feat: add simple login

This commit is contained in:
Hendrik Schlehlein 2022-02-20 19:08:19 +01:00 committed by nitnelave
parent c850fa4273
commit 82df8d4ca1
3 changed files with 154 additions and 41 deletions

View File

@ -186,9 +186,13 @@ impl HostService {
.context("Error clearing cookie") .context("Error clearing cookie")
}; };
let parse_token = move |data: String| { let parse_token = move |data: String| {
get_claims_from_jwt(&data) serde_json::from_str::<login::ServerLoginResponse>(&data)
.context("Could not parse response") .context("Could not parse response")
.and_then(set_cookies) .and_then(|r| {
get_claims_from_jwt(r.token.as_str())
.context("Could not parse response")
.and_then(set_cookies)
})
}; };
call_server( call_server(
"/auth/opaque/login/finish", "/auth/opaque/login/finish",

View File

@ -3,10 +3,11 @@
use chrono::prelude::*; use chrono::prelude::*;
use serde::{Deserialize, Serialize}; use serde::{Deserialize, Serialize};
use std::collections::HashSet; use std::collections::HashSet;
use std::fmt;
pub mod opaque; pub mod opaque;
/// The messages for the 3-step OPAQUE login process. /// The messages for the 3-step OPAQUE and simple login process.
pub mod login { pub mod login {
use super::*; use super::*;
@ -35,6 +36,28 @@ pub mod login {
pub server_data: String, pub server_data: String,
pub credential_finalization: opaque::client::login::CredentialFinalization, pub credential_finalization: opaque::client::login::CredentialFinalization,
} }
#[derive(Serialize, Deserialize, Clone)]
pub struct ClientSimpleLoginRequest {
pub username: String,
pub password: String,
}
impl fmt::Debug for ClientSimpleLoginRequest {
fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
f.debug_struct("ClientSimpleLoginRequest")
.field("username", &self.username)
.field("password", &"***********")
.finish()
}
}
#[derive(Serialize, Deserialize, Clone)]
pub struct ServerLoginResponse {
pub token: String,
#[serde(rename = "refreshToken", skip_serializing_if = "Option::is_none")]
pub refresh_token: Option<String>,
}
} }
/// The messages for the 3-step OPAQUE registration process. /// The messages for the 3-step OPAQUE registration process.
@ -68,6 +91,19 @@ pub mod registration {
} }
} }
/// The messages for the 3-step OPAQUE registration process.
/// It is used to reset a user's password.
pub mod password_reset {
use super::*;
#[derive(Serialize, Deserialize, Clone)]
pub struct ServerPasswordResetResponse {
#[serde(rename = "userId")]
pub user_id: String,
pub token: String,
}
}
#[derive(Clone, Serialize, Deserialize)] #[derive(Clone, Serialize, Deserialize)]
pub struct JWTClaims { pub struct JWTClaims {
pub exp: DateTime<Utc>, pub exp: DateTime<Utc>,

View File

@ -1,14 +1,8 @@
use crate::{ use std::collections::{hash_map::DefaultHasher, HashSet};
domain::{ use std::hash::{Hash, Hasher};
error::DomainError, use std::pin::Pin;
handler::{BackendHandler, BindRequest, GroupIdAndName, LoginHandler}, use std::task::{Context, Poll};
opaque_handler::OpaqueHandler,
},
infra::{
tcp_backend_handler::*,
tcp_server::{error_to_http_response, AppState},
},
};
use actix_web::{ use actix_web::{
cookie::{Cookie, SameSite}, cookie::{Cookie, SameSite},
dev::{Service, ServiceRequest, ServiceResponse, Transform}, dev::{Service, ServiceRequest, ServiceResponse, Transform},
@ -22,15 +16,24 @@ use futures::future::{ok, Ready};
use futures_util::{FutureExt, TryFutureExt}; use futures_util::{FutureExt, TryFutureExt};
use hmac::Hmac; use hmac::Hmac;
use jwt::{SignWithKey, VerifyWithKey}; use jwt::{SignWithKey, VerifyWithKey};
use lldap_auth::{login, registration, JWTClaims};
use log::*; use log::*;
use sha2::Sha512; use sha2::Sha512;
use std::collections::{hash_map::DefaultHasher, HashSet};
use std::hash::{Hash, Hasher};
use std::pin::Pin;
use std::task::{Context, Poll};
use time::ext::NumericalDuration; use time::ext::NumericalDuration;
use lldap_auth::{login, opaque, password_reset, registration, JWTClaims};
use crate::{
domain::{
error::DomainError,
handler::{BackendHandler, BindRequest, GroupIdAndName, LoginHandler},
opaque_handler::OpaqueHandler,
},
infra::{
tcp_backend_handler::*,
tcp_server::{error_to_http_response, AppState},
},
};
type Token<S> = jwt::Token<jwt::Header, JWTClaims, S>; type Token<S> = jwt::Token<jwt::Header, JWTClaims, S>;
type SignedToken = Token<jwt::token::Signed>; type SignedToken = Token<jwt::token::Signed>;
@ -48,22 +51,28 @@ fn create_jwt(key: &Hmac<Sha512>, user: String, groups: HashSet<GroupIdAndName>)
jwt::Token::new(header, claims).sign_with_key(key).unwrap() jwt::Token::new(header, claims).sign_with_key(key).unwrap()
} }
fn get_refresh_token_from_cookie( fn parse_refresh_token(token: &str) -> std::result::Result<(u64, String), HttpResponse> {
request: HttpRequest, match token.split_once('+') {
) -> std::result::Result<(u64, String), HttpResponse> { None => Err(HttpResponse::Unauthorized().body("Invalid refresh token")),
match request.cookie("refresh_token") { Some((token, u)) => {
None => Err(HttpResponse::Unauthorized().body("Missing refresh token")), let refresh_token_hash = {
Some(t) => match t.value().split_once('+') { let mut s = DefaultHasher::new();
None => Err(HttpResponse::Unauthorized().body("Invalid refresh token")), token.hash(&mut s);
Some((token, u)) => { s.finish()
let refresh_token_hash = { };
let mut s = DefaultHasher::new(); Ok((refresh_token_hash, u.to_string()))
token.hash(&mut s); }
s.finish() }
}; }
Ok((refresh_token_hash, u.to_string()))
} fn get_refresh_token(request: HttpRequest) -> std::result::Result<(u64, String), HttpResponse> {
}, match (
request.cookie("refresh_token"),
request.headers().get("refresh-token"),
) {
(Some(c), _) => parse_refresh_token(c.value()),
(_, Some(t)) => parse_refresh_token(t.to_str().unwrap()),
(None, None) => Err(HttpResponse::Unauthorized().body("Missing refresh token")),
} }
} }
@ -76,7 +85,7 @@ where
{ {
let backend_handler = &data.backend_handler; let backend_handler = &data.backend_handler;
let jwt_key = &data.jwt_key; let jwt_key = &data.jwt_key;
let (refresh_token_hash, user) = match get_refresh_token_from_cookie(request) { let (refresh_token_hash, user) = match get_refresh_token(request) {
Ok(t) => t, Ok(t) => t,
Err(http_response) => return http_response, Err(http_response) => return http_response,
}; };
@ -108,7 +117,10 @@ where
.same_site(SameSite::Strict) .same_site(SameSite::Strict)
.finish(), .finish(),
) )
.body(token.as_str().to_owned()) .json(&login::ServerLoginResponse {
token: token.as_str().to_owned(),
refresh_token: None,
})
}) })
.unwrap_or_else(error_to_http_response) .unwrap_or_else(error_to_http_response)
} }
@ -183,7 +195,10 @@ where
.same_site(SameSite::Strict) .same_site(SameSite::Strict)
.finish(), .finish(),
) )
.json(user_id) .json(&password_reset::ServerPasswordResetResponse {
user_id,
token: token.as_str().to_owned(),
})
} }
async fn get_logout<Backend>( async fn get_logout<Backend>(
@ -193,7 +208,7 @@ async fn get_logout<Backend>(
where where
Backend: TcpBackendHandler + BackendHandler + 'static, Backend: TcpBackendHandler + BackendHandler + 'static,
{ {
let (refresh_token_hash, user) = match get_refresh_token_from_cookie(request) { let (refresh_token_hash, user) = match get_refresh_token(request) {
Ok(t) => t, Ok(t) => t,
Err(http_response) => return http_response, Err(http_response) => return http_response,
}; };
@ -274,6 +289,8 @@ where
.await .await
.map(|(groups, (refresh_token, max_age))| { .map(|(groups, (refresh_token, max_age))| {
let token = create_jwt(&data.jwt_key, name.to_string(), groups); let token = create_jwt(&data.jwt_key, name.to_string(), groups);
let refresh_token_plus_name = refresh_token + "+" + name;
HttpResponse::Ok() HttpResponse::Ok()
.cookie( .cookie(
Cookie::build("token", token.as_str()) Cookie::build("token", token.as_str())
@ -284,14 +301,17 @@ where
.finish(), .finish(),
) )
.cookie( .cookie(
Cookie::build("refresh_token", refresh_token + "+" + name) Cookie::build("refresh_token", refresh_token_plus_name.clone())
.max_age(max_age.num_days().days()) .max_age(max_age.num_days().days())
.path("/auth") .path("/auth")
.http_only(true) .http_only(true)
.same_site(SameSite::Strict) .same_site(SameSite::Strict)
.finish(), .finish(),
) )
.body(token.as_str().to_owned()) .json(&login::ServerLoginResponse {
token: token.as_str().to_owned(),
refresh_token: Some(refresh_token_plus_name),
})
}) })
.unwrap_or_else(error_to_http_response) .unwrap_or_else(error_to_http_response)
} }
@ -314,6 +334,58 @@ where
get_login_successful_response(&data, &name).await get_login_successful_response(&data, &name).await
} }
async fn simple_login<Backend>(
data: web::Data<AppState<Backend>>,
request: web::Json<login::ClientSimpleLoginRequest>,
) -> HttpResponse
where
Backend: TcpBackendHandler + BackendHandler + OpaqueHandler + 'static,
{
let password = &request.password;
let mut rng = rand::rngs::OsRng;
let opaque::client::login::ClientLoginStartResult { state, message } =
match opaque::client::login::start_login(password, &mut rng) {
Ok(n) => n,
Err(e) => {
return HttpResponse::InternalServerError()
.body(format!("Internal Server Error: {:#?}", e))
}
};
let username = request.username.clone();
let start_request = login::ClientLoginStartRequest {
username: username.clone(),
login_start_request: message,
};
let start_response = match data.backend_handler.login_start(start_request).await {
Ok(n) => n,
Err(e) => return error_to_http_response(e),
};
let login_finish =
match opaque::client::login::finish_login(state, start_response.credential_response) {
Err(_) => {
return error_to_http_response(DomainError::AuthenticationError(String::from(
"Invalid username or password",
)))
}
Ok(l) => l,
};
let finish_request = login::ClientLoginFinishRequest {
server_data: start_response.server_data,
credential_finalization: login_finish.message,
};
let name = match data.backend_handler.login_finish(finish_request).await {
Ok(n) => n,
Err(e) => return error_to_http_response(e),
};
get_login_successful_response(&data, &name).await
}
async fn post_authorize<Backend>( async fn post_authorize<Backend>(
data: web::Data<AppState<Backend>>, data: web::Data<AppState<Backend>>,
request: web::Json<BindRequest>, request: web::Json<BindRequest>,
@ -508,6 +580,7 @@ where
web::resource("/opaque/login/finish") web::resource("/opaque/login/finish")
.route(web::post().to(opaque_login_finish::<Backend>)), .route(web::post().to(opaque_login_finish::<Backend>)),
) )
.service(web::resource("/simple/login").route(web::post().to(simple_login::<Backend>)))
.service(web::resource("/refresh").route(web::get().to(get_refresh::<Backend>))) .service(web::resource("/refresh").route(web::get().to(get_refresh::<Backend>)))
.service( .service(
web::resource("/reset/step1/{user_id}") web::resource("/reset/step1/{user_id}")