tursom/memgraph
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix handling of Bolt init auth metadata

Browse Source 
Summary:
Our implementation of the Bolt protocol now correctly handles INIT message
metadata used for authentification. The related description from the Bolt
standard is: 'The token must contain either just the entry {"scheme": "none"}
or the keys scheme, principal, and credentials. Example {"scheme": "basic",
"principal": "user", "credentials": "secret"}". If no scheme is provided, it
defaults to "none".'

Reviewers: msantl

Reviewed By: msantl

Subscribers: pullbot

Differential Revision: https://phabricator.memgraph.io/D1518
This commit is contained in:
Matej Ferencevic 2018-07-30 16:07:56 +02:00
parent f7f7ccde60
commit 6546d1de07
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/communication/bolt/v1/states/init.hpp
View File

@ -61,21 +61,27 @@ State StateInitRun(Session &session) {
<< std::endl; << std::endl;
// Get authentication data. // Get authentication data.
std::string username, password;
auto &data = metadata.ValueMap(); auto &data = metadata.ValueMap();
if (!data.count("scheme") || !data.count("principal") || if (!data.count("scheme")) {
!data.count("credentials")) {
LOG(WARNING) << "The client didn't supply authentication information!"; LOG(WARNING) << "The client didn't supply authentication information!";
return State::Close; return State::Close;
} }
if (data["scheme"].ValueString() != "basic") { if (data["scheme"].ValueString() == "basic") {
if (!data.count("principal") || !data.count("credentials")) {
LOG(WARNING) << "The client didn't supply authentication information!";
return State::Close;
}
username = data["principal"].ValueString();
password = data["credentials"].ValueString();
} else if (data["scheme"].ValueString() != "none") {
LOG(WARNING) << "Unsupported authentication scheme: " LOG(WARNING) << "Unsupported authentication scheme: "
<< data["scheme"].ValueString(); << data["scheme"].ValueString();
return State::Close; return State::Close;
} }
// Authenticate the user. // Authenticate the user.
if (!session.Authenticate(data["principal"].ValueString(), if (!session.Authenticate(username, password)) {
data["credentials"].ValueString())) {
if (!session.encoder_.MessageFailure( if (!session.encoder_.MessageFailure(
{{"code", "Memgraph.ClientError.Security.Unauthenticated"}, {{"code", "Memgraph.ClientError.Security.Unauthenticated"},
{"message", "Authentication failure"}})) { {"message", "Authentication failure"}})) {