(
authenticator: &Authenticator,
creds: Option<Credentials>,
allowed_roles: AllowedRoles,
challenges: &WwwAuthenticateChallenges,
group_claim: Option<&str>,
)
| 1462 | } |
| 1463 | |
| 1464 | async fn auth( |
| 1465 | authenticator: &Authenticator, |
| 1466 | creds: Option<Credentials>, |
| 1467 | allowed_roles: AllowedRoles, |
| 1468 | challenges: &WwwAuthenticateChallenges, |
| 1469 | group_claim: Option<&str>, |
| 1470 | ) -> Result<AuthedUser, AuthError> { |
| 1471 | let (name, external_metadata_rx, authenticated, groups) = match authenticator { |
| 1472 | Authenticator::Frontegg(frontegg) => match creds { |
| 1473 | Some(Credentials::Password { username, password }) => { |
| 1474 | let (auth_session, authenticated) = frontegg |
| 1475 | .authenticate(&username, password.as_str(), group_claim) |
| 1476 | .await?; |
| 1477 | let name = auth_session.user().into(); |
| 1478 | let groups = auth_session.groups(); |
| 1479 | let external_metadata_rx = Some(auth_session.external_metadata_rx()); |
| 1480 | (name, external_metadata_rx, authenticated, groups) |
| 1481 | } |
| 1482 | Some(Credentials::Token { token }) => { |
| 1483 | let (claims, authenticated) = |
| 1484 | frontegg.validate_access_token(&token, None, group_claim)?; |
| 1485 | let (_, external_metadata_rx) = watch::channel(ExternalUserMetadata { |
| 1486 | user_id: claims.user_id, |
| 1487 | admin: claims.is_admin, |
| 1488 | }); |
| 1489 | ( |
| 1490 | claims.user, |
| 1491 | Some(external_metadata_rx), |
| 1492 | authenticated, |
| 1493 | claims.groups, |
| 1494 | ) |
| 1495 | } |
| 1496 | None => { |
| 1497 | return Err(AuthError::MissingHttpAuthentication { |
| 1498 | challenges: challenges.clone(), |
| 1499 | }); |
| 1500 | } |
| 1501 | }, |
| 1502 | Authenticator::Password(adapter_client) => match creds { |
| 1503 | Some(Credentials::Password { username, password }) => { |
| 1504 | let authenticated = adapter_client |
| 1505 | .authenticate(&username, &password) |
| 1506 | .await |
| 1507 | .map_err(|_| AuthError::InvalidCredentials)?; |
| 1508 | (username, None, authenticated, None) |
| 1509 | } |
| 1510 | _ => { |
| 1511 | return Err(AuthError::MissingHttpAuthentication { |
| 1512 | challenges: challenges.clone(), |
| 1513 | }); |
| 1514 | } |
| 1515 | }, |
| 1516 | Authenticator::Sasl(_) => { |
| 1517 | // We shouldn't ever end up here as the configuration is validated at startup. |
| 1518 | // If we do, it's a server misconfiguration. |
| 1519 | // Just in case, we return a 401 rather than panic. |
| 1520 | return Err(AuthError::MissingHttpAuthentication { |
| 1521 | challenges: challenges.clone(), |
no test coverage detected