|
| 1 | +// Copyright 2022 SAP SE. |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http: //www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, |
| 10 | +// software distributed under the License is distributed on an |
| 11 | +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, |
| 12 | +// either express or implied. See the License for the specific |
| 13 | +// language governing permissions and limitations under the License. |
| 14 | +'use strict'; |
| 15 | + |
| 16 | +var crypto = require('crypto'); |
| 17 | +var util = require('../../util'); |
| 18 | +var Fields = require('../data/Fields'); |
| 19 | + |
| 20 | +var CLIENT_NONCE_SIZE = 64; |
| 21 | +var CAPABILITIES_SIZE = 8; |
| 22 | +var DEFAULT_CAPABILITIES = 1; |
| 23 | +var SESSION_KEY_SIZE = 32; // AES256 key size |
| 24 | + |
| 25 | +module.exports = LDAP; |
| 26 | + |
| 27 | +/** |
| 28 | + * Handle LDAP authentication |
| 29 | + * |
| 30 | + * @param {object} options |
| 31 | + * @param {string|Buffer} options.password The LDAP password of the user |
| 32 | + * @param {Buffer} [options.clientChallenge] (for test only) the client nonce (64 bytes) to use |
| 33 | + * @param {Buffer} [options.sessionKey] (for test only) the AES256 key (32 bytes) for the encryption of the password |
| 34 | + */ |
| 35 | +function LDAP(options) { |
| 36 | + this.name = 'LDAP'; |
| 37 | + this.password = options.password; |
| 38 | + if (util.isString(this.password)) { |
| 39 | + this.password = new Buffer(this.password, 'utf8'); |
| 40 | + } |
| 41 | + this.clientNonce = options.clientChallenge || crypto.randomBytes(CLIENT_NONCE_SIZE); |
| 42 | + this.clientProof = null; |
| 43 | + this.sessionKey = options.sessionKey; |
| 44 | +} |
| 45 | + |
| 46 | +/** |
| 47 | + * Return the initial data to send to HANA (client none + capabilities) |
| 48 | + * @return {Buffer} |
| 49 | + */ |
| 50 | +LDAP.prototype.initialData = function() { |
| 51 | + // prepare capabilities |
| 52 | + var capabilities = Buffer.allocUnsafe ? Buffer.allocUnsafe(CAPABILITIES_SIZE) : new Buffer(CAPABILITIES_SIZE); |
| 53 | + capabilities.writeInt8(DEFAULT_CAPABILITIES, 0); |
| 54 | + capabilities.fill(0, 1); // fill the remaining 7 bytes with 0 |
| 55 | + |
| 56 | + // write fields |
| 57 | + var data = Fields.write(null, [this.clientNonce, capabilities]).buffer; |
| 58 | + return data; |
| 59 | +}; |
| 60 | + |
| 61 | +/** |
| 62 | + * Gets the first response from the server and calculates the data for the next request |
| 63 | + * @param {Buffer} buffer |
| 64 | + * @param {function(Error?)} cb |
| 65 | + */ |
| 66 | +LDAP.prototype.initialize = function(buffer, cb) { |
| 67 | + // read server challenge |
| 68 | + var serverChallengeData = Fields.read({ |
| 69 | + buffer: buffer |
| 70 | + }); |
| 71 | + |
| 72 | + // check number of fields |
| 73 | + if (serverChallengeData.length < 4) { |
| 74 | + var error = new Error('Unexpected number of fields [' + serverChallengeData.length + '] in server challenge (LDAP authentication)'); |
| 75 | + error.code = 'EHDBAUTHPROTOCOL'; |
| 76 | + cb(error); |
| 77 | + return; |
| 78 | + } |
| 79 | + |
| 80 | + // check client nonce |
| 81 | + var clientNonceProof = serverChallengeData[0]; |
| 82 | + if (!clientNonceProof.equals(this.clientNonce)) { |
| 83 | + var error = new Error('Client nonce does not match (LDAP authentication)'); |
| 84 | + error.code = 'EHDBAUTHCLIENTNONCE'; |
| 85 | + cb(error); |
| 86 | + return; |
| 87 | + } |
| 88 | + |
| 89 | + // check capabilities |
| 90 | + var serverCapabilities = serverChallengeData[3]; |
| 91 | + if (serverCapabilities.readInt8() != DEFAULT_CAPABILITIES) { |
| 92 | + var error = new Error('Unsupported capabilities (LDAP authentication)'); |
| 93 | + error.code = 'EHDBAUTHCAPABILITIES'; |
| 94 | + cb(error); |
| 95 | + return; |
| 96 | + } |
| 97 | + |
| 98 | + // generate session key (for AES256 encryption of the password) |
| 99 | + if (!this.sessionKey) { |
| 100 | + this.sessionKey = crypto.randomBytes(SESSION_KEY_SIZE); |
| 101 | + } |
| 102 | + |
| 103 | + // generate the encrypted session key |
| 104 | + var serverNonce = serverChallengeData[1]; |
| 105 | + var serverPublicKey = serverChallengeData[2].toString('ascii'); // RSA public key (PKCS8 PEM) |
| 106 | + var sessionKeyContent = Buffer.concat([this.sessionKey, serverNonce]); |
| 107 | + var encryptedSessionKey = crypto.publicEncrypt({ |
| 108 | + key: serverPublicKey, |
| 109 | + format: 'pem', |
| 110 | + type: 'spki' |
| 111 | + }, sessionKeyContent); |
| 112 | + |
| 113 | + // encrypt the password |
| 114 | + var iv = serverNonce.slice(0, 16); |
| 115 | + var cipher = crypto.createCipheriv("aes-256-cbc", this.sessionKey, iv); |
| 116 | + var passwordContent = Buffer.concat([this.password, new Buffer(1), serverNonce]); |
| 117 | + var encryptedPassword = cipher.update(passwordContent); |
| 118 | + encryptedPassword = Buffer.concat([encryptedPassword, cipher.final()]); |
| 119 | + |
| 120 | + // generate client proof |
| 121 | + this.clientProof = Fields.write(null, [encryptedSessionKey, encryptedPassword]).buffer; |
| 122 | + |
| 123 | + // done |
| 124 | + cb(); |
| 125 | +}; |
| 126 | + |
| 127 | +LDAP.prototype.finalData = function finalData() { |
| 128 | + return this.clientProof; |
| 129 | +}; |
| 130 | + |
| 131 | +LDAP.prototype.finalize = function finalize(buffer) { |
| 132 | + /* jshint unused:false */ |
| 133 | +}; |
0 commit comments