teach/adlin
Archived
0
0
Fork 0
Code Issues 1 Pull Requests 4 Releases Activity

token-handler: handle authorization through Epita CRI LDAP

Browse Source
This commit is contained in:
nemunaire 2019-03-13 11:19:51 +01:00
parent 58e541d6ad
commit 38902bee8d
6 changed files with 194 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
token-validator/auth.go Normal file
View File

@ -0,0 +1,77 @@
package main
import (
"encoding/json"
"errors"
"fmt"
"net/http"
"github.com/julienschmidt/httprouter"
)
func init() {
router.GET("/auth", authHandler(apiHandler(validateAuthToken, printStudent)))
router.POST("/auth", apiHandler(checkAuth))
}
func printStudent(std *Student, r *http.Request) error {
if std != nil {
return errors.New(fmt.Sprintf("%s", *std))
} else {
return nil
}
}
func validateAuthToken(_ httprouter.Params, _ []byte) (interface{}, error) {
return false, nil
}
type loginForm struct {
Username string
Password string
}
func checkAuth(_ httprouter.Params, body []byte) (interface{}, error) {
var lf loginForm
if err := json.Unmarshal(body, &lf); err != nil {
return nil, err
}
if r, err := http.NewRequest("GET", "https://owncloud.srs.epita.fr/remote.php/webdav/", nil); err != nil {
return nil, err
} else {
r.SetBasicAuth(lf.Username, lf.Password)
if resp, err := http.DefaultClient.Do(r); err != nil {
return nil, err
} else {
defer resp.Body.Close()
if resp.StatusCode == http.StatusOK {
var std Student
if !studentExists(lf.Username) {
if std, err = NewStudent(lf.Username); err != nil {
return nil, err
}
} else if std, err = getStudentByLogin(lf.Username); err != nil {
return nil, err
}
session, err := std.NewSession()
if err != nil {
return nil, err
}
res := map[string]interface{}{}
res["status"] = "OK"
res["id_session"] = session.Id
return res, nil
} else {
return nil, errors.New(`{"status": "Invalid username or password"}`)
}
}
return nil, nil
}
}

10
token-validator/db.go
View File

@ -102,6 +102,16 @@ CREATE TABLE IF NOT EXISTS student_pong(
time TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY(id_student) REFERENCES students(id_student)
) DEFAULT CHARACTER SET = utf8 COLLATE = utf8_bin;
`); err != nil {
return err
}
if _, err := db.Exec(`
CREATE TABLE IF NOT EXISTS student_sessions(
id_session BLOB(255) NOT NULL,
id_student INTEGER NOT NULL,
time TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
FOREIGN KEY(id_student) REFERENCES students(id_student)
) DEFAULT CHARACTER SET = utf8 COLLATE = utf8_bin;
`); err != nil {
return err
}

35
token-validator/handler.go
View File

@ -10,6 +10,7 @@ import (
"log"
"net/http"
"strconv"
"strings"
"time"
"github.com/julienschmidt/httprouter"
@ -38,6 +39,20 @@ func remoteValidatorHandler(f func(http.ResponseWriter, *http.Request, httproute
}
}
func authHandler(f func(http.ResponseWriter, *http.Request, httprouter.Params)) func(http.ResponseWriter, *http.Request, httprouter.Params) {
return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
if flds := strings.Fields(r.Header.Get("Authorization")); len(flds) != 2 || flds[0] != "Bearer" {
http.Error(w, `{"errmsg": "Authorization required"}`, http.StatusUnauthorized)
} else if sessionid, err := base64.StdEncoding.DecodeString(flds[1]); err != nil {
http.Error(w, fmt.Sprintf(`{"errmsg": %q}`, err), http.StatusNotAcceptable)
} else if _, err := getSession(sessionid); err != nil {
http.Error(w, fmt.Sprintf(`{"errmsg": %q}`, err), http.StatusUnauthorized)
} else {
f(w, r, ps)
}
}
}
func rawHandler(f func(*http.Request, httprouter.Params, []byte) (interface{}, error), access ...func(*Student, *http.Request) error) func(http.ResponseWriter, *http.Request, httprouter.Params) {
return func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {
if addr := r.Header.Get("X-Forwarded-For"); addr != "" {
@ -50,10 +65,26 @@ func rawHandler(f func(*http.Request, httprouter.Params, []byte) (interface{}, e
var ret interface{}
var err error = nil
// Read Authorization header
var student *Student = nil
if flds := strings.Fields(r.Header.Get("Authorization")); len(flds) == 2 && flds[0] == "Bearer" {
if sessionid, err := base64.StdEncoding.DecodeString(flds[1]); err != nil {
http.Error(w, fmt.Sprintf(`{"errmsg": %q}`, err), http.StatusNotAcceptable)
} else if session, err := getSession(sessionid); err != nil {
http.Error(w, fmt.Sprintf(`{"errmsg": %q}`, err), http.StatusUnauthorized)
return
} else if std, err := getStudent(int(session.IdStudent)); err != nil {
http.Error(w, fmt.Sprintf(`{"errmsg": %q}`, err), http.StatusUnauthorized)
return
} else {
student = &std
}
}
// Check access limitation
for _, a := range access {
if err := a(nil, r); err != nil {
http.Error(w, fmt.Sprintf("{errmsg:\"You're not allowed to access this page this way!\"}", err), http.StatusForbidden)
if err := a(student, r); err != nil {
http.Error(w, fmt.Sprintf(`{"errmsg":%q}`, err), http.StatusForbidden)
return
}
}

6
token-validator/ip.go
View File

@ -28,7 +28,11 @@ func showIPs(_ httprouter.Params, body []byte) (interface{}, error) {
r[sid] = make(map[string]string)
r[sid]["mac"] = std.MAC
if std.MAC == nil {
continue
}
r[sid]["mac"] = *std.MAC
r[sid]["vlan0"] = fmt.Sprintf("172.23.0.%d", std.IPSuffix())
r[sid]["vlan7"] = fmt.Sprintf("172.23.142.%d", std.IPSuffix())
}

58
token-validator/session.go Normal file
View File

@ -0,0 +1,58 @@
package main
import (
"crypto/rand"
"time"
)
type Session struct {
Id []byte `json:"id"`
IdStudent int64 `json:"login"`
Time time.Time `json:"time"`
}
func getSession(id []byte) (s Session, err error) {
err = DBQueryRow("SELECT id_session, id_student, time FROM student_sessions WHERE id_session=?", id).Scan(&s.Id, &s.IdStudent, &s.Time)
return
}
func (student Student) NewSession() (Session, error) {
session_id := make([]byte, 255)
if _, err := rand.Read(session_id); err != nil {
return Session{}, err
} else if _, err := DBExec("INSERT INTO student_sessions (id_session, id_student, time) VALUES (?, ?, ?)", session_id, student.Id, time.Now()); err != nil {
return Session{}, err
} else {
return Session{session_id, student.Id, time.Now()}, nil
}
}
func (s Session) Update() (int64, error) {
if res, err := DBExec("UPDATE student_sessions SET id_student = ?, time = ? WHERE id_session = ?", s.IdStudent, s.Time, s.Id); err != nil {
return 0, err
} else if nb, err := res.RowsAffected(); err != nil {
return 0, err
} else {
return nb, err
}
}
func (s Session) Delete() (int64, error) {
if res, err := DBExec("DELETE FROM student_sessions WHERE id_session = ?", s.Id); err != nil {
return 0, err
} else if nb, err := res.RowsAffected(); err != nil {
return 0, err
} else {
return nb, err
}
}
func ClearSession() (int64, error) {
if res, err := DBExec("DELETE FROM student_sessions"); err != nil {
return 0, err
} else if nb, err := res.RowsAffected(); err != nil {
return 0, err
} else {
return nb, err
}
}

20
token-validator/students.go
View File

@ -59,11 +59,11 @@ func init() {
}
type Student struct {
Id int64 `json:"id"`
Login string `json:"login"`
Time time.Time `json:"time"`
IP string `json:"ip"`
MAC string `json:"mac"`
Id int64 `json:"id"`
Login string `json:"login"`
Time *time.Time `json:"time"`
IP *string `json:"ip"`
MAC *string `json:"mac"`
}
type uploadedStudent struct {
@ -106,16 +106,17 @@ func getStudentByLogin(login string) (s Student, err error) {
func studentExists(login string) bool {
var z int
err := DBQueryRow("SELECT 1 FROM students WHERE login=?", login).Scan(&z)
return err != nil && z == 1
return err == nil && z == 1
}
func NewStudent(login string) (Student, error) {
if res, err := DBExec("INSERT INTO students (login, time) VALUES (?, ?)", login, time.Now()); err != nil {
t := time.Now()
if res, err := DBExec("INSERT INTO students (login, time) VALUES (?, ?)", login, t); err != nil {
return Student{}, err
} else if sid, err := res.LastInsertId(); err != nil {
return Student{}, err
} else {
return Student{sid, login, time.Now(), "", ""}, nil
return Student{sid, login, &t, nil, nil}, nil
}
}
@ -168,7 +169,8 @@ func createStudent(_ httprouter.Params, body []byte) (interface{}, error) {
}
exist.registerAccess(std.IP, std.MAC)
exist.IP = fmt.Sprintf("172.23.0.%d", exist.IPSuffix())
ip := fmt.Sprintf("172.23.0.%d", exist.IPSuffix())
exist.IP = &ip
return exist, nil
}