Started work on OAuth support.
Ylian Saint-Hilaire committed
May 13, 2020 at 20:49 UTC
906d43d367fa63019ad8dfdda02cdfda1eab05e5
42 files changed
+107
-4
MeshCentralServer.njsproj
+2
@@ -502,6 +502,7 @@
502
<Folder Include="typings\globals\node-forge\" />
503
<Folder Include="typings\globals\nodemailer\" />
504
<Folder Include="typings\globals\node\" />
505
+ <Folder Include="typings\globals\passport\" />
506
<Folder Include="views\" />
507
</ItemGroup>
508
<ItemGroup>
@@ -512,6 +513,7 @@
513
<TypeScriptCompile Include="typings\globals\node-forge\index.d.ts" />
514
<TypeScriptCompile Include="typings\globals\nodemailer\index.d.ts" />
515
<TypeScriptCompile Include="typings\globals\node\index.d.ts" />
516
+ <TypeScriptCompile Include="typings\globals\passport\index.d.ts" />
517
<TypeScriptCompile Include="typings\index.d.ts" />
518
</ItemGroup>
519
<Import Project="$(MSBuildToolsPath)\Microsoft.Common.targets" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/MeshService-signed.exe
Binary files a/agents/MeshService-signed.exe and b/agents/MeshService-signed.exe differ
agents/MeshService.exe
Binary files a/agents/MeshService.exe and b/agents/MeshService.exe differ
agents/MeshService64-signed.exe
Binary files a/agents/MeshService64-signed.exe and b/agents/MeshService64-signed.exe differ
agents/MeshService64.exe
Binary files a/agents/MeshService64.exe and b/agents/MeshService64.exe differ
agents/agents-new/MeshCmd-signed.exe
Binary files /dev/null and b/agents/agents-new/MeshCmd-signed.exe differ
agents/agents-new/MeshCmd64-signed.exe
Binary files /dev/null and b/agents/agents-new/MeshCmd64-signed.exe differ
agents/agents-new/MeshService-signed.exe
Binary files /dev/null and b/agents/agents-new/MeshService-signed.exe differ
agents/agents-new/MeshService.exe
Binary files /dev/null and b/agents/agents-new/MeshService.exe differ
agents/agents-new/MeshService64-signed.exe
Binary files /dev/null and b/agents/agents-new/MeshService64-signed.exe differ
agents/agents-new/MeshService64.exe
Binary files /dev/null and b/agents/agents-new/MeshService64.exe differ
agents/agents-old/MeshCmd-signed.exe
Binary files /dev/null and b/agents/agents-old/MeshCmd-signed.exe differ
agents/agents-old/MeshCmd64-signed.exe
Binary files /dev/null and b/agents/agents-old/MeshCmd64-signed.exe differ
agents/agents-old/MeshService-signed.exe
Binary files /dev/null and b/agents/agents-old/MeshService-signed.exe differ
agents/agents-old/MeshService.exe
Binary files /dev/null and b/agents/agents-old/MeshService.exe differ
agents/agents-old/MeshService64-signed.exe
Binary files /dev/null and b/agents/agents-old/MeshService64-signed.exe differ
agents/agents-old/MeshService64.exe
Binary files /dev/null and b/agents/agents-old/MeshService64.exe differ
agents/agents-old/meshagent_arm
renamed
agents/agents-old/meshagent_arm-linaro
renamed
agents/agents-old/meshagent_arm64
renamed
agents/agents-old/meshagent_armhf
renamed
agents/agents-old/meshagent_freebsd_x86-64
renamed
agents/agents-old/meshagent_mips
renamed
agents/agents-old/meshagent_osx-x86-64
renamed
agents/agents-old/meshagent_pogo
renamed
agents/agents-old/meshagent_poky
renamed
agents/agents-old/meshagent_poky64
renamed
agents/agents-old/meshagent_x86
renamed
agents/agents-old/meshagent_x86-64
renamed
agents/agents-old/meshagent_x86-64_nokvm
renamed
agents/agents-old/meshagent_x86_nokvm
renamed
meshcentral.js
+9
-1
@@ -2537,9 +2537,10 @@ function mainStart() {
2537
// Lowercase the auth value if present
2538
for (var i in config.domains) { if (typeof config.domains[i].auth == 'string') { config.domains[i].auth = config.domains[i].auth.toLowerCase(); } }
2539
2540
- // Check if Windows SSPI and YubiKey OTP will be used
2540
+ // Check if Windows SSPI, LDAP, Passport and YubiKey OTP will be used
2541
var sspi = false;
2542
var ldap = false;
2543
+ var passport = null;
2544
var allsspi = true;
2545
var yubikey = false;
2546
var recordingIndex = false;
@@ -2549,6 +2550,12 @@ function mainStart() {
2550
for (var i in config.domains) {
2551
if (config.domains[i].yubikey != null) { yubikey = true; }
2552
if (config.domains[i].auth == 'ldap') { ldap = true; }
2553
+ if ((typeof config.domains[i].authstrategies == 'object')) {
2554
+ if (passport == null) { passport = ['passport']; }
2555
+ if ((typeof config.domains[i].authstrategies.twitter == 'object') && (typeof config.domains[i].authstrategies.twitter.apikey == 'string') && (typeof config.domains[i].authstrategies.twitter.apisecret == 'string') && (passport.indexOf('passport-twitter') == -1)) { passport.push('passport-twitter'); }
2556
+ if ((typeof config.domains[i].authstrategies.google == 'object') && (typeof config.domains[i].authstrategies.google.clientid == 'string') && (typeof config.domains[i].authstrategies.google.clientsecret == 'string') && (passport.indexOf('passport-google-oauth20') == -1)) { passport.push('passport-google-oauth20'); }
2557
+ if ((typeof config.domains[i].authstrategies.github == 'object') && (typeof config.domains[i].authstrategies.github.clientid == 'string') && (typeof config.domains[i].authstrategies.github.clientsecret == 'string') && (passport.indexOf('passport-github2') == -1)) { passport.push('passport-github2'); }
2558
+ }
2559
if ((config.domains[i].sessionrecording != null) && (config.domains[i].sessionrecording.index == true)) { recordingIndex = true; }
2560
}
2561
@@ -2559,6 +2566,7 @@ function mainStart() {
2566
var modules = ['ws', 'cbor', 'nedb', 'https', 'yauzl', 'xmldom', 'ipcheck', 'express', 'archiver', 'multiparty', 'node-forge', 'express-ws', 'compression', 'body-parser', 'connect-redis', 'cookie-session', 'express-handlebars'];
2567
if (require('os').platform() == 'win32') { modules.push('node-windows'); if (sspi == true) { modules.push('node-sspi'); } } // Add Windows modules
2568
if (ldap == true) { modules.push('ldapauth-fork'); }
2569
+ if (passport != null) { modules.push(...passport); }
2570
if (recordingIndex == true) { modules.push('image-size'); } // Need to get the remote desktop JPEG sizes to index the recodring file.
2571
if (config.letsencrypt != null) { if (nodeVersion < 8) { addServerWarning("Let's Encrypt support requires Node v8.x or higher.", !args.launch); } else { modules.push('acme-client'); } } // Add acme-client module
2572
if (config.settings.mqtt != null) { modules.push('aedes'); } // Add MQTT Modules
public/images/Login/github32.png
Binary files /dev/null and b/public/images/Login/github32.png differ
public/images/Login/github64.png
Binary files /dev/null and b/public/images/Login/github64.png differ
public/images/Login/google32.png
Binary files /dev/null and b/public/images/Login/google32.png differ
public/images/Login/google64.png
Binary files /dev/null and b/public/images/Login/google64.png differ
public/images/Login/twitter32.png
Binary files /dev/null and b/public/images/Login/twitter32.png differ
public/images/Login/twitter64.png
Binary files /dev/null and b/public/images/Login/twitter64.png differ
views/login.handlebars
+16
@@ -70,6 +70,13 @@
70
Don't have an account? <a onclick="return xgo(2,event);" href="#" style=cursor:pointer>Create one</a>.
71
</div>
72
<input id=loginformargs name="urlargs" type="hidden" value="" />
73
+ <div id="authStrategies" style="display:none">
74
+ <hr />
75
+ <div style="margin-bottom:8px">Log in using an existing account</div>
76
+ <a id="auth-twitter" href="auth-twitter" style="display:none"><img src="images/login/twitter32.png" loading="lazy" width="32" height="32" style="margin-left:3px;margin-right:3px;border-radius:3px;box-shadow:2px 2px 5px black;cursor:pointer" title="Sign-in using Twitter" /></a>
77
+ <a id="auth-google" href="auth-google" style="display:none"><img src="images/login/google32.png" loading="lazy" width="32" height="32" style="margin-left:3px;margin-right:3px;border-radius:3px;box-shadow:2px 2px 5px black;cursor:pointer" title="Sign-in using Google" /></a>
78
+ <a id="auth-github" href="auth-github" style="display:none"><img src="images/login/github32.png" loading="lazy" width="32" height="32" style="margin-left:3px;margin-right:3px;border-radius:3px;box-shadow:2px 2px 5px black;cursor:pointer" title="Sign-in using GitHub" /></a>
79
+ </div>
80
</form>
81
</div>
82
<div id=createpanel style="display:none;position:relative">
@@ -302,6 +309,7 @@
309
var otpemail = (decodeURIComponent('{{{otpemail}}}') === 'true');
310
var otpsms = (decodeURIComponent('{{{otpsms}}}') === 'true');
311
var twoFactorCookieDays = parseInt('{{{twoFactorCookieDays}}}');
312
+ var authStrategies = '{{{authStrategies}}}'.split(',');
313
314
function startup() {
315
// Display the right server message
@@ -368,6 +376,14 @@
376
QV('createPanelHint', passRequirements.hint === true);
377
QV('resetpasswordpanelHint', passRequirements.hint === true);
378
379
+ // Setup authentication strategies
380
+ if (authStrategies != '') {
381
+ QV('authStrategies', true);
382
+ if (authStrategies.indexOf('twitter') >= 0) { QV('auth-twitter', true); }
383
+ if (authStrategies.indexOf('google') >= 0) { QV('auth-google', true); }
384
+ if (authStrategies.indexOf('github') >= 0) { QV('auth-github', true); }
385
+ }
386
+
387
// Display the welcome text
388
if (welcomeText) {
389
QH('welcomeText', welcomeText);
webserver.js
+80
-3
@@ -1982,8 +1982,16 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
1982
var twoFactorCookieDays = 30;
1983
if (typeof domain.twofactorcookiedurationdays == 'number') { twoFactorCookieDays = domain.twofactorcookiedurationdays; }
1984
1985
+ // See what authentication strategies we have
1986
+ var authStrategies = [];
1987
+ if (typeof domain.authstrategies == 'object') {
1988
+ if ((typeof domain.authstrategies.twitter == 'object') && (typeof domain.authstrategies.twitter.apikey == 'string') && (typeof domain.authstrategies.twitter.apisecret == 'string')) { authStrategies.push('twitter'); }
1989
+ if ((typeof domain.authstrategies.google == 'object') && (typeof domain.authstrategies.google.clientid == 'string') && (typeof domain.authstrategies.google.clientsecret == 'string')) { authStrategies.push('google'); }
1990
+ if ((typeof domain.authstrategies.github == 'object') && (typeof domain.authstrategies.github.clientid == 'string') && (typeof domain.authstrategies.github.clientsecret == 'string')) { authStrategies.push('github'); }
1991
+ }
1992
+
1993
// Render the login page
1986
- render(req, res, getRenderPage('login', req, domain), getRenderArgs({ loginmode: loginmode, rootCertLink: getRootCertLink(), newAccount: newAccountsAllowed, newAccountPass: (((domain.newaccountspass == null) || (domain.newaccountspass == '')) ? 0 : 1), serverDnsName: obj.getWebServerName(domain), serverPublicPort: httpsPort, emailcheck: emailcheck, features: features, sessiontime: args.sessiontime, passRequirements: passRequirements, footer: (domain.footer == null) ? '' : domain.footer, hkey: encodeURIComponent(hardwareKeyChallenge), messageid: msgid, passhint: passhint, welcometext: domain.welcometext ? encodeURIComponent(domain.welcometext).split('\'').join('\\\'') : null, hwstate: hwstate, otpemail: otpemail, otpsms: otpsms, twoFactorCookieDays: twoFactorCookieDays }, req, domain));
1994
+ render(req, res, getRenderPage('login', req, domain), getRenderArgs({ loginmode: loginmode, rootCertLink: getRootCertLink(), newAccount: newAccountsAllowed, newAccountPass: (((domain.newaccountspass == null) || (domain.newaccountspass == '')) ? 0 : 1), serverDnsName: obj.getWebServerName(domain), serverPublicPort: httpsPort, emailcheck: emailcheck, features: features, sessiontime: args.sessiontime, passRequirements: passRequirements, footer: (domain.footer == null) ? '' : domain.footer, hkey: encodeURIComponent(hardwareKeyChallenge), messageid: msgid, passhint: passhint, welcometext: domain.welcometext ? encodeURIComponent(domain.welcometext).split('\'').join('\\\'') : null, hwstate: hwstate, otpemail: otpemail, otpsms: otpsms, twoFactorCookieDays: twoFactorCookieDays, authStrategies: authStrategies.join(',') }, req, domain));
1995
}
1996
1997
// Handle a post request on the root
@@ -3917,7 +3925,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3925
if (parent.multiServer != null) { obj.app.ws('/meshserver.ashx', function (ws, req) { parent.multiServer.CreatePeerInServer(parent.multiServer, ws, req); }); }
3926
for (var i in parent.config.domains) {
3927
if (parent.config.domains[i].dns != null) { continue; } // This is a subdomain with a DNS name, no added HTTP bindings needed.
3920
- var url = parent.config.domains[i].url;
3928
+ var domain = parent.config.domains[i];
3929
+ var url = domain.url;
3930
obj.app.get(url, handleRootRequest);
3931
obj.app.post(url, handleRootPostRequest);
3932
obj.app.get(url + 'backup.zip', handleBackupRequest);
@@ -3969,7 +3978,7 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3978
}
3979
});
3980
});
3972
- if (parent.config.domains[i].agentinvitecodes == true) {
3981
+ if (domain.agentinvitecodes == true) {
3982
obj.app.get(url + 'invite', handleInviteRequest);
3983
obj.app.post(url + 'invite', handleInviteRequest);
3984
}
@@ -3979,6 +3988,74 @@ module.exports.CreateWebServer = function (parent, db, args, certificates) {
3988
obj.app.get(url + 'pluginHandler.js', obj.handlePluginJS);
3989
}
3990
3991
+ // Setup passport if needed
3992
+ if (typeof domain.authstrategies == 'object') {
3993
+ const passport = domain.passport = require('passport');
3994
+ if ((typeof domain.authstrategies.twitter == 'object') && (typeof domain.authstrategies.twitter.apikey == 'string') && (typeof domain.authstrategies.twitter.apisecret == 'string')) {
3995
+ const TwitterStrategy = require('passport-twitter');
3996
+ passport.use(new TwitterStrategy({
3997
+ consumerKey: domain.authstrategies.twitter.apikey,
3998
+ consumerSecret: domain.authstrategies.twitter.apisecret,
3999
+ callbackURL: url + 'auth-twitter-callback'
4000
+ },
4001
+ function (token, tokenSecret, profile, cb) {
4002
+ console.log('Twitter1', token, tokenSecret, profile);
4003
+ //User.findOrCreate({ twitterId: profile.id }, function (err, user) { return cb(err, user); });
4004
+ }
4005
+ ));
4006
+ obj.app.get(url + 'auth-twitter', domain.passport.authenticate('twitter'));
4007
+ obj.app.get(url + 'https://alt.meshcentral.com',
4008
+ domain.passport.authenticate('twitter', { failureRedirect: '/' }),
4009
+ function (req, res) {
4010
+ // Successful authentication, redirect home.
4011
+ console.log('Twitter2');
4012
+ res.redirect('/');
4013
+ });
4014
+ }
4015
+ if ((typeof domain.authstrategies.google == 'object') && (typeof domain.authstrategies.google.clientid == 'string') && (typeof domain.authstrategies.google.clientsecret == 'string')) {
4016
+ const GoogleStrategy = require('passport-google-oauth20');
4017
+ passport.use(new GoogleStrategy({
4018
+ clientID: domain.authstrategies.google.clientid,
4019
+ clientSecret: domain.authstrategies.google.clientsecret,
4020
+ callbackURL: url + 'auth-google-callback'
4021
+ },
4022
+ function (token, tokenSecret, profile, cb) {
4023
+ console.log('Google1', token, tokenSecret, profile);
4024
+ //User.findOrCreate({ googleId: profile.id }, function (err, user) { return cb(err, user); });
4025
+ }
4026
+ ));
4027
+ obj.app.get(url + 'auth-google', domain.passport.authenticate('google'));
4028
+ obj.app.get(url + 'auth-google-callback',
4029
+ domain.passport.authenticate('google', { failureRedirect: '/' }),
4030
+ function (req, res) {
4031
+ // Successful authentication, redirect home.
4032
+ console.log('Google2');
4033
+ res.redirect('/');
4034
+ });
4035
+ }
4036
+ if ((typeof domain.authstrategies.github == 'object') && (typeof domain.authstrategies.github.clientid == 'string') && (typeof domain.authstrategies.github.clientsecret == 'string')) {
4037
+ const GitHubStrategy = require('passport-github2');
4038
+ passport.use(new GitHubStrategy({
4039
+ clientID: domain.authstrategies.github.clientid,
4040
+ clientSecret: domain.authstrategies.github.clientsecret,
4041
+ callbackURL: url + 'auth-github-callback'
4042
+ },
4043
+ function (token, tokenSecret, profile, cb) {
4044
+ console.log('GitHub1', token, tokenSecret, profile);
4045
+ //User.findOrCreate({ githubId: profile.id }, function (err, user) { return cb(err, user); });
4046
+ }
4047
+ ));
4048
+ obj.app.get(url + 'auth-github', domain.passport.authenticate('github', { scope: ['user:email'] }));
4049
+ obj.app.get(url + 'auth-github-callback',
4050
+ domain.passport.authenticate('google', { failureRedirect: '/' }),
4051
+ function (req, res) {
4052
+ // Successful authentication, redirect home.
4053
+ console.log('GitHub2');
4054
+ res.redirect('/');
4055
+ });
4056
+ }
4057
+ }
4058
+
4059
// Server redirects
4060
if (parent.config.domains[i].redirects) { for (var j in parent.config.domains[i].redirects) { if (j[0] != '_') { obj.app.get(url + j, obj.handleDomainRedirect); } } }
4061