#556

pending completion

Build # #556

Build Type

push

github-actions

Committed by

web-flow

Commit Message

<a href="https://github.com/Badgerati/Pode/commit/<a class=hub.com/Badgerati/Pode/commit/f5b91d2612e5ac6f2acc81a86b1380ae008ae315">f5b91d261<a href="https://github.com/Badgerati/Pode/commit/f5b91d2612e5ac6f2acc81a86b1380ae008ae315">">Merge </a><a class="double-link" href="https://github.com/Badgerati/Pode/commit/<a class="double-link" href="https://github.com/Badgerati/Pode/commit/8888f7b7555961509c6e406c50eb479203999635">8888f7b75</a>">8888f7b75</a><a href="https://github.com/Badgerati/Pode/commit/f5b91d2612e5ac6f2acc81a86b1380ae008ae315"> into 5f3eda0fe">5f3eda0fe</a>

Run Details

109 of 109 new or added lines in 2 files covered. (100.0%)

2366 of 5313 relevant lines covered (44.53%)

1.14 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/Public/Authentication.ps1

<#
.SYNOPSIS
Create a new type of Authentication.

.DESCRIPTION
Create a new type of Authentication, which is used to parse the Request for user credentials for validating.

.PARAMETER Basic
If supplied, will use the inbuilt Basic Authentication credentials retriever.

.PARAMETER Encoding
The Encoding to use when decoding the Basic Authorization header.

.PARAMETER HeaderTag
The name of the type of Basic Authentication.

.PARAMETER Form
If supplied, will use the inbuilt Form Authentication credentials retriever.

.PARAMETER UsernameField
The name of the Username Field in the payload to retrieve the username.

.PARAMETER PasswordField
The name of the Password Field in the payload to retrieve the password.

.PARAMETER Custom
If supplied, will allow you to create a Custom Authentication credentials retriever.

.PARAMETER ScriptBlock
The ScriptBlock is used to parse the request and retieve user credentials and other information.

.PARAMETER ArgumentList
An array of arguments to supply to the Custom Authentication type's ScriptBlock.

.PARAMETER Name
The Name of an Authentication type - such as Basic or NTLM.

.PARAMETER Realm
The name of scope of the protected area.

.PARAMETER Scheme
The scheme type for custom Authentication types. Default is HTTP.

.PARAMETER PostValidator
The PostValidator is a scriptblock that is invoked after user validation.

.PARAMETER Digest
If supplied, will use the inbuilt Digest Authentication credentials retriever.

.PARAMETER Bearer
If supplied, will use the inbuilt Bearer Authentication token retriever.

.PARAMETER Scope
An optional array of Scopes for Bearer Authentication. (These are case-sensitive)

.EXAMPLE
$basic_auth = New-PodeAuthType -Basic

.EXAMPLE
$form_auth = New-PodeAuthType -Form -UsernameField 'Email'

.EXAMPLE
$custom_auth = New-PodeAuthType -Custom -ScriptBlock { /* logic */ }
#>
function New-PodeAuthType
{
    [CmdletBinding(DefaultParameterSetName='Basic')]
    [OutputType([hashtable])]
    param (
        [Parameter(ParameterSetName='Basic')]
        [switch]
        $Basic,

        [Parameter(ParameterSetName='Basic')]
        [string]
        $Encoding = 'ISO-8859-1',

        [Parameter(ParameterSetName='Basic')]
        [string]
        $HeaderTag = 'Basic',

        [Parameter(ParameterSetName='Form')]
        [switch]
        $Form,

        [Parameter(ParameterSetName='Form')]
        [string]
        $UsernameField = 'username',

        [Parameter(ParameterSetName='Form')]
        [string]
        $PasswordField = 'password',

        [Parameter(ParameterSetName='Custom')]
        [switch]
        $Custom,

        [Parameter(Mandatory=$true, ParameterSetName='Custom')]
        [ValidateScript({
            if (Test-IsEmpty $_) {
                throw "A non-empty ScriptBlock is required for the Custom authentication type"
            }

            return $true
        })]
        [scriptblock]
        $ScriptBlock,

        [Parameter(ParameterSetName='Custom')]
        [hashtable]
        $ArgumentList,

        [Parameter(ParameterSetName='Custom')]
        [string]
        $Name,

        [Parameter()]
        [string]
        $Realm,

        [Parameter(ParameterSetName='Custom')]
        [ValidateSet('ApiKey', 'Http', 'OAuth2', 'OpenIdConnect')]
        [string]
        $Scheme = 'Http',

        [Parameter(ParameterSetName='Custom')]
        [scriptblock]
        $PostValidator,

        [Parameter(ParameterSetName='Digest')]
        [switch]
        $Digest,

        [Parameter(ParameterSetName='Bearer')]
        [switch]
        $Bearer,

        [Parameter(ParameterSetName='Bearer')]
        [string[]]
        $Scope
    )

    # default realm
    $_realm = 'User'

    # configure the auth type
    switch ($PSCmdlet.ParameterSetName.ToLowerInvariant()) {
        'basic' {
            return @{
                Name = (Protect-PodeValue -Value $HeaderTag -Default 'Basic')
                Realm = (Protect-PodeValue -Value $Realm -Default $_realm)
                ScriptBlock = (Get-PodeAuthBasicType)
                PostValidator = $null
                Scheme = 'http'
                Arguments = @{
                    HeaderTag = (Protect-PodeValue -Value $HeaderTag -Default 'Basic')
                    Encoding = (Protect-PodeValue -Value $Encoding -Default 'ISO-8859-1')
                }
            }
        }

        'digest' {
            return @{
                Name = 'Digest'
                Realm = (Protect-PodeValue -Value $Realm -Default $_realm)
                ScriptBlock = (Get-PodeAuthDigestType)
                PostValidator = (Get-PodeAuthDigestPostValidator)
                Scheme = 'http'
                Arguments = @{}
            }
        }

        'bearer' {
            return @{
                Name = 'Bearer'
                Realm = (Protect-PodeValue -Value $Realm -Default $_realm)
                ScriptBlock = (Get-PodeAuthBearerType)
                PostValidator = (Get-PodeAuthBearerPostValidator)
                Scheme = 'http'
                Arguments = @{
                    Scopes = $Scope
                }
            }
        }

        'form' {
            return @{
                Name = 'Form'
                Realm = (Protect-PodeValue -Value $Realm -Default $_realm)
                ScriptBlock = (Get-PodeAuthFormType)
                PostValidator = $null
                Scheme = 'http'
                Arguments = @{
                    Fields = @{
                        Username = (Protect-PodeValue -Value $UsernameField -Default 'username')
                        Password = (Protect-PodeValue -Value $PasswordField -Default 'password')
                    }
                }
            }
        }

        'custom' {
            return @{
                Name = $Name
                Realm = (Protect-PodeValue -Value $Realm -Default $_realm)
                Scheme = $Scheme.ToLowerInvariant()
                ScriptBlock = $ScriptBlock
                PostValidator = $PostValidator
                Arguments = $ArgumentList
            }
        }
    }
}

<#
.SYNOPSIS
Adds a custom Authentication method for verifying users.

.DESCRIPTION
Adds a custom Authentication method for verifying users.

.PARAMETER Name
A unique Name for the Authentication method.

.PARAMETER Type
The Type to use for retrieving credentials (From New-PodeAuthType).

.PARAMETER ScriptBlock
The ScriptBlock defining logic that retrieves and verifys a user.

.PARAMETER ArgumentList
An array of arguments to supply to the Custom Authentication's ScriptBlock.

.EXAMPLE
New-PodeAuthType -Form | Add-PodeAuth -Name 'Main' -ScriptBlock { /* logic */ }
#>
function Add-PodeAuth
{
    [CmdletBinding()]
    param (
        [Parameter(Mandatory=$true)]
        [string]
        $Name,

        [Parameter(Mandatory=$true, ValueFromPipeline=$true)]
        [hashtable]
        $Type,

        [Parameter(Mandatory=$true)]
        [ValidateScript({
            if (Test-IsEmpty $_) {
                throw "A non-empty ScriptBlock is required for the authentication method"
            }

            return $true
        })]
        [scriptblock]
        $ScriptBlock,

        [Parameter()]
        [object[]]
        $ArgumentList
    )

    # ensure the name doesn't already exist
    if ($PodeContext.Server.Authentications.ContainsKey($Name)) {
        throw "Authentication method already defined: $($Name)"
    }

    # ensure the Type contains a scriptblock
    if (Test-IsEmpty $Type.ScriptBlock) {
        throw "The supplied Type for the '$($Name)' authentication method requires a valid ScriptBlock"
    }

    # add auth method to server
    $PodeContext.Server.Authentications[$Name] = @{
        Type = $Type
        ScriptBlock = $ScriptBlock
        Arguments = $ArgumentList
    }
}

<#
.SYNOPSIS
Adds the inbuilt Windows AD Authentication method for verifying users.

.DESCRIPTION
Adds the inbuilt Windows AD Authentication method for verifying users.

.PARAMETER Name
A unique Name for the Authentication method.

.PARAMETER Type
The Type to use for retrieving credentials (From New-PodeAuthType).

.PARAMETER Fqdn
A custom FQDN for the DNS of the AD you wish to authenticate against. (Alias: Server)

.PARAMETER Domain
(Unix Only) A custom domain name that is prepended onto usernames that are missing it (<Domain>\<Username>).

.PARAMETER Groups
An array of Group names to only allow access.

.PARAMETER Users
An array of Usernames to only allow access.

.PARAMETER NoGroups
If supplied, groups will not be retrieved for the user in AD.

.PARAMETER OpenLDAP
If supplied, and on Windows, OpenLDAP will be used instead.

.EXAMPLE
New-PodeAuthType -Form | Add-PodeAuthWindowsAd -Name 'WinAuth'

.EXAMPLE
New-PodeAuthType -Basic | Add-PodeAuthWindowsAd -Name 'WinAuth' -Groups @('Developers')

.EXAMPLE
New-PodeAuthType -Form | Add-PodeAuthWindowsAd -Name 'WinAuth' -NoGroups

.EXAMPLE
New-PodeAuthType -Form | Add-PodeAuthWindowsAd -Name 'UnixAuth' -Server 'testdomain.company.com' -Domain 'testdomain'
#>
function Add-PodeAuthWindowsAd
{
    [CmdletBinding(DefaultParameterSetName='Groups')]
    param (
        [Parameter(Mandatory=$true)]
        [string]
        $Name,

        [Parameter(Mandatory=$true, ValueFromPipeline=$true)]
        [hashtable]
        $Type,

        [Parameter()]
        [Alias('Server')]
        [string]
        $Fqdn,

        [Parameter()]
        [string]
        $Domain,

        [Parameter(ParameterSetName='Groups')]
        [string[]]
        $Groups,

        [Parameter()]
        [string[]]
        $Users,

        [Parameter(ParameterSetName='NoGroups')]
        [switch]
        $NoGroups,

        [switch]
        $OpenLDAP
    )

    # ensure the name doesn't already exist
    if ($PodeContext.Server.Authentications.ContainsKey($Name)) {
        throw "Windows AD Authentication method already defined: $($Name)"
    }

    # ensure the Type contains a scriptblock
    if (Test-IsEmpty $Type.ScriptBlock) {
        throw "The supplied Type for the '$($Name)' Windows AD authentication method requires a valid ScriptBlock"
    }

    # set server name if not passed
    if ([string]::IsNullOrWhiteSpace($Fqdn)) {
        $Fqdn = Get-PodeAuthDomainName

        if ([string]::IsNullOrWhiteSpace($Fqdn)) {
            throw 'No domain server name has been supplied for Windows AD authentication'
        }
    }

    # set the domain if not passed
    if ([string]::IsNullOrWhiteSpace($Domain)) {
        $Domain = ($Fqdn -split '\.')[0]
    }

    # add Windows AD auth method to server
    $PodeContext.Server.Authentications[$Name] = @{
        Type = $Type
        ScriptBlock = (Get-PodeAuthWindowsADMethod)
        Arguments = @{
            Server = $Fqdn
            Domain = $Domain
            Users = $Users
            Groups = $Groups
            NoGroups = $NoGroups
            OpenLDAP = $OpenLDAP
        }
    }
}

<#
.SYNOPSIS
Remove a specific Authentication method.

.DESCRIPTION
Remove a specific Authentication method.

.PARAMETER Name
The Name of the Authentication method.

.EXAMPLE
Remove-PodeAuth -Name 'Login'
#>
function Remove-PodeAuth
{
    [CmdletBinding()]
    param (
        [Parameter(Mandatory=$true, ValueFromPipeline=$true)]
        [string]
        $Name
    )

    $PodeContext.Server.Authentications.Remove($Name) | Out-Null
}

<#
.SYNOPSIS
Clear all defined Authentication methods.

.DESCRIPTION
Clear all defined Authentication methods.

.EXAMPLE
Clear-PodeAuth
#>
function Clear-PodeAuth
{
    [CmdletBinding()]
    param()

    $PodeContext.Server.Authentications.Clear()
}

<#
.SYNOPSIS
Returns Authentication Middleware that can be used globally, or an Routes.

.DESCRIPTION
Returns Authentication Middleware that can be used globally, or an Routes.

.PARAMETER Name
The Name of the Authentication method.

.PARAMETER FailureUrl
The URL to redirect to when authentication fails.

.PARAMETER FailureMessage
An override Message to throw when authentication fails.

.PARAMETER SuccessUrl
The URL to redirect to when authentication succeeds.

.PARAMETER EnableFlash
If supplied, error messages will be added as Flash messages.

.PARAMETER Sessionless
If supplied, authenticated users will not be stored in sessions, and sessions will not be used.

.PARAMETER AutoLogin
If supplied, navigating to a login page with a valid session will redirect to the SuccessUrl. Otherwise the login page will be displayed.

.PARAMETER Logout
If supplied, the current session will be purged, and the user will be redirected to the FailureUrl.

.EXAMPLE
Add-PodeRoute -Method Get -Path '/' -Middleware (Get-PodeAuthMiddleware -Name 'Main') -ScriptBlock { /* logic */ }

.EXAMPLE
Get-PodeAuthMiddleware -Name 'BasicAuth' -Sessionless | Add-PodeMiddeware -Name 'GlobalAuth'

.EXAMPLE
Add-PodeRoute -Method Get -Path '/login' -Middleware (Get-PodeAuthMiddleware -Name 'Main' -SuccessUrl '/' -AutoLogin) -ScriptBlock { /* logic */ }
#>
function Get-PodeAuthMiddleware
{
    [CmdletBinding()]
    [OutputType([hashtable])]
    param (
        [Parameter(Mandatory=$true, ValueFromPipeline=$true)]
        [string]
        $Name,

        [Parameter()]
        [string]
        $FailureUrl,

        [Parameter()]
        [string]
        $FailureMessage,

        [Parameter()]
        [string]
        $SuccessUrl,

        [switch]
        $EnableFlash,

        [switch]
        $Sessionless,

        [switch]
        $AutoLogin,

        [switch]
        $Logout
    )

    # ensure the auth method exists
    if (!$PodeContext.Server.Authentications.ContainsKey($Name)) {
        throw "Authentication method does not exist: $($Name)"
    }

    # if we're using sessions, ensure sessions have been setup
    if (!$Sessionless -and !(Test-PodeSessionsConfigured)) {
        throw 'Sessions are required to use session persistent authentication'
    }

    # create the options
    $options = @{
        Name = $Name
        Failure = @{
            Url = $FailureUrl
            Message = $FailureMessage
            FlashEnabled = $EnableFlash
        }
        Success = @{
            Url = $SuccessUrl
        }
        Sessionless = $Sessionless
        AutoLogin = $AutoLogin
        Logout = $Logout
    }

    # return the middleware
    return (Get-PodeAuthMiddlewareScript | New-PodeMiddleware -ArgumentList $options)
}

1	<#
2	.SYNOPSIS
3	Create a new type of Authentication.
4
5	.DESCRIPTION
6	Create a new type of Authentication, which is used to parse the Request for user credentials for validating.
7
8	.PARAMETER Basic
9	If supplied, will use the inbuilt Basic Authentication credentials retriever.
10
11	.PARAMETER Encoding
12	The Encoding to use when decoding the Basic Authorization header.
13
14	.PARAMETER HeaderTag
15	The name of the type of Basic Authentication.
16
17	.PARAMETER Form
18	If supplied, will use the inbuilt Form Authentication credentials retriever.
19
20	.PARAMETER UsernameField
21	The name of the Username Field in the payload to retrieve the username.
22
23	.PARAMETER PasswordField
24	The name of the Password Field in the payload to retrieve the password.
25
26	.PARAMETER Custom
27	If supplied, will allow you to create a Custom Authentication credentials retriever.
28
29	.PARAMETER ScriptBlock
30	The ScriptBlock is used to parse the request and retieve user credentials and other information.
31
32	.PARAMETER ArgumentList
33	An array of arguments to supply to the Custom Authentication type's ScriptBlock.
34
35	.PARAMETER Name
36	The Name of an Authentication type - such as Basic or NTLM.
37
38	.PARAMETER Realm
39	The name of scope of the protected area.
40
41	.PARAMETER Scheme
42	The scheme type for custom Authentication types. Default is HTTP.
43
44	.PARAMETER PostValidator
45	The PostValidator is a scriptblock that is invoked after user validation.
46
47	.PARAMETER Digest
48	If supplied, will use the inbuilt Digest Authentication credentials retriever.
49
50	.PARAMETER Bearer
51	If supplied, will use the inbuilt Bearer Authentication token retriever.
52
53	.PARAMETER Scope
54	An optional array of Scopes for Bearer Authentication. (These are case-sensitive)
55
56	.EXAMPLE
57	$basic_auth = New-PodeAuthType -Basic
58
59	.EXAMPLE
60	$form_auth = New-PodeAuthType -Form -UsernameField 'Email'
61
62	.EXAMPLE
63	$custom_auth = New-PodeAuthType -Custom -ScriptBlock { /* logic */ }
64	#>
65	function New-PodeAuthType
66	{
67	[CmdletBinding(DefaultParameterSetName='Basic')]
68	[OutputType([hashtable])]
69	param (
70	[Parameter(ParameterSetName='Basic')]
71	[switch]
72	$Basic,
73
74	[Parameter(ParameterSetName='Basic')]
75	[string]
76	$Encoding = 'ISO-8859-1',
77
78	[Parameter(ParameterSetName='Basic')]
79	[string]
80	$HeaderTag = 'Basic',
81
82	[Parameter(ParameterSetName='Form')]
83	[switch]
84	$Form,
85
86	[Parameter(ParameterSetName='Form')]
87	[string]
88	$UsernameField = 'username',
89
90	[Parameter(ParameterSetName='Form')]
91	[string]
92	$PasswordField = 'password',
93
94	[Parameter(ParameterSetName='Custom')]
95	[switch]
96	$Custom,
97
98	[Parameter(Mandatory=$true, ParameterSetName='Custom')]
99	[ValidateScript({
100	if (Test-IsEmpty $_) {	×
101	throw "A non-empty ScriptBlock is required for the Custom authentication type"	×
102	}
103
104	return $true	×
105	})]
106	[scriptblock]
107	$ScriptBlock,
108
109	[Parameter(ParameterSetName='Custom')]
110	[hashtable]
111	$ArgumentList,
112
113	[Parameter(ParameterSetName='Custom')]
114	[string]
115	$Name,
116
117	[Parameter()]
118	[string]
119	$Realm,
120
121	[Parameter(ParameterSetName='Custom')]
122	[ValidateSet('ApiKey', 'Http', 'OAuth2', 'OpenIdConnect')]
123	[string]
124	$Scheme = 'Http',
125
126	[Parameter(ParameterSetName='Custom')]
127	[scriptblock]
128	$PostValidator,
129
130	[Parameter(ParameterSetName='Digest')]
131	[switch]
132	$Digest,
133
134	[Parameter(ParameterSetName='Bearer')]
135	[switch]
136	$Bearer,
137
138	[Parameter(ParameterSetName='Bearer')]
139	[string[]]
140	$Scope
141	)
142
143	# default realm
144	$_realm = 'User'	×
145
146	# configure the auth type
147	switch ($PSCmdlet.ParameterSetName.ToLowerInvariant()) {	×
148	'basic' {
149	return @{	×
150	Name = (Protect-PodeValue -Value $HeaderTag -Default 'Basic')	×
151	Realm = (Protect-PodeValue -Value $Realm -Default $_realm)	×
152	ScriptBlock = (Get-PodeAuthBasicType)	×
153	PostValidator = $null	×
154	Scheme = 'http'	×
155	Arguments = @{	×
156	HeaderTag = (Protect-PodeValue -Value $HeaderTag -Default 'Basic')	×
157	Encoding = (Protect-PodeValue -Value $Encoding -Default 'ISO-8859-1')	×
158	}
159	}
160	}
161
162	'digest' {
163	return @{	×
164	Name = 'Digest'	×
165	Realm = (Protect-PodeValue -Value $Realm -Default $_realm)	×
166	ScriptBlock = (Get-PodeAuthDigestType)	×
167	PostValidator = (Get-PodeAuthDigestPostValidator)	×
168	Scheme = 'http'	×
169	Arguments = @{}	×
170	}
171	}
172
173	'bearer' {
174	return @{	×
175	Name = 'Bearer'	×
176	Realm = (Protect-PodeValue -Value $Realm -Default $_realm)	×
177	ScriptBlock = (Get-PodeAuthBearerType)	×
178	PostValidator = (Get-PodeAuthBearerPostValidator)	×
179	Scheme = 'http'	×
180	Arguments = @{	×
181	Scopes = $Scope	×
182	}
183	}
184	}
185
186	'form' {
187	return @{	×
188	Name = 'Form'	×
189	Realm = (Protect-PodeValue -Value $Realm -Default $_realm)	×
190	ScriptBlock = (Get-PodeAuthFormType)	×
191	PostValidator = $null	×
192	Scheme = 'http'	×
193	Arguments = @{	×
194	Fields = @{	×
195	Username = (Protect-PodeValue -Value $UsernameField -Default 'username')	×
196	Password = (Protect-PodeValue -Value $PasswordField -Default 'password')	×
197	}
198	}
199	}
200	}
201
202	'custom' {
203	return @{	×
204	Name = $Name	×
205	Realm = (Protect-PodeValue -Value $Realm -Default $_realm)	×
206	Scheme = $Scheme.ToLowerInvariant()	×
207	ScriptBlock = $ScriptBlock	×
208	PostValidator = $PostValidator	×
209	Arguments = $ArgumentList	×
210	}
211	}
212	}
213	}
214
215	<#
216	.SYNOPSIS
217	Adds a custom Authentication method for verifying users.
218
219	.DESCRIPTION
220	Adds a custom Authentication method for verifying users.
221
222	.PARAMETER Name
223	A unique Name for the Authentication method.
224
225	.PARAMETER Type
226	The Type to use for retrieving credentials (From New-PodeAuthType).
227
228	.PARAMETER ScriptBlock
229	The ScriptBlock defining logic that retrieves and verifys a user.
230
231	.PARAMETER ArgumentList
232	An array of arguments to supply to the Custom Authentication's ScriptBlock.
233
234	.EXAMPLE
235	New-PodeAuthType -Form \| Add-PodeAuth -Name 'Main' -ScriptBlock { /* logic */ }
236	#>
237	function Add-PodeAuth
238	{
239	[CmdletBinding()]
240	param (
241	[Parameter(Mandatory=$true)]
242	[string]
243	$Name,
244
245	[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
246	[hashtable]
247	$Type,
248
249	[Parameter(Mandatory=$true)]
250	[ValidateScript({
251	if (Test-IsEmpty $_) {	×
252	throw "A non-empty ScriptBlock is required for the authentication method"	×
253	}
254
255	return $true	×
256	})]
257	[scriptblock]
258	$ScriptBlock,
259
260	[Parameter()]
261	[object[]]
262	$ArgumentList
263	)
264
265	# ensure the name doesn't already exist
266	if ($PodeContext.Server.Authentications.ContainsKey($Name)) {	×
267	throw "Authentication method already defined: $($Name)"	×
268	}
269
270	# ensure the Type contains a scriptblock
271	if (Test-IsEmpty $Type.ScriptBlock) {	×
272	throw "The supplied Type for the '$($Name)' authentication method requires a valid ScriptBlock"	×
273	}
274
275	# add auth method to server
276	$PodeContext.Server.Authentications[$Name] = @{	×
277	Type = $Type	×
278	ScriptBlock = $ScriptBlock	×
279	Arguments = $ArgumentList	×
280	}
281	}
282
283	<#
284	.SYNOPSIS
285	Adds the inbuilt Windows AD Authentication method for verifying users.
286
287	.DESCRIPTION
288	Adds the inbuilt Windows AD Authentication method for verifying users.
289
290	.PARAMETER Name
291	A unique Name for the Authentication method.
292
293	.PARAMETER Type
294	The Type to use for retrieving credentials (From New-PodeAuthType).
295
296	.PARAMETER Fqdn
297	A custom FQDN for the DNS of the AD you wish to authenticate against. (Alias: Server)
298
299	.PARAMETER Domain
300	(Unix Only) A custom domain name that is prepended onto usernames that are missing it (<Domain>\<Username>).
301
302	.PARAMETER Groups
303	An array of Group names to only allow access.
304
305	.PARAMETER Users
306	An array of Usernames to only allow access.
307
308	.PARAMETER NoGroups
309	If supplied, groups will not be retrieved for the user in AD.
310
311	.PARAMETER OpenLDAP
312	If supplied, and on Windows, OpenLDAP will be used instead.
313
314	.EXAMPLE
315	New-PodeAuthType -Form \| Add-PodeAuthWindowsAd -Name 'WinAuth'
316
317	.EXAMPLE
318	New-PodeAuthType -Basic \| Add-PodeAuthWindowsAd -Name 'WinAuth' -Groups @('Developers')
319
320	.EXAMPLE
321	New-PodeAuthType -Form \| Add-PodeAuthWindowsAd -Name 'WinAuth' -NoGroups
322
323	.EXAMPLE
324	New-PodeAuthType -Form \| Add-PodeAuthWindowsAd -Name 'UnixAuth' -Server 'testdomain.company.com' -Domain 'testdomain'
325	#>
326	function Add-PodeAuthWindowsAd
327	{
328	[CmdletBinding(DefaultParameterSetName='Groups')]
329	param (
330	[Parameter(Mandatory=$true)]
331	[string]
332	$Name,
333
334	[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
335	[hashtable]
336	$Type,
337
338	[Parameter()]
339	[Alias('Server')]
340	[string]
341	$Fqdn,
342
343	[Parameter()]
344	[string]
345	$Domain,
346
347	[Parameter(ParameterSetName='Groups')]
348	[string[]]
349	$Groups,
350
351	[Parameter()]
352	[string[]]
353	$Users,
354
355	[Parameter(ParameterSetName='NoGroups')]
356	[switch]
357	$NoGroups,
358
359	[switch]
360	$OpenLDAP
361	)
362
363	# ensure the name doesn't already exist
364	if ($PodeContext.Server.Authentications.ContainsKey($Name)) {	×
365	throw "Windows AD Authentication method already defined: $($Name)"	×
366	}
367
368	# ensure the Type contains a scriptblock
369	if (Test-IsEmpty $Type.ScriptBlock) {	×
370	throw "The supplied Type for the '$($Name)' Windows AD authentication method requires a valid ScriptBlock"	×
371	}
372
373	# set server name if not passed
374	if ([string]::IsNullOrWhiteSpace($Fqdn)) {	×
375	$Fqdn = Get-PodeAuthDomainName	×
376
377	if ([string]::IsNullOrWhiteSpace($Fqdn)) {	×
378	throw 'No domain server name has been supplied for Windows AD authentication'	×
379	}
380	}
381
382	# set the domain if not passed
383	if ([string]::IsNullOrWhiteSpace($Domain)) {	×
384	$Domain = ($Fqdn -split '\.')[0]	×
385	}
386
387	# add Windows AD auth method to server
388	$PodeContext.Server.Authentications[$Name] = @{	×
389	Type = $Type	×
390	ScriptBlock = (Get-PodeAuthWindowsADMethod)	×
391	Arguments = @{	×
392	Server = $Fqdn	×
393	Domain = $Domain	×
394	Users = $Users	×
395	Groups = $Groups	×
396	NoGroups = $NoGroups	×
397	OpenLDAP = $OpenLDAP	×
398	}
399	}
400	}
401
402	<#
403	.SYNOPSIS
404	Remove a specific Authentication method.
405
406	.DESCRIPTION
407	Remove a specific Authentication method.
408
409	.PARAMETER Name
410	The Name of the Authentication method.
411
412	.EXAMPLE
413	Remove-PodeAuth -Name 'Login'
414	#>
415	function Remove-PodeAuth
416	{
417	[CmdletBinding()]
418	param (
419	[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
420	[string]
421	$Name
422	)
423
424	$PodeContext.Server.Authentications.Remove($Name) \| Out-Null	×
425	}
426
427	<#
428	.SYNOPSIS
429	Clear all defined Authentication methods.
430
431	.DESCRIPTION
432	Clear all defined Authentication methods.
433
434	.EXAMPLE
435	Clear-PodeAuth
436	#>
437	function Clear-PodeAuth
438	{
439	[CmdletBinding()]
440	param()
441
442	$PodeContext.Server.Authentications.Clear()	×
443	}
444
445	<#
446	.SYNOPSIS
447	Returns Authentication Middleware that can be used globally, or an Routes.
448
449	.DESCRIPTION
450	Returns Authentication Middleware that can be used globally, or an Routes.
451
452	.PARAMETER Name
453	The Name of the Authentication method.
454
455	.PARAMETER FailureUrl
456	The URL to redirect to when authentication fails.
457
458	.PARAMETER FailureMessage
459	An override Message to throw when authentication fails.
460
461	.PARAMETER SuccessUrl
462	The URL to redirect to when authentication succeeds.
463
464	.PARAMETER EnableFlash
465	If supplied, error messages will be added as Flash messages.
466
467	.PARAMETER Sessionless
468	If supplied, authenticated users will not be stored in sessions, and sessions will not be used.
469
470	.PARAMETER AutoLogin
471	If supplied, navigating to a login page with a valid session will redirect to the SuccessUrl. Otherwise the login page will be displayed.
472
473	.PARAMETER Logout
474	If supplied, the current session will be purged, and the user will be redirected to the FailureUrl.
475
476	.EXAMPLE
477	Add-PodeRoute -Method Get -Path '/' -Middleware (Get-PodeAuthMiddleware -Name 'Main') -ScriptBlock { /* logic */ }
478
479	.EXAMPLE
480	Get-PodeAuthMiddleware -Name 'BasicAuth' -Sessionless \| Add-PodeMiddeware -Name 'GlobalAuth'
481
482	.EXAMPLE
483	Add-PodeRoute -Method Get -Path '/login' -Middleware (Get-PodeAuthMiddleware -Name 'Main' -SuccessUrl '/' -AutoLogin) -ScriptBlock { /* logic */ }
484	#>
485	function Get-PodeAuthMiddleware
486	{
487	[CmdletBinding()]
488	[OutputType([hashtable])]
489	param (
490	[Parameter(Mandatory=$true, ValueFromPipeline=$true)]
491	[string]
492	$Name,
493
494	[Parameter()]
495	[string]
496	$FailureUrl,
497
498	[Parameter()]
499	[string]
500	$FailureMessage,
501
502	[Parameter()]
503	[string]
504	$SuccessUrl,
505
506	[switch]
507	$EnableFlash,
508
509	[switch]
510	$Sessionless,
511
512	[switch]
513	$AutoLogin,
514
515	[switch]
516	$Logout
517	)
518
519	# ensure the auth method exists
520	if (!$PodeContext.Server.Authentications.ContainsKey($Name)) {	×
521	throw "Authentication method does not exist: $($Name)"	×
522	}
523
524	# if we're using sessions, ensure sessions have been setup
525	if (!$Sessionless -and !(Test-PodeSessionsConfigured)) {	×
526	throw 'Sessions are required to use session persistent authentication'	×
527	}
528
529	# create the options
530	$options = @{	×
531	Name = $Name	×
532	Failure = @{	×
533	Url = $FailureUrl	×
534	Message = $FailureMessage	×
535	FlashEnabled = $EnableFlash	×
536	}
537	Success = @{	×
538	Url = $SuccessUrl	×
539	}
540	Sessionless = $Sessionless	×
541	AutoLogin = $AutoLogin	×
542	Logout = $Logout	×
543	}
544
545	# return the middleware
546	return (Get-PodeAuthMiddlewareScript \| New-PodeMiddleware -ArgumentList $options)	×
547	}

Badgerati / Pode / #556

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous