mod_auth_form.c revision 7a33ac1af978d790a5594d686141ad284eacd070
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "apr_strings.h"
#include "apr_md5.h" /* for apr_password_validate */
#include "apr_lib.h" /* for apr_isspace */
#include "apr_base64.h" /* for apr_base64_decode et al */
#define APR_WANT_STRFUNC /* for strcasecmp */
#include "apr_want.h"
#include "ap_config.h"
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "ap_provider.h"
#include "util_md5.h"
#include "mod_auth.h"
#include "mod_session.h"
#include "mod_request.h"
#define LOG_PREFIX "mod_auth_form: "
#define FORM_LOGIN_HANDLER "form-login-handler"
#define FORM_LOGOUT_HANDLER "form-logout-handler"
#define FORM_REDIRECT_HANDLER "form-redirect-handler"
#define MOD_AUTH_FORM_HASH "site"
typedef struct {
char *dir;
int authoritative;
int authoritative_set;
const char *site;
int site_set;
const char *username;
int username_set;
const char *password;
int password_set;
int form_size_set;
int fakebasicauth;
int fakebasicauth_set;
const char *location;
int location_set;
const char *method;
int method_set;
const char *mimetype;
int mimetype_set;
const char *body;
int body_set;
int disable_no_store;
int disable_no_store_set;
const char *loginsuccess;
int loginsuccess_set;
const char *loginrequired;
int loginrequired_set;
const char *logout;
int logout_set;
static void *create_auth_form_dir_config(apr_pool_t * p, char *d)
{
/* Any failures are fatal. */
/* form size defaults to 8k */
/* default form field names */
return conf;
}
{
new->disable_no_store = (add->disable_no_store_set == 0) ? base->disable_no_store : add->disable_no_store;
return new;
}
const char *arg)
{
/* lookup and cache the actual provider now */
/*
* by the time they use it, the provider should be loaded and
* registered with us.
*/
"Unknown Authn provider: %s",
}
/* if it doesn't provide the appropriate function, reject it */
"The '%s' Authn provider doesn't support "
}
return "You must load mod_session to enable the mod_auth_form "
"functions";
}
}
return "You must load mod_request to enable the mod_auth_form "
"functions";
}
}
/* Add it to the list now. */
}
else {
}
}
return NULL;
}
/**
* Sanity check a given string that it exists, is not empty,
* and does not contain special characters.
*/
{
" cannot be empty, or contain '=' or '&'.",
NULL);
}
return NULL;
}
{
}
{
}
{
}
{
}
{
}
{
}
const char *arg)
{
return "AuthCookieFormSize must be a size in bytes, or zero.";
}
return NULL;
}
static const char *set_login_required_location(cmd_parms * cmd, void *config, const char *loginrequired)
{
return NULL;
}
static const char *set_login_success_location(cmd_parms * cmd, void *config, const char *loginsuccess)
{
return NULL;
}
{
return NULL;
}
{
return NULL;
}
{
return NULL;
}
{
return NULL;
}
{
return NULL;
}
static const command_rec auth_form_cmds[] =
{
"specify the auth providers for a directory or location"),
"The field of the login form carrying the username"),
"The field of the login form carrying the password"),
"The field of the login form carrying the URL to redirect on "
"successful login."),
"The field of the login form carrying the original request method."),
"The field of the login form carrying the original request mimetype."),
"The field of the login form carrying the urlencoded original request "
"body."),
"Maximum size of body parsed by the form parser"),
"If set, redirect the browser to this URL rather than "
"return 401 Not Authorized."),
"If set, redirect the browser to this URL when a login "
"processed by the login handler is successful."),
"The URL of the logout successful page. An attempt to access an "
"in an redirect to this page after logout."),
"If set, use this passphrase to determine whether the user should "
"be authenticated. Bypasses the user authentication check on "
"every website hit, and is useful for high traffic sites."),
"Set to 'Off' to allow access control to be passed along to "
"lower modules if the UserID is not known to this module"),
"Set to 'On' to pass through authentication to the rest of the "
"server as a basic authentication header."),
"Set to 'on' to stop the sending of a Cache-Control no-store header with "
"the login screen. This allows the browser to cache the credentials, but "
"at the risk of it being possible for the login form to be resubmitted "
"and revealed to the backend server through XSS. Use at own risk."),
{NULL}
};
static void note_cookie_auth_failure(request_rec * r)
{
}
}
static int hook_note_cookie_auth_failure(request_rec * r,
const char *auth_type)
{
return DECLINED;
return OK;
}
/**
* Set the auth username and password into the main request
* notes table.
*/
static void set_notes_auth(request_rec * r,
{
const char *authname;
/* find the main request */
while (r->main) {
r = r->main;
}
/* find the first redirect */
while (r->prev) {
r = r->prev;
}
/* have we isolated the user and pw before? */
authname = ap_auth_name(r);
if (user) {
}
if (pw) {
}
if (method) {
}
if (mimetype) {
}
}
/**
* Get the auth username and password from the main request
* notes table, if present.
*/
static void get_notes_auth(request_rec * r,
{
const char *authname;
/* find the main request */
while (r->main) {
r = r->main;
}
/* find the first redirect */
while (r->prev) {
r = r->prev;
}
/* have we isolated the user and pw before? */
authname = ap_auth_name(r);
if (user) {
}
if (pw) {
}
if (method) {
}
if (mimetype) {
}
"from notes: user: %s, pw: %s, method: %s, mimetype: %s",
}
/**
* Set the auth username and password into the session.
*
* If either the username, or the password are NULL, the username
*/
{
const char *authname = ap_auth_name(r);
session_rec *z = NULL;
if (site) {
}
ap_session_load_fn(r, &z);
return APR_SUCCESS;
}
/**
* Get the auth username and password from the main request
* notes table, if present.
*/
{
const char *authname = ap_auth_name(r);
session_rec *z = NULL;
ap_session_load_fn(r, &z);
if (user) {
}
if (pw) {
}
if (hash) {
}
/* set the user, even though the user is unauthenticated at this point */
}
return APR_SUCCESS;
}
/**
* Isolate the username and password in a POSTed form with the
* username in the "username" field, and the password in the
* "password" field.
*
* If either the username or the password is missing, this
* function will return HTTP_UNAUTHORIZED.
*
* The location field is considered optional, and will be returned
* if present.
*/
static int get_form_auth(request_rec * r,
const char *username,
const char *password,
const char *location,
const char *method,
const char *mimetype,
const char *body,
const char **sent_user,
const char **sent_pw,
const char **sent_loc,
const char **sent_method,
const char **sent_mimetype,
{
/* sanity check - are we a POST request? */
/* find the username and password in the form */
int res;
char *buffer;
/* have we isolated the user and pw before? */
return OK;
}
return res;
}
}
}
}
*sent_method = buffer;
}
*sent_mimetype = buffer;
}
}
}
/* set the user, even though the user is unauthenticated at this point */
if (*sent_user) {
}
/* a missing username or missing password means auth denied */
return HTTP_UNAUTHORIZED;
}
/*
* save away the username, password, mimetype and method, so that they
* are available should the auth need to be run again.
*/
return OK;
}
/* These functions return 0 if client is OK, and proper error status
* if not... either HTTP_UNAUTHORIZED, if we made a check, and it failed, or
* HTTP_INTERNAL_SERVER_ERROR, if things are so totally confused that we
* couldn't figure out how to tell if the client is authorized or not.
*
* If they return DECLINED, and all other modules also decline, that's
* treated by the server core as a configuration error, logged and
* reported as such.
*/
/**
* Given a username and site passphrase hash from the session, determine
* whether the site passphrase is valid for this session.
*
* If the site passphrase is NULL, or if the sent_hash is NULL, this
* function returns DECLINED.
*
* If the site passphrase hash does not match the sent hash, this function
* returns AUTH_USER_NOT_FOUND.
*
* On success, returns OK.
*/
static int check_site(request_rec * r, const char *site, const char *sent_user, const char *sent_hash)
{
return OK;
}
else {
return AUTH_USER_NOT_FOUND;
}
}
return DECLINED;
}
/**
* Given a username and password (extracted externally from a cookie), run
* the authnz hooks to determine whether this request is authorized.
*
* Return an HTTP code.
*/
{
do {
const authn_provider *provider;
/*
* For now, if a provider isn't set, we'll be nice and use the file
* provider.
*/
if (!current_provider) {
"no authn provider configured");
break;
}
}
else {
}
break;
}
/* Something occured. Stop checking. */
if (auth_result != AUTH_USER_NOT_FOUND) {
break;
}
/* If we're not really configured for providers, stop now. */
break;
}
} while (current_provider);
if (auth_result != AUTH_GRANTED) {
int return_code;
/* If we're not authoritative, then any error is ignored. */
return DECLINED;
}
switch (auth_result) {
case AUTH_DENIED:
"user '%s': authentication failure for \"%s\": "
"password Mismatch",
break;
case AUTH_USER_NOT_FOUND:
break;
case AUTH_GENERAL_ERROR:
default:
/*
* We'll assume that the module has already said what its error
* was in the logs.
*/
break;
}
/* If we're returning 403, tell them to try again. */
if (return_code == HTTP_UNAUTHORIZED) {
}
/* TODO: Flag the user somehow as to the reason for the failure */
return return_code;
}
return OK;
}
/* fake the basic authentication header if configured to do so */
{
if (conf->fakebasicauth) {
}
}
/**
* Must we use form authentication? If so, extract the cookie and run
* the authnz hooks to determine if the login is valid.
*
* If the login is not valid, a 401 Not Authorized will be returned. It
* is up to the webmaster to ensure this screen displays a suitable login
* form to give the user the opportunity to log in.
*/
static int authenticate_form_authn(request_rec * r)
{
const char *current_auth = NULL;
int rv = HTTP_UNAUTHORIZED;
/* Are we configured to be Form auth? */
current_auth = ap_auth_type(r);
return DECLINED;
}
/*
* XSS security warning: using cookies to store private data only works
* when the administrator has full control over the source website. When
* in forward-proxy mode, websites are public by definition, and so can
* never be secure. Abort the auth attempt in this case.
*/
if (PROXYREQ_PROXY == r->proxyreq) {
0, r, LOG_PREFIX "form auth cannot be used for proxy "
"requests due to XSS risk, access denied: %s", r->uri);
return HTTP_INTERNAL_SERVER_ERROR;
}
/* We need an authentication realm. */
if (!ap_auth_name(r)) {
return HTTP_INTERNAL_SERVER_ERROR;
}
r->ap_auth_type = (char *) current_auth;
/* try get the username and password from the notes, if present */
/* otherwise try get the username and password from a session, if present */
}
else {
res = APR_SUCCESS;
}
/* first test whether the site passphrase matches */
return OK;
}
}
/* otherwise test for a normal password match */
return OK;
}
}
/*
* If we reach this point, the request should fail with access denied,
* except for one potential scenario:
*
* If the request is a POST, and the posted form contains user defined fields
* for a username and a password, and the username and password are correct,
* then return the response obtained by a GET to this URL.
*
* If an additional user defined location field is present in the form,
* instead of a GET of the current URL, redirect the browser to the new
* location.
*
* As a further option, if the user defined fields for the type of request,
* the mime type of the body of the request, and the body of the request
* itself are present, replace this request with a new request of the given
* type and with the given body.
*
* Otherwise access is denied.
*
* Reading the body requires some song and dance, because the input filters
* are not yet configured. To work around this problem, we create a
* subrequest and use that to create a sane filter stack we can read the
* form from.
*
* The main request is then capped with a kept_body input filter, which has
* the effect of guaranteeing the input stack can be safely read a second time.
*
*/
/* create a subrequest of our current uri */
/* run the insert_filters hook on the subrequest to ensure a body read can
* be done properly.
*/
/* parse the form by reading the subrequest */
/* make sure any user detected within the subrequest is saved back to
* the main request.
*/
/* we cannot clean up rr at this point, as memory allocated to rr is
* referenced from the main request. It will be cleaned up when the
* main request is cleaned up.
*/
/* insert the kept_body filter on the main request to guarantee the
* input filter stack cannot be read a second time, optionally inject
* a saved body if one was specified in the login form.
*/
if (sent_body && sent_mimetype) {
}
else {
}
/* did the form ask to change the method? if so, switch in the redirect handler
* to relaunch this request as the subrequest with the new method. If the
* form didn't specify a method, the default value GET will force a redirect.
*/
r->handler = FORM_REDIRECT_HANDLER;
}
/* check the authn in the main request, based on the username found */
if (sent_loc) {
return HTTP_MOVED_TEMPORARILY;
}
if (conf->loginsuccess) {
return HTTP_MOVED_TEMPORARILY;
}
}
}
}
/*
* did the admin prefer to be redirected to the login page on failure
* instead?
*/
return HTTP_MOVED_TEMPORARILY;
}
/* did the user ask to be redirected on login success? */
if (sent_loc) {
}
/*
* potential security issue: if we return a login to the browser, we must
* send a no-store to make sure a well behaved browser will not try and
* send the login details a second time if the back button is pressed.
*
* if the user has full control over the backend, the
* AuthCookieDisableNoStore can be used to turn this off.
*/
}
return rv;
}
/**
* Handle a login attempt.
*
* If the login session is either missing or form authnz is unsuccessful, a
* 401 Not Authorized will be returned to the browser. The webmaster
* is expected to insert a login form into the 401 Not Authorized
* error screen.
*
* If the webmaster wishes, they can point the form submission at this
* handler, which will redirect the user to the correct page on success.
* On failure, the 401 Not Authorized error screen will be redisplayed,
* where the login attempt can be repeated.
*
*/
static int authenticate_form_login_handler(request_rec * r)
{
int rv;
return DECLINED;
}
if (r->method_number != M_POST) {
r->uri);
return HTTP_METHOD_NOT_ALLOWED;
}
if (sent_loc) {
return HTTP_MOVED_TEMPORARILY;
}
if (conf->loginsuccess) {
return HTTP_MOVED_TEMPORARILY;
}
return HTTP_OK;
}
}
/* did we prefer to be redirected to the login page on failure instead? */
return HTTP_MOVED_TEMPORARILY;
}
return rv;
}
/**
* Handle a logout attempt.
*
* If an attempt is made to access this URL, any username and password
* embedded in the session is deleted.
*
* This has the effect of logging the person out.
*
* If a logout URI has been specified, this function will create an
* internal redirect to this page.
*/
static int authenticate_form_logout_handler(request_rec * r)
{
return DECLINED;
}
/* remove the username and password, effectively logging the user out */
/*
* make sure the logout page is never cached - otherwise the logout won't
* work!
*/
/* if set, internal redirect to the logout page */
return HTTP_TEMPORARY_REDIRECT;
}
return HTTP_OK;
}
/**
* Handle a redirect attempt.
*
* If during a form login, the method, mimetype and request body are
* specified, this handler will ensure that this request is included
* as an internal redirect.
*
*/
static int authenticate_form_redirect_handler(request_rec * r)
{
return DECLINED;
}
/* get the method and mimetype from the notes */
"internal redirect to method '%s' and body mimetype '%s' for the "
}
else {
"internal redirect requested but one or all of method, mimetype or "
"body are NULL: %s", r->uri);
return HTTP_INTERNAL_SERVER_ERROR;
}
/* return the underlying error, or OK on success */
}
static void register_hooks(apr_pool_t * p)
{
#else
#endif
}
{
create_auth_form_dir_config, /* dir config creater */
merge_auth_form_dir_config, /* dir merger --- default is to override */
NULL, /* server config */
NULL, /* merge server config */
auth_form_cmds, /* command apr_table_t */
register_hooks /* register hooks */
};