proxmox-mirrors/proxmox-backup
1
0
Fork 1
mirror of https://git.proxmox.com/git/proxmox-backup synced 2025-08-09 05:26:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ticket: box TfaChallenge, it's large

Browse Source 
Signed-off-by: Wolfgang Bumiller <w.bumiller@proxmox.com>
This commit is contained in:
Wolfgang Bumiller 2022-07-28 10:23:19 +02:00
parent e1ea913522
commit e589e2b790
3 changed files with 8 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/api2/access/mod.rs
View File

@ -40,7 +40,7 @@ enum AuthResult {
CreateTicket, CreateTicket,
/// A partial ticket which requires a 2nd factor will be created. /// A partial ticket which requires a 2nd factor will be created.
Partial(TfaChallenge), Partial(Box<TfaChallenge>),
} }
fn authenticate_user( fn authenticate_user(
@ -110,7 +110,7 @@ fn authenticate_user(
Ok(match crate::config::tfa::login_challenge(userid)? { Ok(match crate::config::tfa::login_challenge(userid)? {
None => AuthResult::CreateTicket, None => AuthResult::CreateTicket,
Some(challenge) => AuthResult::Partial(challenge), Some(challenge) => AuthResult::Partial(Box::new(challenge)),
}) })
} }
@ -119,7 +119,7 @@ fn authenticate_2nd(
challenge_ticket: &str, challenge_ticket: &str,
response: &str, response: &str,
) -> Result<AuthResult, Error> { ) -> Result<AuthResult, Error> {
let challenge: TfaChallenge = Ticket::<ApiTicket>::parse(challenge_ticket)? let challenge: Box<TfaChallenge> = Ticket::<ApiTicket>::parse(challenge_ticket)?
.verify_with_time_frame(public_auth_key(), "PBS", Some(userid.as_str()), -60..600)? .verify_with_time_frame(public_auth_key(), "PBS", Some(userid.as_str()), -60..600)?
.require_partial()?; .require_partial()?;
@ -205,7 +205,7 @@ pub fn create_ticket(
match authenticate_user(&username, &password, path, privs, port, tfa_challenge) { match authenticate_user(&username, &password, path, privs, port, tfa_challenge) {
Ok(AuthResult::Success) => Ok(json!({ "username": username })), Ok(AuthResult::Success) => Ok(json!({ "username": username })),
Ok(AuthResult::CreateTicket) => { Ok(AuthResult::CreateTicket) => {
let api_ticket = ApiTicket::full(username.clone()); let api_ticket = ApiTicket::Full(username.clone());
let ticket = Ticket::new("PBS", &api_ticket)?.sign(private_auth_key(), None)?; let ticket = Ticket::new("PBS", &api_ticket)?.sign(private_auth_key(), None)?;
let token = assemble_csrf_prevention_token(csrf_secret(), &username); let token = assemble_csrf_prevention_token(csrf_secret(), &username);
@ -218,7 +218,7 @@ pub fn create_ticket(
})) }))
} }
Ok(AuthResult::Partial(challenge)) => { Ok(AuthResult::Partial(challenge)) => {
let api_ticket = ApiTicket::partial(challenge); let api_ticket = ApiTicket::Partial(challenge);
let ticket = Ticket::new("PBS", &api_ticket)? let ticket = Ticket::new("PBS", &api_ticket)?
.sign(private_auth_key(), Some(username.as_str()))?; .sign(private_auth_key(), Some(username.as_str()))?;
Ok(json!({ Ok(json!({

2
src/api2/access/openid.rs
View File

@ -200,7 +200,7 @@ pub fn openid_login(
} }
} }
let api_ticket = ApiTicket::full(user_id.clone()); let api_ticket = ApiTicket::Full(user_id.clone());
let ticket = Ticket::new("PBS", &api_ticket)?.sign(private_auth_key(), None)?; let ticket = Ticket::new("PBS", &api_ticket)?.sign(private_auth_key(), None)?;
let token = assemble_csrf_prevention_token(csrf_secret(), &user_id); let token = assemble_csrf_prevention_token(csrf_secret(), &user_id);

14
src/server/ticket.rs
View File

@ -21,7 +21,7 @@ pub struct PartialTicket {
/// parse the userid ticket content. /// parse the userid ticket content.
pub enum ApiTicket { pub enum ApiTicket {
Full(Userid), Full(Userid),
Partial(tfa::TfaChallenge), Partial(Box<tfa::TfaChallenge>),
} }
impl ApiTicket { impl ApiTicket {
@ -35,22 +35,12 @@ impl ApiTicket {
/// Expect the ticket to contain a tfa challenge, otherwise error with a meaningful error /// Expect the ticket to contain a tfa challenge, otherwise error with a meaningful error
/// message. /// message.
pub fn require_partial(self) -> Result<tfa::TfaChallenge, Error> { pub fn require_partial(self) -> Result<Box<tfa::TfaChallenge>, Error> {
match self { match self {
ApiTicket::Full(_) => bail!("invalid tfa challenge"), ApiTicket::Full(_) => bail!("invalid tfa challenge"),
ApiTicket::Partial(challenge) => Ok(challenge), ApiTicket::Partial(challenge) => Ok(challenge),
} }
} }
/// Create a new full ticket.
pub fn full(userid: Userid) -> Self {
ApiTicket::Full(userid)
}
/// Create a new partial ticket.
pub fn partial(challenge: tfa::TfaChallenge) -> Self {
ApiTicket::Partial(challenge)
}
} }
impl fmt::Display for ApiTicket { impl fmt::Display for ApiTicket {