PromisePromise.<null>This function provides a simple way to verify that a user name and password match those normally used for Kerberos authentication. It does this by checking that the supplied user name and password can be @@ -141,14 +141,14 @@ has the correct realms and KDCs listed.
only be used for testing. Do not use this in any production system - your security could be compromised if you do.PromisePromiseThis function returns the service principal for the server given a service type and hostname.
Details are looked up via the /etc/keytab file.
PromisePromise.<KerberosClient>Initializes a context for client-side authentication with the given service principal.
PromisePromise.<KerberosServer>Initializes a context for server-side authentication with the given service principal.
string | A string containing the base64-encoded server data (which may be empty for the first step) |
-| [callback] | function | |
Processes a single kerberos client-side step using the supplied server challenge.
-**Returns**: Promise - returns Promise if no callback passed
-### *kerberosClient*.wrap(challenge, [options], [callback])
+### *kerberosClient*.wrap(challenge, [options])
| Param | Type | Description |
| --- | --- | --- |
| challenge | string | The response returned after calling `unwrap` |
-| [options] | object | Optional settings |
+| [options] | object | Options |
| [options.user] | string | The user to authorize |
| [options.protect] | boolean | Indicates if the wrap should request message confidentiality |
-| [callback] | function | |
Perform the client side kerberos wrap step.
-**Returns**: Promise - returns Promise if no callback passed
-### *kerberosClient*.unwrap(challenge, [callback])
+### *kerberosClient*.unwrap(challenge)
| Param | Type | Description |
| --- | --- | --- |
| challenge | string | A string containing the base64-encoded server data |
-| [callback] | function | |
Perform the client side kerberos unwrap step
-**Returns**: Promise - returns Promise if no callback passed
## KerberosServer
@@ -228,19 +222,17 @@ Perform the client side kerberos unwrap step
-### *kerberosServer*.step(challenge, [callback])
+### *kerberosServer*.step(challenge)
| Param | Type | Description |
| --- | --- | --- |
| challenge | string | A string containing the base64-encoded client data |
-| [callback] | function | |
Processes a single kerberos server-side step using the supplied client data.
-**Returns**: Promise - returns Promise if no callback passed
-## checkPassword(username, password, service, [defaultRealm], [callback])
+## checkPassword(username, password, service, [defaultRealm])
| Param | Type | Description |
| --- | --- | --- |
@@ -248,7 +240,6 @@ Processes a single kerberos server-side step using the supplied client data.
| password | string | The password for the user. |
| service | string | The Kerberos service to check access for. |
| [defaultRealm] | string | The default realm to use if one is not supplied in the user argument. |
-| [callback] | function | |
This function provides a simple way to verify that a user name and password
match those normally used for Kerberos authentication.
@@ -266,25 +257,24 @@ IMPORTANT: This method is vulnerable to KDC spoofing attacks and it should
only be used for testing. Do not use this in any production system - your
security could be compromised if you do.
-**Returns**: Promise - returns Promise if no callback passed
+**Returns**: Promise.<null> - returns Promise that rejects if the password is invalid
-## principalDetails(service, hostname, [callback])
+## principalDetails(service, hostname)
| Param | Type | Description |
| --- | --- | --- |
| service | string | The Kerberos service type for the server. |
| hostname | string | The hostname of the server. |
-| [callback] | function | |
This function returns the service principal for the server given a service type and hostname.
Details are looked up via the `/etc/keytab` file.
-**Returns**: Promise - returns Promise if no callback passed
+**Returns**: Promise - returns Promise
-## initializeClient(service, [options], [callback])
+## initializeClient(service, [options])
| Param | Type | Description |
| --- | --- | --- |
@@ -293,20 +283,18 @@ Details are looked up via the `/etc/keytab` file.
| [options.principal] | string | Optional string containing the client principal in the form 'user@realm' (e.g. 'jdoe@example.com'). |
| [options.flags] | number | Optional integer used to set GSS flags. (e.g. `GSS_C_DELEG_FLAG\|GSS_C_MUTUAL_FLAG\|GSS_C_SEQUENCE_FLAG` will allow for forwarding credentials to the remote host) |
| [options.mechOID] | number | Optional GSS mech OID. Defaults to None (GSS_C_NO_OID). Other possible values are `GSS_MECH_OID_KRB5`, `GSS_MECH_OID_SPNEGO`. |
-| [callback] | function | |
Initializes a context for client-side authentication with the given service principal.
-**Returns**: Promise - returns Promise if no callback passed
+**Returns**: [Promise.<KerberosClient>](#KerberosClient) - returns Promise
-## initializeServer(service, [callback])
+## initializeServer(service)
| Param | Type | Description |
| --- | --- | --- |
| service | string | A string containing the service principal in the form 'type@fqdn' (e.g. 'imap@mail.apple.com'). |
-| [callback] | function | |
Initializes a context for server-side authentication with the given service principal.
-**Returns**: Promise - returns Promise if no callback passed
+**Returns**: [Promise.<KerberosServer>](#KerberosServer) - returns Promise
diff --git a/lib/auth_processes/mongodb.js b/lib/auth_processes/mongodb.js
deleted file mode 100644
index 5682e11..0000000
--- a/lib/auth_processes/mongodb.js
+++ /dev/null
@@ -1,161 +0,0 @@
-'use strict';
-const dns = require('dns');
-const kerberos = require('../kerberos');
-
-/**
- * A class that was used for MongoDB kerberos authentication with legacy
- * MongoDB Node drivers (`mongodb<4.0`).
- *
- * Not intended for direct use.
- *
- * @kind class
- *
- * @deprecated This class will be removed in an upcoming major release.
- */
-class MongoAuthProcess {
- constructor(host, port, serviceName, options) {
- options = options || {};
- this.host = host;
- this.port = port;
-
- // Set up service name
- this.serviceName = serviceName || options.gssapiServiceName || 'mongodb';
-
- // Options
- this.canonicalizeHostName =
- typeof options.gssapiCanonicalizeHostName === 'boolean'
- ? options.gssapiCanonicalizeHostName
- : false;
-
- // Set up first transition
- this._transition = firstTransition(this);
-
- // Number of retries
- this.retries = 10;
- }
-
- init(username, password, callback) {
- const self = this;
- this.username = username;
- this.password = password;
-
- // Canonicialize host name if needed
- function performGssapiCanonicalizeHostName(canonicalizeHostName, host, callback) {
- if (!canonicalizeHostName) return callback();
-
- // Attempt to resolve the host name
- dns.resolveCname(host, (err, r) => {
- if (err) return callback(err);
-
- // Get the first resolve host id
- if (Array.isArray(r) && r.length > 0) {
- self.host = r[0];
- }
-
- callback();
- });
- }
-
- // Canonicialize host name if needed
- performGssapiCanonicalizeHostName(this.canonicalizeHostName, this.host, err => {
- if (err) return callback(err);
-
- const initOptions = {};
- if (password != null) {
- Object.assign(initOptions, { user: username, password });
- }
-
- const service =
- process.platform === 'win32'
- ? `${this.serviceName}/${this.host}`
- : `${this.serviceName}@${this.host}`;
-
- kerberos.initializeClient(service, initOptions, (err, client) => {
- if (err) return callback(err, null);
-
- self.client = client;
- callback(null, client);
- });
- });
- }
-
- transition(payload, callback) {
- if (this._transition == null) {
- return callback(new Error('Transition finished'));
- }
-
- this._transition(payload, callback);
- }
-}
-
-function firstTransition(auth) {
- return (payload, callback) => {
- auth.client.step('', (err, response) => {
- if (err) return callback(err);
-
- // Set up the next step
- auth._transition = secondTransition(auth);
-
- // Return the payload
- callback(null, response);
- });
- };
-}
-
-function secondTransition(auth) {
- return (payload, callback) => {
- auth.client.step(payload, (err, response) => {
- if (err && auth.retries === 0) return callback(err);
-
- // Attempt to re-establish a context
- if (err) {
- // Adjust the number of retries
- auth.retries = auth.retries - 1;
-
- // Call same step again
- return auth.transition(payload, callback);
- }
-
- // Set up the next step
- auth._transition = thirdTransition(auth);
-
- // Return the payload
- callback(null, response || '');
- });
- };
-}
-
-function thirdTransition(auth) {
- return (payload, callback) => {
- // GSS Client Unwrap
- auth.client.unwrap(payload, (err, response) => {
- if (err) return callback(err, false);
-
- // Wrap the response
- auth.client.wrap(response, { user: auth.username }, (err, wrapped) => {
- if (err) return callback(err, false);
-
- // Set up the next step
- auth._transition = fourthTransition(auth);
-
- // Return the payload
- callback(null, wrapped);
- });
- });
- };
-}
-
-function fourthTransition(auth) {
- return (payload, callback) => {
- // Set the transition to null
- auth._transition = null;
-
- // Callback with valid authentication
- callback(null, true);
- };
-}
-
-// Set the process
-module.exports = {
- MongoAuthProcess
-};
diff --git a/lib/index.js b/lib/index.js
index 2359362..d3b3fd2 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -9,8 +9,3 @@ module.exports = kerberos;
module.exports.Kerberos = kerberos;
module.exports.version = require('../package.json').version;
-
-// Set up the auth processes
-module.exports.processes = {
- MongoAuthProcess: require('./auth_processes/mongodb').MongoAuthProcess
-};
diff --git a/lib/kerberos.js b/lib/kerberos.js
index f768180..c69105a 100644
--- a/lib/kerberos.js
+++ b/lib/kerberos.js
@@ -1,6 +1,7 @@
'use strict';
-const { loadBindings, defineOperation } = require('./util');
+const { promisify } = require('util');
+const { loadBindings } = require('./util');
const kerberos = loadBindings();
const KerberosClient = kerberos.KerberosClient;
@@ -31,52 +32,59 @@ const GSS_MECH_OID_SPNEGO = 6;
* @property {boolean} contextComplete Indicates that authentication has successfully completed or not
*/
+const promisifiedStep = promisify(KerberosClient.prototype.step);
/**
* Processes a single kerberos client-side step using the supplied server challenge.
*
* @kind function
* @memberof KerberosClient
* @param {string} challenge A string containing the base64-encoded server data (which may be empty for the first step)
- * @param {function} [callback]
- * @return {Promise} returns Promise if no callback passed
+ * @return {Promise