James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 1 | #pragma once |
| 2 | |
Paul Fertser | 29aab24 | 2024-06-12 19:28:47 +0000 | [diff] [blame] | 3 | #include "cookies.hpp" |
Ed Tanous | 3ccb3ad | 2023-01-13 17:40:03 -0800 | [diff] [blame] | 4 | #include "forward_unauthorized.hpp" |
| 5 | #include "http_request.hpp" |
| 6 | #include "http_response.hpp" |
| 7 | #include "http_utility.hpp" |
| 8 | #include "pam_authenticate.hpp" |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 9 | #include "webroutes.hpp" |
| 10 | |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 11 | #include <boost/container/flat_set.hpp> |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 12 | |
| 13 | #include <random> |
Ed Tanous | b5a7693 | 2020-09-29 16:16:58 -0700 | [diff] [blame] | 14 | #include <utility> |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 15 | |
| 16 | namespace crow |
| 17 | { |
| 18 | |
Nan Zhou | d055a34 | 2022-05-25 01:15:34 +0000 | [diff] [blame] | 19 | namespace authentication |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 20 | { |
| 21 | |
Ed Tanous | b1d736f | 2023-02-10 12:24:00 -0800 | [diff] [blame] | 22 | inline void cleanupTempSession(const Request& req) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 23 | { |
| 24 | // TODO(ed) THis should really be handled by the persistent data |
| 25 | // middleware, but because it is upstream, it doesn't have access to the |
| 26 | // session information. Should the data middleware persist the current |
| 27 | // user session? |
| 28 | if (req.session != nullptr && |
| 29 | req.session->persistence == |
Ed Tanous | 52cc112 | 2020-07-18 13:51:21 -0700 | [diff] [blame] | 30 | persistent_data::PersistenceType::SINGLE_REQUEST) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 31 | { |
| 32 | persistent_data::SessionStore::getInstance().removeSession(req.session); |
| 33 | } |
| 34 | } |
| 35 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 36 | inline std::shared_ptr<persistent_data::UserSession> |
Sunitha Harish | c0ea7ae | 2020-10-30 02:37:30 -0500 | [diff] [blame] | 37 | performBasicAuth(const boost::asio::ip::address& clientIp, |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 38 | std::string_view authHeader) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 39 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 40 | BMCWEB_LOG_DEBUG("[AuthMiddleware] Basic authentication"); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 41 | |
Ed Tanous | 11ba397 | 2022-07-11 09:50:41 -0700 | [diff] [blame] | 42 | if (!authHeader.starts_with("Basic ")) |
John Edward Broadbent | 97a056a | 2021-09-10 14:56:19 -0700 | [diff] [blame] | 43 | { |
| 44 | return nullptr; |
| 45 | } |
| 46 | |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 47 | std::string_view param = authHeader.substr(strlen("Basic ")); |
John Edward Broadbent | 97a056a | 2021-09-10 14:56:19 -0700 | [diff] [blame] | 48 | std::string authData; |
| 49 | |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 50 | if (!crow::utility::base64Decode(param, authData)) |
| 51 | { |
| 52 | return nullptr; |
| 53 | } |
| 54 | std::size_t separator = authData.find(':'); |
| 55 | if (separator == std::string::npos) |
| 56 | { |
| 57 | return nullptr; |
| 58 | } |
| 59 | |
| 60 | std::string user = authData.substr(0, separator); |
| 61 | separator += 1; |
| 62 | if (separator > authData.size()) |
| 63 | { |
| 64 | return nullptr; |
| 65 | } |
| 66 | std::string pass = authData.substr(separator); |
| 67 | |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 68 | BMCWEB_LOG_DEBUG("[AuthMiddleware] Authenticating user: {}", user); |
| 69 | BMCWEB_LOG_DEBUG("[AuthMiddleware] User IPAddress: {}", |
| 70 | clientIp.to_string()); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 71 | |
| 72 | int pamrc = pamAuthenticateUser(user, pass); |
| 73 | bool isConfigureSelfOnly = pamrc == PAM_NEW_AUTHTOK_REQD; |
| 74 | if ((pamrc != PAM_SUCCESS) && !isConfigureSelfOnly) |
| 75 | { |
| 76 | return nullptr; |
| 77 | } |
| 78 | |
| 79 | // TODO(ed) generateUserSession is a little expensive for basic |
| 80 | // auth, as it generates some random identifiers that will never be |
| 81 | // used. This should have a "fast" path for when user tokens aren't |
| 82 | // needed. |
| 83 | // This whole flow needs to be revisited anyway, as we can't be |
| 84 | // calling directly into pam for every request |
| 85 | return persistent_data::SessionStore::getInstance().generateUserSession( |
Ed Tanous | bb759e3 | 2022-08-02 17:07:54 -0700 | [diff] [blame] | 86 | user, clientIp, std::nullopt, |
Sunitha Harish | d323922 | 2021-02-24 15:33:29 +0530 | [diff] [blame] | 87 | persistent_data::PersistenceType::SINGLE_REQUEST, isConfigureSelfOnly); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 88 | } |
| 89 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 90 | inline std::shared_ptr<persistent_data::UserSession> |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 91 | performTokenAuth(std::string_view authHeader) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 92 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 93 | BMCWEB_LOG_DEBUG("[AuthMiddleware] Token authentication"); |
Ed Tanous | 11ba397 | 2022-07-11 09:50:41 -0700 | [diff] [blame] | 94 | if (!authHeader.starts_with("Token ")) |
John Edward Broadbent | 97a056a | 2021-09-10 14:56:19 -0700 | [diff] [blame] | 95 | { |
| 96 | return nullptr; |
| 97 | } |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 98 | std::string_view token = authHeader.substr(strlen("Token ")); |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 99 | auto sessionOut = |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 100 | persistent_data::SessionStore::getInstance().loginSessionByToken(token); |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 101 | return sessionOut; |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 102 | } |
| 103 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 104 | inline std::shared_ptr<persistent_data::UserSession> |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 105 | performXtokenAuth(const boost::beast::http::header<true>& reqHeader) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 106 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 107 | BMCWEB_LOG_DEBUG("[AuthMiddleware] X-Auth-Token authentication"); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 108 | |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 109 | std::string_view token = reqHeader["X-Auth-Token"]; |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 110 | if (token.empty()) |
| 111 | { |
| 112 | return nullptr; |
| 113 | } |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 114 | auto sessionOut = |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 115 | persistent_data::SessionStore::getInstance().loginSessionByToken(token); |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 116 | return sessionOut; |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 117 | } |
| 118 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 119 | inline std::shared_ptr<persistent_data::UserSession> |
Ed Tanous | 1d86960 | 2022-12-19 13:48:12 -0800 | [diff] [blame] | 120 | performCookieAuth(boost::beast::http::verb method [[maybe_unused]], |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 121 | const boost::beast::http::header<true>& reqHeader) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 122 | { |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 123 | using headers = boost::beast::http::header<true>; |
| 124 | std::pair<headers::const_iterator, headers::const_iterator> cookies = |
| 125 | reqHeader.equal_range(boost::beast::http::field::cookie); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 126 | |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 127 | for (auto it = cookies.first; it != cookies.second; it++) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 128 | { |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 129 | std::string_view cookieValue = it->value(); |
| 130 | BMCWEB_LOG_DEBUG("Checking cookie {}", cookieValue); |
| 131 | auto startIndex = cookieValue.find("SESSION="); |
| 132 | if (startIndex == std::string::npos) |
| 133 | { |
| 134 | BMCWEB_LOG_DEBUG( |
| 135 | "Cookie was present, but didn't look like a session {}", |
| 136 | cookieValue); |
| 137 | continue; |
| 138 | } |
| 139 | startIndex += sizeof("SESSION=") - 1; |
| 140 | auto endIndex = cookieValue.find(';', startIndex); |
| 141 | if (endIndex == std::string::npos) |
| 142 | { |
| 143 | endIndex = cookieValue.size(); |
| 144 | } |
| 145 | std::string_view authKey = cookieValue.substr(startIndex, |
| 146 | endIndex - startIndex); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 147 | |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 148 | std::shared_ptr<persistent_data::UserSession> sessionOut = |
| 149 | persistent_data::SessionStore::getInstance().loginSessionByToken( |
| 150 | authKey); |
| 151 | if (sessionOut == nullptr) |
| 152 | { |
| 153 | return nullptr; |
| 154 | } |
| 155 | sessionOut->cookieAuth = true; |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 156 | |
Ed Tanous | 576db69 | 2024-05-10 16:37:56 -0700 | [diff] [blame] | 157 | if constexpr (!BMCWEB_INSECURE_DISABLE_CSRF) |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 158 | { |
| 159 | // RFC7231 defines methods that need csrf protection |
| 160 | if (method != boost::beast::http::verb::get) |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 161 | { |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 162 | std::string_view csrf = reqHeader["X-XSRF-TOKEN"]; |
| 163 | // Make sure both tokens are filled |
| 164 | if (csrf.empty() || sessionOut->csrfToken.empty()) |
| 165 | { |
| 166 | return nullptr; |
| 167 | } |
| 168 | |
| 169 | if (csrf.size() != persistent_data::sessionTokenSize) |
| 170 | { |
| 171 | return nullptr; |
| 172 | } |
| 173 | // Reject if csrf token not available |
| 174 | if (!crow::utility::constantTimeStringCompare( |
| 175 | csrf, sessionOut->csrfToken)) |
| 176 | { |
| 177 | return nullptr; |
| 178 | } |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 179 | } |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 180 | } |
Ed Tanous | 3eaecac | 2024-05-08 16:26:24 -0700 | [diff] [blame] | 181 | return sessionOut; |
Ed Tanous | 9f217c2 | 2024-04-19 17:22:43 -0700 | [diff] [blame] | 182 | } |
| 183 | return nullptr; |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 184 | } |
| 185 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 186 | inline std::shared_ptr<persistent_data::UserSession> |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 187 | performTLSAuth(Response& res, |
| 188 | const boost::beast::http::header<true>& reqHeader, |
Ed Tanous | b5a7693 | 2020-09-29 16:16:58 -0700 | [diff] [blame] | 189 | const std::weak_ptr<persistent_data::UserSession>& session) |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 190 | { |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 191 | if (auto sp = session.lock()) |
| 192 | { |
| 193 | // set cookie only if this is req from the browser. |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 194 | if (reqHeader["User-Agent"].empty()) |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 195 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 196 | BMCWEB_LOG_DEBUG(" TLS session: {} will be used for this request.", |
| 197 | sp->uniqueId); |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 198 | return sp; |
| 199 | } |
Karol Niczyj | ade2fe7 | 2022-04-27 18:04:58 +0200 | [diff] [blame] | 200 | // TODO: change this to not switch to cookie auth |
Paul Fertser | 29aab24 | 2024-06-12 19:28:47 +0000 | [diff] [blame] | 201 | bmcweb::setSessionCookies(res, *sp); |
Ed Tanous | 994fd86 | 2023-06-06 13:37:03 -0700 | [diff] [blame] | 202 | res.addHeader(boost::beast::http::field::set_cookie, |
| 203 | "IsAuthenticated=true; Secure"); |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 204 | BMCWEB_LOG_DEBUG( |
| 205 | " TLS session: {} with cookie will be used for this request.", |
| 206 | sp->uniqueId); |
Karol Niczyj | ade2fe7 | 2022-04-27 18:04:58 +0200 | [diff] [blame] | 207 | return sp; |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 208 | } |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 209 | return nullptr; |
| 210 | } |
| 211 | |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 212 | // checks if request can be forwarded without authentication |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 213 | inline bool isOnAllowlist(std::string_view url, boost::beast::http::verb method) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 214 | { |
Ed Tanous | 3822150 | 2024-06-03 12:19:38 -0700 | [diff] [blame] | 215 | // Handle the case where the router registers routes as both ending with / |
| 216 | // and not. |
VinceChang6637 | 8f5df13 | 2024-06-14 17:13:16 +0800 | [diff] [blame] | 217 | if (url.ends_with('/') && url != "/") |
Ed Tanous | 3822150 | 2024-06-03 12:19:38 -0700 | [diff] [blame] | 218 | { |
| 219 | url.remove_suffix(1); |
| 220 | } |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 221 | if (boost::beast::http::verb::get == method) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 222 | { |
Ed Tanous | 3822150 | 2024-06-03 12:19:38 -0700 | [diff] [blame] | 223 | if ((url == "/redfish") || // |
| 224 | (url == "/redfish/v1") || // |
| 225 | (url == "/redfish/v1/odata") || // |
| 226 | (url == "/redfish/v1/$metadata")) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 227 | { |
| 228 | return true; |
| 229 | } |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 230 | if (crow::webroutes::routes.find(std::string(url)) != |
Ed Tanous | d4d2579 | 2020-09-29 15:15:03 -0700 | [diff] [blame] | 231 | crow::webroutes::routes.end()) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 232 | { |
| 233 | return true; |
| 234 | } |
| 235 | } |
| 236 | |
| 237 | // it's allowed to POST on session collection & login without |
| 238 | // authentication |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 239 | if (boost::beast::http::verb::post == method) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 240 | { |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 241 | if ((url == "/redfish/v1/SessionService/Sessions") || |
Ed Tanous | e76cd86 | 2022-03-14 09:12:00 -0700 | [diff] [blame] | 242 | (url == "/redfish/v1/SessionService/Sessions/Members") || |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 243 | (url == "/login")) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 244 | { |
| 245 | return true; |
| 246 | } |
| 247 | } |
| 248 | |
| 249 | return false; |
| 250 | } |
| 251 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 252 | inline std::shared_ptr<persistent_data::UserSession> authenticate( |
| 253 | const boost::asio::ip::address& ipAddress [[maybe_unused]], |
| 254 | Response& res [[maybe_unused]], |
| 255 | boost::beast::http::verb method [[maybe_unused]], |
| 256 | const boost::beast::http::header<true>& reqHeader, |
| 257 | [[maybe_unused]] const std::shared_ptr<persistent_data::UserSession>& |
| 258 | session) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 259 | { |
Ed Tanous | 52cc112 | 2020-07-18 13:51:21 -0700 | [diff] [blame] | 260 | const persistent_data::AuthConfigMethods& authMethodsConfig = |
| 261 | persistent_data::SessionStore::getInstance().getAuthMethodsConfig(); |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 262 | |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 263 | std::shared_ptr<persistent_data::UserSession> sessionOut = nullptr; |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 264 | if constexpr (BMCWEB_MUTUAL_TLS_AUTH) |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 265 | { |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 266 | if (authMethodsConfig.tls) |
| 267 | { |
| 268 | sessionOut = performTLSAuth(res, reqHeader, session); |
| 269 | } |
James Feist | 6964c98 | 2020-07-28 16:10:23 -0700 | [diff] [blame] | 270 | } |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 271 | if constexpr (BMCWEB_XTOKEN_AUTH) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 272 | { |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 273 | if (sessionOut == nullptr && authMethodsConfig.xtoken) |
| 274 | { |
| 275 | sessionOut = performXtokenAuth(reqHeader); |
| 276 | } |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 277 | } |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 278 | if constexpr (BMCWEB_COOKIE_AUTH) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 279 | { |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 280 | if (sessionOut == nullptr && authMethodsConfig.cookie) |
| 281 | { |
| 282 | sessionOut = performCookieAuth(method, reqHeader); |
| 283 | } |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 284 | } |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 285 | std::string_view authHeader = reqHeader["Authorization"]; |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 286 | BMCWEB_LOG_DEBUG("authHeader={}", authHeader); |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 287 | if constexpr (BMCWEB_SESSION_AUTH) |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 288 | { |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 289 | if (sessionOut == nullptr && authMethodsConfig.sessionToken) |
| 290 | { |
| 291 | sessionOut = performTokenAuth(authHeader); |
| 292 | } |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 293 | } |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 294 | if constexpr (BMCWEB_BASIC_AUTH) |
John Edward Broadbent | 97a056a | 2021-09-10 14:56:19 -0700 | [diff] [blame] | 295 | { |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 296 | if (sessionOut == nullptr && authMethodsConfig.basic) |
| 297 | { |
| 298 | sessionOut = performBasicAuth(ipAddress, authHeader); |
| 299 | } |
John Edward Broadbent | 97a056a | 2021-09-10 14:56:19 -0700 | [diff] [blame] | 300 | } |
| 301 | if (sessionOut != nullptr) |
| 302 | { |
| 303 | return sessionOut; |
| 304 | } |
| 305 | |
John Edward Broadbent | 59b98b2 | 2021-07-13 15:36:32 -0700 | [diff] [blame] | 306 | return nullptr; |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 307 | } |
| 308 | |
Nan Zhou | d055a34 | 2022-05-25 01:15:34 +0000 | [diff] [blame] | 309 | } // namespace authentication |
James Feist | 3909dc8 | 2020-04-03 10:58:55 -0700 | [diff] [blame] | 310 | } // namespace crow |