mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
d1d02d9eae
* Redirect to default URL after 1FA when default policy is one_factor. User is now redirected to the default redirection URL after 1FA if the default policy is set to one_factor and there is no target URL or if the target URL is unsafe. Also, if the default policy is set to one_factor and the user is already authenticated, if she visits the login portal, the 'already authenticated' view is displayed with a logout button. This fixes #581. * Update users.yml * Fix permissions issue causing suite test failure
83 lines
2.4 KiB
Go
83 lines
2.4 KiB
Go
package handlers
|
|
|
|
import (
|
|
"fmt"
|
|
"net/url"
|
|
|
|
"github.com/authelia/authelia/internal/authorization"
|
|
"github.com/authelia/authelia/internal/middlewares"
|
|
"github.com/authelia/authelia/internal/utils"
|
|
)
|
|
|
|
func Handle1FAResponse(ctx *middlewares.AutheliaCtx, targetURI string, username string, groups []string) {
|
|
if targetURI == "" {
|
|
if authorization.PolicyToLevel(ctx.Configuration.AccessControl.DefaultPolicy) == authorization.OneFactor &&
|
|
ctx.Configuration.DefaultRedirectionURL != "" {
|
|
ctx.SetJSONBody(redirectResponse{Redirect: ctx.Configuration.DefaultRedirectionURL})
|
|
} else {
|
|
ctx.ReplyOK()
|
|
}
|
|
return
|
|
}
|
|
|
|
targetURL, err := url.ParseRequestURI(targetURI)
|
|
if err != nil {
|
|
ctx.Error(fmt.Errorf("Unable to parse target URL %s: %s", targetURI, err), authenticationFailedMessage)
|
|
return
|
|
}
|
|
|
|
requiredLevel := ctx.Providers.Authorizer.GetRequiredLevel(authorization.Subject{
|
|
Username: username,
|
|
Groups: groups,
|
|
IP: ctx.RemoteIP(),
|
|
}, *targetURL)
|
|
|
|
ctx.Logger.Debugf("Required level for the URL %s is %d", targetURI, requiredLevel)
|
|
|
|
if requiredLevel > authorization.OneFactor {
|
|
ctx.Logger.Warnf("%s requires more than 1FA, cannot be redirected to", targetURI)
|
|
ctx.ReplyOK()
|
|
return
|
|
}
|
|
|
|
safeRedirection := utils.IsRedirectionSafe(*targetURL, ctx.Configuration.Session.Domain)
|
|
|
|
if !safeRedirection {
|
|
if authorization.PolicyToLevel(ctx.Configuration.AccessControl.DefaultPolicy) == authorization.OneFactor &&
|
|
ctx.Configuration.DefaultRedirectionURL != "" {
|
|
ctx.SetJSONBody(redirectResponse{Redirect: ctx.Configuration.DefaultRedirectionURL})
|
|
} else {
|
|
ctx.ReplyOK()
|
|
}
|
|
return
|
|
}
|
|
|
|
ctx.Logger.Debugf("Redirection URL %s is safe", targetURI)
|
|
response := redirectResponse{Redirect: targetURI}
|
|
ctx.SetJSONBody(response)
|
|
}
|
|
|
|
func Handle2FAResponse(ctx *middlewares.AutheliaCtx, targetURI string) {
|
|
if targetURI == "" {
|
|
if ctx.Configuration.DefaultRedirectionURL != "" {
|
|
ctx.SetJSONBody(redirectResponse{Redirect: ctx.Configuration.DefaultRedirectionURL})
|
|
} else {
|
|
ctx.ReplyOK()
|
|
}
|
|
return
|
|
}
|
|
|
|
targetURL, err := url.ParseRequestURI(targetURI)
|
|
|
|
if err != nil {
|
|
ctx.Error(fmt.Errorf("Unable to parse target URL: %s", err), mfaValidationFailedMessage)
|
|
return
|
|
}
|
|
|
|
if targetURL != nil && utils.IsRedirectionSafe(*targetURL, ctx.Configuration.Session.Domain) {
|
|
ctx.SetJSONBody(redirectResponse{Redirect: targetURI})
|
|
} else {
|
|
ctx.ReplyOK()
|
|
}
|
|
}
|