1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
|
package handlers
import (
"encoding/base64"
"errors"
"net/http"
"strings"
"github.com/authelia/authelia/v4/internal/authentication"
"github.com/authelia/authelia/v4/internal/middlewares"
"github.com/authelia/authelia/v4/internal/regulation"
"github.com/authelia/authelia/v4/internal/session"
"github.com/valyala/fasthttp"
"gopkg.in/jcmturner/goidentity.v3"
"gopkg.in/jcmturner/gokrb5.v7/gssapi"
"gopkg.in/jcmturner/gokrb5.v7/spnego"
)
const (
// spnegoNegTokenRespKRBAcceptCompleted - The response on successful authentication always has this header. Capturing as const so we don't have marshaling and encoding overhead.
spnegoNegTokenRespKRBAcceptCompleted = "Negotiate oRQwEqADCgEAoQsGCSqGSIb3EgECAg=="
// spnegoNegTokenRespReject - The response on a failed authentication always has this rejection header. Capturing as const so we don't have marshaling and encoding overhead.
spnegoNegTokenRespReject = "Negotiate oQcwBaADCgEC"
// spnegoNegTokenRespIncompleteKRB5 - Response token specifying incomplete context and KRB5 as the supported mechtype.
spnegoNegTokenRespIncompleteKRB5 = "Negotiate oRQwEqADCgEBoQsGCSqGSIb3EgECAg=="
)
// spnego.SPNEGOKRB5Authenticate is a Kerberos spnego.SPNEGO authentication HTTP handler wrapper.
func FirstFactorSPNEGO(inner fasthttp.RequestHandler) middlewares.RequestHandler {
return func(ctx *middlewares.AutheliaCtx) {
var (
details *authentication.UserDetails
err error
)
// getting the spnego headers
headerParts := strings.SplitN(string(ctx.Request.Header.Peek(spnego.HTTPHeaderAuthRequest)), " ", 2)
if len(headerParts) != 2 || headerParts[0] != spnego.HTTPHeaderAuthResponseValueKey {
// No Authorization header set so return 401 with WWW-Authenticate Negotiate header
ctx.Response.Header.Set(spnego.HTTPHeaderAuthResponse, spnego.HTTPHeaderAuthResponseValueKey)
ctx.SetStatusCode(fasthttp.StatusBadRequest)
ctx.SetJSONError(messageMFAValidationFailed)
ctx.Logger.WithError(err).Errorf(logFmtErrPasskeyAuthenticationChallengeValidate, errStrReqBodyParse)
doMarkAuthenticationAttempt(ctx, false, regulation.NewBan(regulation.BanTypeNone, "", nil), regulation.AuthTypePasskey, nil)
return
}
bodyJSON := bodyFirstFactorSPNEGOequest{}
if err = ctx.ParseBody(&bodyJSON); err != nil {
ctx.Logger.WithError(err).Errorf(logFmtErrParseRequestBody, regulation.AuthType1FA)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
// we then decode the base64-encoded token
b, err := base64.StdEncoding.DecodeString(headerParts[1])
if err != nil {
ctx.SetStatusCode(fasthttp.StatusBadRequest)
ctx.Logger.WithError(err).Errorf(logFmtErrPasskeyAuthenticationChallengeValidate, errStrReqBodyParse)
doMarkAuthenticationAttempt(ctx, false, regulation.NewBan(regulation.BanTypeNone, "", nil), regulation.AuthTypePasskey, nil)
return
}
// and unmarshal it using the spnego library
var st spnego.SPNEGOToken
err = st.Unmarshal(b)
if err != nil {
ctx.SetStatusCode(fasthttp.StatusBadRequest)
ctx.SetJSONError(messageAuthenticationFailed)
ctx.Logger.WithError(err).Errorf(logFmtErrPasskeyAuthenticationChallengeValidate, errStrReqBodyParse)
doMarkAuthenticationAttempt(ctx, false, regulation.NewBan(regulation.BanTypeNone, "", nil), regulation.AuthTypePasskey, nil)
return
}
SPNEGO, err := ctx.GetSPNEGOProvider()
if err != nil {
ctx.Logger.WithError(err).Errorf(logFmtErrPasskeyAuthenticationChallengeGenerate, "error occurred provisioning the configuration")
ctx.SetStatusCode(fasthttp.StatusForbidden)
ctx.SetJSONError(messageMFAValidationFailed)
doMarkAuthenticationAttempt(ctx, false, regulation.NewBan(regulation.BanTypeNone, "", nil), regulation.AuthTypePasskey, nil)
return
}
// Validate the context token
authed, context, status := SPNEGO.AcceptSecContext(&st)
if status.Code != gssapi.StatusComplete && status.Code != gssapi.StatusContinueNeeded {
ctx.SetStatusCode(fasthttp.StatusForbidden)
ctx.SetJSONError(messageMFAValidationFailed)
return
}
if status.Code == gssapi.StatusContinueNeeded {
ctx.SetStatusCode(fasthttp.StatusForbidden)
ctx.SetJSONError(messageMFAValidationFailed)
return
}
if !authed {
doMarkAuthenticationAttempt(ctx, false, regulation.NewBan(regulation.BanTypeNone, details.Username, nil), regulation.AuthType1FA, nil)
respondUnauthorized(ctx, messageAuthenticationFailed)
}
authContext := context.Value(spnego.CTXKeyCredentials).(goidentity.Identity)
ctx.Response.Header.Set(spnego.HTTPHeaderAuthResponse, spnegoNegTokenRespKRBAcceptCompleted)
username := authContext.UserName()
if details, err = ctx.Providers.UserProvider.GetDetails(username); err != nil {
ctx.Logger.WithError(err).Errorf("Error occurred getting details for user with username input '%s' which usually indicates they do not exist", username)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
if ban, _, expires, err := ctx.Providers.Regulator.BanCheck(ctx, details.Username); err != nil {
if errors.Is(err, regulation.ErrUserIsBanned) {
doMarkAuthenticationAttempt(ctx, false, regulation.NewBan(ban, details.Username, expires), regulation.AuthType1FA, nil)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
ctx.Logger.WithError(err).Errorf(logFmtErrRegulationFail, regulation.AuthType1FA, details.Username)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
doMarkAuthenticationAttempt(ctx, true, regulation.NewBan(regulation.BanTypeNone, details.Username, nil), regulation.AuthType1FA, nil)
var provider *session.Session
if provider, err = ctx.GetSessionProvider(); err != nil {
ctx.Logger.WithError(err).Error("Failed to get session provider during 1FA attempt")
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
if err = provider.DestroySession(ctx.RequestCtx); err != nil {
// This failure is not likely to be critical as we ensure to regenerate the session below.
ctx.Logger.WithError(err).Trace("Failed to destroy session during 1FA attempt")
}
userSession := provider.NewDefaultUserSession()
// Reset all values from previous session except OIDC workflow before regenerating the cookie.
if err = provider.SaveSession(ctx.RequestCtx, userSession); err != nil {
ctx.Logger.WithError(err).Errorf(logFmtErrSessionReset, regulation.AuthType1FA, details.Username)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
if err = provider.RegenerateSession(ctx.RequestCtx); err != nil {
ctx.Logger.WithError(err).Errorf(logFmtErrSessionRegenerate, regulation.AuthType1FA, details.Username)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
ctx.Logger.Tracef(logFmtTraceProfileDetails, details.Username, details.Groups, details.Emails)
userSession.SetOneFactorPassword(ctx.Clock.Now(), details, false)
if ctx.Configuration.AuthenticationBackend.RefreshInterval.Update() {
userSession.RefreshTTL = ctx.Clock.Now().Add(ctx.Configuration.AuthenticationBackend.RefreshInterval.Value())
}
if err = provider.SaveSession(ctx.RequestCtx, userSession); err != nil {
ctx.Logger.WithError(err).Errorf(logFmtErrSessionSave, "updated profile", regulation.AuthType1FA, logFmtActionAuthentication, details.Username)
respondUnauthorized(ctx, messageAuthenticationFailed)
return
}
if bodyJSON.Workflow == workflowOpenIDConnect {
handleOIDCWorkflowResponse(ctx, &userSession, bodyJSON.WorkflowID)
} else {
Handle1FAResponse(ctx, bodyJSON.TargetURL, bodyJSON.RequestMethod, userSession.Username, userSession.Groups)
}
}
}
func SPNEGONegotiateKRB5MechType(s *spnego.SPNEGO, ctx *middlewares.AutheliaCtx, format string, v ...interface{}) {
s.Log(format, v...)
ctx.Response.Header.Set(spnego.HTTPHeaderAuthResponse, spnegoNegTokenRespIncompleteKRB5)
ctx.Response.SetStatusCode(http.StatusUnauthorized)
ctx.Response.SetBodyString(spnego.UnauthorizedMsg)
}
func SPNEGOResponseReject(s *spnego.SPNEGO, ctx *middlewares.AutheliaCtx, format string, v ...interface{}) {
s.Log(format, v...)
ctx.Response.Header.Set(spnego.HTTPHeaderAuthResponse, spnegoNegTokenRespReject)
ctx.Response.SetStatusCode(http.StatusUnauthorized)
ctx.Response.SetBodyString(spnego.UnauthorizedMsg)
}
|
