sasler

package main

import (
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	auth := myAnonymousAuthenticator{}
	mech := sasler.AnonymousServer("anonymous-user", &auth)

	// ANONYMOUS expects one message from the client
	_, err := mech.Data([]byte("user@example.com"))
	if err != nil {
		fmt.Println(err)
	}

	// Retrieve authorized identity
	completed, authz := mech.HasCompleted()
	if completed {
		fmt.Println("Authorized identity:", authz)
		fmt.Println("Stored trace:", auth.trace)
	}

}

// myAnonymousAuthenciator is an example AnonymousAuthenticator that just
// stores the latest retrieve trace information in a field.
type myAnonymousAuthenticator struct {
	trace string
}

// StoreTrace stores the received trace information in a field of a.
func (a *myAnonymousAuthenticator) StoreTrace(trace string) {
	a.trace = trace
}

Output:

Authorized identity: anonymous-user
Stored trace: user@example.com

package main

import (
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	// SelectClientMech() represents a function that returns a ClientMech
	mech := SelectClientMech()
	mechName, clientFirst := mech.Mech()

	// AuthenticateToServer() and all calls to Read() and Write() represent a
	// protocol-specific communication channel.
	server := AuthenticateToServer(mechName)

	// For client-first mechanisms, send the first message
	if clientFirst {
		data, err := mech.Data(nil)
		if err != nil {
			fmt.Println("Authentication aborted.", err)
			return
		}
		server.Write(data)
	}

	// Relay authentication data until error, Success or Failure
	for {
		command, data := server.Read()
		switch command {
		case Success:
			fmt.Println("Authentication succeeded.")
			return
		case Failure:
			fmt.Println("Authentication failed.")
			return
		case Data:
			data, err := mech.Data(data)
			if err != nil {
				fmt.Println("Authentication aborted.", err)
				return
			}
			server.Write(data)
		}
	}

}

func SelectClientMech() sasler.ClientMech { return sasler.ExternalClient("") }

type exampleServer struct{}

func AuthenticateToServer(mechName string) exampleServer { return exampleServer{} }

func (*exampleServer) Write(data []byte) {}

const (
	Data = iota
	Success
	Failure
)

func (*exampleServer) Read() (int, []byte) { return Success, nil }

Output:

Authentication succeeded.

package main

import (
	"crypto/ecdsa"
	"errors"
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	// EcdsaClientConn() represents a function that returns a client that has
	// requested authentication using the ECDSA-NIST256P-CHALLENGE mechanism.
	conn := EcdsaClientConn()
	auth := myEcdsaAuthenticator{}
	mech := sasler.EcdsaNist256pChallengeServer(&auth)

	// ECDSA-NIST256P-CHALLENGE requires a couple of messages to be exchanged
	// between client and server.
	for {
		data, err := mech.Data(conn.Read())
		if err != nil {
			// Abort() represents a function that uses a protocol-specific way to
			// signal to the client that authentication has failed.
			conn.Abort()
			fmt.Println(err)
			return
		}
		// Relay data from mech to client
		if data != nil {
			conn.Write(data)
		}
		// Test if the conversation has completed and show the authz
		completed, authz := mech.HasCompleted()
		if completed {
			// Success() represents a function that uses a protocol-specific way to
			// signal to the client that authentication has succeeded.
			conn.Success()
			fmt.Println("Authorized identity:", authz)
			return
		}
	}

}

// myEcdsaAuthenticator is an example EcdsaAuthenticator that accepts only a
// single username.
type myEcdsaAuthenticator struct{}

// GetPublicKey retrieves the public key, if authn is "user".
func (a *myEcdsaAuthenticator) GetPublicKey(authn string) (*ecdsa.PublicKey, error) {
	if authn != "user" {
		return nil, errors.New("unknown authn")
	}
	return RetrievePublicKey(authn), nil
}

// DeriveAuthz derives an authz from an authn.
func (a *myEcdsaAuthenticator) DeriveAuthz(authn string) string {
	return authn
}

// Authorize checks whether the authn is authorized to act on behalf of the
// authz. This implementation also allows anyone authenticated as Admin to be
// authorized for any identity.
func (a *myEcdsaAuthenticator) Authorize(authz, authn string) bool {
	return authz == authn || authn == "Admin"
}

Output:

Authorized identity: user

package main

import (
	"crypto/x509"
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	// TLSConn() represents a function that returns a *tls.Conn with a client
	// that has presented a client certificate and has requested authentication
	// using the EXTERNAL mechanism.
	certs := TLSConn().ConnectionState().PeerCertificates
	if len(certs) == 0 {
		fmt.Println("No client TLS certificate.")
		return
	}
	auth := myExternalAuthenticator{certs[0]}
	mech := sasler.ExternalServer(&auth)

	// EXTERNAL expects one message from the client
	_, err := mech.Data([]byte(""))
	if err != nil {
		fmt.Println(err)
	}

	// Retrieve authorized identity
	completed, authz := mech.HasCompleted()
	if completed {
		fmt.Println("Authorized identity:", authz)
	}

}

// myExternalAuthenticator is an example ExternalAuthenticator that accepts
// any authentication request when a certificate is present, because it assumes
// that connections to clients that present invalid or untrusted certificates
// have been denied.
type myExternalAuthenticator struct {
	cert *x509.Certificate
}

// DeriveAuthz derives an authz from the common name of the certificate.
func (a *myExternalAuthenticator) DeriveAuthz() string {
	return "cn=" + a.cert.Subject.CommonName
}

// Authorize checks whether the authz matches the common name of the
// certificate. This implementation also allows anyone authenticated as
// admin@example.com to be authorized for any identity.
func (a *myExternalAuthenticator) Authorize(authz string) bool {
	cn := a.cert.Subject.CommonName
	return authz == "cn="+cn || authz == "cn=admin@example.com"
}

Output:

Authorized identity: cn=user@example.com

package main

import (
	"bytes"
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	auth := myOAuthBearerAuthenticator{
		host:      "example.com",
		port:      143,
		signature: []byte("SiGNeD_By_auTHoRiTy"),
	}
	mech := sasler.OAuthBearerServer(&auth)

	// OAUTHBEARER expects one message from the client
	_, err := mech.Data([]byte("n,\x01host=example.com\x01port=143\x01auth=Bearer username,SiGNeD_By_auTHoRiTy\x01\x01"))
	if err != nil {
		fmt.Println(err)
	}

	// Retrieve authorized identity
	completed, authz := mech.HasCompleted()
	if completed {
		fmt.Println("Authorized identity:", authz)
	}

}

// myOAuthBearerAuthentication is an example OAuthBearerAuthentication that
// accepts only authentication requets for a specific host and port, signed by
// a static signature.
type myOAuthBearerAuthenticator struct {
	host      string
	port      int
	signature []byte
}

// VerifyToken verifies the host, port and signature of the provided token.
func (a *myOAuthBearerAuthenticator) VerifyToken(token []byte, host string, port int) bool {
	signature := bytes.Split(token, []byte(","))[1]
	return host == a.host && port == a.port && bytes.Equal(signature, a.signature)
}

// DeriveAuthz derives an authz from the token.
func (a *myOAuthBearerAuthenticator) DeriveAuthz(token []byte) string {
	return string(bytes.Split(token, []byte(","))[0])
}

// Authorize checks whether the authn in the token matches the authz. This
// implementation also allows anyone authenticated as Admin to be authorized
// for any identity.
func (a *myOAuthBearerAuthenticator) Authorize(authz string, token []byte) bool {
	authn := string(bytes.Split(token, []byte(","))[0])
	return authz == authn || authn == "Admin"
}

Output:

Authorized identity: username

package main

import (
	"bytes"
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	auth := myPlainAuthenticator{
		user:   "user",
		passwd: []byte("pencil"),
	}
	mech := sasler.PlainServer(&auth)

	// PLAIN expects one message from the client
	_, err := mech.Data([]byte("\x00user\x00pencil"))
	if err != nil {
		fmt.Println(err)
	}

	// Retrieve authorized identity
	completed, authz := mech.HasCompleted()
	if completed {
		fmt.Println("Authorized identity:", authz)
	}

}

// myPlainAuthenticator is an example PlainAuthenticator that accepts only a
// single username/password combination.
type myPlainAuthenticator struct {
	user   string
	passwd []byte
}

// VerifyPasswd verifies the username and password.
func (a *myPlainAuthenticator) VerifyPasswd(authn string, passwd []byte) bool {
	return authn == a.user && bytes.Equal(passwd, a.passwd)
}

// DeriveAuthz derives an authz from an authn.
func (a *myPlainAuthenticator) DeriveAuthz(authn string) string {
	return authn
}

// Authorize checks whether the authn is authorized to act on behalf of the
// authz. This implementation also allows anyone authenticatd as Admin to be
// authorized for any identity.
func (a *myPlainAuthenticator) Authorize(authz, authn string) bool {
	return authz == authn || authn == "Admin"
}

Output:

Authorized identity: user

package main

import (
	"errors"
	"fmt"

	"github.com/phedny/sasler"
)

func main() {
	// ScramClientConn() represents a function that returns a client that has
	// requested authentication using the SCRAM-SHA-1 mechanism.
	conn := ScramClientConn()
	auth := myScramAuthenticator{}
	mech, err := sasler.ScramSha1Server(&auth)
	if err != nil {
		fmt.Println(err)
		return
	}

	// SCRAM-* requires a couple of messages to be exchanged between client and
	// server.
	for {
		data, err := mech.Data(conn.Read())
		if err != nil {
			// Abort() represents a function that uses a protocol-specific way to
			// signal to the client that authentication has failed.
			conn.Abort()
			fmt.Println(err)
			return
		}
		// Relay data from mech to client
		if data != nil {
			conn.Write(data)
		}
		// Test if the conversation has completed and show the authz
		completed, authz := mech.HasCompleted()
		if completed {
			// Success() represents a function that uses a protocol-specific way to
			// signal to the client that authentication has succeeded.
			conn.Success()
			fmt.Println("Authorized identity:", authz)
			return
		}
	}

}

// myScramAuthenticator is an example ScramAuthenticator that accepts only a
// single username/password combination.
type myScramAuthenticator struct{}

// GetCredentials returns the credentials that belong to the requested authn.
func (a *myScramAuthenticator) GetCredentials(authn string) (passwd []byte, isSalted bool, salt []byte, iCount int, err error) {
	if authn != "user" {
		return nil, false, nil, 0, errors.New("unknown authn")
	}
	// passwd is stored in a database in salted form, which is recommended.
	passwd = []byte("\x1d\x96\xee:R\x9bZ_\x9eG\xc0\x1f\"\x9a,\xb8\xa6\xe1_}")
	// If a plaintext password is returned, return isSalted = false.
	isSalted = true
	// Both salt and iCount must be retrieved from database if isSalted = true,
	// otherwise they might be random. If salts are stored in the database, it is
	// recommended to use a different salt for every entry.
	salt = []byte("A%\xc2G\xe4:\xb1\xe9<m\xffv")
	iCount = 4096
	return
}

// DeriveAuthz derives an authz from an authn.
func (a *myScramAuthenticator) DeriveAuthz(authn string) string {
	return authn
}

// Authorize checks whether the authn is authorized to act on behalf of the
// authz. This implementation also allows anyone authenticated as Admin to be
// authorized for any identity.
func (a *myScramAuthenticator) Authorize(authz, authn string) bool {
	return authz == authn || authn == "Admin"
}

Output:

Authorized identity: user

// ClientConn() represents retrieving a connection with a client that
// initiated SASL authentication, including the mechanism name it requested.
mechName, conn := ClientConn()

// CreateMechanism() represents a function that returns a ServerMech based on
// the requested mechanism name.
mech := CreateMechanism(mechName)
_, clientFirst := mech.Mech()

// For server-first mechanisms, send the first message
if !clientFirst {
	data, err := mech.Data(nil)
	if err != nil {
		fmt.Println("Authentication aborted.")
		return
	}
	conn.Write(Data, data)
}

// Relay authentication data until error or completion
for {
	data := conn.Read()
	data, err := mech.Data(data)
	if err != nil {
		conn.Write(Failure, nil)
		switch err {
		case sasler.ErrAuthenticationFailed:
			fmt.Println("Authentication failed.")
		case sasler.ErrUnauthorized:
			fmt.Println("Unauthorized.")
		default:
			fmt.Println("Authentication aborted.", err)
		}
		return
	}
	if data != nil {
		conn.Write(Data, data)
	}
	completed, authz := mech.HasCompleted()
	if completed {
		conn.Write(Success, nil)
		fmt.Println("Authentication succeeded, authorised id:", authz)
		return
	}
}

Output:

Authentication succeeded, authorised id: username