Software /
code /
prosody
Annotate
plugins/mod_auth_ldap.lua @ 12300:fb74ff16620c
mod_c2s: Close ports in a separate, earlier event from closing sessions
Lets other things step in and do things while c2s ports are closed, e.g.
mod_smacks, or other modules with port handlers that forward to c2s.
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Fri, 18 Feb 2022 14:25:22 +0100 |
parent | 11837:a37bf4497280 |
child | 12642:9061f9621330 |
rev | line source |
---|---|
11837
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
1 -- mod_auth_ldap |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
2 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
3 local jid_split = require "util.jid".split; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
4 local new_sasl = require "util.sasl".new; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
5 local lualdap = require "lualdap"; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
6 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
7 local function ldap_filter_escape(s) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
8 return (s:gsub("[*()\\%z]", function(c) return ("\\%02x"):format(c:byte()) end)); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
9 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
10 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
11 -- Config options |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
12 local ldap_server = module:get_option_string("ldap_server", "localhost"); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
13 local ldap_rootdn = module:get_option_string("ldap_rootdn", ""); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
14 local ldap_password = module:get_option_string("ldap_password", ""); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
15 local ldap_tls = module:get_option_boolean("ldap_tls"); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
16 local ldap_scope = module:get_option_string("ldap_scope", "subtree"); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
17 local ldap_filter = module:get_option_string("ldap_filter", "(uid=$user)"):gsub("%%s", "$user", 1); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
18 local ldap_base = assert(module:get_option_string("ldap_base"), "ldap_base is a required option for ldap"); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
19 local ldap_mode = module:get_option_string("ldap_mode", "bind"); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
20 local ldap_admins = module:get_option_string("ldap_admin_filter", |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
21 module:get_option_string("ldap_admins")); -- COMPAT with mistake in documentation |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
22 local host = ldap_filter_escape(module:get_option_string("realm", module.host)); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
23 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
24 -- Initiate connection |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
25 local ld = nil; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
26 module.unload = function() if ld then pcall(ld, ld.close); end end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
27 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
28 function ldap_do_once(method, ...) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
29 if ld == nil then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
30 local err; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
31 ld, err = lualdap.open_simple(ldap_server, ldap_rootdn, ldap_password, ldap_tls); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
32 if not ld then return nil, err, "reconnect"; end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
33 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
34 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
35 -- luacheck: ignore 411/success |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
36 local success, iterator, invariant, initial = pcall(ld[method], ld, ...); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
37 if not success then ld = nil; return nil, iterator, "search"; end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
38 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
39 local success, dn, attr = pcall(iterator, invariant, initial); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
40 if not success then ld = nil; return success, dn, "iter"; end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
41 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
42 return dn, attr, "return"; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
43 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
44 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
45 function ldap_do(method, retry_count, ...) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
46 local dn, attr, where; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
47 for _=1,1+retry_count do |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
48 dn, attr, where = ldap_do_once(method, ...); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
49 if dn or not(attr) then break; end -- nothing or something found |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
50 module:log("warn", "LDAP: %s %s (in %s)", tostring(dn), tostring(attr), where); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
51 -- otherwise retry |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
52 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
53 if not dn and attr then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
54 module:log("error", "LDAP: %s", tostring(attr)); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
55 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
56 return dn, attr; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
57 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
58 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
59 function get_user(username) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
60 module:log("debug", "get_user(%q)", username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
61 return ldap_do("search", 2, { |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
62 base = ldap_base; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
63 scope = ldap_scope; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
64 sizelimit = 1; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
65 filter = ldap_filter:gsub("%$(%a+)", { |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
66 user = ldap_filter_escape(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
67 host = host; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
68 }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
69 }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
70 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
71 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
72 local provider = {}; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
73 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
74 function provider.create_user(username, password) -- luacheck: ignore 212 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
75 return nil, "Account creation not available with LDAP."; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
76 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
77 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
78 function provider.user_exists(username) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
79 return not not get_user(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
80 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
81 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
82 function provider.set_password(username, password) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
83 local dn, attr = get_user(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
84 if not dn then return nil, attr end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
85 if attr.userPassword == password then return true end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
86 return ldap_do("modify", 2, dn, { '=', userPassword = password }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
87 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
88 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
89 if ldap_mode == "getpasswd" then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
90 function provider.get_password(username) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
91 local dn, attr = get_user(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
92 if dn and attr then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
93 return attr.userPassword; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
94 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
95 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
96 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
97 function provider.test_password(username, password) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
98 return provider.get_password(username) == password; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
99 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
100 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
101 function provider.get_sasl_handler() |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
102 return new_sasl(module.host, { |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
103 plain = function(sasl, username) -- luacheck: ignore 212/sasl |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
104 local password = provider.get_password(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
105 if not password then return "", nil; end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
106 return password, true; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
107 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
108 }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
109 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
110 elseif ldap_mode == "bind" then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
111 local function test_password(userdn, password) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
112 local ok, err = lualdap.open_simple(ldap_server, userdn, password, ldap_tls); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
113 if not ok then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
114 module:log("debug", "ldap open_simple error: %s", err); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
115 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
116 return not not ok; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
117 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
118 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
119 function provider.test_password(username, password) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
120 local dn = get_user(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
121 if not dn then return end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
122 return test_password(dn, password) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
123 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
124 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
125 function provider.get_sasl_handler() |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
126 return new_sasl(module.host, { |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
127 plain_test = function(sasl, username, password) -- luacheck: ignore 212/sasl |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
128 return provider.test_password(username, password), true; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
129 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
130 }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
131 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
132 else |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
133 module:log("error", "Unsupported ldap_mode %s", tostring(ldap_mode)); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
134 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
135 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
136 if ldap_admins then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
137 function provider.is_admin(jid) |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
138 local username, user_host = jid_split(jid); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
139 if user_host ~= module.host then |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
140 return false; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
141 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
142 return ldap_do("search", 2, { |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
143 base = ldap_base; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
144 scope = ldap_scope; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
145 sizelimit = 1; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
146 filter = ldap_admins:gsub("%$(%a+)", { |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
147 user = ldap_filter_escape(username); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
148 host = host; |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
149 }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
150 }); |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
151 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
152 end |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
153 |
a37bf4497280
mod_auth_ldap: Import from prosody-modules rev f52452911187
Kim Alvefur <zash@zash.se>
parents:
diff
changeset
|
154 module:provides("auth", provider); |