Sovite.SASL.Server (sovite v0.2.0)

Copy Markdown View Source

Runs the server side of a SASL exchange against a Sovite.SASL.Backend.

opts = [backend: {Sovite.SASL.Backend.Static, file: "/etc/sovite/users"}]

Sovite.SASL.Server.mechanisms(opts)
#=> ["PLAIN", "LOGIN", "SCRAM-SHA-256"]

case Sovite.SASL.Server.start("PLAIN", initial_response, opts) do
  {:ok, identity} -> ...
  {:challenge, data, server} -> # send data, then Sovite.SASL.Server.step(server, response)
  {:error, reason, username} -> ...
end

Options

  • :backend - {module, opts} for passwords and SCRAM-SHA-256. Required.
  • :token_backend - {module, opts} for OAUTHBEARER. Defaults to :backend.
  • :mechanisms - mechanisms to allow, in order of preference. Defaults to all the backends support. Unknown names are ignored.
  • :scram_secret - a secret to derive fake salts for unknown users, so SCRAM-SHA-256 does not reveal which users exist. Defaults to a random value per VM.
  • :oauth_error - the JSON sent when an OAUTHBEARER token is rejected (RFC 7628 §3.2.2). Defaults to {"status":"invalid_token"}.

Errors

reason is :invalid_credentials, :malformed (the client broke the protocol), :authorization_failed (the client asked to act as another user), :temporary (the backend failed), :unsupported_mechanism, or :no_scram_credentials (the user has no SCRAM-SHA-256 values; the client sees the same reply as for a wrong password). username is the name the client gave, if any, for logs.

Summary

Types

error()
result()
t()

Functions

mechanisms(opts)

Returns the mechanisms the backends support, filtered by :mechanisms.

start(mechanism, initial, opts)

Starts an exchange. initial is the client's initial response, "" for an empty one, or nil for none.

step(server, response)

Continues an exchange with the client's response to the last challenge.

Types

error()

@type error() ::
  :invalid_credentials
  | :malformed
  | :authorization_failed
  | :temporary
  | :unsupported_mechanism
  | :no_scram_credentials

result()

@type result() ::
  {:ok, identity :: String.t()}
  | {:challenge, binary(), t()}
  | {:error, error(), username :: String.t() | nil}

t()

@opaque t()

Functions

mechanisms(opts)

@spec mechanisms(keyword()) :: [String.t()]

Returns the mechanisms the backends support, filtered by :mechanisms.

start(mechanism, initial, opts)

@spec start(String.t(), binary() | nil, keyword()) :: result()

Starts an exchange. initial is the client's initial response, "" for an empty one, or nil for none.

step(server, response)

@spec step(t(), binary()) :: result()

Continues an exchange with the client's response to the last challenge.