Added authentication backends: internal, pam and http-headers. fixes #119

src/libs/auth/impl/pam/PAMPasswordService.cpp

@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2019 Emeric Poupon
+ *
+ * This file is part of LMS.
+ *
+ * LMS is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * LMS is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "PAMPasswordService.hpp"
+
+#ifndef LMS_SUPPORT_PAM
+#error "Should not compile this"
+#endif
+
+#include <cstring>
+#include <security/pam_appl.h>
+
+#include "auth/Types.hpp"
+#include "database/Session.hpp"
+#include "utils/Logger.hpp"
+
+namespace Auth
+{
+	class PAMError
+	{
+		public:
+			PAMError(std::string_view msg, pam_handle_t *pamh, int err)
+			{
+				_errorMsg = std::string {msg} + ": " + pam_strerror(pamh, err);
+			}
+
+			std::string_view message() const { return _errorMsg; }
+
+		private:
+			std::string _errorMsg;
+	};
+
+	class PAMContext
+	{
+		public:
+			PAMContext(std::string_view loginName)
+			{
+				int err {pam_start("lms", std::string {loginName}.c_str(), &_conv, &_pamh)};
+				if (err != PAM_SUCCESS)
+					throw PAMError {"start failed", _pamh, err};
+			}
+
+			~PAMContext()
+			{
+				int err {pam_end(_pamh, 0)};
+				if (err != PAM_SUCCESS)
+					LMS_LOG(AUTH, ERROR) << "end failed: " << pam_strerror(_pamh, err);
+			}
+
+			void authenticate(std::string_view password)
+			{
+				AuthenticateConvContext authContext {password};
+				ScopedConvContextSetter scopedContext {*this, authContext};
+
+				int err {pam_authenticate(_pamh, 0)};
+				if (err != PAM_SUCCESS)
+					throw PAMError {"authenticate failed", _pamh, err};
+			}
+
+			void validateAccount()
+			{
+				int err {pam_acct_mgmt(_pamh, PAM_SILENT)};
+				if (err != PAM_SUCCESS)
+					throw PAMError {"acct_mgmt failed", _pamh, err};
+			}
+
+		private:
+
+			class ConvContext
+			{
+				public:
+					virtual ~ConvContext() = default;
+			};
+
+			class AuthenticateConvContext final : public ConvContext
+			{
+				public:
+					AuthenticateConvContext(std::string_view password) : _password {password} {}
+
+					std::string_view getPassword() const { return _password; }
+
+				private:
+					std::string_view _password;
+			};
+
+			class ScopedConvContextSetter
+			{
+				public:
+					ScopedConvContextSetter(PAMContext& pamContext, ConvContext& convContext)
+						: _pamContext {pamContext}
+					{
+						_pamContext._convContext = &convContext;
+					}
+
+					~ScopedConvContextSetter()
+					{
+						_pamContext._convContext = nullptr;
+					}
+
+					ScopedConvContextSetter(const ScopedConvContextSetter&) = delete;
+					ScopedConvContextSetter(ScopedConvContextSetter&&) = delete;
+					ScopedConvContextSetter& operator=(const ScopedConvContextSetter&) = delete;
+					ScopedConvContextSetter& operator=(ScopedConvContextSetter&&) = delete;
+
+				private:
+					PAMContext& _pamContext;
+			};
+
+
+			static int conv(int msgCount, const pam_message** msgs, pam_response** resps, void* userData)
+			{
+				if (msgCount < 1)
+					return PAM_CONV_ERR;
+				if (!resps || !msgs || !userData)
+					return PAM_CONV_ERR;
+
+				PAMContext& context {*static_cast<PAMContext*>(userData)};
+
+				AuthenticateConvContext* authenticateContext = dynamic_cast<AuthenticateConvContext*>(context._convContext);
+				if (!authenticateContext)
+				{
+					LMS_LOG(AUTH, ERROR) << "Unexpected conv!";
+					return PAM_CONV_ERR;
+				}
+
+				// Only expect a PAM_PROMPT_ECHO_OFF msg
+				if (msgCount != 1 || msgs[0]->msg_style != PAM_PROMPT_ECHO_OFF)
+				{
+					LMS_LOG(AUTH, ERROR) << "Unexpected conv message. Count = " << msgCount;
+					return PAM_CONV_ERR;
+				}
+
+				pam_response* response {static_cast<pam_response*>(malloc(sizeof(pam_response)))};
+				if (!response)
+					return PAM_CONV_ERR;
+
+				response->resp = strdup(std::string {authenticateContext->getPassword()}.c_str());
+
+				*resps = response;
+				return PAM_SUCCESS;
+			}
+
+			ConvContext* _convContext {};
+			pam_conv _conv {&PAMContext::conv, this};
+			pam_handle_t *_pamh {};
+
+	};
+
+	bool
+	PAMPasswordService::checkUserPassword(Database::Session& /*session*/, std::string_view loginName, std::string_view password)
+	{
+		try
+		{
+			LMS_LOG(AUTH, DEBUG) << "Checking PAM password for user '" << loginName << "'";
+			PAMContext pamContext {loginName};
+
+			pamContext.authenticate(password);
+			pamContext.validateAccount();
+
+			return true;
+		}
+		catch (const PAMError& error)
+		{
+			LMS_LOG(AUTH, ERROR) << "PAM error: " << error.message();
+			return false;
+		}
+	}
+
+	bool
+	PAMPasswordService::canSetPasswords() const
+	{
+		return false;
+	}
+
+	bool
+	PAMPasswordService::isPasswordSecureEnough(std::string_view, std::string_view) const
+	{
+		throw NotImplementedException {};
+	}
+
+	void
+	PAMPasswordService::setPassword(Database::Session&, Database::IdType, std::string_view)
+	{
+		throw NotImplementedException {};
+	}
+
+} // namespace Auth
+