GUACAMOLE-1020: Implement extension with enhanced login and connection restrictions.

This commit is contained in:
Virtually Nick
2023-03-26 17:03:58 -04:00
parent 2168b44be0
commit 1088f60a49
34 changed files with 3058 additions and 1 deletions

View File

@@ -0,0 +1,40 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/**
* Config block which registers restrict-specific field types.
*/
angular.module('guacRestrict').config(['formServiceProvider',
function guacRestrictConfig(formServiceProvider) {
// Define the time restriction field
formServiceProvider.registerFieldType('GUAC_TIME_RESTRICTION', {
module : 'guacRestrict',
controller : 'timeRestrictionFieldController',
templateUrl : 'app/ext/restrict/templates/timeRestrictionField.html'
});
// Define the host restriction field
formServiceProvider.registerFieldType('GUAC_HOST_RESTRICTION', {
module : 'guacRestrict',
controller : 'hostRestrictionFieldController',
templateUrl : 'app/ext/restrict/templates/hostRestrictionField.html'
});
}]);

View File

@@ -0,0 +1,170 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/**
* Controller for host restriction fields, which are used to configure a
* hostname, IP address, or CIDR range, that this restriction applies to.
*/
angular.module('guacRestrict').controller('hostRestrictionFieldController', ['$scope', '$injector',
function hostRestrictionFieldController($scope, $injector) {
// Required types
const HostRestrictionEntry = $injector.get('HostRestrictionEntry');
/**
* Options which dictate the behavior of the input field model, as defined
* by https://docs.angularjs.org/api/ng/directive/ngModelOptions
*
* @type Object.<String, String>
*/
$scope.modelOptions = {
/**
* Space-delimited list of events on which the model will be updated.
*
* @type String
*/
updateOn : 'blur',
/**
* The time zone to use when reading/writing the Date object of the
* model.
*
* @type String
*/
timezone : 'UTC'
};
/**
* The restrictions, as objects, that are used by the HTML template to
* present the restrictions to the user via the web interface.
*
* @type HostRestrictionEntry[]
*/
$scope.restrictions = [];
/**
* Remove the current entry from the list.
*
* @param {HostRestrictionEntry} entry
* A restriction entry.
*/
$scope.removeEntry = function removeEntry(entry) {
if (entry === null || entry.$$hashKey === '') {
return;
}
for (let i = 0; i < $scope.restrictions.length; i++) {
if ($scope.restrictions[i].$$hashKey === entry.$$hashKey) {
$scope.restrictions.splice(i,1);
return;
}
}
};
/**
* Add an empty entry to the restriction list.
*/
$scope.addEntry = function addEntry() {
$scope.restrictions.push(new HostRestrictionEntry());
};
/**
* Parse the provided string into an array containing the objects that
* represent each of entries that can then be displayed as a more
* user-friendly field.
*
* @param {String} restrString
* The string that contains the restrictions, un-parsed and as stored
* in the underlying field.
*
* @returns {HostRestrictionEntry[]}
* An array of objects that represents each of the entries as parsed
* out of the string field, and which can be interpreted by the
* AngularJS field for display.
*/
const parseRestrictions = function parseRestrictions(restrString) {
var restrictions = [];
// If the string is null or empty, just return an empty array
if (restrString === null || restrString === "")
return restrictions;
// Set up the RegEx and split the string using the separator.
var restrArray = restrString.split(";");
// Loop through split string and process each item
for (let i = 0; i < restrArray.length; i++) {
var entry = new HostRestrictionEntry();
entry.host = restrArray[i];
restrictions.push(entry);
}
return restrictions;
};
/**
* Parse the restrictions in the field into a string that can be stored
* in an underlying module.
*
* @param {HostRestrictionEntry[]} restrictions
* The array of restrictions that will be converted to a string.
*
* @returns {String}
* The string containing the restriction data that can be stored in e.g.
* a database.
*/
const storeRestrictions = function storeRestrictions(restrictions) {
// If there are no members of the array, just return an empty string.
if (restrictions === null || restrictions.length < 1)
return '';
var restrString = '';
for (let i = 0; i < restrictions.length; i++) {
// If any of the properties are not defined, skip this one.
if (!Object.hasOwn(restrictions[i], 'host')
|| restrictions[i].host === null)
continue;
// If this is not the first item, then add a semi-colon separator
if (restrString.length > 0)
restrString += ';';
// Add the current host to the list
restrString += restrictions[i].host;
}
return restrString;
};
// Update the field when the model changes.
$scope.$watch('model', function modelChanged(model) {
$scope.restrictions = parseRestrictions(model);
});
// Update string value in model when web form is changed
$scope.$watch('restrictions', function restrictionsChanged(restrictions) {
$scope.model = storeRestrictions(restrictions);
}, true);
}]);

View File

@@ -0,0 +1,223 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/**
* Controller for time restriction fields, which are used to select weekday and
* time restrictions that apply to user logins and connections.
*/
angular.module('guacRestrict').controller('timeRestrictionFieldController', ['$scope', '$injector',
function timeRestrictionFieldController($scope, $injector) {
// Required types
const TimeRestrictionEntry = $injector.get('TimeRestrictionEntry');
/**
* Options which dictate the behavior of the input field model, as defined
* by https://docs.angularjs.org/api/ng/directive/ngModelOptions
*
* @type Object.<String, String>
*/
$scope.modelOptions = {
/**
* Space-delimited list of events on which the model will be updated.
*
* @type String
*/
updateOn : 'blur'
};
/**
* The restrictions, as objects, that are used by the HTML template to
* present the restrictions to the user via the web interface.
*
* @type TimeRestrictionEntry[]
*/
$scope.restrictions = [];
/**
* Map of weekday identifier to display name.
*/
$scope.weekDays = [
{ id : '1', day : 'Monday' },
{ id : '2', day : 'Tuesday' },
{ id : '3', day : 'Wednesday' },
{ id : '4', day : 'Thursday' },
{ id : '5', day : 'Friday' },
{ id : '6', day : 'Saturday' },
{ id : '7', day : 'Sunday' },
{ id : '*', day : 'All days' },
{ id : 'wd', day: 'Week days' },
{ id : 'we', day: 'Week end' }
];
/**
* Remove the current entry from the list.
*
* @param {TimeRestrictionEntry} entry
* A restriction entry.
*/
$scope.removeEntry = function removeEntry(entry) {
if (entry === null || entry.$$hashKey === '') {
return;
}
for (let i = 0; i < $scope.restrictions.length; i++) {
if ($scope.restrictions[i].$$hashKey === entry.$$hashKey) {
$scope.restrictions.splice(i,1);
return;
}
}
};
/**
* Add an empty entry to the restriction list.
*/
$scope.addEntry = function addEntry() {
$scope.restrictions.push(new TimeRestrictionEntry());
};
/**
* Parse the provided string into an array containing the objects that
* represent each of entries that can then be displayed as a more
* user-friendly field.
*
* @param {String} restrString
* The string that contains the restrictions, un-parsed and as stored
* in the underlying field.
*
* @returns {TimeRestrictionEntry[]}
* An array of objects that represents each of the entries as parsed
* out of the string field, and which can be interpreted by the
* AngularJS field for display.
*/
const parseRestrictions = function parseRestrictions(restrString) {
var restrictions = [];
// If the string is null or empty, just return an empty array
if (restrString === null || restrString === "")
return restrictions;
// Set up the RegEx and split the string using the separator.
const restrictionRegex = new RegExp('^([1-7*]|(?:[w][ed]))(?::((?:[01][0-9]|2[0-3])[0-5][0-9])\-((?:[01][0-9]|2[0-3])[0-5][0-9]))$');
var restrArray = restrString.split(";");
// Loop through split string and process each item
for (let i = 0; i < restrArray.length; i++) {
// Test if our regex matches
if (restrictionRegex.test(restrArray[i])) {
var currArray = restrArray[i].match(restrictionRegex);
var entry = new TimeRestrictionEntry();
entry.weekDay = '' + currArray[1];
entry.startTime = new Date(Date.UTC(1970, 1, 1, parseInt(currArray[2].slice(0,2)), parseInt(currArray[2].slice(2)), 0, 0));
entry.endTime = new Date(Date.UTC(1970, 1, 1, parseInt(currArray[3].slice(0,2)), parseInt(currArray[3].slice(2)), 0, 0));
restrictions.push(entry);
}
}
return restrictions;
};
/**
* Parse the restrictions in the field into a string that can be stored
* in an underlying module.
*
* @param {TimeRestrictionEntry[]} restrictions
* The array of restrictions that will be converted to a string.
*
* @returns {String}
* The string containing the restriction data that can be stored in e.g.
* a database.
*/
const storeRestrictions = function storeRestrictions(restrictions) {
// If there are no members of the array, just return an empty string.
if (restrictions === null || restrictions.length < 1)
return '';
var restrString = '';
for (let i = 0; i < restrictions.length; i++) {
// If any of the properties are not defined, skip this one.
if (!Object.hasOwn(restrictions[i], 'weekDay')
|| restrictions[i].weekDay === null
|| !Object.hasOwn(restrictions[i], 'startTime')
|| restrictions[i].startTime === null
|| !(restrictions[i].startTime instanceof Date)
|| !Object.hasOwn(restrictions[i], 'endTime')
|| restrictions[i].endTime === null
|| !(restrictions[i].endTime instanceof Date))
continue;
// If this is not the first item, then add a semi-colon separator
if (restrString.length > 0)
restrString += ';';
// Add the weekday component of the restriction, insuring it is a string.
var currString = '' + restrictions[i].weekDay;
currString += ':';
// Retrieve startTime hours component and add it, adding leading zero if required.
startHours = restrictions[i].startTime.getUTCHours();
if (startHours !== null && startHours < 10)
startHours = '0' + startHours;
currString += startHours;
// Retrieve startTime minutes component and add it, adding leading zero if required.
startMins = restrictions[i].startTime.getUTCMinutes();
if (startMins !== null && startMins < 10)
startMins = '0' + startMins;
currString += startMins;
currString += '-';
// Retrieve endTime hours component and add it, adding leading zero if required.
endHours = restrictions[i].endTime.getUTCHours();
if (endHours !== null && endHours < 10)
endHours = '0' + endHours;
currString += endHours;
// Retrieve endTime minutes component and add it, adding leading zero if required.
endMins = restrictions[i].endTime.getUTCMinutes();
if (endMins < 10)
endMins = '0' + endMins;
currString += endMins;
// Add the newly-created string to the overall restriction string.
restrString += currString;
}
return restrString;
};
// Update the field when the model changes.
$scope.$watch('model', function modelChanged(model) {
$scope.restrictions = parseRestrictions(model);
});
// Update string value in model when web form is changed
$scope.$watch('restrictions', function restrictionsChanged(restrictions) {
$scope.model = storeRestrictions(restrictions);
}, true);
}]);

View File

@@ -0,0 +1,29 @@
{
"guacamoleVersion" : "1.6.0",
"name" : "Restriction Authentication Backend",
"namespace" : "restrict",
"authProviders" : [
"org.apache.guacamole.auth.restrict.RestrictionAuthenticationProvider"
],
"translations" : [
"translations/en.json"
],
"js" : [
"restrict.min.js"
],
"css" : [
"restrict.min.css"
],
"resources" : {
"templates/hostRestrictionField.html" : "text/html",
"templates/timeRestrictionField.html" : "text/html"
}
}

View File

@@ -0,0 +1,18 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/

View File

@@ -0,0 +1,29 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/**
* Module which provides handling for additional login and connection
* restrictions.
*/
angular.module('guacRestrict', [
'form'
]);
// Ensure the guacRestrict module is loaded along with the rest of the app
angular.module('index').requires.push('guacRestrict');

View File

@@ -0,0 +1,36 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
.restrictionList {
border: 0;
}
button.restrictionListButton {
font-size: 0.75em;
}
img.restrictionListHeader {
width: 0.75em;
height: 0.75em;
}
img.restrictionListItem {
width: 1em;
height: 1em;
}

View File

@@ -0,0 +1,23 @@
<div class="hostField">
<table class="restrictionList" ng-show="restrictions !== null && restrictions.length > 0">
<tr>
<th>{{ 'RESTRICT.TABLE_HEADER_HOST' | translate }}</th>
<th>&nbsp;</th>
</tr>
<tr class="restrictionListItem" ng-repeat="entry in restrictions">
<td>
<input type="text" ng-model="entry.host" ng-model-options="modelOptions">
</td>
<td>
<img class="restrictionListItem"
src="images/x-red.svg"
alt="Remove entry"
ng-click="removeEntry(entry)">
</td>
</tr>
</table>
<button ng-click="addEntry()"
class="restrictionListButton">
{{ 'RESTRICT.ACTION_ADD_ENTRY' | translate }}
</button>
</div>

View File

@@ -0,0 +1,38 @@
<div class="timeRestrictionField">
<table class="restrictionList" ng-show="restrictions !== null && restrictions.length > 0">
<tr>
<th>{{ 'RESTRICT.TABLE_HEADER_DAY' | translate }}</th>
<th>{{ 'RESTRICT.TABLE_HEADER_START_TIME' | translate }}</th>
<th>{{ 'RESTRICT.TABLE_HEADER_END_TIME' | translate }}</th>
<th>&nbsp;</th>
</tr>
<tr class="restrictionListItem" ng-repeat="entry in restrictions">
<td>
<select ng-model="entry.weekDay"
ng-options="weekDay.id as weekDay.day for weekDay in weekDays"
ng-model-options="modelOptions">
</select>
</td>
<td>
<input type="time"
ng-model="entry.startTime"
ng-model-options="modelOptions">
</td>
<td>
<input type="time"
ng-model="entry.endTime"
ng-model-options="modelOptions">
</td>
<td>
<img class="restrictionListItem"
src="images/x-red.svg"
alt="Remove entry"
ng-click="removeEntry(entry)">
</td>
</tr>
</table>
<button ng-click="addEntry()"
class="restrictionListButton">
{{ 'RESTRICT.ACTION_ADD_ENTRY' | translate }}
</button>
</div>

View File

@@ -0,0 +1,67 @@
{
"DATA_SOURCE_LOGIN_RESTRICTIONS" : {
"NAME" : "Additional Restrictions"
},
"CONNECTION_ATTRIBUTES" : {
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_ALLOWED" : "Hosts from which connection may be accessed:",
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_DENIED" : "Hosts from which connection may not be accessed:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_ALLOWED" : "Times connection is allowed to be used:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_DENIED" : "Times connection may not be used:",
"SECTION_HEADER_RESTRICT_LOGIN_FORM" : "Additional Connection Restrictions"
},
"CONNECTION_GROUP_ATTRIBUTES" : {
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_ALLOWED" : "Hosts from which connection group may be accessed:",
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_DENIED" : "Hosts from which connection group may not be accessed:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_ALLOWED" : "Times connection group is allowed to be used:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_DENIED" : "Times connection group may not be used:",
"SECTION_HEADER_RESTRICT_LOGIN_FORM" : "Additional Connection Restrictions"
},
"RESTRICT" : {
"ACTION_ADD_ENTRY" : "Add Entry",
"ERROR_CONNECTION_NOT_ALLOWED_NOW" : "The connection is not available at this time.",
"ERROR_CONNECTION_NOT_ALLOWED_FROM_HOST" : "The connection is not allowed from this host.",
"ERROR_USER_LOGIN_NOT_ALLOWED_NOW" : "The login for this user is not allowed at this time.",
"ERROR_USER_LOGIN_NOT_ALLOWED_FROM_HOST" : "The login for this user is not allowed from this host.",
"TABLE_HEADER_DAY" : "Day",
"TABLE_HEADER_END_TIME" : "End Time",
"TABLE_HEADER_HOST" : "Host",
"TABLE_HEADER_START_TIME" : "Start Time"
},
"USER_ATTRIBUTES" : {
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_ALLOWED" : "Hosts from which user can log in:",
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_DENIED" : "Hosts from which user may not log in:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_ALLOWED" : "Times user is allowed to log in:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_DENIED" : "Times user is denied from log in:",
"SECTION_HEADER_RESTRICT_LOGIN_FORM" : "Additional Login Restrictions"
},
"USER_GROUP_ATTRIBUTES" : {
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_ALLOWED" : "Hosts from which members may log in:",
"FIELD_HEADER_GUAC_RESTRICT_HOSTS_DENIED" : "Hosts from which members may not log in:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_ALLOWED" : "Times members are allowed to log in:",
"FIELD_HEADER_GUAC_RESTRICT_TIME_DENIED" : "Times members are denied from log in:",
"SECTION_HEADER_RESTRICT_LOGIN_FORM" : "Additional Login Restrictions"
}
}

View File

@@ -0,0 +1,53 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/**
* Provides the HostRestrictionEntry class definition.
*/
angular.module('guacRestrict').factory('HostRestrictionEntry', [
function defineHostRestrictionEntry() {
/**
* Creates a new HostRestrictionEntry, initializing the properties of that
* HostRestrictionEntry with the corresponding properties of the given
* template.
*
* @constructor
* @param {HostRestrictionEntry|Object} [template={}]
* The object whose properties should be copied within the new
* HostRestrictionEntry.
*/
var HostRestrictionEntry = function HostRestrictionEntry(template) {
// Use empty object by default
template = template || {};
/**
* The IP address, CIDR notation range, or DNS hostname of the host(s)
* specified by this restriction.
*
* @type String
*/
this.host = template.host || '';
};
return HostRestrictionEntry;
}]);

View File

@@ -0,0 +1,69 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
/**
* Provides the TimeRestrictionEntry class definition.
*/
angular.module('guacRestrict').factory('TimeRestrictionEntry', [
function defineTimeRestrictionEntry() {
/**
* Creates a new TimeRestrictionEntry, initializing the properties of that
* TimeRestrictionEntry with the corresponding properties of the given
* template.
*
* @constructor
* @param {TimeRestrictionEntry|Object} [template={}]
* The object whose properties should be copied within the new
* TimeRestrictionEntry.
*/
var TimeRestrictionEntry = function TimeRestrictionEntry(template) {
// Use empty object by default
template = template || {};
/**
* The numerical representation of the day of the week this restriction
* applies to.
*
* @type Number
*/
this.weekDay = template.weekDay;
/**
* The hour and minute that this restriction starts, in 24-hour time,
* and with no separator between the hour and minute.
*
* @type Date
*/
this.startTime = template.startTime;
/**
* The hour and minute that this restriction ends, in 24-hour time, and
* with no separator between the hour and minute.
*
* @type Date
*/
this.endTime = template.endTime;
};
return TimeRestrictionEntry;
}]);