author | Jonas Schäfer <jonas@wielicki.name> |
Tue, 28 Mar 2023 21:25:54 +0200 | |
changeset 13010 | d943733c6d01 |
parent 13007 | 34ed17ef1c1a |
child 13013 | a70ff0c524c9 |
permissions | -rw-r--r-- |
12981
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
1 |
local base64 = require "prosody.util.encodings".base64; |
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
2 |
local hashes = require "prosody.util.hashes"; |
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
3 |
local id = require "prosody.util.id"; |
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
4 |
local jid = require "prosody.util.jid"; |
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
5 |
local random = require "prosody.util.random"; |
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
6 |
local usermanager = require "prosody.core.usermanager"; |
74b9e05af71e
plugins: Prefix module imports with prosody namespace
Kim Alvefur <zash@zash.se>
parents:
12963
diff
changeset
|
7 |
local generate_identifier = require "prosody.util.id".short; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
8 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
9 |
local token_store = module:open_store("auth_tokens", "keyval+"); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
10 |
|
12984
6ebad8e16b3b
mod_tokenauth: Track last access time (last time a token was used)
Matthew Wild <mwild1@gmail.com>
parents:
12981
diff
changeset
|
11 |
local access_time_granularity = module:get_option_number("token_auth_access_time_granularity", 60); |
6ebad8e16b3b
mod_tokenauth: Track last access time (last time a token was used)
Matthew Wild <mwild1@gmail.com>
parents:
12981
diff
changeset
|
12 |
|
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
13 |
local function select_role(username, host, role) |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
14 |
if role then |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
15 |
return prosody.hosts[host].authz.get_role_by_name(role); |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
16 |
end |
12666
07424992d7fc
mod_authz_internal, and more: New iteration of role API
Matthew Wild <mwild1@gmail.com>
parents:
12653
diff
changeset
|
17 |
return usermanager.get_user_role(username, host); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
18 |
end |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
19 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
20 |
function create_grant(actor_jid, grant_jid, grant_ttl, grant_data) |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
21 |
grant_jid = jid.prep(grant_jid); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
22 |
if not actor_jid or actor_jid ~= grant_jid and not jid.compare(grant_jid, actor_jid) then |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
23 |
module:log("debug", "Actor <%s> is not permitted to create a token granting access to JID <%s>", actor_jid, grant_jid); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
24 |
return nil, "not-authorized"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
25 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
26 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
27 |
local grant_username, grant_host, grant_resource = jid.split(grant_jid); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
28 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
29 |
if grant_host ~= module.host then |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
30 |
return nil, "invalid-host"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
31 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
32 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
33 |
local grant_id = id.short(); |
12984
6ebad8e16b3b
mod_tokenauth: Track last access time (last time a token was used)
Matthew Wild <mwild1@gmail.com>
parents:
12981
diff
changeset
|
34 |
local now = os.time(); |
6ebad8e16b3b
mod_tokenauth: Track last access time (last time a token was used)
Matthew Wild <mwild1@gmail.com>
parents:
12981
diff
changeset
|
35 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
36 |
local grant = { |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
37 |
id = grant_id; |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
38 |
|
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
39 |
owner = actor_jid; |
12984
6ebad8e16b3b
mod_tokenauth: Track last access time (last time a token was used)
Matthew Wild <mwild1@gmail.com>
parents:
12981
diff
changeset
|
40 |
created = now; |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
41 |
expires = grant_ttl and (now + grant_ttl) or nil; |
12984
6ebad8e16b3b
mod_tokenauth: Track last access time (last time a token was used)
Matthew Wild <mwild1@gmail.com>
parents:
12981
diff
changeset
|
42 |
accessed = now; |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
43 |
|
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
44 |
jid = grant_jid; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
45 |
resource = grant_resource; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
46 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
47 |
data = grant_data; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
48 |
|
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
49 |
-- tokens[<hash-name>..":"..<secret>] = token_info |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
50 |
tokens = {}; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
51 |
}; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
52 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
53 |
local ok, err = token_store:set_key(grant_username, grant_id, grant); |
13000
e8716515405e
mod_tokenauth: return error if storage of new token fails
Matthew Wild <mwild1@gmail.com>
parents:
12984
diff
changeset
|
54 |
if not ok then |
e8716515405e
mod_tokenauth: return error if storage of new token fails
Matthew Wild <mwild1@gmail.com>
parents:
12984
diff
changeset
|
55 |
return nil, err; |
e8716515405e
mod_tokenauth: return error if storage of new token fails
Matthew Wild <mwild1@gmail.com>
parents:
12984
diff
changeset
|
56 |
end |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
57 |
|
13007
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
58 |
module:fire_event("token-grant-created", { |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
59 |
id = grant_id; |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
60 |
grant = grant; |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
61 |
username = grant_username; |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
62 |
host = grant_host; |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
63 |
}); |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
64 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
65 |
return grant; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
66 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
67 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
68 |
function create_token(grant_jid, grant, token_role, token_ttl, token_purpose, token_data) |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
69 |
if (token_data and type(token_data) ~= "table") or (token_purpose and type(token_purpose) ~= "string") then |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
70 |
return nil, "bad-request"; |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
71 |
end |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
72 |
local grant_username, grant_host = jid.split(grant_jid); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
73 |
if grant_host ~= module.host then |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
74 |
return nil, "invalid-host"; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
75 |
end |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
76 |
if type(grant) == "string" then -- lookup by id |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
77 |
grant = token_store:get_key(grant_username, grant); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
78 |
if not grant then return nil; end |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
79 |
end |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
80 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
81 |
if not grant.tokens then return nil, "internal-server-error"; end -- old-style token? |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
82 |
|
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
83 |
local now = os.time(); |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
84 |
local expires = grant.expires; -- Default to same expiry as grant |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
85 |
if token_ttl then -- explicit lifetime requested |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
86 |
if expires then |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
87 |
-- Grant has an expiry, so limit to that or shorter |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
88 |
expires = math.min(now + token_ttl, expires); |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
89 |
else |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
90 |
-- Grant never expires, just use whatever expiry is requested for the token |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
91 |
expires = now + token_ttl; |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
92 |
end |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
93 |
end |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
94 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
95 |
local token_info = { |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
96 |
role = token_role; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
97 |
|
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
98 |
created = now; |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
99 |
expires = expires; |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
100 |
purpose = token_purpose; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
101 |
|
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
102 |
data = token_data; |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
103 |
}; |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
104 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
105 |
local token_secret = random.bytes(18); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
106 |
grant.tokens["sha256:"..hashes.sha256(token_secret, true)] = token_info; |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
107 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
108 |
local ok, err = token_store:set_key(grant_username, grant.id, grant); |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
109 |
if not ok then |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
110 |
return nil, err; |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
111 |
end |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
112 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
113 |
local token_string = "secret-token:"..base64.encode("2;"..grant.id..";"..token_secret..";"..grant.jid); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
114 |
return token_string, token_info; |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
115 |
end |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
116 |
|
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
117 |
local function parse_token(encoded_token) |
12921
e4de42495fb7
mod_tokenauth: Gracefully handle missing tokens
Matthew Wild <mwild1@gmail.com>
parents:
12919
diff
changeset
|
118 |
if not encoded_token then return nil; end |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
119 |
local encoded_data = encoded_token:match("^secret%-token:(.+)$"); |
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
120 |
if not encoded_data then return nil; end |
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
121 |
local token = base64.decode(encoded_data); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
122 |
if not token then return nil; end |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
123 |
local token_id, token_secret, token_jid = token:match("^2;([^;]+);([^;]+);(.+)$"); |
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
124 |
if not token_id then return nil; end |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
125 |
local token_user, token_host = jid.split(token_jid); |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
126 |
return token_id, token_user, token_host, token_secret; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
127 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
128 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
129 |
local function clear_expired_grant_tokens(grant, now) |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
130 |
local updated; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
131 |
now = now or os.time(); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
132 |
for secret, token_info in pairs(grant.tokens) do |
13003
c87ac7d1967f
mod_tokenauth: Fix traceback when checking expiry of tokens with no expiry
Matthew Wild <mwild1@gmail.com>
parents:
13002
diff
changeset
|
133 |
local expires = token_info.expires; |
c87ac7d1967f
mod_tokenauth: Fix traceback when checking expiry of tokens with no expiry
Matthew Wild <mwild1@gmail.com>
parents:
13002
diff
changeset
|
134 |
if expires and expires < now then |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
135 |
grant.tokens[secret] = nil; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
136 |
updated = true; |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
137 |
end |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
138 |
end |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
139 |
return updated; |
13001
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
140 |
end |
0a56b84ec4ad
mod_tokenauth: Support for creating sub-tokens
Matthew Wild <mwild1@gmail.com>
parents:
13000
diff
changeset
|
141 |
|
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
142 |
local function _get_validated_token_info(token_id, token_user, token_host, token_secret) |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
143 |
if token_host ~= module.host then |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
144 |
return nil, "invalid-host"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
145 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
146 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
147 |
local grant, err = token_store:get_key(token_user, token_id); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
148 |
if not grant or not grant.tokens then |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
149 |
if err then |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
150 |
module:log("error", "Unable to read from token storage: %s", err); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
151 |
return nil, "internal-error"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
152 |
end |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
153 |
module:log("warn", "Invalid token in storage (%s / %s)", token_user, token_id); |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
154 |
return nil, "not-authorized"; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
155 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
156 |
|
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
157 |
-- Check provided secret |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
158 |
local secret_hash = "sha256:"..hashes.sha256(token_secret, true); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
159 |
local token_info = grant.tokens[secret_hash]; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
160 |
if not token_info then |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
161 |
module:log("debug", "No tokens matched the given secret"); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
162 |
return nil, "not-authorized"; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
163 |
end |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
164 |
|
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
165 |
-- Check expiry |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
166 |
local now = os.time(); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
167 |
if token_info.expires < now then |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
168 |
module:log("debug", "Token has expired, cleaning it up"); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
169 |
grant.tokens[secret_hash] = nil; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
170 |
token_store:set_key(token_user, token_id, grant); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
171 |
return nil, "not-authorized"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
172 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
173 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
174 |
-- Invalidate grants from before last password change |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
175 |
local account_info = usermanager.get_account_info(token_user, module.host); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
176 |
local password_updated_at = account_info and account_info.password_updated; |
13010
d943733c6d01
mod_tokenauth: fix traceback if password has never been changed
Jonas Schäfer <jonas@wielicki.name>
parents:
13007
diff
changeset
|
177 |
if password_updated_at and grant.created < password_updated_at then |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
178 |
module:log("debug", "Token grant issued before last password change, invalidating it now"); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
179 |
token_store:set_key(token_user, token_id, nil); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
180 |
return nil, "not-authorized"; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
181 |
end |
12746
126aefd2c4c6
mod_tokenauth: Invalidate tokens issued before most recent password change
Matthew Wild <mwild1@gmail.com>
parents:
12666
diff
changeset
|
182 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
183 |
-- Update last access time if necessary |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
184 |
local last_accessed = grant.accessed; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
185 |
if not last_accessed or (now - last_accessed) > access_time_granularity then |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
186 |
grant.accessed = now; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
187 |
clear_expired_grant_tokens(grant); -- Clear expired tokens while we're here |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
188 |
token_store:set_key(token_user, token_id, grant); |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
189 |
end |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
190 |
|
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
191 |
token_info.id = token_id; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
192 |
token_info.grant = grant; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
193 |
token_info.jid = grant.jid; |
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
194 |
|
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
195 |
return token_info; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
196 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
197 |
|
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
198 |
|
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
199 |
function get_token_info(token) |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
200 |
local token_id, token_user, token_host, token_secret = parse_token(token); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
201 |
if not token_id then |
12956
a668bc1aa39d
mod_tokenauth: Log error when token validation fails
Matthew Wild <mwild1@gmail.com>
parents:
12942
diff
changeset
|
202 |
module:log("warn", "Failed to verify access token: %s", token_user); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
203 |
return nil, "invalid-token-format"; |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
204 |
end |
12957
ebe3b2f96cad
mod_tokenauth: Switch to new token format (invalidates existing tokens!)
Matthew Wild <mwild1@gmail.com>
parents:
12956
diff
changeset
|
205 |
return _get_validated_token_info(token_id, token_user, token_host, token_secret); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
206 |
end |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
207 |
|
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
208 |
function get_token_session(token, resource) |
12963
e331210beeb2
mod_tokenauth: Fix traceback in get_token_session()
Kim Alvefur <zash@zash.se>
parents:
12957
diff
changeset
|
209 |
local token_id, token_user, token_host, token_secret = parse_token(token); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
210 |
if not token_id then |
12956
a668bc1aa39d
mod_tokenauth: Log error when token validation fails
Matthew Wild <mwild1@gmail.com>
parents:
12942
diff
changeset
|
211 |
module:log("warn", "Failed to verify access token: %s", token_user); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
212 |
return nil, "invalid-token-format"; |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
213 |
end |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
214 |
|
12963
e331210beeb2
mod_tokenauth: Fix traceback in get_token_session()
Kim Alvefur <zash@zash.se>
parents:
12957
diff
changeset
|
215 |
local token_info, err = _get_validated_token_info(token_id, token_user, token_host, token_secret); |
12653
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
216 |
if not token_info then return nil, err; end |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
217 |
|
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
218 |
return { |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
219 |
username = token_user; |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
220 |
host = token_host; |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
221 |
resource = token_info.resource or resource or generate_identifier(); |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
222 |
|
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
223 |
role = select_role(token_user, token_host, token_info.role); |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
224 |
}; |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
225 |
end |
86e1187f6274
mod_tokenauth: New API that better fits how modules are using token auth
Matthew Wild <mwild1@gmail.com>
parents:
10679
diff
changeset
|
226 |
|
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
227 |
function revoke_token(token) |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
228 |
local token_id, token_user, token_host = parse_token(token); |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
229 |
if not token_id then |
12956
a668bc1aa39d
mod_tokenauth: Log error when token validation fails
Matthew Wild <mwild1@gmail.com>
parents:
12942
diff
changeset
|
230 |
module:log("warn", "Failed to verify access token: %s", token_user); |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
231 |
return nil, "invalid-token-format"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
232 |
end |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
233 |
if token_host ~= module.host then |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
234 |
return nil, "invalid-host"; |
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
235 |
end |
13007
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
236 |
local ok, err = token_store:set_key(token_user, token_id, nil); |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
237 |
if not ok then |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
238 |
return nil, err; |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
239 |
end |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
240 |
module:fire_event("token-grant-revoked", { id = token_id, username = token_user, host = token_host }); |
34ed17ef1c1a
mod_tokenauth: Fire events on grant creation and revocation
Matthew Wild <mwild1@gmail.com>
parents:
13004
diff
changeset
|
241 |
return true; |
10672
25c84c0a66fd
mod_authtokens: New module for managing auth tokens
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
242 |
end |
12919
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
243 |
|
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
244 |
function sasl_handler(auth_provider, purpose, extra) |
12942
055b03d3059b
util.sasl.oauthbearer: Return username from callback instead using authzid (BC)
Kim Alvefur <zash@zash.se>
parents:
12923
diff
changeset
|
245 |
return function (sasl, token, realm, _authzid) |
12919
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
246 |
local token_info, err = get_token_info(token); |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
247 |
if not token_info then |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
248 |
module:log("debug", "SASL handler failed to verify token: %s", err); |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
249 |
return nil, nil, extra; |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
250 |
end |
13002
601d9a375b86
mod_tokenauth: Refactor API to separate tokens and grants
Matthew Wild <mwild1@gmail.com>
parents:
13001
diff
changeset
|
251 |
local token_user, token_host, resource = jid.split(token_info.grant.jid); |
12942
055b03d3059b
util.sasl.oauthbearer: Return username from callback instead using authzid (BC)
Kim Alvefur <zash@zash.se>
parents:
12923
diff
changeset
|
252 |
if realm ~= token_host or (purpose and token_info.purpose ~= purpose) then |
12919
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
253 |
return nil, nil, extra; |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
254 |
end |
12942
055b03d3059b
util.sasl.oauthbearer: Return username from callback instead using authzid (BC)
Kim Alvefur <zash@zash.se>
parents:
12923
diff
changeset
|
255 |
if auth_provider.is_enabled and not auth_provider.is_enabled(token_user) then |
12919
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
256 |
return true, false, token_info; |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
257 |
end |
12942
055b03d3059b
util.sasl.oauthbearer: Return username from callback instead using authzid (BC)
Kim Alvefur <zash@zash.se>
parents:
12923
diff
changeset
|
258 |
sasl.resource = resource; |
055b03d3059b
util.sasl.oauthbearer: Return username from callback instead using authzid (BC)
Kim Alvefur <zash@zash.se>
parents:
12923
diff
changeset
|
259 |
sasl.token_info = token_info; |
055b03d3059b
util.sasl.oauthbearer: Return username from callback instead using authzid (BC)
Kim Alvefur <zash@zash.se>
parents:
12923
diff
changeset
|
260 |
return token_user, true, token_info; |
12919
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
261 |
end; |
70f6a8dceb1d
mod_tokenauth: Add SASL handler backend that can accept and verify tokens
Matthew Wild <mwild1@gmail.com>
parents:
12918
diff
changeset
|
262 |
end |