
urlencoding::encode(conf.domain_name_without_port()), urlencoding::encode(conf.domain_name()),
urlencoding::encode(&u.username), urlencoding::encode(&u.username),
self.encoded, self.encoded,
urlencoding::encode(conf.domain_name_without_port()), urlencoding::encode(conf.domain_name()),
NUM_DIGITS, NUM_DIGITS,
PERIOD, PERIOD,
) )
@ -53,7 +53,7 @@ impl TotpKey {
pub fn account_name(&self, u: &User, conf: &AppConfig) -> String { pub fn account_name(&self, u: &User, conf: &AppConfig) -> String {
format!( format!(
"{}:{}", "{}:{}",
urlencoding::encode(conf.domain_name_without_port()), urlencoding::encode(conf.domain_name()),
urlencoding::encode(&u.username) urlencoding::encode(&u.username)
) )
} }
@ -73,11 +73,6 @@ impl TotpKey {
self.get_code_at(|| time() - PERIOD) self.get_code_at(|| time() - PERIOD)
} }
/// Get following code
pub fn following_code(&self) -> Res<String> {
self.get_code_at(|| time() + PERIOD)
}
/// Get the code at a specific time /// Get the code at a specific time
fn get_code_at<F: Fn() -> u64>(&self, get_time: F) -> Res<String> { fn get_code_at<F: Fn() -> u64>(&self, get_time: F) -> Res<String> {
let gen = TotpGenerator::new() let gen = TotpGenerator::new()
@ -103,9 +98,7 @@ impl TotpKey {
/// Check a code's validity /// Check a code's validity
pub fn check_code(&self, code: &str) -> Res<bool> { pub fn check_code(&self, code: &str) -> Res<bool> {
Ok(self.previous_code()?.eq(code) Ok(self.current_code()?.eq(code) || self.previous_code()?.eq(code))
|| self.current_code()?.eq(code)
|| self.following_code()?.eq(code))
} }
} }
@ -118,10 +111,7 @@ mod test {
let key = TotpKey::new_random(); let key = TotpKey::new_random();
let code = key.current_code().unwrap(); let code = key.current_code().unwrap();
let old_code = key.previous_code().unwrap(); let old_code = key.previous_code().unwrap();
let following_code = key.following_code().unwrap();
assert_ne!(code, old_code); assert_ne!(code, old_code);
assert_ne!(code, following_code);
assert_ne!(old_code, following_code);
} }
#[test] #[test]

View File

@ -1,17 +1,14 @@
use bincode::{Decode, Encode};
use std::collections::HashMap; use std::collections::HashMap;
use std::net::IpAddr; use std::net::IpAddr;
use crate::actors::users_actor::AuthorizedAuthenticationSources;
use crate::constants::SECOND_FACTOR_EXEMPTION_AFTER_SUCCESSFUL_LOGIN; use crate::constants::SECOND_FACTOR_EXEMPTION_AFTER_SUCCESSFUL_LOGIN;
use crate::data::client::{Client, ClientID}; use crate::data::client::ClientID;
use crate::data::login_redirect::LoginRedirect; use crate::data::login_redirect::LoginRedirect;
use crate::data::provider::{Provider, ProviderID};
use crate::data::totp_key::TotpKey; use crate::data::totp_key::TotpKey;
use crate::data::webauthn_manager::WebauthnPubKey; use crate::data::webauthn_manager::WebauthnPubKey;
use crate::utils::time::{fmt_time, time}; use crate::utils::time::{fmt_time, time};
#[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize, Encode, Decode)] #[derive(Clone, Debug, Eq, PartialEq, serde::Serialize, serde::Deserialize)]
pub struct UserID(pub String); pub struct UserID(pub String);
#[derive(Debug, Clone)] #[derive(Debug, Clone)]
@ -90,17 +87,11 @@ impl TwoFactor {
} }
} }
pub fn login_url(&self, redirect_uri: &LoginRedirect, force_2fa: bool) -> String { pub fn login_url(&self, redirect_uri: &LoginRedirect) -> String {
match self.kind { match self.kind {
TwoFactorType::TOTP(_) => format!( TwoFactorType::TOTP(_) => format!("/2fa_otp?redirect={}", redirect_uri.get_encoded()),
"/2fa_otp?redirect={}&force_2fa={force_2fa}",
redirect_uri.get_encoded()
),
TwoFactorType::WEBAUTHN(_) => { TwoFactorType::WEBAUTHN(_) => {
format!( format!("/2fa_webauthn?redirect={}", redirect_uri.get_encoded())
"/2fa_webauthn?redirect={}&force_2fa={force_2fa}",
redirect_uri.get_encoded()
)
} }
} }
} }
@ -123,10 +114,6 @@ impl Successful2FALogin {
} }
} }
fn default_true() -> bool {
true
}
#[derive(Clone, Debug, serde::Serialize, serde::Deserialize)] #[derive(Clone, Debug, serde::Serialize, serde::Deserialize)]
pub struct User { pub struct User {
pub uid: UserID, pub uid: UserID,
@ -155,14 +142,6 @@ pub struct User {
/// None = all services /// None = all services
/// Some([]) = no service /// Some([]) = no service
pub authorized_clients: Option<Vec<ClientID>>, pub authorized_clients: Option<Vec<ClientID>>,
/// Authorize connection through local login
#[serde(default = "default_true")]
pub allow_local_login: bool,
/// Allowed third party providers
#[serde(default)]
pub allow_login_from_providers: Vec<ProviderID>,
} }
impl User { impl User {
@ -183,19 +162,6 @@ impl User {
) )
} }
/// Get the list of sources from which a user can authenticate from
pub fn authorized_authentication_sources(&self) -> AuthorizedAuthenticationSources {
AuthorizedAuthenticationSources {
local: self.allow_local_login,
upstream: self.allow_login_from_providers.clone(),
}
}
/// Check if a user can authenticate using a givne provider or not
pub fn can_login_from_provider(&self, provider: &Provider) -> bool {
self.allow_login_from_providers.contains(&provider.id)
}
pub fn granted_clients(&self) -> GrantedClients { pub fn granted_clients(&self) -> GrantedClients {
match self.authorized_clients.as_deref() { match self.authorized_clients.as_deref() {
None => GrantedClients::AllClients, None => GrantedClients::AllClients,
@ -204,14 +170,10 @@ impl User {
} }
} }
pub fn can_access_app(&self, client: &Client) -> bool { pub fn can_access_app(&self, id: &ClientID) -> bool {
if client.granted_to_all_users {
return true;
}
match self.granted_clients() { match self.granted_clients() {
GrantedClients::AllClients => true, GrantedClients::AllClients => true,
GrantedClients::SomeClients(c) => c.contains(&client.id), GrantedClients::SomeClients(c) => c.contains(id),
GrantedClients::NoClient => false, GrantedClients::NoClient => false,
} }
} }
@ -317,7 +279,7 @@ impl Eq for User {}
impl Default for User { impl Default for User {
fn default() -> Self { fn default() -> Self {
Self { Self {
uid: UserID(uuid::Uuid::new_v4().to_string()), uid: UserID("".to_string()),
first_name: "".to_string(), first_name: "".to_string(),
last_name: "".to_string(), last_name: "".to_string(),
username: "".to_string(), username: "".to_string(),
@ -330,8 +292,6 @@ impl Default for User {
two_factor_exemption_after_successful_login: false, two_factor_exemption_after_successful_login: false,
last_successful_2fa: Default::default(), last_successful_2fa: Default::default(),
authorized_clients: Some(Vec::new()), authorized_clients: Some(Vec::new()),
allow_local_login: true,
allow_login_from_providers: vec![],
} }
} }
} }

View File

@ -1,6 +1,6 @@
use std::net::IpAddr; use std::net::IpAddr;
use crate::actors::users_actor::{AuthorizedAuthenticationSources, UsersSyncBackend}; use crate::actors::users_actor::UsersSyncBackend;
use crate::data::entity_manager::EntityManager; use crate::data::entity_manager::EntityManager;
use crate::data::user::{FactorID, GeneralSettings, GrantedClients, TwoFactor, User, UserID}; use crate::data::user::{FactorID, GeneralSettings, GrantedClients, TwoFactor, User, UserID};
use crate::utils::err::{new_error, Res}; use crate::utils::err::{new_error, Res};
@ -13,7 +13,7 @@ impl EntityManager<User> {
F: FnOnce(User) -> User, F: FnOnce(User) -> User,
{ {
let user = match self.find_by_user_id(id)? { let user = match self.find_by_user_id(id)? {
None => return new_error(format!("Failed to find user {id:?}")), None => return new_error(format!("Failed to find user {:?}", id)),
Some(user) => user, Some(user) => user,
}; };
@ -41,15 +41,6 @@ fn verify_password<P: AsRef<[u8]>>(pwd: P, hash: &str) -> bool {
} }
impl UsersSyncBackend for EntityManager<User> { impl UsersSyncBackend for EntityManager<User> {
fn find_by_email(&self, u: &str) -> Res<Option<User>> {
for entry in self.iter() {
if entry.email.eq(u) {
return Ok(Some(entry.clone()));
}
}
Ok(None)
}
fn find_by_username_or_email(&self, u: &str) -> Res<Option<User>> { fn find_by_username_or_email(&self, u: &str) -> Res<Option<User>> {
for entry in self.iter() { for entry in self.iter() {
if entry.username.eq(u) || entry.email.eq(u) { if entry.username.eq(u) || entry.email.eq(u) {
@ -143,7 +134,8 @@ impl UsersSyncBackend for EntityManager<User> {
let user = match self.find_by_user_id(id)? { let user = match self.find_by_user_id(id)? {
None => { None => {
return new_error(format!( return new_error(format!(
"Could not delete account {id:?} because it was not found!" "Could not delete account {:?} because it was not found!",
id
)); ));
} }
Some(s) => s, Some(s) => s,
@ -152,18 +144,6 @@ impl UsersSyncBackend for EntityManager<User> {
self.remove(&user) self.remove(&user)
} }
fn set_authorized_authentication_sources(
&mut self,
id: &UserID,
sources: AuthorizedAuthenticationSources,
) -> Res {
self.update_user(id, |mut user| {
user.allow_local_login = sources.local;
user.allow_login_from_providers = sources.upstream;
user
})
}
fn set_granted_2fa_clients(&mut self, id: &UserID, clients: GrantedClients) -> Res { fn set_granted_2fa_clients(&mut self, id: &UserID, clients: GrantedClients) -> Res {
self.update_user(id, |mut user| { self.update_user(id, |mut user| {
user.authorized_clients = clients.to_user(); user.authorized_clients = clients.to_user();

View File

@ -2,8 +2,6 @@ use std::io::ErrorKind;
use std::sync::Arc; use std::sync::Arc;
use actix_web::web; use actix_web::web;
use bincode::{Decode, Encode};
use light_openid::crypto_wrapper::CryptoWrapper;
use uuid::Uuid; use uuid::Uuid;
use webauthn_rs::prelude::{ use webauthn_rs::prelude::{
CreationChallengeResponse, Passkey, PublicKeyCredential, RegisterPublicKeyCredential, CreationChallengeResponse, Passkey, PublicKeyCredential, RegisterPublicKeyCredential,
@ -15,6 +13,7 @@ use crate::constants::{
APP_NAME, WEBAUTHN_LOGIN_CHALLENGE_EXPIRE, WEBAUTHN_REGISTER_CHALLENGE_EXPIRE, APP_NAME, WEBAUTHN_LOGIN_CHALLENGE_EXPIRE, WEBAUTHN_REGISTER_CHALLENGE_EXPIRE,
}; };
use crate::data::app_config::AppConfig; use crate::data::app_config::AppConfig;
use crate::data::crypto_wrapper::CryptoWrapper;
use crate::data::user::{User, UserID}; use crate::data::user::{User, UserID};
use crate::utils::err::Res; use crate::utils::err::Res;
use crate::utils::time::time; use crate::utils::time::time;
@ -29,7 +28,7 @@ pub struct RegisterKeyRequest {
pub creation_challenge: CreationChallengeResponse, pub creation_challenge: CreationChallengeResponse,
} }
#[derive(Debug, serde::Serialize, serde::Deserialize, Encode, Decode)] #[derive(Debug, serde::Serialize, serde::Deserialize)]
struct RegisterKeyOpaqueData { struct RegisterKeyOpaqueData {
registration_state: String, registration_state: String,
user_id: UserID, user_id: UserID,
@ -41,7 +40,7 @@ pub struct AuthRequest {
pub login_challenge: RequestChallengeResponse, pub login_challenge: RequestChallengeResponse,
} }
#[derive(Debug, Encode, Decode)] #[derive(Debug, serde::Serialize, serde::Deserialize)]
struct AuthStateOpaqueData { struct AuthStateOpaqueData {
authentication_state: String, authentication_state: String,
user_id: UserID, user_id: UserID,
@ -57,24 +56,15 @@ pub struct WebAuthManager {
impl WebAuthManager { impl WebAuthManager {
pub fn init(conf: &AppConfig) -> Self { pub fn init(conf: &AppConfig) -> Self {
let rp_id = conf Self {
.domain_name() core: WebauthnBuilder::new(
conf.domain_name()
.split_once(':') .split_once(':')
.map(|s| s.0) .map(|s| s.0)
.unwrap_or_else(|| conf.domain_name()); .unwrap_or_else(|| conf.domain_name()),
&url::Url::parse(&conf.website_origin)
let rp_origin = .expect("Failed to parse configuration origin!"),
url::Url::parse(&conf.website_origin).expect("Failed to parse configuration origin!"); )
log::debug!(
"rp_id={} rp_origin={} rp_origin_domain={:?}",
rp_id,
rp_origin,
rp_origin.domain()
);
Self {
core: WebauthnBuilder::new(rp_id, &rp_origin)
.expect("Invalid Webauthn configuration") .expect("Invalid Webauthn configuration")
.rp_name(APP_NAME) .rp_name(APP_NAME)
.build() .build()

View File

@ -4,7 +4,6 @@ use std::sync::Arc;
use actix::Actor; use actix::Actor;
use actix_identity::config::LogoutBehaviour; use actix_identity::config::LogoutBehaviour;
use actix_identity::IdentityMiddleware; use actix_identity::IdentityMiddleware;
use actix_remote_ip::RemoteIPConfig;
use actix_session::storage::CookieSessionStore; use actix_session::storage::CookieSessionStore;
use actix_session::SessionMiddleware; use actix_session::SessionMiddleware;
use actix_web::cookie::{Key, SameSite}; use actix_web::cookie::{Key, SameSite};
@ -13,7 +12,6 @@ use actix_web::{get, middleware, web, App, HttpResponse, HttpServer};
use basic_oidc::actors::bruteforce_actor::BruteForceActor; use basic_oidc::actors::bruteforce_actor::BruteForceActor;
use basic_oidc::actors::openid_sessions_actor::OpenIDSessionsActor; use basic_oidc::actors::openid_sessions_actor::OpenIDSessionsActor;
use basic_oidc::actors::providers_states_actor::ProvidersStatesActor;
use basic_oidc::actors::users_actor::{UsersActor, UsersSyncBackend}; use basic_oidc::actors::users_actor::{UsersActor, UsersSyncBackend};
use basic_oidc::constants::*; use basic_oidc::constants::*;
use basic_oidc::controllers::assets_controller::assets_route; use basic_oidc::controllers::assets_controller::assets_route;
@ -22,7 +20,6 @@ use basic_oidc::data::app_config::AppConfig;
use basic_oidc::data::client::ClientManager; use basic_oidc::data::client::ClientManager;
use basic_oidc::data::entity_manager::EntityManager; use basic_oidc::data::entity_manager::EntityManager;
use basic_oidc::data::jwt_signer::JWTSigner; use basic_oidc::data::jwt_signer::JWTSigner;
use basic_oidc::data::provider::ProvidersManager;
use basic_oidc::data::user::User; use basic_oidc::data::user::User;
use basic_oidc::data::webauthn_manager::WebAuthManager; use basic_oidc::data::webauthn_manager::WebAuthManager;
use basic_oidc::middlewares::auth_middleware::AuthMiddleware; use basic_oidc::middlewares::auth_middleware::AuthMiddleware;
@ -71,25 +68,18 @@ async fn main() -> std::io::Result<()> {
let users_actor = UsersActor::new(users).start(); let users_actor = UsersActor::new(users).start();
let bruteforce_actor = BruteForceActor::default().start(); let bruteforce_actor = BruteForceActor::default().start();
let providers_states_actor = ProvidersStatesActor::default().start();
let openid_sessions_actor = OpenIDSessionsActor::default().start(); let openid_sessions_actor = OpenIDSessionsActor::default().start();
let jwt_signer = JWTSigner::gen_from_memory().expect("Failed to generate JWKS key"); let jwt_signer = JWTSigner::gen_from_memory().expect("Failed to generate JWKS key");
let webauthn_manager = Arc::new(WebAuthManager::init(config)); let webauthn_manager = Arc::new(WebAuthManager::init(config));
let mut clients =
ClientManager::open_or_create(config.clients_file()).expect("Failed to load clients list!");
clients.apply_environment_variables();
let clients = Arc::new(clients);
let mut providers = ProvidersManager::open_or_create(config.providers_file())
.expect("Failed to load providers list!");
providers.apply_environment_variables();
let providers = Arc::new(providers);
log::info!("Server will listen on {}", config.listen_address); log::info!("Server will listen on {}", config.listen_address);
let listen_address = config.listen_address.to_string(); let listen_address = config.listen_address.to_string();
HttpServer::new(move || { HttpServer::new(move || {
let mut clients = ClientManager::open_or_create(config.clients_file())
.expect("Failed to load clients list!");
clients.apply_environment_variables();
let session_mw = SessionMiddleware::builder( let session_mw = SessionMiddleware::builder(
CookieSessionStore::default(), CookieSessionStore::default(),
Key::from(config.token_key.as_bytes()), Key::from(config.token_key.as_bytes()),
@ -108,15 +98,10 @@ async fn main() -> std::io::Result<()> {
App::new() App::new()
.app_data(web::Data::new(users_actor.clone())) .app_data(web::Data::new(users_actor.clone()))
.app_data(web::Data::new(bruteforce_actor.clone())) .app_data(web::Data::new(bruteforce_actor.clone()))
.app_data(web::Data::new(providers_states_actor.clone()))
.app_data(web::Data::new(openid_sessions_actor.clone())) .app_data(web::Data::new(openid_sessions_actor.clone()))
.app_data(web::Data::new(clients.clone())) .app_data(web::Data::new(clients))
.app_data(web::Data::new(providers.clone()))
.app_data(web::Data::new(jwt_signer.clone())) .app_data(web::Data::new(jwt_signer.clone()))
.app_data(web::Data::new(webauthn_manager.clone())) .app_data(web::Data::new(webauthn_manager.clone()))
.app_data(web::Data::new(RemoteIPConfig {
proxy: AppConfig::get().proxy_ip.clone(),
}))
.wrap( .wrap(
middleware::DefaultHeaders::new().add(("Permissions-Policy", "interest-cohort=()")), middleware::DefaultHeaders::new().add(("Permissions-Policy", "interest-cohort=()")),
) )
@ -124,7 +109,7 @@ async fn main() -> std::io::Result<()> {
.wrap(AuthMiddleware {}) .wrap(AuthMiddleware {})
.wrap(identity_middleware) .wrap(identity_middleware)
.wrap(session_mw) .wrap(session_mw)
// Main route // main route
.route( .route(
"/", "/",
web::get().to(|| async { web::get().to(|| async {
@ -134,7 +119,7 @@ async fn main() -> std::io::Result<()> {
}), }),
) )
.route("/robots.txt", web::get().to(assets_controller::robots_txt)) .route("/robots.txt", web::get().to(assets_controller::robots_txt))
// Health route // health route
.service(health) .service(health)
// Assets serving // Assets serving
.route("/assets/{path:.*}", web::get().to(assets_route)) .route("/assets/{path:.*}", web::get().to(assets_route))
@ -165,15 +150,6 @@ async fn main() -> std::io::Result<()> {
"/login/api/auth_webauthn", "/login/api/auth_webauthn",
web::post().to(login_api::auth_webauthn), web::post().to(login_api::auth_webauthn),
) )
// Providers controller
.route(
"/login_with_prov",
web::get().to(providers_controller::start_login),
)
.route(
OIDC_PROVIDER_CB_URI,
web::get().to(providers_controller::finish_login),
)
// Settings routes // Settings routes
.route( .route(
"/settings", "/settings",
@ -230,10 +206,6 @@ async fn main() -> std::io::Result<()> {
"/admin/clients", "/admin/clients",
web::get().to(admin_controller::clients_route), web::get().to(admin_controller::clients_route),
) )
.route(
"/admin/providers",
web::get().to(admin_controller::providers_route),
)
.route("/admin/users", web::get().to(admin_controller::users_route)) .route("/admin/users", web::get().to(admin_controller::users_route))
.route( .route(
"/admin/users", "/admin/users",

View File

@ -1,4 +1,5 @@
pub mod crypt_utils; pub mod crypt_utils;
pub mod err; pub mod err;
pub mod network_utils;
pub mod string_utils; pub mod string_utils;
pub mod time; pub mod time;

178
src/utils/network_utils.rs Normal file
View File

@ -0,0 +1,178 @@
use std::net::{IpAddr, Ipv6Addr};
use std::str::FromStr;
use actix_web::HttpRequest;
/// Check if two ips matches
pub fn match_ip(pattern: &str, ip: &str) -> bool {
if pattern.eq(ip) {
return true;
}
if pattern.ends_with('*') && ip.starts_with(&pattern.replace('*', "")) {
return true;
}
false
}
/// Get the remote IP address
pub fn get_remote_ip(req: &HttpRequest, proxy_ip: Option<&str>) -> IpAddr {
let mut ip = req.peer_addr().unwrap().ip();
// We check if the request comes from a trusted reverse proxy
if let Some(proxy) = proxy_ip.as_ref() {
if match_ip(proxy, &ip.to_string()) {
if let Some(header) = req.headers().get("X-Forwarded-For") {
let header = header.to_str().unwrap();
let remote_ip = if let Some((upstream_ip, _)) = header.split_once(',') {
upstream_ip
} else {
header
};
if let Some(upstream_ip) = parse_ip(remote_ip) {
ip = upstream_ip;
}
}
}
}
ip
}
/// Parse an IP address
pub fn parse_ip(ip: &str) -> Option<IpAddr> {
let mut ip = match IpAddr::from_str(ip) {
Ok(ip) => ip,
Err(e) => {
log::warn!("Failed to parse an IP address: {}", e);
return None;
}
};
if let IpAddr::V6(ipv6) = &mut ip {
let mut octets = ipv6.octets();
for o in octets.iter_mut().skip(8) {
*o = 0;
}
ip = IpAddr::V6(Ipv6Addr::from(octets));
}
Some(ip)
}
#[cfg(test)]
mod test {
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr};
use std::str::FromStr;
use actix_web::test::TestRequest;
use crate::utils::network_utils::{get_remote_ip, parse_ip};
#[test]
fn test_get_remote_ip() {
let req = TestRequest::default()
.peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
.to_http_request();
assert_eq!(
get_remote_ip(&req, None),
"192.168.1.1".parse::<IpAddr>().unwrap()
);
}
#[test]
fn test_get_remote_ip_from_proxy() {
let req = TestRequest::default()
.peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
.insert_header(("X-Forwarded-For", "1.1.1.1"))
.to_http_request();
assert_eq!(
get_remote_ip(&req, Some("192.168.1.1")),
"1.1.1.1".parse::<IpAddr>().unwrap()
);
}
#[test]
fn test_get_remote_ip_from_proxy_2() {
let req = TestRequest::default()
.peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
.insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2"))
.to_http_request();
assert_eq!(
get_remote_ip(&req, Some("192.168.1.1")),
"1.1.1.1".parse::<IpAddr>().unwrap()
);
}
#[test]
fn test_get_remote_ip_from_proxy_ipv6() {
let req = TestRequest::default()
.peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
.insert_header(("X-Forwarded-For", "10::1, 1.2.2.2"))
.to_http_request();
assert_eq!(
get_remote_ip(&req, Some("192.168.1.1")),
"10::".parse::<IpAddr>().unwrap()
);
}
#[test]
fn test_get_remote_ip_from_no_proxy() {
let req = TestRequest::default()
.peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
.insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2"))
.to_http_request();
assert_eq!(
get_remote_ip(&req, None),
"192.168.1.1".parse::<IpAddr>().unwrap()
);
}
#[test]
fn test_get_remote_ip_from_other_proxy() {
let req = TestRequest::default()
.peer_addr(SocketAddr::from_str("192.168.1.1:1000").unwrap())
.insert_header(("X-Forwarded-For", "1.1.1.1, 1.2.2.2"))
.to_http_request();
assert_eq!(
get_remote_ip(&req, Some("192.168.1.2")),
"192.168.1.1".parse::<IpAddr>().unwrap()
);
}
#[test]
fn parse_bad_ip() {
let ip = parse_ip("badbad");
assert_eq!(None, ip);
}
#[test]
fn parse_ip_v4_address() {
let ip = parse_ip("192.168.1.1").unwrap();
assert_eq!(ip, IpAddr::V4(Ipv4Addr::new(192, 168, 1, 1)));
}
#[test]
fn parse_ip_v6_address() {
let ip = parse_ip("2a00:1450:4007:813::200e").unwrap();
assert_eq!(
ip,
IpAddr::V6(Ipv6Addr::new(0x2a00, 0x1450, 0x4007, 0x813, 0, 0, 0, 0))
);
}
#[test]
fn parse_ip_v6_address_2() {
let ip = parse_ip("::1").unwrap();
assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0, 0, 0, 0, 0, 0, 0, 0)));
}
#[test]
fn parse_ip_v6_address_3() {
let ip = parse_ip("a::1").unwrap();
assert_eq!(ip, IpAddr::V6(Ipv6Addr::new(0xa, 0, 0, 0, 0, 0, 0, 0)));
}
}

View File

@ -24,8 +24,8 @@ pub fn apply_env_vars(val: &str) -> String {
let value = match std::env::var(varname) { let value = match std::env::var(varname) {
Ok(v) => v, Ok(v) => v,
Err(e) => { Err(e) => {
log::error!("Failed to find environment variable {varname}!"); log::error!("Failed to find environment variable {}!", varname);
eprintln!("Failed to find environment variable! {e:?}"); eprintln!("Failed to find environment variable! {:?}", e);
std::process::exit(2); std::process::exit(2);
} }
}; };
@ -36,14 +36,9 @@ pub fn apply_env_vars(val: &str) -> String {
val val
} }
/// Check out whether a given login is acceptable or not
pub fn is_acceptable_login(login: &str) -> bool {
mailchecker::is_valid(login) || lazy_regex::regex!("^[a-zA-Z0-9-+]+$").is_match(login)
}
#[cfg(test)] #[cfg(test)]
mod test { mod test {
use crate::utils::string_utils::{apply_env_vars, is_acceptable_login}; use crate::utils::string_utils::apply_env_vars;
use std::env; use std::env;
const VAR_ONE: &str = "VAR_ONE"; const VAR_ONE: &str = "VAR_ONE";
@ -61,12 +56,4 @@ mod test {
let src = format!("This is ${{{}}}", VAR_INVALID); let src = format!("This is ${{{}}}", VAR_INVALID);
assert_eq!(src, apply_env_vars(&src)); assert_eq!(src, apply_env_vars(&src));
} }
#[test]
fn test_is_acceptable_login() {
assert!(is_acceptable_login("admin"));
assert!(is_acceptable_login("someone@somewhere.fr"));
assert!(!is_acceptable_login("someone@somewhere.#fr"));
assert!(!is_acceptable_login("bad bad"));
}
} }

View File

@ -1,4 +1,4 @@
use chrono::DateTime; use chrono::{DateTime, NaiveDateTime, Utc};
use std::time::{SystemTime, UNIX_EPOCH}; use std::time::{SystemTime, UNIX_EPOCH};
/// Get the current time since epoch /// Get the current time since epoch
@ -11,25 +11,13 @@ pub fn time() -> u64 {
/// Format unix timestamp to a human-readable string /// Format unix timestamp to a human-readable string
pub fn fmt_time(timestamp: u64) -> String { pub fn fmt_time(timestamp: u64) -> String {
// Create a DateTime from the timestamp // Create a NaiveDateTime from the timestamp
let datetime = let naive =
DateTime::from_timestamp(timestamp as i64, 0).expect("Failed to parse timestamp!"); NaiveDateTime::from_timestamp_opt(timestamp as i64, 0).expect("Failed to parse timestamp!");
// Create a normal DateTime from the NaiveDateTime
let datetime: DateTime<Utc> = DateTime::from_utc(naive, Utc);
// Format the datetime how you want // Format the datetime how you want
datetime.format("%Y-%m-%d %H:%M:%S").to_string() datetime.format("%Y-%m-%d %H:%M:%S").to_string()
} }
#[cfg(test)]
mod test {
use crate::utils::time::{fmt_time, time};
#[test]
fn test_time() {
assert!(time() > 10);
}
#[test]
fn test_fmt_time() {
assert_eq!(fmt_time(1693475465), "2023-08-31 09:51:05");
}
}

View File

@ -8,7 +8,7 @@
<!-- No indexing --> <!-- No indexing -->
<meta name="robots" content="noindex, nofollow"> <meta name="robots" content="noindex, nofollow">
<title>{{ p.app_name }} - {{ p.page_title }}</title> <title>{{ _p.app_name }} - {{ _p.page_title }}</title>
<!-- Bootstrap core CSS --> <!-- Bootstrap core CSS -->
<link href="/assets/css/bootstrap.css" rel="stylesheet" crossorigin="anonymous"/> <link href="/assets/css/bootstrap.css" rel="stylesheet" crossorigin="anonymous"/>
@ -30,6 +30,8 @@
font-size: 3.5rem; font-size: 3.5rem;
} }
} }
</style> </style>
@ -43,15 +45,15 @@
<main class="form-signin"> <main class="form-signin">
<h1 class="h3 mb-3 fw-normal" style="margin-bottom: 2rem !important;">{{ p.page_title }}</h1> <h1 class="h3 mb-3 fw-normal">{{ _p.page_title }}</h1>
{% if let Some(danger) = p.danger %} {% if let Some(danger) = _p.danger %}
<div class="alert alert-danger" role="alert"> <div class="alert alert-danger" role="alert">
{{ danger }} {{ danger }}
</div> </div>
{% endif %} {% endif %}
{% if let Some(success) = p.success %} {% if let Some(success) = _p.success %}
<div class="alert alert-success" role="alert"> <div class="alert alert-success" role="alert">
{{ success }} {{ success }}
</div> </div>

View File

@ -5,16 +5,14 @@
<p>You need to validate a second factor to complete your login.</p> <p>You need to validate a second factor to complete your login.</p>
{% for factor in user.get_distinct_factors_types() %} {% for factor in user.get_distinct_factors_types() %}
<!-- We can ask to force 2FA, because once we are here, it means 2FA is required anyway... --> <a class="btn btn-primary btn-lg" href="{{ factor.login_url(_p.redirect_uri) }}" style="width: 100%; display: flex;">
<a class="btn btn-primary btn-lg" href="{{ factor.login_url(p.redirect_uri, true) }}" <img src="{{ factor.type_image() }}" alt="Factor icon" style="margin-right: 1em;" />
style="width: 100%; display: flex;">
<img src="{{ factor.type_image() }}" alt="Factor icon" style="margin-right: 1em;"/>
<div style="text-align: left;"> <div style="text-align: left;">
{{ factor.type_str() }} <br/> {{ factor.type_str() }} <br/>
<small style="font-size: 0.7em;">{{ factor.description_str() }}</small> <small style="font-size: 0.7em;">{{ factor.description_str() }}</small>
</div> </div>
</a> </a>
<br/> <br />
{% endfor %} {% endfor %}
</div> </div>

View File

@ -1,24 +1,6 @@
{% extends "base_login_page.html" %} {% extends "base_login_page.html" %}
{% block content %} {% block content %}
<style> <form action="/login?redirect={{ _p.redirect_uri.get_encoded() }}" method="post">
#providers {
margin-top: 40px;
}
.provider-button {
width: 100%;
display: flex;
margin-top: 10px;
}
.provider-button img {
margin-right: 1em;
width: 1em;
}
</style>
<form action="/login?redirect={{ p.redirect_uri.get_encoded() }}" method="post">
<div> <div>
<div class="form-floating"> <div class="form-floating">
<input name="login" type="text" required class="form-control" id="floatingName" placeholder="unsername" <input name="login" type="text" required class="form-control" id="floatingName" placeholder="unsername"
@ -37,18 +19,4 @@
</form> </form>
<!-- Upstream providers -->
{% if !providers.is_empty() %}
<div id="providers">
{% for prov in providers %}
<a class="btn btn-secondary btn-lg provider-button" href="{{ prov.login_url(p.redirect_uri) }}">
<img src="{{ prov.logo_url() }}" alt="Provider icon"/>
<div style="text-align: left;">
Login using {{ prov.name }} <br/>
</div>
</a>
{% endfor %}
</div>
{% endif %}
{% endblock content %} {% endblock content %}

View File

@ -28,7 +28,7 @@
<div style="margin-top: 10px;"> <div style="margin-top: 10px;">
<a href="/2fa_auth?force_display=true&redirect={{ p.redirect_uri.get_encoded() }}&force_2fa=true">Sign in using another factor</a><br/> <a href="/2fa_auth?force_display=true&redirect={{ _p.redirect_uri.get_encoded() }}">Sign in using another factor</a><br/>
<a href="/logout">Sign out</a> <a href="/logout">Sign out</a>
</div> </div>

View File

@ -1,6 +1,6 @@
{% extends "base_login_page.html" %} {% extends "base_login_page.html" %}
{% block content %} {% block content %}
<form action="/reset_password?redirect={{ p.redirect_uri.get_encoded() }}" method="post" id="reset_password_form"> <form action="/reset_password?redirect={{ _p.redirect_uri.get_encoded() }}" method="post" id="reset_password_form">
<div> <div>
<p>You need to configure a new password:</p> <p>You need to configure a new password:</p>

View File

@ -1,13 +0,0 @@
{% extends "base_login_page.html" %}
{% block content %}
<div class="alert alert-danger" style="margin-bottom: 10px;">
<strong>Authentication failed!</strong>
<p style="margin-top: 10px; text-align: justify;">{{ message }}</p>
</div>
<a href="/login?redirect={{ p.redirect_uri.get_encoded() }}">Go back to login</a>
{% endblock content %}

View File

@ -12,13 +12,13 @@
</div> </div>
<div style="margin-top: 10px;"> <div style="margin-top: 10px;">
<a href="/2fa_auth?force_display=true&redirect={{ p.redirect_uri.get_encoded() }}&force_2fa=true">Sign in using another factor</a><br/> <a href="/2fa_auth?force_display=true&redirect={{ _p.redirect_uri.get_encoded() }}">Sign in using another factor</a><br/>
<a href="/logout">Sign out</a> <a href="/logout">Sign out</a>
</div> </div>
<script src="/assets/js/base64_lib.js"></script> <script src="/assets/js/base64_lib.js"></script>
<script> <script>
const REDIRECT_URI = decodeURIComponent("{{ p.redirect_uri.get_encoded() }}"); const REDIRECT_URI = decodeURIComponent("{{ _p.redirect_uri.get_encoded() }}");
const OPAQUE_STATE = "{{ opaque_state }}"; const OPAQUE_STATE = "{{ opaque_state }}";
const AUTH_CHALLENGE = JSON.parse(decodeURIComponent("{{ challenge_json }}")); const AUTH_CHALLENGE = JSON.parse(decodeURIComponent("{{ challenge_json }}"));
// Decode data // Decode data

View File

@ -5,31 +5,29 @@
<tbody> <tbody>
<tr> <tr>
<th scope="row">User ID</th> <th scope="row">User ID</th>
<td>{{ p.user.uid.0 }}</td> <td>{{ u.uid.0 }}</td>
</tr> </tr>
<tr> <tr>
<th scope="row">First name</th> <th scope="row">First name</th>
<td>{{ p.user.first_name }}</td> <td>{{ u.first_name }}</td>
</tr> </tr>
<tr> <tr>
<th scope="row">Last name</th> <th scope="row">Last name</th>
<td>{{ p.user.last_name }}</td> <td>{{ u.last_name }}</td>
</tr> </tr>
<tr> <tr>
<th scope="row">Username</th> <th scope="row">Username</th>
<td>{{ p.user.username }}</td> <td>{{ u.username }}</td>
</tr> </tr>
<tr> <tr>
<th scope="row">Email</th> <th scope="row">Email</th>
<td>{{ p.user.email }}</td> <td>{{ u.email }}</td>
</tr> </tr>
<tr> <tr>
<th scope="row">Account type</th> <th scope="row">Account type</th>
<td>{% if p.user.admin %}Admin{% else %}Regular user{% endif %}</td> <td>{% if u.admin %}Admin{% else %}Regular user{% endif %}</td>
</tr> </tr>
</tbody> </tbody>
</table> </table>
<p>Your IP address: {{ remote_ip }}</p>
{% endblock content %} {% endblock content %}

View File

@ -2,7 +2,7 @@
<html lang="en"> <html lang="en">
<head> <head>
<meta charset="UTF-8"> <meta charset="UTF-8">
<title>{{ p.page_title }} - {{ p.app_name }}</title> <title>{{ _p.page_title }} - {{ _p.app_name }}</title>
<!-- Bootstrap core CSS --> <!-- Bootstrap core CSS -->
<link href="/assets/css/bootstrap.css" rel="stylesheet" crossorigin="anonymous"/> <link href="/assets/css/bootstrap.css" rel="stylesheet" crossorigin="anonymous"/>
@ -12,10 +12,10 @@
<body> <body>
<div class="d-flex flex-column flex-shrink-0 p-3 bg-light" style="width: 280px;"> <div class="d-flex flex-column flex-shrink-0 p-3 bg-light" style="width: 280px;">
<a href="/" class="d-flex align-items-center mb-3 mb-md-0 me-md-auto link-dark text-decoration-none"> <a href="/" class="d-flex align-items-center mb-3 mb-md-0 me-md-auto link-dark text-decoration-none">
<span class="fs-4">{{ p.app_name }}</span> <span class="fs-4">{{ _p.app_name }}</span>
</a> </a>
{% if p.user.admin %} {% if _p.is_admin %}
<span>Version {{ p.version }}</span> <span>Version {{ _p.version }}</span>
{% endif %} {% endif %}
<hr> <hr>
<ul class="nav nav-pills flex-column mb-auto"> <ul class="nav nav-pills flex-column mb-auto">
@ -24,31 +24,24 @@
Account details Account details
</a> </a>
</li> </li>
{% if p.user.allow_local_login %}
<li> <li>
<a href="/settings/change_password" class="nav-link link-dark"> <a href="/settings/change_password" class="nav-link link-dark">
Change password Change password
</a> </a>
</li> </li>
{% endif %}
<li> <li>
<a href="/settings/two_factors" class="nav-link link-dark"> <a href="/settings/two_factors" class="nav-link link-dark">
Two-factor authentication Two-factor authentication
</a> </a>
</li> </li>
{% if p.user.admin %} {% if _p.is_admin %}
<hr/> <hr/>
<li> <li>
<a href="/admin/clients" class="nav-link link-dark"> <a href="/admin/clients" class="nav-link link-dark">
Clients Clients
</a> </a>
</li> </li>
<li>
<a href="/admin/providers" class="nav-link link-dark">
Providers
</a>
</li>
<li> <li>
<a href="/admin/users" class="nav-link link-dark"> <a href="/admin/users" class="nav-link link-dark">
Users Users
@ -61,7 +54,7 @@
<a href="#" class="d-flex align-items-center link-dark text-decoration-none dropdown-toggle" id="dropdownUser" <a href="#" class="d-flex align-items-center link-dark text-decoration-none dropdown-toggle" id="dropdownUser"
data-bs-toggle="dropdown" aria-expanded="false"> data-bs-toggle="dropdown" aria-expanded="false">
<img src="/assets/img/account.png" alt="" width="32" height="32" class="rounded-circle me-2"> <img src="/assets/img/account.png" alt="" width="32" height="32" class="rounded-circle me-2">
<strong>{{ p.user.username }}</strong> <strong>{{ _p.user_name }}</strong>
</a> </a>
<ul class="dropdown-menu text-small shadow" aria-labelledby="dropdownUser"> <ul class="dropdown-menu text-small shadow" aria-labelledby="dropdownUser">
<li><a class="dropdown-item" href="/logout">Sign out</a></li> <li><a class="dropdown-item" href="/logout">Sign out</a></li>
@ -70,14 +63,14 @@
</div> </div>
<div class="page_body" style="flex: 1"> <div class="page_body" style="flex: 1">
{% if let Some(msg) = p.danger_message %} {% if let Some(msg) = _p.danger_message %}
<div class="alert alert-danger">{{ msg }}</div> <div class="alert alert-danger">{{ msg }}</div>
{% endif %} {% endif %}
{% if let Some(msg) = p.success_message %} {% if let Some(msg) = _p.success_message %}
<div class="alert alert-success">{{ msg }}</div> <div class="alert alert-success">{{ msg }}</div>
{% endif %} {% endif %}
<h2 class="bd-title mt-0" style="margin-bottom: 40px;">{{ p.page_title }}</h2> <h2 class="bd-title mt-0" style="margin-bottom: 40px;">{{ _p.page_title }}</h2>
{% block content %} {% block content %}
TO_REPLACE TO_REPLACE
@ -90,10 +83,9 @@
if(el.href === location.href) el.classList.add("active"); if(el.href === location.href) el.classList.add("active");
else el.classList.remove("active") else el.classList.remove("active")
}) })
</script> </script>
{% if p.ip_location_api.is_some() %} {% if _p.ip_location_api.is_some() %}
<script>const IP_LOCATION_API = "{{ p.ip_location_api.unwrap() }}"</script> <script>const IP_LOCATION_API = "{{ _p.ip_location_api.unwrap() }}"</script>
{% endif %} {% endif %}
<script src="/assets/js/ip_location_service.js"></script> <script src="/assets/js/ip_location_service.js"></script>
</body> </body>

View File

@ -8,8 +8,6 @@
<th scope="col">Name</th> <th scope="col">Name</th>
<th scope="col">Description</th> <th scope="col">Description</th>
<th scope="col">Redirect URI</th> <th scope="col">Redirect URI</th>
<th scope="col">Default</th>
<th scope="col">Granted to all users</th>
</tr> </tr>
</thead> </thead>
<tbody> <tbody>
@ -19,8 +17,6 @@
<td>{{ c.name }}</td> <td>{{ c.name }}</td>
<td>{{ c.description }}</td> <td>{{ c.description }}</td>
<td>{{ c.redirect_uri }}</td> <td>{{ c.redirect_uri }}</td>
<td>{% if c.default %}YES{% else %}NO{% endif %}</td>
<td>{% if c.granted_to_all_users %}YES{% else %}NO{% endif %}</td>
</tr> </tr>
{% endfor %} {% endfor %}
</tbody> </tbody>

View File

@ -113,60 +113,27 @@
<ul> <ul>
{% for e in u.get_formatted_2fa_successful_logins() %} {% for e in u.get_formatted_2fa_successful_logins() %}
{% if e.can_bypass_2fa %} {% if e.can_bypass_2fa %}<li style="font-weight: bold;">{{ e.ip }} - {{ e.fmt_time() }} - BYPASS 2FA</li>
<li style="font-weight: bold;">{{ e.ip }} - {{ e.fmt_time() }} - BYPASS 2FA</li> {% else %}<li>{{ e.ip }} - {{ e.fmt_time() }}</li>{% endif %}
{% else %}
<li>{{ e.ip }} - {{ e.fmt_time() }}</li>
{% endif %}
{% endfor %} {% endfor %}
</ul> </ul>
</fieldset> </fieldset>
{% endif %} {% endif %}
<!-- Authorized authentication sources -->
<fieldset class="form-group">
<legend class="mt-4">Authorized authentication sources</legend>
<!-- Local login -->
<div class="form-check">
<input class="form-check-input" type="checkbox" name="allow_local_login" id="allow_local_login"
{% if u.allow_local_login %} checked="" {% endif %}>
<label class="form-check-label" for="allow_local_login">
Allow local login
</label>
</div>
<!-- Upstream providers -->
<input type="hidden" name="authorized_sources" id="authorized_sources"/>
{% for prov in providers %}
<div class="form-check">
<input class="form-check-input authorized_provider" type="checkbox" name="prov-{{ prov.id.0 }}"
id="prov-{{ prov.id.0 }}"
data-id="{{ prov.id.0 }}"
{% if u.can_login_from_provider(prov) %} checked="" {% endif %}>
<label class="form-check-label" for="prov-{{ prov.id.0 }}">
Allow login from {{ prov.name }}
</label>
</div>
{% endfor %}
</fieldset>
<!-- Granted clients --> <!-- Granted clients -->
<fieldset class="form-group"> <fieldset class="form-group">
<legend class="mt-4">Granted clients</legend> <legend class="mt-4">Granted clients</legend>
<div class="form-check"> <div class="form-check">
<label class="form-check-label"> <label class="form-check-label">
<input type="radio" class="form-check-input" name="grant_type" <input type="radio" class="form-check-input" name="grant_type"
value="all_clients" {% if u.granted_clients()== GrantedClients::AllClients %} checked="" {% endif value="all_clients" {% if u.granted_clients() == GrantedClients::AllClients %} checked="" {% endif %}>
%}>
Grant all clients Grant all clients
</label> </label>
</div> </div>
<div class="form-check"> <div class="form-check">
<label class="form-check-label"> <label class="form-check-label">
<input type="radio" class="form-check-input" name="grant_type" <input type="radio" class="form-check-input" name="grant_type"
value="custom_clients" {% if matches!(self.u.granted_clients(), GrantedClients::SomeClients(_)) value="custom_clients" {% if matches!(self.u.granted_clients(), GrantedClients::SomeClients(_)) %} checked="checked" {% endif %}>
%} checked="checked" {% endif %}>
Manually specify allowed clients Manually specify allowed clients
</label> </label>
</div> </div>
@ -177,7 +144,7 @@
<div class="form-check"> <div class="form-check">
<input id="client-{{ c.id.0 }}" class="form-check-input authorize_client_checkbox" type="checkbox" <input id="client-{{ c.id.0 }}" class="form-check-input authorize_client_checkbox" type="checkbox"
data-id="{{ c.id.0 }}" data-id="{{ c.id.0 }}"
{% if u.can_access_app(c) %} checked="" {% endif %}> {% if u.can_access_app(c.id) %} checked="" {% endif %}>
<label class="form-check-label" for="client-{{ c.id.0 }}"> <label class="form-check-label" for="client-{{ c.id.0 }}">
{{ c.name }} {{ c.name }}
</label> </label>
@ -188,14 +155,13 @@
<div class="form-check"> <div class="form-check">
<label class="form-check-label"> <label class="form-check-label">
<input type="radio" class="form-check-input" name="grant_type" <input type="radio" class="form-check-input" name="grant_type"
value="no_client" {% if u.granted_clients()== GrantedClients::NoClient %} checked="checked" {% value="no_client" {% if u.granted_clients() == GrantedClients::NoClient %} checked="checked" {% endif %}>
endif %}>
Do not grant any client Do not grant any client
</label> </label>
</div> </div>
</fieldset> </fieldset>
<input type="submit" class="btn btn-primary mt-4" value="{{ p.page_title }}"> <input type="submit" class="btn btn-primary mt-4" value="{{ _p.page_title }}">
</form> </form>
<script> <script>
@ -249,13 +215,6 @@
form.addEventListener("submit", (ev) => { form.addEventListener("submit", (ev) => {
ev.preventDefault(); ev.preventDefault();
const authorized_sources = [...document.querySelectorAll(".authorized_provider")]
.filter(e => e.checked)
.map(e => e.getAttribute("data-id")).join(",")
document.querySelector("input[name=authorized_sources]").value = authorized_sources;
const authorized_clients = [...document.querySelectorAll(".authorize_client_checkbox")] const authorized_clients = [...document.querySelectorAll(".authorize_client_checkbox")]
.filter(e => e.checked) .filter(e => e.checked)
.map(e => e.getAttribute("data-id")).join(",") .map(e => e.getAttribute("data-id")).join(",")
@ -272,9 +231,6 @@
form.submit(); form.submit();
}); });
</script> </script>
{% endblock content %} {% endblock content %}

View File

@ -1,39 +0,0 @@
{% extends "base_settings_page.html" %}
{% block content %}
<style>
#providers td {
vertical-align: middle;
}
</style>
<table id="providers" class="table table-hover" style="max-width: 800px;" aria-describedby="OpenID providers list">
<thead>
<tr>
<th scope="col"></th>
<th scope="col">ID</th>
<th scope="col">Name</th>
<th scope="col">Configuration URL</th>
<th scope="col">Client ID</th>
</tr>
</thead>
<tbody>
{% for c in providers %}
<tr>
<td>
<img src="{{ c.logo_url() }}" alt="{{ c.name }} logo" width="30px"/>
</td>
<td>{{ c.id.0 }}</td>
<td>{{ c.name }}</td>
<td><a href="{{ c.configuration_url }}" target="_blank" rel="noreferrer">
{{ c.configuration_url }}
</a></td>
<td>{{ c.client_id }}</td>
</tr>
{% endfor %}
</tbody>
</table>
<p>Redirect URL for new clients: {{ redirect_url }}</p>
{% endblock content %}

View File

@ -26,9 +26,7 @@
<tbody> <tbody>
{% for f in user.two_factor %} {% for f in user.two_factor %}
<tr id="factor-{{ f.id.0 }}"> <tr id="factor-{{ f.id.0 }}">
<td><img src="{{ f.type_image() }}" alt="Factor icon" style="height: 1.5em; margin-right: 0.5em;"/>{{ <td><img src="{{ f.type_image() }}" alt="Factor icon" style="height: 1.5em; margin-right: 0.5em;" />{{ f.type_str() }}</td>
f.type_str() }}
</td>
<td>{{ f.name }}</td> <td>{{ f.name }}</td>
<td><a href="javascript:delete_factor('{{ f.id.0 }}');">Delete</a></td> <td><a href="javascript:delete_factor('{{ f.id.0 }}');">Delete</a></td>
</tr> </tr>
@ -55,9 +53,7 @@
{% for e in user.get_formatted_2fa_successful_logins() %} {% for e in user.get_formatted_2fa_successful_logins() %}
<tr> <tr>
<td>{{ e.ip }}</td> <td>{{ e.ip }}</td>
<td> <td><locateip ip="{{ e.ip }}"></locateip></td>
<locateip ip="{{ e.ip }}"></locateip>
</td>
<td>{{ e.fmt_time() }}</td> <td>{{ e.fmt_time() }}</td>
<td>{% if e.can_bypass_2fa %}YES{% else %}NO{% endif %}</td> <td>{% if e.can_bypass_2fa %}YES{% else %}NO{% endif %}</td>
</tr> </tr>
@ -67,10 +63,6 @@
{% endif %} {% endif %}
</div> </div>
{% if let Some(last_2fa_auth) = last_2fa_auth %}
<p>Last successful 2FA authentication on this browser: {{ last_2fa_auth }}</p>
{% endif %}
<script> <script>
async function delete_factor(id) { async function delete_factor(id) {
if (!confirm("Do you really want to remove this factor?")) if (!confirm("Do you really want to remove this factor?"))
@ -92,7 +84,7 @@
if (res.status == 200) if (res.status == 200)
document.getElementById("factor-" + id).remove(); document.getElementById("factor-" + id).remove();
} catch (e) { } catch(e) {
console.error(e); console.error(e);
alert("Failed to remove factor!"); alert("Failed to remove factor!");
} }
@ -112,7 +104,7 @@
if (res.status == 200) if (res.status == 200)
document.getElementById("2fa_history_container").remove(); document.getElementById("2fa_history_container").remove();
} catch (e) { } catch(e) {
console.error(e); console.error(e);
alert("Failed to clear 2FA history!"); alert("Failed to clear 2FA history!");
} }