trustchain-oc1-orchestral
/
authentik
Archived
10
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

outposts/ldap: improve responses for unsuccessful binds 

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
This commit is contained in:
Jens Langhammer 2021-06-13 22:00:05 +02:00
parent cabbd18880
commit d824b09365
1 changed files with 21 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
outpost/pkg/ldap/instance_bind.go
View File

@ -3,7 +3,6 @@ package ldap
import ( import (
"context" "context"
"errors" "errors"
"fmt"
"net" "net"
"net/http" "net/http"
"net/http/cookiejar" "net/http/cookiejar"
@ -66,15 +65,15 @@ func (pi *ProviderInstance) Bind(username string, bindDN, bindPW string, conn ne
params := url.Values{} params := url.Values{}
params.Add("goauthentik.io/outpost/ldap", "true") params.Add("goauthentik.io/outpost/ldap", "true")
passed, err := pi.solveFlowChallenge(username, bindPW, apiClient, params.Encode(), 1) passed, rerr := pi.solveFlowChallenge(username, bindPW, apiClient, params.Encode(), 1)
if err != nil { if rerr != ldap.LDAPResultSuccess {
pi.log.WithField("bindDN", bindDN).WithError(err).Warning("failed to solve challenge") pi.log.WithField("bindDN", bindDN).WithError(err).Warning("failed to solve challenge")
return ldap.LDAPResultOperationsError, nil return rerr, nil
} }
if !passed { if !passed {
return ldap.LDAPResultInvalidCredentials, nil return ldap.LDAPResultInvalidCredentials, nil
} }
p, _, err := apiClient.CoreApi.CoreApplicationsCheckAccessCreate(context.Background(), pi.appSlug).Execute() p, _, err := apiClient.CoreApi.CoreApplicationsCheckAccessRetrieve(context.Background(), pi.appSlug).Execute()
if !p.Passing { if !p.Passing {
pi.log.WithField("bindDN", bindDN).Info("Access denied for user") pi.log.WithField("bindDN", bindDN).Info("Access denied for user")
return ldap.LDAPResultInsufficientAccessRights, nil return ldap.LDAPResultInsufficientAccessRights, nil
@ -138,12 +137,12 @@ type ChallengeInt interface {
GetResponseErrors() map[string][]api.ErrorDetail GetResponseErrors() map[string][]api.ErrorDetail
} }
func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, client *api.APIClient, urlParams string, depth int) (bool, error) { func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, client *api.APIClient, urlParams string, depth int) (bool, ldap.LDAPResultCode) {
req := client.FlowsApi.FlowsExecutorGet(context.Background(), pi.flowSlug).Query(urlParams) req := client.FlowsApi.FlowsExecutorGet(context.Background(), pi.flowSlug).Query(urlParams)
challenge, _, err := req.Execute() challenge, _, err := req.Execute()
if err != nil { if err != nil {
pi.log.WithError(err).Warning("Failed to get challenge") pi.log.WithError(err).Warning("Failed to get challenge")
return false, err return false, ldap.LDAPResultOperationsError
} }
ch := challenge.GetActualInstance().(ChallengeInt) ch := challenge.GetActualInstance().(ChallengeInt)
pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got challenge") pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got challenge")
@ -162,45 +161,51 @@ func (pi *ProviderInstance) solveFlowChallenge(bindDN string, password string, c
} }
} }
if deviceChallenge == nil { if deviceChallenge == nil {
return false, errors.New("got ak-stage-authenticator-validate without duo") pi.log.Warning("got ak-stage-authenticator-validate without duo")
return false, ldap.LDAPResultOperationsError
} }
devId, err := strconv.Atoi(deviceChallenge.DeviceUid) devId, err := strconv.Atoi(deviceChallenge.DeviceUid)
if err != nil { if err != nil {
return false, errors.New("failed to convert duo device id to int") pi.log.Warning("failed to convert duo device id to int")
return false, ldap.LDAPResultOperationsError
} }
devId32 := int32(devId) devId32 := int32(devId)
inner := api.NewAuthenticatorValidationChallengeResponseRequest() inner := api.NewAuthenticatorValidationChallengeResponseRequest()
inner.Duo = &devId32 inner.Duo = &devId32
responseReq = responseReq.FlowChallengeResponseRequest(api.AuthenticatorValidationChallengeResponseRequestAsFlowChallengeResponseRequest(inner)) responseReq = responseReq.FlowChallengeResponseRequest(api.AuthenticatorValidationChallengeResponseRequestAsFlowChallengeResponseRequest(inner))
case "ak-stage-access-denied": case "ak-stage-access-denied":
return false, errors.New("got ak-stage-access-denied") pi.log.Info("got ak-stage-access-denied")
return false, ldap.LDAPResultInsufficientAccessRights
default: default:
return false, fmt.Errorf("unsupported challenge type: %s", ch.GetComponent()) pi.log.Warning("unsupported challenge type: %s", ch.GetComponent())
return false, ldap.LDAPResultOperationsError
} }
response, _, err := responseReq.Execute() response, _, err := responseReq.Execute()
ch = response.GetActualInstance().(ChallengeInt) ch = response.GetActualInstance().(ChallengeInt)
pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got response") pi.log.WithField("component", ch.GetComponent()).WithField("type", ch.GetType()).Debug("Got response")
switch ch.GetComponent() { switch ch.GetComponent() {
case "ak-stage-access-denied": case "ak-stage-access-denied":
return false, errors.New("got ak-stage-access-denied") pi.log.Info("got ak-stage-access-denied")
return false, ldap.LDAPResultInsufficientAccessRights
} }
if ch.GetType() == "redirect" { if ch.GetType() == "redirect" {
return true, nil return true, ldap.LDAPResultSuccess
} }
if err != nil { if err != nil {
pi.log.WithError(err).Warning("Failed to submit challenge") pi.log.WithError(err).Warning("Failed to submit challenge")
return false, err return false, ldap.LDAPResultOperationsError
} }
if len(ch.GetResponseErrors()) > 0 { if len(ch.GetResponseErrors()) > 0 {
for key, errs := range ch.GetResponseErrors() { for key, errs := range ch.GetResponseErrors() {
for _, err := range errs { for _, err := range errs {
pi.log.WithField("key", key).WithField("code", err.Code).WithField("msg", err.String).Warning("Flow error") pi.log.WithField("key", key).WithField("code", err.Code).WithField("msg", err.String).Warning("Flow error")
return false, nil return false, ldap.LDAPResultInsufficientAccessRights
} }
} }
} }
if depth >= 10 { if depth >= 10 {
return false, errors.New("exceeded stage recursion depth") pi.log.Warning("exceeded stage recursion depth")
return false, ldap.LDAPResultOperationsError
} }
return pi.solveFlowChallenge(bindDN, password, client, urlParams, depth+1) return pi.solveFlowChallenge(bindDN, password, client, urlParams, depth+1)
} }