sendnrw/rdpgw
2
0
Fork 0
mirror of https://github.com/bolkedebruin/rdpgw.git synced 2026-03-30 15:36:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Working basic auth

Browse Source
This commit is contained in:
Bolke de Bruin
2022-08-25 10:58:23 +02:00
parent 69bcf81230
commit 0901a117c9
4 changed files with 31 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/rdpgw/api/basic.go
View File

@@ -33,7 +33,7 @@ func (c *Config) BasicAuth(next http.HandlerFunc) http.HandlerFunc {
defer conn.Close() defer conn.Close()
c := auth.NewAuthenticateClient(conn) c := auth.NewAuthenticateClient(conn)
ctx, cancel := context.WithTimeout(context.Background(), time.Second) ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
defer cancel() defer cancel()
req := &auth.UserPass{Username: username, Password: password} req := &auth.UserPass{Username: username, Password: password}

19
cmd/rdpgw/main.go
View File

@@ -44,8 +44,6 @@ func main() {
// configure api // configure api
api := &api.Config{ api := &api.Config{
PAATokenGenerator: security.GeneratePAAToken,
UserTokenGenerator: security.GenerateUserToken,
QueryInfo: security.QueryInfo, QueryInfo: security.QueryInfo,
QueryTokenIssuer: conf.Security.QueryTokenIssuer, QueryTokenIssuer: conf.Security.QueryTokenIssuer,
EnableUserToken: conf.Security.EnableUserToken, EnableUserToken: conf.Security.EnableUserToken,
@@ -64,6 +62,13 @@ func main() {
Authentication: conf.Server.Authentication, Authentication: conf.Server.Authentication,
} }
if conf.Caps.TokenAuth {
api.PAATokenGenerator = security.GeneratePAAToken
}
if conf.Security.EnableUserToken {
api.UserTokenGenerator = security.GenerateUserToken
}
if conf.Server.Authentication == "openid" { if conf.Server.Authentication == "openid" {
// set oidc config // set oidc config
provider, err := oidc.NewProvider(context.Background(), conf.OpenId.ProviderUrl) provider, err := oidc.NewProvider(context.Background(), conf.OpenId.ProviderUrl)
@@ -144,10 +149,12 @@ func main() {
DisableAll: conf.Caps.DisableRedirect, DisableAll: conf.Caps.DisableRedirect,
EnableAll: conf.Caps.RedirectAll, EnableAll: conf.Caps.RedirectAll,
}, },
VerifyTunnelCreate: security.VerifyPAAToken, SendBuf: conf.Server.SendBuf,
VerifyServerFunc: security.VerifyServerFunc, ReceiveBuf: conf.Server.ReceiveBuf,
SendBuf: conf.Server.SendBuf, }
ReceiveBuf: conf.Server.ReceiveBuf, if conf.Caps.TokenAuth {
handlerConfig.VerifyTunnelAuthFunc = security.VerifyPAAToken
handlerConfig.VerifyServerFunc = security.VerifyServerFunc
} }
gw := protocol.Gateway{ gw := protocol.Gateway{
ServerConf: &handlerConfig, ServerConf: &handlerConfig,

13
cmd/rdpgw/protocol/server.go
View File

@@ -78,8 +78,8 @@ func (s *Server) Process(ctx context.Context) error {
s.Session.TransportOut.WritePacket(msg) s.Session.TransportOut.WritePacket(msg)
return fmt.Errorf("%x: wrong state", E_PROXY_INTERNALERROR) return fmt.Errorf("%x: wrong state", E_PROXY_INTERNALERROR)
} }
major, minor, _, auth := s.handshakeRequest(pkt) // todo check if auth matches what the handler can do major, minor, _, reqAuth := s.handshakeRequest(pkt)
caps, err := s.matchAuth(auth) caps, err := s.matchAuth(reqAuth)
if err != nil { if err != nil {
log.Println(err) log.Println(err)
msg := s.handshakeResponse(0x0, 0x0, 0, E_PROXY_CAPABILITYMISMATCH) msg := s.handshakeResponse(0x0, 0x0, 0, E_PROXY_CAPABILITYMISMATCH)
@@ -224,7 +224,7 @@ func (s *Server) handshakeRequest(data []byte) (major byte, minor byte, version
return return
} }
func (s *Server) matchAuth(extAuth uint16) (caps uint16, err error) { func (s *Server) matchAuth(clientAuthCaps uint16) (caps uint16, err error) {
if s.SmartCardAuth { if s.SmartCardAuth {
caps = caps | HTTP_EXTENDED_AUTH_SC caps = caps | HTTP_EXTENDED_AUTH_SC
} }
@@ -232,10 +232,13 @@ func (s *Server) matchAuth(extAuth uint16) (caps uint16, err error) {
caps = caps | HTTP_EXTENDED_AUTH_PAA caps = caps | HTTP_EXTENDED_AUTH_PAA
} }
if caps & extAuth == 0 && extAuth > 0 { if caps&clientAuthCaps == 0 && clientAuthCaps > 0 {
return 0, fmt.Errorf("%x has no matching capability configured (%x). Did you configure caps? ", extAuth, caps) return 0, fmt.Errorf("%x has no matching capability configured (%x). Did you configure caps? ", clientAuthCaps, caps)
} }
if caps > 0 && clientAuthCaps == 0 {
return 0, fmt.Errorf("%d caps are required by the server, but the client does not support them", caps)
}
return caps, nil return caps, nil
} }

9
cmd/rdpgw/security/jwt.go
View File

@@ -34,7 +34,16 @@ type customClaims struct {
} }
func VerifyPAAToken(ctx context.Context, tokenString string) (bool, error) { func VerifyPAAToken(ctx context.Context, tokenString string) (bool, error) {
if tokenString == "" {
log.Printf("no token to parse")
return false, errors.New("no token to parse")
}
token, err := jwt.ParseSigned(tokenString) token, err := jwt.ParseSigned(tokenString)
if err != nil {
log.Printf("cannot parse token due to: %s", err)
return false, err
}
// check if the signing algo matches what we expect // check if the signing algo matches what we expect
for _, header := range token.Headers { for _, header := range token.Headers {