aboutsummaryrefslogtreecommitdiff
path: root/internal/auth
diff options
context:
space:
mode:
Diffstat (limited to 'internal/auth')
-rw-r--r--internal/auth/auth.go151
-rw-r--r--internal/auth/github/github.go50
-rw-r--r--internal/auth/ldap/README.md119
-rw-r--r--internal/auth/ldap/ldap.go328
-rw-r--r--internal/auth/pam/pam.go35
-rw-r--r--internal/auth/pam/pam_stub.go15
6 files changed, 698 insertions, 0 deletions
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
new file mode 100644
index 00000000..89fb1c46
--- /dev/null
+++ b/internal/auth/auth.go
@@ -0,0 +1,151 @@
+// Copyright 2014 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package auth
+
+import (
+ "strings"
+ "time"
+
+ "github.com/go-macaron/session"
+ gouuid "github.com/satori/go.uuid"
+ log "gopkg.in/clog.v1"
+ "gopkg.in/macaron.v1"
+
+ "gogs.io/gogs/internal/db"
+ "gogs.io/gogs/internal/db/errors"
+ "gogs.io/gogs/internal/setting"
+ "gogs.io/gogs/internal/tool"
+)
+
+func IsAPIPath(url string) bool {
+ return strings.HasPrefix(url, "/api/")
+}
+
+// SignedInID returns the id of signed in user, along with one bool value which indicates whether user uses token
+// authentication.
+func SignedInID(c *macaron.Context, sess session.Store) (_ int64, isTokenAuth bool) {
+ if !db.HasEngine {
+ return 0, false
+ }
+
+ // Check access token.
+ if IsAPIPath(c.Req.URL.Path) {
+ tokenSHA := c.Query("token")
+ if len(tokenSHA) <= 0 {
+ tokenSHA = c.Query("access_token")
+ }
+ if len(tokenSHA) == 0 {
+ // Well, check with header again.
+ auHead := c.Req.Header.Get("Authorization")
+ if len(auHead) > 0 {
+ auths := strings.Fields(auHead)
+ if len(auths) == 2 && auths[0] == "token" {
+ tokenSHA = auths[1]
+ }
+ }
+ }
+
+ // Let's see if token is valid.
+ if len(tokenSHA) > 0 {
+ t, err := db.GetAccessTokenBySHA(tokenSHA)
+ if err != nil {
+ if !db.IsErrAccessTokenNotExist(err) && !db.IsErrAccessTokenEmpty(err) {
+ log.Error(2, "GetAccessTokenBySHA: %v", err)
+ }
+ return 0, false
+ }
+ t.Updated = time.Now()
+ if err = db.UpdateAccessToken(t); err != nil {
+ log.Error(2, "UpdateAccessToken: %v", err)
+ }
+ return t.UID, true
+ }
+ }
+
+ uid := sess.Get("uid")
+ if uid == nil {
+ return 0, false
+ }
+ if id, ok := uid.(int64); ok {
+ if _, err := db.GetUserByID(id); err != nil {
+ if !errors.IsUserNotExist(err) {
+ log.Error(2, "GetUserByID: %v", err)
+ }
+ return 0, false
+ }
+ return id, false
+ }
+ return 0, false
+}
+
+// SignedInUser returns the user object of signed in user, along with two bool values,
+// which indicate whether user uses HTTP Basic Authentication or token authentication respectively.
+func SignedInUser(ctx *macaron.Context, sess session.Store) (_ *db.User, isBasicAuth bool, isTokenAuth bool) {
+ if !db.HasEngine {
+ return nil, false, false
+ }
+
+ uid, isTokenAuth := SignedInID(ctx, sess)
+
+ if uid <= 0 {
+ if setting.Service.EnableReverseProxyAuth {
+ webAuthUser := ctx.Req.Header.Get(setting.ReverseProxyAuthUser)
+ if len(webAuthUser) > 0 {
+ u, err := db.GetUserByName(webAuthUser)
+ if err != nil {
+ if !errors.IsUserNotExist(err) {
+ log.Error(2, "GetUserByName: %v", err)
+ return nil, false, false
+ }
+
+ // Check if enabled auto-registration.
+ if setting.Service.EnableReverseProxyAutoRegister {
+ u := &db.User{
+ Name: webAuthUser,
+ Email: gouuid.NewV4().String() + "@localhost",
+ Passwd: webAuthUser,
+ IsActive: true,
+ }
+ if err = db.CreateUser(u); err != nil {
+ // FIXME: should I create a system notice?
+ log.Error(2, "CreateUser: %v", err)
+ return nil, false, false
+ } else {
+ return u, false, false
+ }
+ }
+ }
+ return u, false, false
+ }
+ }
+
+ // Check with basic auth.
+ baHead := ctx.Req.Header.Get("Authorization")
+ if len(baHead) > 0 {
+ auths := strings.Fields(baHead)
+ if len(auths) == 2 && auths[0] == "Basic" {
+ uname, passwd, _ := tool.BasicAuthDecode(auths[1])
+
+ u, err := db.UserLogin(uname, passwd, -1)
+ if err != nil {
+ if !errors.IsUserNotExist(err) {
+ log.Error(2, "UserLogin: %v", err)
+ }
+ return nil, false, false
+ }
+
+ return u, true, false
+ }
+ }
+ return nil, false, false
+ }
+
+ u, err := db.GetUserByID(uid)
+ if err != nil {
+ log.Error(2, "GetUserByID: %v", err)
+ return nil, false, false
+ }
+ return u, false, isTokenAuth
+}
diff --git a/internal/auth/github/github.go b/internal/auth/github/github.go
new file mode 100644
index 00000000..a06608a3
--- /dev/null
+++ b/internal/auth/github/github.go
@@ -0,0 +1,50 @@
+// Copyright 2018 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package github
+
+import (
+ "context"
+ "crypto/tls"
+ "fmt"
+ "net/http"
+ "strings"
+
+ "github.com/google/go-github/github"
+)
+
+func Authenticate(apiEndpoint, login, passwd string) (name string, email string, website string, location string, _ error) {
+ tp := github.BasicAuthTransport{
+ Username: strings.TrimSpace(login),
+ Password: strings.TrimSpace(passwd),
+ Transport: &http.Transport{
+ TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+ },
+ }
+ client, err := github.NewEnterpriseClient(apiEndpoint, apiEndpoint, tp.Client())
+ if err != nil {
+ return "", "", "", "", fmt.Errorf("create new client: %v", err)
+ }
+ user, _, err := client.Users.Get(context.Background(), "")
+ if err != nil {
+ return "", "", "", "", fmt.Errorf("get user info: %v", err)
+ }
+
+ if user.Name != nil {
+ name = *user.Name
+ }
+ if user.Email != nil {
+ email = *user.Email
+ } else {
+ email = login + "+github@local"
+ }
+ if user.HTMLURL != nil {
+ website = strings.ToLower(*user.HTMLURL)
+ }
+ if user.Location != nil {
+ location = strings.ToUpper(*user.Location)
+ }
+
+ return name, email, website, location, nil
+}
diff --git a/internal/auth/ldap/README.md b/internal/auth/ldap/README.md
new file mode 100644
index 00000000..bc357e96
--- /dev/null
+++ b/internal/auth/ldap/README.md
@@ -0,0 +1,119 @@
+Gogs LDAP Authentication Module
+===============================
+
+## About
+
+This authentication module attempts to authorize and authenticate a user
+against an LDAP server. It provides two methods of authentication: LDAP via
+BindDN, and LDAP simple authentication.
+
+LDAP via BindDN functions like most LDAP authentication systems. First, it
+queries the LDAP server using a Bind DN and searches for the user that is
+attempting to sign in. If the user is found, the module attempts to bind to the
+server using the user's supplied credentials. If this succeeds, the user has
+been authenticated, and their account information is retrieved and passed to the
+Gogs login infrastructure.
+
+LDAP simple authentication does not utilize a Bind DN. Instead, it binds
+directly with the LDAP server using the user's supplied credentials. If the bind
+succeeds and no filter rules out the user, the user is authenticated.
+
+LDAP via BindDN is recommended for most users. By using a Bind DN, the server
+can perform authorization by restricting which entries the Bind DN account can
+read. Furthermore, using a Bind DN with reduced permissions can reduce security risk
+in the face of application bugs.
+
+## Usage
+
+To use this module, add an LDAP authentication source via the Authentications
+section in the admin panel. Both the LDAP via BindDN and the simple auth LDAP
+share the following fields:
+
+* Authorization Name **(required)**
+ * A name to assign to the new method of authorization.
+
+* Host **(required)**
+ * The address where the LDAP server can be reached.
+ * Example: mydomain.com
+
+* Port **(required)**
+ * The port to use when connecting to the server.
+ * Example: 636
+
+* Enable TLS Encryption (optional)
+ * Whether to use TLS when connecting to the LDAP server.
+
+* Admin Filter (optional)
+ * An LDAP filter specifying if a user should be given administrator
+ privileges. If a user accounts passes the filter, the user will be
+ privileged as an administrator.
+ * Example: (objectClass=adminAccount)
+
+* First name attribute (optional)
+ * The attribute of the user's LDAP record containing the user's first name.
+ This will be used to populate their account information.
+ * Example: givenName
+
+* Surname attribute (optional)
+ * The attribute of the user's LDAP record containing the user's surname This
+ will be used to populate their account information.
+ * Example: sn
+
+* E-mail attribute **(required)**
+ * The attribute of the user's LDAP record containing the user's email
+ address. This will be used to populate their account information.
+ * Example: mail
+
+**LDAP via BindDN** adds the following fields:
+
+* Bind DN (optional)
+ * The DN to bind to the LDAP server with when searching for the user. This
+ may be left blank to perform an anonymous search.
+ * Example: cn=Search,dc=mydomain,dc=com
+
+* Bind Password (optional)
+ * The password for the Bind DN specified above, if any. _Note: The password
+ is stored in plaintext at the server. As such, ensure that your Bind DN
+ has as few privileges as possible._
+
+* User Search Base **(required)**
+ * The LDAP base at which user accounts will be searched for.
+ * Example: ou=Users,dc=mydomain,dc=com
+
+* User Filter **(required)**
+ * An LDAP filter declaring how to find the user record that is attempting to
+ authenticate. The '%s' matching parameter will be substituted with the
+ user's username.
+ * Example: (&(objectClass=posixAccount)(uid=%s))
+
+**LDAP using simple auth** adds the following fields:
+
+* User DN **(required)**
+ * A template to use as the user's DN. The `%s` matching parameter will be
+ substituted with the user's username.
+ * Example: cn=%s,ou=Users,dc=mydomain,dc=com
+ * Example: uid=%s,ou=Users,dc=mydomain,dc=com
+
+* User Filter **(required)**
+ * An LDAP filter declaring when a user should be allowed to log in. The `%s`
+ matching parameter will be substituted with the user's username.
+ * Example: (&(objectClass=posixAccount)(cn=%s))
+ * Example: (&(objectClass=posixAccount)(uid=%s))
+
+**Verify group membership in LDAP** uses the following fields:
+
+* Group Search Base (optional)
+ * The LDAP DN used for groups.
+ * Example: ou=group,dc=mydomain,dc=com
+
+* Group Name Filter (optional)
+ * An LDAP filter declaring how to find valid groups in the above DN.
+ * Example: (|(cn=gogs_users)(cn=admins))
+
+* User Attribute in Group (optional)
+ * Which user LDAP attribute is listed in the group.
+ * Example: uid
+
+* Group Attribute for User (optional)
+ * Which group LDAP attribute contains an array above user attribute names.
+ * Example: memberUid
diff --git a/internal/auth/ldap/ldap.go b/internal/auth/ldap/ldap.go
new file mode 100644
index 00000000..e88cef77
--- /dev/null
+++ b/internal/auth/ldap/ldap.go
@@ -0,0 +1,328 @@
+// Copyright 2014 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+// Package ldap provide functions & structure to query a LDAP ldap directory
+// For now, it's mainly tested again an MS Active Directory service, see README.md for more information
+package ldap
+
+import (
+ "crypto/tls"
+ "fmt"
+ "strings"
+
+ log "gopkg.in/clog.v1"
+ "gopkg.in/ldap.v2"
+)
+
+type SecurityProtocol int
+
+// Note: new type must be added at the end of list to maintain compatibility.
+const (
+ SECURITY_PROTOCOL_UNENCRYPTED SecurityProtocol = iota
+ SECURITY_PROTOCOL_LDAPS
+ SECURITY_PROTOCOL_START_TLS
+)
+
+// Basic LDAP authentication service
+type Source struct {
+ Host string // LDAP host
+ Port int // port number
+ SecurityProtocol SecurityProtocol
+ SkipVerify bool
+ BindDN string `ini:"bind_dn,omitempty"` // DN to bind with
+ BindPassword string `ini:",omitempty"` // Bind DN password
+ UserBase string `ini:",omitempty"` // Base search path for users
+ UserDN string `ini:"user_dn,omitempty"` // Template for the DN of the user for simple auth
+ AttributeUsername string // Username attribute
+ AttributeName string // First name attribute
+ AttributeSurname string // Surname attribute
+ AttributeMail string // E-mail attribute
+ AttributesInBind bool // fetch attributes in bind context (not user)
+ Filter string // Query filter to validate entry
+ AdminFilter string // Query filter to check if user is admin
+ GroupEnabled bool // if the group checking is enabled
+ GroupDN string `ini:"group_dn"` // Group Search Base
+ GroupFilter string // Group Name Filter
+ GroupMemberUID string `ini:"group_member_uid"` // Group Attribute containing array of UserUID
+ UserUID string `ini:"user_uid"` // User Attribute listed in Group
+}
+
+func (ls *Source) sanitizedUserQuery(username string) (string, bool) {
+ // See http://tools.ietf.org/search/rfc4515
+ badCharacters := "\x00()*\\"
+ if strings.ContainsAny(username, badCharacters) {
+ log.Trace("LDAP: Username contains invalid query characters: %s", username)
+ return "", false
+ }
+
+ return strings.Replace(ls.Filter, "%s", username, -1), true
+}
+
+func (ls *Source) sanitizedUserDN(username string) (string, bool) {
+ // See http://tools.ietf.org/search/rfc4514: "special characters"
+ badCharacters := "\x00()*\\,='\"#+;<>"
+ if strings.ContainsAny(username, badCharacters) || strings.HasPrefix(username, " ") || strings.HasSuffix(username, " ") {
+ log.Trace("LDAP: Username contains invalid query characters: %s", username)
+ return "", false
+ }
+
+ return strings.Replace(ls.UserDN, "%s", username, -1), true
+}
+
+func (ls *Source) sanitizedGroupFilter(group string) (string, bool) {
+ // See http://tools.ietf.org/search/rfc4515
+ badCharacters := "\x00*\\"
+ if strings.ContainsAny(group, badCharacters) {
+ log.Trace("LDAP: Group filter invalid query characters: %s", group)
+ return "", false
+ }
+
+ return group, true
+}
+
+func (ls *Source) sanitizedGroupDN(groupDn string) (string, bool) {
+ // See http://tools.ietf.org/search/rfc4514: "special characters"
+ badCharacters := "\x00()*\\'\"#+;<>"
+ if strings.ContainsAny(groupDn, badCharacters) || strings.HasPrefix(groupDn, " ") || strings.HasSuffix(groupDn, " ") {
+ log.Trace("LDAP: Group DN contains invalid query characters: %s", groupDn)
+ return "", false
+ }
+
+ return groupDn, true
+}
+
+func (ls *Source) findUserDN(l *ldap.Conn, name string) (string, bool) {
+ log.Trace("Search for LDAP user: %s", name)
+ if len(ls.BindDN) > 0 && len(ls.BindPassword) > 0 {
+ // Replace placeholders with username
+ bindDN := strings.Replace(ls.BindDN, "%s", name, -1)
+ err := l.Bind(bindDN, ls.BindPassword)
+ if err != nil {
+ log.Trace("LDAP: Failed to bind as BindDN '%s': %v", bindDN, err)
+ return "", false
+ }
+ log.Trace("LDAP: Bound as BindDN: %s", bindDN)
+ } else {
+ log.Trace("LDAP: Proceeding with anonymous LDAP search")
+ }
+
+ // A search for the user.
+ userFilter, ok := ls.sanitizedUserQuery(name)
+ if !ok {
+ return "", false
+ }
+
+ log.Trace("LDAP: Searching for DN using filter '%s' and base '%s'", userFilter, ls.UserBase)
+ search := ldap.NewSearchRequest(
+ ls.UserBase, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0,
+ false, userFilter, []string{}, nil)
+
+ // Ensure we found a user
+ sr, err := l.Search(search)
+ if err != nil || len(sr.Entries) < 1 {
+ log.Trace("LDAP: Failed search using filter '%s': %v", userFilter, err)
+ return "", false
+ } else if len(sr.Entries) > 1 {
+ log.Trace("LDAP: Filter '%s' returned more than one user", userFilter)
+ return "", false
+ }
+
+ userDN := sr.Entries[0].DN
+ if userDN == "" {
+ log.Error(2, "LDAP: Search was successful, but found no DN!")
+ return "", false
+ }
+
+ return userDN, true
+}
+
+func dial(ls *Source) (*ldap.Conn, error) {
+ log.Trace("LDAP: Dialing with security protocol '%v' without verifying: %v", ls.SecurityProtocol, ls.SkipVerify)
+
+ tlsCfg := &tls.Config{
+ ServerName: ls.Host,
+ InsecureSkipVerify: ls.SkipVerify,
+ }
+ if ls.SecurityProtocol == SECURITY_PROTOCOL_LDAPS {
+ return ldap.DialTLS("tcp", fmt.Sprintf("%s:%d", ls.Host, ls.Port), tlsCfg)
+ }
+
+ conn, err := ldap.Dial("tcp", fmt.Sprintf("%s:%d", ls.Host, ls.Port))
+ if err != nil {
+ return nil, fmt.Errorf("Dial: %v", err)
+ }
+
+ if ls.SecurityProtocol == SECURITY_PROTOCOL_START_TLS {
+ if err = conn.StartTLS(tlsCfg); err != nil {
+ conn.Close()
+ return nil, fmt.Errorf("StartTLS: %v", err)
+ }
+ }
+
+ return conn, nil
+}
+
+func bindUser(l *ldap.Conn, userDN, passwd string) error {
+ log.Trace("Binding with userDN: %s", userDN)
+ err := l.Bind(userDN, passwd)
+ if err != nil {
+ log.Trace("LDAP authentication failed for '%s': %v", userDN, err)
+ return err
+ }
+ log.Trace("Bound successfully with userDN: %s", userDN)
+ return err
+}
+
+// searchEntry : search an LDAP source if an entry (name, passwd) is valid and in the specific filter
+func (ls *Source) SearchEntry(name, passwd string, directBind bool) (string, string, string, string, bool, bool) {
+ // See https://tools.ietf.org/search/rfc4513#section-5.1.2
+ if len(passwd) == 0 {
+ log.Trace("authentication failed for '%s' with empty password", name)
+ return "", "", "", "", false, false
+ }
+ l, err := dial(ls)
+ if err != nil {
+ log.Error(2, "LDAP connect failed for '%s': %v", ls.Host, err)
+ return "", "", "", "", false, false
+ }
+ defer l.Close()
+
+ var userDN string
+ if directBind {
+ log.Trace("LDAP will bind directly via UserDN template: %s", ls.UserDN)
+
+ var ok bool
+ userDN, ok = ls.sanitizedUserDN(name)
+ if !ok {
+ return "", "", "", "", false, false
+ }
+ } else {
+ log.Trace("LDAP will use BindDN")
+
+ var found bool
+ userDN, found = ls.findUserDN(l, name)
+ if !found {
+ return "", "", "", "", false, false
+ }
+ }
+
+ if directBind || !ls.AttributesInBind {
+ // binds user (checking password) before looking-up attributes in user context
+ err = bindUser(l, userDN, passwd)
+ if err != nil {
+ return "", "", "", "", false, false
+ }
+ }
+
+ userFilter, ok := ls.sanitizedUserQuery(name)
+ if !ok {
+ return "", "", "", "", false, false
+ }
+
+ log.Trace("Fetching attributes '%v', '%v', '%v', '%v', '%v' with filter '%s' and base '%s'",
+ ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail, ls.UserUID, userFilter, userDN)
+ search := ldap.NewSearchRequest(
+ userDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, userFilter,
+ []string{ls.AttributeUsername, ls.AttributeName, ls.AttributeSurname, ls.AttributeMail, ls.UserUID},
+ nil)
+
+ sr, err := l.Search(search)
+ if err != nil {
+ log.Error(2, "LDAP: User search failed: %v", err)
+ return "", "", "", "", false, false
+ } else if len(sr.Entries) < 1 {
+ if directBind {
+ log.Trace("LDAP: User filter inhibited user login")
+ } else {
+ log.Trace("LDAP: User search failed: 0 entries")
+ }
+
+ return "", "", "", "", false, false
+ }
+
+ username := sr.Entries[0].GetAttributeValue(ls.AttributeUsername)
+ firstname := sr.Entries[0].GetAttributeValue(ls.AttributeName)
+ surname := sr.Entries[0].GetAttributeValue(ls.AttributeSurname)
+ mail := sr.Entries[0].GetAttributeValue(ls.AttributeMail)
+ uid := sr.Entries[0].GetAttributeValue(ls.UserUID)
+
+ // Check group membership
+ if ls.GroupEnabled {
+ groupFilter, ok := ls.sanitizedGroupFilter(ls.GroupFilter)
+ if !ok {
+ return "", "", "", "", false, false
+ }
+ groupDN, ok := ls.sanitizedGroupDN(ls.GroupDN)
+ if !ok {
+ return "", "", "", "", false, false
+ }
+
+ log.Trace("LDAP: Fetching groups '%v' with filter '%s' and base '%s'", ls.GroupMemberUID, groupFilter, groupDN)
+ groupSearch := ldap.NewSearchRequest(
+ groupDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, groupFilter,
+ []string{ls.GroupMemberUID},
+ nil)
+
+ srg, err := l.Search(groupSearch)
+ if err != nil {
+ log.Error(2, "LDAP: Group search failed: %v", err)
+ return "", "", "", "", false, false
+ } else if len(srg.Entries) < 1 {
+ log.Trace("LDAP: Group search returned no entries")
+ return "", "", "", "", false, false
+ }
+
+ isMember := false
+ if ls.UserUID == "dn" {
+ for _, group := range srg.Entries {
+ for _, member := range group.GetAttributeValues(ls.GroupMemberUID) {
+ if member == sr.Entries[0].DN {
+ isMember = true
+ }
+ }
+ }
+ } else {
+ for _, group := range srg.Entries {
+ for _, member := range group.GetAttributeValues(ls.GroupMemberUID) {
+ if member == uid {
+ isMember = true
+ }
+ }
+ }
+ }
+
+ if !isMember {
+ log.Trace("LDAP: Group membership test failed [username: %s, group_member_uid: %s, user_uid: %s", username, ls.GroupMemberUID, uid)
+ return "", "", "", "", false, false
+ }
+ }
+
+ isAdmin := false
+ if len(ls.AdminFilter) > 0 {
+ log.Trace("Checking admin with filter '%s' and base '%s'", ls.AdminFilter, userDN)
+ search = ldap.NewSearchRequest(
+ userDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, ls.AdminFilter,
+ []string{ls.AttributeName},
+ nil)
+
+ sr, err = l.Search(search)
+ if err != nil {
+ log.Error(2, "LDAP: Admin search failed: %v", err)
+ } else if len(sr.Entries) < 1 {
+ log.Trace("LDAP: Admin search returned no entries")
+ } else {
+ isAdmin = true
+ }
+ }
+
+ if !directBind && ls.AttributesInBind {
+ // binds user (checking password) after looking-up attributes in BindDN context
+ err = bindUser(l, userDN, passwd)
+ if err != nil {
+ return "", "", "", "", false, false
+ }
+ }
+
+ return username, firstname, surname, mail, isAdmin, true
+}
diff --git a/internal/auth/pam/pam.go b/internal/auth/pam/pam.go
new file mode 100644
index 00000000..7f326d42
--- /dev/null
+++ b/internal/auth/pam/pam.go
@@ -0,0 +1,35 @@
+// +build pam
+
+// Copyright 2014 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package pam
+
+import (
+ "errors"
+
+ "github.com/msteinert/pam"
+)
+
+func PAMAuth(serviceName, userName, passwd string) error {
+ t, err := pam.StartFunc(serviceName, userName, func(s pam.Style, msg string) (string, error) {
+ switch s {
+ case pam.PromptEchoOff:
+ return passwd, nil
+ case pam.PromptEchoOn, pam.ErrorMsg, pam.TextInfo:
+ return "", nil
+ }
+ return "", errors.New("Unrecognized PAM message style")
+ })
+
+ if err != nil {
+ return err
+ }
+
+ if err = t.Authenticate(0); err != nil {
+ return err
+ }
+
+ return nil
+}
diff --git a/internal/auth/pam/pam_stub.go b/internal/auth/pam/pam_stub.go
new file mode 100644
index 00000000..33ac751a
--- /dev/null
+++ b/internal/auth/pam/pam_stub.go
@@ -0,0 +1,15 @@
+// +build !pam
+
+// Copyright 2014 The Gogs Authors. All rights reserved.
+// Use of this source code is governed by a MIT-style
+// license that can be found in the LICENSE file.
+
+package pam
+
+import (
+ "errors"
+)
+
+func PAMAuth(serviceName, userName, passwd string) error {
+ return errors.New("PAM not supported")
+}
Powered by cgit, Themed by Ted Yin.