auth

package
v0.0.0-...-d559fe2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 19, 2024 License: MIT Imports: 40 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	BasicMethodName       = "basic"
	AccessTokenMethodName = "access_token"
	OAuth2TokenMethodName = "oauth2_token"
	ActionTokenMethodName = "action_token"
)

BasicMethodName is the constant name of the basic authentication method

View Source 
const ReverseProxyMethodName = "reverse_proxy"

ReverseProxyMethodName is the constant name of the ReverseProxy authentication method

Variables

View Source 
var (
	ErrAuthTokenInvalidFormat = util.NewInvalidArgumentErrorf("auth token has an invalid format")
	ErrAuthTokenExpired       = util.NewInvalidArgumentErrorf("auth token has expired")
	ErrAuthTokenInvalidHash   = util.NewInvalidArgumentErrorf("auth token is invalid")
)

Functions

func CheckAuthToken 

func CheckAuthToken(ctx context.Context, value string) (*auth_model.AuthToken, error)

func CheckTaskIsRunning 

func CheckTaskIsRunning(ctx context.Context, taskID int64) bool

CheckTaskIsRunning verifies that the TaskID corresponds to a running task

func CreateAuthTokenForUserID 

func CreateAuthTokenForUserID(ctx context.Context, userID int64) (*auth_model.AuthToken, string, error)

func DeleteSource 

func DeleteSource(ctx context.Context, source *auth.Source) error

DeleteSource deletes a AuthSource record in DB.

func GetAccessScope 

func GetAccessScope(store DataStore) auth_model.AccessTokenScope

func GetOAuthAccessTokenScopeAndUserID 

func GetOAuthAccessTokenScopeAndUserID(ctx context.Context, accessToken string) (auth_model.AccessTokenScope, int64)

GetOAuthAccessTokenScopeAndUserID returns access token scope and user id

func Init 

func Init()

Init should be called exactly once when the application starts to allow plugins to allocate necessary resources

func RegenerateAuthToken 

func RegenerateAuthToken(ctx context.Context, t *auth_model.AuthToken) (*auth_model.AuthToken, string, error)

func SyncExternalUsers 

func SyncExternalUsers(ctx context.Context, updateExisting bool) error

SyncExternalUsers is used to synchronize users with external authorization source

func UserSignIn 

func UserSignIn(ctx context.Context, username, password string) (*user_model.User, *auth.Source, error)

UserSignIn validates user name and password.

func VerifyCert 

func VerifyCert(r *http.Request) (*asymkey_model.PublicKey, error)

VerifyCert verifies the validity of the ssh certificate and returns the publickey of the signer We verify that the certificate is signed with the correct CA We verify that the http request is signed with the private key (of the public key mentioned in the certificate)

func VerifyPubKey 

func VerifyPubKey(r *http.Request) (*asymkey_model.PublicKey, error)

Types

type Basic 

type Basic struct{}

Basic implements the Auth interface and authenticates requests (API requests only) by looking for Basic authentication data or "x-oauth-basic" token in the "Authorization" header.

func (*Basic) Name 

func (b *Basic) Name() string

Name represents the name of auth method

func (*Basic) Verify 

func (b *Basic) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

Verify extracts and validates Basic data (username and password/token) from the "Authorization" header of the request and returns the corresponding user object for that name/token on successful validation. Returns nil if header is empty or validation fails.

type DataStore 

type DataStore middleware.ContextDataStore

DataStore represents a data store

type Group 

type Group struct {
	// contains filtered or unexported fields
}

Group implements the Auth interface with serval Auth.

func NewGroup 

func NewGroup(methods ...Method) *Group

NewGroup creates a new auth group

func (*Group) Add 

func (b *Group) Add(method Method)

Add adds a new method to group

func (*Group) Name 

func (b *Group) Name() string

Name returns group's methods name

func (*Group) Verify 

func (b *Group) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

type HTTPSign 

type HTTPSign struct{}

HTTPSign implements the Auth interface and authenticates requests (API requests only) by looking for http signature data in the "Signature" header. more information can be found on https://github.com/go-fed/httpsig

func (*HTTPSign) Name 

func (h *HTTPSign) Name() string

Name represents the name of auth method

func (*HTTPSign) Verify 

func (h *HTTPSign) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

Verify extracts and validates HTTPsign from the Signature header of the request and returns the corresponding user object on successful validation. Returns nil if header is empty or validation fails.

type LocalTwoFASkipper 

type LocalTwoFASkipper interface {
	IsSkipLocalTwoFA() bool
}

LocalTwoFASkipper represents a source of authentication that can skip local 2fa

type Method 

type Method interface {
	// Verify tries to verify the authentication data contained in the request.
	// If verification is successful returns either an existing user object (with id > 0)
	// or a new user object (with id = 0) populated with the information that was found
	// in the authentication data (username or email).
	// Second argument returns err if verification fails, otherwise
	// First return argument returns nil if no matched verification condition
	Verify(http *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

	Name() string
}

Method represents an authentication method (plugin) for HTTP requests.

type OAuth2 

type OAuth2 struct{}

OAuth2 implements the Auth interface and authenticates requests (API requests only) by looking for an OAuth token in query parameters or the "Authorization" header.

func (*OAuth2) Name 

func (o *OAuth2) Name() string

Name represents the name of auth method

func (*OAuth2) Verify 

func (o *OAuth2) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

Verify extracts the user ID from the OAuth token in the query parameters or the "Authorization" header and returns the corresponding user object for that ID. If verification is successful returns an existing user object. Returns nil if verification fails.

type PasswordAuthenticator 

type PasswordAuthenticator interface {
	Authenticate(ctx context.Context, user *user_model.User, login, password string) (*user_model.User, error)
}

PasswordAuthenticator represents a source of authentication

type ReverseProxy 

type ReverseProxy struct{}

ReverseProxy implements the Auth interface, but actually relies on a reverse proxy for authentication of users. On successful authentication the proxy is expected to populate the username in the "setting.ReverseProxyAuthUser" header. Optionally it can also populate the email of the user in the "setting.ReverseProxyAuthEmail" header.

func (*ReverseProxy) Name 

func (r *ReverseProxy) Name() string

Name represents the name of auth method

func (*ReverseProxy) Verify 

func (r *ReverseProxy) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

Verify attempts to load a user object based on headers sent by the reverse proxy. First it will attempt to load it based on the username (see docs for getUserFromAuthUser), and failing that it will attempt to load it based on the email (see docs for getUserFromAuthEmail). Returns nil if the headers are empty or the user is not found.

type SSPI 

type SSPI struct{}

SSPI implements the SingleSignOn interface and authenticates requests via the built-in SSPI module in Windows for SPNEGO authentication. The SSPI plugin is expected to be executed last, as it returns 401 status code if negotiation fails (or if negotiation should continue), which would prevent other authentication methods to execute at all.

func (*SSPI) Name 

func (s *SSPI) Name() string

Name represents the name of auth method

func (*SSPI) Verify 

func (s *SSPI) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

Verify uses SSPI (Windows implementation of SPNEGO) to authenticate the request. If authentication is successful, returns the corresponding user object. If negotiation should continue or authentication fails, immediately returns a 401 HTTP response code, as required by the SPNEGO protocol.

type SSPIAuth 

type SSPIAuth interface {
	AppendAuthenticateHeader(w http.ResponseWriter, data string)
	Authenticate(r *http.Request, w http.ResponseWriter) (userInfo *SSPIUserInfo, outToken string, err error)
}

type SSPIUserInfo 

type SSPIUserInfo struct {
	Username string   // Name of user, usually in the form DOMAIN\User
	Groups   []string // The global groups the user is a member of
}

type Session 

type Session struct{}

Session checks if there is a user uid stored in the session and returns the user object for that uid.

func (*Session) Name 

func (s *Session) Name() string

Name represents the name of auth method

func (*Session) Verify 

func (s *Session) Verify(req *http.Request, w http.ResponseWriter, store DataStore, sess SessionStore) (*user_model.User, error)

Verify checks if there is a user uid stored in the session and returns the user object for that uid. Returns nil if there is no user uid stored in the session.

type SessionStore 

type SessionStore session.Store

SessionStore represents a session store

type SynchronizableSource 

type SynchronizableSource interface {
	Sync(ctx context.Context, updateExisting bool) error
}

SynchronizableSource represents a source that can synchronize users

Source Files

View all Source files

Directories

Path Synopsis
db
ldap
oauth2
pam
smtp
sspi

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.