|
| 1 | +-- Token authentication |
| 2 | +-- Copyright (C) 2015 Atlassian |
| 3 | + |
| 4 | +local formdecode = require "util.http".formdecode; |
| 5 | +local generate_uuid = require "util.uuid".generate; |
| 6 | +local new_sasl = require "util.sasl".new; |
| 7 | +local sasl = require "util.sasl"; |
| 8 | +local token_util = module:require "token/util_kiwi".new(module); |
| 9 | +local sessions = prosody.full_sessions; |
| 10 | + |
| 11 | +module:log("info", "kiwiirc patch active: prosody-plugins/mod_auth_kiwi_token.lua"); |
| 12 | + |
| 13 | +-- no token configuration |
| 14 | +if token_util == nil then |
| 15 | + return; |
| 16 | +end |
| 17 | + |
| 18 | +-- define auth provider |
| 19 | +local provider = {}; |
| 20 | + |
| 21 | +local host = module.host; |
| 22 | + |
| 23 | +-- Extract 'token' param from URL when session is created |
| 24 | +function init_session(event) |
| 25 | + local session, request = event.session, event.request; |
| 26 | + local query = request.url.query; |
| 27 | + |
| 28 | + if query ~= nil then |
| 29 | + local params = formdecode(query); |
| 30 | + |
| 31 | + -- The following fields are filled in the session, by extracting them |
| 32 | + -- from the query and no validation is beeing done. |
| 33 | + -- After validating auth_token will be cleaned in case of error and few |
| 34 | + -- other fields will be extracted from the token and set in the session |
| 35 | + |
| 36 | + session.auth_token = query and params.token or nil; |
| 37 | + -- previd is used together with https://modules.prosody.im/mod_smacks.html |
| 38 | + -- the param is used to find resumed session and re-use anonymous(random) user id |
| 39 | + -- (see get_username_from_token) |
| 40 | + session.previd = query and params.previd or nil; |
| 41 | + |
| 42 | + -- The room name and optional prefix from the web query |
| 43 | + session.jitsi_web_query_room = params.room; |
| 44 | + session.jitsi_web_query_prefix = params.prefix or ""; |
| 45 | + |
| 46 | + -- Deprecated, you should use jitsi_web_query_room and jitsi_web_query_prefix |
| 47 | + session.jitsi_bosh_query_room = session.jitsi_web_query_room; |
| 48 | + session.jitsi_bosh_query_prefix = session.jitsi_web_query_prefix; |
| 49 | + end |
| 50 | +end |
| 51 | + |
| 52 | +module:hook_global("bosh-session", init_session); |
| 53 | +module:hook_global("websocket-session", init_session); |
| 54 | + |
| 55 | +function provider.test_password(username, password) |
| 56 | + return nil, "Password based auth not supported"; |
| 57 | +end |
| 58 | + |
| 59 | +function provider.get_password(username) |
| 60 | + return nil; |
| 61 | +end |
| 62 | + |
| 63 | +function provider.set_password(username, password) |
| 64 | + return nil, "Set password not supported"; |
| 65 | +end |
| 66 | + |
| 67 | +function provider.user_exists(username) |
| 68 | + return nil; |
| 69 | +end |
| 70 | + |
| 71 | +function provider.create_user(username, password) |
| 72 | + return nil; |
| 73 | +end |
| 74 | + |
| 75 | +function provider.delete_user(username) |
| 76 | + return nil; |
| 77 | +end |
| 78 | + |
| 79 | +function provider.get_sasl_handler(session) |
| 80 | + |
| 81 | + local function get_username_from_token(self, message) |
| 82 | + |
| 83 | + -- retrieve custom public key from server and save it on the session |
| 84 | + local pre_event_result = prosody.events.fire_event("pre-jitsi-authentication-fetch-key", session); |
| 85 | + if pre_event_result ~= nil and pre_event_result.res == false then |
| 86 | + log("warn", |
| 87 | + "Error verifying token on pre authentication stage:%s, reason:%s", pre_event_result.error, pre_event_result.reason); |
| 88 | + session.auth_token = nil; |
| 89 | + return pre_event_result.res, pre_event_result.error, pre_event_result.reason; |
| 90 | + end |
| 91 | + |
| 92 | + local res, error, reason = token_util:process_and_verify_token(session); |
| 93 | + if res == false then |
| 94 | + log("warn", |
| 95 | + "Error verifying token err:%s, reason:%s", error, reason); |
| 96 | + session.auth_token = nil; |
| 97 | + return res, error, reason; |
| 98 | + end |
| 99 | + |
| 100 | + local customUsername |
| 101 | + = prosody.events.fire_event("pre-jitsi-authentication", session); |
| 102 | + |
| 103 | + if (customUsername) then |
| 104 | + self.username = customUsername; |
| 105 | + elseif (session.previd ~= nil) then |
| 106 | + for _, session1 in pairs(sessions) do |
| 107 | + if (session1.resumption_token == session.previd) then |
| 108 | + self.username = session1.username; |
| 109 | + break; |
| 110 | + end |
| 111 | + end |
| 112 | + else |
| 113 | + self.username = message; |
| 114 | + end |
| 115 | + |
| 116 | + local post_event_result = prosody.events.fire_event("post-jitsi-authentication", session); |
| 117 | + if post_event_result ~= nil and post_event_result.res == false then |
| 118 | + log("warn", |
| 119 | + "Error verifying token on post authentication stage :%s, reason:%s", post_event_result.error, post_event_result.reason); |
| 120 | + session.auth_token = nil; |
| 121 | + return post_event_result.res, post_event_result.error, post_event_result.reason; |
| 122 | + end |
| 123 | + |
| 124 | + return res; |
| 125 | + end |
| 126 | + |
| 127 | + return new_sasl(host, { anonymous = get_username_from_token }); |
| 128 | +end |
| 129 | + |
| 130 | +module:provides("auth", provider); |
| 131 | + |
| 132 | +local function anonymous(self, message) |
| 133 | + |
| 134 | + local username = generate_uuid(); |
| 135 | + |
| 136 | + -- This calls the handler created in 'provider.get_sasl_handler(session)' |
| 137 | + local result, err, msg = self.profile.anonymous(self, username, self.realm); |
| 138 | + |
| 139 | + if result == true then |
| 140 | + if (self.username == nil) then |
| 141 | + self.username = username; |
| 142 | + end |
| 143 | + return "success"; |
| 144 | + else |
| 145 | + return "failure", err, msg; |
| 146 | + end |
| 147 | +end |
| 148 | + |
| 149 | +sasl.registerMechanism("ANONYMOUS", {"anonymous"}, anonymous); |
0 commit comments