int oilsAuthSessionRetrieve( osrfMethodContext* ctx ) { OSRF_METHOD_VERIFY_CONTEXT(ctx); bool returnFull = false; const char* authToken = jsonObjectGetString( jsonObjectGetIndex(ctx->params, 0)); if(ctx->params->size > 1) { // caller wants full cached object, with authtime, etc. const char* rt = jsonObjectGetString(jsonObjectGetIndex(ctx->params, 1)); if(rt && strcmp(rt, "0") != 0) returnFull = true; } jsonObject* cacheObj = NULL; oilsEvent* evt = NULL; if( authToken ){ // Reset the timeout to keep the session alive evt = _oilsAuthResetTimeout(authToken, 0); if( evt && strcmp(evt->event, OILS_EVENT_SUCCESS) ) { osrfAppRespondComplete( ctx, oilsEventToJSON( evt )); // can't reset timeout } else { // Retrieve the cached session object osrfLogDebug(OSRF_LOG_MARK, "Retrieving auth session: %s", authToken); char* key = va_list_to_string("%s%s", OILS_AUTH_CACHE_PRFX, authToken ); cacheObj = osrfCacheGetObject( key ); if(cacheObj) { // Return a copy of the cached user object if(returnFull) osrfAppRespondComplete( ctx, cacheObj); else osrfAppRespondComplete( ctx, jsonObjectGetKeyConst( cacheObj, "userobj")); jsonObjectFree(cacheObj); } else { // Auth token is invalid or expired oilsEvent* evt2 = oilsNewEvent(OSRF_LOG_MARK, OILS_EVENT_NO_SESSION); osrfAppRespondComplete( ctx, oilsEventToJSON(evt2) ); /* should be event.. */ oilsEventFree(evt2); } free(key); } } else { // No session evt = oilsNewEvent(OSRF_LOG_MARK, OILS_EVENT_NO_SESSION); osrfAppRespondComplete( ctx, oilsEventToJSON(evt) ); } if(evt) oilsEventFree(evt); return 0; }
/** * Determines the correct recipient address based on the requested * service or recipient address. */ static int osrfHttpTranslatorSetTo(osrfHttpTranslator* trans) { int stat = 0; jsonObject* sessionCache = NULL; if(trans->service) { if(trans->recipient) { osrfLogError(OSRF_LOG_MARK, "Specifying both SERVICE and TO are not allowed"); } else { // service is specified, build a recipient address // from the router, domain, and service int size = snprintf(recipientBuf, 128, "%s@%s/%s", routerName, domainName, trans->service); recipientBuf[size] = '\0'; osrfLogDebug(OSRF_LOG_MARK, "Set recipient to %s", recipientBuf); trans->recipient = recipientBuf; stat = 1; } } else { if(trans->recipient) { sessionCache = osrfCacheGetObject(trans->thread); if(sessionCache) { const char* ipAddr = jsonObjectGetString( jsonObjectGetKeyConst( sessionCache, "ip" )); const char* recipient = jsonObjectGetString( jsonObjectGetKeyConst( sessionCache, "jid" )); // choosing a specific recipient address requires that the recipient and // thread be cached on the server (so drone processes cannot be hijacked) if(!strcmp(ipAddr, trans->remoteHost) && !strcmp(recipient, trans->recipient)) { osrfLogDebug( OSRF_LOG_MARK, "Found cached session from host %s and recipient %s", trans->remoteHost, trans->recipient); stat = 1; trans->service = apr_pstrdup( trans->apreq->pool, jsonObjectGetString( jsonObjectGetKeyConst( sessionCache, "service" ))); } else { osrfLogError(OSRF_LOG_MARK, "Session cache for thread %s does not match request", trans->thread); } } else { osrfLogError(OSRF_LOG_MARK, "attempt to send directly to %s without a session", trans->recipient); } } else { osrfLogError(OSRF_LOG_MARK, "No SERVICE or RECIPIENT defined"); } } jsonObjectFree(sessionCache); return stat; }
/** Resets the auth login timeout @return The event object, OILS_EVENT_SUCCESS, or OILS_EVENT_NO_SESSION */ static oilsEvent* _oilsAuthResetTimeout( const char* authToken ) { if(!authToken) return NULL; oilsEvent* evt = NULL; time_t timeout; osrfLogDebug(OSRF_LOG_MARK, "Resetting auth timeout for session %s", authToken); char* key = va_list_to_string("%s%s", OILS_AUTH_CACHE_PRFX, authToken ); jsonObject* cacheObj = osrfCacheGetObject( key ); if(!cacheObj) { osrfLogInfo(OSRF_LOG_MARK, "No user in the cache exists with key %s", key); evt = oilsNewEvent(OSRF_LOG_MARK, OILS_EVENT_NO_SESSION); } else { // Determine a new timeout value jsonObject* endtime_obj = jsonObjectGetKey( cacheObj, "endtime" ); if( endtime_obj ) { // Extend the current endtime by a fixed amount time_t endtime = (time_t) jsonObjectGetNumber( endtime_obj ); int reset_interval = DEFAULT_RESET_INTERVAL; const jsonObject* reset_interval_obj = jsonObjectGetKeyConst( cacheObj, "reset_interval" ); if( reset_interval_obj ) { reset_interval = (int) jsonObjectGetNumber( reset_interval_obj ); if( reset_interval <= 0 ) reset_interval = DEFAULT_RESET_INTERVAL; } time_t now = time( NULL ); time_t new_endtime = now + reset_interval; if( new_endtime > endtime ) { // Keep the session alive a little longer jsonObjectSetNumber( endtime_obj, (double) new_endtime ); timeout = reset_interval; osrfCachePutObject( key, cacheObj, timeout ); } else { // The session isn't close to expiring, so don't reset anything. // Just report the time remaining. timeout = endtime - now; } } else { // Reapply the existing timeout from the current time timeout = (time_t) jsonObjectGetNumber( jsonObjectGetKeyConst( cacheObj, "authtime")); osrfCachePutObject( key, cacheObj, timeout ); } jsonObject* payload = jsonNewNumberObject( (double) timeout ); evt = oilsNewEvent2(OSRF_LOG_MARK, OILS_EVENT_SUCCESS, payload); jsonObjectFree(payload); jsonObjectFree(cacheObj); } free(key); return evt; }
static int oilsAuthLoginVerifyPassword(const osrfMethodContext* ctx, int user_id, const char* username, const char* password) { // build the cache key growing_buffer* gb = buffer_init(64); // free me buffer_add(gb, OILS_AUTH_CACHE_PRFX); buffer_add(gb, username); buffer_add(gb, OILS_AUTH_COUNT_SFFX); char* countkey = buffer_release(gb); // free me jsonObject* countobject = osrfCacheGetObject(countkey); // free me long failcount = 0; if (countobject) { failcount = (long) jsonObjectGetNumber(countobject); if (failcount >= _oilsAuthBlockCount) { // User is blocked. Don't waste any more CPU cycles on them. osrfLogInfo(OSRF_LOG_MARK, "oilsAuth found too many recent failures for '%s' : %i, " "forcing failure state.", username, failcount); jsonObjectFree(countobject); free(countkey); return 0; } } int verified = oilsAuthLoginCheckPassword(user_id, password); if (!verified) { // login failed. increment failure counter. failcount++; if (countobject) { // append to existing counter jsonObjectSetNumber(countobject, failcount); } else { // first failure, create a new counter countobject = jsonNewNumberObject((double) failcount); } osrfCachePutObject(countkey, countobject, _oilsAuthBlockTimeout); } jsonObjectFree(countobject); // NULL OK free(countkey); return verified; }
/** @brief Verify the password received from the client. @param ctx The method context. @param userObj An object from the database, representing the user. @param password An obfuscated password received from the client. @return 1 if the password is valid; 0 if it isn't; or -1 upon error. (None of the so-called "passwords" used here are in plaintext. All have been passed through at least one layer of hashing to obfuscate them.) Take the password from the user object. Append it to the username seed from memcache, as stored previously by a call to the init method. Take an md5 hash of the result. Then compare this hash to the password received from the client. In order for the two to match, other than by dumb luck, the client had to construct the password it passed in the same way. That means it neded to know not only the original password (either hashed or plaintext), but also the seed. The latter requirement means that the client process needs either to be the same process that called the init method or to receive the seed from the process that did so. */ static int oilsAuthVerifyPassword( const osrfMethodContext* ctx, int user_id, const char* identifier, const char* password, const char* nonce) { int verified = 0; // We won't be needing the seed again, remove it osrfCacheRemove("%s%s%s", OILS_AUTH_CACHE_PRFX, identifier, nonce); // Ask the DB to verify the user's password. // Here, the password is md5(md5(password) + salt) jsonObject* params = jsonParseFmt( // free "{\"from\":[\"actor.verify_passwd\",%d,\"main\",\"%s\"]}", user_id, password); jsonObject* verify_obj = // free oilsUtilsCStoreReq("open-ils.cstore.json_query", params); jsonObjectFree(params); if (verify_obj) { verified = oilsUtilsIsDBTrue( jsonObjectGetString( jsonObjectGetKeyConst( verify_obj, "actor.verify_passwd"))); jsonObjectFree(verify_obj); } char* countkey = va_list_to_string("%s%s%s", OILS_AUTH_CACHE_PRFX, identifier, OILS_AUTH_COUNT_SFFX ); jsonObject* countobject = osrfCacheGetObject( countkey ); if(countobject) { long failcount = (long) jsonObjectGetNumber( countobject ); if(failcount >= _oilsAuthBlockCount) { verified = 0; osrfLogInfo(OSRF_LOG_MARK, "oilsAuth found too many recent failures for '%s' : %i, " "forcing failure state.", identifier, failcount); } if(verified == 0) { failcount += 1; } jsonObjectSetNumber( countobject, failcount ); osrfCachePutObject( countkey, countobject, _oilsAuthBlockTimeout ); jsonObjectFree(countobject); } free(countkey); return verified; }
/** @brief Implement the "init" method. @param ctx The method context. @return Zero if successful, or -1 if not. Method parameters: - username - nonce : optional login seed (string) provided by the caller which is added to the auth init cache to differentiate between logins using the same username and thus avoiding cache collisions for near-simultaneous logins. Return to client: Intermediate authentication seed. Combine the username with a timestamp and process ID, and take an md5 hash of the result. Store the hash in memcache, with a key based on the username. Then return the hash to the client. However: if the username includes one or more embedded blank spaces, return a dummy hash without storing anything in memcache. The dummy will never match a stored hash, so any attempt to authenticate with it will fail. */ int oilsAuthInit( osrfMethodContext* ctx ) { OSRF_METHOD_VERIFY_CONTEXT(ctx); char* username = jsonObjectToSimpleString( jsonObjectGetIndex(ctx->params, 0) ); const char* nonce = jsonObjectGetString(jsonObjectGetIndex(ctx->params, 1)); if (!nonce) nonce = ""; if( username ) { jsonObject* resp; if( strchr( username, ' ' ) ) { // Embedded spaces are not allowed in a username. Use "x" as a dummy // seed. It will never be a valid seed because 'x' is not a hex digit. resp = jsonNewObject( "x" ); } else { // Build a key and a seed; store them in memcache. char* key = va_list_to_string( "%s%s%s", OILS_AUTH_CACHE_PRFX, username, nonce ); char* countkey = va_list_to_string( "%s%s%s", OILS_AUTH_CACHE_PRFX, username, OILS_AUTH_COUNT_SFFX ); char* seed = md5sum( "%d.%ld.%s.%s", (int) time(NULL), (long) getpid(), username, nonce ); jsonObject* countobject = osrfCacheGetObject( countkey ); if(!countobject) { countobject = jsonNewNumberObject( (double) 0 ); } osrfCachePutString( key, seed, _oilsAuthSeedTimeout ); osrfCachePutObject( countkey, countobject, _oilsAuthBlockTimeout ); osrfLogDebug( OSRF_LOG_MARK, "oilsAuthInit(): has seed %s and key %s", seed, key ); // Build a returnable object containing the seed. resp = jsonNewObject( seed ); free( seed ); free( key ); free( countkey ); jsonObjectFree( countobject ); } // Return the seed to the client. osrfAppRespondComplete( ctx, resp ); jsonObjectFree(resp); free(username); return 0; } return -1; // Error: no username parameter }
// ident is either a username or barcode // Returns the init seed -> requires free(); static char* oilsAuthBuildInitCache( int user_id, const char* ident, const char* ident_type, const char* nonce) { char* cache_key = va_list_to_string( "%s%s%s", OILS_AUTH_CACHE_PRFX, ident, nonce); char* count_key = va_list_to_string( "%s%s%s", OILS_AUTH_CACHE_PRFX, ident, OILS_AUTH_COUNT_SFFX); char* auth_seed; if (user_id == -1) { // user does not exist. Use a dummy seed auth_seed = strdup("x"); } else { auth_seed = oilsAuthGetSalt(user_id); } jsonObject* seed_object = jsonParseFmt( "{\"%s\":\"%s\",\"user_id\":%d,\"seed\":\"%s\"}", ident_type, ident, user_id, auth_seed); jsonObject* count_object = osrfCacheGetObject(count_key); if(!count_object) { count_object = jsonNewNumberObject((double) 0); } osrfCachePutObject(cache_key, seed_object, _oilsAuthSeedTimeout); if (user_id != -1) { // Only track login counts for existing users, since a // login for a nonexistent user will never succeed anyway. osrfCachePutObject(count_key, count_object, _oilsAuthBlockTimeout); } osrfLogDebug(OSRF_LOG_MARK, "oilsAuthInit(): has seed %s and key %s", auth_seed, cache_key); free(cache_key); free(count_key); jsonObjectFree(count_object); jsonObjectFree(seed_object); return auth_seed; }
/** @brief Implement the "complete" method. @param ctx The method context. @return -1 upon error; zero if successful, and if a STATUS message has been sent to the client to indicate completion; a positive integer if successful but no such STATUS message has been sent. Method parameters: - a hash with some combination of the following elements: - "username" - "barcode" - "password" (hashed with the cached seed; not plaintext) - "type" - "org" - "workstation" - "agent" (what software/interface/3rd-party is making the request) - "nonce" optional login seed to differentiate logins using the same username. The password is required. Either a username or a barcode must also be present. Return to client: Intermediate authentication seed. Validate the password, using the username if available, or the barcode if not. The user must be active, and not barred from logging on. The barcode, if used for authentication, must be active as well. The workstation, if specified, must be valid. Upon deciding whether to allow the logon, return a corresponding event to the client. */ int oilsAuthComplete( osrfMethodContext* ctx ) { OSRF_METHOD_VERIFY_CONTEXT(ctx); const jsonObject* args = jsonObjectGetIndex(ctx->params, 0); const char* uname = jsonObjectGetString(jsonObjectGetKeyConst(args, "username")); const char* identifier = jsonObjectGetString(jsonObjectGetKeyConst(args, "identifier")); const char* password = jsonObjectGetString(jsonObjectGetKeyConst(args, "password")); const char* type = jsonObjectGetString(jsonObjectGetKeyConst(args, "type")); int orgloc = (int) jsonObjectGetNumber(jsonObjectGetKeyConst(args, "org")); const char* workstation = jsonObjectGetString(jsonObjectGetKeyConst(args, "workstation")); const char* barcode = jsonObjectGetString(jsonObjectGetKeyConst(args, "barcode")); const char* ewho = jsonObjectGetString(jsonObjectGetKeyConst(args, "agent")); const char* nonce = jsonObjectGetString(jsonObjectGetKeyConst(args, "nonce")); const char* ws = (workstation) ? workstation : ""; if (!nonce) nonce = ""; // we no longer care how the identifier reaches us, // as long as we have one. if (!identifier) { if (uname) { identifier = uname; } else if (barcode) { identifier = barcode; } } if (!identifier) { return osrfAppRequestRespondException(ctx->session, ctx->request, "username/barcode and password required for method: %s", ctx->method->name); } osrfLogInfo(OSRF_LOG_MARK, "Patron completing authentication with identifer %s", identifier); /* Use __FILE__, harmless_line_number for creating * OILS_EVENT_AUTH_FAILED events (instead of OSRF_LOG_MARK) to avoid * giving away information about why an authentication attempt failed. */ int harmless_line_number = __LINE__; if( !type ) type = OILS_AUTH_STAFF; oilsEvent* response = NULL; // free jsonObject* userObj = NULL; // free char* cache_key = va_list_to_string( "%s%s%s", OILS_AUTH_CACHE_PRFX, identifier, nonce); jsonObject* cacheObj = osrfCacheGetObject(cache_key); // free if (!cacheObj) { return osrfAppRequestRespondException(ctx->session, ctx->request, "No authentication seed found. " "open-ils.auth.authenticate.init must be called first " " (check that memcached is running and can be connected to) " ); } int user_id = jsonObjectGetNumber( jsonObjectGetKeyConst(cacheObj, "user_id")); if (user_id == -1) { // User was not found during init. Clean up and exit early. response = oilsNewEvent( __FILE__, harmless_line_number, OILS_EVENT_AUTH_FAILED); osrfAppRespondComplete(ctx, oilsEventToJSON(response)); oilsEventFree(response); // frees event JSON osrfCacheRemove(cache_key); jsonObjectFree(cacheObj); return 0; } jsonObject* param = jsonNewNumberObject(user_id); // free userObj = oilsUtilsCStoreReqCtx( ctx, "open-ils.cstore.direct.actor.user.retrieve", param); jsonObjectFree(param); char* freeable_uname = NULL; if (!uname) { uname = freeable_uname = oilsFMGetString(userObj, "usrname"); } // See if the user is allowed to login. jsonObject* params = jsonNewObject(NULL); jsonObjectSetKey(params, "user_id", jsonNewNumberObject(oilsFMGetObjectId(userObj))); jsonObjectSetKey(params,"org_unit", jsonNewNumberObject(orgloc)); jsonObjectSetKey(params, "login_type", jsonNewObject(type)); if (barcode) jsonObjectSetKey(params, "barcode", jsonNewObject(barcode)); jsonObject* authEvt = oilsUtilsQuickReqCtx( // freed after password test ctx, "open-ils.auth_internal", "open-ils.auth_internal.user.validate", params); jsonObjectFree(params); if (!authEvt) { // Something went seriously wrong. Get outta here before // we start segfaulting. jsonObjectFree(userObj); if(freeable_uname) free(freeable_uname); return -1; } const char* authEvtCode = jsonObjectGetString(jsonObjectGetKey(authEvt, "textcode")); if (!strcmp(authEvtCode, OILS_EVENT_AUTH_FAILED)) { // Received the generic login failure event. osrfLogInfo(OSRF_LOG_MARK, "failed login: username=%s, barcode=%s, workstation=%s", uname, (barcode ? barcode : "(none)"), ws); response = oilsNewEvent( __FILE__, harmless_line_number, OILS_EVENT_AUTH_FAILED); } int passOK = 0; if (!response) { // User exists and is not barred, etc. Test the password. passOK = oilsAuthVerifyPassword( ctx, user_id, identifier, password, nonce); if (!passOK) { // Password check failed. Return generic login failure. response = oilsNewEvent( __FILE__, harmless_line_number, OILS_EVENT_AUTH_FAILED); osrfLogInfo(OSRF_LOG_MARK, "failed login: username=%s, barcode=%s, workstation=%s", uname, (barcode ? barcode : "(none)"), ws ); } } // Below here, we know the password check succeeded if no response // object is present. if (!response && ( !strcmp(authEvtCode, "PATRON_INACTIVE") || !strcmp(authEvtCode, "PATRON_CARD_INACTIVE"))) { // Patron and/or card is inactive but the correct password // was provided. Alert the caller to the inactive-ness. response = oilsNewEvent2( OSRF_LOG_MARK, authEvtCode, jsonObjectGetKey(authEvt, "payload") // cloned within Event ); } if (!response && strcmp(authEvtCode, OILS_EVENT_SUCCESS)) { // Validate API returned an unexpected non-success event. // To be safe, treat this as a generic login failure. response = oilsNewEvent( __FILE__, harmless_line_number, OILS_EVENT_AUTH_FAILED); } if (!response) { // password OK and no other events have prevented login completion. char* ewhat = "login"; if (0 == strcmp(ctx->method->name, "open-ils.auth.authenticate.verify")) { response = oilsNewEvent( OSRF_LOG_MARK, OILS_EVENT_SUCCESS ); ewhat = "verify"; } else { response = oilsAuthHandleLoginOK( ctx, userObj, uname, type, orgloc, workstation); } oilsUtilsTrackUserActivity( ctx, oilsFMGetObjectId(userObj), ewho, ewhat, osrfAppSessionGetIngress() ); } // reply osrfAppRespondComplete(ctx, oilsEventToJSON(response)); // clean up oilsEventFree(response); jsonObjectFree(userObj); jsonObjectFree(authEvt); jsonObjectFree(cacheObj); if(freeable_uname) free(freeable_uname); return 0; }
/** @brief Verify the password received from the client. @param ctx The method context. @param userObj An object from the database, representing the user. @param password An obfuscated password received from the client. @return 1 if the password is valid; 0 if it isn't; or -1 upon error. (None of the so-called "passwords" used here are in plaintext. All have been passed through at least one layer of hashing to obfuscate them.) Take the password from the user object. Append it to the username seed from memcache, as stored previously by a call to the init method. Take an md5 hash of the result. Then compare this hash to the password received from the client. In order for the two to match, other than by dumb luck, the client had to construct the password it passed in the same way. That means it neded to know not only the original password (either hashed or plaintext), but also the seed. The latter requirement means that the client process needs either to be the same process that called the init method or to receive the seed from the process that did so. */ static int oilsAuthVerifyPassword( const osrfMethodContext* ctx, const jsonObject* userObj, const char* uname, const char* password, const char* nonce ) { // Get the username seed, as stored previously in memcache by the init method char* seed = osrfCacheGetString( "%s%s%s", OILS_AUTH_CACHE_PRFX, uname, nonce ); if(!seed) { return osrfAppRequestRespondException( ctx->session, ctx->request, "No authentication seed found. " "open-ils.auth.authenticate.init must be called first " " (check that memcached is running and can be connected to) " ); } // We won't be needing the seed again, remove it osrfCacheRemove( "%s%s%s", OILS_AUTH_CACHE_PRFX, uname, nonce ); // Get the hashed password from the user object char* realPassword = oilsFMGetString( userObj, "passwd" ); osrfLogInternal(OSRF_LOG_MARK, "oilsAuth retrieved real password: [%s]", realPassword); osrfLogDebug(OSRF_LOG_MARK, "oilsAuth retrieved seed from cache: %s", seed ); // Concatenate them and take an MD5 hash of the result char* maskedPw = md5sum( "%s%s", seed, realPassword ); free(realPassword); free(seed); if( !maskedPw ) { // This happens only if md5sum() runs out of memory free( maskedPw ); return -1; // md5sum() ran out of memory } osrfLogDebug(OSRF_LOG_MARK, "oilsAuth generated masked password %s. " "Testing against provided password %s", maskedPw, password ); int ret = 0; if( !strcmp( maskedPw, password ) ) ret = 1; free(maskedPw); char* countkey = va_list_to_string( "%s%s%s", OILS_AUTH_CACHE_PRFX, uname, OILS_AUTH_COUNT_SFFX ); jsonObject* countobject = osrfCacheGetObject( countkey ); if(countobject) { long failcount = (long) jsonObjectGetNumber( countobject ); if(failcount >= _oilsAuthBlockCount) { ret = 0; osrfLogInfo(OSRF_LOG_MARK, "oilsAuth found too many recent failures for '%s' : %i, forcing failure state.", uname, failcount); } if(ret == 0) { failcount += 1; } jsonObjectSetNumber( countobject, failcount ); osrfCachePutObject( countkey, countobject, _oilsAuthBlockTimeout ); jsonObjectFree(countobject); } free(countkey); return ret; }