Greetings,
I was just changing a simple app to move away
from ::Authen::AllowedUsers to
something that authenticates against one of our local systems, when i
noticed
I could connect using *any* username, no matter how i
configured ::Authen::AllowedUsers.
A bit of debugging shows that the callbacks in there never get
called. This
looks to be due to me also using ::Authen::StaticPassword (same as
the test
framework), which has a callback that does this:
sub get_password {
my ($self, $cb, %args) = @_;
$cb->set($self->{password});
}
Since the GetPassword callback is run before the CheckCleartext one,
this
->set() is called before AllowedUsers (or any other user/password
check for
that matter), which calls the following code in IQ.pm:
if ($can_get_password) {
$vhost->run_hook_chain(phase => "GetPassword",
args => [ username => $username, conn => $conn ],
methods => {
set => sub {
my (undef, $good_password) = @_;
if ($password && $password eq $good_password) {
$accept->();
} elsif ($digest) {
my $good_dig = lc(Digest::SHA1::sha1_hex
($conn->{stream_id} . $good_password));
if ($good_dig eq $digest) {
$accept->();
} else {
$reject->();
}
} else {
$reject->();
}
},
},
fallback => $reject
This means that any plugin that returns a password in the ->set()
call will
stop any further username/password checks from being done.
Should this code be abstracted out of IQ.pm? Should it go in Authen.pm
instead, so it can be overridden properly? Is it completely wrong and
should
be thrown out?
--
Jos
Boumans
http://www.linkedin.com/in/josboumans
How do I prove I'm not crazy to people who are?
