package yubikey import ( "net/http" "strings" "github.com/GeertJohan/yubigo" "github.com/gorilla/sessions" yaml "gopkg.in/yaml.v3" "github.com/Luzifer/go_helpers/v2/str" "github.com/Luzifer/nginx-sso/plugins" ) type AuthYubikey struct { ClientID string `yaml:"client_id"` SecretKey string `yaml:"secret_key"` Devices map[string]string `yaml:"devices"` Groups map[string][]string `yaml:"groups"` cookie plugins.CookieConfig cookieStore *sessions.CookieStore } func New(cs *sessions.CookieStore) *AuthYubikey { return &AuthYubikey{ cookieStore: cs, } } // AuthenticatorID needs to return an unique string to identify // this special authenticator func (a AuthYubikey) AuthenticatorID() string { return "yubikey" } // Configure loads the configuration for the Authenticator from the // global config.yaml file which is passed as a byte-slice. // If no configuration for the Authenticator is supplied the function // needs to return the plugins.ErrProviderUnconfigured func (a *AuthYubikey) Configure(yamlSource []byte) error { envelope := struct { Cookie plugins.CookieConfig `yaml:"cookie"` Providers struct { Yubikey *AuthYubikey `yaml:"yubikey"` } `yaml:"providers"` }{} envelope.Cookie = plugins.DefaultCookieConfig() if err := yaml.Unmarshal(yamlSource, &envelope); err != nil { return err } if envelope.Providers.Yubikey == nil { return plugins.ErrProviderUnconfigured } a.ClientID = envelope.Providers.Yubikey.ClientID a.SecretKey = envelope.Providers.Yubikey.SecretKey a.Devices = envelope.Providers.Yubikey.Devices a.Groups = envelope.Providers.Yubikey.Groups a.cookie = envelope.Cookie return nil } // DetectUser is used to detect a user without a login form from // a cookie, header or other methods // If no user was detected the plugins.ErrNoValidUserFound needs to be // returned func (a AuthYubikey) DetectUser(res http.ResponseWriter, r *http.Request) (string, []string, error) { sess, err := a.cookieStore.Get(r, strings.Join([]string{a.cookie.Prefix, a.AuthenticatorID()}, "-")) if err != nil { return "", nil, plugins.ErrNoValidUserFound } user, ok := sess.Values["user"].(string) if !ok { return "", nil, plugins.ErrNoValidUserFound } // We had a cookie, lets renew it sess.Options = a.cookie.GetSessionOpts() if err := sess.Save(r, res); err != nil { return "", nil, err } groups := []string{} for group, users := range a.Groups { if str.StringInSlice(user, users) { groups = append(groups, group) } } return user, groups, nil } // Login is called when the user submits the login form and needs // to authenticate the user or throw an error. If the user has // successfully logged in the persistent cookie should be written // in order to use DetectUser for the next login. // If the user did not login correctly the plugins.ErrNoValidUserFound // needs to be returned func (a AuthYubikey) Login(res http.ResponseWriter, r *http.Request) (string, []plugins.MFAConfig, error) { keyInput := r.FormValue(strings.Join([]string{a.AuthenticatorID(), "key-input"}, "-")) yubiAuth, err := yubigo.NewYubiAuth(a.ClientID, a.SecretKey) if err != nil { return "", nil, err } _, ok, err := yubiAuth.Verify(keyInput) if err != nil && !strings.Contains(err.Error(), "OTP has wrong length.") { return "", nil, err } if !ok { // Not a valid authentication return "", nil, plugins.ErrNoValidUserFound } user, ok := a.Devices[keyInput[:12]] if !ok { // We do not have a definition for that key return "", nil, plugins.ErrNoValidUserFound } sess, _ := a.cookieStore.Get(r, strings.Join([]string{a.cookie.Prefix, a.AuthenticatorID()}, "-")) // #nosec G104 - On error empty session is returned sess.Options = a.cookie.GetSessionOpts() sess.Values["user"] = user return user, nil, sess.Save(r, res) } // LoginFields needs to return the fields required for this login // method. If no login using this method is possible the function // needs to return nil. func (a AuthYubikey) LoginFields() (fields []plugins.LoginField) { return []plugins.LoginField{ { Label: "Yubikey One-Time-Password", Name: "key-input", Placeholder: "Press the button of your Yubikey...", Type: "text", }, } } // Logout is called when the user visits the logout endpoint and // needs to destroy any persistent stored cookies func (a AuthYubikey) Logout(res http.ResponseWriter, r *http.Request) (err error) { sess, _ := a.cookieStore.Get(r, strings.Join([]string{a.cookie.Prefix, a.AuthenticatorID()}, "-")) // #nosec G104 - On error empty session is returned sess.Options = a.cookie.GetSessionOpts() sess.Options.MaxAge = -1 // Instant delete return sess.Save(r, res) } // SupportsMFA returns the MFA detection capabilities of the login // provider. If the provider can provide mfaConfig objects from its // configuration return true. If this is true the login interface // will display an additional field for this provider for the user // to fill in their MFA token. func (a AuthYubikey) SupportsMFA() bool { return false }