35 lines
1.2 KiB
Text
35 lines
1.2 KiB
Text
|
|
sso_secret_file=$werc_root/etc/misaki_sso.secret
|
|
|
|
fn misaki_sso_auth {
|
|
if(! ~ $#logged_user 0 || ~ $"HTTP_X_AUTH_USER '')
|
|
ssoskip=yes
|
|
if not if(! test -s $sso_secret_file)
|
|
dprint 'misaki-sso: secret file missing/empty: '^$sso_secret_file
|
|
if not {
|
|
sso_u=$"HTTP_X_AUTH_USER
|
|
sso_exp=$"HTTP_X_AUTH_EXP
|
|
if(! echo -n $sso_u | grep -s '^[a-zA-Z0-9_-]+$')
|
|
dprint 'misaki-sso: bad X-Auth-User: '^$"sso_u
|
|
if not if(! echo -n $sso_exp | grep -s '^[0-9]+$')
|
|
dprint 'misaki-sso: missing/non-numeric X-Auth-Exp ('^$"sso_exp^') - is auth_secret set in misaki?'
|
|
if not if(! test $sso_exp -gt `{date -n})
|
|
dprint 'misaki-sso: expired token for '^$sso_u
|
|
if not {
|
|
sso_want=`{echo -n 'v1:'^$sso_u^':'^$sso_exp | openssl dgst -sha256 -hmac `{cat $sso_secret_file} -binary | openssl base64 -A | tr '+/' '-_' | tr -d '='}
|
|
if(~ $"sso_want '')
|
|
dprint 'misaki-sso: empty HMAC - is openssl installed?'
|
|
if not if(! ~ $"HTTP_X_AUTH_SIG $sso_want)
|
|
dprint 'misaki-sso: signature mismatch for '^$sso_u^''
|
|
if not {
|
|
logged_user=$sso_u
|
|
logged_password=()
|
|
dprint 'misaki-sso: authenticated '^$sso_u
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
fn misaki-sso_init { misaki_sso_auth }
|
|
|
|
misaki_sso_auth
|