2019-04-24 21:52:08 +00:00
|
|
|
package authentication
|
|
|
|
|
2020-05-04 19:39:25 +00:00
|
|
|
import (
|
|
|
|
"errors"
|
|
|
|
)
|
|
|
|
|
2020-04-20 21:03:38 +00:00
|
|
|
// Level is the type representing a level of authentication.
|
2019-04-24 21:52:08 +00:00
|
|
|
type Level int
|
|
|
|
|
|
|
|
const (
|
2020-04-20 21:03:38 +00:00
|
|
|
// NotAuthenticated if the user is not authenticated yet.
|
2019-04-24 21:52:08 +00:00
|
|
|
NotAuthenticated Level = iota
|
2020-04-20 21:03:38 +00:00
|
|
|
// OneFactor if the user has passed first factor only.
|
2019-04-24 21:52:08 +00:00
|
|
|
OneFactor Level = iota
|
2020-04-20 21:03:38 +00:00
|
|
|
// TwoFactor if the user has passed two factors.
|
2019-04-24 21:52:08 +00:00
|
|
|
TwoFactor Level = iota
|
|
|
|
)
|
|
|
|
|
2021-07-01 23:16:16 +00:00
|
|
|
const (
|
|
|
|
ldapSupportedExtensionAttribute = "supportedExtension"
|
2021-07-02 01:33:10 +00:00
|
|
|
ldapOIDPasswdModifyExtension = "1.3.6.1.4.1.4203.1.11.1" // http://oidref.com/1.3.6.1.4.1.4203.1.11.1
|
2021-07-01 23:16:16 +00:00
|
|
|
)
|
|
|
|
|
2022-05-02 01:51:38 +00:00
|
|
|
const (
|
|
|
|
ldapAttributeUnicodePwd = "unicodePwd"
|
|
|
|
ldapAttributeUserPassword = "userPassword"
|
|
|
|
)
|
|
|
|
|
2021-08-05 04:17:07 +00:00
|
|
|
const (
|
|
|
|
ldapPlaceholderInput = "{input}"
|
|
|
|
ldapPlaceholderDistinguishedName = "{dn}"
|
|
|
|
ldapPlaceholderUsername = "{username}"
|
|
|
|
)
|
|
|
|
|
2020-05-03 04:06:09 +00:00
|
|
|
// CryptAlgo the crypt representation of an algorithm used in the prefix of the hash.
|
|
|
|
type CryptAlgo string
|
|
|
|
|
2020-03-06 01:38:02 +00:00
|
|
|
const (
|
2020-04-20 21:03:38 +00:00
|
|
|
// HashingAlgorithmArgon2id Argon2id hash identifier.
|
2020-05-06 00:52:06 +00:00
|
|
|
HashingAlgorithmArgon2id CryptAlgo = argon2id
|
2020-04-20 21:03:38 +00:00
|
|
|
// HashingAlgorithmSHA512 SHA512 hash identifier.
|
2020-05-03 04:06:09 +00:00
|
|
|
HashingAlgorithmSHA512 CryptAlgo = "6"
|
2020-03-06 01:38:02 +00:00
|
|
|
)
|
|
|
|
|
2020-04-20 21:03:38 +00:00
|
|
|
// These are the default values from the upstream crypt module we use them to for GetInt
|
|
|
|
// and they need to be checked when updating github.com/simia-tech/crypt.
|
2020-03-06 01:38:02 +00:00
|
|
|
const (
|
|
|
|
HashingDefaultArgon2idTime = 1
|
|
|
|
HashingDefaultArgon2idMemory = 32 * 1024
|
|
|
|
HashingDefaultArgon2idParallelism = 4
|
|
|
|
HashingDefaultArgon2idKeyLength = 32
|
|
|
|
HashingDefaultSHA512Iterations = 5000
|
|
|
|
)
|
|
|
|
|
2020-04-20 21:03:38 +00:00
|
|
|
// HashingPossibleSaltCharacters represents valid hashing runes.
|
2021-11-11 09:13:32 +00:00
|
|
|
var HashingPossibleSaltCharacters = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/"
|
2020-05-02 16:20:40 +00:00
|
|
|
|
2020-05-04 19:39:25 +00:00
|
|
|
// ErrUserNotFound indicates the user wasn't found in the authentication backend.
|
|
|
|
var ErrUserNotFound = errors.New("user not found")
|
|
|
|
|
2020-05-06 00:52:06 +00:00
|
|
|
const argon2id = "argon2id"
|
2020-05-02 16:20:40 +00:00
|
|
|
const sha512 = "sha512"
|
|
|
|
|
|
|
|
const testPassword = "my;secure*password"
|
2020-05-08 03:38:22 +00:00
|
|
|
|
|
|
|
const fileAuthenticationMode = 0600
|
2020-12-03 05:23:52 +00:00
|
|
|
|
|
|
|
// OWASP recommends to escape some special characters.
|
|
|
|
// https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md
|
|
|
|
const specialLDAPRunes = ",#+<>;\"="
|