From 50b0fd1cb8bd5013fd24ab71ff71ebe89bd57780 Mon Sep 17 00:00:00 2001
From: emeric <itmfr@yahoo.fr>
Date: Sun, 5 Jul 2020 15:15:51 +0200
Subject: [PATCH] Various fixes + refacto

---
 CMakeLists.txt                                |   8 -
 README.md                                     |   4 +-
 approot/admin-user.xml                        |   9 +
 approot/messages.xml                          |   7 +-
 approot/messages_fr.xml                       |   4 +
 cmake/modules/FindFFMPEGAV.cmake              |   3 -
 src/libs/auth/CMakeLists.txt                  |   5 +
 src/libs/auth/impl/LoginThrottler.hpp         |   2 -
 src/libs/auth/impl/PasswordService.cpp        | 128 ++++---------
 src/libs/auth/impl/PasswordService.hpp        |   5 +-
 src/libs/auth/impl/pam/PAM.cpp                | 177 ++++++++++++++++++
 src/libs/auth/impl/pam/PAM.hpp                |  32 ++++
 .../auth/include/auth/IPasswordService.hpp    |   3 +
 src/libs/database/impl/Session.cpp            |   9 +-
 src/libs/database/impl/User.cpp               |   8 +-
 src/libs/database/include/database/User.hpp   |  20 +-
 src/libs/subsonic/impl/SubsonicResource.cpp   |   4 +-
 src/libs/utils/impl/String.cpp                |   1 +
 src/lms/ui/admin/InitWizardView.cpp           |   4 +-
 src/lms/ui/admin/UserView.cpp                 | 131 +++++++------
 src/test/database/DatabaseTest.cpp            |  22 +--
 21 files changed, 390 insertions(+), 196 deletions(-)
 create mode 100644 src/libs/auth/impl/pam/PAM.cpp
 create mode 100644 src/libs/auth/impl/pam/PAM.hpp

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 67572a74..2d0c04fe 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -17,14 +17,6 @@ find_package(PStreams REQUIRED)
 find_package(PAM)
 pkg_check_modules(GRAPHICSMAGICKXX REQUIRED GraphicsMagick++)
 
-set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wall")
-set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -Werror -Wno-error=parentheses -Wno-error=unused-function -O0 -g")
-set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -O2 -g")
-
-if(PAM_FOUND)
-	set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DUSEPAM")
-endif(PAM_FOUND)
-
 add_subdirectory(src)
 
 # TODO pam configuration file
diff --git a/README.md b/README.md
index 2d1b24a0..d8e1773e 100644
--- a/README.md
+++ b/README.md
@@ -90,9 +90,11 @@ __Notes__:
 * a C++17 compiler is needed
 * ffmpeg version 4 minimum is required
 ```sh
-apt-get install g++ cmake libboost-system-dev libavutil-dev libavformat-dev libgraphicsmagick++1-dev libconfig++-dev libpstreams-dev ffmpeg libtag1-dev
+apt-get install g++ cmake libboost-system-dev libavutil-dev libavformat-dev libgraphicsmagick++1-dev libconfig++-dev libpstreams-dev ffmpeg libtag1-dev libpam0g-dev
 ```
 
+__Note__: package libpam0g-dev is optional (only for using PAM authentication)
+
 You also need _Wt4_, which is not packaged yet on _Debian_. See [installation instructions](https://www.webtoolkit.eu/wt/doc/reference/html/InstallationUnix.html).</br>
 No optional requirement is needed, except openSSL if you plan not to deploy behind a reverse proxy (which is not recommended).
 
diff --git a/approot/admin-user.xml b/approot/admin-user.xml
index c3adc97a..80a97d25 100644
--- a/approot/admin-user.xml
+++ b/approot/admin-user.xml
@@ -30,6 +30,15 @@
 						</div>
 					</div>
 					${</if-has-login>}
+					<div class="form-group">
+						<label class="control-label col-lg-3"  for="${id:auth-mode}">
+							${tr:Lms.Admin.User.auth-mode}
+						</label>
+						<div class="col-lg-9">
+							${auth-mode}
+							${auth-mode-info class="help-block"}
+						</div>
+					</div>
 					<div class="form-group">
 						<label class="control-label col-lg-3"  for="${id:password}">
 							${tr:Lms.password-new}
diff --git a/approot/messages.xml b/approot/messages.xml
index babaaad2..45e0280f 100644
--- a/approot/messages.xml
+++ b/approot/messages.xml
@@ -16,10 +16,8 @@
 <message id="Lms.password-bad-login-combination">Bad login / password combination</message>
 <message id="Lms.password-client-throttled">Login throttled, please try again later</message>
 <message id="Lms.password-confirm">Confirm password</message>
+<message id="Lms.password-must-not-be-empty">Password must not be empty</message>
 <message id="Lms.password-new">New password</message>
-<message id="Lms.external_auth">Is auth managed externally?</message>
-<message id="Lms.password_must_be_empty_for_ext">Password must be empty for users with external authentication</message>
-<message id="Lms.password-must-not-be-empty">Password must not be empty for users without external authentication</message>
 <message id="Lms.password-old">Old password</message>
 <message id="Lms.password-too-weak">Password too weak</message>
 <message id="Lms.passwords-dont-match">Passwords don't match</message>
@@ -84,6 +82,9 @@
 <message id="Lms.Admin.Users.menu-users"><i class="fa fa-fw fa-users" aria-hidden="true"></i> Users</message>
 
 <!--User-->
+<message id="Lms.Admin.User.auth-mode">Authentication mode</message>
+<message id="Lms.Admin.User.auth-mode.internal">Internal</message>
+<message id="Lms.Admin.User.auth-mode.pam">PAM</message>
 <message id="Lms.Admin.User.demo-account">Demo account</message>
 <message id="Lms.Admin.User.demo-account-already-exists">Demo account already exists!</message>
 <message id="Lms.Admin.User.demo-password-invalid">Demo password must be the login name!</message>
diff --git a/approot/messages_fr.xml b/approot/messages_fr.xml
index 7b92c05b..e9dc699a 100644
--- a/approot/messages_fr.xml
+++ b/approot/messages_fr.xml
@@ -16,6 +16,7 @@
 <message id="Lms.password-bad-login-combination">Mauvaise combinaison login / mot de passe</message>
 <message id="Lms.password-client-throttled">Trop de tentatives de connexion, veuillez réessayer plus tard</message>
 <message id="Lms.password-confirm">Confirmation du mot de passe</message>
+<message id="Lms.password-must-not-be-empty">Le mot de passe ne doit pas être vide</message>
 <message id="Lms.password-new">Nouveau mot de passe</message>
 <message id="Lms.password-old">Ancien mot de passe</message>
 <message id="Lms.password-too-weak">Mot de passe trop faible</message>
@@ -81,6 +82,9 @@
 <message id="Lms.Admin.Users.menu-users"><i class="fa fa-fw fa-users" aria-hidden="true"></i> Utilisateurs</message>
 
 <!--User-->
+<message id="Lms.Admin.User.auth-mode">Mode d'authentification</message>
+<message id="Lms.Admin.User.auth-mode.internal">Interne</message>
+<message id="Lms.Admin.User.auth-mode.pam">PAM</message>
 <message id="Lms.Admin.User.demo-account">Compte de démonstration</message>
 <message id="Lms.Admin.User.demo-account-already-exists">Le compte de démonstration existe déjà !</message>
 <message id="Lms.Admin.User.demo-password-invalid">Le password doit être égal au login !</message>
diff --git a/cmake/modules/FindFFMPEGAV.cmake b/cmake/modules/FindFFMPEGAV.cmake
index 2a512757..896c10b4 100644
--- a/cmake/modules/FindFFMPEGAV.cmake
+++ b/cmake/modules/FindFFMPEGAV.cmake
@@ -9,9 +9,6 @@ find_library(AVFORMAT_LIBRARY avformat)
 find_path(AVUTIL_INCLUDE_DIR NAMES libavutil/avutil.h PATH_SUFFIXES ffmpeg)
 find_library(AVUTIL_LIBRARY avutil)
 
-find_path(AVDEVICE_INCLUDE_DIR NAMES libavdevice/avdevice.h PATH_SUFFIXES ffmpeg)
-find_library(AVDEVICE_LIBRARY avdevice)
-
 include(FindPackageHandleStandardArgs)
 
 FIND_PACKAGE_HANDLE_STANDARD_ARGS(
diff --git a/src/libs/auth/CMakeLists.txt b/src/libs/auth/CMakeLists.txt
index 20e1cf37..4f3469f6 100644
--- a/src/libs/auth/CMakeLists.txt
+++ b/src/libs/auth/CMakeLists.txt
@@ -25,5 +25,10 @@ target_link_libraries(lmsauth PUBLIC
 	${PAM_LIBRARIES}
 	)
 
+if (PAM_FOUND)
+	target_compile_options(lmsauth PRIVATE "-DLMS_SUPPORT_PAM")
+	target_sources(lmsauth PRIVATE impl/pam/PAM.cpp)
+endif(PAM_FOUND)
+
 install(TARGETS lmsauth DESTINATION lib)
 
diff --git a/src/libs/auth/impl/LoginThrottler.hpp b/src/libs/auth/impl/LoginThrottler.hpp
index 401e89ee..b8390630 100644
--- a/src/libs/auth/impl/LoginThrottler.hpp
+++ b/src/libs/auth/impl/LoginThrottler.hpp
@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #pragma once
 
 #include <shared_mutex>
diff --git a/src/libs/auth/impl/PasswordService.cpp b/src/libs/auth/impl/PasswordService.cpp
index 3a0fac63..af57f5ae 100644
--- a/src/libs/auth/impl/PasswordService.cpp
+++ b/src/libs/auth/impl/PasswordService.cpp
@@ -26,8 +26,9 @@
 #include "database/Session.hpp"
 #include "utils/Exception.hpp"
 #include "utils/Logger.hpp"
-
-#include <security/pam_appl.h>
+#ifdef LMS_SUPPORT_PAM
+#include "pam/PAM.hpp"
+#endif
 
 namespace Auth {
 
@@ -41,101 +42,29 @@ PasswordService::PasswordService(std::size_t maxThrottlerEntries)
 {
 }
 
-#ifdef USEPAM
-static void
-delete_resp(int num_msg, pam_response *response)
+bool
+PasswordService::isAuthModeSupported(Database::User::AuthMode authMode) const
 {
-    if (response == nullptr)
-        return;
-    for (int i = 0; i < num_msg; i++) {
-        if (response[i].resp) {
-            /* clear before freeing -- might be a password */
-            bzero(response[i].resp, strlen(response[i].resp));
-            free(response[i].resp);
-            response[i].resp = nullptr;
-        }
-    }
-}
-
-struct pam_conv_data
-{
-	const char *username;
-	const char *password;
-};
-
-static
-int lms_conv(int num_msg, const pam_message** msgs, pam_response** resps, void* appdata_ptr)
-{
-	if(num_msg < 1)
-		return PAM_CONV_ERR;
-	if (!resps || !msgs || !appdata_ptr)
-		return PAM_CONV_ERR;
-	
-	pam_conv_data *data = static_cast<pam_conv_data*>( appdata_ptr );
-	pam_response  *response = new (std::nothrow) pam_response[num_msg];
-	if(!response)
-		return PAM_CONV_ERR;
-
-	for(int i = 0; i < num_msg; ++i)
+	switch (authMode)
 	{
-		response[i].resp_retcode = 0;
-		response[i].resp = 0;
-		switch (msgs[i]->msg_style) {
-		case PAM_PROMPT_ECHO_ON:
-			/* on memory allocation failure, auth fails */
-			response[i].resp = strdup(data->username);
-			break;
-		case PAM_PROMPT_ECHO_OFF:
-			response[i].resp = strdup(data->password);
-			break;
-		case PAM_ERROR_MSG:
-		case PAM_TEXT_INFO:
-		default:
-			delete_resp(i, response);
-			return PAM_CONV_ERR;
-		}
-	}
-	
-	*resps = response;
-	return PAM_SUCCESS;
-}
-#endif
+		case Database::User::AuthMode::Internal:
+			return true;
 
-static bool
-pamCheckUserPassword(const std::string& loginName, const std::string& password)
-{
-#ifdef USEPAM
-	pam_conv_data authdata{loginName.c_str(), password.c_str()};
-	pam_conv conv = { lms_conv, &authdata };
-	pam_handle_t *pamh;
-	bool authenticated{false};
-
-	/* Initialize PAM framework */
-	int err = pam_start("lms", loginName.c_str(), &conv, &pamh);
-	if (err != PAM_SUCCESS) {
-		return false;
-	}
-
-	err = pam_authenticate(pamh, 0);
-	if(err == PAM_SUCCESS) 
-	{
-		/* Make sure account and password are still valid */
-		err = pam_acct_mgmt(pamh, PAM_SILENT);
-		authenticated = err == PAM_SUCCESS;
-	}
-
-	(void) pam_end(pamh, 0);
-	return authenticated;
+		case Database::User::AuthMode::PAM:
+#ifdef LMS_SUPPORT_PAM
+			return true;
 #else
-	return false;
+			return false;
 #endif
+	}
+	return false;
 }
 
 static
 bool
 checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
 {
-	bool hasExternalAuth;
+	Database::User::AuthMode authMode;
 	Database::User::PasswordHash passwordHash;
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -144,21 +73,28 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
 		if (!user)
 			return false;
 
-		hasExternalAuth = user->hasExternalAuth();
+		authMode = user->getAuthMode();
 		passwordHash = user->getPasswordHash();
 	}
 
-	if (hasExternalAuth) 
+	switch (authMode)
 	{
-		return pamCheckUserPassword(loginName, password);
-	}
-	else
-	{
-		const Wt::Auth::BCryptHashFunction hashFunc {6};
-		return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
-	}
-}
+		case Database::User::AuthMode::Internal:
+		{
+			const Wt::Auth::BCryptHashFunction hashFunc {6}; // TODO parametrize this
+			return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
+		}
 
+		case Database::User::AuthMode::PAM:
+#ifdef LMS_SUPPORT_PAM
+			return PAM::checkUserPassword(loginName, password);
+#else
+			return false;
+#endif
+	}
+
+	return false;
+}
 
 PasswordService::PasswordCheckResult
 PasswordService::checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password)
diff --git a/src/libs/auth/impl/PasswordService.hpp b/src/libs/auth/impl/PasswordService.hpp
index 99377e8b..a5b8784c 100644
--- a/src/libs/auth/impl/PasswordService.hpp
+++ b/src/libs/auth/impl/PasswordService.hpp
@@ -46,14 +46,13 @@ namespace Auth {
 			PasswordService(PasswordService&&) = delete;
 			PasswordService& operator=(PasswordService&&) = delete;
 
+		private:
 
-			// Password services
+			bool isAuthModeSupported(Database::User::AuthMode authMode) const;
 			PasswordCheckResult		checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) override;
 			Database::User::PasswordHash	hashPassword(const std::string& password) const override;
 			bool				evaluatePasswordStrength(const std::string& loginName, const std::string& password) const override;
 
-		private:
-
 			std::shared_timed_mutex	_mutex;
 			LoginThrottler	_loginThrottler;
 	};
diff --git a/src/libs/auth/impl/pam/PAM.cpp b/src/libs/auth/impl/pam/PAM.cpp
new file mode 100644
index 00000000..03cf0e26
--- /dev/null
+++ b/src/libs/auth/impl/pam/PAM.cpp
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2019 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "PAM.hpp"
+
+#include <cstring>
+
+#include "utils/Exception.hpp"
+#include "utils/Logger.hpp"
+
+#include <security/pam_appl.h>
+
+namespace Auth::PAM
+{
+
+static
+	void
+freeResp(int num_msg, pam_response *response)
+{
+	if (response == nullptr)
+		return;
+
+	for (int i = 0; i < num_msg; i++)
+	{
+		if (response[i].resp)
+		{
+			memset(response[i].resp, 0, strlen(response[i].resp));
+			free(response[i].resp);
+			response[i].resp = nullptr;
+		}
+	}
+
+	free(response);
+}
+
+struct PAMConvData
+{
+	std::string loginName;
+	std::string password;
+};
+
+static
+int
+lms_conv(int msgCount, const pam_message** msgs, pam_response** resps, void* userData)
+{
+	if (msgCount < 1)
+		return PAM_CONV_ERR;
+	if (!resps || !msgs || !userData)
+		return PAM_CONV_ERR;
+
+	const PAMConvData& convData {*static_cast<const PAMConvData*>(userData)};
+
+	pam_response* response {static_cast<pam_response*>(malloc(sizeof(pam_response) * msgCount))};
+	if (!response)
+		return PAM_CONV_ERR;
+
+	for (int i {}; i < msgCount; ++i)
+	{
+		response[i].resp_retcode = 0;
+		response[i].resp = nullptr;
+
+		switch (msgs[i]->msg_style)
+		{
+			case PAM_PROMPT_ECHO_ON:
+				// on memory allocation failure, auth fails
+				response[i].resp = strdup(convData.loginName.c_str());
+				break;
+
+			case PAM_PROMPT_ECHO_OFF:
+				response[i].resp = strdup(convData.password.c_str());
+				break;
+
+			case PAM_ERROR_MSG:
+			case PAM_TEXT_INFO:
+			default:
+				freeResp(i, response);
+				return PAM_CONV_ERR;
+		}
+	}
+
+	*resps = response;
+	return PAM_SUCCESS;
+}
+
+class PAMError
+{
+	public:
+		PAMError(std::string_view msg, pam_handle_t *pamh, int err)
+		{
+			_errorMsg = std::string {msg} + ": " + pam_strerror(pamh, err);
+		}
+
+		std::string_view message() const { return _errorMsg; }
+
+	private:
+		std::string _errorMsg;
+};
+
+class PAMContext
+{
+	public:
+		PAMContext(std::string_view loginName)
+			: _convData {std::string {loginName}, {}}
+		{
+			int err {pam_start("lms", _convData.loginName.c_str(), &_conv, &_pamh)};
+			if (err != PAM_SUCCESS)
+				throw PAMError {"start failed", _pamh, err};
+		}
+
+		~PAMContext()
+		{
+			int err {pam_end(_pamh, 0)};
+			if (err != PAM_SUCCESS)
+				LMS_LOG(AUTH, ERROR) << "end failed: " << pam_strerror(_pamh, err);
+		}
+
+		void authenticate(const std::string& password)
+		{
+			_convData.password = password;
+			int err {pam_authenticate(_pamh, 0)};
+			_convData.password.clear();
+
+			if(err != PAM_SUCCESS)
+				throw PAMError {"authenticate failed", _pamh, err};
+		}
+
+		void validateAccount()
+		{
+			int err {pam_acct_mgmt(_pamh, PAM_SILENT)};
+			if (err != PAM_SUCCESS)
+					throw PAMError {"acct_mgmt failed", _pamh, err};
+		}
+
+	private:
+		PAMConvData _convData;
+		pam_conv _conv {lms_conv, &_convData};
+		pam_handle_t *_pamh {};
+
+};
+
+bool
+checkUserPassword(const std::string& loginName, const std::string& password)
+{
+	try
+	{
+		PAMContext pamContext {loginName};
+
+		pamContext.authenticate(password);
+		pamContext.validateAccount();
+
+		return true;
+	}
+	catch (const PAMError& error)
+	{
+		LMS_LOG(AUTH, ERROR) << "PAM error: " << error.message();
+		return false;
+	}
+}
+
+} // namespace Auth::PAM
+
diff --git a/src/libs/auth/impl/pam/PAM.hpp b/src/libs/auth/impl/pam/PAM.hpp
new file mode 100644
index 00000000..dd0e9732
--- /dev/null
+++ b/src/libs/auth/impl/pam/PAM.hpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2020 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#ifdef LMS_SUPPORT_PAM
+
+#include <string>
+
+namespace Auth::PAM
+{
+	bool checkUserPassword(const std::string& loginName, const std::string& password);
+}
+
+#endif // LMS_SUPPORT_PAM
+
diff --git a/src/libs/auth/include/auth/IPasswordService.hpp b/src/libs/auth/include/auth/IPasswordService.hpp
index fb5f9551..1608c972 100644
--- a/src/libs/auth/include/auth/IPasswordService.hpp
+++ b/src/libs/auth/include/auth/IPasswordService.hpp
@@ -48,6 +48,9 @@ namespace Auth {
 				Mismatch,
 				Throttled,
 			};
+
+			virtual bool isAuthModeSupported(Database::User::AuthMode authMode) const = 0;
+
 			virtual PasswordCheckResult	checkUserPassword(Database::Session& session, const boost::asio::ip::address& clientAddress, const std::string& loginName, const std::string& password) = 0;
 			virtual Database::User::PasswordHash	hashPassword(const std::string& password) const = 0;
 			virtual bool				evaluatePasswordStrength(const std::string& loginName, const std::string& password) const = 0;
diff --git a/src/libs/database/impl/Session.cpp b/src/libs/database/impl/Session.cpp
index 7cf91fcf..17b243b6 100644
--- a/src/libs/database/impl/Session.cpp
+++ b/src/libs/database/impl/Session.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Emeric Poupon
+auth_mode(C) 2013 Emeric Poupon
  *
  * This file is part of LMS.
  *
@@ -40,7 +40,7 @@
 
 namespace Database {
 
-#define LMS_DATABASE_VERSION	24
+#define LMS_DATABASE_VERSION	25
 
 using Version = std::size_t;
 
@@ -267,6 +267,11 @@ CREATE TABLE "user_backup" (
 			// Just increment the scan version of the settings to make the next scheduled scan rescan everything
 			ScanSettings::get(*this).modify()->incScanVersion();
 		}
+		else if (version == 24)
+		{
+			// User's AuthMode
+			_session.execute("ALTER TABLE user ADD auth_mode INTEGER NOT NULL DEFAULT(" + std::to_string(static_cast<int>(User::defaultAuthMode)) + ")");
+		}
 		else
 		{
 			LMS_LOG(DB, ERROR) << "Database version " << version << " cannot be handled using migration";
diff --git a/src/libs/database/impl/User.cpp b/src/libs/database/impl/User.cpp
index 97fa06ab..26321542 100644
--- a/src/libs/database/impl/User.cpp
+++ b/src/libs/database/impl/User.cpp
@@ -70,10 +70,8 @@ AuthToken::getByValue(Session& session, const std::string& value)
 static const std::string playedListName {"__played_tracks__"};
 static const std::string queuedListName {"__queued_tracks__"};
 
-User::User(const std::string& loginName, const PasswordHash& passwordHash)
+User::User(const std::string& loginName)
 : _loginName {loginName}
-, _passwordSalt {passwordHash.salt}
-, _passwordHash {passwordHash.hash}
 {
 }
 
@@ -96,11 +94,11 @@ User::getDemo(Session& session)
 }
 
 User::pointer
-User::create(Session& session, const std::string& loginName, const PasswordHash& passwordHash)
+User::create(Session& session, const std::string& loginName)
 {
 	session.checkUniqueLocked();
 
-	User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName, passwordHash))};
+	User::pointer user {session.getDboSession().add(std::make_unique<User>(loginName))};
 
 	TrackList::create(session, playedListName, TrackList::Type::Internal, false, user);
 	TrackList::create(session, queuedListName, TrackList::Type::Internal, false, user);
diff --git a/src/libs/database/include/database/User.hpp b/src/libs/database/include/database/User.hpp
index 99b4eeb5..8d3e8851 100644
--- a/src/libs/database/include/database/User.hpp
+++ b/src/libs/database/include/database/User.hpp
@@ -100,6 +100,12 @@ class User : public Wt::Dbo::Dbo<User>
 			DEMO	= 2,
 		};
 
+		enum class AuthMode
+		{
+			Internal	= 0,
+			PAM			= 1,
+		};
+
 		struct PasswordHash
 		{
 			std::string salt;
@@ -137,13 +143,14 @@ class User : public Wt::Dbo::Dbo<User>
 		static inline const Bitrate		defaultSubsonicTranscodeBitrate {128000};
 		static inline const UITheme		defaultUITheme {UITheme::Dark};
 		static inline const SubsonicArtistListMode defaultSubsonicArtistListMode {SubsonicArtistListMode::AllArtists};
+		static inline const AuthMode defaultAuthMode {AuthMode::Internal};
 
 
 		User() = default;
-		User(const std::string& loginName, const PasswordHash& passwordHash);
+		User(const std::string& loginName);
 
 		// utility
-		static pointer create(Session& session, const std::string& loginName, const PasswordHash& passwordHash);
+		static pointer create(Session& session, const std::string& loginName);
 
 		static pointer			getById(Session& session, IdType id);
 		static pointer			getByLoginName(Session& session, const std::string& loginName);
@@ -165,7 +172,7 @@ class User : public Wt::Dbo::Dbo<User>
 		void setSubsonicTranscodeBitrate(Bitrate bitrate);
 		void setCurPlayingTrackPos(std::size_t pos)		{ _curPlayingTrackPos = pos; }
 		void setRadio(bool val)					{ _radio = val; }
-		void setExternalAuth(bool val)				{ _externalAuth = val; }
+		void setAuthMode(AuthMode mode) { _authMode = mode;}
 		void setRepeatAll(bool val)				{ _repeatAll = val; }
 		void setUITheme(UITheme uiTheme)			{ _uiTheme = uiTheme; }
 		void clearAuthTokens();
@@ -180,7 +187,7 @@ class User : public Wt::Dbo::Dbo<User>
 		std::size_t		getCurPlayingTrackPos() const { return _curPlayingTrackPos; }
 		bool			isRepeatAllSet() const { return _repeatAll; }
 		bool			isRadioSet() const { return _radio; }
-		bool			hasExternalAuth() const { return _externalAuth; }
+		AuthMode		getAuthMode() const { return _authMode; }
 		UITheme			getUITheme() const { return _uiTheme; }
 		SubsonicArtistListMode	getSubsonicArtistListMode() const { return _subsonicArtistListMode; }
 
@@ -220,7 +227,7 @@ class User : public Wt::Dbo::Dbo<User>
 			Wt::Dbo::field(a, _curPlayingTrackPos, "cur_playing_track_pos");
 			Wt::Dbo::field(a, _repeatAll, "repeat_all");
 			Wt::Dbo::field(a, _radio, "radio");
-			Wt::Dbo::field(a, _externalAuth, "external_auth");
+			Wt::Dbo::field(a, _authMode, "auth_mode");
 			Wt::Dbo::hasMany(a, _tracklists, Wt::Dbo::ManyToOne, "user");
 			Wt::Dbo::hasMany(a, _starredArtists, Wt::Dbo::ManyToMany, "user_artist_starred", "", Wt::Dbo::OnDeleteCascade);
 			Wt::Dbo::hasMany(a, _starredReleases, Wt::Dbo::ManyToMany, "user_release_starred", "", Wt::Dbo::OnDeleteCascade);
@@ -249,8 +256,7 @@ class User : public Wt::Dbo::Dbo<User>
 		int		_curPlayingTrackPos {}; // Current track position in queue
 		bool		_repeatAll {};
 		bool		_radio {};
-		
-		bool		_externalAuth {false};
+		AuthMode	_authMode {defaultAuthMode};
 
 		Wt::Dbo::collection<Wt::Dbo::ptr<TrackList>> _tracklists;
 		Wt::Dbo::collection<Wt::Dbo::ptr<Artist>> _starredArtists;
diff --git a/src/libs/subsonic/impl/SubsonicResource.cpp b/src/libs/subsonic/impl/SubsonicResource.cpp
index 6d793f20..a177590d 100644
--- a/src/libs/subsonic/impl/SubsonicResource.cpp
+++ b/src/libs/subsonic/impl/SubsonicResource.cpp
@@ -597,7 +597,9 @@ handleCreateUserRequest(RequestContext& context)
 	if (User::getByLoginName(context.dbSession, username) != User::pointer{})
 		throw UserAlreadyExistsGenericError {};
 
-	User::pointer user {User::create(context.dbSession, username, hash)};
+	User::pointer user {User::create(context.dbSession, username)};
+	user.modify()->setAuthMode(User::AuthMode::Internal);
+	user.modify()->setPasswordHash(hash);
 
 	return Response::createOkResponse(context);
 }
diff --git a/src/libs/utils/impl/String.cpp b/src/libs/utils/impl/String.cpp
index edef6744..a2065c75 100644
--- a/src/libs/utils/impl/String.cpp
+++ b/src/libs/utils/impl/String.cpp
@@ -164,6 +164,7 @@ jsEscape(const std::string& str)
 		{ '\r', "\\r" },
 		{ '\t', "\\t" },
 		{ '"', "\\\"" },
+		{ '\'', "\\\'" },
 	};
 
 	std::string escaped;
diff --git a/src/lms/ui/admin/InitWizardView.cpp b/src/lms/ui/admin/InitWizardView.cpp
index e62820b0..a9f3cc3f 100644
--- a/src/lms/ui/admin/InitWizardView.cpp
+++ b/src/lms/ui/admin/InitWizardView.cpp
@@ -64,8 +64,10 @@ class InitWizardModel : public Wt::WFormModel
 			if (!Database::User::getAll(LmsApp->getDbSession()).empty())
 				throw LmsException("Admin user already created");
 
-			Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8(), passwordHash)};
+			Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(AdminLoginField).toUTF8())};
 			user.modify()->setType(Database::User::Type::ADMIN);
+			user.modify()->setAuthMode(Database::User::AuthMode::Internal);
+			user.modify()->setPasswordHash(passwordHash);
 		}
 
 		bool validateField(Field field)
diff --git a/src/lms/ui/admin/UserView.cpp b/src/lms/ui/admin/UserView.cpp
index fec69cb7..3daad20f 100644
--- a/src/lms/ui/admin/UserView.cpp
+++ b/src/lms/ui/admin/UserView.cpp
@@ -51,11 +51,15 @@ class UserModel : public Wt::WFormModel
 		static inline const Field LoginField {"login"};
 		static inline const Field PasswordField {"password"};
 		static inline const Field DemoField {"demo"};
-		static inline const Field ExternalAuthField{"external-auth"};
+		static inline const Field AuthModeField{"auth-mode"};
+
+		using AuthModeModel = ValueStringModel<User::AuthMode>;
 
 		UserModel(std::optional<Database::IdType> userId)
 		: _userId {userId}
 		{
+			initializeModels();
+
 			if (!_userId)
 			{
 				addField(LoginField);
@@ -64,15 +68,16 @@ class UserModel : public Wt::WFormModel
 
 			addField(PasswordField);
 			addField(DemoField);
-			addField(ExternalAuthField);
+			addField(AuthModeField);
 
 			if (!_userId)
 				setValidator(PasswordField, createMandatoryValidator());
 
-			// populate the model with initial data
 			loadData();
 		}
 
+		std::shared_ptr<AuthModeModel> getAuthModeModel() const { return _authModeModel; }
+
 		void saveData()
 		{
 			std::optional<Database::User::PasswordHash> passwordHash;
@@ -86,44 +91,50 @@ class UserModel : public Wt::WFormModel
 				// Update user
 				Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
 
-				// Account
-				if (passwordHash)
+				auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+				if (!authModeRow)
+					throw LmsException {"Bad authentication mode"};
+
+				const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+				user.modify()->setAuthMode(authMode);
+				if (authMode == Database::User::AuthMode::Internal && passwordHash)
 				{
 					user.modify()->setPasswordHash(*passwordHash);
 					user.modify()->clearAuthTokens();
 				}
-				
-				user.modify()->setExternalAuth(static_cast<bool>(Wt::asNumber(value(ExternalAuthField))));
 			}
 			else
 			{
 				// Create user
-				Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(LoginField).toUTF8(), *passwordHash)};
+				Database::User::pointer user {Database::User::create(LmsApp->getDbSession(), valueText(LoginField).toUTF8())};
 
 				if (Wt::asNumber(value(DemoField)))
 					user.modify()->setType(Database::User::Type::DEMO);
-				
-				if (Wt::asNumber(value(ExternalAuthField)))
-					user.modify()->setExternalAuth(true);
-				else
-					user.modify()->setExternalAuth(false);
+
+				auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+				if (!authModeRow)
+					throw LmsException {"Bad authentication mode"};
+
+				const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+				user.modify()->setAuthMode(authMode);
+				if (authMode == Database::User::AuthMode::Internal)
+					user.modify()->setPasswordHash(*passwordHash);
 			}
 		}
 
 	private:
-		
-		Wt::WString validatePassword() const 
-		{
-			Wt::WString error;
 
-			if (Wt::asNumber(value(ExternalAuthField)))
-			{
-				if (!valueText(PasswordField).empty())
-				{
-					error = Wt::WString::tr("Lms.password_must_be_empty_for_ext");
-				}
-			}
-			else if (!valueText(PasswordField).empty())
+		void validatePassword(Wt::WString& error) const
+		{
+			auto authModeRow {_authModeModel->getRowFromString(valueText(AuthModeField))};
+			if (!authModeRow)
+				throw LmsException {"Bad authentication mode"};
+
+			const Database::User::AuthMode authMode {_authModeModel->getValue(*authModeRow)};
+			if (authMode != Database::User::AuthMode::Internal)
+				return;
+
+			if (!valueText(PasswordField).empty())
 			{
 				if (Wt::asNumber(value(DemoField)))
 				{
@@ -138,11 +149,18 @@ class UserModel : public Wt::WFormModel
 						error = Wt::WString::tr("Lms.password-too-weak");
 				}
 			}
-			else 
+			else
 			{
-				error = Wt::WString::tr("Lms.password-must-not-be-empty");
+				auto transaction {LmsApp->getDbSession().createSharedTransaction()};
+
+				// Allow an empty password if and only if the user previously had one set
+				const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
+				if (!user)
+					throw UserNotFoundException {*_userId};
+
+				if (user->getPasswordHash().hash.empty())
+					error = Wt::WString::tr("Lms.password-must-not-be-empty");
 			}
-			return error;
 		}
 
 		void loadData()
@@ -157,19 +175,14 @@ class UserModel : public Wt::WFormModel
 				throw UserNotFoundException {*_userId};
 			else if (user == LmsApp->getUser())
 				throw UserNotAllowedException {};
-		}
-		
-		bool getExternalAuth() const 
-		{
-			if (_userId)
-			{
-				auto transaction {LmsApp->getDbSession().createSharedTransaction()};
 
-				const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
-				return user->hasExternalAuth();
+			auto authModeRow {_authModeModel->getRowFromValue(user->getAuthMode())};
+			if (authModeRow)
+			{
+				setValue(AuthModeField, _authModeModel->getString(*authModeRow));
+				if (_authModeModel->getValue(*authModeRow) != User::AuthMode::Internal)
+					setReadOnly(PasswordField, true);
 			}
-			else
-				return Wt::asNumber(value(ExternalAuthField));
 		}
 
 		std::string getLoginName() const
@@ -199,7 +212,7 @@ class UserModel : public Wt::WFormModel
 			}
 			else if (field == PasswordField)
 			{
-				error = validatePassword();
+				validatePassword(error);
 			}
 			else if (field == DemoField)
 			{
@@ -217,7 +230,18 @@ class UserModel : public Wt::WFormModel
 			return false;
 		}
 
+		void initializeModels()
+		{
+			_authModeModel = std::make_shared<AuthModeModel>();
+
+			if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::Internal))
+				_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.internal"), User::AuthMode::Internal);
+			if (ServiceProvider<::Auth::IPasswordService>::get()->isAuthModeSupported(User::AuthMode::PAM))
+				_authModeModel->add(Wt::WString::tr("Lms.Admin.User.auth-mode.pam"), User::AuthMode::PAM);
+		}
+
 		std::optional<Database::IdType> _userId;
+		std::shared_ptr<AuthModeModel>	_authModeModel;
 };
 
 UserView::UserView()
@@ -254,14 +278,7 @@ UserView::refreshView()
 
 		t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-edit").arg(user->getLoginName()), Wt::TextFormat::Plain);
 		t->setCondition("if-has-last-login", true);
-
 		t->bindString("last-login", user->getLastLogin().toString(), Wt::TextFormat::Plain);
-		
-
-		auto extCheckBox = std::make_unique<Wt::WCheckBox>();
-		extCheckBox->setChecked(user->hasExternalAuth());
-		t->setFormWidget(UserModel::ExternalAuthField, std::move(extCheckBox));
-		t->setCondition("if-external-auth", true);
 	}
 	else
 	{
@@ -269,13 +286,21 @@ UserView::refreshView()
 		t->setCondition("if-has-login", true);
 		t->setFormWidget(UserModel::LoginField, std::make_unique<Wt::WLineEdit>());
 		t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-create"));
-		
-		auto extCheckBox = std::make_unique<Wt::WCheckBox>();
-		extCheckBox->setChecked(true);
-		t->setCondition(UserModel::ExternalAuthField, false);
-		t->setFormWidget("external-auth", std::move(extCheckBox));
 	}
 
+	// Auth mode
+	auto authMode = std::make_unique<Wt::WComboBox>();
+	authMode->setModel(model->getAuthModeModel());
+	authMode->activated().connect([=](int row)
+	{
+		const User::AuthMode authMode {model->getAuthModeModel()->getValue(row)};
+
+		model->setReadOnly(UserModel::PasswordField, authMode != User::AuthMode::Internal);
+		t->updateModel(model.get());
+		t->updateView(model.get());
+	});
+	t->setFormWidget(UserModel::AuthModeField, std::move(authMode));
+
 	// Password
 	auto passwordEdit = std::make_unique<Wt::WLineEdit>();
 	passwordEdit->setEchoMode(Wt::EchoMode::Password);
@@ -286,7 +311,7 @@ UserView::refreshView()
 	t->setFormWidget(UserModel::DemoField, std::make_unique<Wt::WCheckBox>());
 	if (!userId && ServiceProvider<IConfig>::get()->getBool("demo", false))
 		t->setCondition("if-demo", true);
-	
+
 	Wt::WPushButton* saveBtn = t->bindNew<Wt::WPushButton>("save-btn", Wt::WString::tr(userId ? "Lms.save" : "Lms.create"));
 	saveBtn->clicked().connect([=]()
 	{
diff --git a/src/test/database/DatabaseTest.cpp b/src/test/database/DatabaseTest.cpp
index c5edcc1f..54602e89 100644
--- a/src/test/database/DatabaseTest.cpp
+++ b/src/test/database/DatabaseTest.cpp
@@ -708,7 +708,7 @@ testMultipleTracksMultipleClustersTopRelease(Session& session)
 	ScopedRelease releaseB {session, "ReleaseB"};
 	ScopedRelease releaseC {session, "ReleaseC"};
 
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "TrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 
 	{
@@ -1221,7 +1221,7 @@ static
 void
 testSingleUser(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -1240,7 +1240,7 @@ void
 testSingleStarredArtist(Session& session)
 {
 	ScopedArtist artist {session, "MyArtist"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -1264,7 +1264,7 @@ void
 testSingleStarredRelease(Session& session)
 {
 	ScopedRelease release {session, "MyRelease"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createUniqueTransaction()};
@@ -1288,7 +1288,7 @@ void
 testSingleStarredTrack(Session& session)
 {
 	ScopedTrack track {session, "MyTrack"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 
 	{
 		auto transaction {session.createUniqueTransaction()};
@@ -1311,7 +1311,7 @@ static
 void
 testSingleTrackList(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MytrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 
 	{
@@ -1328,7 +1328,7 @@ static
 void
 testSingleTrackListMultipleTrack(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MytrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	std::list<ScopedTrack> tracks;
 
@@ -1354,7 +1354,7 @@ static
 void
 testSingleTrackListMultipleTrackSingleCluster(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	ScopedClusterType clusterType {session, "MyClusterType"};
 	ScopedCluster cluster {session, clusterType.lockAndGet(), "MyCluster"};
@@ -1388,7 +1388,7 @@ static
 void
 testSingleTrackListMultipleTrackMultiClusters(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	ScopedClusterType clusterType {session, "MyClusterType"};
 	ScopedCluster cluster1 {session, clusterType.lockAndGet(), "MyCluster1"};
@@ -1443,7 +1443,7 @@ static
 void
 testSingleTrackListMultipleTrackMultiClustersRecentlyPlayed(Session& session)
 {
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackList trackList {session, "MyTrackList", TrackList::Type::Playlist, false, user.lockAndGet()};
 	ScopedClusterType clusterType {session, "MyClusterType"};
 	ScopedCluster cluster1 {session, clusterType.lockAndGet(), "MyCluster1"};
@@ -1821,7 +1821,7 @@ void
 testSingleTrackSingleUserSingleBookmark(Session& session)
 {
 	ScopedTrack track {session, "MyTrack"};
-	ScopedUser user {session, "MyUser", User::PasswordHash {}};
+	ScopedUser user {session, "MyUser"};
 	ScopedTrackBookmark bookmark {session, user.lockAndGet(), track.lockAndGet()};
 
 	{