@ -1,41 +1,46 @@
-- Token authentication
-- Copyright (C) 2015 Atlassian
local usermanager = require " core.usermanager " ;
local generate_uuid = require " util.uuid " . generate ;
local new_sasl = require " util.sasl " . new ;
local log = module._log ;
local host = module.host ;
local sasl = require " util.sasl " ;
local formdecode = require " util.http " . formdecode ;
local token_util = module : require " token/util " ;
-- define auth provider
local provider = { } ;
--do
-- local list;
-- for mechanism in pairs(new_sasl(module.host):mechanisms()) do
-- list = (not(list) and mechanism) or (list..", "..mechanism);
-- end
-- if not list then
-- module:log("error", "No mechanisms");
-- else
-- module:log("error", "Mechanisms: %s", list);
-- end
--end
local host = module.host ;
local appId = module : get_option_string ( " app_id " ) ;
local appSecret = module : get_option_string ( " app_secret " ) ;
local allowEmptyToken = module : get_option_boolean ( " allow_empty_token " ) ;
function provider . test_password ( username , password )
local result , msg = token_util.verify_password ( password , appId , appSecret , nil ) ;
if result == true then
return true ;
else
log ( " error " , " Token auth failed for user %s, reason: %s " , username , msg ) ;
return nil , msg ;
if allowEmptyToken == true then
module : log ( " warn " , " WARNING - empty tokens allowed " ) ;
end
if appId == nil then
module : log ( " error " , " 'app_id' must not be empty " ) ;
return ;
end
if appSecret == nil then
module : log ( " error " , " 'app_secret' must not be empty " ) ;
return ;
end
-- Extract 'token' param from BOSH URL when session is created
module : hook ( " bosh-session " , function ( event )
local session , request = event.session , event.request ;
local query = request.url . query ;
if query ~= nil then
session.auth_token = query and formdecode ( query ) . token or nil ;
end
end )
function provider . test_password ( username , password )
return nil , " Password based auth not supported " ;
end
function provider . get_password ( username )
@ -50,10 +55,6 @@ function provider.user_exists(username)
return nil ;
end
function provider . users ( )
return next , hosts [ module.host ] . sessions , nil ;
end
function provider . create_user ( username , password )
return nil ;
end
@ -62,13 +63,59 @@ function provider.delete_user(username)
return nil ;
end
function provider . get_sasl_handler ( )
local testpass_authentication_profile = {
plain_test = function ( sasl , username , password , realm )
return usermanager.test_password ( username , realm , password ) , true ;
function provider . get_sasl_handler ( session )
-- JWT token extracted from BOSH URL
local token = session.auth_token ;
local function get_username_from_token ( self , message )
if token == nil then
if allowEmptyToken == true then
return true ;
else
return false , " not-allowed " , " token required " ;
end
end
-- here we check if 'room' claim exists
local room , roomErr = token_util.get_room_name ( token , appSecret ) ;
if room == nil then
return false , " not-allowed " , roomErr ;
end
-- now verify the whole token
local result , msg
= token_util.verify_token ( token , appId , appSecret , room ) ;
if result == true then
-- Binds room name to the session which is later checked on MUC join
session.jitsi_meet_room = room ;
return true
else
return false , " not-allowed " , msg
end
} ;
return new_sasl ( host , testpass_authentication_profile ) ;
end
return new_sasl ( host , { anonymous = get_username_from_token } ) ;
end
module : provides ( " auth " , provider ) ;
local function anonymous ( self , message )
local username = generate_uuid ( ) ;
-- This calls the handler created in 'provider.get_sasl_handler(session)'
local result , err , msg = self.profile . anonymous ( self , username , self.realm ) ;
self.username = username ;
if result == true then
return " success "
else
return " failure " , err , msg
end
end
sasl.registerMechanism ( " ANONYMOUS " , { " anonymous " } , anonymous ) ;
paweldomas
9 years ago