YunoHost/SSOwat
1
0
Fork 0
mirror of https://github.com/YunoHost/SSOwat.git synced 2024-09-03 20:06:27 +02:00
Code Issues Projects Releases Packages Wiki Activity

parse auth header at the end

Browse source
This commit is contained in:
Kay0u 2020-12-23 15:20:55 +01:00
parent 75cecb9a7a
commit a756462e6c
No known key found for this signature in database
GPG key ID: AAFEEB16CFA2AE2D
2 changed files with 36 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
access.lua
View file

@ -331,12 +331,15 @@ if hlp.has_access(permission) then
return hlp.pass() return hlp.pass()
-- 2nd case : no access ... redirect to portal / login form -- 2nd case : no access ... check Authorization header, redirect to portal / login form
else else
if is_logged_in then if is_logged_in then
return hlp.redirect(conf.portal_url) return hlp.redirect(conf.portal_url)
else else
-- Check if there is `Authorization` header, and redirect if we have successfully logged in
hlp.parse_auth_header()
-- Only display this if HTTPS. For HTTP, we can't know if the user really is -- Only display this if HTTPS. For HTTP, we can't know if the user really is
-- logged in or not, because the cookie is available only in HTTP... -- logged in or not, because the cookie is available only in HTTP...
if ngx.var.scheme == "https" then if ngx.var.scheme == "https" then

55
helpers.lua
View file

@ -260,35 +260,44 @@ function refresh_logged_in()
end end
end end
-- If client set the `Authorization` header before reaching the SSO, return false
-- we want to match user and password against the user database. end
--
-- It allows to bypass the cookie-based procedure with a per-request
-- authentication. This is useful to authenticate on the SSO during
-- curl requests for example.
-- If client set the `Authorization` header before reaching the SSO,
-- we want to match user and password against the user database.
--
-- It allows to bypass the cookie-based procedure with a per-request
-- authentication. This is useful to authenticate on the SSO during
-- curl requests for example.
function parse_auth_header()
local auth_header = ngx.req.get_headers()["Authorization"] local auth_header = ngx.req.get_headers()["Authorization"]
if auth_header then if auth_header then
_, _, b64_cred = string.find(auth_header, "^Basic%s+(.+)$") _, _, b64_cred = string.find(auth_header, "^Basic%s+(.+)$")
if b64_cred == nil then if b64_cred ~= nil then
is_logged_in = false _, _, user, password = string.find(ngx.decode_base64(b64_cred), "^(.+):(.+)$")
return is_logged_in user = authenticate(user, password)
end if user then
_, _, user, password = string.find(ngx.decode_base64(b64_cred), "^(.+):(.+)$") logger.debug("User got authenticated through basic auth")
user = authenticate(user, password) is_logged_in = true
if user then authUser = user
logger.debug("User got authenticated through basic auth")
authUser = user
is_logged_in = true
else
is_logged_in = false
end
return is_logged_in
end
is_logged_in = false if has_access(permission, user) then
return false refresh_user_cache(user)
-- If Basic Authorization header are enable for this permission,
-- add it to the response
if permission["auth_header"] then
set_headers(user)
end
return pass()
else
return redirect(conf.portal_url)
end
end
end
end
end end
function log_access(user, uri) function log_access(user, uri)