ric/uptime-kuma
1
0
Fork 0
mirror of https://github.com/louislam/uptime-kuma.git synced 2024-11-23 14:54:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[feat] Adding RemoteUser authentication

Browse source
This commit is contained in:
Marc Hagen 2022-04-24 13:21:56 +02:00
parent 88b7c047a8
commit 86ee98e0e8
No known key found for this signature in database
6 changed files with 146 additions and 76 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
server/auth.js
View file

@ -7,6 +7,9 @@ const { loginRateLimiter, apiRateLimiter } = require("./rate-limiter");
const { Settings } = require("./settings");
const dayjs = require("dayjs");
const remoteAuthEnabled = process.env.REMOTE_AUTH_ENABLED || false;
const remoteAuthHeader = process.env.REMOTE_AUTH_HEADER || "Remote-User";
/**
* Login to web app
* @param {string} username Username to login with
@ -133,29 +136,40 @@ function userAuthorizer(username, password, callback) {
* @returns {Promise<void>}
*/
exports.basicAuth = async function (req, res, next) {
const disabledAuth = await setting("disableAuth");
if (remoteAuthEnabled) {
const remoteUser = req.headers[remoteAuthHeader.toLowerCase()];
if (remoteUser !== undefined) {
let user = await R.findOne("user", " username = ? AND active = 1 ", [ remoteUser ]);
if (user) {
next();
return;
}
}
}
if (!disabledAuth) {
const middleware = basicAuth({
authorizer: userAuthorizer,
authorizeAsync: true,
challenge: true,
});
const disabledAuth = await setting("disableAuth");
if (!disabledAuth) {
middleware(req, res, next);
} else {
next();
return;
}
next();
};
/**
* Use use API Key if API keys enabled, else use basic auth
* Use API Key if API keys enabled, else use basic auth
* @param {express.Request} req Express request object
* @param {express.Response} res Express response object
* @param {express.NextFunction} next Next handler in chain
* @returns {Promise<void>}
*/
exports.apiAuth = async function (req, res, next) {
exports.authMiddleware = async function (req, res, next) {
if (!await Settings.get("disableAuth")) {
let usingAPIKeys = await Settings.get("apiKeysEnabled");
let middleware;

11
server/model/user.js
View file

@ -48,6 +48,17 @@ class User extends BeanModel {
}, jwtSecret);
}
/**
* @param {number} userID ID of user to update
* @param {string} newUsername Users new username
* @returns {Promise<void>}
*/
static async updateUsername(userID, newUsername) {
await R.exec("UPDATE `user` SET username = ? WHERE id = ? ", [
newUsername,
userID
]);
}
}
module.exports = User;

26
server/server.js
View file

@ -104,12 +104,14 @@ log.debug("server", "Importing Background Jobs");
const { initBackgroundJobs, stopBackgroundJobs } = require("./jobs");
const { loginRateLimiter, twoFaRateLimiter } = require("./rate-limiter");
const { apiAuth } = require("./auth");
const { authMiddleware } = require("./auth");
const { login } = require("./auth");
const passwordHash = require("./password-hash");
const hostname = config.hostname;
const remoteAuthEnabled = process.env.REMOTE_AUTH_ENABLED || false;
const remoteAuthHeader = process.env.REMOTE_AUTH_HEADER || "Remote-User";
const hostname = config.hostname;
if (hostname) {
log.info("server", "Custom hostname: " + hostname);
}
@ -262,7 +264,7 @@ let needSetup = false;
// Prometheus API metrics /metrics
// With Basic Auth using the first user's username/password
app.get("/metrics", apiAuth, prometheusAPIMetrics());
app.get("/metrics", authMiddleware, prometheusAPIMetrics());
app.use("/", expressStaticGzip("dist", {
enableBrotli: true,
@ -1538,10 +1540,26 @@ let needSetup = false;
// ***************************
log.debug("auth", "check auto login");
if (await setting("disableAuth")) {
if (await Settings.get("disableAuth")) {
log.info("auth", "Disabled Auth: auto login to admin");
await afterLogin(socket, await R.findOne("user"));
socket.emit("autoLogin");
} else if (remoteAuthEnabled) {
log.debug("auth", socket.handshake.headers);
const remoteUser = socket.handshake.headers[remoteAuthHeader.toLowerCase()];
if (remoteUser !== undefined) {
const user = await R.findOne("user", " username = ? AND active = 1 ", [ remoteUser ]);
if (user) {
log.info("auth", `Login by remote-user header. IP=${await server.getClientIP(socket)}`);
log.debug("auth", `Remote user ${remoteUser} exists, found user ${user.username}`);
afterLogin(socket, user);
socket.emit("autoLoginRemoteHeader", user.username);
} else {
log.debug("auth", `Remote user ${remoteUser} doesn't exist`);
}
} else {
log.debug("auth", "Remote user header set but not found in headers");
}
} else {
socket.emit("loginRequired");
log.debug("auth", "need auth");

7
src/components/settings/Security.vue
View file

@ -5,9 +5,9 @@
<template v-if="!settings.disableAuth">
<p>
{{ $t("Current User") }}: <strong>{{ $root.username }}</strong>
<button v-if="! settings.disableAuth" id="logout-btn" class="btn btn-danger ms-4 me-2 mb-2" @click="$root.logout">{{ $t("Logout") }}</button>
<button v-if="$root.socket.token.startsWith('autoLogin') === false" id="logout-btn" class="btn btn-danger ms-4 me-2 mb-2" @click="$root.logout">{{ $t("Logout") }}</button>
</p>
<template v-if="$root.socket.token.startsWith('autoLogin') === false">
<h5 class="my-4 settings-subheading">{{ $t("Change Password") }}</h5>
<form class="mb-3" @submit.prevent="savePassword">
<div class="mb-3">
@ -63,8 +63,9 @@
</div>
</form>
</template>
</template>
<div v-if="! settings.disableAuth" class="mt-5 mb-3">
<div v-if="$root.socket.token.startsWith('autoLogin') === false" class="mt-5 mb-3">
<h5 class="my-4 settings-subheading">
{{ $t("Two Factor Authentication") }}
</h5>

2
src/layouts/Layout.vue
View file

@ -69,7 +69,7 @@
</a>
</li>
<li v-if="$root.loggedIn && $root.socket.token !== 'autoLogin'">
<li v-if="$root.loggedIn && $root.socket.token.startsWith('autoLogin') === false">
<button class="dropdown-item" @click="$root.logout">
<font-awesome-icon icon="sign-out-alt" />
{{ $t("Logout") }}

32
src/mixins/socket.js
View file

@ -118,17 +118,25 @@ export default {
this.info = info;
});
socket.on("setup", (monitorID, data) => {
socket.on("setup", () => {
this.$router.push("/setup");
});
socket.on("autoLogin", (monitorID, data) => {
socket.on("autoLogin", () => {
this.loggedIn = true;
this.storage().token = "autoLogin";
this.socket.token = "autoLogin";
this.allowLoginDialog = false;
});
socket.on("autoLoginRemoteHeader", (username) => {
this.loggedIn = true;
this.username = username;
this.storage().token = "autoLoginRemoteHeader";
this.socket.token = "autoLoginRemoteHeader";
this.allowLoginDialog = false;
});
socket.on("loginRequired", () => {
let token = this.storage().token;
if (token && token !== "autoLogin") {
@ -266,6 +274,24 @@ export default {
this.clearData();
}
let token = this.storage().token;
if (token) {
if (token.startsWith("autoLogin") === false) {
this.loginByToken(token);
} else {
// Timeout if it is not actually auto login
setTimeout(() => {
if (! this.loggedIn) {
this.allowLoginDialog = true;
this.$root.storage().removeItem("token");
}
}, 5000);
}
} else {
this.allowLoginDialog = true;
}
this.socket.firstConnect = false;
});
@ -300,7 +326,7 @@ export default {
getJWTPayload() {
const jwtToken = this.$root.storage().token;
if (jwtToken && jwtToken !== "autoLogin") {
if (jwtToken && jwtToken.startsWith("autoLogin") === false) {
return jwtDecode(jwtToken);
}
return undefined;