yamldap 0.0.8

A lightweight LDAP server that serves directory data from YAML files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

use base64::{engine::general_purpose::STANDARD as BASE64, Engine};
use sha1::Sha1;
use sha2::{Digest, Sha256};

pub fn verify_password(password: &str, stored: &str) -> crate::Result<bool> {
    // Check for password hash prefix
    if let Some(stripped) = stored.strip_prefix("{SSHA}") {
        verify_ssha(password, stripped)
    } else if let Some(stripped) = stored.strip_prefix("{SHA}") {
        verify_sha(password, stripped)
    } else if let Some(stripped) = stored.strip_prefix("{SHA256}") {
        verify_sha256(password, stripped)
    } else if stored.starts_with("{BCRYPT}") || stored.starts_with("$2") {
        verify_bcrypt(password, stored.trim_start_matches("{BCRYPT}"))
    } else {
        // Plain text comparison
        Ok(password == stored)
    }
}

fn verify_ssha(password: &str, encoded: &str) -> crate::Result<bool> {
    let decoded = BASE64
        .decode(encoded)
        .map_err(|e| crate::YamlLdapError::Auth(format!("Invalid SSHA encoding: {}", e)))?;

    if decoded.len() < 20 {
        return Err(crate::YamlLdapError::Auth(
            "Invalid SSHA hash length".to_string(),
        ));
    }

    let (hash, salt) = decoded.split_at(20);

    let mut hasher = Sha1::new();
    hasher.update(password.as_bytes());
    hasher.update(salt);
    let computed_hash = hasher.finalize();

    Ok(computed_hash.as_slice() == hash)
}

fn verify_sha(password: &str, encoded: &str) -> crate::Result<bool> {
    let decoded = BASE64
        .decode(encoded)
        .map_err(|e| crate::YamlLdapError::Auth(format!("Invalid SHA encoding: {}", e)))?;

    let mut hasher = Sha1::new();
    hasher.update(password.as_bytes());
    let computed_hash = hasher.finalize();

    Ok(computed_hash.as_slice() == decoded)
}

fn verify_sha256(password: &str, encoded: &str) -> crate::Result<bool> {
    let decoded = BASE64
        .decode(encoded)
        .map_err(|e| crate::YamlLdapError::Auth(format!("Invalid SHA256 encoding: {}", e)))?;

    let mut hasher = Sha256::new();
    hasher.update(password.as_bytes());
    let computed_hash = hasher.finalize();

    Ok(computed_hash.as_slice() == decoded)
}

fn verify_bcrypt(password: &str, hash: &str) -> crate::Result<bool> {
    bcrypt::verify(password, hash)
        .map_err(|e| crate::YamlLdapError::Auth(format!("Bcrypt verification failed: {}", e)))
}

pub fn hash_password(password: &str, method: &str) -> crate::Result<String> {
    match method {
        "plain" => Ok(password.to_string()),
        "sha" => {
            let mut hasher = Sha1::new();
            hasher.update(password.as_bytes());
            let hash = hasher.finalize();
            Ok(format!("{{SHA}}{}", BASE64.encode(hash)))
        }
        "ssha" => {
            use rand::Rng;
            let salt: [u8; 8] = rand::thread_rng().gen();

            let mut hasher = Sha1::new();
            hasher.update(password.as_bytes());
            hasher.update(salt);
            let hash = hasher.finalize();

            let mut result = hash.to_vec();
            result.extend_from_slice(&salt);

            Ok(format!("{{SSHA}}{}", BASE64.encode(result)))
        }
        "bcrypt" => {
            let hash = bcrypt::hash(password, bcrypt::DEFAULT_COST)
                .map_err(|e| crate::YamlLdapError::Auth(format!("Bcrypt hashing failed: {}", e)))?;
            Ok(format!("{{BCRYPT}}{}", hash))
        }
        _ => Err(crate::YamlLdapError::Auth(format!(
            "Unknown password hash method: {}",
            method
        ))),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_plain_password() {
        assert!(verify_password("test123", "test123").unwrap());
        assert!(!verify_password("test123", "wrong").unwrap());
    }

    #[test]
    fn test_sha_password() {
        let hashed = hash_password("test123", "sha").unwrap();
        assert!(verify_password("test123", &hashed).unwrap());
        assert!(!verify_password("wrong", &hashed).unwrap());
    }

    #[test]
    fn test_bcrypt_password() {
        let hashed = hash_password("test123", "bcrypt").unwrap();
        assert!(verify_password("test123", &hashed).unwrap());
        assert!(!verify_password("wrong", &hashed).unwrap());
    }
}