X-Git-Url: https://git.enpas.org/?a=blobdiff_plain;f=core%2Fusermanager.lua;h=1aea0de9b86f6c1ad17519023b86cd9e8c20f9cb;hb=aa53318e7ca435fd45038557eb497b6514a6b995;hp=6e4d117ea262c13f6ba9086a71797c55450e7a5d;hpb=2f3a9c1f031f043e3984488f0ec5affa53a2f2f3;p=prosody.git diff --git a/core/usermanager.lua b/core/usermanager.lua index 6e4d117e..1aea0de9 100644 --- a/core/usermanager.lua +++ b/core/usermanager.lua @@ -6,102 +6,58 @@ -- COPYING file in the source package for more information. -- -local datamanager = require "util.datamanager"; +local modulemanager = require "core.modulemanager"; local log = require "util.logger".init("usermanager"); local type = type; -local error = error; local ipairs = ipairs; -local hashes = require "util.hashes"; local jid_bare = require "util.jid".bare; local config = require "core.configmanager"; local hosts = hosts; +local sasl_new = require "util.sasl".new; local prosody = _G.prosody; +local setmetatable = setmetatable; + +local default_provider = "internal_plain"; + module "usermanager" -local new_default_provider; +function new_null_provider() + local function dummy() end; + local function dummy_get_sasl_handler() return sasl_new(nil, {}); end + return setmetatable({name = "null", get_sasl_handler = dummy_get_sasl_handler}, { __index = function() return dummy; end }); +end -prosody.events.add_handler("host-activated", function (host) +function initialize_host(host) local host_session = hosts[host]; - host_session.events.add_handler("item-added/auth-provider", function (provider) - if config.get(host, "core", "authentication") == provider.name then + if host_session.type ~= "local" then return; end + + host_session.events.add_handler("item-added/auth-provider", function (event) + local provider = event.item; + local auth_provider = config.get(host, "core", "authentication") or default_provider; + if provider.name == auth_provider then host_session.users = provider; end + if host_session.users ~= nil and host_session.users.name ~= nil then + log("debug", "host '%s' now set to use user provider '%s'", host, host_session.users.name); + end end); - host_session.events.add_handler("item-removed/auth-provider", function (provider) + host_session.events.add_handler("item-removed/auth-provider", function (event) + local provider = event.item; if host_session.users == provider then - host_session.users = new_default_provider(host); + host_session.users = new_null_provider(); end end); - host_session.users = new_default_provider(host); -- Start with the default usermanager provider -end); - -local function is_cyrus(host) return config.get(host, "core", "sasl_backend") == "cyrus"; end - -function new_default_provider(host) - local provider = {}; - - function provider.test_password(username, password) - if is_cyrus(host) then return nil, "Legacy auth not supported with Cyrus SASL."; end - local credentials = datamanager.load(username, host, "accounts") or {}; - - if password == credentials.password then - return true; - else - return nil, "Auth failed. Invalid username or password."; - end - end - - function provider.get_password(username) - if is_cyrus(host) then return nil, "Passwords unavailable for Cyrus SASL."; end - return (datamanager.load(username, host, "accounts") or {}).password; - end - - function provider.set_password(username, password) - if is_cyrus(host) then return nil, "Passwords unavailable for Cyrus SASL."; end - local account = datamanager.load(username, host, "accounts"); - if account then - account.password = password; - return datamanager.store(username, host, "accounts", account); - end - return nil, "Account not available."; - end - - function provider.user_exists(username) - if is_cyrus(host) then return true; end - return datamanager.load(username, host, "accounts") ~= nil; -- FIXME also check for empty credentials - end - - function provider.create_user(username, password) - if is_cyrus(host) then return nil, "Account creation/modification not available with Cyrus SASL."; end - return datamanager.store(username, host, "accounts", {password = password}); - end - - function provider.get_supported_methods() - return {["PLAIN"] = true, ["DIGEST-MD5"] = true}; -- TODO this should be taken from the config - end - - function provider.is_admin(jid) - host = host or "*"; - local admins = config.get(host, "core", "admins"); - if host ~= "*" and admins == config.get("*", "core", "admins") then - return nil; - end - if type(admins) == "table" then - jid = jid_bare(jid); - for _,admin in ipairs(admins) do - if admin == jid then return true; end - end - elseif admins then - log("warn", "Option 'admins' for host '%s' is not a table", host); - end - return nil; + host_session.users = new_null_provider(); -- Start with the default usermanager provider + local auth_provider = config.get(host, "core", "authentication") or default_provider; + if auth_provider ~= "null" then + modulemanager.load(host, "auth_"..auth_provider); end - return provider; -end +end; +prosody.events.add_handler("host-activated", initialize_host, 100); -function validate_credentials(host, username, password, method) +function test_password(username, host, password) return hosts[host].users.test_password(username, password); end @@ -109,7 +65,7 @@ function get_password(username, host) return hosts[host].users.get_password(username); end -function set_password(username, host, password) +function set_password(username, password, host) return hosts[host].users.set_password(username, password); end @@ -121,12 +77,53 @@ function create_user(username, password, host) return hosts[host].users.create_user(username, password); end -function get_supported_methods(host) - return hosts[host].users.get_supported_methods(); +function get_sasl_handler(host) + return hosts[host].users.get_sasl_handler(); +end + +function get_provider(host) + return hosts[host].users; end function is_admin(jid, host) - return hosts[host].users.is_admin(jid); + local is_admin; + jid = jid_bare(jid); + host = host or "*"; + + local host_admins = config.get(host, "core", "admins"); + local global_admins = config.get("*", "core", "admins"); + + if host_admins and host_admins ~= global_admins then + if type(host_admins) == "table" then + for _,admin in ipairs(host_admins) do + if admin == jid then + is_admin = true; + break; + end + end + elseif host_admins then + log("error", "Option 'admins' for host '%s' is not a list", host); + end + end + + if not is_admin and global_admins then + if type(global_admins) == "table" then + for _,admin in ipairs(global_admins) do + if admin == jid then + is_admin = true; + break; + end + end + elseif global_admins then + log("error", "Global option 'admins' is not a list"); + end + end + + -- Still not an admin, check with auth provider + if not is_admin and host ~= "*" and hosts[host].users and hosts[host].users.is_admin then + is_admin = hosts[host].users.is_admin(jid); + end + return is_admin or false; end return _M;