owen/lms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge branch 'tazio-pam-auth' into develop. fixes #65, fixes #69

Browse Source
This commit is contained in:
emeric
2020-07-06 13:59:50 +02:00
parent 718d2ee6d7 21942f1db8
commit 0623df3dae
32 changed files with 651 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.travis.yml
+1 -1
View File
@@ -16,7 +16,7 @@ matrix:
- gcc
before_install:
- eval "${MATRIX_EVAL}"
- sudo apt-get install build-essential cmake libboost-all-dev libconfig++-dev libavcodec-dev libavutil-dev libavformat-dev ffmpeg libgraphicsmagick++1-dev libpstreams-dev libconfig++-dev libpstreams-dev libtag1-dev
- sudo apt-get install build-essential cmake libboost-all-dev libconfig++-dev libavcodec-dev libavutil-dev libavformat-dev ffmpeg libgraphicsmagick++1-dev libpstreams-dev libconfig++-dev libpstreams-dev libtag1-dev libpam0g-dev
- git clone https://github.com/emweb/wt.git wt
- pushd wt;
- git checkout 4.2.1
CMakeLists.txt
+7 -2
View File
@@ -2,7 +2,6 @@ cmake_minimum_required(VERSION 3.12)
project(lms)
set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_SOURCE_DIR}/cmake/modules/")
set(CMAKE_CXX_STANDARD 17)
@@ -11,12 +10,18 @@ set(CMAKE_CXX_STANDARD_REQUIRED True)
include(CTest)
find_package(PkgConfig REQUIRED)
find_package(Filesystem REQUIRED)
find_package(FFMPEGAV REQUIRED)
find_package(Taglib REQUIRED)
find_package(Boost REQUIRED COMPONENTS system)
find_package(PStreams REQUIRED)
find_package(PAM)
pkg_check_modules(GRAPHICSMAGICKXX REQUIRED GraphicsMagick++)
add_subdirectory(src)
install(DIRECTORY approot DESTINATION share/lms)
install(DIRECTORY docroot DESTINATION share/lms)
install(FILES systemd/default.service DESTINATION share/lms)
install(FILES conf/systemd/default.service DESTINATION share/lms)
install(FILES conf/pam/lms DESTINATION share/lms)
install(FILES conf/lms.conf DESTINATION share/lms)
README.md
+3 -1
View File
@@ -90,9 +90,11 @@ __Notes__:
* a C++17 compiler is needed
* ffmpeg version 4 minimum is required
```sh
apt-get install g++ cmake libboost-system-dev libavutil-dev libavformat-dev libgraphicsmagick++1-dev libconfig++-dev libpstreams-dev ffmpeg libtag1-dev
apt-get install g++ cmake libboost-system-dev libavutil-dev libavformat-dev libgraphicsmagick++1-dev libconfig++-dev libpstreams-dev ffmpeg libtag1-dev libpam0g-dev
```
__Note__: package libpam0g-dev is optional (only for using PAM authentication)
You also need _Wt4_, which is not packaged yet on _Debian_. See [installation instructions](https://www.webtoolkit.eu/wt/doc/reference/html/InstallationUnix.html).</br>
No optional requirement is needed, except openSSL if you plan not to deploy behind a reverse proxy (which is not recommended).
approot/admin-user.xml
+9
View File
@@ -30,6 +30,15 @@
</div>
</div>
${</if-has-login>}
<div class="form-group">
<label class="control-label col-lg-3" for="${id:auth-mode}">
${tr:Lms.Admin.User.auth-mode}
</label>
<div class="col-lg-9">
${auth-mode}
${auth-mode-info class="help-block"}
</div>
</div>
<div class="form-group">
<label class="control-label col-lg-3" for="${id:password}">
${tr:Lms.password-new}
approot/messages.xml
+4
View File
@@ -16,6 +16,7 @@
<message id="Lms.password-bad-login-combination">Bad login / password combination</message>
<message id="Lms.password-client-throttled">Login throttled, please try again later</message>
<message id="Lms.password-confirm">Confirm password</message>
<message id="Lms.password-must-not-be-empty">Password must not be empty</message>
<message id="Lms.password-new">New password</message>
<message id="Lms.password-old">Old password</message>
<message id="Lms.password-too-weak">Password too weak</message>
@@ -81,6 +82,9 @@
<message id="Lms.Admin.Users.menu-users"><i class="fa fa-fw fa-users" aria-hidden="true"></i> Users</message>
<!--User-->
<message id="Lms.Admin.User.auth-mode">Authentication mode</message>
<message id="Lms.Admin.User.auth-mode.internal">Internal</message>
<message id="Lms.Admin.User.auth-mode.pam">PAM</message>
<message id="Lms.Admin.User.demo-account">Demo account</message>
<message id="Lms.Admin.User.demo-account-already-exists">Demo account already exists!</message>
<message id="Lms.Admin.User.demo-password-invalid">Demo password must be the login name!</message>
approot/messages_fr.xml
+4
View File
@@ -16,6 +16,7 @@
<message id="Lms.password-bad-login-combination">Mauvaise combinaison login / mot de passe</message>
<message id="Lms.password-client-throttled">Trop de tentatives de connexion, veuillez réessayer plus tard</message>
<message id="Lms.password-confirm">Confirmation du mot de passe</message>
<message id="Lms.password-must-not-be-empty">Le mot de passe ne doit pas être vide</message>
<message id="Lms.password-new">Nouveau mot de passe</message>
<message id="Lms.password-old">Ancien mot de passe</message>
<message id="Lms.password-too-weak">Mot de passe trop faible</message>
@@ -81,6 +82,9 @@
<message id="Lms.Admin.Users.menu-users"><i class="fa fa-fw fa-users" aria-hidden="true"></i> Utilisateurs</message>
<!--User-->
<message id="Lms.Admin.User.auth-mode">Mode d'authentification</message>
<message id="Lms.Admin.User.auth-mode.internal">Interne</message>
<message id="Lms.Admin.User.auth-mode.pam">PAM</message>
<message id="Lms.Admin.User.demo-account">Compte de démonstration</message>
<message id="Lms.Admin.User.demo-account-already-exists">Le compte de démonstration existe déjà !</message>
<message id="Lms.Admin.User.demo-password-invalid">Le password doit être égal au login !</message>
cmake/modules/FindFFMPEGAV.cmake
+23
View File
@@ -0,0 +1,23 @@
# Quick and dirty av* includes discoverer
find_path(AVCODEC_INCLUDE_DIR NAMES libavcodec/avcodec.h PATH_SUFFIXES ffmpeg)
find_library(AVCODEC_LIBRARY avcodec)
find_path(AVFORMAT_INCLUDE_DIR NAMES libavformat/avformat.h PATH_SUFFIXES ffmpeg)
find_library(AVFORMAT_LIBRARY avformat)
find_path(AVUTIL_INCLUDE_DIR NAMES libavutil/avutil.h PATH_SUFFIXES ffmpeg)
find_library(AVUTIL_LIBRARY avutil)
include(FindPackageHandleStandardArgs)
FIND_PACKAGE_HANDLE_STANDARD_ARGS(
FFMPEGAV
FOUND_VAR FFMPEGAV_FOUND
REQUIRED_VARS AVUTIL_LIBRARY AVFORMAT_LIBRARY
)
mark_as_advanced(AVFORMAT_LIBRARY)
mark_as_advanced(AVUTIL_LIBRARY)
cmake/modules/FindPAM.cmake
+73
View File
@@ -0,0 +1,73 @@
# From http://code.google.com/p/pam-face-authentication/source/browse/branches/pam_face_authentication/cmake/modules/FindPAM.cmake?r=336
# - Try to find the PAM libraries
# Once done this will define
#
# PAM_FOUND - system has pam
# PAM_INCLUDE_DIR - the pam include directory
# PAM_LIBRARIES - libpam library
if (PAM_INCLUDE_DIR AND PAM_LIBRARY)
# Already in cache, be silent
set(PAM_FIND_QUIETLY TRUE)
endif (PAM_INCLUDE_DIR AND PAM_LIBRARY)
find_path(PAM_INCLUDE_DIR NAMES security/pam_appl.h pam/pam_appl.h)
find_library(PAM_LIBRARY pam)
find_library(DL_LIBRARY dl)
if (PAM_INCLUDE_DIR AND PAM_LIBRARY)
set(PAM_FOUND TRUE)
if (DL_LIBRARY)
set(PAM_LIBRARIES ${PAM_LIBRARY} ${DL_LIBRARY})
else (DL_LIBRARY)
set(PAM_LIBRARIES ${PAM_LIBRARY})
endif (DL_LIBRARY)
if (EXISTS ${PAM_INCLUDE_DIR}/pam/pam_appl.h)
# darwin claims to be something special
set(HAVE_PAM_PAM_APPL_H 1)
endif (EXISTS ${PAM_INCLUDE_DIR}/pam/pam_appl.h)
if (NOT DEFINED PAM_MESSAGE_CONST)
include(CheckCXXSourceCompiles)
# XXX does this work with plain c?
check_cxx_source_compiles("
#if ${HAVE_PAM_PAM_APPL_H}+0
# include <pam/pam_appl.h>
#else
# include <security/pam_appl.h>
#endif
static int PAM_conv(
int num_msg,
const struct pam_message **msg, /* this is the culprit */
struct pam_response **resp,
void *ctx)
{
return 0;
}
int main(void)
{
struct pam_conv PAM_conversation = {
&PAM_conv, /* this bombs out if the above does not match */
0
};
return 0;
}
" PAM_MESSAGE_CONST)
endif (NOT DEFINED PAM_MESSAGE_CONST)
set(PAM_MESSAGE_CONST ${PAM_MESSAGE_CONST} CACHE BOOL "PAM expects a conversation function with const pam_message")
endif (PAM_INCLUDE_DIR AND PAM_LIBRARY)
if (PAM_FOUND)
if (NOT PAM_FIND_QUIETLY)
message(STATUS "Found PAM: ${PAM_LIBRARIES}")
endif (NOT PAM_FIND_QUIETLY)
else (PAM_FOUND)
if (PAM_FIND_REQUIRED)
message(FATAL_ERROR "PAM was not found")
endif(PAM_FIND_REQUIRED)
endif (PAM_FOUND)
mark_as_advanced(PAM_INCLUDE_DIR PAM_LIBRARY DL_LIBRARY PAM_MESSAGE_CONST)
cmake/modules/FindPStreams.cmake
+17
View File
@@ -0,0 +1,17 @@
# If already in cache, be silent
if(PSTREAMS_INCLUDE_DIRS)
set (PSTREAMS_FIND_QUIETLY TRUE)
endif()
FIND_PATH(PSTREAMS_INCLUDE_DIR NAMES pstream.h
PATH_SUFFIXES pstreams
HINTS ${PSTREAMS_ROOT}/include $ENV{PSTREAMS_ROOT})
set(PSTREAMS_INCLUDE_DIRS ${PSTREAMS_INCLUDE_DIR})
# Handle the QUIETLY and REQUIRED arguments and set PSTREAMS_FOUND to TRUE if
# all listed variables are TRUE.
INCLUDE(FindPackageHandleStandardArgs)
FIND_PACKAGE_HANDLE_STANDARD_ARGS(Pstreams DEFAULT_MSG PSTREAMS_INCLUDE_DIRS)
MARK_AS_ADVANCED(PSTREAMS_INCLUDE_DIRS)
cmake/modules/FindTaglib.cmake
+87
View File
@@ -0,0 +1,87 @@
# - Try to find the Taglib library
# Once done this will define
#
# TAGLIB_FOUND - system has the taglib library
# TAGLIB_CFLAGS - the taglib cflags
# TAGLIB_LIBRARIES - The libraries needed to use taglib
# Copyright (c) 2006, Laurent Montel, <montel@kde.org>
#
# Redistribution and use is allowed according to the terms of the BSD license.
# For details see the accompanying COPYING-CMAKE-SCRIPTS file.
IF(TAGLIB_FOUND)
MESSAGE(STATUS "Using manually specified taglib locations")
ELSE()
if(NOT TAGLIB_MIN_VERSION)
set(TAGLIB_MIN_VERSION "1.6")
endif(NOT TAGLIB_MIN_VERSION)
if(NOT WIN32)
find_program(TAGLIBCONFIG_EXECUTABLE NAMES taglib-config PATHS
${BIN_INSTALL_DIR}
)
endif(NOT WIN32)
#reset vars
set(TAGLIB_LIBRARIES)
set(TAGLIB_CFLAGS)
# MESSAGE( STATUS "PATHS: ${PATHS}")
# if taglib-config has been found
if(TAGLIBCONFIG_EXECUTABLE)
exec_program(${TAGLIBCONFIG_EXECUTABLE} ARGS --version RETURN_VALUE _return_VALUE OUTPUT_VARIABLE TAGLIB_VERSION)
if(TAGLIB_VERSION VERSION_LESS "${TAGLIB_MIN_VERSION}")
message(STATUS "TagLib version not found: version searched :${TAGLIB_MIN_VERSION}, found ${TAGLIB_VERSION}")
set(TAGLIB_FOUND FALSE)
else(TAGLIB_VERSION VERSION_LESS "${TAGLIB_MIN_VERSION}")
exec_program(${TAGLIBCONFIG_EXECUTABLE} ARGS --libs RETURN_VALUE _return_VALUE OUTPUT_VARIABLE TAGLIB_LIBRARIES)
exec_program(${TAGLIBCONFIG_EXECUTABLE} ARGS --cflags RETURN_VALUE _return_VALUE OUTPUT_VARIABLE TAGLIB_CFLAGS)
if(TAGLIB_LIBRARIES AND TAGLIB_CFLAGS)
set(TAGLIB_FOUND TRUE)
# message(STATUS "Found taglib: ${TAGLIB_LIBRARIES}")
endif(TAGLIB_LIBRARIES AND TAGLIB_CFLAGS)
string(REGEX REPLACE " *-I" ";" TAGLIB_INCLUDES "${TAGLIB_CFLAGS}")
endif(TAGLIB_VERSION VERSION_LESS "${TAGLIB_MIN_VERSION}")
mark_as_advanced(TAGLIB_CFLAGS TAGLIB_LIBRARIES TAGLIB_INCLUDES)
else(TAGLIBCONFIG_EXECUTABLE)
include(FindLibraryWithDebug)
include(FindPackageHandleStandardArgs)
find_path(TAGLIB_INCLUDES
NAMES
tag.h
PATH_SUFFIXES taglib
PATHS
${INCLUDE_INSTALL_DIR}
)
find_library_with_debug(TAGLIB_LIBRARIES
WIN32_DEBUG_POSTFIX d
NAMES tag
PATHS
${LIB_INSTALL_DIR}
)
find_package_handle_standard_args(Taglib DEFAULT_MSG
TAGLIB_INCLUDES TAGLIB_LIBRARIES)
endif(TAGLIBCONFIG_EXECUTABLE)
ENDIF()
if(TAGLIB_FOUND)
if(NOT Taglib_FIND_QUIETLY AND TAGLIBCONFIG_EXECUTABLE)
message(STATUS "Found TagLib: ${TAGLIB_LIBRARIES}")
endif(NOT Taglib_FIND_QUIETLY AND TAGLIBCONFIG_EXECUTABLE)
else(TAGLIB_FOUND)
if(Taglib_FIND_REQUIRED)
message(FATAL_ERROR "Could not find Taglib")
endif(Taglib_FIND_REQUIRED)
endif(TAGLIB_FOUND)
conf/pam/lms
+3
View File
@@ -0,0 +1,3 @@
account required pam_unix.so
auth required pam_unix.so
password required pam_deny.so
systemd/default.service → conf/systemd/default.service
View File
src/libs/auth/CMakeLists.txt
+8 -1
View File
@@ -20,9 +20,16 @@ target_link_libraries(lmsauth PRIVATE
target_link_libraries(lmsauth PUBLIC
pthread
boost_system
Boost::system
wt
)
if (PAM_FOUND)
target_compile_options(lmsauth PRIVATE "-DLMS_SUPPORT_PAM")
target_sources(lmsauth PRIVATE impl/pam/PAM.cpp)
target_include_directories(lmsauth PRIVATE ${PAM_INCLUDE_DIR})
target_link_libraries(lmsauth PRIVATE ${PAM_LIBRARIES})
endif(PAM_FOUND)
install(TARGETS lmsauth DESTINATION lib)
src/libs/auth/impl/AuthTokenService.cpp
-2
View File
@@ -17,8 +17,6 @@
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#include "AuthTokenService.hpp"
#include <Wt/Auth/HashFunction.h>
src/libs/auth/impl/AuthTokenService.hpp
-2
View File
@@ -17,8 +17,6 @@
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#pragma once
#include "auth/IAuthTokenService.hpp"
src/libs/auth/impl/LoginThrottler.hpp
-2
View File
@@ -17,8 +17,6 @@
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#pragma once
#include <shared_mutex>
src/libs/auth/impl/PasswordService.cpp
+40 -5
View File
@@ -17,8 +17,6 @@
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
/* This file contains some classes in order to get info from file using the libavconv */
#include "PasswordService.hpp"
#include <Wt/Auth/HashFunction.h>
@@ -28,6 +26,9 @@
#include "database/Session.hpp"
#include "utils/Exception.hpp"
#include "utils/Logger.hpp"
#ifdef LMS_SUPPORT_PAM
#include "pam/PAM.hpp"
#endif
namespace Auth {
@@ -41,10 +42,29 @@ PasswordService::PasswordService(std::size_t maxThrottlerEntries)
{
}
bool
PasswordService::isAuthModeSupported(Database::User::AuthMode authMode) const
{
switch (authMode)
{
case Database::User::AuthMode::Internal:
return true;
case Database::User::AuthMode::PAM:
#ifdef LMS_SUPPORT_PAM
return true;
#else
return false;
#endif
}
return false;
}
static
bool
checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
{
Database::User::AuthMode authMode;
Database::User::PasswordHash passwordHash;
{
auto transaction {session.createSharedTransaction()};
@@ -53,13 +73,28 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
if (!user)
return false;
authMode = user->getAuthMode();
passwordHash = user->getPasswordHash();
}
const Wt::Auth::BCryptHashFunction hashFunc {6};
return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
}
switch (authMode)
{
case Database::User::AuthMode::Internal:
{
const Wt::Auth::BCryptHashFunction hashFunc {6}; // TODO parametrize this
return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
}
case Database::User::AuthMode::PAM:
#ifdef LMS_SUPPORT_PAM
return PAM::checkUserPassword(loginName, password);
#else
return false;
#endif
}
return false;
}
PasswordService::PasswordCheckResult
PasswordService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)
src/libs/auth/impl/PasswordService.hpp
+2 -3
View File
@@ -46,14 +46,13 @@ namespace Auth {
PasswordService(PasswordService&&) = delete;
PasswordService& operator=(PasswordService&&) = delete;
private:
// Password services
bool isAuthModeSupported(Database::User::AuthMode authMode) const;
PasswordCheckResult checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) override;
Database::User::PasswordHash hashPassword(const std::string& password) const override;
bool evaluatePasswordStrength(const std::string& loginName, const std::string& password) const override;
private:
std::shared_timed_mutex _mutex;
LoginThrottler _loginThrottler;
};
src/libs/auth/impl/pam/PAM.cpp
+182
View File
@@ -0,0 +1,182 @@
/*
* Copyright (C) 2020 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
#include "PAM.hpp"
#include <cstring>
#include "utils/Exception.hpp"
#include "utils/Logger.hpp"
#include <security/pam_appl.h>
namespace Auth::PAM
{
class PAMError
{
public:
PAMError(std::string_view msg, pam_handle_t *pamh, int err)
{
_errorMsg = std::string {msg} + ": " + pam_strerror(pamh, err);
}
std::string_view message() const { return _errorMsg; }
private:
std::string _errorMsg;
};
class PAMContext
{
public:
PAMContext(std::string_view loginName)
{
int err {pam_start("lms", std::string {loginName}.c_str(), &_conv, &_pamh)};
if (err != PAM_SUCCESS)
throw PAMError {"start failed", _pamh, err};
}
~PAMContext()
{
int err {pam_end(_pamh, 0)};
if (err != PAM_SUCCESS)
LMS_LOG(AUTH, ERROR) << "end failed: " << pam_strerror(_pamh, err);
}
void authenticate(std::string_view password)
{
AuthenticateConvContext authContext {password};
ScopedConvContextSetter scopedContext {*this, authContext};
int err {pam_authenticate(_pamh, 0)};
if (err != PAM_SUCCESS)
throw PAMError {"authenticate failed", _pamh, err};
}
void validateAccount()
{
int err {pam_acct_mgmt(_pamh, PAM_SILENT)};
if (err != PAM_SUCCESS)
throw PAMError {"acct_mgmt failed", _pamh, err};
}
private:
class ConvContext
{
public:
virtual ~ConvContext() = default;
};
class AuthenticateConvContext final : public ConvContext
{
public:
AuthenticateConvContext(std::string_view password) : _password {password} {}
std::string_view getPassword() const { return _password; }
private:
std::string_view _password;
};
class ScopedConvContextSetter
{
public:
ScopedConvContextSetter(PAMContext& pamContext, ConvContext& convContext)
: _pamContext {pamContext}
{
_pamContext._convContext = &convContext;
}
~ScopedConvContextSetter()
{
_pamContext._convContext = nullptr;
}
ScopedConvContextSetter(const ScopedConvContextSetter&) = delete;
ScopedConvContextSetter(ScopedConvContextSetter&&) = delete;
ScopedConvContextSetter& operator=(const ScopedConvContextSetter&) = delete;
ScopedConvContextSetter& operator=(ScopedConvContextSetter&&) = delete;
private:
PAMContext& _pamContext;
};
static int conv(int msgCount, const pam_message** msgs, pam_response** resps, void* userData)
{
if (msgCount < 1)
return PAM_CONV_ERR;
if (!resps || !msgs || !userData)
return PAM_CONV_ERR;
PAMContext& context {*static_cast<PAMContext*>(userData)};
AuthenticateConvContext* authenticateContext = dynamic_cast<AuthenticateConvContext*>(context._convContext);
if (!authenticateContext)
{
LMS_LOG(AUTH, ERROR) << "Unexpected conv!";
return PAM_CONV_ERR;
}
// Only expect a PAM_PROMPT_ECHO_OFF msg
if (msgCount != 1 || msgs[0]->msg_style != PAM_PROMPT_ECHO_OFF)
{
LMS_LOG(AUTH, ERROR) << "Unexpected conv message. Count = " << msgCount;
return PAM_CONV_ERR;
}
pam_response* response {static_cast<pam_response*>(malloc(sizeof(pam_response)))};
if (!response)
return PAM_CONV_ERR;
response->resp = strdup(std::string {authenticateContext->getPassword()}.c_str());
*resps = response;
return PAM_SUCCESS;
}
ConvContext* _convContext {};
pam_conv _conv {&PAMContext::conv, this};
pam_handle_t *_pamh {};
};
bool
checkUserPassword(const std::string& loginName, const std::string& password)
{
try
{
PAMContext pamContext {loginName};
pamContext.authenticate(password);
pamContext.validateAccount();
return true;
}
catch (const PAMError& error)
{
LMS_LOG(AUTH, ERROR) << "PAM error: " << error.message();
return false;
}
}
} // namespace Auth::PAM
src/libs/auth/impl/pam/PAM.hpp
+32
View File
@@ -0,0 +1,32 @@
/*
* Copyright (C) 2020 Emeric Poupon
*
* This file is part of LMS.
*
* LMS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* LMS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with LMS. If not, see <http://www.gnu.org/licenses/>.
*/
#pragma once
#ifdef LMS_SUPPORT_PAM
#include <string>
namespace Auth::PAM
{
bool checkUserPassword(const std::string& loginName, const std::string& password);
}
#endif // LMS_SUPPORT_PAM
src/libs/auth/include/auth/IPasswordService.hpp
+3
View File
@@ -48,6 +48,9 @@ namespace Auth {
Mismatch,
Throttled,
};
virtual bool isAuthModeSupported(Database::User::AuthMode authMode) const = 0;
virtual PasswordCheckResult checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) = 0;
virtual Database::User::PasswordHash hashPassword(const std::string& password) const = 0;
virtual bool evaluatePasswordStrength(const std::string& loginName, const std::string& password) const = 0;
src/libs/av/CMakeLists.txt
+6 -1
View File
@@ -6,21 +6,26 @@ add_library(lmsav SHARED
impl/AvTypes.cpp
)
# TODO make av libs private
target_include_directories(lmsav INTERFACE
include
${AVCODEC_INCLUDE_DIR}
${AVFORMAT_INCLUDE_DIR}
${AVUTIL_INCLUDE_DIR}
)
target_include_directories(lmsav PRIVATE
include/
)
# TODO make these private
target_link_libraries(lmsav PUBLIC
lmsutils
avformat
avutil
std::filesystem
wt
${AVFORMAT_LIBRARY}
${AVUTIL_LIBRARY}
)
install(TARGETS lmsav DESTINATION lib)
src/libs/database/impl/Session.cpp
+7 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2013 Emeric Poupon
* Copyright (C) 2020 Emeric Poupon
*
* This file is part of LMS.
*
@@ -40,7 +40,7 @@
namespace Database {
#define LMS_DATABASE_VERSION 24
#define LMS_DATABASE_VERSION 25
using Version = std::size_t;
@@ -267,6 +267,11 @@ CREATE TABLE "user_backup" (
// Just increment the scan version of the settings to make the next scheduled scan rescan everything
ScanSettings::get(*this).modify()->incScanVersion();
}
else if (version == 24)
{
// User's AuthMode
_session.execute("ALTER TABLE user ADD auth_mode INTEGER NOT NULL DEFAULT(" + std::to_string(static_cast<int>(User::defaultAuthMode)) + ")");
}
else
{
LMS_LOG(DB, ERROR) << "Database version " << version << " cannot be handled using migration";
src/libs/database/impl/User.cpp
+3 -5
View File
@@ -70,10 +70,8 @@ AuthToken::getByValue(Session& session, const std::string& value)
static const std::string playedListName {"__played_tracks__"};
static const std::string queuedListName {"__queued_tracks__"};
User::User(const std::string& loginName, const PasswordHash& passwordHash)
User::User(const std::string& loginName)
: _loginName {loginName}
, _passwordSalt {passwordHash.salt}
, _passwordHash {passwordHash.hash}
{
}
@@ -96,11 +94,11 @@ User::getDemo(Session& session)
}
User::pointer
User::create(Session& session, const std::string& loginName, const PasswordHash& passwordHash)
User::create(Session& session, const std::string& loginName)
{
session.checkUniqueLocked();
User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName, passwordHash))};
User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName))};
TrackList::create(session, playedListName, TrackList::Type::Internal, false, user);
TrackList::create(session, queuedListName, TrackList::Type::Internal, false, user);
src/libs/database/include/database/User.hpp
+13 -2
View File
@@ -100,6 +100,12 @@ class User : public Wt::Dbo::Dbo<User>
DEMO = 2,
};
enum class AuthMode
{
Internal = 0,
PAM = 1,
};
struct PasswordHash
{
std::string salt;
@@ -137,13 +143,14 @@ class User : public Wt::Dbo::Dbo<User>
static inline const Bitrate defaultSubsonicTranscodeBitrate {128000};
static inline const UITheme defaultUITheme {UITheme::Dark};
static inline const SubsonicArtistListMode defaultSubsonicArtistListMode {SubsonicArtistListMode::AllArtists};
static inline const AuthMode defaultAuthMode {AuthMode::Internal};
User() = default;
User(const std::string& loginName, const PasswordHash& passwordHash);
User(const std::string& loginName);
// utility
static pointer create(Session& session, const std::string& loginName, const PasswordHash& passwordHash);
static pointer create(Session& session, const std::string& loginName);
static pointer getById(Session& session, IdType id);
static pointer getByLoginName(Session& session, const std::string& loginName);
@@ -165,6 +172,7 @@ class User : public Wt::Dbo::Dbo<User>
void setSubsonicTranscodeBitrate(Bitrate bitrate);
void setCurPlayingTrackPos(std::size_t pos) { _curPlayingTrackPos = pos; }
void setRadio(bool val) { _radio = val; }
void setAuthMode(AuthMode mode) { _authMode = mode;}
void setRepeatAll(bool val) { _repeatAll = val; }
void setUITheme(UITheme uiTheme) { _uiTheme = uiTheme; }
void clearAuthTokens();
@@ -179,6 +187,7 @@ class User : public Wt::Dbo::Dbo<User>
std::size_t getCurPlayingTrackPos() const { return _curPlayingTrackPos; }
bool isRepeatAllSet() const { return _repeatAll; }
bool isRadioSet() const { return _radio; }
AuthMode getAuthMode() const { return _authMode; }
UITheme getUITheme() const { return _uiTheme; }
SubsonicArtistListMode getSubsonicArtistListMode() const { return _subsonicArtistListMode; }
@@ -218,6 +227,7 @@ class User : public Wt::Dbo::Dbo<User>
Wt::Dbo::field(a, _curPlayingTrackPos, "cur_playing_track_pos");
Wt::Dbo::field(a, _repeatAll, "repeat_all");
Wt::Dbo::field(a, _radio, "radio");
Wt::Dbo::field(a, _authMode, "auth_mode");
Wt::Dbo::hasMany(a, _tracklists, Wt::Dbo::ManyToOne, "user");
Wt::Dbo::hasMany(a, _starredArtists, Wt::Dbo::ManyToMany, "user_artist_starred", "", Wt::Dbo::OnDeleteCascade);
Wt::Dbo::hasMany(a, _starredReleases, Wt::Dbo::ManyToMany, "user_release_starred", "", Wt::Dbo::OnDeleteCascade);
@@ -246,6 +256,7 @@ class User : public Wt::Dbo::Dbo<User>
int _curPlayingTrackPos {}; // Current track position in queue
bool _repeatAll {};
bool _radio {};
AuthMode _authMode {defaultAuthMode};
Wt::Dbo::collection<Wt::Dbo::ptr<TrackList>> _tracklists;
Wt::Dbo::collection<Wt::Dbo::ptr<Artist>> _starredArtists;
src/libs/subsonic/impl/SubsonicResource.cpp
+3 -1
View File
@@ -597,7 +597,9 @@ handleCreateUserRequest(RequestContext& context)
if (User::getByLoginName(context.dbSession, username) != User::pointer{})
throw UserAlreadyExistsGenericError {};
User::pointer user {User::create(context.dbSession, username, hash)};
User::pointer user {User::create(context.dbSession, username)};
user.modify()->setAuthMode(User::AuthMode::Internal);
user.modify()->setPasswordHash(hash);
return Response::createOkResponse(context);
}
src/libs/utils/CMakeLists.txt
+1 -1
View File
@@ -25,7 +25,7 @@ target_link_libraries(lmsutils PRIVATE
)
target_link_libraries(lmsutils PUBLIC
boost_system
Boost::system
std::filesystem
wt
)
src/libs/utils/impl/String.cpp
+1
View File
@@ -164,6 +164,7 @@ jsEscape(const std::string& str)
{ '\r', "\\r" },
{ '\t', "\\t" },
{ '"', "\\\"" },
{ '\'', "\\\'" },
};
std::string escaped;
src/lms/ui/admin/InitWizardView.cpp
+3 -1
View File
@@ -64,8 +64,10 @@ class InitWizardModel : public Wt::WFormModel
if (!Database::User::getAll(LmsApp->getDbSession()).empty())
throw LmsException("Admin user already created");
Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8(), passwordHash)};
Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8())};
user.modify()->setType(Database::User::Type::ADMIN);
user.modify()->setAuthMode(Database::User::AuthMode::Internal);
user.modify()->setPasswordHash(passwordHash);
}
bool validateField(Field field)
src/lms/ui/admin/UserView.cpp
+104 -23
View File
@@ -51,26 +51,30 @@ class UserModel : public Wt::WFormModel
static inline const Field LoginField {"login"};
static inline const Field PasswordField {"password"};
static inline const Field DemoField {"demo"};
static inline const Field AuthModeField{"auth-mode"};
using AuthModeModel = ValueStringModel<User::AuthMode>;
UserModel(std::optional<Database::IdType> userId)
: _userId {userId}
{
initializeModels();
if (!_userId)
{
addField(LoginField);
setValidator(LoginField, createNameValidator());
}
addField(AuthModeField);
addField(PasswordField);
addField(DemoField);
if (!_userId)
setValidator(PasswordField, createMandatoryValidator());
// populate the model with initial data
loadData();
}
std::shared_ptr<AuthModeModel> getAuthModeModel() const { return _authModeModel; }
void saveData()
{
std::optional<Database::User::PasswordHash> passwordHash;
@@ -84,8 +88,13 @@ class UserModel : public Wt::WFormModel
// Update user
Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
// Account
if (passwordHash)
auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
if (!authModeRow)
throw LmsException {"Bad authentication mode"};
const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
user.modify()->setAuthMode(authMode);
if (authMode == Database::User::AuthMode::Internal && passwordHash)
{
user.modify()->setPasswordHash(*passwordHash);
user.modify()->clearAuthTokens();
@@ -94,15 +103,70 @@ class UserModel : public Wt::WFormModel
else
{
// Create user
Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(LoginField).toUTF8(), *passwordHash)};
Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(LoginField).toUTF8())};
if (Wt::asNumber(value(DemoField)))
user.modify()->setType(Database::User::Type::DEMO);
auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
if (!authModeRow)
throw LmsException {"Bad authentication mode"};
const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
user.modify()->setAuthMode(authMode);
if (authMode == Database::User::AuthMode::Internal)
user.modify()->setPasswordHash(*passwordHash);
}
}
private:
void validatePassword(Wt::WString& error) const
{
auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
if (!authModeRow)
throw LmsException {"Bad authentication mode"};
const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
if (authMode != Database::User::AuthMode::Internal)
return;
if (!valueText(PasswordField).empty())
{
if (Wt::asNumber(value(DemoField)))
{
// Demo account: password must be the same as the login name
if (valueText(PasswordField) != getLoginName())
error = Wt::WString::tr("Lms.Admin.User.demo-password-invalid");
}
else
{
// Evaluate the strength of the password for non demo accounts
if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
error = Wt::WString::tr("Lms.password-too-weak");
}
}
else
{
auto transaction {LmsApp->getDbSession().createSharedTransaction()};
bool needPassword {true};
// Allow an empty password if and only if the user previously had one set
if (_userId)
{
const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
if (!user)
throw UserNotFoundException {*_userId};
needPassword = user->getPasswordHash().hash.empty();
}
if (needPassword)
error = Wt::WString::tr("Lms.password-must-not-be-empty");
}
}
void loadData()
{
if (!_userId)
@@ -115,6 +179,14 @@ class UserModel : public Wt::WFormModel
throw UserNotFoundException {*_userId};
else if (user == LmsApp->getUser())
throw UserNotAllowedException {};
auto authModeRow {_authModeModel->getRowFromValue(user->getAuthMode())};
if (authModeRow)
{
setValue(AuthModeField, _authModeModel->getString(*authModeRow));
if (_authModeModel->getValue(*authModeRow) != User::AuthMode::Internal)
setReadOnly(PasswordField, true);
}
}
std::string getLoginName() const
@@ -144,21 +216,7 @@ class UserModel : public Wt::WFormModel
}
else if (field == PasswordField)
{
if (!valueText(PasswordField).empty())
{
if (Wt::asNumber(value(DemoField)))
{
// Demo account: password must be the same as the login name
if (valueText(PasswordField) != getLoginName())
error = Wt::WString::tr("Lms.Admin.User.demo-password-invalid");
}
else
{
// Evaluate the strength of the password for non demo accounts
if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
error = Wt::WString::tr("Lms.password-too-weak");
}
}
validatePassword(error);
}
else if (field == DemoField)
{
@@ -176,7 +234,18 @@ class UserModel : public Wt::WFormModel
return false;
}
void initializeModels()
{
_authModeModel = std::make_shared<AuthModeModel>();
if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::Internal))
_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.internal"), User::AuthMode::Internal);
if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::PAM))
_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.pam"), User::AuthMode::PAM);
}
std::optional<Database::IdType> _userId;
std::shared_ptr<AuthModeModel> _authModeModel;
};
UserView::UserView()
@@ -213,7 +282,6 @@ UserView::refreshView()
t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-edit").arg(user->getLoginName()), Wt::TextFormat::Plain);
t->setCondition("if-has-last-login", true);
t->bindString("last-login", user->getLastLogin().toString(), Wt::TextFormat::Plain);
}
else
@@ -224,6 +292,19 @@ UserView::refreshView()
t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-create"));
}
// Auth mode
auto authMode = std::make_unique<Wt::WComboBox>();
authMode->setModel(model->getAuthModeModel());
authMode->activated().connect([=](int row)
{
const User::AuthMode authMode {model->getAuthModeModel()->getValue(row)};
model->setReadOnly(UserModel::PasswordField, authMode != User::AuthMode::Internal);
t->updateModel(model.get());
t->updateView(model.get());
});
t->setFormWidget(UserModel::AuthModeField, std::move(authMode));
// Password
auto passwordEdit = std::make_unique<Wt::WLineEdit>();
passwordEdit->setEchoMode(Wt::EchoMode::Password);
src/lms/ui/common/Validators.cpp
+1 -1
View File
@@ -39,7 +39,7 @@ std::shared_ptr<Wt::WValidator>
createMandatoryValidator()
{
auto v = std::make_shared<Wt::WValidator>();
v->setMandatory(true);
//sv->setMandatory(true);
return v;
}
src/test/database/DatabaseTest.cpp
+11 -11
View File
@@ -708,7 +708,7 @@ testMultipleTracksMultipleClustersTopRelease(Session& session)
ScopedRelease releaseB {session, "ReleaseB"};
ScopedRelease releaseC {session, "ReleaseC"};
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackList trackList {session, "TrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
{
@@ -1221,7 +1221,7 @@ static
void
testSingleUser(Session& session)
{
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
{
auto transaction {session.createSharedTransaction()};
@@ -1240,7 +1240,7 @@ void
testSingleStarredArtist(Session& session)
{
ScopedArtist artist {session, "MyArtist"};
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
{
auto transaction {session.createSharedTransaction()};
@@ -1264,7 +1264,7 @@ void
testSingleStarredRelease(Session& session)
{
ScopedRelease release {session, "MyRelease"};
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
{
auto transaction {session.createUniqueTransaction()};
@@ -1288,7 +1288,7 @@ void
testSingleStarredTrack(Session& session)
{
ScopedTrack track {session, "MyTrack"};
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
{
auto transaction {session.createUniqueTransaction()};
@@ -1311,7 +1311,7 @@ static
void
testSingleTrackList(Session& session)
{
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackList trackList {session, "MytrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
{
@@ -1328,7 +1328,7 @@ static
void
testSingleTrackListMultipleTrack(Session& session)
{
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackList trackList {session, "MytrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
std::list<ScopedTrack> tracks;
@@ -1354,7 +1354,7 @@ static
void
testSingleTrackListMultipleTrackSingleCluster(Session& session)
{
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
ScopedClusterType clusterType {session, "MyClusterType"};
ScopedCluster cluster {session, clusterType.lockAndGet(), "MyCluster"};
@@ -1388,7 +1388,7 @@ static
void
testSingleTrackListMultipleTrackMultiClusters(Session& session)
{
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
ScopedClusterType clusterType {session, "MyClusterType"};
ScopedCluster cluster1 {session, clusterType.lockAndGet(), "MyCluster1"};
@@ -1443,7 +1443,7 @@ static
void
testSingleTrackListMultipleTrackMultiClustersRecentlyPlayed(Session& session)
{
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
ScopedClusterType clusterType {session, "MyClusterType"};
ScopedCluster cluster1 {session, clusterType.lockAndGet(), "MyCluster1"};
@@ -1821,7 +1821,7 @@ void
testSingleTrackSingleUserSingleBookmark(Session& session)
{
ScopedTrack track {session, "MyTrack"};
ScopedUser user {session, "MyUser", User::PasswordHash {}};
ScopedUser user {session, "MyUser"};
ScopedTrackBookmark bookmark {session, user.lockAndGet(), track.lockAndGet()};
{