test
Some checks failed
continuous-integration/drone/push Build is failing

This commit is contained in:
mol
2024-07-06 22:23:31 +08:00
parent 08173d8497
commit 263cb5ef03
1663 changed files with 526884 additions and 0 deletions

View File

@ -0,0 +1,189 @@
# Changelog
All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
### [2.0.1](https://github.com/mongodb-js/kerberos/compare/v2.0.0...v2.0.1) (2022-07-14)
### Bug Fixes
* **NODE-4297:** bump prebuild install to 7.1.1 ([#145](https://github.com/mongodb-js/kerberos/issues/145)) ([142842f](https://github.com/mongodb-js/kerberos/commit/142842fae048e873caac5c83fda43c6b5b45280e))
## [2.0.0](https://github.com/mongodb-js/kerberos/compare/v2.0.0-beta.0...v2.0.0) (2022-02-22)
### ⚠ BREAKING CHANGES
* **NODE-3848:** update dependencies (#142)
### Bug Fixes
* **NODE-3982:** only pass username to SSPI if password is set ([#141](https://github.com/mongodb-js/kerberos/issues/141)) ([2d307a3](https://github.com/mongodb-js/kerberos/commit/2d307a3131e546d046b865e6c1d0a256f7612e0d))
* **NODE-3848:** update dependencies ([#142](https://github.com/mongodb-js/kerberos/issues/142)) ([8c06728](https://github.com/mongodb-js/kerberos/commit/8c067286add33a2b56aeaf10e41f0409c5fe1d5b))
## [2.0.0-beta.0](https://github.com/mongodb-js/kerberos/compare/v1.1.7...v2.0.0-beta.0) (2021-10-06)
### ⚠ BREAKING CHANGES
* **NODE-3472:** convert to Node-API (#137)
### Features
* **NODE-3472:** convert to Node-API ([#137](https://github.com/mongodb-js/kerberos/issues/137)) ([f9481a4](https://github.com/mongodb-js/kerberos/commit/f9481a42877c604f8aac961536fc5674ce8baa6c))
### [1.1.7](https://github.com/mongodb-js/kerberos/compare/v1.1.5...v1.1.7) (2021-07-20)
### Bug Fixes
* **NODE-2129:** fix sporadic AcquireCredentialsHandle error ([#133](https://github.com/mongodb-js/kerberos/issues/133)) ([adf8346](https://github.com/mongodb-js/kerberos/commit/adf834665d7b927778669c1197d53d6f4ed6e797))
* **NODE-3350:** do not export Init function symbol ([#130](https://github.com/mongodb-js/kerberos/issues/130)) ([acdd746](https://github.com/mongodb-js/kerberos/commit/acdd7466c131494e9a2ca36eb9ad64ecda2d1366))
<a name="1.1.6"></a>
## [1.1.6](https://github.com/mongodb-js/kerberos/compare/v1.1.5...v1.1.6) (2021-07-20)
### Bug Fixes
* **NODE-2129:** fix sporadic AcquireCredentialsHandle error ([#133](https://github.com/mongodb-js/kerberos/issues/133)) ([adf8346](https://github.com/mongodb-js/kerberos/commit/adf834665d7b927778669c1197d53d6f4ed6e797))
* **NODE-3350:** do not export Init function symbol ([#130](https://github.com/mongodb-js/kerberos/issues/130)) ([acdd746](https://github.com/mongodb-js/kerberos/commit/acdd7466c131494e9a2ca36eb9ad64ecda2d1366))
<a name="1.1.5"></a>
## [1.1.5](https://github.com/mongodb-js/kerberos/compare/v1.1.4...v1.1.5) (2021-04-06)
### Bug Fixes
* temporarily roll back node-abi until lgeiger/node-abi/[#90](https://github.com/mongodb-js/kerberos/issues/90) is resolved ([880ae2e](https://github.com/mongodb-js/kerberos/commit/880ae2eee6a8fe565ab627717d1d81ae85896abf))
* **build:** make addon buildable as static library ([#119](https://github.com/mongodb-js/kerberos/issues/119)) ([786e7d8](https://github.com/mongodb-js/kerberos/commit/786e7d83672ad5ff2718c9a440dbd180f8e7b24a))
<a name="1.1.4"></a>
## [1.1.4](https://github.com/mongodb-js/kerberos/compare/v1.1.3...v1.1.4) (2020-10-13)
<a name="1.1.3"></a>
## [1.1.3](https://github.com/mongodb-js/kerberos/compare/v1.2.0...v1.1.3) (2019-08-27)
### Bug Fixes
* add support for node 12 ([ae6755d](https://github.com/mongodb-js/kerberos/commit/ae6755d))
<a name="1.1.2"></a>
## [1.1.2](https://github.com/mongodb-js/kerberos/compare/v1.1.1...v1.1.2) (2018-11-01)
### Bug Fixes
* **auth-process:** only send username/password if provided ([334ca9c](https://github.com/mongodb-js/kerberos/commit/334ca9c))
* **auth-process:** use canonicalized hostname in client init ([b1802d1](https://github.com/mongodb-js/kerberos/commit/b1802d1))
<a name="1.1.1"></a>
## [1.1.1](https://github.com/mongodb-js/kerberos/compare/v1.1.0...v1.1.1) (2018-10-30)
### Bug Fixes
* **sspi:** only add password and domain if they are provided ([bc48814](https://github.com/mongodb-js/kerberos/commit/bc48814))
<a name="1.1.0"></a>
# [1.1.0](https://github.com/mongodb-js/kerberos/compare/v1.0.0...v1.1.0) (2018-10-26)
### Bug Fixes
* **sspi:** correct invalid null checks for user data ([163bdb9](https://github.com/mongodb-js/kerberos/commit/163bdb9))
### Features
* **package:** export the package version ([5be618f](https://github.com/mongodb-js/kerberos/commit/5be618f))
<a name="1.0.0"></a>
# [1.0.0](https://github.com/christkv/kerberos/compare/v0.0.24...v1.0.0) (2018-08-15)
### Bug Fixes
* **check-password:** correctly validate parameters, fix test ([b772dde](https://github.com/christkv/kerberos/commit/b772dde))
* **common:** ensure nan is being included everywhere appropriately ([7bddb24](https://github.com/christkv/kerberos/commit/7bddb24))
* **context:** add `NewInstance` methods, and make getters safer ([fd4b852](https://github.com/christkv/kerberos/commit/fd4b852))
* **gss:** fix issue with memory corruption ([ff4167e](https://github.com/christkv/kerberos/commit/ff4167e))
* **kerberos:** provide default gss flags ([b365934](https://github.com/christkv/kerberos/commit/b365934))
* **legacy:** support legacy import expectations ([615b23f](https://github.com/christkv/kerberos/commit/615b23f))
* **response:** ensure null or client/server response is returned ([083518f](https://github.com/christkv/kerberos/commit/083518f))
* **server:** use the correct internal method name for server init ([8c8dd35](https://github.com/christkv/kerberos/commit/8c8dd35))
* **this:** use the correct reference to `this` for object unwrapping ([1acfb20](https://github.com/christkv/kerberos/commit/1acfb20))
* **unique_ptr:** ensure we include <memory> where required ([e3d9afb](https://github.com/christkv/kerberos/commit/e3d9afb))
* **warnings:** set clang compiler pragmas only when clang is detected ([048479d](https://github.com/christkv/kerberos/commit/048479d))
* **win32:** `windows` -> `win32` in bindings.gyp ([0221c06](https://github.com/christkv/kerberos/commit/0221c06))
* **win32:** cleanup client state in addon destructor ([5394561](https://github.com/christkv/kerberos/commit/5394561))
* **win32:** initialize with a domain, if one is provided ([309ba61](https://github.com/christkv/kerberos/commit/309ba61))
### Features
* **async-worker:** introduce a `KerberosWorker` using lambdas ([1239ef7](https://github.com/christkv/kerberos/commit/1239ef7))
* **checkPassword:** add implementation for checking krb5 passwords ([60f476e](https://github.com/christkv/kerberos/commit/60f476e))
* **clean:** provide implementations for the clean methods ([77a77ce](https://github.com/christkv/kerberos/commit/77a77ce))
* **client:** add final wrap/unwrap api endpoints ([016222f](https://github.com/christkv/kerberos/commit/016222f))
* **client:** add implementation for client wrap/unwrap to win32 ([994604c](https://github.com/christkv/kerberos/commit/994604c))
* **gss:** add `new` methods for constructing state tracking types ([274cad6](https://github.com/christkv/kerberos/commit/274cad6))
* **jsdoc2md:** add jsdoc2md support, and README template ([60e1ee5](https://github.com/christkv/kerberos/commit/60e1ee5))
* **kerberos:** add getters to check for context completeness ([6a9a01d](https://github.com/christkv/kerberos/commit/6a9a01d))
* **kerberos:** implement client/server init, move to worker file ([1c857ea](https://github.com/christkv/kerberos/commit/1c857ea))
* **kerberos:** return value for `step` is the challenge response ([e153d24](https://github.com/christkv/kerberos/commit/e153d24))
* **promises:** allow to access all API by promise or callback ([3b77430](https://github.com/christkv/kerberos/commit/3b77430))
* **serverPrincipalDetails:** add server pricipal details method ([385fcd1](https://github.com/christkv/kerberos/commit/385fcd1))
* **src:** begin to develop the new version of the module in `src` ([f45da50](https://github.com/christkv/kerberos/commit/f45da50))
* **sspi:** introduce client initialization for SSPI ([6a40301](https://github.com/christkv/kerberos/commit/6a40301))
* **sspi:** provide implementation for `initializeClient` ([5943f1c](https://github.com/christkv/kerberos/commit/5943f1c))
* **step:** implement client and server step methods ([5a4327c](https://github.com/christkv/kerberos/commit/5a4327c))
0.0.23 07-03-2017
-----------------
- SSPI implemented missing _sspi_FreeCredentialsHandle to correctly cleanup credentials allocation on call to destructor of the C++ instance.
- Updated nan.h dependency to 2.5.x series for Node 7.6.x or higher.
0.0.22 10-11-2016
-----------------
- Updated nan.h dependency to 2.4.x series for Node 6.8.x or higher.
- The length calculations are off by one meaning it impossible to not set the password (Issue #54, http://www.github.com/tlbdk).
0.0.21 04-28-2016
-----------------
- Updated nan.h dependency to 2.3.x series for Node 6.0.
0.0.20 04-26-2016
-----------------
- Updated nan.h dependency to 2.2.x series.
- Fixed minor compilation warnings due to v8 C++ ABI changes.
0.0.19 03-07-2016
-----------------
- Fix installation error (Issue #1).
- Allow passing down off CANONICALIZE_HOST_NAME and SERVICE_REALM options.
0.0.18 01-19-2016
-----------------
- remove builderror.log.
0.0.17 10-30-2015
-----------------
- Reverted changes in package.json from 0.0.16.
0.0.16 10-26-2015
-----------------
- Removed (exit 0) on build to let correct failure happen.

View File

@ -0,0 +1,201 @@
Apache License
Version 2.0, January 2004
http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
1. Definitions.
"License" shall mean the terms and conditions for use, reproduction,
and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by
the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all
other entities that control, are controlled by, or are under common
control with that entity. For the purposes of this definition,
"control" means (i) the power, direct or indirect, to cause the
direction or management of such entity, whether by contract or
otherwise, or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity
exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications,
including but not limited to software source code, documentation
source, and configuration files.
"Object" form shall mean any form resulting from mechanical
transformation or translation of a Source form, including but
not limited to compiled object code, generated documentation,
and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or
Object form, made available under the License, as indicated by a
copyright notice that is included in or attached to the work
(an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object
form, that is based on (or derived from) the Work and for which the
editorial revisions, annotations, elaborations, or other modifications
represent, as a whole, an original work of authorship. For the purposes
of this License, Derivative Works shall not include works that remain
separable from, or merely link (or bind by name) to the interfaces of,
the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including
the original version of the Work and any modifications or additions
to that Work or Derivative Works thereof, that is intentionally
submitted to Licensor for inclusion in the Work by the copyright owner
or by an individual or Legal Entity authorized to submit on behalf of
the copyright owner. For the purposes of this definition, "submitted"
means any form of electronic, verbal, or written communication sent
to the Licensor or its representatives, including but not limited to
communication on electronic mailing lists, source code control systems,
and issue tracking systems that are managed by, or on behalf of, the
Licensor for the purpose of discussing and improving the Work, but
excluding communication that is conspicuously marked or otherwise
designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity
on behalf of whom a Contribution has been received by Licensor and
subsequently incorporated within the Work.
2. Grant of Copyright License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
copyright license to reproduce, prepare Derivative Works of,
publicly display, publicly perform, sublicense, and distribute the
Work and such Derivative Works in Source or Object form.
3. Grant of Patent License. Subject to the terms and conditions of
this License, each Contributor hereby grants to You a perpetual,
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
(except as stated in this section) patent license to make, have made,
use, offer to sell, sell, import, and otherwise transfer the Work,
where such license applies only to those patent claims licensable
by such Contributor that are necessarily infringed by their
Contribution(s) alone or by combination of their Contribution(s)
with the Work to which such Contribution(s) was submitted. If You
institute patent litigation against any entity (including a
cross-claim or counterclaim in a lawsuit) alleging that the Work
or a Contribution incorporated within the Work constitutes direct
or contributory patent infringement, then any patent licenses
granted to You under this License for that Work shall terminate
as of the date such litigation is filed.
4. Redistribution. You may reproduce and distribute copies of the
Work or Derivative Works thereof in any medium, with or without
modifications, and in Source or Object form, provided that You
meet the following conditions:
(a) You must give any other recipients of the Work or
Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices
stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works
that You distribute, all copyright, patent, trademark, and
attribution notices from the Source form of the Work,
excluding those notices that do not pertain to any part of
the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its
distribution, then any Derivative Works that You distribute must
include a readable copy of the attribution notices contained
within such NOTICE file, excluding those notices that do not
pertain to any part of the Derivative Works, in at least one
of the following places: within a NOTICE text file distributed
as part of the Derivative Works; within the Source form or
documentation, if provided along with the Derivative Works; or,
within a display generated by the Derivative Works, if and
wherever such third-party notices normally appear. The contents
of the NOTICE file are for informational purposes only and
do not modify the License. You may add Your own attribution
notices within Derivative Works that You distribute, alongside
or as an addendum to the NOTICE text from the Work, provided
that such additional attribution notices cannot be construed
as modifying the License.
You may add Your own copyright statement to Your modifications and
may provide additional or different license terms and conditions
for use, reproduction, or distribution of Your modifications, or
for any such Derivative Works as a whole, provided Your use,
reproduction, and distribution of the Work otherwise complies with
the conditions stated in this License.
5. Submission of Contributions. Unless You explicitly state otherwise,
any Contribution intentionally submitted for inclusion in the Work
by You to the Licensor shall be under the terms and conditions of
this License, without any additional terms or conditions.
Notwithstanding the above, nothing herein shall supersede or modify
the terms of any separate license agreement you may have executed
with Licensor regarding such Contributions.
6. Trademarks. This License does not grant permission to use the trade
names, trademarks, service marks, or product names of the Licensor,
except as required for reasonable and customary use in describing the
origin of the Work and reproducing the content of the NOTICE file.
7. Disclaimer of Warranty. Unless required by applicable law or
agreed to in writing, Licensor provides the Work (and each
Contributor provides its Contributions) on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or conditions
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
PARTICULAR PURPOSE. You are solely responsible for determining the
appropriateness of using or redistributing the Work and assume any
risks associated with Your exercise of permissions under this License.
8. Limitation of Liability. In no event and under no legal theory,
whether in tort (including negligence), contract, or otherwise,
unless required by applicable law (such as deliberate and grossly
negligent acts) or agreed to in writing, shall any Contributor be
liable to You for damages, including any direct, indirect, special,
incidental, or consequential damages of any character arising as a
result of this License or out of the use or inability to use the
Work (including but not limited to damages for loss of goodwill,
work stoppage, computer failure or malfunction, or any and all
other commercial damages or losses), even if such Contributor
has been advised of the possibility of such damages.
9. Accepting Warranty or Additional Liability. While redistributing
the Work or Derivative Works thereof, You may choose to offer,
and charge a fee for, acceptance of support, warranty, indemnity,
or other liability obligations and/or rights consistent with this
License. However, in accepting such obligations, You may act only
on Your own behalf and on Your sole responsibility, not on behalf
of any other Contributor, and only if You agree to indemnify,
defend, and hold each Contributor harmless for any liability
incurred by, or claims asserted against, such Contributor by reason
of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following
boilerplate notice, with the fields enclosed by brackets "[]"
replaced with your own identifying information. (Don't include
the brackets!) The text should be enclosed in the appropriate
comment syntax for the file format. We also recommend that a
file or class name and description of purpose be included on the
same "printed page" as the copyright notice for easier
identification within third-party archives.
Copyright [yyyy] [name of copyright owner]
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Binary file not shown.

Binary file not shown.

View File

@ -0,0 +1,151 @@
'use strict';
const dns = require('dns');
const kerberos = require('../kerberos');
class MongoAuthProcess {
constructor(host, port, serviceName, options) {
options = options || {};
this.host = host;
this.port = port;
// Set up service name
this.serviceName = serviceName || options.gssapiServiceName || 'mongodb';
// Options
this.canonicalizeHostName =
typeof options.gssapiCanonicalizeHostName === 'boolean'
? options.gssapiCanonicalizeHostName
: false;
// Set up first transition
this._transition = firstTransition(this);
// Number of retries
this.retries = 10;
}
init(username, password, callback) {
const self = this;
this.username = username;
this.password = password;
// Canonicialize host name if needed
function performGssapiCanonicalizeHostName(canonicalizeHostName, host, callback) {
if (!canonicalizeHostName) return callback();
// Attempt to resolve the host name
dns.resolveCname(host, (err, r) => {
if (err) return callback(err);
// Get the first resolve host id
if (Array.isArray(r) && r.length > 0) {
self.host = r[0];
}
callback();
});
}
// Canonicialize host name if needed
performGssapiCanonicalizeHostName(this.canonicalizeHostName, this.host, err => {
if (err) return callback(err);
const initOptions = {};
if (password != null) {
Object.assign(initOptions, { user: username, password });
}
const service =
process.platform === 'win32'
? `${this.serviceName}/${this.host}`
: `${this.serviceName}@${this.host}`;
kerberos.initializeClient(service, initOptions, (err, client) => {
if (err) return callback(err, null);
self.client = client;
callback(null, client);
});
});
}
transition(payload, callback) {
if (this._transition == null) {
return callback(new Error('Transition finished'));
}
this._transition(payload, callback);
}
}
function firstTransition(auth) {
return (payload, callback) => {
auth.client.step('', (err, response) => {
if (err) return callback(err);
// Set up the next step
auth._transition = secondTransition(auth);
// Return the payload
callback(null, response);
});
};
}
function secondTransition(auth) {
return (payload, callback) => {
auth.client.step(payload, (err, response) => {
if (err && auth.retries === 0) return callback(err);
// Attempt to re-establish a context
if (err) {
// Adjust the number of retries
auth.retries = auth.retries - 1;
// Call same step again
return auth.transition(payload, callback);
}
// Set up the next step
auth._transition = thirdTransition(auth);
// Return the payload
callback(null, response || '');
});
};
}
function thirdTransition(auth) {
return (payload, callback) => {
// GSS Client Unwrap
auth.client.unwrap(payload, (err, response) => {
if (err) return callback(err, false);
// Wrap the response
auth.client.wrap(response, { user: auth.username }, (err, wrapped) => {
if (err) return callback(err, false);
// Set up the next step
auth._transition = fourthTransition(auth);
// Return the payload
callback(null, wrapped);
});
});
};
}
function fourthTransition(auth) {
return (payload, callback) => {
// Set the transition to null
auth._transition = null;
// Callback with valid authentication
callback(null, true);
};
}
// Set the process
module.exports = {
MongoAuthProcess
};

View File

@ -0,0 +1,16 @@
'use strict';
const kerberos = require('./kerberos');
// Get the Kerberos library
module.exports = kerberos;
// Support legacy versions of the mongodb driver which expect this export
module.exports.Kerberos = kerberos;
module.exports.version = require('../package.json').version;
// Set up the auth processes
module.exports.processes = {
MongoAuthProcess: require('./auth_processes/mongodb').MongoAuthProcess
};

View File

@ -0,0 +1,203 @@
'use strict';
const kerberos = require('bindings')('kerberos');
const KerberosClient = kerberos.KerberosClient;
const KerberosServer = kerberos.KerberosServer;
const defineOperation = require('./util').defineOperation;
// GSS Flags
const GSS_C_DELEG_FLAG = 1;
const GSS_C_MUTUAL_FLAG = 2;
const GSS_C_REPLAY_FLAG = 4;
const GSS_C_SEQUENCE_FLAG = 8;
const GSS_C_CONF_FLAG = 16;
const GSS_C_INTEG_FLAG = 32;
const GSS_C_ANON_FLAG = 64;
const GSS_C_PROT_READY_FLAG = 128;
const GSS_C_TRANS_FLAG = 256;
// GSS_OID
const GSS_C_NO_OID = 0;
const GSS_MECH_OID_KRB5 = 9;
const GSS_MECH_OID_SPNEGO = 6;
/**
* @class KerberosClient
*
* @property {string} username The username used for authentication
* @property {string} response The last response received during authentication steps
* @property {string} responseConf Indicates whether confidentiality was applied or not (GSSAPI only)
* @property {boolean} contextComplete Indicates that authentication has successfully completed or not
*/
/**
* Processes a single kerberos client-side step using the supplied server challenge.
*
* @kind function
* @memberof KerberosClient
* @param {string} challenge A string containing the base64-encoded server data (which may be empty for the first step)
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
KerberosClient.prototype.step = defineOperation(KerberosClient.prototype.step, [
{ name: 'challenge', type: 'string' },
{ name: 'callback', type: 'function', required: false }
]);
/**
* Perform the client side kerberos wrap step.
*
* @kind function
* @memberof KerberosClient
* @param {string} challenge The response returned after calling `unwrap`
* @param {object} [options] Optional settings
* @param {string} [options.user] The user to authorize
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
KerberosClient.prototype.wrap = defineOperation(KerberosClient.prototype.wrap, [
{ name: 'challenge', type: 'string' },
{ name: 'options', type: 'object' },
{ name: 'callback', type: 'function', required: false }
]);
/**
* Perform the client side kerberos unwrap step
*
* @kind function
* @memberof KerberosClient
* @param {string} challenge A string containing the base64-encoded server data
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
KerberosClient.prototype.unwrap = defineOperation(KerberosClient.prototype.unwrap, [
{ name: 'challenge', type: 'string' },
{ name: 'callback', type: 'function', required: false }
]);
/**
* @class KerberosServer
*
* @property {string} username The username used for authentication
* @property {string} response The last response received during authentication steps
* @property {string} targetName The target used for authentication
* @property {boolean} contextComplete Indicates that authentication has successfully completed or not
*/
/**
* Processes a single kerberos server-side step using the supplied client data.
*
* @kind function
* @memberof KerberosServer
* @param {string} challenge A string containing the base64-encoded client data
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
KerberosServer.prototype.step = defineOperation(KerberosServer.prototype.step, [
{ name: 'challenge', type: 'string' },
{ name: 'callback', type: 'function', required: false }
]);
/**
* This function provides a simple way to verify that a user name and password
* match those normally used for Kerberos authentication.
* It does this by checking that the supplied user name and password can be
* used to get a ticket for the supplied service.
* If the user name does not contain a realm, then the default realm supplied
* is used.
*
* For this to work properly the Kerberos must be configured properly on this
* machine.
* That will likely mean ensuring that the edu.mit.Kerberos preference file
* has the correct realms and KDCs listed.
*
* IMPORTANT: This method is vulnerable to KDC spoofing attacks and it should
* only be used for testing. Do not use this in any production system - your
* security could be compromised if you do.
*
* @kind function
* @param {string} username The Kerberos user name. If no realm is supplied, then the `defaultRealm` will be used.
* @param {string} password The password for the user.
* @param {string} service The Kerberos service to check access for.
* @param {string} [defaultRealm] The default realm to use if one is not supplied in the user argument.
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
const checkPassword = defineOperation(kerberos.checkPassword, [
{ name: 'username', type: 'string' },
{ name: 'password', type: 'string' },
{ name: 'service', type: 'string' },
{ name: 'defaultRealm', type: 'string', required: false },
{ name: 'callback', type: 'function', required: false }
]);
/**
* This function returns the service principal for the server given a service type and hostname.
*
* Details are looked up via the `/etc/keytab` file.
*
* @kind function
* @param {string} service The Kerberos service type for the server.
* @param {string} hostname The hostname of the server.
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
const principalDetails = defineOperation(kerberos.principalDetails, [
{ name: 'service', type: 'string' },
{ name: 'hostname', type: 'string' },
{ name: 'callback', type: 'function', required: false }
]);
/**
* Initializes a context for client-side authentication with the given service principal.
*
* @kind function
* @param {string} service A string containing the service principal in the form 'type@fqdn' (e.g. 'imap@mail.apple.com').
* @param {object} [options] Optional settings
* @param {string} [options.principal] Optional string containing the client principal in the form 'user@realm' (e.g. 'jdoe@example.com').
* @param {number} [options.gssFlags] Optional integer used to set GSS flags. (e.g. GSS_C_DELEG_FLAG|GSS_C_MUTUAL_FLAG|GSS_C_SEQUENCE_FLAG will allow for forwarding credentials to the remote host)
* @param {number} [options.mechOID] Optional GSS mech OID. Defaults to None (GSS_C_NO_OID). Other possible values are `GSS_MECH_OID_KRB5`, `GSS_MECH_OID_SPNEGO`.
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
const initializeClient = defineOperation(kerberos.initializeClient, [
{ name: 'service', type: 'string' },
{ name: 'options', type: 'object', default: { mechOID: GSS_C_NO_OID } },
{ name: 'callback', type: 'function', required: false }
]);
/**
* Initializes a context for server-side authentication with the given service principal.
*
* @kind function
* @param {string} service A string containing the service principal in the form 'type@fqdn' (e.g. 'imap@mail.apple.com').
* @param {function} [callback]
* @return {Promise} returns Promise if no callback passed
*/
const initializeServer = defineOperation(kerberos.initializeServer, [
{ name: 'service', type: 'string' },
{ name: 'callback', type: 'function', required: false }
]);
module.exports = {
initializeClient,
initializeServer,
principalDetails,
checkPassword,
// gss flags
GSS_C_DELEG_FLAG,
GSS_C_MUTUAL_FLAG,
GSS_C_REPLAY_FLAG,
GSS_C_SEQUENCE_FLAG,
GSS_C_CONF_FLAG,
GSS_C_INTEG_FLAG,
GSS_C_ANON_FLAG,
GSS_C_PROT_READY_FLAG,
GSS_C_TRANS_FLAG,
GSS_C_NO_OID,
// mechanism OIDs
GSS_MECH_OID_KRB5,
GSS_MECH_OID_SPNEGO
};

View File

@ -0,0 +1,84 @@
'use strict';
function validateParameter(parameter, specs, specIndex) {
const spec = specs[specIndex];
if (parameter == null && spec.required === false) {
return;
}
if (parameter == null) {
throw new TypeError(`Required parameter \`${spec.name}\` missing`);
}
const paramType = typeof parameter;
if (spec.type && paramType !== spec.type) {
if (spec.required === false) {
if (specs.slice(specIndex).some(def => def.type === paramType)) {
return false;
}
}
throw new TypeError(
`Invalid type for parameter \`${spec.name}\`, expected \`${
spec.type
}\` but found \`${typeof parameter}\``
);
}
return true;
}
function hasOwnProperty(object, property) {
return Object.prototype.hasOwnProperty.call(object, property);
}
/**
* Monkey-patches an existing method to support parameter validation, as well
* as adding support for returning Promises if callbacks are not provided.
*
* @private
* @param {function} fn the function to override
* @param {Array<Object>} paramDefs the definitions of each parameter to the function
*/
function defineOperation(fn, paramDefs) {
return function () {
const args = Array.prototype.slice.call(arguments);
const params = [];
for (let i = 0, argIdx = 0; i < paramDefs.length; ++i, ++argIdx) {
const def = paramDefs[i];
let arg = args[argIdx];
if (hasOwnProperty(def, 'default') && arg == null) arg = def.default;
if (def.type === 'object' && def.default != null) {
arg = Object.assign({}, def.default, arg);
}
// special case to allow `options` to be optional
if (def.name === 'options' && (typeof arg === 'function' || arg == null)) {
arg = {};
}
if (validateParameter(arg, paramDefs, i)) {
params.push(arg);
} else {
argIdx--;
}
}
const callback = arguments[arguments.length - 1];
if (typeof callback !== 'function') {
return new Promise((resolve, reject) => {
params.push((err, response) => {
if (err) return reject(err);
resolve(response);
});
fn.apply(this, params);
});
}
fn.apply(this, params);
};
}
module.exports = { defineOperation, validateParameter };

View File

@ -0,0 +1,73 @@
{
"name": "kerberos",
"version": "2.0.1",
"description": "Kerberos library for Node.js",
"main": "lib/index.js",
"files": [
"lib",
"src",
"binding.gyp",
"HISTORY.md",
"README.md"
],
"repository": {
"type": "git",
"url": "https://github.com/mongodb-js/kerberos.git"
},
"keywords": [
"kerberos",
"security",
"authentication"
],
"author": {
"name": "The MongoDB NodeJS Team",
"email": "dbx-node@mongodb.com"
},
"bugs": {
"url": "https://jira.mongodb.org/projects/NODE/issues/"
},
"dependencies": {
"bindings": "^1.5.0",
"node-addon-api": "^4.3.0",
"prebuild-install": "7.1.1"
},
"devDependencies": {
"chai": "^4.3.6",
"chai-string": "^1.5.0",
"chalk": "^4.1.2",
"clang-format": "^1.6.0",
"dmd-clear": "^0.1.2",
"eslint": "^8.9.0",
"eslint-config-prettier": "^8.3.0",
"eslint-plugin-prettier": "^4.0.0",
"jsdoc-to-markdown": "^7.1.1",
"mocha": "^9.2.0",
"mongodb": "^4.3.1",
"prebuild": "^11.0.3",
"prettier": "^2.5.1",
"request": "^2.88.0",
"standard-version": "^9.3.2"
},
"scripts": {
"install": "prebuild-install --runtime napi || node-gyp rebuild",
"format-cxx": "git-clang-format",
"format-js": "eslint lib test --fix",
"check:lint": "eslint lib test",
"precommit": "check-clang-format",
"test": "mocha test",
"docs": "jsdoc2md --template etc/README.hbs --plugin dmd-clear --files lib/kerberos.js > README.md",
"rebuild": "prebuild --runtime napi --compile",
"prebuild": "prebuild --runtime napi --strip --verbose --all",
"release": "standard-version -i HISTORY.md"
},
"engines": {
"node": ">=12.9.0"
},
"binary": {
"napi_versions": [
4
]
},
"license": "Apache-2.0",
"readmeFilename": "README.md"
}