@ -20,15 +20,14 @@ use crate::{
log_user_event , log_user_event ,
two_factor ::webauthn ::WEBAUTHN , two_factor ::webauthn ::WEBAUTHN ,
two_factor ::{ two_factor ::{
authenticator , duo , duo_oidc , email , enforce_2fa_policy , is_twofactor_provider_usable , webauthn , authenticator , duo_oidc , email , enforce_2fa_policy , is_twofactor_provider_usable , webauthn , yubikey ,
yubikey ,
} , } ,
} , } ,
master_password_policy , identity_ master_password_policy,
push ::register_push_device , push ::register_push_device ,
} , } ,
auth , auth ,
auth ::{ AuthMethod , ClientHeaders , ClientIp , ClientVersion , Secure , generate_organization_api_key_login_claims } , auth ::{ AuthMethod , ClientHeaders , ClientIp , Secure , generate_organization_api_key_login_claims } ,
crypto , crypto ,
db ::{ db ::{
DbConn , DbConn ,
@ -49,7 +48,6 @@ pub fn routes() -> Vec<Route> {
login , login ,
post_prelogin , post_prelogin ,
prelogin_password , prelogin_password ,
identity_register ,
register_verification_email , register_verification_email ,
register_finish , register_finish ,
prevalidate , prevalidate ,
@ -61,12 +59,7 @@ pub fn routes() -> Vec<Route> {
} }
#[ post( " /connect/token " , data = " <data> " ) ] #[ post( " /connect/token " , data = " <data> " ) ]
async fn login ( async fn login ( data : Form < ConnectData > , client_header : ClientHeaders , conn : DbConn ) -> JsonResult {
data : Form < ConnectData > ,
client_header : ClientHeaders ,
client_version : Option < ClientVersion > ,
conn : DbConn ,
) -> JsonResult {
let data : ConnectData = data . into_inner ( ) ; let data : ConnectData = data . into_inner ( ) ;
let mut user_id : Option < UserId > = None ; let mut user_id : Option < UserId > = None ;
@ -77,7 +70,7 @@ async fn login(
refresh_login ( data , & conn , & client_header . ip ) . await refresh_login ( data , & conn , & client_header . ip ) . await
} }
"webauthn" | "password" if CONFIG . sso_enabled ( ) & & CONFIG . sso_only ( ) = > err ! ( "SSO sign-in is required" ) , "webauthn" | "password" if CONFIG . sso_enabled ( ) & & CONFIG . sso_only ( ) = > err ! ( "SSO sign-in is required" ) ,
"webauthn" if CONFIG . passkeys_enabled ( ) & & CONFIG . is_webauthn_2fa_supported ( ) = > { "webauthn" if CONFIG . is_webauthn_2fa_supported ( ) = > {
check_is_some ( data . client_id . as_ref ( ) , "client_id cannot be blank" ) ? ; check_is_some ( data . client_id . as_ref ( ) , "client_id cannot be blank" ) ? ;
check_is_some ( data . token . as_ref ( ) , "token cannot be blank" ) ? ; check_is_some ( data . token . as_ref ( ) , "token cannot be blank" ) ? ;
check_is_some ( data . device_response . as_ref ( ) , "deviceResponse cannot be blank" ) ? ; check_is_some ( data . device_response . as_ref ( ) , "deviceResponse cannot be blank" ) ? ;
@ -87,7 +80,7 @@ async fn login(
check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ; check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ;
webauthn_login ( data , & mut user_id , & conn , & client_header . ip ) . await webauthn_login ( data , & mut user_id , & conn , & client_header . ip ) . await
} }
"webauthn" = > err ! ( "Passkey sign-in is not enabled " ) , "webauthn" = > err ! ( "Passkey sign-in is unavailable " ) ,
"password" = > { "password" = > {
check_is_some ( data . client_id . as_ref ( ) , "client_id cannot be blank" ) ? ; check_is_some ( data . client_id . as_ref ( ) , "client_id cannot be blank" ) ? ;
check_is_some ( data . password . as_ref ( ) , "password cannot be blank" ) ? ; check_is_some ( data . password . as_ref ( ) , "password cannot be blank" ) ? ;
@ -98,17 +91,13 @@ async fn login(
check_is_some ( data . device_name . as_ref ( ) , "device_name cannot be blank" ) ? ; check_is_some ( data . device_name . as_ref ( ) , "device_name cannot be blank" ) ? ;
check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ; check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ;
password_login ( data , & mut user_id , & conn , & client_header . ip , client_version . as_ref ( ) ) . await password_login ( data , & mut user_id , & conn , & client_header . ip ) . await
} }
"client_credentials" = > { "client_credentials" = > {
check_is_some ( data . client_id . as_ref ( ) , "client_id cannot be blank" ) ? ; check_is_some ( data . client_id . as_ref ( ) , "client_id cannot be blank" ) ? ;
check_is_some ( data . client_secret . as_ref ( ) , "client_secret cannot be blank" ) ? ; check_is_some ( data . client_secret . as_ref ( ) , "client_secret cannot be blank" ) ? ;
check_is_some ( data . scope . as_ref ( ) , "scope cannot be blank" ) ? ; check_is_some ( data . scope . as_ref ( ) , "scope cannot be blank" ) ? ;
check_is_some ( data . device_identifier . as_ref ( ) , "device_identifier cannot be blank" ) ? ;
check_is_some ( data . device_name . as_ref ( ) , "device_name cannot be blank" ) ? ;
check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ;
api_key_login ( data , & mut user_id , & conn , & client_header . ip ) . await api_key_login ( data , & mut user_id , & conn , & client_header . ip ) . await
} }
"authorization_code" if CONFIG . sso_enabled ( ) = > { "authorization_code" if CONFIG . sso_enabled ( ) = > {
@ -120,7 +109,7 @@ async fn login(
check_is_some ( data . device_name . as_ref ( ) , "device_name cannot be blank" ) ? ; check_is_some ( data . device_name . as_ref ( ) , "device_name cannot be blank" ) ? ;
check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ; check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ;
sso_login ( data , & mut user_id , & conn , & client_header . ip , client_version . as_ref ( ) ) . await sso_login ( data , & mut user_id , & conn , & client_header . ip ) . await
} }
"authorization_code" = > err ! ( "SSO sign-in is not available" ) , "authorization_code" = > err ! ( "SSO sign-in is not available" ) ,
"send_access" = > { "send_access" = > {
@ -144,7 +133,7 @@ async fn login(
match & login_result { match & login_result {
Ok ( _ ) = > { Ok ( _ ) = > {
log_user_event ( log_user_event (
EventType ::UserLoggedIn as i32 , EventType ::UserLoggedIn ,
& user_id , & user_id ,
client_header . device_type , client_header . device_type ,
& client_header . ip . ip , & client_header . ip . ip ,
@ -154,8 +143,7 @@ async fn login(
} }
Err ( e ) = > { Err ( e ) = > {
if let Some ( ev ) = e . get_event ( ) { if let Some ( ev ) = e . get_event ( ) {
log_user_event ( ev . event as i32 , & user_id , client_header . device_type , & client_header . ip . ip , & conn ) log_user_event ( ev . event , & user_id , client_header . device_type , & client_header . ip . ip , & conn ) . await ;
. await ;
} }
} }
} }
@ -205,13 +193,7 @@ async fn refresh_login(data: ConnectData, conn: &DbConn, ip: &ClientIp) -> JsonR
} }
// After exchanging the code we need to check first if 2FA is needed before continuing
// After exchanging the code we need to check first if 2FA is needed before continuing
async fn sso_login ( async fn sso_login ( data : ConnectData , user_id : & mut Option < UserId > , conn : & DbConn , ip : & ClientIp ) -> JsonResult {
data : ConnectData ,
user_id : & mut Option < UserId > ,
conn : & DbConn ,
ip : & ClientIp ,
client_version : Option < & ClientVersion > ,
) -> JsonResult {
AuthMethod ::Sso . check_scope ( data . scope . as_ref ( ) ) ? ; AuthMethod ::Sso . check_scope ( data . scope . as_ref ( ) ) ? ;
// Ratelimit the login
// Ratelimit the login
@ -368,7 +350,7 @@ async fn sso_login(
Some ( ( mut user , sso_user ) ) = > { Some ( ( mut user , sso_user ) ) = > {
let mut device = get_device ( & data , conn , & user ) . await ? ; let mut device = get_device ( & data , conn , & user ) . await ? ;
let twofactor_token = twofactor_auth ( & mut user , & data , & mut device , ip , client_version , c onn ) . await ? ; let twofactor_token = twofactor_auth ( & mut user , & data , & mut device , ip , conn ) . await ? ;
if user . private_key . is_none ( ) { if user . private_key . is_none ( ) {
// User was invited a stub was created
// User was invited a stub was created
@ -400,13 +382,7 @@ async fn sso_login(
authenticated_response ( & user , & mut device , auth_tokens , twofactor_token , conn , ip ) . await authenticated_response ( & user , & mut device , auth_tokens , twofactor_token , conn , ip ) . await
} }
async fn password_login ( async fn password_login ( data : ConnectData , user_id : & mut Option < UserId > , conn : & DbConn , ip : & ClientIp ) -> JsonResult {
data : ConnectData ,
user_id : & mut Option < UserId > ,
conn : & DbConn ,
ip : & ClientIp ,
client_version : Option < & ClientVersion > ,
) -> JsonResult {
// Validate scope
// Validate scope
AuthMethod ::Password . check_scope ( data . scope . as_ref ( ) ) ? ; AuthMethod ::Password . check_scope ( data . scope . as_ref ( ) ) ? ;
@ -415,24 +391,14 @@ async fn password_login(
// Get the user
// Get the user
let username = data . username . as_ref ( ) . unwrap ( ) . trim ( ) ; let username = data . username . as_ref ( ) . unwrap ( ) . trim ( ) ;
let log_username = username . escape_debug ( ) ;
let Some ( mut user ) = User ::find_by_mail ( username , conn ) . await else { let Some ( mut user ) = User ::find_by_mail ( username , conn ) . await else {
err ! ( "Username or password is incorrect. Try again" , format ! ( "IP: {}. Username: {username}." , ip . ip ) ) err ! ( "Username or password is incorrect. Try again" , format ! ( "IP: {}. Username: {log_ username}." , ip . ip ) )
} ; } ;
// Set the user_id here to be passed back used for event logging.
// Set the user_id here to be passed back used for event logging.
* user_id = Some ( user . uuid . clone ( ) ) ; * user_id = Some ( user . uuid . clone ( ) ) ;
// Check if the user is disabled
if ! user . enabled {
err ! (
"This user has been disabled" ,
format ! ( "IP: {}. Username: {username}." , ip . ip ) ,
ErrorEvent {
event : EventType ::UserFailedLogIn
}
)
}
let password = data . password . as_ref ( ) . unwrap ( ) ; let password = data . password . as_ref ( ) . unwrap ( ) ;
// If we get an auth request, we don't check the user's password, but the access code of the auth request
// If we get an auth request, we don't check the user's password, but the access code of the auth request
@ -440,7 +406,7 @@ async fn password_login(
let Some ( auth_request ) = AuthRequest ::find_by_uuid_and_user ( auth_request_id , & user . uuid , conn ) . await else { let Some ( auth_request ) = AuthRequest ::find_by_uuid_and_user ( auth_request_id , & user . uuid , conn ) . await else {
err ! ( err ! (
"Auth request not found. Try again." , "Auth request not found. Try again." ,
format ! ( "IP: {}. Username: {username}." , ip . ip ) , format ! ( "IP: {}. Username: {log_ username}." , ip . ip ) ,
ErrorEvent { ErrorEvent {
event : EventType ::UserFailedLogIn , event : EventType ::UserFailedLogIn ,
} }
@ -452,13 +418,14 @@ async fn password_login(
if auth_request . user_uuid ! = user . uuid if auth_request . user_uuid ! = user . uuid
| | ! auth_request . approved . unwrap_or ( false ) | | ! auth_request . approved . unwrap_or ( false )
| | auth_request . authentication_date . is_some ( )
| | request_expired | | request_expired
| | ip . ip . to_string ( ) ! = auth_request . request_ip | | ip . ip . to_string ( ) ! = auth_request . request_ip
| | ! auth_request . check_access_code ( password ) | | ! auth_request . check_access_code ( password )
{ {
err ! ( err ! (
"Username or access code is incorrect. Try again" , "Username or access code is incorrect. Try again" ,
format ! ( "IP: {}. Username: {username}." , ip . ip ) , format ! ( "IP: {}. Username: {log_ username}." , ip . ip ) ,
ErrorEvent { ErrorEvent {
event : EventType ::UserFailedLogIn , event : EventType ::UserFailedLogIn ,
} }
@ -467,13 +434,24 @@ async fn password_login(
} else if ! user . check_valid_password ( password ) { } else if ! user . check_valid_password ( password ) {
err ! ( err ! (
"Username or password is incorrect. Try again" , "Username or password is incorrect. Try again" ,
format ! ( "IP: {}. Username: {username}." , ip . ip ) , format ! ( "IP: {}. Username: {log_ username}." , ip . ip ) ,
ErrorEvent { ErrorEvent {
event : EventType ::UserFailedLogIn , event : EventType ::UserFailedLogIn ,
} }
) )
} }
// Check if the user is disabled
if ! user . enabled {
err ! (
"This user has been disabled" ,
format ! ( "IP: {}. Username: {log_username}." , ip . ip ) ,
ErrorEvent {
event : EventType ::UserFailedLogIn
}
)
}
// Change the KDF Iterations (only when not logging in with an auth request)
// Change the KDF Iterations (only when not logging in with an auth request)
if data . auth_request . is_none ( ) { if data . auth_request . is_none ( ) {
kdf_upgrade ( & mut user , password , conn ) . await ? ; kdf_upgrade ( & mut user , password , conn ) . await ? ;
@ -506,7 +484,7 @@ async fn password_login(
// We still want the login to fail until they actually verified the email address
// We still want the login to fail until they actually verified the email address
err ! ( err ! (
"Please verify your email before trying again." , "Please verify your email before trying again." ,
format ! ( "IP: {}. Username: {username}." , ip . ip ) , format ! ( "IP: {}. Username: {log_ username}." , ip . ip ) ,
ErrorEvent { ErrorEvent {
event : EventType ::UserFailedLogIn event : EventType ::UserFailedLogIn
} }
@ -515,7 +493,20 @@ async fn password_login(
let mut device = get_device ( & data , conn , & user ) . await ? ; let mut device = get_device ( & data , conn , & user ) . await ? ;
let twofactor_token = twofactor_auth ( & mut user , & data , & mut device , ip , client_version , conn ) . await ? ; let twofactor_token = twofactor_auth ( & mut user , & data , & mut device , ip , conn ) . await ? ;
// Like upstream, an auth request can be used for one login only. Marked after 2FA so a 2FA prompt doesn't use it up.
if let Some ( ref auth_request_id ) = data . auth_request
& & ! AuthRequest ::set_authentication_date ( auth_request_id , conn ) . await ?
{
err ! (
"Username or access code is incorrect. Try again" ,
format ! ( "IP: {}. Username: {log_username}." , ip . ip ) ,
ErrorEvent {
event : EventType ::UserFailedLogIn ,
}
)
}
let auth_tokens = auth ::AuthTokens ::new ( & device , & user , AuthMethod ::Password , data . client_id ) ; let auth_tokens = auth ::AuthTokens ::new ( & device , & user , AuthMethod ::Password , data . client_id ) ;
@ -526,9 +517,8 @@ async fn password_login(
// database and consume it atomically before WebAuthn verification.
// database and consume it atomically before WebAuthn verification.
#[ get( " /accounts/webauthn/assertion-options " ) ] #[ get( " /accounts/webauthn/assertion-options " ) ]
async fn get_webauthn_login_assertion_options ( conn : DbConn , ip : ClientIp ) -> JsonResult { async fn get_webauthn_login_assertion_options ( conn : DbConn , ip : ClientIp ) -> JsonResult {
if ! CONFIG . passkeys_enabled ( ) | | ! CONFIG . is_webauthn_2fa_supported ( ) | | ( CONFIG . sso_enabled ( ) & & CONFIG . sso_only ( ) ) if ! CONFIG . is_webauthn_2fa_supported ( ) | | ( CONFIG . sso_enabled ( ) & & CONFIG . sso_only ( ) ) {
{ err ! ( "Passkey sign-in is unavailable" )
err ! ( "Passkey sign-in is not enabled" )
} }
crate ::ratelimit ::check_limit_unauthenticated ( & ip . ip ) ? ; crate ::ratelimit ::check_limit_unauthenticated ( & ip . ip ) ? ;
let ( mut response , state ) = WEBAUTHN . start_passkey_authentication ( & [ ] ) ? ; let ( mut response , state ) = WEBAUTHN . start_passkey_authentication ( & [ ] ) ? ;
@ -560,6 +550,9 @@ async fn webauthn_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
if ! user . enabled { if ! user . enabled {
err ! ( "This user has been disabled" ) err ! ( "This user has been disabled" )
} }
if user . verified_at . is_none ( ) & & CONFIG . mail_enabled ( ) & & CONFIG . signups_verify ( ) {
err ! ( "Please verify your email before trying again." )
}
let Some ( handle ) = response . response . user_handle . as_ref ( ) else { let Some ( handle ) = response . response . user_handle . as_ref ( ) else {
err ! ( "Invalid passkey user handle" ) err ! ( "Invalid passkey user handle" )
} ; } ;
@ -604,6 +597,9 @@ async fn webauthn_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &
if ! current_user . enabled { if ! current_user . enabled {
err ! ( "This user has been disabled" ) err ! ( "This user has been disabled" )
} }
if current_user . verified_at . is_none ( ) & & CONFIG . mail_enabled ( ) & & CONFIG . signups_verify ( ) {
err ! ( "Please verify your email before trying again." )
}
// User verification by the authenticator satisfies this grant's login factor.
// User verification by the authenticator satisfies this grant's login factor.
// Other grants retain their existing two-step-login behavior and enrollment.
// Other grants retain their existing two-step-login behavior and enrollment.
let mut device = get_device ( & data , conn , & current_user ) . await ? ; let mut device = get_device ( & data , conn , & current_user ) . await ? ;
@ -653,7 +649,7 @@ async fn authenticated_response(
// Save to update `device.updated_at` to track usage and toggle new status
// Save to update `device.updated_at` to track usage and toggle new status
device . save ( true , conn ) . await ? ; device . save ( true , conn ) . await ? ;
let master_password_policy = master_password_policy ( user , conn ) . await ; let master_password_policy = identity_ master_password_policy( user , conn ) . await ;
let has_master_password = ! user . password_hash . is_empty ( ) ; let has_master_password = ! user . password_hash . is_empty ( ) ;
let master_password_unlock = if has_master_password { let master_password_unlock = if has_master_password {
@ -697,7 +693,6 @@ async fn authenticated_response(
"KdfIterations" : user . client_kdf_iter , "KdfIterations" : user . client_kdf_iter ,
"KdfMemory" : user . client_kdf_memory , "KdfMemory" : user . client_kdf_memory ,
"KdfParallelism" : user . client_kdf_parallelism , "KdfParallelism" : user . client_kdf_parallelism ,
"ResetMasterPassword" : false , // TODO: Same as above
"ForcePasswordReset" : false , "ForcePasswordReset" : false ,
"MasterPasswordPolicy" : master_password_policy , "MasterPasswordPolicy" : master_password_policy ,
"scope" : auth_tokens . scope ( ) , "scope" : auth_tokens . scope ( ) ,
@ -727,7 +722,14 @@ async fn api_key_login(data: ConnectData, user_id: &mut Option<UserId>, conn: &D
// Validate scope
// Validate scope
match data . scope . as_ref ( ) { match data . scope . as_ref ( ) {
Some ( scope ) if scope = = & AuthMethod ::UserApiKey . scope ( ) = > user_api_key_login ( data , user_id , conn , ip ) . await , Some ( scope ) if scope = = & AuthMethod ::UserApiKey . scope ( ) = > {
// Like upstream, only the user API key logs in a device
check_is_some ( data . device_identifier . as_ref ( ) , "device_identifier cannot be blank" ) ? ;
check_is_some ( data . device_name . as_ref ( ) , "device_name cannot be blank" ) ? ;
check_is_some ( data . device_type . as_ref ( ) , "device_type cannot be blank" ) ? ;
user_api_key_login ( data , user_id , conn , ip ) . await
}
Some ( scope ) if scope = = & AuthMethod ::OrgApiKey . scope ( ) = > organization_api_key_login ( data , conn , ip ) . await , Some ( scope ) if scope = = & AuthMethod ::OrgApiKey . scope ( ) = > organization_api_key_login ( data , conn , ip ) . await ,
_ = > err ! ( "Scope not supported" ) , _ = > err ! ( "Scope not supported" ) ,
} }
@ -851,7 +853,6 @@ async fn user_api_key_login(
"KdfIterations" : user . client_kdf_iter , "KdfIterations" : user . client_kdf_iter ,
"KdfMemory" : user . client_kdf_memory , "KdfMemory" : user . client_kdf_memory ,
"KdfParallelism" : user . client_kdf_parallelism , "KdfParallelism" : user . client_kdf_parallelism ,
"ResetMasterPassword" : false , // TODO: according to official server seems something like: user.password_hash.is_empty(), but would need testing
"ForcePasswordReset" : false , "ForcePasswordReset" : false ,
"scope" : AuthMethod ::UserApiKey . scope ( ) , "scope" : AuthMethod ::UserApiKey . scope ( ) ,
"AccountKeys" : account_keys , "AccountKeys" : account_keys ,
@ -917,7 +918,6 @@ async fn twofactor_auth(
data : & ConnectData , data : & ConnectData ,
device : & mut Device , device : & mut Device ,
ip : & ClientIp , ip : & ClientIp ,
client_version : Option < & ClientVersion > ,
conn : & DbConn , conn : & DbConn ,
) -> ApiResult < Option < String > > { ) -> ApiResult < Option < String > > {
let twofactors = TwoFactor ::find_by_user ( & user . uuid , conn ) . await ; let twofactors = TwoFactor ::find_by_user ( & user . uuid , conn ) . await ;
@ -946,17 +946,12 @@ async fn twofactor_auth(
if ! [ TwoFactorType ::Remember as i32 , TwoFactorType ::RecoveryCode as i32 ] . contains ( & selected_id ) if ! [ TwoFactorType ::Remember as i32 , TwoFactorType ::RecoveryCode as i32 ] . contains ( & selected_id )
& & ! twofactor_ids . contains ( & selected_id ) & & ! twofactor_ids . contains ( & selected_id )
{ {
err_json ! ( err_json ! ( json_err_twofactor ( & twofactor_ids , user , data , conn ) . await ? , "Invalid two factor provider" )
json_err_twofactor ( & twofactor_ids , & user . uuid , data , client_version , conn ) . await ? ,
"Invalid two factor provider"
)
} }
let Some ( ref twofactor_code ) = data . two_factor_token else { // Like upstream, a blank token counts as not provided
err_json ! ( let Some ( twofactor_code ) = data . two_factor_token . as_deref ( ) . filter ( | t | ! t . trim ( ) . is_empty ( ) ) else {
json_err_twofactor ( & twofactor_ids , & user . uuid , data , client_version , conn ) . await ? , err_json ! ( json_err_twofactor ( & twofactor_ids , user , data , conn ) . await ? , "2FA token not provided" )
"2FA token not provided"
)
} ; } ;
let selected_twofactor = twofactors . into_iter ( ) . find ( | tf | tf . atype = = selected_id & & tf . enabled ) ; let selected_twofactor = twofactors . into_iter ( ) . find ( | tf | tf . atype = = selected_id & & tf . enabled ) ;
@ -970,20 +965,14 @@ async fn twofactor_auth(
Some ( TwoFactorType ::Webauthn ) = > webauthn ::validate_webauthn_login ( & user . uuid , twofactor_code , conn ) . await ? , Some ( TwoFactorType ::Webauthn ) = > webauthn ::validate_webauthn_login ( & user . uuid , twofactor_code , conn ) . await ? ,
Some ( TwoFactorType ::YubiKey ) = > yubikey ::validate_yubikey_login ( twofactor_code , & selected_data ? ) . await ? , Some ( TwoFactorType ::YubiKey ) = > yubikey ::validate_yubikey_login ( twofactor_code , & selected_data ? ) . await ? ,
Some ( TwoFactorType ::Duo ) = > { Some ( TwoFactorType ::Duo ) = > {
if CONFIG . duo_use_iframe ( ) { duo_oidc ::validate_duo_login (
// Legacy iframe prompt flow
& user . email ,
duo ::validate_duo_login ( & user . email , twofactor_code , conn ) . await ? ; twofactor_code ,
} else { data . client_id . as_ref ( ) . unwrap ( ) ,
// OIDC based flow
data . device_identifier . as_ref ( ) . unwrap ( ) ,
duo_oidc ::validate_duo_login ( conn ,
& user . email , )
twofactor_code , . await ? ;
data . client_id . as_ref ( ) . unwrap ( ) ,
data . device_identifier . as_ref ( ) . unwrap ( ) ,
conn ,
)
. await ? ;
}
} }
Some ( TwoFactorType ::Email ) = > { Some ( TwoFactorType ::Email ) = > {
email ::validate_email_code_str ( & user . uuid , twofactor_code , & selected_data ? , & ip . ip , conn ) . await ? ; email ::validate_email_code_str ( & user . uuid , twofactor_code , & selected_data ? , & ip . ip , conn ) . await ? ;
@ -1005,16 +994,22 @@ async fn twofactor_auth(
device . save ( true , conn ) . await ? ; device . save ( true , conn ) . await ? ;
} }
err_json ! ( err_json ! (
json_err_twofactor ( & twofactor_ids , & user . uuid , data , client_version , conn ) . await ? , json_err_twofactor ( & twofactor_ids , user , data , conn ) . await ? ,
"2FA Remember token not provided or expired" "2FA Remember token not provided or expired"
) )
} }
} }
} }
Some ( TwoFactorType ::RecoveryCode ) = > { Some ( TwoFactorType ::RecoveryCode ) = > {
// Check if recovery code is correct
// Like upstream, spaces and case don't matter
if ! user . check_valid_recovery_code ( twofactor_code ) { let recovery_code = twofactor_code . replace ( ' ' , "" ) . trim ( ) . to_lowercase ( ) ;
err ! ( "Recovery code is incorrect. Try again." ) if ! user . check_valid_recovery_code ( & recovery_code ) {
err ! (
"Two-step token is invalid. Try again." ,
ErrorEvent {
event : EventType ::UserFailedLogIn2fa
}
)
} }
// Remove all twofactors from the user
// Remove all twofactors from the user
@ -1027,7 +1022,14 @@ async fn twofactor_auth(
enforce_2fa_policy ( user , & user . uuid , device . atype , & ip . ip , conn ) . await ? ; enforce_2fa_policy ( user , & user . uuid , device . atype , & ip . ip , conn ) . await ? ;
log_user_event ( EventType ::UserRecovered2fa as i32 , & user . uuid , device . atype , & ip . ip , conn ) . await ; log_user_event ( EventType ::UserRecovered2fa , & user . uuid , device . atype , & ip . ip , conn ) . await ;
if CONFIG . mail_enabled ( )
& & let Err ( e ) =
mail ::send_recover_twofactor ( & user . email , & ip . ip . to_string ( ) , & Utc ::now ( ) . naive_utc ( ) ) . await
{
error ! ( "Error sending two-step login recovered email: {e:#?}" ) ;
}
// Remove the recovery code, not needed without twofactors
// Remove the recovery code, not needed without twofactors
user . totp_recover = None ; user . totp_recover = None ;
@ -1056,21 +1058,14 @@ fn selected_data(tf: Option<TwoFactor>) -> ApiResult<String> {
tf . map ( | t | t . data ) . map_res ( "Two factor doesn't exist" ) tf . map ( | t | t . data ) . map_res ( "Two factor doesn't exist" )
} }
async fn json_err_twofactor ( async fn json_err_twofactor ( providers : & [ i32 ] , user : & User , data : & ConnectData , conn : & DbConn ) -> ApiResult < Value > {
providers : & [ i32 ] , let user_id = & user . uuid ;
user_id : & UserId ,
data : & ConnectData ,
client_version : Option < & ClientVersion > ,
conn : & DbConn ,
) -> ApiResult < Value > {
let mut result = json ! ( { let mut result = json ! ( {
"error" : "invalid_grant" , "error" : "invalid_grant" ,
"error_description" : "Two factor required." , "error_description" : "Two factor required." ,
"TwoFactorProviders" : providers . iter ( ) . map ( ToString ::to_string ) . collect ::< Vec < String > > ( ) , "TwoFactorProviders" : providers . iter ( ) . map ( ToString ::to_string ) . collect ::< Vec < String > > ( ) ,
"TwoFactorProviders2" : { } , // { "0" : null }
"TwoFactorProviders2" : { } , // { "0" : null }
"MasterPasswordPolicy" : { "MasterPasswordPolicy" : identity_master_password_policy ( user , conn ) . await ,
"Object" : "masterPasswordPolicy"
}
} ) ; } ) ;
for provider in providers { for provider in providers {
@ -1083,37 +1078,21 @@ async fn json_err_twofactor(
} }
Some ( TwoFactorType ::Duo ) = > { Some ( TwoFactorType ::Duo ) = > {
let email = if let Some ( u ) = User ::find_by_uuid ( user_id , conn ) . await { let auth_url = duo_oidc ::get_duo_auth_url (
u . email & user . email ,
} else { data . client_id . as_ref ( ) . unwrap ( ) ,
err ! ( "User does not exist" ) data . device_identifier . as_ref ( ) . unwrap ( ) ,
} ; conn ,
)
if CONFIG . duo_use_iframe ( ) { . await ? ;
// Legacy iframe prompt flow
let ( signature , host ) = duo ::generate_duo_signature ( & email , conn ) . await ? ;
result [ "TwoFactorProviders2" ] [ provider . to_string ( ) ] = json ! ( {
"Host" : host ,
"Signature" : signature ,
} ) ;
} else {
// OIDC based flow
let auth_url = duo_oidc ::get_duo_auth_url (
& email ,
data . client_id . as_ref ( ) . unwrap ( ) ,
data . device_identifier . as_ref ( ) . unwrap ( ) ,
conn ,
)
. await ? ;
result [ "TwoFactorProviders2" ] [ provider . to_string ( ) ] = json ! ( { result [ "TwoFactorProviders2" ] [ provider . to_string ( ) ] = json ! ( {
"AuthUrl" : auth_url , "AuthUrl" : auth_url ,
} ) ; } ) ;
}
} }
Some ( tf_type @ TwoFactorType ::YubiKey ) = > { Some ( tf_type @ TwoFactorType ::YubiKey ) = > {
let Some ( twofactor ) = TwoFactor ::find_by_user_and_type ( user_id , tf_type as i32 , conn ) . await else { let Some ( twofactor ) = TwoFactor ::find_by_user_and_type ( user_id , tf_type , conn ) . await else {
err ! ( "No YubiKey devices registered" ) err ! ( "No YubiKey devices registered" )
} ; } ;
@ -1125,23 +1104,10 @@ async fn json_err_twofactor(
} }
Some ( tf_type @ TwoFactorType ::Email ) = > { Some ( tf_type @ TwoFactorType ::Email ) = > {
let Some ( twofactor ) = TwoFactor ::find_by_user_and_type ( user_id , tf_type as i32 , conn ) . await else { let Some ( twofactor ) = TwoFactor ::find_by_user_and_type ( user_id , tf_type , conn ) . await else {
err ! ( "No twofactor email registered" ) err ! ( "No twofactor email registered" )
} ; } ;
// Starting with version 2025.5.0 the client will call `/api/two-factor/send-email-login`.
let disabled_send = if let Some ( cv ) = client_version {
let ver_match = semver ::VersionReq ::parse ( ">=2025.5.0" ) . unwrap ( ) ;
ver_match . matches ( & cv . 0 )
} else {
false
} ;
// Send email immediately if email is the only 2FA option.
if providers . len ( ) = = 1 & & ! disabled_send {
email ::send_token ( user_id , conn ) . await ? ;
}
let email_data = email ::EmailTokenData ::from_json ( & twofactor . data ) ? ; let email_data = email ::EmailTokenData ::from_json ( & twofactor . data ) ? ;
result [ "TwoFactorProviders2" ] [ provider . to_string ( ) ] = json ! ( { result [ "TwoFactorProviders2" ] [ provider . to_string ( ) ] = json ! ( {
"Email" : email ::obscure_email ( & email_data . email ) , "Email" : email ::obscure_email ( & email_data . email ) ,
@ -1181,11 +1147,6 @@ async fn prelogin_password(data: Json<PreloginData>, ip: ClientIp, conn: DbConn)
prelogin ( data , ip , conn ) . await prelogin ( data , ip , conn ) . await
} }
#[ post( " /accounts/register " , data = " <data> " ) ]
async fn identity_register ( data : Json < RegisterData > , conn : DbConn ) -> JsonResult {
register ( data , false , conn ) . await
}
#[ derive(Debug, Deserialize) ] #[ derive(Debug, Deserialize) ]
#[ serde(rename_all = " camelCase " ) ] #[ serde(rename_all = " camelCase " ) ]
struct RegisterVerificationData { struct RegisterVerificationData {
@ -1257,8 +1218,9 @@ async fn register_verification_email(
} }
#[ post( " /accounts/register/finish " , data = " <data> " ) ] #[ post( " /accounts/register/finish " , data = " <data> " ) ]
async fn register_finish ( data : Json < RegisterData > , conn : DbConn ) -> JsonResult { async fn register_finish ( data : Json < RegisterData > , ip : ClientIp , conn : DbConn ) -> JsonResult {
register ( data , true , conn ) . await crate ::ratelimit ::check_limit_unauthenticated ( & ip . ip ) ? ;
register ( data , conn ) . await
} }
// https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts
// https://github.com/bitwarden/jslib/blob/master/common/src/models/request/tokenRequest.ts
@ -1395,7 +1357,7 @@ async fn oidcsignin_redirect(
let state = sso ::decode_state ( & base64_state ) ? ; let state = sso ::decode_state ( & base64_state ) ? ;
let Some ( mut sso_auth ) = SsoAuth ::find ( & state , conn ) . await else { let Some ( mut sso_auth ) = SsoAuth ::find ( & state , conn ) . await else {
err ! ( format ! ( "Cannot retrieve sso_auth for {state }" ) ) err ! ( format ! ( "Cannot retrieve sso_auth for {}" , state . escape_debug ( ) ) )
} ; } ;
// Browser-binding check
// Browser-binding check
@ -1404,7 +1366,7 @@ async fn oidcsignin_redirect(
let provided_hash = cookie_value . as_deref ( ) . map ( | v | crypto ::sha256_hex ( v . as_bytes ( ) ) ) ; let provided_hash = cookie_value . as_deref ( ) . map ( | v | crypto ::sha256_hex ( v . as_bytes ( ) ) ) ;
match ( sso_auth . binding_hash . as_deref ( ) , provided_hash . as_deref ( ) ) { match ( sso_auth . binding_hash . as_deref ( ) , provided_hash . as_deref ( ) ) {
( Some ( expected ) , Some ( actual ) ) if crypto ::ct_eq ( expected , actual ) = > { } ( Some ( expected ) , Some ( actual ) ) if crypto ::ct_eq ( expected , actual ) = > { }
_ = > err ! ( format ! ( "SSO session binding mismatch for {state }" ) ) , _ = > err ! ( format ! ( "SSO session binding mismatch for {}" , state . escape_debug ( ) ) ) ,
} }
cookies cookies
. remove ( Cookie ::build ( SSO_BINDING_COOKIE ) . path ( format ! ( "{}/identity/connect/" , CONFIG . domain_path ( ) ) ) . build ( ) ) ; . remove ( Cookie ::build ( SSO_BINDING_COOKIE ) . path ( format ! ( "{}/identity/connect/" , CONFIG . domain_path ( ) ) ) . build ( ) ) ;
Akhil Babel
15 hours ago