|
|
|
|
using System;
|
|
|
|
|
using System.Linq;
|
|
|
|
|
using System.Net;
|
|
|
|
|
using System.Security.Claims;
|
|
|
|
|
using System.Security.Principal;
|
|
|
|
|
using Lidarr.Http.Extensions;
|
|
|
|
|
using Nancy;
|
|
|
|
|
using Nancy.Authentication.Basic;
|
|
|
|
|
using Nancy.Authentication.Forms;
|
|
|
|
|
using NLog;
|
|
|
|
|
using NzbDrone.Common.Extensions;
|
|
|
|
|
using NzbDrone.Core.Authentication;
|
|
|
|
|
using NzbDrone.Core.Configuration;
|
|
|
|
|
|
|
|
|
|
namespace Lidarr.Http.Authentication
|
|
|
|
|
{
|
|
|
|
|
public interface IAuthenticationService : IUserValidator, IUserMapper
|
|
|
|
|
{
|
|
|
|
|
void SetContext(NancyContext context);
|
|
|
|
|
|
|
|
|
|
void LogUnauthorized(NancyContext context);
|
|
|
|
|
User Login(NancyContext context, string username, string password);
|
|
|
|
|
void Logout(NancyContext context);
|
|
|
|
|
bool IsAuthenticated(NancyContext context);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public class AuthenticationService : IAuthenticationService
|
|
|
|
|
{
|
|
|
|
|
private const string AnonymousUser = "Anonymous";
|
|
|
|
|
private static readonly Logger _authLogger = LogManager.GetLogger("Auth");
|
|
|
|
|
private readonly IUserService _userService;
|
|
|
|
|
|
|
|
|
|
private static string API_KEY;
|
|
|
|
|
private static AuthenticationType AUTH_METHOD;
|
|
|
|
|
|
|
|
|
|
[ThreadStatic]
|
|
|
|
|
private static NancyContext _context;
|
|
|
|
|
|
|
|
|
|
public AuthenticationService(IConfigFileProvider configFileProvider, IUserService userService)
|
|
|
|
|
{
|
|
|
|
|
_userService = userService;
|
|
|
|
|
API_KEY = configFileProvider.ApiKey;
|
|
|
|
|
AUTH_METHOD = configFileProvider.AuthenticationMethod;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public void SetContext(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
// Validate and GetUserIdentifier don't have access to the NancyContext so get it from the pipeline earlier
|
|
|
|
|
_context = context;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public User Login(NancyContext context, string username, string password)
|
|
|
|
|
{
|
|
|
|
|
if (AUTH_METHOD == AuthenticationType.None)
|
|
|
|
|
{
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var user = _userService.FindUser(username, password);
|
|
|
|
|
|
|
|
|
|
if (user != null)
|
|
|
|
|
{
|
|
|
|
|
LogSuccess(context, username);
|
|
|
|
|
|
|
|
|
|
return user;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
LogFailure(context, username);
|
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public void Logout(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
if (AUTH_METHOD == AuthenticationType.None)
|
|
|
|
|
{
|
|
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (context.CurrentUser != null)
|
|
|
|
|
{
|
|
|
|
|
LogLogout(context, context.CurrentUser.Identity.Name);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public ClaimsPrincipal Validate(string username, string password)
|
|
|
|
|
{
|
|
|
|
|
if (AUTH_METHOD == AuthenticationType.None)
|
|
|
|
|
{
|
|
|
|
|
return new ClaimsPrincipal(new GenericIdentity(AnonymousUser));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var user = _userService.FindUser(username, password);
|
|
|
|
|
|
|
|
|
|
if (user != null)
|
|
|
|
|
{
|
|
|
|
|
if (AUTH_METHOD != AuthenticationType.Basic)
|
|
|
|
|
{
|
|
|
|
|
// Don't log success for basic auth
|
|
|
|
|
LogSuccess(_context, username);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return new ClaimsPrincipal(new GenericIdentity(user.Username));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
LogFailure(_context, username);
|
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public ClaimsPrincipal GetUserFromIdentifier(Guid identifier, NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
if (AUTH_METHOD == AuthenticationType.None)
|
|
|
|
|
{
|
|
|
|
|
return new ClaimsPrincipal(new GenericIdentity(AnonymousUser));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var user = _userService.FindUser(identifier);
|
|
|
|
|
|
|
|
|
|
if (user != null)
|
|
|
|
|
{
|
|
|
|
|
return new ClaimsPrincipal(new GenericIdentity(user.Username));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
LogInvalidated(_context);
|
|
|
|
|
|
|
|
|
|
return null;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public bool IsAuthenticated(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
var apiKey = GetApiKey(context);
|
|
|
|
|
|
|
|
|
|
if (context.Request.IsApiRequest())
|
|
|
|
|
{
|
|
|
|
|
return ValidApiKey(apiKey);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (AUTH_METHOD == AuthenticationType.None)
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (context.Request.IsFeedRequest())
|
|
|
|
|
{
|
|
|
|
|
if (ValidUser(context) || ValidApiKey(apiKey))
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (context.Request.IsLoginRequest())
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (context.Request.IsContentRequest())
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (ValidUser(context))
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private bool ValidUser(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
if (context.CurrentUser != null)
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private bool ValidApiKey(string apiKey)
|
|
|
|
|
{
|
|
|
|
|
if (API_KEY.Equals(apiKey))
|
|
|
|
|
{
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private string GetApiKey(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
var apiKeyHeader = context.Request.Headers["X-Api-Key"].FirstOrDefault();
|
|
|
|
|
var apiKeyQueryString = context.Request.Query["ApiKey"];
|
|
|
|
|
|
|
|
|
|
if (!apiKeyHeader.IsNullOrWhiteSpace())
|
|
|
|
|
{
|
|
|
|
|
return apiKeyHeader;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (apiKeyQueryString.HasValue)
|
|
|
|
|
{
|
|
|
|
|
return apiKeyQueryString.Value;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return context.Request.Headers.Authorization;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
public void LogUnauthorized(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
_authLogger.Info("Auth-Unauthorized ip {0} url '{1}'", GetRemoteIP(context), context.Request.Url.ToString());
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private void LogInvalidated(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
_authLogger.Info("Auth-Invalidated ip {0}", GetRemoteIP(context));
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private void LogFailure(NancyContext context, string username)
|
|
|
|
|
{
|
|
|
|
|
_authLogger.Warn("Auth-Failure ip {0} username '{1}'", GetRemoteIP(context), username);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private void LogSuccess(NancyContext context, string username)
|
|
|
|
|
{
|
|
|
|
|
_authLogger.Info("Auth-Success ip {0} username '{1}'", GetRemoteIP(context), username);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private void LogLogout(NancyContext context, string username)
|
|
|
|
|
{
|
|
|
|
|
_authLogger.Info("Auth-Logout ip {0} username '{1}'", GetRemoteIP(context), username);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private string GetRemoteIP(NancyContext context)
|
|
|
|
|
{
|
|
|
|
|
if (context == null || context.Request == null)
|
|
|
|
|
{
|
|
|
|
|
return "Unknown";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var remoteAddress = context.Request.UserHostAddress;
|
|
|
|
|
IPAddress remoteIP;
|
|
|
|
|
|
|
|
|
|
// Only check if forwarded by a local network reverse proxy
|
|
|
|
|
if (IPAddress.TryParse(remoteAddress, out remoteIP) && remoteIP.IsLocalAddress())
|
|
|
|
|
{
|
|
|
|
|
var realIPHeader = context.Request.Headers["X-Real-IP"];
|
|
|
|
|
if (realIPHeader.Any())
|
|
|
|
|
{
|
|
|
|
|
return realIPHeader.First().ToString();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
var forwardedForHeader = context.Request.Headers["X-Forwarded-For"];
|
|
|
|
|
if (forwardedForHeader.Any())
|
|
|
|
|
{
|
|
|
|
|
// Get the first address that was forwarded by a local IP to prevent remote clients faking another proxy
|
|
|
|
|
foreach (var forwardedForAddress in forwardedForHeader.SelectMany(v => v.Split(',')).Select(v => v.Trim()).Reverse())
|
|
|
|
|
{
|
|
|
|
|
if (!IPAddress.TryParse(forwardedForAddress, out remoteIP))
|
|
|
|
|
{
|
|
|
|
|
return remoteAddress;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!remoteIP.IsLocalAddress())
|
|
|
|
|
{
|
|
|
|
|
return forwardedForAddress;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
remoteAddress = forwardedForAddress;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return remoteAddress;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|