From 182003aa417ba67661c6743e0fabe6e1f67efd1c Mon Sep 17 00:00:00 2001 From: Paolo Borelli Date: Thu, 23 Apr 2015 13:58:57 +0200 Subject: [PATCH] Add PAM authentication --- .travis.yml | 6 ++-- conf/locale/locale_en-US.ini | 1 + models/login.go | 61 ++++++++++++++++++++++++++++++++++ modules/auth/auth_form.go | 1 + modules/auth/pam/pam.go | 35 +++++++++++++++++++ modules/auth/pam/pam_stub.go | 15 +++++++++ public/ng/js/gogs.js | 7 ++++ routers/admin/auths.go | 8 +++++ templates/admin/auth/edit.tmpl | 6 ++++ templates/admin/auth/new.tmpl | 6 ++++ 10 files changed, 144 insertions(+), 2 deletions(-) create mode 100644 modules/auth/pam/pam.go create mode 100644 modules/auth/pam/pam_stub.go diff --git a/.travis.yml b/.travis.yml index 4149e173..113773d6 100644 --- a/.travis.yml +++ b/.travis.yml @@ -6,11 +6,13 @@ go: - 1.4 - tip -sudo: false +before_install: + - sudo apt-get update -qq + - sudo apt-get install -y libpam-dev script: go build -v notifications: email: - u@gogs.io - slack: gophercn:o5pSanyTeNhnfYc3QnG0X7Wx \ No newline at end of file + slack: gophercn:o5pSanyTeNhnfYc3QnG0X7Wx diff --git a/conf/locale/locale_en-US.ini b/conf/locale/locale_en-US.ini index 3fbc71cb..8e768ae6 100644 --- a/conf/locale/locale_en-US.ini +++ b/conf/locale/locale_en-US.ini @@ -619,6 +619,7 @@ auths.smtp_auth = SMTP Authorization Type auths.smtphost = SMTP Host auths.smtpport = SMTP Port auths.enable_tls = Enable TLS Encryption +auths.pam_service_name = PAM Service Name auths.enable_auto_register = Enable Auto Registration auths.tips = Tips auths.edit = Edit Authorization Setting diff --git a/models/login.go b/models/login.go index 916e2731..8b773c13 100644 --- a/models/login.go +++ b/models/login.go @@ -17,6 +17,7 @@ import ( "github.com/go-xorm/xorm" "github.com/gogits/gogs/modules/auth/ldap" + "github.com/gogits/gogs/modules/auth/pam" "github.com/gogits/gogs/modules/log" "github.com/gogits/gogs/modules/uuid" ) @@ -28,6 +29,7 @@ const ( PLAIN LDAP SMTP + PAM ) var ( @@ -39,12 +41,14 @@ var ( var LoginTypes = map[LoginType]string{ LDAP: "LDAP", SMTP: "SMTP", + PAM: "PAM", } // Ensure structs implemented interface. var ( _ core.Conversion = &LDAPConfig{} _ core.Conversion = &SMTPConfig{} + _ core.Conversion = &PAMConfig{} ) type LDAPConfig struct { @@ -74,6 +78,18 @@ func (cfg *SMTPConfig) ToDB() ([]byte, error) { return json.Marshal(cfg) } +type PAMConfig struct { + ServiceName string // pam service (e.g. system-auth) +} + +func (cfg *PAMConfig) FromDB(bs []byte) error { + return json.Unmarshal(bs, &cfg) +} + +func (cfg *PAMConfig) ToDB() ([]byte, error) { + return json.Marshal(cfg) +} + type LoginSource struct { Id int64 Type LoginType @@ -97,6 +113,10 @@ func (source *LoginSource) SMTP() *SMTPConfig { return source.Cfg.(*SMTPConfig) } +func (source *LoginSource) PAM() *PAMConfig { + return source.Cfg.(*PAMConfig) +} + func (source *LoginSource) BeforeSet(colName string, val xorm.Cell) { if colName == "type" { ty := (*val).(int64) @@ -105,6 +125,8 @@ func (source *LoginSource) BeforeSet(colName string, val xorm.Cell) { source.Cfg = new(LDAPConfig) case SMTP: source.Cfg = new(SMTPConfig) + case PAM: + source.Cfg = new(PAMConfig) } } } @@ -197,6 +219,13 @@ func UserSignIn(uname, passwd string) (*User, error) { return u, nil } log.Warn("Fail to login(%s) by SMTP(%s): %v", uname, source.Name, err) + } else if source.Type == PAM { + u, err := LoginUserPAMSource(nil, uname, passwd, + source.Id, source.Cfg.(*PAMConfig), true) + if err == nil { + return u, nil + } + log.Warn("Fail to login(%s) by PAM(%s): %v", uname, source.Name, err) } } @@ -218,6 +247,8 @@ func UserSignIn(uname, passwd string) (*User, error) { return LoginUserLdapSource(u, u.LoginName, passwd, source.Id, source.Cfg.(*LDAPConfig), false) case SMTP: return LoginUserSMTPSource(u, u.LoginName, passwd, source.Id, source.Cfg.(*SMTPConfig), false) + case PAM: + return LoginUserPAMSource(u, u.LoginName, passwd, source.Id, source.Cfg.(*PAMConfig), false) } return nil, ErrUnsupportedLoginType } @@ -359,3 +390,33 @@ func LoginUserSMTPSource(u *User, name, passwd string, sourceId int64, cfg *SMTP err := CreateUser(u) return u, err } + +// Query if name/passwd can login against PAM +// Create a local user if success +// Return the same LoginUserPlain semantic +func LoginUserPAMSource(u *User, name, passwd string, sourceId int64, cfg *PAMConfig, autoRegister bool) (*User, error) { + if err := pam.PAMAuth(cfg.ServiceName, name, passwd); err != nil { + if strings.Contains(err.Error(), "Authentication failure") { + return nil, ErrUserNotExist + } + return nil, err + } + + if !autoRegister { + return u, nil + } + + // fake a local user creation + u = &User{ + LowerName: strings.ToLower(name), + Name: strings.ToLower(name), + LoginType: PAM, + LoginSource: sourceId, + LoginName: name, + IsActive: true, + Passwd: passwd, + Email: name, + } + err := CreateUser(u) + return u, err +} diff --git a/modules/auth/auth_form.go b/modules/auth/auth_form.go index 7d459999..1102dc34 100644 --- a/modules/auth/auth_form.go +++ b/modules/auth/auth_form.go @@ -30,6 +30,7 @@ type AuthenticationForm struct { SMTPPort int `form:"smtp_port"` TLS bool `form:"tls"` AllowAutoRegister bool `form:"allowautoregister"` + PAMServiceName string } func (f *AuthenticationForm) Validate(ctx *macaron.Context, errs binding.Errors) binding.Errors { diff --git a/modules/auth/pam/pam.go b/modules/auth/pam/pam.go new file mode 100644 index 00000000..7d150b1c --- /dev/null +++ b/modules/auth/pam/pam.go @@ -0,0 +1,35 @@ +// +build !windows + +// Copyright 2014 The Gogs Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package pam + +import ( + "errors" + + "github.com/msteinert/pam" +) + +func PAMAuth(serviceName, userName, passwd string) error { + t, err := pam.StartFunc(serviceName, userName, func(s pam.Style, msg string) (string, error) { + switch s { + case pam.PromptEchoOff: + return passwd, nil + case pam.PromptEchoOn, pam.ErrorMsg, pam.TextInfo: + return "", nil + } + return "", errors.New("Unrecognized PAM message style") + }) + + if err != nil { + return err + } + + if err = t.Authenticate(0); err != nil { + return err + } + + return nil +} diff --git a/modules/auth/pam/pam_stub.go b/modules/auth/pam/pam_stub.go new file mode 100644 index 00000000..2f210bf6 --- /dev/null +++ b/modules/auth/pam/pam_stub.go @@ -0,0 +1,15 @@ +// +build windows + +// Copyright 2014 The Gogs Authors. All rights reserved. +// Use of this source code is governed by a MIT-style +// license that can be found in the LICENSE file. + +package pam + +import ( + "errors" +) + +func PAMAuth(serviceName, userName, passwd string) error { + return errors.New("PAM not supported") +} diff --git a/public/ng/js/gogs.js b/public/ng/js/gogs.js index c5fd719c..7ffef8af 100644 --- a/public/ng/js/gogs.js +++ b/public/ng/js/gogs.js @@ -753,10 +753,17 @@ function initAdmin() { if (v == 2) { $('.ldap').toggleShow(); $('.smtp').toggleHide(); + $('.pam').toggleHide(); } if (v == 3) { $('.smtp').toggleShow(); $('.ldap').toggleHide(); + $('.pam').toggleHide(); + } + if (v == 4) { + $('.pam').toggleShow(); + $('.smtp').toggleHide(); + $('.ldap').toggleHide(); } }); diff --git a/routers/admin/auths.go b/routers/admin/auths.go index b13b0bd1..2bec7da4 100644 --- a/routers/admin/auths.go +++ b/routers/admin/auths.go @@ -84,6 +84,10 @@ func NewAuthSourcePost(ctx *middleware.Context, form auth.AuthenticationForm) { Port: form.SMTPPort, TLS: form.TLS, } + case models.PAM: + u = &models.PAMConfig{ + ServiceName: form.PAMServiceName, + } default: ctx.Error(400) return @@ -166,6 +170,10 @@ func EditAuthSourcePost(ctx *middleware.Context, form auth.AuthenticationForm) { Port: form.SMTPPort, TLS: form.TLS, } + case models.PAM: + config = &models.PAMConfig{ + ServiceName: form.PAMServiceName, + } default: ctx.Error(400) return diff --git a/templates/admin/auth/edit.tmpl b/templates/admin/auth/edit.tmpl index a178b717..12d1d1f8 100644 --- a/templates/admin/auth/edit.tmpl +++ b/templates/admin/auth/edit.tmpl @@ -91,6 +91,12 @@ + + {{else if eq $type 4}} +
+ + +
{{end}}
diff --git a/templates/admin/auth/new.tmpl b/templates/admin/auth/new.tmpl index 0d1f2ab4..36b90cfb 100644 --- a/templates/admin/auth/new.tmpl +++ b/templates/admin/auth/new.tmpl @@ -86,6 +86,12 @@
+