467f7b1585
This adds standard OAuth2 client credentials and bearer token support as well as scope-based authorization checks for REST API clients. Note that this initial implementation should not be used in production and that the access token limit has not been implemented yet. Signed-off-by: Michael Mayer <michael@photoprism.app>
98 lines
2.3 KiB
Go
98 lines
2.3 KiB
Go
package authn
|
|
|
|
import (
|
|
"strings"
|
|
|
|
"github.com/photoprism/photoprism/pkg/clean"
|
|
"github.com/photoprism/photoprism/pkg/list"
|
|
"github.com/photoprism/photoprism/pkg/txt"
|
|
)
|
|
|
|
// ProviderType represents an authentication provider type.
|
|
type ProviderType string
|
|
|
|
// Authentication providers.
|
|
const (
|
|
ProviderDefault ProviderType = "default"
|
|
ProviderClient ProviderType = "client"
|
|
ProviderLocal ProviderType = "local"
|
|
ProviderLDAP ProviderType = "ldap"
|
|
ProviderLink ProviderType = "link"
|
|
ProviderNone ProviderType = "none"
|
|
ProviderUnknown ProviderType = ""
|
|
)
|
|
|
|
// RemoteProviders lists all remote auth providers.
|
|
var RemoteProviders = list.List{
|
|
string(ProviderLDAP),
|
|
}
|
|
|
|
// LocalProviders lists all local auth providers.
|
|
var LocalProviders = list.List{
|
|
string(ProviderLocal),
|
|
}
|
|
|
|
// IsRemote checks if the provider is external.
|
|
func (t ProviderType) IsRemote() bool {
|
|
return list.Contains(RemoteProviders, string(t))
|
|
}
|
|
|
|
// IsLocal checks if local authentication is possible.
|
|
func (t ProviderType) IsLocal() bool {
|
|
return list.Contains(LocalProviders, string(t))
|
|
}
|
|
|
|
// IsDefault checks if this is the default provider.
|
|
func (t ProviderType) IsDefault() bool {
|
|
return t.String() == ProviderDefault.String()
|
|
}
|
|
|
|
// String returns the provider identifier as a string.
|
|
func (t ProviderType) String() string {
|
|
switch t {
|
|
case "":
|
|
return string(ProviderDefault)
|
|
case "token":
|
|
return string(ProviderLink)
|
|
case "password":
|
|
return string(ProviderLocal)
|
|
default:
|
|
return string(t)
|
|
}
|
|
}
|
|
|
|
// Equal checks if the type matches.
|
|
func (t ProviderType) Equal(s string) bool {
|
|
return strings.EqualFold(s, t.String())
|
|
}
|
|
|
|
// NotEqual checks if the type is different.
|
|
func (t ProviderType) NotEqual(s string) bool {
|
|
return !t.Equal(s)
|
|
}
|
|
|
|
// Pretty returns the provider identifier in an easy-to-read format.
|
|
func (t ProviderType) Pretty() string {
|
|
switch t {
|
|
case ProviderLDAP:
|
|
return "LDAP/AD"
|
|
default:
|
|
return txt.UpperFirst(t.String())
|
|
}
|
|
}
|
|
|
|
// Provider casts a string to a normalized provider type.
|
|
func Provider(s string) ProviderType {
|
|
switch s {
|
|
case "", "-", "null", "nil", "0", "false":
|
|
return ProviderDefault
|
|
case "token", "url":
|
|
return ProviderLink
|
|
case "pass", "passwd", "password":
|
|
return ProviderLocal
|
|
case "ldap", "ad", "ldap/ad", "ldap\\ad":
|
|
return ProviderLDAP
|
|
default:
|
|
return ProviderType(clean.TypeLower(s))
|
|
}
|
|
}
|