Fixes #83. Add user block list.

mokey.toml.sample

@@ -26,7 +26,7 @@ base_url = "https://localhost"
 # keytab = "/srv/mokey/private/mokey.keytab"
 
 #------------------------------------------------------------------------------
-# User account defaults
+# User account settings
 #------------------------------------------------------------------------------
 
 # Default home directory
@@ -44,6 +44,9 @@ min_passwd_len = 8
 # password policy set in FreeIPA
 min_passwd_classes = 2
 
+# Block list of user accounts from logging in
+# block_users = ["username1", "username2", "username3"]
+
 #------------------------------------------------------------------------------
 # Email
 #------------------------------------------------------------------------------
@@ -53,7 +56,7 @@ token_max_age = 3600
 
 # Secret key for branca tokens. Must be 32 bytes. To generate run:
 #    openssl rand -hex 32 
-# token_secret = 
+# token_secret = ""
 
 # Hostname for smtp server
 smtp_host = "localhost"

server/auth.go

@@ -9,6 +9,17 @@ import (
 	"github.com/ubccr/goipa"
 )
 
+func isBlocked(username string) bool {
+	blockUsers := viper.GetStringSlice("block_users")
+	for _, u := range blockUsers {
+		if username == u {
+			return true
+		}
+	}
+
+	return false
+}
+
 func (r *Router) Login(c *fiber.Ctx) error {
 	vars := fiber.Map{}
 	return c.Render("login.html", vars)
@@ -109,6 +120,13 @@ func (r *Router) CheckUser(c *fiber.Ctx) error {
 		return c.Status(fiber.StatusBadRequest).SendString("Please provide a username")
 	}
 
+	if isBlocked(username) {
+		log.WithFields(log.Fields{
+			"username": username,
+		}).Warn("User account is blocked from logging in")
+		return c.Status(fiber.StatusUnauthorized).SendString("Invalid credentials")
+	}
+
 	userRec, err := r.adminClient.UserShow(username)
 	if err != nil {
 		if ierr, ok := err.(*ipa.IpaError); ok && ierr.Code == 4001 {
@@ -133,7 +151,6 @@ func (r *Router) CheckUser(c *fiber.Ctx) error {
 			"username": username,
 		}).Warn("User account is locked in FreeIPA")
 		return c.Status(fiber.StatusUnauthorized).SendString("Invalid credentials")
-
 	}
 
 	log.WithFields(log.Fields{
@@ -164,6 +181,13 @@ func (r *Router) Authenticate(c *fiber.Ctx) error {
 		return c.Status(fiber.StatusBadRequest).SendString("Please provide a password")
 	}
 
+	if isBlocked(username) {
+		log.WithFields(log.Fields{
+			"username": username,
+		}).Warn("User account is blocked from logging in")
+		return c.Status(fiber.StatusUnauthorized).SendString("Invalid credentials")
+	}
+
 	client := ipa.NewDefaultClient()
 	err := client.RemoteLogin(username, password+otp)
 	if err != nil {