Poco::OSP::Auth::Data

class AuthAdminServiceImpl

File Information

Library: OSP/Auth/Data
Package: Auth
Header: Poco/OSP/Auth/Data/AuthAdminServiceImpl.h

Description

This class implements the AuthAdminService using a SQL database accessed via the POCO Data library, and optionally LDAP for password verification and permissions.

Upon successful authentication of a user, the class will cache the permissions for the user so that further permission checks are very quick.

This implementation supports multiple variants/versions of storing password hashes.

  • Version 1 is the original mechanism, using MD5 with a global salt. This is no longer considered secure and should no longer be used.
  • Version 2 uses PBKDF2 with HMAC-SHA1 and per-user random salt.
  • Version 3 uses PBKDF2 with HMAC-SHA1 and per-user random salt with additional MD5 password pre-hashing, allowing implementation of secure challenge-response authentication mechanisms such as SCRAM-SHA1.
  • Version 4 uses PBKDF2 with HMAC-SHA256, SHA1 pre-hasing and a minimum of 50.000 iterations, and a minimum salt length of 8 bytes.

Version 4 is recommended for new deployments. Stored passwords using a lower version than the one configured will automatically be upgraded as soon as a user successfully authenticates.

As of 2021, the recommended number of iterations for PBKDF2 with HMAC-SHA256 is 310.000 for HMAC-SHA256 (version 4) and 720.000 for HMAC-SHA1 (version 3). See https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html for more information.

Versions 3 and 4 pass a hash of the password rather than the actual password to the PBKDF2 hashing function. This is to guard against certain timing attacks that would allow an attacker to get hints regarding the password length, and also to avoid excessive CPU usage in case of very long passwords.

Note that the getUserAttribute() method of this implementation supports the following special attributes:

  • $salt: Returns the salt used for hashing the given user's password. For Version 1, this will be the configured global salt string. For Version 2, this will be a string consisting entirely of hexadecimal digits. For Versions 3 and 4, this will be a string containing binary data.
  • $iterations: Returns the number of PBKDF2 iterations used for hashing the given user's password.
  • $hash: Returns the password hash stored for the given user. For Versions 1 and 2, this will be a string consisting entirely of hexadecimal digits. For Versions 3 and 4, this will be a string containing binary data.
  • $version: Returns the version of the hash used for the given user.

Inheritance

Direct Base Classes: Poco::OSP::Auth::AbstractLDAPAuthAdminService

All Base Classes: Poco::OSP::Auth::AbstractLDAPAuthAdminService, Poco::OSP::Auth::AuthAdminService, Poco::OSP::Auth::AuthService, Poco::OSP::Service, Poco::RefCountedObject

Member Summary

Member Functions: addRole, addUser, addUserImpl, assignRoleToUser, attributesForUser, authenticate, authenticateDB, authorize, authorizeRole, changePassword, changePasswordImpl, checkDatabaseConnectivity, createOrUpdateUserImpl, discoverInlineAttributes, effectivePermissionsForUser, findUsersByAttribute, getUserAttribute, grantPermissionsToRole, grantPermissionsToUser, invalidateCaches, isA, isExternalUser, isUserLockedOut, lockOutUser, permissionsForRole, permissionsForUser, removeRole, removeRoleFromUser, removeUser, removeUserAttribute, removeUserImpl, replacePermissionsForRole, replacePermissionsForUser, replacePermissionsForUserImpl, replaceRolesForUser, replaceRolesForUserImpl, replaceUserAttributeImpl, replaceUserAttributes, reset, revokePermission, revokePermissionsFromRole, revokePermissionsFromUser, roleExists, roleExistsImpl, roles, rolesForUser, session, sessionExpired, setUserAttribute, setupSession, type, uncacheUser, uncacheUserImpl, unlockOutUser, updateUserAttributes, userEnabled, userExists, userExistsImpl, users, usersWithAttribute, usersWithName, usersWithPermission, usersWithRole

Inherited Functions: addRole, addUser, assignRoleToUser, attributesForUser, authenticate, authenticateLDAP, authorize, changePassword, createOrUpdateUserImpl, duplicate, effectivePermissionsForUser, escapeLDAP, findUsersByAttribute, getUserAttribute, grantPermissionsToRole, grantPermissionsToUser, invalidateCaches, isA, isExternalUser, isExtraAttribute, isUserLockedOut, lockOutUser, permissionsForRole, permissionsForUser, referenceCount, release, removeRole, removeRoleFromUser, removeUser, removeUserAttribute, replacePermissionsForRole, replacePermissionsForUser, replacePermissionsForUserImpl, replaceRolesForUser, replaceRolesForUserImpl, replaceUserAttributeImpl, replaceUserAttributes, reset, revokePermission, revokePermissionsFromRole, revokePermissionsFromUser, roleExists, roles, rolesForUser, setUserAttribute, type, uncacheUser, unlockOutUser, updateUserAttributes, userEnabled, userExists, users, usersWithAttribute, usersWithName, usersWithPermission, usersWithRole

Nested Classes

struct AuthParams

 

Types Aliases

Ptr

using Ptr = Poco::AutoPtr < AuthAdminServiceImpl >;

Enumerations

Anonymous protected

V4_MIN_SALT_LENGTH = 8

V4_MIN_ITERATIONS = 50000

Anonymous protected

SQL_CACHE_BUCKET_SIZE = 113

Constructors

AuthAdminServiceImpl

AuthAdminServiceImpl(
    const Poco::Util::AbstractConfiguration & properties,
    Poco::Logger & logger,
    const AuthParams & authParams,
    const LDAPParams & ldapParams
);

Creates the AuthAdminServiceImpl using the given authentication and LDAP parameters.

Note: if ldapParams.uri is empty, LDAP authentication will be disabled.

See the Poco::Data::Session class for more information on connector names and connection strings.

Destructor

~AuthAdminServiceImpl virtual

~AuthAdminServiceImpl();

Destroys the AuthAdminServiceImpl.

Member Functions

addRole virtual

void addRole(
    const std::string & rolename
);

See also: Poco::OSP::Auth::AuthAdminService::addRole()

addUser virtual

void addUser(
    const std::string & username,
    const std::string & password
);

See also: Poco::OSP::Auth::AuthAdminService::addUser()

assignRoleToUser virtual

void assignRoleToUser(
    const std::string & username,
    const std::string & rolename
);

See also: Poco::OSP::Auth::AuthAdminService::assignRoleToUser()

attributesForUser virtual

void attributesForUser(
    const std::string & username,
    std::set < std::string > & attributes
) const;

See also: Poco::OSP::Auth::AuthAdminService::attributesForUser()

attributesForUser virtual

void attributesForUser(
    const std::string & username,
    std::map < std::string, std::string > & attributes
) const;

See also: Poco::OSP::Auth::AuthAdminService::attributesForUser()

authenticate virtual

bool authenticate(
    const std::string & username,
    const std::string & credentials
) const;

See also: Poco::OSP::Auth::AuthService::authenticate()

authorize virtual

bool authorize(
    const std::string & username,
    const std::string & permission
) const;

See also: Poco::OSP::Auth::AuthService::authorize()

authorize virtual

bool authorize(
    const std::string & userName,
    const std::string & roleOrScope,
    const std::string & permission
) const;

See also: Poco::OSP::Auth::AuthService::authorize()

changePassword virtual

void changePassword(
    const std::string & username,
    const std::string & password
);

See also: Poco::OSP::Auth::AuthAdminService::changePassword()

checkDatabaseConnectivity static

static bool checkDatabaseConnectivity(
    const Poco::Util::AbstractConfiguration & properties,
    const AuthParams & authParams,
    Poco::Logger & logger
);

Checks whether the database connection is ok.

effectivePermissionsForUser virtual

void effectivePermissionsForUser(
    const std::string & username,
    std::set < std::string > & permissions
) const;

See also: Poco::OSP::Auth::AuthAdminService::effectivePermissionsForUser()

findUsersByAttribute virtual

std::vector < std::string > findUsersByAttribute(
    const std::string & attribute,
    const std::string & value
) const;

See also: Poco::OSP::Auth::AuthAdminService::findUsersByAttribute()

getUserAttribute virtual

std::string getUserAttribute(
    const std::string & username,
    const std::string & attribute,
    const std::string & deflt = std::string ()
) const;

See also: Poco::OSP::Auth::AuthAdminService::getUserAttribute()

grantPermissionsToRole virtual

void grantPermissionsToRole(
    const std::string & rolename,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::grantPermissionsToRole()

grantPermissionsToUser virtual

void grantPermissionsToUser(
    const std::string & username,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::grantPermissionsToUser()

invalidateCaches virtual

void invalidateCaches(
    int what = INVALIDATE_ALL
);

See also: Poco::OSP::Auth::AuthAdminService::invalidateCaches()

isA virtual

bool isA(
    const std::type_info & otherType
) const;

See also: Poco::OSP::Auth::AuthAdminService::isA()

isExternalUser virtual

bool isExternalUser(
    const std::string & username
) const;

See also: Poco::OSP::Auth::AuthAdminService::isExternalUser()

isUserLockedOut virtual

bool isUserLockedOut(
    const std::string & username
) const;

See also: Poco::OSP::Auth::AuthAdminService::isUserLockedOut()

lockOutUser virtual

void lockOutUser(
    const std::string & username,
    const Poco::DateTime & lockOutUntil
);

See also: Poco::OSP::Auth::AuthAdminService::lockOutUser()

permissionsForRole virtual

void permissionsForRole(
    const std::string & rolename,
    std::set < std::string > & permissions
) const;

See also: Poco::OSP::Auth::AuthAdminService::permissionsForRole()

permissionsForUser virtual

void permissionsForUser(
    const std::string & username,
    std::set < std::string > & permissions
) const;

See also: Poco::OSP::Auth::AuthAdminService::permissionsForUser()

removeRole virtual

void removeRole(
    const std::string & rolename
);

See also: Poco::OSP::Auth::AuthAdminService::removeRole()

removeRoleFromUser virtual

void removeRoleFromUser(
    const std::string & username,
    const std::string & rolename
);

See also: Poco::OSP::Auth::AuthAdminService::removeRoleFromUser()

removeUser virtual

void removeUser(
    const std::string & username
);

See also: Poco::OSP::Auth::AuthAdminService::removeUser()

removeUserAttribute virtual

void removeUserAttribute(
    const std::string & username,
    const std::string & attribute
);

See also: Poco::OSP::Auth::AuthAdminService::removeUserAttribute()

replacePermissionsForRole virtual

void replacePermissionsForRole(
    const std::string & rolename,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::replacePermissionsForRole()

replacePermissionsForUser virtual

void replacePermissionsForUser(
    const std::string & username,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::replacePermissionsForUser()

replaceRolesForUser virtual

void replaceRolesForUser(
    const std::string & username,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::replaceRolesForUser()

replaceUserAttributes virtual

void replaceUserAttributes(
    const std::string & username,
    const std::map < std::string, std::string > & attributes
);

See also: Poco::OSP::Auth::AuthAdminService::replaceUserAttributes()

reset virtual

void reset();

See also: Poco::OSP::Auth::AuthAdminService::reset()

revokePermission virtual

void revokePermission(
    const std::string & permission
);

See also: Poco::OSP::Auth::AuthAdminService::revokePermission()

revokePermissionsFromRole virtual

void revokePermissionsFromRole(
    const std::string & rolename,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::revokePermissionsFromRole()

revokePermissionsFromUser virtual

void revokePermissionsFromUser(
    const std::string & username,
    const std::set < std::string > & permissions
);

See also: Poco::OSP::Auth::AuthAdminService::revokePermissionsFromUser()

roleExists virtual

bool roleExists(
    const std::string & rolename
) const;

See also: Poco::OSP::Auth::AuthAdminService::roleExists()

roles virtual

void roles(
    std::set < std::string > & roles
) const;

See also: Poco::OSP::Auth::AuthAdminService::roles()

rolesForUser virtual

void rolesForUser(
    const std::string & username,
    std::set < std::string > & roles
) const;

See also: Poco::OSP::Auth::AuthAdminService::rolesForUser()

setUserAttribute virtual

void setUserAttribute(
    const std::string & username,
    const std::string & attribute,
    const std::string & value
);

See also: Poco::OSP::Auth::AuthAdminService::setUserAttribute()

type virtual

const std::type_info & type() const;

See also: Poco::OSP::Auth::AuthAdminService::type()

uncacheUser virtual

void uncacheUser(
    const std::string & username
);

See also: Poco::OSP::Auth::AuthAdminService::uncacheUser()

unlockOutUser virtual

void unlockOutUser(
    const std::string & username
);

See also: Poco::OSP::Auth::AuthAdminService::unlockOutUser()

updateUserAttributes virtual

void updateUserAttributes(
    const std::string & username,
    const std::map < std::string, std::string > & attributes
);

See also: Poco::OSP::Auth::AuthAdminService::updateUserAttributes()

userEnabled virtual

bool userEnabled(
    const std::string & username
) const;

See also: Poco::OSP::Auth::AuthAdminService::userEnabled()

userExists virtual

bool userExists(
    const std::string & username
) const;

See also: Poco::OSP::Auth::AuthService::userExists()

users virtual

int users(
    std::set < std::string > & users,
    int first = 0,
    int limit = 0
) const;

See also: Poco::OSP::Auth::AuthAdminService::users()

usersWithAttribute virtual

int usersWithAttribute(
    std::set < std::string > & users,
    const std::string & attribute,
    const std::string & value,
    int first = 0,
    int limit = 0
) const;

See also: Poco::OSP::Auth::AuthAdminService::usersWithAttribute()

usersWithName virtual

int usersWithName(
    std::set < std::string > & users,
    const std::string & pattern,
    int first = 0,
    int limit = 0
) const;

See also: Poco::OSP::Auth::AuthAdminService::usersWithName()

usersWithPermission virtual

int usersWithPermission(
    std::set < std::string > & users,
    const std::string & permission,
    int first = 0,
    int limit = 0
) const;

See also: Poco::OSP::Auth::AuthAdminService::usersWithPermission()

usersWithRole virtual

int usersWithRole(
    std::set < std::string > & users,
    const std::string & role,
    int first = 0,
    int limit = 0
) const;

See also: Poco::OSP::Auth::AuthAdminService::usersWithRole()

addUserImpl protected

void addUserImpl(
    Poco::Data::Session & session,
    const std::string & username,
    const std::string & password
) const;

authenticateDB protected

bool authenticateDB(
    Poco::Data::Session & session,
    const std::string & username,
    const std::string & credentials
) const;

authorizeRole protected

bool authorizeRole(
    const std::string & rolename,
    const std::string & permission
) const;

changePasswordImpl protected

void changePasswordImpl(
    Poco::Data::Session & session,
    const std::string & username,
    const std::string & hashedCredentials
) const;

createOrUpdateUserImpl protected

void createOrUpdateUserImpl(
    Poco::Data::Session & session,
    const std::string & username,
    const std::string & credentials
) const;

createOrUpdateUserImpl protected virtual

void createOrUpdateUserImpl(
    const std::string & username,
    const std::string & credentials
) const;

See also: Poco::OSP::Auth::AbstractLDAPAuthAdminService::createOrUpdateUserImpl()

discoverInlineAttributes protected

void discoverInlineAttributes();

removeUserImpl protected

void removeUserImpl(
    Poco::Data::Session & session,
    const std::string & username
) const;

replacePermissionsForUserImpl protected

void replacePermissionsForUserImpl(
    Poco::Data::Session & session,
    const std::string & username,
    const std::set < std::string > & permissions
) const;

replacePermissionsForUserImpl protected virtual

void replacePermissionsForUserImpl(
    const std::string & username,
    const std::set < std::string > & permissions
) const;

See also: Poco::OSP::Auth::AbstractLDAPAuthAdminService::replacePermissionsForUserImpl()

replaceRolesForUserImpl protected

void replaceRolesForUserImpl(
    Poco::Data::Session & session,
    const std::string & username,
    const std::set < std::string > & permissions
) const;

replaceRolesForUserImpl protected virtual

void replaceRolesForUserImpl(
    const std::string & username,
    const std::set < std::string > & permissions
) const;

See also: Poco::OSP::Auth::AbstractLDAPAuthAdminService::replaceRolesForUserImpl()

replaceUserAttributeImpl protected

void replaceUserAttributeImpl(
    Poco::Data::Session & session,
    const std::string & username,
    const std::string & attribute,
    const std::string & value
) const;

replaceUserAttributeImpl protected virtual

void replaceUserAttributeImpl(
    const std::string & username,
    const std::string & attribute,
    const std::string & value
) const;

See also: Poco::OSP::Auth::AbstractLDAPAuthAdminService::replaceUserAttributeImpl()

roleExistsImpl protected

bool roleExistsImpl(
    Poco::Data::Session & session,
    const std::string & rolename
) const;

session protected

Poco::Data::Session & session() const;

sessionExpired protected

bool sessionExpired() const;

setupSession protected static

static void setupSession(
    Poco::Data::Session & session,
    const Poco::Util::AbstractConfiguration & properties,
    const AuthParams & authParams,
    Poco::Logger & logger
);

uncacheUserImpl protected

void uncacheUserImpl(
    const std::string & username
) const;

userExistsImpl protected

bool userExistsImpl(
    Poco::Data::Session & session,
    const std::string & username
) const;

Variables

USER_ATTR_FAILURES static

static const std::string USER_ATTR_FAILURES;

USER_ATTR_LDAP static

static const std::string USER_ATTR_LDAP;

USER_ATTR_LOCKOUT static

static const std::string USER_ATTR_LOCKOUT;

Securely control IoT edge devices from anywhere   Connect a Device