2014-06-09 01:53:53 +04:00
// Copyright 2014 The Gogs Authors. All rights reserved.
2019-11-14 22:10:23 +03:00
// Copyright 2019 The Gitea Authors. All rights reserved.
2022-11-27 21:20:29 +03:00
// SPDX-License-Identifier: MIT
2014-05-05 13:32:47 +04:00
2022-01-02 16:12:35 +03:00
package auth
2014-04-26 10:21:04 +04:00
2014-05-03 06:48:14 +04:00
import (
2021-09-24 14:32:56 +03:00
"fmt"
2021-07-24 13:16:34 +03:00
"reflect"
2014-04-26 10:21:04 +04:00
2021-09-19 14:49:59 +03:00
"code.gitea.io/gitea/models/db"
2016-11-10 19:24:48 +03:00
"code.gitea.io/gitea/modules/log"
2019-08-15 17:46:21 +03:00
"code.gitea.io/gitea/modules/timeutil"
2022-10-18 08:50:37 +03:00
"code.gitea.io/gitea/modules/util"
2019-08-15 17:46:21 +03:00
2019-10-17 12:26:49 +03:00
"xorm.io/xorm"
2020-03-22 18:12:55 +03:00
"xorm.io/xorm/convert"
2014-05-03 06:48:14 +04:00
)
2014-04-26 10:21:04 +04:00
2021-09-24 14:32:56 +03:00
// Type represents an login type.
type Type int
2014-06-09 01:53:53 +04:00
2016-08-31 11:22:41 +03:00
// Note: new type must append to the end of list to maintain compatibility.
2014-05-05 12:40:25 +04:00
const (
2021-09-24 14:32:56 +03:00
NoType Type = iota
Plain // 1
LDAP // 2
SMTP // 3
PAM // 4
DLDAP // 5
OAuth2 // 6
SSPI // 7
2014-05-05 12:40:25 +04:00
)
2021-07-24 13:16:34 +03:00
// String returns the string name of the LoginType
2021-09-24 14:32:56 +03:00
func ( typ Type ) String ( ) string {
return Names [ typ ]
2021-07-24 13:16:34 +03:00
}
2021-07-25 10:09:52 +03:00
// Int returns the int value of the LoginType
2021-09-24 14:32:56 +03:00
func ( typ Type ) Int ( ) int {
2021-07-25 10:09:52 +03:00
return int ( typ )
}
2021-09-24 14:32:56 +03:00
// Names contains the name of LoginType values.
var Names = map [ Type ] string {
LDAP : "LDAP (via BindDN)" ,
DLDAP : "LDAP (simple auth)" , // Via direct bind
SMTP : "SMTP" ,
PAM : "PAM" ,
OAuth2 : "OAuth2" ,
SSPI : "SPNEGO with SSPI" ,
2014-05-05 12:40:25 +04:00
}
2014-04-26 10:21:04 +04:00
2021-09-24 14:32:56 +03:00
// Config represents login config as far as the db is concerned
type Config interface {
2021-07-24 13:16:34 +03:00
convert . Conversion
2014-04-26 10:21:04 +04:00
}
2021-07-24 13:16:34 +03:00
// SkipVerifiable configurations provide a IsSkipVerify to check if SkipVerify is set
type SkipVerifiable interface {
IsSkipVerify ( ) bool
2016-07-08 02:25:09 +03:00
}
2021-07-24 13:16:34 +03:00
// HasTLSer configurations provide a HasTLS to check if TLS can be enabled
type HasTLSer interface {
HasTLS ( ) bool
2014-05-11 11:49:36 +04:00
}
2021-07-24 13:16:34 +03:00
// UseTLSer configurations provide a HasTLS to check if TLS is enabled
type UseTLSer interface {
UseTLS ( ) bool
2014-05-11 11:49:36 +04:00
}
2021-07-24 13:16:34 +03:00
// SSHKeyProvider configurations provide ProvidesSSHKeys to check if they provide SSHKeys
type SSHKeyProvider interface {
ProvidesSSHKeys ( ) bool
2014-05-11 11:49:36 +04:00
}
2021-07-24 13:16:34 +03:00
// RegisterableSource configurations provide RegisterSource which needs to be run on creation
type RegisterableSource interface {
RegisterSource ( ) error
UnregisterSource ( ) error
2015-04-23 14:58:57 +03:00
}
2022-01-02 16:12:35 +03:00
var registeredConfigs = map [ Type ] func ( ) Config { }
2015-04-23 14:58:57 +03:00
2021-09-24 14:32:56 +03:00
// RegisterTypeConfig register a config for a provided type
func RegisterTypeConfig ( typ Type , exemplar Config ) {
2021-07-24 13:16:34 +03:00
if reflect . TypeOf ( exemplar ) . Kind ( ) == reflect . Ptr {
// Pointer:
2021-09-24 14:32:56 +03:00
registeredConfigs [ typ ] = func ( ) Config {
return reflect . New ( reflect . ValueOf ( exemplar ) . Elem ( ) . Type ( ) ) . Interface ( ) . ( Config )
2021-07-24 13:16:34 +03:00
}
return
}
2019-11-23 02:33:31 +03:00
2021-07-24 13:16:34 +03:00
// Not a Pointer
2021-09-24 14:32:56 +03:00
registeredConfigs [ typ ] = func ( ) Config {
return reflect . New ( reflect . TypeOf ( exemplar ) ) . Elem ( ) . Interface ( ) . ( Config )
2021-07-24 13:16:34 +03:00
}
2019-11-23 02:33:31 +03:00
}
2022-01-02 16:12:35 +03:00
// SourceSettable configurations can have their authSource set on them
type SourceSettable interface {
SetAuthSource ( * Source )
}
2019-11-23 02:33:31 +03:00
2021-09-24 14:32:56 +03:00
// Source represents an external way for authorizing users.
type Source struct {
2017-05-10 16:10:18 +03:00
ID int64 ` xorm:"pk autoincr" `
2021-09-24 14:32:56 +03:00
Type Type
2020-03-22 18:12:55 +03:00
Name string ` xorm:"UNIQUE" `
2021-07-24 13:16:34 +03:00
IsActive bool ` xorm:"INDEX NOT NULL DEFAULT false" `
2020-03-22 18:12:55 +03:00
IsSyncEnabled bool ` xorm:"INDEX NOT NULL DEFAULT false" `
Cfg convert . Conversion ` xorm:"TEXT" `
2016-03-10 03:53:30 +03:00
2019-08-15 17:46:21 +03:00
CreatedUnix timeutil . TimeStamp ` xorm:"INDEX created" `
UpdatedUnix timeutil . TimeStamp ` xorm:"INDEX updated" `
2014-05-03 06:48:14 +04:00
}
2021-09-24 14:32:56 +03:00
// TableName xorm will read the table name from this method
func ( Source ) TableName ( ) string {
return "login_source"
}
2021-09-19 14:49:59 +03:00
func init ( ) {
2021-09-24 14:32:56 +03:00
db . RegisterModel ( new ( Source ) )
2021-09-19 14:49:59 +03:00
}
2016-11-24 14:34:38 +03:00
// BeforeSet is invoked from XORM before setting the value of a field of this object.
2021-09-24 14:32:56 +03:00
func ( source * Source ) BeforeSet ( colName string , val xorm . Cell ) {
2019-06-12 22:41:28 +03:00
if colName == "type" {
2022-01-02 16:12:35 +03:00
typ := Type ( db . Cell2Int64 ( val ) )
2021-09-24 14:32:56 +03:00
constructor , ok := registeredConfigs [ typ ]
2021-07-24 13:16:34 +03:00
if ! ok {
return
}
source . Cfg = constructor ( )
2021-09-24 14:32:56 +03:00
if settable , ok := source . Cfg . ( SourceSettable ) ; ok {
2022-01-02 16:12:35 +03:00
settable . SetAuthSource ( source )
2015-08-29 10:45:58 +03:00
}
}
}
2016-11-24 14:34:38 +03:00
// TypeName return name of this login source type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) TypeName ( ) string {
return Names [ source . Type ]
2014-05-05 12:40:25 +04:00
}
2016-11-24 14:34:38 +03:00
// IsLDAP returns true of this source is of the LDAP type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) IsLDAP ( ) bool {
return source . Type == LDAP
2015-09-11 19:03:08 +03:00
}
2016-11-24 14:34:38 +03:00
// IsDLDAP returns true of this source is of the DLDAP type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) IsDLDAP ( ) bool {
return source . Type == DLDAP
2015-09-11 19:03:08 +03:00
}
2016-11-24 14:34:38 +03:00
// IsSMTP returns true of this source is of the SMTP type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) IsSMTP ( ) bool {
return source . Type == SMTP
2015-09-11 19:03:08 +03:00
}
2016-11-24 14:34:38 +03:00
// IsPAM returns true of this source is of the PAM type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) IsPAM ( ) bool {
return source . Type == PAM
2015-09-11 19:03:08 +03:00
}
2017-02-22 10:14:37 +03:00
// IsOAuth2 returns true of this source is of the OAuth2 type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) IsOAuth2 ( ) bool {
return source . Type == OAuth2
2017-02-22 10:14:37 +03:00
}
2019-11-23 02:33:31 +03:00
// IsSSPI returns true of this source is of the SSPI type.
2021-09-24 14:32:56 +03:00
func ( source * Source ) IsSSPI ( ) bool {
return source . Type == SSPI
2019-11-23 02:33:31 +03:00
}
2016-11-24 14:34:38 +03:00
// HasTLS returns true of this source supports TLS.
2021-09-24 14:32:56 +03:00
func ( source * Source ) HasTLS ( ) bool {
2021-07-24 13:16:34 +03:00
hasTLSer , ok := source . Cfg . ( HasTLSer )
return ok && hasTLSer . HasTLS ( )
2016-07-08 02:25:09 +03:00
}
2016-11-24 14:34:38 +03:00
// UseTLS returns true of this source is configured to use TLS.
2021-09-24 14:32:56 +03:00
func ( source * Source ) UseTLS ( ) bool {
2021-07-24 13:16:34 +03:00
useTLSer , ok := source . Cfg . ( UseTLSer )
return ok && useTLSer . UseTLS ( )
2015-09-11 19:03:08 +03:00
}
2016-11-24 14:34:38 +03:00
// SkipVerify returns true if this source is configured to skip SSL
// verification.
2021-09-24 14:32:56 +03:00
func ( source * Source ) SkipVerify ( ) bool {
2021-07-24 13:16:34 +03:00
skipVerifiable , ok := source . Cfg . ( SkipVerifiable )
return ok && skipVerifiable . IsSkipVerify ( )
2019-11-23 02:33:31 +03:00
}
2022-01-02 16:12:35 +03:00
// CreateSource inserts a AuthSource in the DB if not already
2016-11-24 14:34:38 +03:00
// existing with the given name.
2021-09-24 14:32:56 +03:00
func CreateSource ( source * Source ) error {
has , err := db . GetEngine ( db . DefaultContext ) . Where ( "name=?" , source . Name ) . Exist ( new ( Source ) )
2016-08-31 10:56:10 +03:00
if err != nil {
return err
} else if has {
2021-09-24 14:32:56 +03:00
return ErrSourceAlreadyExist { source . Name }
2016-08-31 10:56:10 +03:00
}
2021-07-08 14:38:13 +03:00
// Synchronization is only available with LDAP for now
2017-05-10 16:10:18 +03:00
if ! source . IsLDAP ( ) {
source . IsSyncEnabled = false
}
2016-08-31 10:56:10 +03:00
2021-09-23 18:45:36 +03:00
_ , err = db . GetEngine ( db . DefaultContext ) . Insert ( source )
2021-07-24 13:16:34 +03:00
if err != nil {
return err
}
if ! source . IsActive {
return nil
}
2021-09-24 14:32:56 +03:00
if settable , ok := source . Cfg . ( SourceSettable ) ; ok {
2022-01-02 16:12:35 +03:00
settable . SetAuthSource ( source )
2021-07-25 10:09:52 +03:00
}
2021-07-24 13:16:34 +03:00
registerableSource , ok := source . Cfg . ( RegisterableSource )
if ! ok {
return nil
}
err = registerableSource . RegisterSource ( )
if err != nil {
2022-01-02 16:12:35 +03:00
// remove the AuthSource in case of errors while registering configuration
2021-09-23 18:45:36 +03:00
if _ , err := db . GetEngine ( db . DefaultContext ) . Delete ( source ) ; err != nil {
2021-09-24 14:32:56 +03:00
log . Error ( "CreateSource: Error while wrapOpenIDConnectInitializeError: %v" , err )
2017-05-01 16:26:53 +03:00
}
2017-02-22 10:14:37 +03:00
}
2014-06-09 01:53:53 +04:00
return err
}
2021-09-24 14:32:56 +03:00
// Sources returns a slice of all login sources found in DB.
func Sources ( ) ( [ ] * Source , error ) {
auths := make ( [ ] * Source , 0 , 6 )
2021-09-23 18:45:36 +03:00
return auths , db . GetEngine ( db . DefaultContext ) . Find ( & auths )
2014-05-03 06:48:14 +04:00
}
2021-09-24 14:32:56 +03:00
// SourcesByType returns all sources of the specified type
func SourcesByType ( loginType Type ) ( [ ] * Source , error ) {
sources := make ( [ ] * Source , 0 , 1 )
2021-09-23 18:45:36 +03:00
if err := db . GetEngine ( db . DefaultContext ) . Where ( "type = ?" , loginType ) . Find ( & sources ) ; err != nil {
2019-11-23 02:33:31 +03:00
return nil , err
}
return sources , nil
}
2021-09-24 14:32:56 +03:00
// AllActiveSources returns all active sources
func AllActiveSources ( ) ( [ ] * Source , error ) {
sources := make ( [ ] * Source , 0 , 5 )
2021-09-23 18:45:36 +03:00
if err := db . GetEngine ( db . DefaultContext ) . Where ( "is_active = ?" , true ) . Find ( & sources ) ; err != nil {
2021-07-24 13:16:34 +03:00
return nil , err
}
return sources , nil
}
2021-09-24 14:32:56 +03:00
// ActiveSources returns all active sources of the specified type
func ActiveSources ( tp Type ) ( [ ] * Source , error ) {
sources := make ( [ ] * Source , 0 , 1 )
if err := db . GetEngine ( db . DefaultContext ) . Where ( "is_active = ? and type = ?" , true , tp ) . Find ( & sources ) ; err != nil {
2019-11-23 02:33:31 +03:00
return nil , err
}
return sources , nil
}
// IsSSPIEnabled returns true if there is at least one activated login
// source of type LoginSSPI
func IsSSPIEnabled ( ) bool {
2021-09-19 14:49:59 +03:00
if ! db . HasEngine {
2019-11-23 02:33:31 +03:00
return false
}
2021-09-24 14:32:56 +03:00
sources , err := ActiveSources ( SSPI )
2019-11-23 02:33:31 +03:00
if err != nil {
2021-09-24 14:32:56 +03:00
log . Error ( "ActiveSources: %v" , err )
2019-11-23 02:33:31 +03:00
return false
}
return len ( sources ) > 0
}
2021-09-24 14:32:56 +03:00
// GetSourceByID returns login source by given ID.
func GetSourceByID ( id int64 ) ( * Source , error ) {
source := new ( Source )
2021-07-24 13:16:34 +03:00
if id == 0 {
2021-09-24 14:32:56 +03:00
source . Cfg = registeredConfigs [ NoType ] ( )
2021-07-24 13:16:34 +03:00
// Set this source to active
// FIXME: allow disabling of db based password authentication in future
source . IsActive = true
return source , nil
}
2021-09-23 18:45:36 +03:00
has , err := db . GetEngine ( db . DefaultContext ) . ID ( id ) . Get ( source )
2014-05-05 12:40:25 +04:00
if err != nil {
return nil , err
2014-06-09 01:53:53 +04:00
} else if ! has {
2021-09-24 14:32:56 +03:00
return nil , ErrSourceNotExist { id }
2014-05-05 12:40:25 +04:00
}
return source , nil
}
2021-09-24 14:32:56 +03:00
// UpdateSource updates a Source record in DB.
func UpdateSource ( source * Source ) error {
2022-01-02 16:12:35 +03:00
var originalSource * Source
2017-05-01 16:26:53 +03:00
if source . IsOAuth2 ( ) {
// keep track of the original values so we can restore in case of errors while registering OAuth2 providers
var err error
2022-01-02 16:12:35 +03:00
if originalSource , err = GetSourceByID ( source . ID ) ; err != nil {
2017-05-01 16:26:53 +03:00
return err
}
}
2021-09-23 18:45:36 +03:00
_ , err := db . GetEngine ( db . DefaultContext ) . ID ( source . ID ) . AllCols ( ) . Update ( source )
2021-07-24 13:16:34 +03:00
if err != nil {
return err
}
if ! source . IsActive {
return nil
}
2021-09-24 14:32:56 +03:00
if settable , ok := source . Cfg . ( SourceSettable ) ; ok {
2022-01-02 16:12:35 +03:00
settable . SetAuthSource ( source )
2021-07-25 10:09:52 +03:00
}
2021-07-24 13:16:34 +03:00
registerableSource , ok := source . Cfg . ( RegisterableSource )
if ! ok {
return nil
}
err = registerableSource . RegisterSource ( )
if err != nil {
// restore original values since we cannot update the provider it self
2022-01-02 16:12:35 +03:00
if _ , err := db . GetEngine ( db . DefaultContext ) . ID ( source . ID ) . AllCols ( ) . Update ( originalSource ) ; err != nil {
2021-07-24 13:16:34 +03:00
log . Error ( "UpdateSource: Error while wrapOpenIDConnectInitializeError: %v" , err )
2017-05-01 16:26:53 +03:00
}
2017-02-22 10:14:37 +03:00
}
2014-05-03 06:48:14 +04:00
return err
}
2021-09-24 14:32:56 +03:00
// CountSources returns number of login sources.
func CountSources ( ) int64 {
count , _ := db . GetEngine ( db . DefaultContext ) . Count ( new ( Source ) )
return count
}
2017-02-22 10:14:37 +03:00
2021-09-24 14:32:56 +03:00
// ErrSourceNotExist represents a "SourceNotExist" kind of error.
type ErrSourceNotExist struct {
ID int64
}
2017-02-22 10:14:37 +03:00
2021-09-24 14:32:56 +03:00
// IsErrSourceNotExist checks if an error is a ErrSourceNotExist.
func IsErrSourceNotExist ( err error ) bool {
_ , ok := err . ( ErrSourceNotExist )
return ok
}
2017-02-22 10:14:37 +03:00
2021-09-24 14:32:56 +03:00
func ( err ErrSourceNotExist ) Error ( ) string {
return fmt . Sprintf ( "login source does not exist [id: %d]" , err . ID )
2014-04-26 10:21:04 +04:00
}
2014-05-11 10:12:45 +04:00
2022-10-18 08:50:37 +03:00
// Unwrap unwraps this as a ErrNotExist err
func ( err ErrSourceNotExist ) Unwrap ( ) error {
return util . ErrNotExist
}
2021-09-24 14:32:56 +03:00
// ErrSourceAlreadyExist represents a "SourceAlreadyExist" kind of error.
type ErrSourceAlreadyExist struct {
Name string
}
// IsErrSourceAlreadyExist checks if an error is a ErrSourceAlreadyExist.
func IsErrSourceAlreadyExist ( err error ) bool {
_ , ok := err . ( ErrSourceAlreadyExist )
return ok
}
func ( err ErrSourceAlreadyExist ) Error ( ) string {
return fmt . Sprintf ( "login source already exists [name: %s]" , err . Name )
}
2022-10-18 08:50:37 +03:00
// Unwrap unwraps this as a ErrExist err
func ( err ErrSourceAlreadyExist ) Unwrap ( ) error {
return util . ErrAlreadyExist
}
2021-09-24 14:32:56 +03:00
// ErrSourceInUse represents a "SourceInUse" kind of error.
type ErrSourceInUse struct {
ID int64
}
// IsErrSourceInUse checks if an error is a ErrSourceInUse.
func IsErrSourceInUse ( err error ) bool {
_ , ok := err . ( ErrSourceInUse )
return ok
}
func ( err ErrSourceInUse ) Error ( ) string {
return fmt . Sprintf ( "login source is still used by some users [id: %d]" , err . ID )
2016-08-31 11:22:41 +03:00
}