2c134435e8
* Allow 9 digits long passcode for passcode bypass * Change name of 'Mobile Passcode' to 'Passcode' * Do not display any prompt when user is waiting * Add autopushPrompt option * Change name OTP method * Change enrolement message handling * Addded postrm script * [bugfix] Restart sshd service after rublon package instalation * Rename 01_rublon_ssh.conf to 01-rublon-ssh.conf * Prepared scripts for generating rpm for alma nad rocky * Adding public key authentication option * Add postinst script and ssh configuration for using pubkey * Add GCC 7 compatybility * Cleanup includes, cleanup std::array usage * Add Static String implementation * Remove memory_resources * Add monotonic_buffer_resource in experimental c++ imlpementation * Use case insensitive map * Remove not needed code * Stop using deprecated SHA256 functions * Changed app verstion to v2.0.4 * Fixed postinst script for ubuntu * CHanged vangrantfile not to show gui * Refactor cpack + add component builds for rpm based distros
95 lines
3.3 KiB
C++
95 lines
3.3 KiB
C++
#include "rublon/json.hpp"
|
|
#include "rublon/memory.hpp"
|
|
#include <security/pam_appl.h>
|
|
#include <security/pam_client.h>
|
|
#include <security/pam_ext.h>
|
|
#include <security/pam_misc.h>
|
|
#include <security/pam_modules.h>
|
|
#include <syslog.h>
|
|
|
|
#include <rublon/check_application.hpp>
|
|
#include <rublon/error.hpp>
|
|
#include <rublon/error_handler.hpp>
|
|
#include <rublon/finish.hpp>
|
|
#include <rublon/rublon.hpp>
|
|
#include <rublon/utils.hpp>
|
|
|
|
std::string g_tid;
|
|
|
|
int main([[maybe_unused]] int argc, [[maybe_unused]] const char ** argv) {
|
|
using namespace rublon;
|
|
details::initLog();
|
|
PamStub pam{};
|
|
|
|
auto printAuthMessageAndExit = [&](const AuthenticationStatus status) {
|
|
switch(status.action()) {
|
|
case AuthenticationStatus::Action::Bypass:
|
|
pam.print("RUBLON authentication BYPASSED");
|
|
return PAM_SUCCESS;
|
|
|
|
case AuthenticationStatus::Action::Denied:
|
|
pam.print("RUBLON authentication FAILED");
|
|
return PAM_MAXTRIES;
|
|
|
|
case AuthenticationStatus::Action::Confirmed:
|
|
pam.print("RUBLON authentication SUCCEEDED");
|
|
return PAM_SUCCESS;
|
|
}
|
|
|
|
pam.print("RUBLON connector has exited with unknown code, access DENY!\n");
|
|
return PAM_MAXTRIES;
|
|
};
|
|
|
|
auto session = rublon::RublonFactory{}.startSession(pam);
|
|
if(not session.has_value()) {
|
|
return printAuthMessageAndExit(AuthenticationStatus::Action::Bypass);
|
|
}
|
|
|
|
if(!session->config().logging){
|
|
g_level = LogLevel::Warning;
|
|
}
|
|
|
|
auto & CH = session.value().coreHandler();
|
|
|
|
auto selectMethod = [&](const MethodSelect & selector) { return selector.create(pam); };
|
|
auto confirmMethod = [&](const PostMethod & postMethod) { return postMethod.handle(CH); };
|
|
auto confirmCode = [&](const MethodProxy & method) mutable { return method.fire(CH, pam); };
|
|
|
|
auto finalizeTransaction = [&](const AuthenticationStatus & status) -> tl::expected< AuthenticationStatus, Error > {
|
|
if(status.userAuthorized()) {
|
|
auto tok = std::string{status.accessToken().substr(10, 60).data(), 60};
|
|
|
|
Finish finish{session.value().config(), std::move(tok)};
|
|
finish.handle(CH);
|
|
}
|
|
return status;
|
|
};
|
|
|
|
auto allowLogin = [&](const AuthenticationStatus & status) -> tl::expected< int, Error > { return printAuthMessageAndExit(status); };
|
|
|
|
auto mapError = [&](const Error & error) -> tl::expected< int, Error > {
|
|
rublon::ErrorHandler{pam, session->config()}.printErrorDetails(error);
|
|
};
|
|
|
|
{
|
|
CheckApplication ca;
|
|
auto ret =
|
|
ca.call(CH, {session.value().config().systemToken.data(), session.value().config().systemToken.size()}).or_else(mapError);
|
|
if(not ret.has_value()) {
|
|
log(LogLevel::Error, "Check Application step failed, check configration");
|
|
return PAM_MAXTRIES;
|
|
}
|
|
}
|
|
|
|
auto ret = Init{session.value()}
|
|
.handle(CH, pam) //
|
|
.and_then(selectMethod)
|
|
.and_then(confirmMethod)
|
|
.and_then(confirmCode)
|
|
.and_then(finalizeTransaction)
|
|
.and_then(allowLogin)
|
|
.or_else(mapError);
|
|
|
|
return ret.value_or(PAM_MAXTRIES);
|
|
}
|