auth

Paddy 2015-01-18 Parent:0a1e16b9c141 Child:23c1a07c8a61

124:d14f0a81498c Go to Latest

auth/session.go

Fill out token.CreatedFrom. Add a GrantType.AuditString() string method that will return a string for an audit log. Basically, it returns enough information to identify how the token got created. For client credentials, that's just the string "client_credentials". For user credentials, that's just the string "credentials". For auth codes, that's "authcode:", followed by the code used. For refresh tokens, that's "refresh_token:", followed by the refresh token used.

Download raw file
View source Diff to previous Annotate
History
paddy@70 1 package auth
paddy@70 2
paddy@70 3 import (
paddy@98 4 "crypto/sha256"
paddy@98 5 "encoding/hex"
paddy@119 6 "encoding/json"
paddy@70 7 "errors"
paddy@98 8 "log"
paddy@98 9 "net/http"
paddy@89 10 "sort"
paddy@70 11 "time"
paddy@70 12
paddy@107 13 "code.secondbit.org/pass.hg"
paddy@107 14 "code.secondbit.org/uuid.hg"
paddy@98 15 "github.com/gorilla/mux"
paddy@98 16 )
paddy@98 17
paddy@98 18 const (
paddy@98 19 loginTemplateName = "login"
paddy@70 20 )
paddy@70 21
paddy@119 22 func init() {
paddy@119 23 RegisterGrantType("password", GrantType{
paddy@119 24 Validate: credentialsValidate,
paddy@119 25 Invalidate: nil,
paddy@119 26 IssuesRefresh: true,
paddy@119 27 ReturnToken: RenderJSONToken,
paddy@124 28 AuditString: credentialsAuditString,
paddy@119 29 })
paddy@119 30 }
paddy@119 31
paddy@70 32 var (
paddy@70 33 // ErrNoSessionStore is returned when a Context tries to act on a sessionStore without setting on first.
paddy@70 34 ErrNoSessionStore = errors.New("no sessionStore was specified for the Context")
paddy@70 35 // ErrSessionNotFound is returned when a Session is requested but not found in the sessionStore.
paddy@70 36 ErrSessionNotFound = errors.New("session not found in sessionStore")
paddy@70 37 // ErrInvalidSession is returned when a Session is specified but is not valid.
paddy@70 38 ErrInvalidSession = errors.New("session is not valid")
paddy@77 39 // ErrSessionAlreadyExists is returned when a sessionStore tries to store a Session with an ID that already exists in the sessionStore.
paddy@77 40 ErrSessionAlreadyExists = errors.New("session already exists")
paddy@98 41
paddy@98 42 passphraseSchemes = map[int]passphraseScheme{
paddy@98 43 1: {
paddy@98 44 check: pbkdf2sha256check,
paddy@98 45 create: pbkdf2sha256create,
paddy@98 46 calculateIterations: pbkdf2sha256calc,
paddy@98 47 },
paddy@98 48 }
paddy@70 49 )
paddy@70 50
paddy@98 51 type passphraseScheme struct {
paddy@98 52 check func(profile Profile, passphrase string) (bool, error)
paddy@103 53 create func(passphrase string, iterations int) (result, salt string, err error)
paddy@98 54 calculateIterations func() (int, error)
paddy@98 55 }
paddy@98 56
paddy@70 57 // Session represents a user's authenticated session, associating it with a profile
paddy@70 58 // and some audit data.
paddy@70 59 type Session struct {
paddy@70 60 ID string
paddy@70 61 IP string
paddy@70 62 UserAgent string
paddy@70 63 ProfileID uuid.ID
paddy@98 64 Login string
paddy@70 65 Created time.Time
paddy@70 66 Active bool
paddy@70 67 }
paddy@70 68
paddy@89 69 type sortedSessions []Session
paddy@89 70
paddy@89 71 func (s sortedSessions) Len() int {
paddy@89 72 return len(s)
paddy@89 73 }
paddy@89 74
paddy@89 75 func (s sortedSessions) Less(i, j int) bool {
paddy@89 76 return s[i].Created.After(s[j].Created)
paddy@89 77 }
paddy@89 78
paddy@89 79 func (s sortedSessions) Swap(i, j int) {
paddy@89 80 s[i], s[j] = s[j], s[i]
paddy@89 81 }
paddy@89 82
paddy@70 83 type sessionStore interface {
paddy@70 84 createSession(session Session) error
paddy@70 85 getSession(id string) (Session, error)
paddy@70 86 removeSession(id string) error
paddy@70 87 listSessions(profile uuid.ID, before time.Time, num int64) ([]Session, error)
paddy@70 88 }
paddy@77 89
paddy@77 90 func (m *memstore) createSession(session Session) error {
paddy@77 91 m.sessionLock.Lock()
paddy@77 92 defer m.sessionLock.Unlock()
paddy@77 93 if _, ok := m.sessions[session.ID]; ok {
paddy@77 94 return ErrSessionAlreadyExists
paddy@77 95 }
paddy@77 96 m.sessions[session.ID] = session
paddy@77 97 return nil
paddy@77 98 }
paddy@77 99
paddy@77 100 func (m *memstore) getSession(id string) (Session, error) {
paddy@77 101 m.sessionLock.RLock()
paddy@77 102 defer m.sessionLock.RUnlock()
paddy@77 103 if _, ok := m.sessions[id]; !ok {
paddy@77 104 return Session{}, ErrSessionNotFound
paddy@77 105 }
paddy@77 106 return m.sessions[id], nil
paddy@77 107 }
paddy@77 108
paddy@77 109 func (m *memstore) removeSession(id string) error {
paddy@77 110 m.sessionLock.Lock()
paddy@77 111 defer m.sessionLock.Unlock()
paddy@77 112 if _, ok := m.sessions[id]; !ok {
paddy@77 113 return ErrSessionNotFound
paddy@77 114 }
paddy@77 115 delete(m.sessions, id)
paddy@77 116 return nil
paddy@77 117 }
paddy@77 118
paddy@77 119 func (m *memstore) listSessions(profile uuid.ID, before time.Time, num int64) ([]Session, error) {
paddy@77 120 m.sessionLock.RLock()
paddy@77 121 defer m.sessionLock.RUnlock()
paddy@77 122 res := []Session{}
paddy@77 123 for _, session := range m.sessions {
paddy@77 124 if int64(len(res)) >= num {
paddy@77 125 break
paddy@77 126 }
paddy@77 127 if profile != nil && !profile.Equal(session.ProfileID) {
paddy@77 128 continue
paddy@77 129 }
paddy@77 130 if !before.IsZero() && session.Created.After(before) {
paddy@77 131 continue
paddy@77 132 }
paddy@77 133 res = append(res, session)
paddy@77 134 }
paddy@89 135 sorted := sortedSessions(res)
paddy@89 136 sort.Sort(sorted)
paddy@89 137 res = []Session(sorted)
paddy@77 138 return res, nil
paddy@77 139 }
paddy@98 140
paddy@98 141 // RegisterSessionHandlers adds handlers to the passed router to handle the session endpoints, like login and logout.
paddy@98 142 func RegisterSessionHandlers(r *mux.Router, context Context) {
paddy@98 143 r.Handle("/login", wrap(context, CreateSessionHandler))
paddy@98 144 }
paddy@98 145
paddy@98 146 func checkCookie(r *http.Request, context Context) (Session, error) {
paddy@98 147 cookie, err := r.Cookie(authCookieName)
paddy@98 148 if err == http.ErrNoCookie {
paddy@98 149 return Session{}, ErrNoSession
paddy@98 150 } else if err != nil {
paddy@98 151 log.Println(err)
paddy@98 152 return Session{}, err
paddy@98 153 }
paddy@98 154 sess, err := context.GetSession(cookie.Value)
paddy@98 155 if err == ErrSessionNotFound {
paddy@98 156 return Session{}, ErrInvalidSession
paddy@98 157 } else if err != nil {
paddy@98 158 return Session{}, err
paddy@98 159 }
paddy@98 160 if !sess.Active {
paddy@98 161 return Session{}, ErrInvalidSession
paddy@98 162 }
paddy@98 163 return sess, nil
paddy@98 164 }
paddy@98 165
paddy@98 166 func buildLoginRedirect(r *http.Request, context Context) string {
paddy@98 167 if context.loginURI == nil {
paddy@98 168 return ""
paddy@98 169 }
paddy@98 170 uri := *context.loginURI
paddy@98 171 q := uri.Query()
paddy@98 172 q.Set("from", r.URL.String())
paddy@98 173 uri.RawQuery = q.Encode()
paddy@98 174 return uri.String()
paddy@98 175 }
paddy@98 176
paddy@98 177 func pbkdf2sha256check(profile Profile, passphrase string) (bool, error) {
paddy@98 178 realPass, err := hex.DecodeString(profile.Passphrase)
paddy@98 179 if err != nil {
paddy@98 180 return false, err
paddy@98 181 }
paddy@103 182 realSalt, err := hex.DecodeString(profile.Salt)
paddy@103 183 if err != nil {
paddy@103 184 return false, err
paddy@103 185 }
paddy@103 186 candidate := pass.Check(sha256.New, profile.Iterations, []byte(passphrase), []byte(realSalt))
paddy@98 187 if !pass.Compare(candidate, realPass) {
paddy@98 188 return false, ErrIncorrectAuth
paddy@98 189 }
paddy@98 190 return true, nil
paddy@98 191 }
paddy@98 192
paddy@103 193 func pbkdf2sha256create(passphrase string, iters int) (result, salt string, err error) {
paddy@103 194 passBytes, saltBytes, err := pass.Create(sha256.New, iters, []byte(passphrase))
paddy@103 195 if err != nil {
paddy@103 196 return "", "", err
paddy@103 197 }
paddy@103 198 result = hex.EncodeToString(passBytes)
paddy@103 199 salt = hex.EncodeToString(saltBytes)
paddy@103 200 return result, salt, err
paddy@98 201 }
paddy@98 202
paddy@98 203 func pbkdf2sha256calc() (int, error) {
paddy@98 204 return pass.CalculateIterations(sha256.New)
paddy@98 205 }
paddy@98 206
paddy@98 207 func authenticate(user, passphrase string, context Context) (Profile, error) {
paddy@98 208 profile, err := context.GetProfileByLogin(user)
paddy@98 209 if err != nil {
paddy@98 210 if err == ErrProfileNotFound || err == ErrLoginNotFound {
paddy@98 211 return Profile{}, ErrIncorrectAuth
paddy@98 212 }
paddy@98 213 return Profile{}, err
paddy@98 214 }
paddy@98 215 if profile.Compromised {
paddy@98 216 return Profile{}, ErrProfileCompromised
paddy@98 217 }
paddy@98 218 if !profile.LockedUntil.IsZero() && profile.LockedUntil.After(time.Now()) {
paddy@98 219 return profile, ErrProfileLocked
paddy@98 220 }
paddy@98 221 scheme, ok := passphraseSchemes[profile.PassphraseScheme]
paddy@98 222 if !ok {
paddy@98 223 return Profile{}, ErrInvalidPassphraseScheme
paddy@98 224 }
paddy@98 225 result, err := scheme.check(profile, passphrase)
paddy@98 226 if !result {
paddy@98 227 return Profile{}, err
paddy@98 228 }
paddy@98 229 return profile, nil
paddy@98 230 }
paddy@98 231
paddy@98 232 // CreateSessionHandler allows the user to log into their account and create their session.
paddy@98 233 func CreateSessionHandler(w http.ResponseWriter, r *http.Request, context Context) {
paddy@98 234 // BUG(paddy): Creating a session needs CSRF protection, right? This whole thing should get a security audit
paddy@98 235 errors := []error{}
paddy@98 236 if r.Method == "POST" {
paddy@98 237 profile, err := authenticate(r.PostFormValue("login"), r.PostFormValue("passphrase"), context)
paddy@98 238 if err == nil {
paddy@98 239 ip := r.Header.Get("X-Forwarded-For")
paddy@98 240 if ip == "" {
paddy@98 241 ip = r.RemoteAddr
paddy@98 242 }
paddy@98 243 session := Session{
paddy@98 244 ID: uuid.NewID().String(),
paddy@98 245 IP: ip,
paddy@98 246 UserAgent: r.UserAgent(),
paddy@98 247 ProfileID: profile.ID,
paddy@98 248 Login: r.PostFormValue("login"),
paddy@98 249 Created: time.Now(),
paddy@98 250 Active: true,
paddy@98 251 }
paddy@98 252 err = context.CreateSession(session)
paddy@98 253 if err != nil {
paddy@98 254 w.WriteHeader(http.StatusInternalServerError)
paddy@98 255 w.Write([]byte(err.Error()))
paddy@98 256 return
paddy@98 257 }
paddy@98 258 // BUG(paddy): really need to do a security audit on our cookie
paddy@98 259 cookie := http.Cookie{
paddy@98 260 Name: authCookieName,
paddy@98 261 Value: session.ID,
paddy@98 262 Expires: time.Now().Add(24 * 7 * time.Hour),
paddy@98 263 HttpOnly: true,
paddy@98 264 }
paddy@98 265 http.SetCookie(w, &cookie)
paddy@98 266 redirectTo := r.URL.Query().Get("from")
paddy@98 267 if redirectTo == "" {
paddy@98 268 redirectTo = "/"
paddy@98 269 }
paddy@98 270 http.Redirect(w, r, redirectTo, http.StatusFound)
paddy@98 271 return
paddy@98 272 } else if err != ErrIncorrectAuth && err != ErrProfileCompromised && err != ErrProfileLocked {
paddy@98 273 w.WriteHeader(http.StatusInternalServerError)
paddy@98 274 w.Write([]byte(err.Error()))
paddy@98 275 return
paddy@98 276 } else {
paddy@98 277 errors = append(errors, err)
paddy@98 278 }
paddy@98 279 }
paddy@98 280 context.Render(w, loginTemplateName, map[string]interface{}{
paddy@98 281 "errors": errors,
paddy@98 282 })
paddy@98 283 }
paddy@119 284
paddy@119 285 func credentialsValidate(w http.ResponseWriter, r *http.Request, context Context) (scope string, profileID uuid.ID, valid bool) {
paddy@119 286 enc := json.NewEncoder(w)
paddy@119 287 username := r.PostFormValue("username")
paddy@119 288 password := r.PostFormValue("password")
paddy@119 289 scope = r.PostFormValue("scope")
paddy@119 290 profile, err := authenticate(username, password, context)
paddy@119 291 if err != nil {
paddy@119 292 if err == ErrIncorrectAuth || err == ErrProfileCompromised || err == ErrProfileLocked {
paddy@119 293 w.WriteHeader(http.StatusBadRequest)
paddy@119 294 renderJSONError(enc, "invalid_grant")
paddy@119 295 return
paddy@119 296 }
paddy@119 297 w.WriteHeader(http.StatusInternalServerError)
paddy@119 298 w.Write([]byte(err.Error()))
paddy@119 299 return
paddy@119 300 }
paddy@119 301 profileID = profile.ID
paddy@119 302 valid = true
paddy@119 303 return
paddy@119 304 }
paddy@124 305
paddy@124 306 func credentialsAuditString(r *http.Request) string {
paddy@124 307 return "credentials"
paddy@124 308 }