add check password hook

its main use case is to allow to easily support things like password+OTP for protocols without keyboard interactive support such as FTP and WebDAV
devopsmakers · Aug 19, 2020 · 8b0a181 · 8b0a181
1 parent 04c9a5c
commit 8b0a181
Show file tree

Hide file tree

Showing 27 changed files with 514 additions and 83 deletions.
diff --git a/README.md b/README.md
@@ -143,6 +143,7 @@ Directories outside the user home directory can be exposed as virtual folders, m
 ## Other hooks
 
 You can get notified as soon as a new connection is established using the [Post-connect hook](./docs/post-connect-hook.md) and after each login using the [Post-login hook](./docs/post-login-hook.md).
+You can use your own hook to [check passwords](./docs/check-password-hook.md).
 
 ## Storage backends
 

diff --git a/config/config.go b/config/config.go
@@ -120,12 +120,14 @@ func init() {
 				ExecuteOn: []string{},
 				Hook:      "",
 			},
-			ExternalAuthHook:  "",
-			ExternalAuthScope: 0,
-			CredentialsPath:   "credentials",
-			PreLoginHook:      "",
-			PostLoginHook:     "",
-			PostLoginScope:    0,
+			ExternalAuthHook:   "",
+			ExternalAuthScope:  0,
+			CredentialsPath:    "credentials",
+			PreLoginHook:       "",
+			PostLoginHook:      "",
+			PostLoginScope:     0,
+			CheckPasswordHook:  "",
+			CheckPasswordScope: 0,
 		},
 		HTTPDConfig: httpd.Conf{
 			BindPort:           8080,

diff --git a/dataprovider/bolt.go b/dataprovider/bolt.go
@@ -121,7 +121,7 @@ func (p BoltProvider) checkAvailability() error {
 	return err
 }
 
-func (p BoltProvider) validateUserAndPass(username string, password string) (User, error) {
+func (p BoltProvider) validateUserAndPass(username, password, ip, protocol string) (User, error) {
 	var user User
 	if len(password) == 0 {
 		return user, errors.New("Credentials cannot be null or empty")
@@ -131,7 +131,7 @@ func (p BoltProvider) validateUserAndPass(username string, password string) (Use
 		providerLog(logger.LevelWarn, "error authenticating user: %v, error: %v", username, err)
 		return user, err
 	}
-	return checkUserAndPass(user, password)
+	return checkUserAndPass(user, password, ip, protocol)
 }
 
 func (p BoltProvider) validateUserAndPubKey(username string, pubKey []byte) (User, string, error) {