This repository has been archived on 2023-02-01. You can view files and clone it, but cannot push or open issues or pull requests.
gitea/models/login_source.go

733 lines
20 KiB
Go
Raw Normal View History

// Copyright 2014 The Gogs Authors. All rights reserved.
2014-05-05 09:32:47 +00:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
2014-04-26 06:21:04 +00:00
package models
2014-05-03 02:48:14 +00:00
import (
2014-05-15 18:46:04 +00:00
"crypto/tls"
2014-05-03 02:48:14 +00:00
"encoding/json"
2014-05-05 08:40:25 +00:00
"errors"
2014-05-11 07:49:36 +00:00
"fmt"
"net/smtp"
"net/textproto"
2014-05-11 06:12:45 +00:00
"strings"
2014-05-03 02:48:14 +00:00
"time"
2014-04-26 06:21:04 +00:00
2015-09-11 16:03:08 +00:00
"github.com/Unknwon/com"
"github.com/go-macaron/binding"
2014-05-03 02:48:14 +00:00
"github.com/go-xorm/core"
2014-05-05 08:40:25 +00:00
"github.com/go-xorm/xorm"
2014-05-05 09:32:47 +00:00
"code.gitea.io/gitea/modules/auth/ldap"
"code.gitea.io/gitea/modules/auth/pam"
"code.gitea.io/gitea/modules/log"
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
"code.gitea.io/gitea/modules/auth/oauth2"
2014-05-03 02:48:14 +00:00
)
2014-04-26 06:21:04 +00:00
2016-11-24 11:34:38 +00:00
// LoginType represents an login type.
type LoginType int
2016-08-31 08:22:41 +00:00
// Note: new type must append to the end of list to maintain compatibility.
2014-05-05 08:40:25 +00:00
const (
LoginNoType LoginType = iota
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
LoginPlain // 1
LoginLDAP // 2
LoginSMTP // 3
LoginPAM // 4
LoginDLDAP // 5
LoginOAuth2 // 6
2014-05-05 08:40:25 +00:00
)
2016-11-24 11:34:38 +00:00
// LoginNames contains the name of LoginType values.
2015-09-10 21:11:41 +00:00
var LoginNames = map[LoginType]string{
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
LoginLDAP: "LDAP (via BindDN)",
LoginDLDAP: "LDAP (simple auth)", // Via direct bind
LoginSMTP: "SMTP",
LoginPAM: "PAM",
LoginOAuth2: "OAuth2",
2014-05-05 08:40:25 +00:00
}
2014-04-26 06:21:04 +00:00
2016-11-24 11:34:38 +00:00
// SecurityProtocolNames contains the name of SecurityProtocol values.
var SecurityProtocolNames = map[ldap.SecurityProtocol]string{
2016-11-07 16:38:43 +00:00
ldap.SecurityProtocolUnencrypted: "Unencrypted",
ldap.SecurityProtocolLDAPS: "LDAPS",
2016-11-10 15:16:32 +00:00
ldap.SecurityProtocolStartTLS: "StartTLS",
}
2014-12-07 01:22:48 +00:00
// Ensure structs implemented interface.
2014-05-12 15:02:36 +00:00
var (
_ core.Conversion = &LDAPConfig{}
_ core.Conversion = &SMTPConfig{}
2015-04-23 11:58:57 +00:00
_ core.Conversion = &PAMConfig{}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
_ core.Conversion = &OAuth2Config{}
2014-05-12 15:02:36 +00:00
)
2014-04-26 06:21:04 +00:00
2016-11-24 11:34:38 +00:00
// LDAPConfig holds configuration for LDAP login source.
2014-04-26 06:21:04 +00:00
type LDAPConfig struct {
2015-09-14 19:48:51 +00:00
*ldap.Source
2014-04-26 06:21:04 +00:00
}
2016-11-24 11:34:38 +00:00
// FromDB fills up a LDAPConfig from serialized format.
2014-04-26 06:21:04 +00:00
func (cfg *LDAPConfig) FromDB(bs []byte) error {
2015-09-14 19:48:51 +00:00
return json.Unmarshal(bs, &cfg)
2014-04-26 06:21:04 +00:00
}
2016-11-24 11:34:38 +00:00
// ToDB exports a LDAPConfig to a serialized format.
2014-04-26 06:21:04 +00:00
func (cfg *LDAPConfig) ToDB() ([]byte, error) {
2015-09-14 19:48:51 +00:00
return json.Marshal(cfg)
2014-04-26 06:21:04 +00:00
}
2016-11-24 11:34:38 +00:00
// SecurityProtocolName returns the name of configured security
// protocol.
func (cfg *LDAPConfig) SecurityProtocolName() string {
return SecurityProtocolNames[cfg.SecurityProtocol]
}
2016-11-24 11:34:38 +00:00
// SMTPConfig holds configuration for the SMTP login source.
2014-05-11 07:49:36 +00:00
type SMTPConfig struct {
Auth string
Host string
Port int
AllowedDomains string `xorm:"TEXT"`
TLS bool
SkipVerify bool
2014-05-11 07:49:36 +00:00
}
2016-11-24 11:34:38 +00:00
// FromDB fills up an SMTPConfig from serialized format.
2014-05-11 07:49:36 +00:00
func (cfg *SMTPConfig) FromDB(bs []byte) error {
return json.Unmarshal(bs, cfg)
}
2016-11-24 11:34:38 +00:00
// ToDB exports an SMTPConfig to a serialized format.
2014-05-11 07:49:36 +00:00
func (cfg *SMTPConfig) ToDB() ([]byte, error) {
return json.Marshal(cfg)
}
2016-11-24 11:34:38 +00:00
// PAMConfig holds configuration for the PAM login source.
2015-04-23 11:58:57 +00:00
type PAMConfig struct {
ServiceName string // pam service (e.g. system-auth)
}
2016-11-24 11:34:38 +00:00
// FromDB fills up a PAMConfig from serialized format.
2015-04-23 11:58:57 +00:00
func (cfg *PAMConfig) FromDB(bs []byte) error {
return json.Unmarshal(bs, &cfg)
}
2016-11-24 11:34:38 +00:00
// ToDB exports a PAMConfig to a serialized format.
2015-04-23 11:58:57 +00:00
func (cfg *PAMConfig) ToDB() ([]byte, error) {
return json.Marshal(cfg)
}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
// OAuth2Config holds configuration for the OAuth2 login source.
type OAuth2Config struct {
Provider string
ClientID string
ClientSecret string
}
// FromDB fills up an OAuth2Config from serialized format.
func (cfg *OAuth2Config) FromDB(bs []byte) error {
return json.Unmarshal(bs, cfg)
}
// ToDB exports an SMTPConfig to a serialized format.
func (cfg *OAuth2Config) ToDB() ([]byte, error) {
return json.Marshal(cfg)
}
2016-08-31 08:22:41 +00:00
// LoginSource represents an external way for authorizing users.
2014-04-26 06:21:04 +00:00
type LoginSource struct {
ID int64 `xorm:"pk autoincr"`
Type LoginType
Name string `xorm:"UNIQUE"`
2017-01-06 15:14:33 +00:00
IsActived bool `xorm:"INDEX NOT NULL DEFAULT false"`
Cfg core.Conversion `xorm:"TEXT"`
Created time.Time `xorm:"-"`
2017-01-06 15:14:33 +00:00
CreatedUnix int64 `xorm:"INDEX"`
Updated time.Time `xorm:"-"`
2017-01-06 15:14:33 +00:00
UpdatedUnix int64 `xorm:"INDEX"`
}
2016-11-24 11:34:38 +00:00
// BeforeInsert is invoked from XORM before inserting an object of this type.
func (source *LoginSource) BeforeInsert() {
source.CreatedUnix = time.Now().Unix()
source.UpdatedUnix = source.CreatedUnix
}
2016-11-24 11:34:38 +00:00
// BeforeUpdate is invoked from XORM before updating this object.
func (source *LoginSource) BeforeUpdate() {
source.UpdatedUnix = time.Now().Unix()
2014-05-03 02:48:14 +00:00
}
2016-01-11 06:34:32 +00:00
// Cell2Int64 converts a xorm.Cell type to int64,
// and handles possible irregular cases.
func Cell2Int64(val xorm.Cell) int64 {
switch (*val).(type) {
2016-01-11 07:47:23 +00:00
case []uint8:
log.Trace("Cell2Int64 ([]uint8): %v", *val)
return com.StrTo(string((*val).([]uint8))).MustInt64()
2016-01-11 06:34:32 +00:00
}
return (*val).(int64)
}
2016-11-24 11:34:38 +00:00
// BeforeSet is invoked from XORM before setting the value of a field of this object.
func (source *LoginSource) BeforeSet(colName string, val xorm.Cell) {
switch colName {
case "type":
2016-01-11 06:34:32 +00:00
switch LoginType(Cell2Int64(val)) {
case LoginLDAP, LoginDLDAP:
source.Cfg = new(LDAPConfig)
case LoginSMTP:
source.Cfg = new(SMTPConfig)
case LoginPAM:
source.Cfg = new(PAMConfig)
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
case LoginOAuth2:
source.Cfg = new(OAuth2Config)
2015-09-11 16:03:08 +00:00
default:
panic("unrecognized login source type: " + com.ToStr(*val))
}
}
}
2016-11-24 11:34:38 +00:00
// AfterSet is invoked from XORM after setting the value of a field of this object.
func (source *LoginSource) AfterSet(colName string, _ xorm.Cell) {
switch colName {
case "created_unix":
2016-11-24 11:34:38 +00:00
source.Created = time.Unix(source.CreatedUnix, 0).Local()
case "updated_unix":
2016-11-24 11:34:38 +00:00
source.Updated = time.Unix(source.UpdatedUnix, 0).Local()
}
}
2016-11-24 11:34:38 +00:00
// TypeName return name of this login source type.
2015-09-10 21:11:41 +00:00
func (source *LoginSource) TypeName() string {
return LoginNames[source.Type]
2014-05-05 08:40:25 +00:00
}
2016-11-24 11:34:38 +00:00
// IsLDAP returns true of this source is of the LDAP type.
2015-09-11 16:03:08 +00:00
func (source *LoginSource) IsLDAP() bool {
return source.Type == LoginLDAP
2015-09-11 16:03:08 +00:00
}
2016-11-24 11:34:38 +00:00
// IsDLDAP returns true of this source is of the DLDAP type.
2015-09-11 16:03:08 +00:00
func (source *LoginSource) IsDLDAP() bool {
return source.Type == LoginDLDAP
2015-09-11 16:03:08 +00:00
}
2016-11-24 11:34:38 +00:00
// IsSMTP returns true of this source is of the SMTP type.
2015-09-11 16:03:08 +00:00
func (source *LoginSource) IsSMTP() bool {
return source.Type == LoginSMTP
2015-09-11 16:03:08 +00:00
}
2016-11-24 11:34:38 +00:00
// IsPAM returns true of this source is of the PAM type.
2015-09-11 16:03:08 +00:00
func (source *LoginSource) IsPAM() bool {
return source.Type == LoginPAM
2015-09-11 16:03:08 +00:00
}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
// IsOAuth2 returns true of this source is of the OAuth2 type.
func (source *LoginSource) IsOAuth2() bool {
return source.Type == LoginOAuth2
}
2016-11-24 11:34:38 +00:00
// HasTLS returns true of this source supports TLS.
func (source *LoginSource) HasTLS() bool {
return ((source.IsLDAP() || source.IsDLDAP()) &&
2016-11-07 16:38:43 +00:00
source.LDAP().SecurityProtocol > ldap.SecurityProtocolUnencrypted) ||
source.IsSMTP()
}
2016-11-24 11:34:38 +00:00
// UseTLS returns true of this source is configured to use TLS.
2015-09-11 16:03:08 +00:00
func (source *LoginSource) UseTLS() bool {
switch source.Type {
case LoginLDAP, LoginDLDAP:
2016-11-07 16:38:43 +00:00
return source.LDAP().SecurityProtocol != ldap.SecurityProtocolUnencrypted
case LoginSMTP:
2015-09-11 16:03:08 +00:00
return source.SMTP().TLS
}
return false
}
2016-11-24 11:34:38 +00:00
// SkipVerify returns true if this source is configured to skip SSL
// verification.
2015-09-14 19:48:51 +00:00
func (source *LoginSource) SkipVerify() bool {
switch source.Type {
case LoginLDAP, LoginDLDAP:
2015-09-14 19:48:51 +00:00
return source.LDAP().SkipVerify
case LoginSMTP:
2015-09-14 19:48:51 +00:00
return source.SMTP().SkipVerify
}
return false
}
2016-11-24 11:34:38 +00:00
// LDAP returns LDAPConfig for this source, if of LDAP type.
2014-05-05 08:40:25 +00:00
func (source *LoginSource) LDAP() *LDAPConfig {
return source.Cfg.(*LDAPConfig)
}
2016-11-24 11:34:38 +00:00
// SMTP returns SMTPConfig for this source, if of SMTP type.
2014-05-11 07:49:36 +00:00
func (source *LoginSource) SMTP() *SMTPConfig {
return source.Cfg.(*SMTPConfig)
}
2016-11-24 11:34:38 +00:00
// PAM returns PAMConfig for this source, if of PAM type.
2015-04-23 11:58:57 +00:00
func (source *LoginSource) PAM() *PAMConfig {
return source.Cfg.(*PAMConfig)
}
2016-11-24 11:34:38 +00:00
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
// OAuth2 returns OAuth2Config for this source, if of OAuth2 type.
func (source *LoginSource) OAuth2() *OAuth2Config {
return source.Cfg.(*OAuth2Config)
}
2016-11-24 11:34:38 +00:00
// CreateLoginSource inserts a LoginSource in the DB if not already
// existing with the given name.
func CreateLoginSource(source *LoginSource) error {
has, err := x.Get(&LoginSource{Name: source.Name})
if err != nil {
return err
} else if has {
return ErrLoginSourceAlreadyExist{source.Name}
}
_, err = x.Insert(source)
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
if err == nil && source.IsOAuth2() {
oAuth2Config := source.OAuth2()
oauth2.RegisterProvider(source.Name, oAuth2Config.Provider, oAuth2Config.ClientID, oAuth2Config.ClientSecret)
}
return err
}
2016-11-24 11:34:38 +00:00
// LoginSources returns a slice of all login sources found in DB.
func LoginSources() ([]*LoginSource, error) {
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
auths := make([]*LoginSource, 0, 6)
return auths, x.Find(&auths)
2014-05-03 02:48:14 +00:00
}
2015-12-05 22:13:13 +00:00
// GetLoginSourceByID returns login source by given ID.
func GetLoginSourceByID(id int64) (*LoginSource, error) {
2014-05-05 08:40:25 +00:00
source := new(LoginSource)
2014-06-21 04:51:41 +00:00
has, err := x.Id(id).Get(source)
2014-05-05 08:40:25 +00:00
if err != nil {
return nil, err
} else if !has {
return nil, ErrLoginSourceNotExist{id}
2014-05-05 08:40:25 +00:00
}
return source, nil
}
2016-11-24 11:34:38 +00:00
// UpdateSource updates a LoginSource record in DB.
2014-05-11 10:10:37 +00:00
func UpdateSource(source *LoginSource) error {
_, err := x.Id(source.ID).AllCols().Update(source)
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
if err == nil && source.IsOAuth2() {
oAuth2Config := source.OAuth2()
oauth2.RemoveProvider(source.Name)
oauth2.RegisterProvider(source.Name, oAuth2Config.Provider, oAuth2Config.ClientID, oAuth2Config.ClientSecret)
}
2014-05-03 02:48:14 +00:00
return err
}
2016-11-24 11:34:38 +00:00
// DeleteSource deletes a LoginSource record in DB.
2015-09-11 16:03:08 +00:00
func DeleteSource(source *LoginSource) error {
count, err := x.Count(&User{LoginSource: source.ID})
2014-05-05 08:40:25 +00:00
if err != nil {
return err
2015-09-11 16:03:08 +00:00
} else if count > 0 {
2016-08-31 08:22:41 +00:00
return ErrLoginSourceInUse{source.ID}
2014-05-05 08:40:25 +00:00
}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
count, err = x.Count(&ExternalLoginUser{LoginSourceID: source.ID})
if err != nil {
return err
} else if count > 0 {
return ErrLoginSourceInUse{source.ID}
}
if source.IsOAuth2() {
oauth2.RemoveProvider(source.Name)
}
2015-09-11 16:03:08 +00:00
_, err = x.Id(source.ID).Delete(new(LoginSource))
2014-05-03 02:48:14 +00:00
return err
2014-04-26 06:21:04 +00:00
}
2014-05-11 06:12:45 +00:00
2016-08-31 08:22:41 +00:00
// CountLoginSources returns number of login sources.
func CountLoginSources() int64 {
count, _ := x.Count(new(LoginSource))
return count
}
// .____ ________ _____ __________
// | | \______ \ / _ \\______ \
// | | | | \ / /_\ \| ___/
// | |___ | ` \/ | \ |
// |_______ \/_______ /\____|__ /____|
// \/ \/ \/
2014-05-11 06:12:45 +00:00
2016-08-31 08:22:41 +00:00
func composeFullName(firstname, surname, username string) string {
switch {
case len(firstname) == 0 && len(surname) == 0:
return username
case len(firstname) == 0:
return surname
case len(surname) == 0:
return firstname
default:
return firstname + " " + surname
}
}
// LoginViaLDAP queries if login/password is valid against the LDAP directory pool,
2015-11-21 17:58:31 +00:00
// and create a local user if success when enabled.
2016-11-21 19:08:21 +00:00
func LoginViaLDAP(user *User, login, password string, source *LoginSource, autoRegister bool) (*User, error) {
username, fn, sn, mail, isAdmin, succeed := source.Cfg.(*LDAPConfig).SearchEntry(login, password, source.Type == LoginDLDAP)
2016-08-31 08:22:41 +00:00
if !succeed {
2014-12-05 23:08:09 +00:00
// User not in LDAP, do nothing
return nil, ErrUserNotExist{0, login, 0}
2014-05-11 06:12:45 +00:00
}
2014-05-11 06:12:45 +00:00
if !autoRegister {
2016-08-31 08:22:41 +00:00
return user, nil
2014-05-11 06:12:45 +00:00
}
2014-12-05 23:08:09 +00:00
// Fallback.
if len(username) == 0 {
2016-08-31 08:22:41 +00:00
username = login
}
// Validate username make sure it satisfies requirement.
2016-07-21 06:15:04 +00:00
if binding.AlphaDashDotPattern.MatchString(username) {
return nil, fmt.Errorf("Invalid pattern for attribute 'username' [%s]: must be valid alpha or numeric or dash(-_) or dot characters", username)
}
2014-12-05 23:08:09 +00:00
if len(mail) == 0 {
mail = fmt.Sprintf("%s@localhost", username)
2014-12-05 23:08:09 +00:00
}
2016-08-31 08:22:41 +00:00
user = &User{
LowerName: strings.ToLower(username),
Name: username,
FullName: composeFullName(fn, sn, username),
2016-08-31 08:22:41 +00:00
Email: mail,
2015-09-05 03:39:23 +00:00
LoginType: source.Type,
LoginSource: source.ID,
2016-08-31 08:22:41 +00:00
LoginName: login,
2014-12-05 23:08:09 +00:00
IsActive: true,
2016-08-31 08:22:41 +00:00
IsAdmin: isAdmin,
2014-05-11 06:12:45 +00:00
}
2016-08-31 08:22:41 +00:00
return user, CreateUser(user)
}
// _________ __________________________
// / _____/ / \__ ___/\______ \
// \_____ \ / \ / \| | | ___/
// / \/ Y \ | | |
// /_______ /\____|__ /____| |____|
// \/ \/
2016-08-31 08:22:41 +00:00
type smtpLoginAuth struct {
2014-05-11 07:49:36 +00:00
username, password string
}
2016-08-31 08:22:41 +00:00
func (auth *smtpLoginAuth) Start(server *smtp.ServerInfo) (string, []byte, error) {
return "LOGIN", []byte(auth.username), nil
2014-05-11 07:49:36 +00:00
}
2016-08-31 08:22:41 +00:00
func (auth *smtpLoginAuth) Next(fromServer []byte, more bool) ([]byte, error) {
2014-05-11 07:49:36 +00:00
if more {
switch string(fromServer) {
case "Username:":
2016-08-31 08:22:41 +00:00
return []byte(auth.username), nil
2014-05-11 07:49:36 +00:00
case "Password:":
2016-08-31 08:22:41 +00:00
return []byte(auth.password), nil
2014-05-11 07:49:36 +00:00
}
}
return nil, nil
}
2016-11-24 11:34:38 +00:00
// SMTP authentication type names.
const (
SMTPPlain = "PLAIN"
SMTPLogin = "LOGIN"
2014-05-11 07:49:36 +00:00
)
2016-11-24 11:34:38 +00:00
// SMTPAuths contains available SMTP authentication type names.
var SMTPAuths = []string{SMTPPlain, SMTPLogin}
2016-11-24 11:34:38 +00:00
// SMTPAuth performs an SMTP authentication.
func SMTPAuth(a smtp.Auth, cfg *SMTPConfig) error {
c, err := smtp.Dial(fmt.Sprintf("%s:%d", cfg.Host, cfg.Port))
2014-05-11 07:49:36 +00:00
if err != nil {
return err
}
defer c.Close()
2014-05-15 18:46:04 +00:00
if err = c.Hello("gogs"); err != nil {
return err
}
if cfg.TLS {
2014-05-11 12:04:28 +00:00
if ok, _ := c.Extension("STARTTLS"); ok {
if err = c.StartTLS(&tls.Config{
InsecureSkipVerify: cfg.SkipVerify,
ServerName: cfg.Host,
}); err != nil {
2014-05-11 12:04:28 +00:00
return err
}
} else {
2014-05-16 03:03:26 +00:00
return errors.New("SMTP server unsupports TLS")
2014-05-11 07:49:36 +00:00
}
}
if ok, _ := c.Extension("AUTH"); ok {
if err = c.Auth(a); err != nil {
return err
}
return nil
}
return ErrUnsupportedLoginType
2014-05-11 07:49:36 +00:00
}
2016-08-31 08:22:41 +00:00
// LoginViaSMTP queries if login/password is valid against the SMTP,
// and create a local user if success when enabled.
func LoginViaSMTP(user *User, login, password string, sourceID int64, cfg *SMTPConfig, autoRegister bool) (*User, error) {
// Verify allowed domains.
if len(cfg.AllowedDomains) > 0 {
2016-08-31 08:22:41 +00:00
idx := strings.Index(login, "@")
if idx == -1 {
return nil, ErrUserNotExist{0, login, 0}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
} else if !com.IsSliceContainsStr(strings.Split(cfg.AllowedDomains, ","), login[idx + 1:]) {
return nil, ErrUserNotExist{0, login, 0}
}
}
2014-05-11 07:49:36 +00:00
var auth smtp.Auth
if cfg.Auth == SMTPPlain {
2016-08-31 08:22:41 +00:00
auth = smtp.PlainAuth("", login, password, cfg.Host)
} else if cfg.Auth == SMTPLogin {
2016-08-31 08:22:41 +00:00
auth = &smtpLoginAuth{login, password}
2014-05-11 12:04:28 +00:00
} else {
2014-05-15 18:46:04 +00:00
return nil, errors.New("Unsupported SMTP auth type")
2014-05-11 07:49:36 +00:00
}
if err := SMTPAuth(auth, cfg); err != nil {
// Check standard error format first,
// then fallback to worse case.
tperr, ok := err.(*textproto.Error)
if (ok && tperr.Code == 535) ||
strings.Contains(err.Error(), "Username and Password not accepted") {
return nil, ErrUserNotExist{0, login, 0}
2014-05-15 18:46:04 +00:00
}
2014-05-11 07:49:36 +00:00
return nil, err
}
if !autoRegister {
2016-08-31 08:22:41 +00:00
return user, nil
2014-05-11 07:49:36 +00:00
}
2016-08-31 08:22:41 +00:00
username := login
idx := strings.Index(login, "@")
2014-05-11 12:04:28 +00:00
if idx > -1 {
2016-08-31 08:22:41 +00:00
username = login[:idx]
2014-05-11 12:04:28 +00:00
}
2016-08-31 08:22:41 +00:00
user = &User{
LowerName: strings.ToLower(username),
Name: strings.ToLower(username),
Email: login,
Passwd: password,
LoginType: LoginSMTP,
LoginSource: sourceID,
2016-08-31 08:22:41 +00:00
LoginName: login,
2014-05-11 07:49:36 +00:00
IsActive: true,
}
2016-08-31 08:22:41 +00:00
return user, CreateUser(user)
2014-05-11 07:49:36 +00:00
}
2015-04-23 11:58:57 +00:00
// __________ _____ _____
// \______ \/ _ \ / \
// | ___/ /_\ \ / \ / \
// | | / | \/ Y \
// |____| \____|__ /\____|__ /
// \/ \/
2016-08-31 08:22:41 +00:00
// LoginViaPAM queries if login/password is valid against the PAM,
// and create a local user if success when enabled.
func LoginViaPAM(user *User, login, password string, sourceID int64, cfg *PAMConfig, autoRegister bool) (*User, error) {
2016-11-27 06:03:59 +00:00
if err := pam.Auth(cfg.ServiceName, login, password); err != nil {
2015-04-23 11:58:57 +00:00
if strings.Contains(err.Error(), "Authentication failure") {
return nil, ErrUserNotExist{0, login, 0}
2015-04-23 11:58:57 +00:00
}
return nil, err
}
if !autoRegister {
2016-08-31 08:22:41 +00:00
return user, nil
2015-04-23 11:58:57 +00:00
}
2016-08-31 08:22:41 +00:00
user = &User{
LowerName: strings.ToLower(login),
Name: login,
Email: login,
Passwd: password,
LoginType: LoginPAM,
LoginSource: sourceID,
2016-08-31 08:22:41 +00:00
LoginName: login,
2015-04-23 11:58:57 +00:00
IsActive: true,
}
2016-08-31 08:22:41 +00:00
return user, CreateUser(user)
2015-04-23 11:58:57 +00:00
}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
// ________ _____ __ .__ ________
// \_____ \ / _ \ __ ___/ |_| |__ \_____ \
// / | \ / /_\ \| | \ __\ | \ / ____/
// / | \/ | \ | /| | | Y \/ \
// \_______ /\____|__ /____/ |__| |___| /\_______ \
// \/ \/ \/ \/
// OAuth2Provider describes the display values of a single OAuth2 provider
type OAuth2Provider struct {
Name string
DisplayName string
Image string
}
// OAuth2Providers contains the map of registered OAuth2 providers in Gitea (based on goth)
// key is used to map the OAuth2Provider with the goth provider type (also in LoginSource.OAuth2Config.Provider)
// value is used to store display data
var OAuth2Providers = map[string]OAuth2Provider{
"github": {Name: "github", DisplayName:"GitHub", Image: "/img/github.png"},
}
2016-11-24 11:34:38 +00:00
// ExternalUserLogin attempts a login using external source types.
2016-08-31 08:22:41 +00:00
func ExternalUserLogin(user *User, login, password string, source *LoginSource, autoRegister bool) (*User, error) {
if !source.IsActived {
return nil, ErrLoginSourceNotActived
}
switch source.Type {
case LoginLDAP, LoginDLDAP:
2016-08-31 08:22:41 +00:00
return LoginViaLDAP(user, login, password, source, autoRegister)
case LoginSMTP:
2016-08-31 08:22:41 +00:00
return LoginViaSMTP(user, login, password, source.ID, source.Cfg.(*SMTPConfig), autoRegister)
case LoginPAM:
2016-08-31 08:22:41 +00:00
return LoginViaPAM(user, login, password, source.ID, source.Cfg.(*PAMConfig), autoRegister)
}
return nil, ErrUnsupportedLoginType
}
// UserSignIn validates user name and password.
2016-11-21 19:08:21 +00:00
func UserSignIn(username, password string) (*User, error) {
2016-08-31 08:22:41 +00:00
var user *User
if strings.Contains(username, "@") {
user = &User{Email: strings.ToLower(strings.TrimSpace(username))}
} else {
user = &User{LowerName: strings.ToLower(strings.TrimSpace(username))}
}
2016-08-31 08:22:41 +00:00
hasUser, err := x.Get(user)
if err != nil {
return nil, err
}
2016-08-31 08:22:41 +00:00
if hasUser {
switch user.LoginType {
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
case LoginNoType, LoginPlain, LoginOAuth2:
2016-11-21 19:08:21 +00:00
if user.ValidatePassword(password) {
2016-08-31 08:22:41 +00:00
return user, nil
}
return nil, ErrUserNotExist{user.ID, user.Name, 0}
default:
var source LoginSource
2016-08-31 08:22:41 +00:00
hasSource, err := x.Id(user.LoginSource).Get(&source)
if err != nil {
return nil, err
} else if !hasSource {
2016-08-31 08:22:41 +00:00
return nil, ErrLoginSourceNotExist{user.LoginSource}
}
2016-11-21 19:08:21 +00:00
return ExternalUserLogin(user, user.LoginName, password, &source, false)
}
}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
sources := make([]*LoginSource, 0, 5)
if err = x.UseBool().Find(&sources, &LoginSource{IsActived: true}); err != nil {
return nil, err
}
for _, source := range sources {
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
if source.IsOAuth2() {
// don't try to authenticate against OAuth2 sources
continue
}
2016-11-21 19:08:21 +00:00
authUser, err := ExternalUserLogin(nil, username, password, source, true)
if err == nil {
2016-08-31 08:22:41 +00:00
return authUser, nil
}
2016-08-31 08:22:41 +00:00
log.Warn("Failed to login '%s' via '%s': %v", username, source.Name, err)
}
return nil, ErrUserNotExist{user.ID, user.Name, 0}
}
Oauth2 consumer (#679) * initial stuff for oauth2 login, fails on: * login button on the signIn page to start the OAuth2 flow and a callback for each provider Only GitHub is implemented for now * show login button only when the OAuth2 consumer is configured (and activated) * create macaron group for oauth2 urls * prevent net/http in modules (other then oauth2) * use a new data sessions oauth2 folder for storing the oauth2 session data * add missing 2FA when this is enabled on the user * add password option for OAuth2 user , for use with git over http and login to the GUI * add tip for registering a GitHub OAuth application * at startup of Gitea register all configured providers and also on adding/deleting of new providers * custom handling of errors in oauth2 request init + show better tip * add ExternalLoginUser model and migration script to add it to database * link a external account to an existing account (still need to handle wrong login and signup) and remove if user is removed * remove the linked external account from the user his settings * if user is unknown we allow him to register a new account or link it to some existing account * sign up with button on signin page (als change OAuth2Provider structure so we can store basic stuff about providers) * from gorilla/sessions docs: "Important Note: If you aren't using gorilla/mux, you need to wrap your handlers with context.ClearHandler as or else you will leak memory!" (we're using gorilla/sessions for storing oauth2 sessions) * use updated goth lib that now supports getting the OAuth2 user if the AccessToken is still valid instead of re-authenticating (prevent flooding the OAuth2 provider)
2017-02-22 07:14:37 +00:00
// GetActiveOAuth2ProviderLoginSources returns all actived LoginOAuth2 sources
func GetActiveOAuth2ProviderLoginSources() ([]*LoginSource, error) {
sources := make([]*LoginSource, 0, 1)
if err := x.UseBool().Find(&sources, &LoginSource{IsActived: true, Type: LoginOAuth2}); err != nil {
return nil, err
}
return sources, nil
}
// GetActiveOAuth2LoginSourceByName returns a OAuth2 LoginSource based on the given name
func GetActiveOAuth2LoginSourceByName(name string) (*LoginSource, error) {
loginSource := &LoginSource{
Name: name,
Type: LoginOAuth2,
IsActived: true,
}
has, err := x.UseBool().Get(loginSource)
if !has || err != nil {
return nil, err
}
return loginSource, nil
}
// GetActiveOAuth2Providers returns the map of configured active OAuth2 providers
// key is used as technical name (like in the callbackURL)
// values to display
func GetActiveOAuth2Providers() (map[string]OAuth2Provider, error) {
// Maybe also seperate used and unused providers so we can force the registration of only 1 active provider for each type
loginSources, err := GetActiveOAuth2ProviderLoginSources()
if err != nil {
return nil, err
}
providers := make(map[string]OAuth2Provider)
for _, source := range loginSources {
providers[source.Name] = OAuth2Providers[source.OAuth2().Provider]
}
return providers, nil
}
// InitOAuth2 initialize the OAuth2 lib and register all active OAuth2 providers in the library
func InitOAuth2() {
oauth2.Init()
loginSources, _ := GetActiveOAuth2ProviderLoginSources()
for _, source := range loginSources {
oAuth2Config := source.OAuth2()
oauth2.RegisterProvider(source.Name, oAuth2Config.Provider, oAuth2Config.ClientID, oAuth2Config.ClientSecret)
}
}