mirror of https://github.com/dexidp/dex.git
maksim.nabokikh
12 hours ago
42 changed files with 1245 additions and 58 deletions
@ -0,0 +1,295 @@
|
||||
package server |
||||
|
||||
import ( |
||||
"bytes" |
||||
"context" |
||||
"crypto/hmac" |
||||
"crypto/sha256" |
||||
"encoding/base64" |
||||
"fmt" |
||||
"image/png" |
||||
"net/http" |
||||
"strings" |
||||
|
||||
"github.com/pquerna/otp" |
||||
"github.com/pquerna/otp/totp" |
||||
|
||||
"github.com/dexidp/dex/storage" |
||||
) |
||||
|
||||
// MFAProvider is a pluggable multi-factor authentication method.
|
||||
type MFAProvider interface { |
||||
// Type returns the authenticator type identifier (e.g., "TOTP").
|
||||
Type() string |
||||
// EnabledForConnectorType returns true if this provider applies to the given connector type.
|
||||
// If no connector types are configured, the provider applies to all.
|
||||
EnabledForConnectorType(connectorType string) bool |
||||
} |
||||
|
||||
// TOTPProvider implements TOTP-based multi-factor authentication.
|
||||
type TOTPProvider struct { |
||||
issuer string |
||||
connectorTypes map[string]struct{} |
||||
} |
||||
|
||||
// NewTOTPProvider creates a new TOTP MFA provider.
|
||||
func NewTOTPProvider(issuer string, connectorTypes []string) *TOTPProvider { |
||||
m := make(map[string]struct{}, len(connectorTypes)) |
||||
for _, t := range connectorTypes { |
||||
m[t] = struct{}{} |
||||
} |
||||
return &TOTPProvider{issuer: issuer, connectorTypes: m} |
||||
} |
||||
|
||||
func (p *TOTPProvider) EnabledForConnectorType(connectorType string) bool { |
||||
if len(p.connectorTypes) == 0 { |
||||
return true |
||||
} |
||||
_, ok := p.connectorTypes[connectorType] |
||||
return ok |
||||
} |
||||
|
||||
func (p *TOTPProvider) Type() string { return "TOTP" } |
||||
|
||||
func (p *TOTPProvider) generate(connID, email string) (*otp.Key, error) { |
||||
return totp.Generate(totp.GenerateOpts{ |
||||
Issuer: p.issuer, |
||||
AccountName: fmt.Sprintf("(%s) %s", connID, email), |
||||
}) |
||||
} |
||||
|
||||
func (s *Server) handleMFAVerify(w http.ResponseWriter, r *http.Request) { |
||||
macEncoded := r.FormValue("hmac") |
||||
if macEncoded == "" { |
||||
s.renderError(r, w, http.StatusUnauthorized, "Unauthorized request.") |
||||
return |
||||
} |
||||
mac, err := base64.RawURLEncoding.DecodeString(macEncoded) |
||||
if err != nil { |
||||
s.renderError(r, w, http.StatusUnauthorized, "Unauthorized request.") |
||||
return |
||||
} |
||||
|
||||
ctx := r.Context() |
||||
|
||||
authReq, err := s.storage.GetAuthRequest(ctx, r.FormValue("req")) |
||||
if err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to get auth request", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Database error.") |
||||
return |
||||
} |
||||
if !authReq.LoggedIn { |
||||
s.logger.ErrorContext(ctx, "auth request does not have an identity for MFA verification") |
||||
s.renderError(r, w, http.StatusInternalServerError, "Login process not yet finalized.") |
||||
return |
||||
} |
||||
|
||||
// Verify HMAC
|
||||
h := hmac.New(sha256.New, authReq.HMACKey) |
||||
h.Write([]byte(authReq.ID)) |
||||
if !hmac.Equal(mac, h.Sum(nil)) { |
||||
s.renderError(r, w, http.StatusUnauthorized, "Unauthorized request.") |
||||
return |
||||
} |
||||
|
||||
authenticatorID := r.FormValue("authenticator") |
||||
provider, ok := s.mfaProviders[authenticatorID] |
||||
if !ok { |
||||
s.renderError(r, w, http.StatusBadRequest, "Unknown authenticator.") |
||||
return |
||||
} |
||||
|
||||
totpProvider, ok := provider.(*TOTPProvider) |
||||
if !ok { |
||||
s.renderError(r, w, http.StatusInternalServerError, "Unsupported authenticator type.") |
||||
return |
||||
} |
||||
|
||||
identity, err := s.storage.GetUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID) |
||||
if err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to get user identity", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Database error.") |
||||
return |
||||
} |
||||
|
||||
returnURL := strings.Replace(r.URL.String(), "/totp/verify", "/approval", 1) |
||||
|
||||
if authReq.MFAValidated { |
||||
http.Redirect(w, r, returnURL, http.StatusSeeOther) |
||||
return |
||||
} |
||||
|
||||
secret := identity.MFASecrets[authenticatorID] |
||||
|
||||
switch r.Method { |
||||
case http.MethodGet: |
||||
if secret == nil { |
||||
// First-time enrollment: generate a new TOTP key.
|
||||
generated, err := totpProvider.generate(authReq.ConnectorID, authReq.Claims.Email) |
||||
if err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to generate TOTP key", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Internal server error.") |
||||
return |
||||
} |
||||
|
||||
secret = &storage.MFASecret{ |
||||
AuthenticatorID: authenticatorID, |
||||
Type: "TOTP", |
||||
Secret: generated.String(), |
||||
Confirmed: false, |
||||
CreatedAt: s.now(), |
||||
} |
||||
|
||||
if err := s.storage.UpdateUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) { |
||||
if old.MFASecrets == nil { |
||||
old.MFASecrets = make(map[string]*storage.MFASecret) |
||||
} |
||||
old.MFASecrets[authenticatorID] = secret |
||||
return old, nil |
||||
}); err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to store MFA secret", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Internal server error.") |
||||
return |
||||
} |
||||
} |
||||
|
||||
s.renderTOTPPage(secret, false, totpProvider.issuer, authReq.ConnectorID, w, r) |
||||
|
||||
case http.MethodPost: |
||||
if secret == nil || secret.Secret == "" { |
||||
s.renderError(r, w, http.StatusBadRequest, "MFA not enrolled.") |
||||
return |
||||
} |
||||
|
||||
code := r.FormValue("totp") |
||||
generated, err := otp.NewKeyFromURL(secret.Secret) |
||||
if err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to load TOTP key", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Internal server error.") |
||||
return |
||||
} |
||||
|
||||
if !totp.Validate(code, generated.Secret()) { |
||||
s.renderTOTPPage(secret, true, totpProvider.issuer, authReq.ConnectorID, w, r) |
||||
return |
||||
} |
||||
|
||||
// Mark MFA secret as confirmed.
|
||||
if !secret.Confirmed { |
||||
if err := s.storage.UpdateUserIdentity(ctx, authReq.Claims.UserID, authReq.ConnectorID, func(old storage.UserIdentity) (storage.UserIdentity, error) { |
||||
if s := old.MFASecrets[authenticatorID]; s != nil { |
||||
s.Confirmed = true |
||||
} |
||||
return old, nil |
||||
}); err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to confirm MFA secret", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Internal server error.") |
||||
return |
||||
} |
||||
} |
||||
|
||||
// Mark auth request as MFA-validated.
|
||||
if err := s.storage.UpdateAuthRequest(ctx, authReq.ID, func(old storage.AuthRequest) (storage.AuthRequest, error) { |
||||
old.MFAValidated = true |
||||
return old, nil |
||||
}); err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to update auth request", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Internal server error.") |
||||
return |
||||
} |
||||
|
||||
// Skip approval if configured.
|
||||
if s.skipApproval && !authReq.ForceApprovalPrompt { |
||||
authReq, err = s.storage.GetAuthRequest(ctx, authReq.ID) |
||||
if err != nil { |
||||
s.logger.ErrorContext(ctx, "failed to get finalized auth request", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Login error.") |
||||
return |
||||
} |
||||
s.sendCodeResponse(w, r, authReq) |
||||
return |
||||
} |
||||
|
||||
http.Redirect(w, r, returnURL, http.StatusSeeOther) |
||||
|
||||
default: |
||||
s.renderError(r, w, http.StatusBadRequest, "Unsupported request method.") |
||||
} |
||||
} |
||||
|
||||
func (s *Server) renderTOTPPage(secret *storage.MFASecret, lastFail bool, issuer, connectorID string, w http.ResponseWriter, r *http.Request) { |
||||
var qrCode string |
||||
if !secret.Confirmed { |
||||
var err error |
||||
qrCode, err = generateTOTPQRCode(secret.Secret) |
||||
if err != nil { |
||||
s.logger.ErrorContext(r.Context(), "failed to generate QR code", "err", err) |
||||
s.renderError(r, w, http.StatusInternalServerError, "Internal server error.") |
||||
return |
||||
} |
||||
} |
||||
if err := s.templates.totpVerify(r, w, r.URL.String(), issuer, connectorID, qrCode, lastFail); err != nil { |
||||
s.logger.ErrorContext(r.Context(), "server template error", "err", err) |
||||
} |
||||
} |
||||
|
||||
func generateTOTPQRCode(keyURL string) (string, error) { |
||||
generated, err := otp.NewKeyFromURL(keyURL) |
||||
if err != nil { |
||||
return "", fmt.Errorf("failed to load TOTP key: %w", err) |
||||
} |
||||
|
||||
qrCodeImage, err := generated.Image(300, 300) |
||||
if err != nil { |
||||
return "", fmt.Errorf("failed to generate TOTP QR code: %w", err) |
||||
} |
||||
|
||||
var buf bytes.Buffer |
||||
if err := png.Encode(&buf, qrCodeImage); err != nil { |
||||
return "", fmt.Errorf("failed to encode TOTP QR code: %w", err) |
||||
} |
||||
|
||||
return base64.StdEncoding.EncodeToString(buf.Bytes()), nil |
||||
} |
||||
|
||||
// mfaChainForClient returns the MFA chain for a client filtered by connector type,
|
||||
// falling back to the server's defaultMFAChain if the client has none.
|
||||
// Returns nil if no MFA is configured/applicable.
|
||||
func (s *Server) mfaChainForClient(ctx context.Context, clientID, connectorID string) ([]string, error) { |
||||
if len(s.mfaProviders) == 0 { |
||||
return nil, nil |
||||
} |
||||
|
||||
client, err := s.storage.GetClient(ctx, clientID) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
// nil means "not set" — fall back to default.
|
||||
// Explicit empty slice ([]string{}) means "no MFA" — don't fall back.
|
||||
source := client.MFAChain |
||||
if source == nil { |
||||
source = s.defaultMFAChain |
||||
} |
||||
|
||||
// Resolve connector type from connector ID.
|
||||
connectorType := s.getConnectorType(connectorID) |
||||
|
||||
var chain []string |
||||
for _, authID := range source { |
||||
provider, ok := s.mfaProviders[authID] |
||||
if ok && provider.EnabledForConnectorType(connectorType) { |
||||
chain = append(chain, authID) |
||||
} |
||||
} |
||||
return chain, nil |
||||
} |
||||
|
||||
// getConnectorType returns the type of the connector with the given ID.
|
||||
func (s *Server) getConnectorType(connectorID string) string { |
||||
conn, err := s.storage.GetConnector(context.Background(), connectorID) |
||||
if err != nil { |
||||
return "" |
||||
} |
||||
return conn.Type |
||||
} |
||||
@ -0,0 +1,5 @@
|
||||
export DEX_POSTGRES_DATABASE=dex |
||||
export DEX_POSTGRES_USER=postgres |
||||
export DEX_POSTGRES_PASSWORD=postgres |
||||
export DEX_POSTGRES_HOST=0.0.0.0 |
||||
export DEX_POSTGRES_PORT=5432 |
||||
@ -0,0 +1,35 @@
|
||||
{{ template "header.html" . }} |
||||
|
||||
<div class="theme-panel"> |
||||
<h2 class="theme-heading">Two-factor authentication</h2> |
||||
{{ if not (eq .QRCode "") }} |
||||
<p>Scan the QR code below using your authenticator app, then enter the code.</p> |
||||
<div style="text-align: center; margin: 1em 0;"> |
||||
<img src="data:image/png;base64,{{ .QRCode }}" alt="QR code" width="200" height="200"/> |
||||
</div> |
||||
{{ else }} |
||||
<p>Enter the code from your authenticator app for <b>{{ .Issuer }}</b>.</p> |
||||
{{ end }} |
||||
<form method="post" action="{{ .PostURL }}"> |
||||
<div class="theme-form-row"> |
||||
<div class="theme-form-label"> |
||||
<label for="totp">One-time code</label> |
||||
</div> |
||||
<input tabindex="1" required id="totp" name="totp" type="text" |
||||
inputmode="numeric" pattern="[0-9]*" maxlength="6" |
||||
autocomplete="one-time-code" |
||||
class="theme-form-input" placeholder="000000" |
||||
autofocus/> |
||||
</div> |
||||
|
||||
{{ if .Invalid }} |
||||
<div id="login-error" class="dex-error-box"> |
||||
Invalid code. Please try again. |
||||
</div> |
||||
{{ end }} |
||||
|
||||
<button tabindex="2" id="submit-login" type="submit" class="dex-btn theme-btn--primary">Verify</button> |
||||
</form> |
||||
</div> |
||||
|
||||
{{ template "footer.html" . }} |
||||
Loading…
Reference in new issue