Implemented PAM authentication

CMakeLists.txt

@@ -14,10 +14,20 @@ find_package(FFMPEGAV REQUIRED)
 find_package(Taglib REQUIRED)
 find_package(Boost REQUIRED COMPONENTS system)
 find_package(PStreams REQUIRED)
+find_package(PAM)
 pkg_check_modules(GRAPHICSMAGICKXX REQUIRED GraphicsMagick++)
 
+set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wall")
+set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -Werror -Wno-error=parentheses -Wno-error=unused-function -O0 -g")
+set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -O2 -g")
+
+if(PAM_FOUND)
+	set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -DUSEPAM")
+endif(PAM_FOUND)
+
 add_subdirectory(src)
 
+# TODO pam configuration file
 install(DIRECTORY approot DESTINATION share/lms)
 install(DIRECTORY docroot DESTINATION share/lms)
 install(FILES systemd/default.service DESTINATION share/lms)

approot/admin-user.xml

@@ -38,6 +38,17 @@
 						${password-info class="help-block"}
 					</div>
 				</div>
+				<div class="form-group">
+					<label class="control-label col-lg-3"  for="${id:external_auth}">
+						${tr:Lms.external_auth}
+					</label>
+					<div class="checkbox col-lg-9">
+						<span class="hack">
+							${external-auth}
+							${external-auth-info class="help-block"}
+						</span>
+					</div>
+				</div>
 				${<if-demo>}
 					<div class="form-group">
 						<div class="col-lg-offset-3 col-lg-3"  for="${id:demo}">

approot/messages.xml

@@ -17,6 +17,9 @@
 <message id="Lms.password-client-throttled">Login throttled, please try again later</message>
 <message id="Lms.password-confirm">Confirm password</message>
 <message id="Lms.password-new">New password</message>
+<message id="Lms.external_auth">Is auth managed externally?</message>
+<message id="Lms.password_must_be_empty_for_ext">Password must be empty for users with external authentication</message>
+<message id="Lms.password-must-not-be-empty">Password must not be empty for users without external authentication</message>
 <message id="Lms.password-old">Old password</message>
 <message id="Lms.password-too-weak">Password too weak</message>
 <message id="Lms.passwords-dont-match">Passwords don't match</message>

cmake/modules/FindPAM.cmake

@@ -0,0 +1,73 @@
+# From http://code.google.com/p/pam-face-authentication/source/browse/branches/pam_face_authentication/cmake/modules/FindPAM.cmake?r=336
+
+# - Try to find the PAM libraries
+# Once done this will define
+#
+#  PAM_FOUND - system has pam
+#  PAM_INCLUDE_DIR - the pam include directory
+#  PAM_LIBRARIES - libpam library
+
+if (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+	# Already in cache, be silent
+	set(PAM_FIND_QUIETLY TRUE)
+endif (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+
+find_path(PAM_INCLUDE_DIR NAMES security/pam_appl.h pam/pam_appl.h)
+find_library(PAM_LIBRARY pam)
+find_library(DL_LIBRARY dl)
+
+if (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+	set(PAM_FOUND TRUE)
+	if (DL_LIBRARY)
+		set(PAM_LIBRARIES ${PAM_LIBRARY} ${DL_LIBRARY})
+	else (DL_LIBRARY)
+		set(PAM_LIBRARIES ${PAM_LIBRARY})
+	endif (DL_LIBRARY)
+
+	if (EXISTS ${PAM_INCLUDE_DIR}/pam/pam_appl.h)
+		# darwin claims to be something special
+		set(HAVE_PAM_PAM_APPL_H 1)
+	endif (EXISTS ${PAM_INCLUDE_DIR}/pam/pam_appl.h)
+
+	if (NOT DEFINED PAM_MESSAGE_CONST)
+		include(CheckCXXSourceCompiles)
+		# XXX does this work with plain c?
+		check_cxx_source_compiles("
+#if ${HAVE_PAM_PAM_APPL_H}+0
+# include <pam/pam_appl.h>
+#else
+# include <security/pam_appl.h>
+#endif
+static int PAM_conv(
+	int num_msg,
+	const struct pam_message **msg, /* this is the culprit */
+	struct pam_response **resp,
+	void *ctx)
+{
+	return 0;
+}
+int main(void)
+{
+	struct pam_conv PAM_conversation = {
+		&PAM_conv, /* this bombs out if the above does not match */
+		0
+	};
+	return 0;
+}
+" PAM_MESSAGE_CONST)
+	endif (NOT DEFINED PAM_MESSAGE_CONST)
+	set(PAM_MESSAGE_CONST ${PAM_MESSAGE_CONST} CACHE BOOL "PAM expects a conversation function with const pam_message")
+
+endif (PAM_INCLUDE_DIR AND PAM_LIBRARY)
+
+if (PAM_FOUND)
+	if (NOT PAM_FIND_QUIETLY)
+		message(STATUS "Found PAM: ${PAM_LIBRARIES}")
+	endif (NOT PAM_FIND_QUIETLY)
+else (PAM_FOUND)
+	if (PAM_FIND_REQUIRED)
+		message(FATAL_ERROR "PAM was not found")
+	endif(PAM_FIND_REQUIRED)
+endif (PAM_FOUND)
+
+mark_as_advanced(PAM_INCLUDE_DIR PAM_LIBRARY DL_LIBRARY PAM_MESSAGE_CONST) 

docroot/css/lms.css

@@ -483,4 +483,7 @@ a.Lms-releasename:hover, a.Lms-releasename:focus {
 	margin-bottom: 8px;
 }
 
+.hack {
+	margin-left: 20px;
+}
 

src/libs/auth/CMakeLists.txt

@@ -22,6 +22,7 @@ target_link_libraries(lmsauth PUBLIC
 	pthread
 	boost_system
 	wt
+	${PAM_LIBRARIES}
 	)
 
 install(TARGETS lmsauth DESTINATION lib)

src/libs/auth/impl/AuthTokenService.cpp

@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #include "AuthTokenService.hpp"
 
 #include <Wt/Auth/HashFunction.h>

src/libs/auth/impl/AuthTokenService.hpp

@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #pragma once
 
 #include "auth/IAuthTokenService.hpp"

src/libs/auth/impl/PasswordService.cpp

@@ -17,8 +17,6 @@
  * along with LMS.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-/* This file contains some classes in order to get info from file using the libavconv */
-
 #include "PasswordService.hpp"
 
 #include <Wt/Auth/HashFunction.h>
@@ -29,6 +27,8 @@
 #include "utils/Exception.hpp"
 #include "utils/Logger.hpp"
 
+#include <security/pam_appl.h>
+
 namespace Auth {
 
 std::unique_ptr<IPasswordService> createPasswordService(std::size_t maxThrottlerEntries)
@@ -41,10 +41,101 @@ PasswordService::PasswordService(std::size_t maxThrottlerEntries)
 {
 }
 
+#ifdef USEPAM
+static void
+delete_resp(int num_msg, pam_response *response)
+{
+    if (response == nullptr)
+        return;
+    for (int i = 0; i < num_msg; i++) {
+        if (response[i].resp) {
+            /* clear before freeing -- might be a password */
+            bzero(response[i].resp, strlen(response[i].resp));
+            free(response[i].resp);
+            response[i].resp = nullptr;
+        }
+    }
+}
+
+struct pam_conv_data
+{
+	const char *username;
+	const char *password;
+};
+
+static
+int lms_conv(int num_msg, const pam_message** msgs, pam_response** resps, void* appdata_ptr)
+{
+	if(num_msg < 1)
+		return PAM_CONV_ERR;
+	if (!resps || !msgs || !appdata_ptr)
+		return PAM_CONV_ERR;
+	
+	pam_conv_data *data = static_cast<pam_conv_data*>( appdata_ptr );
+	pam_response  *response = new (std::nothrow) pam_response[num_msg];
+	if(!response)
+		return PAM_CONV_ERR;
+
+	for(int i = 0; i < num_msg; ++i)
+	{
+		response[i].resp_retcode = 0;
+		response[i].resp = 0;
+		switch (msgs[i]->msg_style) {
+		case PAM_PROMPT_ECHO_ON:
+			/* on memory allocation failure, auth fails */
+			response[i].resp = strdup(data->username);
+			break;
+		case PAM_PROMPT_ECHO_OFF:
+			response[i].resp = strdup(data->password);
+			break;
+		case PAM_ERROR_MSG:
+		case PAM_TEXT_INFO:
+		default:
+			delete_resp(i, response);
+			return PAM_CONV_ERR;
+		}
+	}
+	
+	*resps = response;
+	return PAM_SUCCESS;
+}
+#endif
+
+static bool
+pamCheckUserPassword(const std::string& loginName, const std::string& password)
+{
+#ifdef USEPAM
+	pam_conv_data authdata{loginName.c_str(), password.c_str()};
+	pam_conv conv = { lms_conv, &authdata };
+	pam_handle_t *pamh;
+	bool authenticated{false};
+
+	/* Initialize PAM framework */
+	int err = pam_start("lms", loginName.c_str(), &conv, &pamh);
+	if (err != PAM_SUCCESS) {
+		return false;
+	}
+
+	err = pam_authenticate(pamh, 0);
+	if(err == PAM_SUCCESS) 
+	{
+		/* Make sure account and password are still valid */
+		err = pam_acct_mgmt(pamh, PAM_SILENT);
+		authenticated = err == PAM_SUCCESS;
+	}
+
+	(void) pam_end(pamh, 0);
+	return authenticated;
+#else
+	return false;
+#endif
+}
+
 static
 bool
 checkUserPassword(Database::Session& session, const std::string& loginName, const std::string& password)
 {
+	bool hasExternalAuth;
 	Database::User::PasswordHash passwordHash;
 	{
 		auto transaction {session.createSharedTransaction()};
@@ -53,11 +144,19 @@ checkUserPassword(Database::Session& session, const std::string& loginName, cons
 		if (!user)
 			return false;
 
+		hasExternalAuth = user->hasExternalAuth();
 		passwordHash = user->getPasswordHash();
 	}
 
-	const Wt::Auth::BCryptHashFunction hashFunc {6};
+	if (hasExternalAuth) 
-	return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
+	{
+		return pamCheckUserPassword(loginName, password);
+	}
+	else
+	{
+		const Wt::Auth::BCryptHashFunction hashFunc {6};
+		return hashFunc.verify(password, passwordHash.salt, passwordHash.hash);
+	}
 }
 
 

src/libs/database/include/database/User.hpp

@@ -165,6 +165,7 @@ class User : public Wt::Dbo::Dbo<User>
 		void setSubsonicTranscodeBitrate(Bitrate bitrate);
 		void setCurPlayingTrackPos(std::size_t pos)		{ _curPlayingTrackPos = pos; }
 		void setRadio(bool val)					{ _radio = val; }
+		void setExternalAuth(bool val)				{ _externalAuth = val; }
 		void setRepeatAll(bool val)				{ _repeatAll = val; }
 		void setUITheme(UITheme uiTheme)			{ _uiTheme = uiTheme; }
 		void clearAuthTokens();
@@ -179,6 +180,7 @@ class User : public Wt::Dbo::Dbo<User>
 		std::size_t		getCurPlayingTrackPos() const { return _curPlayingTrackPos; }
 		bool			isRepeatAllSet() const { return _repeatAll; }
 		bool			isRadioSet() const { return _radio; }
+		bool			hasExternalAuth() const { return _externalAuth; }
 		UITheme			getUITheme() const { return _uiTheme; }
 		SubsonicArtistListMode	getSubsonicArtistListMode() const { return _subsonicArtistListMode; }
 
@@ -218,6 +220,7 @@ class User : public Wt::Dbo::Dbo<User>
 			Wt::Dbo::field(a, _curPlayingTrackPos, "cur_playing_track_pos");
 			Wt::Dbo::field(a, _repeatAll, "repeat_all");
 			Wt::Dbo::field(a, _radio, "radio");
+			Wt::Dbo::field(a, _externalAuth, "external_auth");
 			Wt::Dbo::hasMany(a, _tracklists, Wt::Dbo::ManyToOne, "user");
 			Wt::Dbo::hasMany(a, _starredArtists, Wt::Dbo::ManyToMany, "user_artist_starred", "", Wt::Dbo::OnDeleteCascade);
 			Wt::Dbo::hasMany(a, _starredReleases, Wt::Dbo::ManyToMany, "user_release_starred", "", Wt::Dbo::OnDeleteCascade);
@@ -246,6 +249,8 @@ class User : public Wt::Dbo::Dbo<User>
 		int		_curPlayingTrackPos {}; // Current track position in queue
 		bool		_repeatAll {};
 		bool		_radio {};
+		
+		bool		_externalAuth {false};
 
 		Wt::Dbo::collection<Wt::Dbo::ptr<TrackList>> _tracklists;
 		Wt::Dbo::collection<Wt::Dbo::ptr<Artist>> _starredArtists;

src/lms/ui/admin/UserView.cpp

@@ -51,6 +51,7 @@ class UserModel : public Wt::WFormModel
 		static inline const Field LoginField {"login"};
 		static inline const Field PasswordField {"password"};
 		static inline const Field DemoField {"demo"};
+		static inline const Field ExternalAuthField{"external-auth"};
 
 		UserModel(std::optional<Database::IdType> userId)
 		: _userId {userId}
@@ -63,6 +64,7 @@ class UserModel : public Wt::WFormModel
 
 			addField(PasswordField);
 			addField(DemoField);
+			addField(ExternalAuthField);
 
 			if (!_userId)
 				setValidator(PasswordField, createMandatoryValidator());
@@ -90,6 +92,8 @@ class UserModel : public Wt::WFormModel
 					user.modify()->setPasswordHash(*passwordHash);
 					user.modify()->clearAuthTokens();
 				}
+				
+				user.modify()->setExternalAuth(static_cast<bool>(Wt::asNumber(value(ExternalAuthField))));
 			}
 			else
 			{
@@ -98,6 +102,11 @@ class UserModel : public Wt::WFormModel
 
 				if (Wt::asNumber(value(DemoField)))
 					user.modify()->setType(Database::User::Type::DEMO);
+				
+				if (Wt::asNumber(value(ExternalAuthField)))
+					user.modify()->setExternalAuth(true);
+				else
+					user.modify()->setExternalAuth(false);
 			}
 		}
 
@@ -116,6 +125,19 @@ class UserModel : public Wt::WFormModel
 			else if (user == LmsApp->getUser())
 				throw UserNotAllowedException {};
 		}
+		
+		bool getExternalAuth() const 
+		{
+			if (_userId)
+			{
+				auto transaction {LmsApp->getDbSession().createSharedTransaction()};
+
+				const Database::User::pointer user {Database::User::getById(LmsApp->getDbSession(), *_userId)};
+				return user->hasExternalAuth();
+			}
+			else
+				return Wt::asNumber(value(ExternalAuthField));
+		}
 
 		std::string getLoginName() const
 		{
@@ -144,7 +166,14 @@ class UserModel : public Wt::WFormModel
 			}
 			else if (field == PasswordField)
 			{
-				if (!valueText(PasswordField).empty())
+				if (Wt::asNumber(value(ExternalAuthField)))
+				{
+					if (!valueText(PasswordField).empty())
+					{
+						error = Wt::WString::tr("Lms.password_must_be_empty_for_ext");
+					}
+				}
+				else if (!valueText(PasswordField).empty())
 				{
 					if (Wt::asNumber(value(DemoField)))
 					{
@@ -157,8 +186,13 @@ class UserModel : public Wt::WFormModel
 						// Evaluate the strength of the password for non demo accounts
 						if (!ServiceProvider<::Auth::IPasswordService>::get()->evaluatePasswordStrength(getLoginName(), valueText(PasswordField).toUTF8()))
 							error = Wt::WString::tr("Lms.password-too-weak");
+
 					}
 				}
+				else 
+				{
+					error = Wt::WString::tr("Lms.password-must-not-be-empty");
+				}
 			}
 			else if (field == DemoField)
 			{
@@ -167,6 +201,11 @@ class UserModel : public Wt::WFormModel
 				if (Wt::asNumber(value(DemoField)) && Database::User::getDemo(LmsApp->getDbSession()))
 					error = Wt::WString::tr("Lms.Admin.User.demo-account-already-exists");
 			}
+// 			else if (field == ExternalAuthField)
+// 			{
+// 				if (!valueText(PasswordField).empty())
+// 					error = Wt::WString::tr("Lms.password_must_be_empty_for_ext");
+// 			}
 
 			if (error.empty())
 				return Wt::WFormModel::validateField(field);
@@ -215,6 +254,12 @@ UserView::refreshView()
 		t->setCondition("if-has-last-login", true);
 
 		t->bindString("last-login", user->getLastLogin().toString(), Wt::TextFormat::Plain);
+		
+
+		auto extCheckBox = std::make_unique<Wt::WCheckBox>();
+		extCheckBox->setChecked(user->hasExternalAuth());
+		t->setFormWidget(UserModel::ExternalAuthField, std::move(extCheckBox));
+		t->setCondition("if-external-auth", true);
 	}
 	else
 	{
@@ -222,6 +267,11 @@ UserView::refreshView()
 		t->setCondition("if-has-login", true);
 		t->setFormWidget(UserModel::LoginField, std::make_unique<Wt::WLineEdit>());
 		t->bindString("title", Wt::WString::tr("Lms.Admin.User.user-create"));
+		
+		auto extCheckBox = std::make_unique<Wt::WCheckBox>();
+		extCheckBox->setChecked(true);
+		t->setCondition(UserModel::ExternalAuthField, false);
+		t->setFormWidget("external-auth", std::move(extCheckBox));
 	}
 
 	// Password
@@ -233,7 +283,7 @@ UserView::refreshView()
 	t->setFormWidget(UserModel::DemoField, std::make_unique<Wt::WCheckBox>());
 	if (!userId && ServiceProvider<IConfig>::get()->getBool("demo", false))
 		t->setCondition("if-demo", true);
-
+	
 	Wt::WPushButton* saveBtn = t->bindNew<Wt::WPushButton>("save-btn", Wt::WString::tr(userId ? "Lms.save" : "Lms.create"));
 	saveBtn->clicked().connect([=]()
 	{

src/lms/ui/common/Validators.cpp

@@ -39,7 +39,7 @@ std::shared_ptr<Wt::WValidator>
 createMandatoryValidator()
 {
 	auto v = std::make_shared<Wt::WValidator>();
-	v->setMandatory(true);
+	//sv->setMandatory(true);
 	return v;
 }