authaus

Mar 27, 2024

Changes in this version

+ func GetStack() string

Mar 13, 2024

Changes in this version

+ func GetMigrationVersion(conx *DBConnection) (int, error)

type Central

+ func (x *Central) GetAllOAuthTokenIDs() ([]string, error)

+ func (x *Central) GetAllTokens(includeExpired bool) ([]*Token, error)

+ func (x *Central) RemoveGroupFromAllUsers(groupIDString string) error

type SessionDB

+ GetAllOAuthTokenIDs func() ([]string, error)

+ GetAllTokens func(includeExpired bool) ([]*Token, error)

Nov 21, 2023

Changes in this version

type Central

+ UsersExemptFromExpiring []string

+ func (x *Central) ExemptFromExpiryCheck(username string) bool

type ConfigUserStoreDB

+ UsersExemptFromExpiring []string

Sep 19, 2023

Changes in this version

+ var AuthUserTypeStrings = map[AuthUserType]string

Feb 24, 2022

Changes in this version

type ConfigMSAAD

+ PassthroughClientIDs []string

type OAuth

+ func (x *OAuth) OAuthLoginUsernamePassword(username string, password string) error

Jan 28, 2022

Changes in this version

type PermissionList

+ func (a *PermissionList) Diff(b *PermissionList) *PermissionList

Jun 9, 2021

Changes in this version

+ const UserIdAdministrator

+ const UserIdLDAPMerge

+ const UserIdMSAADMerge

+ const UserIdOAuthImplicitCreate

type Central

+ func (x *Central) IsShuttingDown() bool

May 31, 2021

Changes in this version

type ConfigUserStoreDB

+ OldPasswordHistorySize int

Apr 29, 2021

Changes in this version

type AuthGroup

+ func ReadRawGroups(importedGroups []RawAuthGroup) ([]AuthGroup, error)

+ type RawAuthGroup struct

+ ID GroupIDU32

+ Name string

+ PermList string

type RoleGroupCache

+ func (x *RoleGroupCache) GetGroupsRaw() ([]RawAuthGroup, error)

type RoleGroupDB

+ GetGroupsRaw func() ([]RawAuthGroup, error)

Dec 3, 2020

Changes in this version

+ const MatchTypeEndsWith

+ const MatchTypeExact

+ const MatchTypeNone

+ const MatchTypeStandard

+ const MatchTypeStartsWith

type ConfigMSAAD

+ AutoDiscoverPermissions bool

+ DefaultRoles []string

+ Domain string

+ type GroupIDU32s []GroupIDU32

+ func (gid *GroupIDU32s) ContainsIndex(idx GroupIDU32) bool

+ func (gid *GroupIDU32s) IndexOf(idx GroupIDU32) int

+ type MatchType int

+ func Match(lhs, rhs string) MatchType

type Permit

+ func (p *Permit) ToString() string

Aug 14, 2020

Changes in this version

+ const DefaultOAuthTokenCheckIntervalSeconds

+ func MergeLDAP(c *Central)

+ func MergeLdapUsersIntoLocalUserStore(x *Central, ldapUsers []AuthUser, imqsUsers []AuthUser)

type AuthUserType

+ const UserTypeMSAAD

type Central

+ MSAAD MSAAD

type Config

+ MSAAD ConfigMSAAD

+ type ConfigMSAAD struct

+ AllowArchiveUser bool

+ ClientID string

+ ClientSecret string

+ DryRun bool

+ EssentialRoles []string

+ MergeIntervalSeconds int

+ RoleToGroup map[string]string

+ TenantID string

+ Verbose bool

type ConfigOAuth

+ DefaultProvider string

+ TokenCheckIntervalSeconds int

type ConfigOAuthProvider

+ AllowCreateUser bool

+ type MSAAD struct

+ Config ConfigMSAAD

+ func (m *MSAAD) Initialize(parent *Central)

+ func (m *MSAAD) SynchronizeUsers() error

type OAuthCompletedResult

+ OAuthSessionID string

+ Profile *OAuthUserProfile

+ type OAuthUserProfile struct

+ DisplayName string

+ Email string

+ FirstName string

+ LastName string

+ Phone string

+ UUID string

type Token

+ OAuthSessionID string

Jul 29, 2020

Changes in this version

type AuthUser

+ InternalUUID string

type Token

+ InternalUUID string

Jul 16, 2020

Changes in this version

type ConfigOAuthProvider

+ RedirectURL string

Jul 16, 2020

Changes in this version

+ const DefaultOAuthLoginExpirySeconds

+ const OAuthProviderMSAAD

+ func HttpNoCache(w http.ResponseWriter)

+ func HttpSendHTML(w http.ResponseWriter, responseCode int, responseBody string)

+ func HttpSendJSON(w http.ResponseWriter, responseCode int, responseObject interface{})

type AuthUser

+ ExternalUUID string

type AuthUserType

+ const UserTypeOAuth

type Central

+ DB *sql.DB

+ OAuth OAuth

+ func (x *Central) CreateSession(user *AuthUser, clientIPAddress string) (sessionkey string, token *Token, err error)

type Config

+ DB DBConnection

+ OAuth ConfigOAuth

+ type ConfigOAuth struct

+ ForceFastTokenRefresh bool

+ LoginExpirySeconds int64

+ Providers map[string]*ConfigOAuthProvider

+ Verbose bool

+ func (c *ConfigOAuth) LoginExpiry() time.Duration

+ type ConfigOAuthProvider struct

+ ClientID string

+ ClientSecret string

+ LoginURL string

+ Scope string

+ Title string

+ TokenURL string

+ Type string

+ type OAuth struct

+ Config ConfigOAuth

+ func (x *OAuth) HttpHandlerOAuthFinish(w http.ResponseWriter, r *http.Request)

+ func (x *OAuth) HttpHandlerOAuthStart(w http.ResponseWriter, r *http.Request)

+ func (x *OAuth) HttpHandlerOAuthTest(w http.ResponseWriter, r *http.Request)

+ func (x *OAuth) Initialize(parent *Central)

+ func (x *OAuth) OAuthFinish(r *http.Request) (*OAuthCompletedResult, error)

+ type OAuthCompletedResult struct

+ IsNewUser bool

+ UserId UserId

Mar 6, 2020

Changes in this version

type ConfigLDAP

+ DebugUserPull bool

Feb 26, 2020

Changes in this version

type ConfigLDAP

+ InsecureSkipVerify bool

Feb 13, 2020

Changes in this version

+ const AuditActionAuthentication

+ const AuditActionCreated

+ const AuditActionDeleted

+ const AuditActionFailedLogin

+ const AuditActionLocked

+ const AuditActionResetPassword

+ const AuditActionUnlocked

+ const AuditActionUpdated

+ const LdapConnectionModePlainText

+ const LdapConnectionModeSSL

+ const LdapConnectionModeTLS

+ var ErrAccountLocked = errors.New("Account locked. Please contact your administrator")

+ var ErrConnect = errors.New("Connect failed")

+ var ErrGroupDuplicateName = errors.New("A group with that name already exists")

+ var ErrGroupExists = errors.New("Group already exists")

+ var ErrGroupNameIllegal = errors.New("Group name may not be empty, and must not have spaces on the left or right")

+ var ErrGroupNotExist = errors.New("Group does not exist")

+ var ErrHttpBasicAuth = errors.New("HTTP Basic Authorization must be base64(identity:password)")

+ var ErrHttpNotAuthorized = errors.New("No authorization information")

+ var ErrIdentityAuthNotFound = errors.New("Identity authorization not found")

+ var ErrIdentityEmpty = errors.New("Identity may not be empty")

+ var ErrIdentityExists = errors.New("Identity already exists")

+ var ErrIdentityPermitNotFound = errors.New("Identity permit not found")

+ var ErrInvalidCredentials = errors.New("Invalid Credentials")

+ var ErrInvalidPassword = errors.New("Invalid password")

+ var ErrInvalidPasswordToken = errors.New("Invalid password token")

+ var ErrInvalidPastPassword = errors.New("Invalid previously used password")

+ var ErrInvalidSessionToken = errors.New("Invalid session token")

+ var ErrPasswordExpired = errors.New("Password has expired")

+ var ErrPasswordTokenExpired = errors.New("Password token has expired")

+ var ErrPermitInvalid = errors.New("Permit is not a sequence of 32-bit words")

+ var ErrUnsupported = errors.New("Unsupported operation")

+ func CanonicalizeIdentity(identity string) string

+ func DeleteGroup(roleDB RoleGroupDB, groupName string) error

+ func EncodePermit(groupIds []GroupIDU32) []byte

+ func GroupIDsToNames(groups []GroupIDU32, db RoleGroupDB) ([]string, error)

+ func GroupNameIsLegal(name string) bool

+ func HttpHandlerLogin(config *ConfigHTTP, central *Central, w http.ResponseWriter, r *http.Request)

+ func HttpHandlerLogout(config *ConfigHTTP, central *Central, w http.ResponseWriter, r *http.Request)

+ func HttpHandlerWhoAmI(config *ConfigHTTP, central *Central, w http.ResponseWriter, r *http.Request)

+ func HttpSendTxt(w http.ResponseWriter, responseCode int, responseBody string)

+ func NewError(base error, detail string) error

+ func NewLDAPConnect(config *ConfigLDAP) (*ldap.LDAPConnection, error)

+ func NewLDAPConnectAndBind(config *ConfigLDAP) (*ldap.LDAPConnection, error)

+ func RandomString(nchars int, corpus string) string

+ func RunHttp(config *ConfigHTTP, central *Central) error

+ func RunHttpFromConfig(config *Config) error

+ func RunMigrations(conx *DBConnection) error

+ func SqlCreateDatabase(conx *DBConnection) error

+ type AuditActionType string

+ type Auditor interface

+ AuditUserAction func(identity, item, context string, auditActionType AuditActionType)

+ type AuthCheck int

+ const AuthCheckDefault

+ const AuthCheckPasswordExpired

+ type AuthGroup struct

+ ID GroupIDU32

+ Name string

+ PermList PermissionList

+ func LoadOrCreateGroup(roleDB RoleGroupDB, groupName string, createIfNotExist bool) (*AuthGroup, error)

+ func (x *AuthGroup) AddPerm(perm PermissionU16)

+ func (x *AuthGroup) HasPerm(perm PermissionU16) bool

+ func (x *AuthGroup) RemovePerm(perm PermissionU16)

+ func (x AuthGroup) Clone() *AuthGroup

+ type AuthUser struct

+ AccountLocked bool

+ Archived bool

+ Created time.Time

+ CreatedBy UserId

+ Email string

+ Firstname string

+ Lastname string

+ Mobilenumber string

+ Modified time.Time

+ ModifiedBy UserId

+ PasswordModifiedDate time.Time

+ Remarks string

+ Telephonenumber string

+ Type AuthUserType

+ UserId UserId

+ Username string

+ type AuthUserType int

+ const UserTypeDefault

+ const UserTypeLDAP

+ func (u AuthUserType) CanRenameIdentity() bool

+ func (u AuthUserType) CanSetPassword() bool

+ type Central struct

+ Auditor Auditor

+ DisablePasswordReuse bool

+ EnableAccountLocking bool

+ LockingPolicy LockingPolicy

+ Log *log.Logger

+ MaxActiveSessions int32

+ MaxFailedLoginAttempts int

+ NewSessionExpiresAfter time.Duration

+ PasswordExpiresAfter time.Duration

+ Stats CentralStats

+ func NewCentral(logfile string, ldap LDAP, userStore UserStore, permitDB PermitDB, ...) *Central

+ func NewCentralDummy(logfile string) *Central

+ func NewCentralFromConfig(config *Config) (central *Central, err error)

+ func (x *Central) ArchiveIdentity(userId UserId) error

+ func (x *Central) AuthenticateUser(identity, password string, authTypeCheck AuthCheck) error

+ func (x *Central) Close()

+ func (x *Central) CreateUserStoreIdentity(user *AuthUser, password string) (UserId, error)

+ func (x *Central) GetAuthenticatorIdentities(getIdentitiesFlag GetIdentitiesFlag) ([]AuthUser, error)

+ func (x *Central) GetPermit(userId UserId) (*Permit, error)

+ func (x *Central) GetPermits() (map[UserId]*Permit, error)

+ func (x *Central) GetRoleGroupDB() RoleGroupDB

+ func (x *Central) GetTokenFromIdentityPassword(identity, password string) (*Token, error)

+ func (x *Central) GetTokenFromSession(sessionkey string) (*Token, error)

+ func (x *Central) GetUserFromIdentity(identity string) (AuthUser, error)

+ func (x *Central) GetUserFromUserId(userId UserId) (AuthUser, error)

+ func (x *Central) GetUserNameFromUserId(userId UserId) string

+ func (x *Central) InvalidateSessionsForIdentity(userId UserId) error

+ func (x *Central) Login(username, password string, clientIPAddress string) (sessionkey string, token *Token, err error)

+ func (x *Central) Logout(sessionkey string) error

+ func (x *Central) MergeLdapUsersIntoLocalUserStore(ldapUsers []AuthUser, imqsUsers []AuthUser)

+ func (x *Central) MergeTick()

+ func (x *Central) RenameIdentity(oldIdent, newIdent string) error

+ func (x *Central) ResetPasswordFinish(userId UserId, token string, password string) error

+ func (x *Central) ResetPasswordStart(userId UserId, expires time.Time) (string, error)

+ func (x *Central) SetPassword(userId UserId, password string) error

+ func (x *Central) SetPermit(userId UserId, permit *Permit) error

+ func (x *Central) SetSessionCacheSize(maxSessions int)

+ func (x *Central) StartMergeTicker() error

+ func (x *Central) UnlockAccount(userId UserId) error

+ func (x *Central) UpdateIdentity(user *AuthUser) error

+ type CentralStats struct

+ EmptyIdentities uint64

+ ExpiredSessionKeys uint64

+ GoodLogin uint64

+ GoodOnceOffAuth uint64

+ InvalidPasswords uint64

+ InvalidSessionKeys uint64

+ Logout uint64

+ UserLoginAttempts map[string]uint64

+ func (x *CentralStats) IncrementAndLog(name string, val *uint64, logger *log.Logger)

+ func (x *CentralStats) IncrementEmptyIdentities(logger *log.Logger)

+ func (x *CentralStats) IncrementExpiredSessionKey(logger *log.Logger)

+ func (x *CentralStats) IncrementGoodLogin(logger *log.Logger)

+ func (x *CentralStats) IncrementGoodOnceOffAuth(logger *log.Logger)

+ func (x *CentralStats) IncrementInvalidPasswordHistory(logger *log.Logger, username string, clientIPAddress string)

+ func (x *CentralStats) IncrementInvalidPasswords(logger *log.Logger)

+ func (x *CentralStats) IncrementInvalidSessionKey(logger *log.Logger)

+ func (x *CentralStats) IncrementLogout(logger *log.Logger)

+ func (x *CentralStats) ResetInvalidPasswordHistory(logger *log.Logger, username string, clientIPAddress string)

+ type Config struct

+ AuditServiceUrl string

+ EnableAccountLocking bool

+ HTTP ConfigHTTP

+ LDAP ConfigLDAP

+ Log ConfigLog

+ MaxFailedLoginAttempts int

+ PermitDB ConfigPermitDB

+ RoleGroupDB ConfigRoleGroupDB

+ SessionDB ConfigSessionDB

+ UserStore ConfigUserStoreDB

+ func (x *Config) LoadFile(filename string) error

+ func (x *Config) Reset()

+ type ConfigHTTP struct

+ Bind string

+ CookieName string

+ CookieSecure bool

+ Port string

+ type ConfigLDAP struct

+ BaseDN string

+ Encryption string

+ LdapDomain string

+ LdapHost string

+ LdapPassword string

+ LdapPort uint16

+ LdapSearchFilter string

+ LdapTickerTime int

+ LdapUsername string

+ SysAdminEmail string

+ type ConfigLog struct

+ Filename string

+ type ConfigPermitDB struct

+ DB DBConnection

+ type ConfigRoleGroupDB struct

+ DB DBConnection

+ type ConfigSessionDB struct

+ DB DBConnection

+ MaxActiveSessions int32

+ SessionExpirySeconds int64

+ type ConfigUserStoreDB struct

+ DB DBConnection

+ DisablePasswordReuse bool

+ PasswordExpirySeconds int

+ type DBConnection struct

+ Database string

+ Driver string

+ Host string

+ Password string

+ Port uint16

+ SSL bool

+ User string

+ func (x *DBConnection) Connect() (*sql.DB, error)

+ func (x *DBConnection) ConnectionString() string

+ func (x *DBConnection) Equals(y *DBConnection) bool

+ type GetIdentitiesFlag int

+ const GetIdentitiesFlagDeleted

+ const GetIdentitiesFlagNone

+ type GroupIDU32 uint32

+ func DecodePermit(permit []byte) ([]GroupIDU32, error)

+ func GroupNamesToIDs(groups []string, db RoleGroupDB) ([]GroupIDU32, error)

+ type LDAP interface

+ Authenticate func(identity, password string) error

+ Close func()

+ GetLdapUsers func() ([]AuthUser, error)

+ type LdapConnectionMode int

+ type LdapImpl struct

+ func NewAuthenticator_LDAP(config *ConfigLDAP) *LdapImpl

+ func (x *LdapImpl) Authenticate(identity, password string) error

+ func (x *LdapImpl) Close()

+ func (x *LdapImpl) GetLdapUsers() ([]AuthUser, error)

+ type LockingPolicy interface

+ IsLockable func(identity string) (bool, error)

+ type PasswordEnforcement int

+ const PasswordEnforcementDefault

+ const PasswordEnforcementReuse

+ type PermissionList []PermissionU16

+ func PermitResolveToList(permit []byte, db RoleGroupDB) (PermissionList, error)

+ func (x *PermissionList) Add(perm PermissionU16)

+ func (x *PermissionList) Remove(perm PermissionU16)

+ func (x PermissionList) Has(perm PermissionU16) bool

+ type PermissionNameTable map[PermissionU16]string

+ func (x *PermissionNameTable) Inverted() map[string]PermissionU16

+ type PermissionU16 uint16

+ type Permit struct

+ Roles []byte

+ func (a *Permit) Equals(b *Permit) bool

+ func (x *Permit) Clone() *Permit

+ func (x *Permit) Deserialize(encoded string) error

+ func (x *Permit) Serialize() string

+ type PermitDB interface

+ Close func()

+ GetPermit func(userId UserId) (*Permit, error)

+ GetPermits func() (map[UserId]*Permit, error)

+ SetPermit func(userId UserId, permit *Permit) error

+ func NewPermitDB_SQL(conx *DBConnection) (PermitDB, error)

+ type RoleGroupCache struct

+ func (x *RoleGroupCache) Close()

+ func (x *RoleGroupCache) DeleteGroup(group *AuthGroup) (err error)

+ func (x *RoleGroupCache) GetByID(id GroupIDU32) (*AuthGroup, error)

+ func (x *RoleGroupCache) GetByName(name string) (*AuthGroup, error)

+ func (x *RoleGroupCache) GetGroups() ([]*AuthGroup, error)

+ func (x *RoleGroupCache) InsertGroup(group *AuthGroup) (err error)

+ func (x *RoleGroupCache) UpdateGroup(group *AuthGroup) (err error)

+ type RoleGroupDB interface

+ Close func()

+ DeleteGroup func(group *AuthGroup) error

+ GetByID func(id GroupIDU32) (*AuthGroup, error)

+ GetByName func(name string) (*AuthGroup, error)

+ GetGroups func() ([]*AuthGroup, error)

+ InsertGroup func(group *AuthGroup) error

+ UpdateGroup func(group *AuthGroup) error

+ func NewCachedRoleGroupDB(backend RoleGroupDB) RoleGroupDB

+ func NewRoleGroupDB_SQL(conx *DBConnection) (RoleGroupDB, error)

+ type SessionDB interface

+ Close func()

+ Delete func(sessionkey string) error

+ InvalidateSessionsForIdentity func(userId UserId) error

+ PermitChanged func(userId UserId, permit *Permit) error

+ Read func(sessionkey string) (*Token, error)

+ Write func(sessionkey string, token *Token) error

+ func NewSessionDB_SQL(conx *DBConnection) (SessionDB, error)

+ type Token struct

+ Email string

+ Expires time.Time

+ Identity string

+ Permit Permit

+ UserId UserId

+ Username string

+ func HttpHandlerBasicAuth(central *Central, r *http.Request) (*Token, error)

+ func HttpHandlerPrelude(config *ConfigHTTP, central *Central, r *http.Request) (*Token, error)

+ func HttpHandlerPreludeWithError(config *ConfigHTTP, central *Central, w http.ResponseWriter, r *http.Request) (*Token, error)

+ type UserId int64

+ const DefaultSessionCacheSize

+ const NullUserId

+ type UserStore interface

+ ArchiveIdentity func(userId UserId) error

+ Authenticate func(identity, password string, authTypeCheck AuthCheck) error

+ Close func()

+ CreateIdentity func(user *AuthUser, password string) (UserId, error)

+ GetIdentities func(getIdentitiesFlag GetIdentitiesFlag) ([]AuthUser, error)

+ GetUserFromIdentity func(identity string) (AuthUser, error)

+ GetUserFromUserId func(userId UserId) (AuthUser, error)

+ LockAccount func(userId UserId) error

+ RenameIdentity func(oldIdent, newIdent string) error

+ ResetPasswordFinish func(userId UserId, token string, password string, ...) error

+ ResetPasswordStart func(userId UserId, expires time.Time) (string, error)

+ SetConfig func(passwordExpiry time.Duration) error

+ SetPassword func(userId UserId, password string, enforceTypeCheck PasswordEnforcement) error

+ UnlockAccount func(userId UserId) error

+ UpdateIdentity func(user *AuthUser) error

+ func NewUserStoreDB_SQL(conx *DBConnection) (UserStore, error)