auth

Documentation

Index

• Constants
• Variables
• func ClientStreamInterceptor(token string) ...
• func ClientUnaryInterceptor(token string) ...
• func ComparePasswords(hashedPassword []byte, plainPassword []byte) error
• func DecodeBase64Password(passwordBase64 string) (string, error)
• func DropTokenKeys(username string) bool
• func DropTokenKeysForCtx(ctx context.Context) (bool, error)
• func GenerateToken(user User, database int64, expTime int) (string, error)
• func HasPermissionForMethod(userPermission uint32, method string) bool
• func HashAndSaltPassword(plainPassword []byte) ([]byte, error)
• func IsMaintenanceMethod(method string) bool
• func IsStrongPassword(password string) error
• func NewStringUUID() string
• func NewUUID() xid.ID
• func ServerStreamInterceptor(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, ...) error
• func ServerUnaryInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, ...) (interface{}, error)
• type AuthType
  • func GetAuthTypeFromContext(ctx context.Context) AuthType
• type JSONToken
  • func GetLoggedInUser(ctx context.Context) (*JSONToken, error)
• type Kind
• type Permission
• type TokenAuthStruct
  • func (t TokenAuthStruct) GetRequestMetadata(ctx context.Context, in ...string) (map[string]string, error)
  • func (TokenAuthStruct) RequireTransportSecurity() bool
• type User
  • func (u *User) ComparePasswords(plainPassword []byte) error
  • func (u *User) GrantPermission(database string, permission uint32) bool
  • func (u *User) HasAtLeastOnePermission(permission uint32) bool
  • func (u *User) HasPermission(database string, permission uint32) bool
  • func (u *User) RevokePermission(database string) bool
  • func (u *User) SetPassword(plainPassword []byte) ([]byte, error)
  • func (u *User) WhichPermission(database string) uint32

Constants

const (
	PermissionNone = iota
	PermissionR
	PermissionRW
)

Non-admin permissions

const PermissionAdmin = 254

PermissionAdmin the system admin permission byte

const PermissionSysAdmin = 255

PermissionSysAdmin the admin permission byte

Variables

var AuthEnabled bool

AuthEnabled toggles authentication on or off

var DevMode bool

DevMode if set to true, remote client commands (except admin ones) will be accepted even if auth is off

var ErrNoAuthData = errors.New("no authentication data provided").WithCode(errors.CodProtocolViolation)

var ErrNotLoggedIn = errors.New("not logged in").WithCode(errors.CodInvalidAuthorizationSpecification)

var IsTampered bool

IsTampered if set to true then one of the databases is tempered and the user is notified

var IsValidUsername = regexp.MustCompile(`^[a-zA-Z0-9_]+$`).MatchString

IsValidUsername is a regexp function used to check username requirements

var PasswordRequirementsMsg = fmt.Sprintf(
	"password must have between %d and %d letters, digits and special characters "+
		"of which at least 1 uppercase letter, 1 digit and 1 special character",
	minPasswordLen,
	maxPasswordLen,
)

PasswordRequirementsMsg message used to inform the user about password strength requirements

var SysAdminPassword = SysAdminUsername

SysAdminPassword the admin password (can be default or from command flags, config or env var)

var SysAdminUsername = "immudb"

SysAdminUsername the system admin username

var UpdateMetrics func(context.Context)

UpdateMetrics callback which will be called to update metrics

var WarnDefaultAdminPassword = "immudb user has the default password: please change it to ensure proper security"

WarnDefaultAdminPassword warning user message for the case when admin uses the default password

Functions

func ClientStreamInterceptor

func ClientStreamInterceptor(token string) func(context.Context, *grpc.StreamDesc, *grpc.ClientConn, string, grpc.Streamer, ...grpc.CallOption) (grpc.ClientStream, error)

ClientStreamInterceptor gRPC client interceptor for streams

func ClientUnaryInterceptor

func ClientUnaryInterceptor(token string) func(context.Context, string, interface{}, interface{}, *grpc.ClientConn, grpc.UnaryInvoker, ...grpc.CallOption) error

ClientUnaryInterceptor gRPC client interceptor for unary methods

func ComparePasswords

func ComparePasswords(hashedPassword []byte, plainPassword []byte) error

ComparePasswords compares the provided plainPassword against the provided hashed password

func DecodeBase64Password

func DecodeBase64Password(passwordBase64 string) (string, error)

DecodeBase64Password decodes the provided base64-encoded password if it has the "enc:" prefix or returns it with leading and trailing space trimmed otherwise

func DropTokenKeys

func DropTokenKeys(username string) bool

DropTokenKeys removes the token keys from the cache, hence invalidating any token that was generated with those keys

func DropTokenKeysForCtx

func DropTokenKeysForCtx(ctx context.Context) (bool, error)

DropTokenKeysForCtx removes the token keys from the cache for the username of the token that resides in the provided context

func GenerateToken

func GenerateToken(user User, database int64, expTime int) (string, error)

GenerateToken ...

func HasPermissionForMethod

func HasPermissionForMethod(userPermission uint32, method string) bool

HasPermissionForMethod checks if userPermission can access method name

func HashAndSaltPassword

func HashAndSaltPassword(plainPassword []byte) ([]byte, error)

HashAndSaltPassword hashes and salts the provided password

func IsMaintenanceMethod

func IsMaintenanceMethod(method string) bool

func IsStrongPassword

func IsStrongPassword(password string) error

IsStrongPassword checks if the provided password meets the strength requirements

func NewStringUUID

func NewStringUUID() string

NewStringUUID generate uuid and return as string

func NewUUID

func NewUUID() xid.ID

NewUUID generate uuid

func ServerStreamInterceptor

func ServerStreamInterceptor(srv interface{}, ss grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error

ServerStreamInterceptor gRPC server interceptor for streams

func ServerUnaryInterceptor

func ServerUnaryInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (interface{}, error)

ServerUnaryInterceptor gRPC server interceptor for unary methods

Types

type AuthType

type AuthType int

const (
	TokenAuth AuthType = iota
	SessionAuth
	None
)

func GetAuthTypeFromContext

func GetAuthTypeFromContext(ctx context.Context) AuthType

type JSONToken

type JSONToken struct {
	Username      string
	Expiration    time.Time
	DatabaseIndex int64
}

JSONToken ...

func GetLoggedInUser

func GetLoggedInUser(ctx context.Context) (*JSONToken, error)

GetLoggedInUser gets userdata from context

type Kind

type Kind uint32

Kind the authentication kind

const (
	KindNone Kind = iota
	KindPassword
	KindCryptoSig
)

Authentication kinds

type Permission

type Permission struct {
	Permission uint32 `json:"permission"` //permission of type auth.PermissionW
	Database   string `json:"database"`   //databases the user has access to
}

Permission per database

type TokenAuthStruct

type TokenAuthStruct struct {
	Token string
}

TokenAuthStruct authentication token data structure

func (TokenAuthStruct) GetRequestMetadata

func (t TokenAuthStruct) GetRequestMetadata(ctx context.Context, in ...string) (map[string]string, error)

GetRequestMetadata callback which returns the Bearer token to be set in request metadata

func (TokenAuthStruct) RequireTransportSecurity

func (TokenAuthStruct) RequireTransportSecurity() bool

RequireTransportSecurity callback which returns whether TLS is mandatory or not

type User

type User struct {
	Username       string       `json:"username"`
	HashedPassword []byte       `json:"hashedpassword"`
	Permissions    []Permission `json:"permissions"`
	Active         bool         `json:"active"`
	IsSysAdmin     bool         `json:"-"`         //for the sysadmin we'll use this instead of adding all db and permissions to Permissions, to save some cpu cycles
	CreatedBy      string       `json:"createdBy"` //user which created this user
	CreatedAt      time.Time    `json:"createdat"` //time in which this user is created/updated
}

User ...

func (*User) ComparePasswords

func (u *User) ComparePasswords(plainPassword []byte) error

ComparePasswords ...

func (*User) GrantPermission

func (u *User) GrantPermission(database string, permission uint32) bool

GrantPermission add permission to database

func (*User) HasAtLeastOnePermission

func (u *User) HasAtLeastOnePermission(permission uint32) bool

HasAtLeastOnePermission checks if user has this permission for at least one database

func (*User) HasPermission

func (u *User) HasPermission(database string, permission uint32) bool

HasPermission checks if user has such permission for this database

func (*User) RevokePermission

func (u *User) RevokePermission(database string) bool

RevokePermission revoke database permission from user

func (*User) SetPassword

func (u *User) SetPassword(plainPassword []byte) ([]byte, error)

SetPassword Hashes and salts the password and assigns it to hashedPassword of User

func (*User) WhichPermission

func (u *User) WhichPermission(database string) uint32

WhichPermission returns the permission that this user has on this database