You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by rn...@apache.org on 2020/03/23 00:21:18 UTC
[couchdb] branch admin-2fa updated (17847c1 -> 6c20d26)
This is an automated email from the ASF dual-hosted git repository.
rnewson pushed a change to branch admin-2fa
in repository https://gitbox.apache.org/repos/asf/couchdb.git.
discard 17847c1 enable totp with basic auth
discard 4236f90 add to Allow admins to have...
discard 08ebedd change verify_totp contract
discard 9de7f2b Allow admins to have a TOTP secret
new f8b60d1 Allow admins to have a TOTP secret
new d639dee change verify_totp contract
new 6c20d26 enable totp with basic auth
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (17847c1)
\
N -- N -- N refs/heads/admin-2fa (6c20d26)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 3 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
[couchdb] 02/03: change verify_totp contract
Posted by rn...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rnewson pushed a commit to branch admin-2fa
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit d639dee946ed1f5da57b4a460187eb7c8d21608c
Author: Robert Newson <rn...@apache.org>
AuthorDate: Sun Mar 22 23:43:58 2020 +0000
change verify_totp contract
---
src/couch/src/couch_httpd_auth.erl | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/src/couch/src/couch_httpd_auth.erl b/src/couch/src/couch_httpd_auth.erl
index 7c55f39..c91b6d6 100644
--- a/src/couch/src/couch_httpd_auth.erl
+++ b/src/couch/src/couch_httpd_auth.erl
@@ -333,7 +333,7 @@ handle_session_req(#httpd{method='POST', mochi_req=MochiReq}=Req, AuthModule) ->
end,
case authenticate(Password, UserProps) of
true ->
- verify_totp(UserProps, Form),
+ verify_totp(UserProps, couch_util:get_value("token", Form, "")),
% setup the session cookie
Secret = ?l2b(ensure_cookie_auth_secret()),
UserSalt = couch_util:get_value(<<"salt">>, UserProps),
@@ -501,7 +501,9 @@ reject_if_totp(User) ->
throw({unauthorized, <<"Name or password is incorrect.">>})
end.
-verify_totp(User, Form) ->
+verify_totp(User, Token) when is_list(Token) ->
+ verify_totp(User, ?l2b(Token));
+verify_totp(User, Token) when is_binary(Token) ->
case get_totp_config(User) of
undefined ->
ok;
@@ -510,7 +512,6 @@ verify_totp(User, Form) ->
Alg = couch_util:to_existing_atom(
couch_util:get_value(<<"algorithm">>, Props, <<"sha">>)),
Len = couch_util:get_value(<<"length">>, Props, 6),
- Token = ?l2b(couch_util:get_value("token", Form, "")),
verify_token(Alg, Key, Len, Token)
end.
[couchdb] 01/03: Allow admins to have a TOTP secret
Posted by rn...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rnewson pushed a commit to branch admin-2fa
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit f8b60d19b7bb558909f75f6ab85327cc6ab5e9e2
Author: Robert Newson <rn...@apache.org>
AuthorDate: Sun Mar 22 22:29:05 2020 +0000
Allow admins to have a TOTP secret
---
src/couch/src/couch_auth_cache.erl | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/src/couch/src/couch_auth_cache.erl b/src/couch/src/couch_auth_cache.erl
index c564cee..f4c4e46 100644
--- a/src/couch/src/couch_auth_cache.erl
+++ b/src/couch/src/couch_auth_cache.erl
@@ -73,10 +73,10 @@ get_admin(UserName) when is_list(UserName) ->
% the name is an admin, now check to see if there is a user doc
% which has a matching name, salt, and password_sha
[HashedPwd, Salt] = string:tokens(HashedPwdAndSalt, ","),
- make_admin_doc(HashedPwd, Salt);
+ add_totp(UserName, make_admin_doc(HashedPwd, Salt));
"-pbkdf2-" ++ HashedPwdSaltAndIterations ->
[HashedPwd, Salt, Iterations] = string:tokens(HashedPwdSaltAndIterations, ","),
- make_admin_doc(HashedPwd, Salt, Iterations);
+ add_totp(UserName, make_admin_doc(HashedPwd, Salt, Iterations));
_Else ->
nil
end.
@@ -94,6 +94,19 @@ make_admin_doc(DerivedKey, Salt, Iterations) ->
{<<"password_scheme">>, <<"pbkdf2">>},
{<<"derived_key">>, ?l2b(DerivedKey)}].
+add_totp(UserName, Props) ->
+ case config:get("admins_totp", UserName) of
+ undefined ->
+ Props;
+ TOTP ->
+ [Alg, Len, Key] = string:tokens(TOTP, ","),
+ [{<<"totp">>,
+ {[
+ {<<"algorithm">>, list_to_existing_atom(Alg)},
+ {<<"length">>, list_to_integer(Len)},
+ {<<"key">>, ?l2b(Key)}]}}
+ | Props]
+ end.
get_from_db(UserName) ->
ok = ensure_users_db_exists(),
[couchdb] 03/03: enable totp with basic auth
Posted by rn...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rnewson pushed a commit to branch admin-2fa
in repository https://gitbox.apache.org/repos/asf/couchdb.git
commit 6c20d26c26c6e77b5c73a0e4c4a20f932069011a
Author: Robert Newson <rn...@apache.org>
AuthorDate: Mon Mar 23 00:15:30 2020 +0000
enable totp with basic auth
---
src/couch/src/couch_httpd_auth.erl | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
diff --git a/src/couch/src/couch_httpd_auth.erl b/src/couch/src/couch_httpd_auth.erl
index c91b6d6..70a10e8 100644
--- a/src/couch/src/couch_httpd_auth.erl
+++ b/src/couch/src/couch_httpd_auth.erl
@@ -97,10 +97,22 @@ default_authentication_handler(Req, AuthModule) ->
nil ->
throw({unauthorized, <<"Name or password is incorrect.">>});
{ok, UserProps, _AuthCtx} ->
- reject_if_totp(UserProps),
UserName = ?l2b(User),
- Password = ?l2b(Pass),
- case authenticate(Password, UserProps) of
+ Authenticated = case get_totp_config(UserProps) of
+ undefined ->
+ authenticate(?l2b(Pass), UserProps);
+ _TOTP ->
+ Len = couch_util:get_value(<<"length">>, UserProps, 6),
+ case ?l2b(Pass) of
+ <<Token:Len/binary, Password/binary>> ->
+ PasswordRight = authenticate(Password, UserProps),
+ verify_totp(UserProps, Token),
+ PasswordRight;
+ _ ->
+ false
+ end
+ end,
+ case Authenticated of
true ->
Req#httpd{user_ctx=#user_ctx{
name=UserName,
@@ -493,14 +505,6 @@ same_site() ->
end.
-reject_if_totp(User) ->
- case get_totp_config(User) of
- undefined ->
- ok;
- _ ->
- throw({unauthorized, <<"Name or password is incorrect.">>})
- end.
-
verify_totp(User, Token) when is_list(Token) ->
verify_totp(User, ?l2b(Token));
verify_totp(User, Token) when is_binary(Token) ->