70 lines
2.1 KiB
Lua
70 lines
2.1 KiB
Lua
-- Authentication with shared secret where the username is ignored
|
|
-- Copyright (C) 2023-present 8x8, Inc.
|
|
|
|
local new_sasl = require "util.sasl".new;
|
|
local saslprep = require "util.encodings".stringprep.saslprep;
|
|
local secure_equals = require "util.hashes".equals;
|
|
|
|
local shared_secret = module:get_option_string('shared_secret');
|
|
-- TODO: shared_secret_prev is probably broken. get_sasl_handler() returns shared_secret
|
|
-- from its plain callback, so Prosody rejects any password other than the current secret.
|
|
-- provider.test_password() handles shared_secret_prev correctly but is not called in the
|
|
-- PLAIN SASL flow. To fix, get_sasl_handler() should use a plain_test profile instead.
|
|
local shared_secret_prev = module:get_option_string('shared_secret_prev');
|
|
if shared_secret == nil then
|
|
module:log('error', 'No shared_secret specified. No secret to operate on!');
|
|
return;
|
|
end
|
|
|
|
module:depends("jitsi_session");
|
|
|
|
-- define auth provider
|
|
local provider = {};
|
|
|
|
function provider.test_password(username, password)
|
|
password = saslprep(password);
|
|
if not password then
|
|
return nil, "Password fails SASLprep.";
|
|
end
|
|
|
|
if secure_equals(password, saslprep(shared_secret)) then
|
|
return true;
|
|
elseif (shared_secret_prev ~= nil and secure_equals(password, saslprep(shared_secret_prev))) then
|
|
module:log("info", "Accepting login using previous shared secret, username=%s", username);
|
|
return true;
|
|
else
|
|
return nil, "Auth failed. Invalid username or password.";
|
|
end
|
|
end
|
|
|
|
function provider.get_password(username)
|
|
return shared_secret;
|
|
end
|
|
|
|
function provider.set_password(username, password)
|
|
return nil, "Set password not supported";
|
|
end
|
|
|
|
function provider.user_exists(username)
|
|
return true; -- all usernames exist
|
|
end
|
|
|
|
function provider.create_user(username, password)
|
|
return nil;
|
|
end
|
|
|
|
function provider.delete_user(username)
|
|
return nil;
|
|
end
|
|
|
|
function provider.get_sasl_handler(session)
|
|
local getpass_authentication_profile = {
|
|
plain = function(_, username, realm)
|
|
return shared_secret, true;
|
|
end
|
|
};
|
|
return new_sasl(module.host, getpass_authentication_profile);
|
|
end
|
|
|
|
module:provides("auth", provider);
|