owen/lms
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Removed session parameters from auth services

Browse Source
This commit is contained in:
emeric
2021-10-03 14:35:25 +02:00
parent cbc137529b
commit 617139c2f4
25 changed files with 135 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libs/auth/impl/AuthServiceBase.cpp
+24 -8
View File
@@ -19,25 +19,33 @@
#include "AuthServiceBase.hpp"
#include "database/Db.hpp"
#include "database/Session.hpp"
#include "database/User.hpp"
#include "utils/Logger.hpp"
namespace Auth
{
Database::UserId
AuthServiceBase::getOrCreateUser(Database::Session& session, std::string_view loginName)
using namespace Database;
AuthServiceBase::AuthServiceBase(Db& db)
: _db {db}
{}
UserId
AuthServiceBase::getOrCreateUser(std::string_view loginName)
{
Session& session {getDbSession()};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getByLoginName(session, loginName)};
User::pointer user {User::getByLoginName(session, loginName)};
if (!user)
{
const Database::UserType type {Database::User::getCount(session) == 0 ? Database::UserType::ADMIN : Database::UserType::REGULAR};
const UserType type {User::getCount(session) == 0 ? UserType::ADMIN : UserType::REGULAR};
LMS_LOG(AUTH, DEBUG) << "Creating user '" << loginName << "', admin = " << (type == Database::UserType::ADMIN);
LMS_LOG(AUTH, DEBUG) << "Creating user '" << loginName << "', admin = " << (type == UserType::ADMIN);
user = Database::User::create(session, loginName);
user = User::create(session, loginName);
user.modify()->setType(type);
}
@@ -45,11 +53,19 @@ namespace Auth
}
void
AuthServiceBase::onUserAuthenticated(Database::Session& session, Database::UserId userId)
AuthServiceBase::onUserAuthenticated(UserId userId)
{
Session& session {getDbSession()};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getById(session, userId)};
User::pointer user {User::getById(session, userId)};
if (user)
user.modify()->setLastLogin(Wt::WDateTime::currentDateTime());
}
Session&
AuthServiceBase::getDbSession()
{
return _db.getTLSSession();
}
}
src/libs/auth/impl/AuthServiceBase.hpp
+10 -2
View File
@@ -24,6 +24,7 @@
namespace Database
{
class Db;
class Session;
}
@@ -32,7 +33,14 @@ namespace Auth
class AuthServiceBase
{
protected:
Database::UserId getOrCreateUser(Database::Session& session, std::string_view loginName);
void onUserAuthenticated(Database::Session& session, Database::UserId userId);
AuthServiceBase(Database::Db& db);
Database::UserId getOrCreateUser(std::string_view loginName);
void onUserAuthenticated(Database::UserId userId);
Database::Session& getDbSession();
private:
Database::Db& _db;
};
}
src/libs/auth/impl/AuthTokenService.cpp
+16 -11
View File
@@ -32,24 +32,27 @@
namespace Auth
{
std::unique_ptr<IAuthTokenService> createAuthTokenService(std::size_t maxThrottlerEntries)
std::unique_ptr<IAuthTokenService> createAuthTokenService(Database::Db& db, std::size_t maxThrottlerEntries)
{
return std::make_unique<AuthTokenService>(maxThrottlerEntries);
return std::make_unique<AuthTokenService>(db, maxThrottlerEntries);
}
static const Wt::Auth::SHA1HashFunction sha1Function;
AuthTokenService::AuthTokenService(std::size_t maxThrottlerEntries)
: _loginThrottler {maxThrottlerEntries}
AuthTokenService::AuthTokenService(Database::Db& db, std::size_t maxThrottlerEntries)
: AuthServiceBase {db}
, _loginThrottler {maxThrottlerEntries}
{
}
std::string
AuthTokenService::createAuthToken(Database::Session& session, Database::UserId userId, const Wt::WDateTime& expiry)
AuthTokenService::createAuthToken(Database::UserId userId, const Wt::WDateTime& expiry)
{
const std::string secret {Wt::WRandom::generateId(32)};
const std::string secretHash {sha1Function.compute(secret, {})};
Database::Session& session {getDbSession()};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getById(session, userId)};
@@ -66,12 +69,12 @@ namespace Auth
return secret;
}
static
std::optional<AuthTokenService::AuthTokenProcessResult::AuthTokenInfo>
processAuthToken(Database::Session& session, std::string_view secret)
AuthTokenService::processAuthToken(std::string_view secret)
{
const std::string secretHash {sha1Function.compute(std::string {secret}, {})};
Database::Session& session {getDbSession()};
auto transaction {session.createUniqueTransaction()};
Database::AuthToken::pointer authToken {Database::AuthToken::getByValue(session, secretHash)};
@@ -93,7 +96,7 @@ namespace Auth
}
AuthTokenService::AuthTokenProcessResult
AuthTokenService::processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, std::string_view tokenValue)
AuthTokenService::processAuthToken(const boost::asio::ip::address& clientAddress, std::string_view tokenValue)
{
// Do not waste too much resource on brute force attacks (optim)
{
@@ -103,7 +106,7 @@ namespace Auth
return AuthTokenProcessResult {AuthTokenProcessResult::State::Throttled};
}
auto res {Auth::processAuthToken(session, tokenValue)};
auto res {processAuthToken(tokenValue)};
{
std::unique_lock lock {_mutex};
@@ -117,14 +120,16 @@ namespace Auth
}
_loginThrottler.onGoodClientAttempt(clientAddress);
onUserAuthenticated(session, res->userId);
onUserAuthenticated(res->userId);
return AuthTokenProcessResult {AuthTokenProcessResult::State::Granted, std::move(*res)};
}
}
void
AuthTokenService::clearAuthTokens(Database::Session& session, Database::UserId userId)
AuthTokenService::clearAuthTokens(Database::UserId userId)
{
Database::Session& session {getDbSession()};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getById(session, userId)};
src/libs/auth/impl/AuthTokenService.hpp
+6 -4
View File
@@ -35,7 +35,7 @@ namespace Auth
class AuthTokenService : public IAuthTokenService, public AuthServiceBase
{
public:
AuthTokenService(std::size_t maxThrottlerEntries);
AuthTokenService(Database::Db& db, std::size_t maxThrottlerEntries);
AuthTokenService(const AuthTokenService&) = delete;
AuthTokenService& operator=(const AuthTokenService&) = delete;
@@ -43,9 +43,11 @@ namespace Auth
AuthTokenService& operator=(AuthTokenService&&) = delete;
private:
AuthTokenProcessResult processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, std::string_view tokenValue) override;
std::string createAuthToken(Database::Session& session, Database::UserId userId, const Wt::WDateTime& expiry) override;
void clearAuthTokens(Database::Session& session, Database::UserId userId) override;
AuthTokenProcessResult processAuthToken(const boost::asio::ip::address& clientAddress, std::string_view tokenValue) override;
std::string createAuthToken(Database::UserId userId, const Wt::WDateTime& expiry) override;
void clearAuthTokens(Database::UserId userId) override;
std::optional<AuthTokenService::AuthTokenProcessResult::AuthTokenInfo> processAuthToken(std::string_view secret);
std::shared_mutex _mutex;
LoginThrottler _loginThrottler;
src/libs/auth/impl/EnvService.cpp
+2 -2
View File
@@ -25,10 +25,10 @@
namespace Auth
{
std::unique_ptr<IEnvService>
createEnvService(std::string_view backendName)
createEnvService(std::string_view backendName, Database::Db& db)
{
if (backendName == "http-headers")
return std::make_unique<HttpHeadersEnvService>();
return std::make_unique<HttpHeadersEnvService>(db);
throw Exception {"Authentication backend '" + std::string {backendName} + "' is not supported!"};
}
src/libs/auth/impl/PasswordServiceBase.cpp
+10 -12
View File
@@ -39,29 +39,27 @@ namespace Auth
static const Wt::Auth::SHA1HashFunction sha1Function;
std::unique_ptr<IPasswordService>
createPasswordService(std::string_view passwordAuthenticationBackend, std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService)
createPasswordService(std::string_view passwordAuthenticationBackend, Database::Db& db, std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService)
{
if (passwordAuthenticationBackend == "internal")
return std::make_unique<InternalPasswordService>(maxThrottlerEntries, authTokenService);
return std::make_unique<InternalPasswordService>(db, maxThrottlerEntries, authTokenService);
#ifdef LMS_SUPPORT_PAM
else if (passwordAuthenticationBackend == "pam")
return std::make_unique<PAMPasswordService>(maxThrottlerEntries, authTokenService);
return std::make_unique<PAMPasswordService>(db, maxThrottlerEntries, authTokenService);
#endif // LMS_SUPPORT_PAM
throw Exception {"Authentication backend '" + std::string {passwordAuthenticationBackend} + "' is not supported!"};
}
PasswordServiceBase::PasswordServiceBase(std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService)
: _loginThrottler {maxThrottlerEntries}
PasswordServiceBase::PasswordServiceBase(Database::Db& db, std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService)
: AuthServiceBase {db}
, _loginThrottler {maxThrottlerEntries}
, _authTokenService {authTokenService}
{
}
PasswordServiceBase::CheckResult
PasswordServiceBase::checkUserPassword(Database::Session& session,
const boost::asio::ip::address& clientAddress,
std::string_view loginName,
std::string_view password)
PasswordServiceBase::checkUserPassword(const boost::asio::ip::address& clientAddress, std::string_view loginName, std::string_view password)
{
LMS_LOG(AUTH, DEBUG) << "Checking password for user '" << loginName << "'";
@@ -73,7 +71,7 @@ namespace Auth
return {CheckResult::State::Throttled};
}
const bool match {checkUserPassword(session, loginName, password)};
const bool match {checkUserPassword(loginName, password)};
{
std::unique_lock lock {_mutex};
@@ -84,8 +82,8 @@ namespace Auth
{
_loginThrottler.onGoodClientAttempt(clientAddress);
const Database::UserId userId {getOrCreateUser(session, loginName)};
onUserAuthenticated(session, userId);
const Database::UserId userId {getOrCreateUser(loginName)};
onUserAuthenticated(userId);
return {CheckResult::State::Granted, userId};
}
else
src/libs/auth/impl/PasswordServiceBase.hpp
+6 -8
View File
@@ -27,6 +27,7 @@
namespace Database
{
class Db;
class Session;
}
@@ -36,7 +37,7 @@ namespace Auth
class PasswordServiceBase : public IPasswordService, public AuthServiceBase
{
public:
PasswordServiceBase(std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService);
PasswordServiceBase(Database::Db& db, std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService);
PasswordServiceBase(const PasswordServiceBase&) = delete;
PasswordServiceBase& operator=(const PasswordServiceBase&) = delete;
@@ -47,14 +48,11 @@ namespace Auth
IAuthTokenService& getAuthTokenService() { return _authTokenService; }
private:
virtual bool checkUserPassword(Database::Session& session,
std::string_view loginName,
std::string_view password) = 0;
virtual bool checkUserPassword(std::string_view loginName, std::string_view password) = 0;
CheckResult checkUserPassword(Database::Session& session,
const boost::asio::ip::address& clientAddress,
std::string_view loginName,
std::string_view password) override;
CheckResult checkUserPassword(const boost::asio::ip::address& clientAddress,
std::string_view loginName,
std::string_view password) override;
std::shared_mutex _mutex;
LoginThrottler _loginThrottler;
src/libs/auth/impl/http-headers/HttpHeadersEnvService.cpp
+9 -8
View File
@@ -28,14 +28,15 @@
namespace Auth
{
HttpHeadersEnvService::HttpHeadersEnvService()
: _fieldName {Service<IConfig>::get()->getString("http-headers-login-field", "X-Forwarded-User")}
HttpHeadersEnvService::HttpHeadersEnvService(Database::Db& db)
: AuthServiceBase {db}
, _fieldName {Service<IConfig>::get()->getString("http-headers-login-field", "X-Forwarded-User")}
{
LMS_LOG(AUTH, INFO) << "Using http header field = '" << _fieldName << "'";
}
HttpHeadersEnvService::CheckResult
HttpHeadersEnvService::processEnv(Database::Session& session, const Wt::WEnvironment& env)
HttpHeadersEnvService::processEnv(const Wt::WEnvironment& env)
{
const std::string loginName {env.headerValue(_fieldName)};
if (loginName.empty())
@@ -43,13 +44,13 @@ namespace Auth
LMS_LOG(AUTH, DEBUG) << "Extracted login name = '" << loginName << "' from HTTP header";
const Database::UserId userId {getOrCreateUser(session, loginName)};
onUserAuthenticated(session, userId);
const Database::UserId userId {getOrCreateUser(loginName)};
onUserAuthenticated(userId);
return {CheckResult::State::Granted, userId};
}
HttpHeadersEnvService::CheckResult
HttpHeadersEnvService::processRequest(Database::Session& session, const Wt::Http::Request& request)
HttpHeadersEnvService::processRequest(const Wt::Http::Request& request)
{
const std::string loginName {request.headerValue(_fieldName)};
if (loginName.empty())
@@ -57,8 +58,8 @@ namespace Auth
LMS_LOG(AUTH, DEBUG) << "Extracted login name = '" << loginName << "' from HTTP header";
const Database::UserId userId {getOrCreateUser(session, loginName)};
onUserAuthenticated(session, userId);
const Database::UserId userId {getOrCreateUser(loginName)};
onUserAuthenticated(userId);
return {CheckResult::State::Granted, userId};
}
src/libs/auth/impl/http-headers/HttpHeadersEnvService.hpp
+3 -3
View File
@@ -27,11 +27,11 @@ namespace Auth
class HttpHeadersEnvService : public IEnvService, public AuthServiceBase
{
public:
HttpHeadersEnvService();
HttpHeadersEnvService(Database::Db& db);
private:
CheckResult processEnv(Database::Session& session, const Wt::WEnvironment& env) override;
CheckResult processRequest(Database::Session& session, const Wt::Http::Request& request) override;
CheckResult processEnv(const Wt::WEnvironment& env) override;
CheckResult processRequest(const Wt::Http::Request& request) override;
std::string _fieldName;
};
src/libs/auth/impl/internal/InternalPasswordService.cpp
+7 -7
View File
@@ -29,8 +29,8 @@
namespace Auth
{
InternalPasswordService::InternalPasswordService(std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService)
: PasswordServiceBase {maxThrottlerEntries, authTokenService}
InternalPasswordService::InternalPasswordService(Database::Db& db, std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService)
: PasswordServiceBase {db, maxThrottlerEntries, authTokenService}
{
_validator.setMinimumLength(Wt::Auth::PasswordStrengthType::OneCharClass, 4);
_validator.setMinimumLength(Wt::Auth::PasswordStrengthType::TwoCharClass, 4);
@@ -42,14 +42,13 @@ namespace Auth
}
bool
InternalPasswordService::checkUserPassword(Database::Session& session,
std::string_view loginName,
std::string_view password)
InternalPasswordService::checkUserPassword(std::string_view loginName, std::string_view password)
{
LMS_LOG(AUTH, DEBUG) << "Checking internal password for user '" << loginName << "'";
Database::User::PasswordHash passwordHash;
{
Database::Session& session {getDbSession()};
auto transaction {session.createSharedTransaction()};
const Database::User::pointer user {Database::User::getByLoginName(session, loginName)};
@@ -96,10 +95,11 @@ namespace Auth
}
void
InternalPasswordService::setPassword(Database::Session& session, Database::UserId userId, std::string_view newPassword)
InternalPasswordService::setPassword(Database::UserId userId, std::string_view newPassword)
{
const Database::User::PasswordHash passwordHash {hashPassword(newPassword)};
Database::Session& session {getDbSession()};
auto transaction {session.createUniqueTransaction()};
Database::User::pointer user {Database::User::getById(session, userId)};
@@ -117,7 +117,7 @@ namespace Auth
}
user.modify()->setPasswordHash(passwordHash);
getAuthTokenService().clearAuthTokens(session, userId);
getAuthTokenService().clearAuthTokens(userId);
}
Database::User::PasswordHash
src/libs/auth/impl/internal/InternalPasswordService.hpp
+3 -5
View File
@@ -33,16 +33,14 @@ namespace Auth
class InternalPasswordService : public PasswordServiceBase
{
public:
InternalPasswordService(std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService);
InternalPasswordService(Database::Db& db, std::size_t maxThrottlerEntries, IAuthTokenService& authTokenService);
private:
bool checkUserPassword(Database::Session& session,
std::string_view loginName,
std::string_view password) override;
bool checkUserPassword(std::string_view loginName, std::string_view password) override;
bool canSetPasswords() const override;
PasswordAcceptabilityResult checkPasswordAcceptability(std::string_view loginName, const PasswordValidationContext& context) const override;
void setPassword(Database::Session& session, Database::UserId userId, std::string_view newPassword) override;
void setPassword(Database::UserId userId, std::string_view newPassword) override;
Database::User::PasswordHash hashPassword(std::string_view password) const;
void hashRandomPassword() const;
src/libs/auth/impl/pam/PAMPasswordService.cpp
+2 -2
View File
@@ -161,7 +161,7 @@ namespace Auth
};
bool
PAMPasswordService::checkUserPassword(Database::Session& /*session*/, std::string_view loginName, std::string_view password)
PAMPasswordService::checkUserPassword(std::string_view loginName, std::string_view password)
{
try
{
@@ -193,7 +193,7 @@ namespace Auth
}
void
PAMPasswordService::setPassword(Database::Session&, Database::UserId, std::string_view)
PAMPasswordService::setPassword(Database::UserId, std::string_view)
{
throw NotImplementedException {};
}
src/libs/auth/impl/pam/PAMPasswordService.hpp
+2 -7
View File
@@ -31,14 +31,9 @@ namespace Auth
using PasswordServiceBase::PasswordServiceBase;
private:
bool checkUserPassword(Database::Session& session,
std::string_view loginName,
std::string_view password) override;
bool checkUserPassword(std::string_view loginName,std::string_view password) override;
bool canSetPasswords() const override;
PasswordAcceptabilityResult checkPasswordAcceptability(std::string_view loginName, const PasswordValidationContext& context) const override;
void setPassword(Database::Session& session,
Database::UserId userId,
std::string_view newPassword) override;
void setPassword(Database::UserId userId, std::string_view newPassword) override;
};
}
src/libs/auth/include/auth/IAuthTokenService.hpp
+5 -5
View File
@@ -31,7 +31,7 @@
namespace Database
{
class Session;
class Db;
class User;
}
@@ -63,12 +63,12 @@ namespace Auth
};
// Provided token is only accepted once
virtual AuthTokenProcessResult processAuthToken(Database::Session& session, const boost::asio::ip::address& clientAddress, std::string_view tokenValue) = 0;
virtual AuthTokenProcessResult processAuthToken(const boost::asio::ip::address& clientAddress, std::string_view tokenValue) = 0;
// Returns a one time token
virtual std::string createAuthToken(Database::Session& session, Database::UserId userid, const Wt::WDateTime& expiry) = 0;
virtual void clearAuthTokens(Database::Session& session, Database::UserId userid) = 0;
virtual std::string createAuthToken(Database::UserId userid, const Wt::WDateTime& expiry) = 0;
virtual void clearAuthTokens(Database::UserId userid) = 0;
};
std::unique_ptr<IAuthTokenService> createAuthTokenService(std::size_t maxThrottlerEntryCount);
std::unique_ptr<IAuthTokenService> createAuthTokenService(Database::Db& db, std::size_t maxThrottlerEntryCount);
}
src/libs/auth/include/auth/IEnvService.hpp
+4 -3
View File
@@ -26,6 +26,7 @@
namespace Database
{
class Db;
class Session;
}
@@ -60,9 +61,9 @@ namespace Auth
std::optional<Database::UserId> userId {};
};
virtual CheckResult processEnv(Database::Session& session, const Wt::WEnvironment& env) = 0;
virtual CheckResult processRequest(Database::Session& session, const Wt::Http::Request& request) = 0;
virtual CheckResult processEnv(const Wt::WEnvironment& env) = 0;
virtual CheckResult processRequest(const Wt::Http::Request& request) = 0;
};
std::unique_ptr<IEnvService> createEnvService(std::string_view backendName);
std::unique_ptr<IEnvService> createEnvService(std::string_view backendName, Database::Db& db);
} // namespace Auth
src/libs/auth/include/auth/IPasswordService.hpp
+6 -7
View File
@@ -30,7 +30,7 @@
namespace Database
{
class Session;
class Db;
class User;
}
@@ -56,10 +56,9 @@ namespace Auth
std::optional<Database::UserId> userId {};
std::optional<Wt::WDateTime> expiry {};
};
virtual CheckResult checkUserPassword(Database::Session& session,
const boost::asio::ip::address& clientAddress,
std::string_view loginName,
std::string_view password) = 0;
virtual CheckResult checkUserPassword(const boost::asio::ip::address& clientAddress,
std::string_view loginName,
std::string_view password) = 0;
virtual bool canSetPasswords() const = 0;
@@ -70,9 +69,9 @@ namespace Auth
MustMatchLoginName,
};
virtual PasswordAcceptabilityResult checkPasswordAcceptability(std::string_view password, const PasswordValidationContext& context) const = 0;
virtual void setPassword(Database::Session& session, Database::UserId userId, std::string_view newPassword) = 0;
virtual void setPassword(Database::UserId userId, std::string_view newPassword) = 0;
};
std::unique_ptr<IPasswordService> createPasswordService(std::string_view authPasswordBackend, std::size_t maxThrottlerEntryCount, IAuthTokenService& authTokenService);
std::unique_ptr<IPasswordService> createPasswordService(std::string_view authPasswordBackend, Database::Db& db, std::size_t maxThrottlerEntryCount, IAuthTokenService& authTokenService);
}