Software `/` code `/` prosody

Annotate

plugins/mod_tokenauth.lua @ 12998:601d9a375b86

mod_tokenauth: Refactor API to separate tokens and grants This is another iteration on top of the previous sub-tokens work. Essentially, the concept of a "parent token" has been replaced with the concept of a "grant" to which all tokens now belong. The grant does not have any tokens when first created, but the create_token() call can add them.

author	Matthew Wild <mwild1@gmail.com>
date	Mon, 27 Mar 2023 18:35:57 +0100
parent	12997:0a56b84ec4ad
child	12999:c87ac7d1967f

rev	line source
12977 74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	1 local base64 = require "prosody.util.encodings".base64;
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	2 local hashes = require "prosody.util.hashes";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	3 local id = require "prosody.util.id";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	4 local jid = require "prosody.util.jid";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	5 local random = require "prosody.util.random";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	6 local usermanager = require "prosody.core.usermanager";
74b9e05af71e plugins: Prefix module imports with prosody namespace Kim Alvefur <zash@zash.se> parents: 12959 diff changeset	7 local generate_identifier = require "prosody.util.id".short;
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	8
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	9 local token_store = module:open_store("auth_tokens", "keyval+");
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	10
12980 6ebad8e16b3b mod_tokenauth: Track last access time (last time a token was used) Matthew Wild <mwild1@gmail.com> parents: 12977 diff changeset	11 local access_time_granularity = module:get_option_number("token_auth_access_time_granularity", 60);
6ebad8e16b3b mod_tokenauth: Track last access time (last time a token was used) Matthew Wild <mwild1@gmail.com> parents: 12977 diff changeset	12
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	13 local function select_role(username, host, role)
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	14 if role then
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	15 return prosody.hosts[host].authz.get_role_by_name(role);
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	16 end
12662 07424992d7fc mod_authz_internal, and more: New iteration of role API Matthew Wild <mwild1@gmail.com> parents: 12649 diff changeset	17 return usermanager.get_user_role(username, host);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	18 end
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	19
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	20 function create_grant(actor_jid, grant_jid, grant_ttl, grant_data)
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	21 grant_jid = jid.prep(grant_jid);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	22 if not actor_jid or actor_jid ~= grant_jid and not jid.compare(grant_jid, actor_jid) then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	23 module:log("debug", "Actor <%s> is not permitted to create a token granting access to JID <%s>", actor_jid, grant_jid);
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	24 return nil, "not-authorized";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	26
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	27 local grant_username, grant_host, grant_resource = jid.split(grant_jid);
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	28
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	29 if grant_host ~= module.host then
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	30 return nil, "invalid-host";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	31 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	32
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	33 local grant_id = id.short();
12980 6ebad8e16b3b mod_tokenauth: Track last access time (last time a token was used) Matthew Wild <mwild1@gmail.com> parents: 12977 diff changeset	34 local now = os.time();
6ebad8e16b3b mod_tokenauth: Track last access time (last time a token was used) Matthew Wild <mwild1@gmail.com> parents: 12977 diff changeset	35
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	36 local grant = {
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	37 id = grant_id;
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	38
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	39 owner = actor_jid;
12980 6ebad8e16b3b mod_tokenauth: Track last access time (last time a token was used) Matthew Wild <mwild1@gmail.com> parents: 12977 diff changeset	40 created = now;
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	41 expires = grant_ttl and (now + grant_ttl) or nil;
12980 6ebad8e16b3b mod_tokenauth: Track last access time (last time a token was used) Matthew Wild <mwild1@gmail.com> parents: 12977 diff changeset	42 accessed = now;
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	43
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	44 jid = grant_jid;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	45 resource = grant_resource;
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	46
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	47 data = grant_data;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	48
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	49 -- tokens[<hash-name>..":"..<secret>] = token_info
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	50 tokens = {};
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	51 };
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	52
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	53 local ok, err = token_store:set_key(grant_username, grant_id, grant);
12996 e8716515405e mod_tokenauth: return error if storage of new token fails Matthew Wild <mwild1@gmail.com> parents: 12980 diff changeset	54 if not ok then
e8716515405e mod_tokenauth: return error if storage of new token fails Matthew Wild <mwild1@gmail.com> parents: 12980 diff changeset	55 return nil, err;
e8716515405e mod_tokenauth: return error if storage of new token fails Matthew Wild <mwild1@gmail.com> parents: 12980 diff changeset	56 end
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	57
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	58 return grant;
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	59 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	60
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	61 function create_token(grant_jid, grant, token_role, token_ttl, token_purpose, token_data)
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	62 if (token_data and type(token_data) ~= "table") or (token_purpose and type(token_purpose) ~= "string") then
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	63 return nil, "bad-request";
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	64 end
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	65 local grant_username, grant_host = jid.split(grant_jid);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	66 if grant_host ~= module.host then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	67 return nil, "invalid-host";
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	68 end
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	69 if type(grant) == "string" then -- lookup by id
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	70 grant = token_store:get_key(grant_username, grant);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	71 if not grant then return nil; end
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	72 end
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	73
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	74 if not grant.tokens then return nil, "internal-server-error"; end -- old-style token?
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	75
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	76 local now = os.time();
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	77 local expires = grant.expires; -- Default to same expiry as grant
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	78 if token_ttl then -- explicit lifetime requested
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	79 if expires then
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	80 -- Grant has an expiry, so limit to that or shorter
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	81 expires = math.min(now + token_ttl, expires);
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	82 else
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	83 -- Grant never expires, just use whatever expiry is requested for the token
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	84 expires = now + token_ttl;
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	85 end
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	86 end
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	87
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	88 local token_info = {
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	89 role = token_role;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	90
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	91 created = now;
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	92 expires = expires;
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	93 purpose = token_purpose;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	94
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	95 data = token_data;
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	96 };
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	97
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	98 local token_secret = random.bytes(18);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	99 grant.tokens["sha256:"..hashes.sha256(token_secret, true)] = token_info;
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	100
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	101 local ok, err = token_store:set_key(grant_username, grant.id, grant);
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	102 if not ok then
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	103 return nil, err;
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	104 end
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	105
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	106 local token_string = "secret-token:"..base64.encode("2;"..grant.id..";"..token_secret..";"..grant.jid);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	107 return token_string, token_info;
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	108 end
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	109
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	110 local function parse_token(encoded_token)
12917 e4de42495fb7 mod_tokenauth: Gracefully handle missing tokens Matthew Wild <mwild1@gmail.com> parents: 12915 diff changeset	111 if not encoded_token then return nil; end
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	112 local encoded_data = encoded_token:match("^secret%-token:(.+)$");
ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	113 if not encoded_data then return nil; end
ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	114 local token = base64.decode(encoded_data);
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	115 if not token then return nil; end
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	116 local token_id, token_secret, token_jid = token:match("^2;([^;]+);([^;]+);(.+)$");
ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	117 if not token_id then return nil; end
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	118 local token_user, token_host = jid.split(token_jid);
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	119 return token_id, token_user, token_host, token_secret;
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	120 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	121
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	122 local function clear_expired_grant_tokens(grant, now)
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	123 local updated;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	124 now = now or os.time();
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	125 for secret, token_info in pairs(grant.tokens) do
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	126 if token_info.expires < now then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	127 grant.tokens[secret] = nil;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	128 updated = true;
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	129 end
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	130 end
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	131 return updated;
12997 0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	132 end
0a56b84ec4ad mod_tokenauth: Support for creating sub-tokens Matthew Wild <mwild1@gmail.com> parents: 12996 diff changeset	133
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	134 local function _get_validated_token_info(token_id, token_user, token_host, token_secret)
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	135 if token_host ~= module.host then
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	136 return nil, "invalid-host";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	137 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	138
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	139 local grant, err = token_store:get_key(token_user, token_id);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	140 if not grant or not grant.tokens then
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	141 if err then
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	142 module:log("error", "Unable to read from token storage: %s", err);
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	143 return nil, "internal-error";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	144 end
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	145 module:log("warn", "Invalid token in storage (%s / %s)", token_user, token_id);
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	146 return nil, "not-authorized";
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	147 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	148
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	149 -- Check provided secret
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	150 local secret_hash = "sha256:"..hashes.sha256(token_secret, true);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	151 local token_info = grant.tokens[secret_hash];
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	152 if not token_info then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	153 module:log("debug", "No tokens matched the given secret");
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	154 return nil, "not-authorized";
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	155 end
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	156
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	157 -- Check expiry
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	158 local now = os.time();
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	159 if token_info.expires < now then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	160 module:log("debug", "Token has expired, cleaning it up");
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	161 grant.tokens[secret_hash] = nil;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	162 token_store:set_key(token_user, token_id, grant);
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	163 return nil, "not-authorized";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	164 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	165
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	166 -- Invalidate grants from before last password change
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	167 local account_info = usermanager.get_account_info(token_user, module.host);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	168 local password_updated_at = account_info and account_info.password_updated;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	169 if grant.created < password_updated_at and password_updated_at then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	170 module:log("debug", "Token grant issued before last password change, invalidating it now");
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	171 token_store:set_key(token_user, token_id, nil);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	172 return nil, "not-authorized";
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	173 end
12742 126aefd2c4c6 mod_tokenauth: Invalidate tokens issued before most recent password change Matthew Wild <mwild1@gmail.com> parents: 12662 diff changeset	174
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	175 -- Update last access time if necessary
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	176 local last_accessed = grant.accessed;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	177 if not last_accessed or (now - last_accessed) > access_time_granularity then
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	178 grant.accessed = now;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	179 clear_expired_grant_tokens(grant); -- Clear expired tokens while we're here
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	180 token_store:set_key(token_user, token_id, grant);
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	181 end
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	182
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	183 token_info.id = token_id;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	184 token_info.grant = grant;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	185 token_info.jid = grant.jid;
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	186
601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	187 return token_info;
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	188 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	189
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	190
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	191 function get_token_info(token)
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	192 local token_id, token_user, token_host, token_secret = parse_token(token);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	193 if not token_id then
12952 a668bc1aa39d mod_tokenauth: Log error when token validation fails Matthew Wild <mwild1@gmail.com> parents: 12938 diff changeset	194 module:log("warn", "Failed to verify access token: %s", token_user);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	195 return nil, "invalid-token-format";
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	196 end
12953 ebe3b2f96cad mod_tokenauth: Switch to new token format (invalidates existing tokens!) Matthew Wild <mwild1@gmail.com> parents: 12952 diff changeset	197 return _get_validated_token_info(token_id, token_user, token_host, token_secret);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	198 end
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	199
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	200 function get_token_session(token, resource)
12959 e331210beeb2 mod_tokenauth: Fix traceback in get_token_session() Kim Alvefur <zash@zash.se> parents: 12953 diff changeset	201 local token_id, token_user, token_host, token_secret = parse_token(token);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	202 if not token_id then
12952 a668bc1aa39d mod_tokenauth: Log error when token validation fails Matthew Wild <mwild1@gmail.com> parents: 12938 diff changeset	203 module:log("warn", "Failed to verify access token: %s", token_user);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	204 return nil, "invalid-token-format";
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	205 end
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	206
12959 e331210beeb2 mod_tokenauth: Fix traceback in get_token_session() Kim Alvefur <zash@zash.se> parents: 12953 diff changeset	207 local token_info, err = _get_validated_token_info(token_id, token_user, token_host, token_secret);
12649 86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	208 if not token_info then return nil, err; end
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	209
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	210 return {
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	211 username = token_user;
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	212 host = token_host;
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	213 resource = token_info.resource or resource or generate_identifier();
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	214
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	215 role = select_role(token_user, token_host, token_info.role);
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	216 };
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	217 end
86e1187f6274 mod_tokenauth: New API that better fits how modules are using token auth Matthew Wild <mwild1@gmail.com> parents: 10675 diff changeset	218
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	219 function revoke_token(token)
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	220 local token_id, token_user, token_host = parse_token(token);
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	221 if not token_id then
12952 a668bc1aa39d mod_tokenauth: Log error when token validation fails Matthew Wild <mwild1@gmail.com> parents: 12938 diff changeset	222 module:log("warn", "Failed to verify access token: %s", token_user);
10668 25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	223 return nil, "invalid-token-format";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	224 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	225 if token_host ~= module.host then
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	226 return nil, "invalid-host";
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	227 end
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	228 return token_store:set(token_user, token_id, nil);
25c84c0a66fd mod_authtokens: New module for managing auth tokens Matthew Wild <mwild1@gmail.com> parents: diff changeset	229 end
12915 70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	230
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	231 function sasl_handler(auth_provider, purpose, extra)
12938 055b03d3059b util.sasl.oauthbearer: Return username from callback instead using authzid (BC) Kim Alvefur <zash@zash.se> parents: 12919 diff changeset	232 return function (sasl, token, realm, _authzid)
12915 70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	233 local token_info, err = get_token_info(token);
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	234 if not token_info then
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	235 module:log("debug", "SASL handler failed to verify token: %s", err);
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	236 return nil, nil, extra;
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	237 end
12998 601d9a375b86 mod_tokenauth: Refactor API to separate tokens and grants Matthew Wild <mwild1@gmail.com> parents: 12997 diff changeset	238 local token_user, token_host, resource = jid.split(token_info.grant.jid);
12938 055b03d3059b util.sasl.oauthbearer: Return username from callback instead using authzid (BC) Kim Alvefur <zash@zash.se> parents: 12919 diff changeset	239 if realm ~= token_host or (purpose and token_info.purpose ~= purpose) then
12915 70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	240 return nil, nil, extra;
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	241 end
12938 055b03d3059b util.sasl.oauthbearer: Return username from callback instead using authzid (BC) Kim Alvefur <zash@zash.se> parents: 12919 diff changeset	242 if auth_provider.is_enabled and not auth_provider.is_enabled(token_user) then
12915 70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	243 return true, false, token_info;
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	244 end
12938 055b03d3059b util.sasl.oauthbearer: Return username from callback instead using authzid (BC) Kim Alvefur <zash@zash.se> parents: 12919 diff changeset	245 sasl.resource = resource;
055b03d3059b util.sasl.oauthbearer: Return username from callback instead using authzid (BC) Kim Alvefur <zash@zash.se> parents: 12919 diff changeset	246 sasl.token_info = token_info;
055b03d3059b util.sasl.oauthbearer: Return username from callback instead using authzid (BC) Kim Alvefur <zash@zash.se> parents: 12919 diff changeset	247 return token_user, true, token_info;
12915 70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	248 end;
70f6a8dceb1d mod_tokenauth: Add SASL handler backend that can accept and verify tokens Matthew Wild <mwild1@gmail.com> parents: 12914 diff changeset	249 end

prosody

601d9a375b86

plugins/mod_tokenauth.lua

Software / code / prosody

Annotate

plugins/mod_tokenauth.lua @ 12998:601d9a375b86

Software `/` code `/` prosody