Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .eslintrc.json
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
"es6": true
},
"parserOptions": {
"ecmaVersion": 2019
"ecmaVersion": 2023
},
"plugins": [
"prettier"
Expand Down
52 changes: 20 additions & 32 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ NOTE: The test suite requires an active kerberos deployment.
## Functions

<dl>
<dt><a href="#checkPassword">checkPassword(username, password, service, [defaultRealm], [callback])</a> ⇒ <code>Promise</code></dt>
<dt><a href="#checkPassword">checkPassword(username, password, service, [defaultRealm])</a> ⇒ <code>Promise.&lt;null&gt;</code></dt>
<dd><p>This function provides a simple way to verify that a user name and password
match those normally used for Kerberos authentication.
It does this by checking that the supplied user name and password can be
Expand All @@ -141,14 +141,14 @@ has the correct realms and KDCs listed.</p>
only be used for testing. Do not use this in any production system - your
security could be compromised if you do.</p>
</dd>
<dt><a href="#principalDetails">principalDetails(service, hostname, [callback])</a> ⇒ <code>Promise</code></dt>
<dt><a href="#principalDetails">principalDetails(service, hostname)</a> ⇒ <code>Promise</code></dt>
<dd><p>This function returns the service principal for the server given a service type and hostname.</p>
<p>Details are looked up via the <code>/etc/keytab</code> file.</p>
</dd>
<dt><a href="#initializeClient">initializeClient(service, [options], [callback])</a> ⇒ <code>Promise</code></dt>
<dt><a href="#initializeClient">initializeClient(service, [options])</a> ⇒ <code><a href="#KerberosClient">Promise.&lt;KerberosClient&gt;</a></code></dt>
<dd><p>Initializes a context for client-side authentication with the given service principal.</p>
</dd>
<dt><a href="#initializeServer">initializeServer(service, [callback])</a> ⇒ <code>Promise</code></dt>
<dt><a href="#initializeServer">initializeServer(service)</a> ⇒ <code><a href="#KerberosServer">Promise.&lt;KerberosServer&gt;</a></code></dt>
<dd><p>Initializes a context for server-side authentication with the given service principal.</p>
</dd>
</dl>
Expand All @@ -168,52 +168,46 @@ security could be compromised if you do.</p>

* [KerberosClient](#KerberosClient)

* [.step(challenge, [callback])](#KerberosClient+step)
* [.step(challenge)](#KerberosClient+step)

* [.wrap(challenge, [options], [callback])](#KerberosClient+wrap)
* [.wrap(challenge, [options])](#KerberosClient+wrap)

* [.unwrap(challenge, [callback])](#KerberosClient+unwrap)
* [.unwrap(challenge)](#KerberosClient+unwrap)


<a name="KerberosClient+step"></a>

### *kerberosClient*.step(challenge, [callback])
### *kerberosClient*.step(challenge)

| Param | Type | Description |
| --- | --- | --- |
| challenge | <code>string</code> | A string containing the base64-encoded server data (which may be empty for the first step) |
| [callback] | <code>function</code> | |

Processes a single kerberos client-side step using the supplied server challenge.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
<a name="KerberosClient+wrap"></a>

### *kerberosClient*.wrap(challenge, [options], [callback])
### *kerberosClient*.wrap(challenge, [options])

| Param | Type | Description |
| --- | --- | --- |
| challenge | <code>string</code> | The response returned after calling `unwrap` |
| [options] | <code>object</code> | Optional settings |
| [options] | <code>object</code> | Options |
| [options.user] | <code>string</code> | The user to authorize |
| [options.protect] | <code>boolean</code> | Indicates if the wrap should request message confidentiality |
| [callback] | <code>function</code> | |

Perform the client side kerberos wrap step.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
<a name="KerberosClient+unwrap"></a>

### *kerberosClient*.unwrap(challenge, [callback])
### *kerberosClient*.unwrap(challenge)

| Param | Type | Description |
| --- | --- | --- |
| challenge | <code>string</code> | A string containing the base64-encoded server data |
| [callback] | <code>function</code> | |

Perform the client side kerberos unwrap step

**Returns**: <code>Promise</code> - returns Promise if no callback passed
<a name="KerberosServer"></a>

## KerberosServer
Expand All @@ -228,27 +222,24 @@ Perform the client side kerberos unwrap step

<a name="KerberosServer+step"></a>

### *kerberosServer*.step(challenge, [callback])
### *kerberosServer*.step(challenge)

| Param | Type | Description |
| --- | --- | --- |
| challenge | <code>string</code> | A string containing the base64-encoded client data |
| [callback] | <code>function</code> | |

Processes a single kerberos server-side step using the supplied client data.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
<a name="checkPassword"></a>

## checkPassword(username, password, service, [defaultRealm], [callback])
## checkPassword(username, password, service, [defaultRealm])

| Param | Type | Description |
| --- | --- | --- |
| username | <code>string</code> | The Kerberos user name. If no realm is supplied, then the `defaultRealm` will be used. |
| password | <code>string</code> | The password for the user. |
| service | <code>string</code> | The Kerberos service to check access for. |
| [defaultRealm] | <code>string</code> | The default realm to use if one is not supplied in the user argument. |
| [callback] | <code>function</code> | |

This function provides a simple way to verify that a user name and password
match those normally used for Kerberos authentication.
Expand All @@ -266,25 +257,24 @@ IMPORTANT: This method is vulnerable to KDC spoofing attacks and it should
only be used for testing. Do not use this in any production system - your
security could be compromised if you do.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
**Returns**: <code>Promise.&lt;null&gt;</code> - returns Promise that rejects if the password is invalid
<a name="principalDetails"></a>

## principalDetails(service, hostname, [callback])
## principalDetails(service, hostname)

| Param | Type | Description |
| --- | --- | --- |
| service | <code>string</code> | The Kerberos service type for the server. |
| hostname | <code>string</code> | The hostname of the server. |
| [callback] | <code>function</code> | |

This function returns the service principal for the server given a service type and hostname.

Details are looked up via the `/etc/keytab` file.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
**Returns**: <code>Promise</code> - returns Promise
<a name="initializeClient"></a>

## initializeClient(service, [options], [callback])
## initializeClient(service, [options])

| Param | Type | Description |
| --- | --- | --- |
Expand All @@ -293,20 +283,18 @@ Details are looked up via the `/etc/keytab` file.
| [options.principal] | <code>string</code> | Optional string containing the client principal in the form 'user@realm' (e.g. '[email protected]'). |
| [options.flags] | <code>number</code> | Optional integer used to set GSS flags. (e.g. `GSS_C_DELEG_FLAG\|GSS_C_MUTUAL_FLAG\|GSS_C_SEQUENCE_FLAG` will allow for forwarding credentials to the remote host) |
| [options.mechOID] | <code>number</code> | Optional GSS mech OID. Defaults to None (GSS_C_NO_OID). Other possible values are `GSS_MECH_OID_KRB5`, `GSS_MECH_OID_SPNEGO`. |
| [callback] | <code>function</code> | |

Initializes a context for client-side authentication with the given service principal.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
**Returns**: [<code>Promise.&lt;KerberosClient&gt;</code>](#KerberosClient) - returns Promise
<a name="initializeServer"></a>

## initializeServer(service, [callback])
## initializeServer(service)

| Param | Type | Description |
| --- | --- | --- |
| service | <code>string</code> | A string containing the service principal in the form 'type@fqdn' (e.g. '[email protected]'). |
| [callback] | <code>function</code> | |

Initializes a context for server-side authentication with the given service principal.

**Returns**: <code>Promise</code> - returns Promise if no callback passed
**Returns**: [<code>Promise.&lt;KerberosServer&gt;</code>](#KerberosServer) - returns Promise
161 changes: 0 additions & 161 deletions lib/auth_processes/mongodb.js

This file was deleted.

5 changes: 0 additions & 5 deletions lib/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,3 @@ module.exports = kerberos;
module.exports.Kerberos = kerberos;

module.exports.version = require('../package.json').version;

// Set up the auth processes
module.exports.processes = {
MongoAuthProcess: require('./auth_processes/mongodb').MongoAuthProcess
};
Loading