Documentation
¶
Overview ¶
Package windows signs people in with their Windows account: a local account of the machine filex runs on, or a domain account of the domain it is joined to.
The check is the operating system's own — LogonUserW, called straight from Go (no cgo, no helper program, nothing to install) with a NETWORK logon, which judges the password and takes no interactive-session rights. What comes back is the account's SID and the groups of its token; the password is used for that one call and is never kept, logged, audited or put on a command line.
On any other operating system the provider is registered (so the admin page lists it) but refuses to start, with a clear reason — it can never be "enabled" on a machine that cannot judge a Windows password.
Names ¶
`alex`, `CORP\alex`, `.\alex` and `alex@corp.example` all sign in; the filex username is the bare account name in lower case (`alex`), and the account's e-mail is derived once (identity.DeriveEmail) so every spelling finds the same account. See names.go.
The first sign-in ¶
The account exists → it signs in. Otherwise the ONE first-login rule applies (auth.ProvisionFirstLogin): auto_create — OFF by default for this provider — and allowed_groups, judged against the groups of the Windows token. System and service accounts are refused in every case (identity.CheckOSLogin, plus the Windows service identities and the built-in accounts by SID).
Not here ¶
Doing file operations AS the Windows user (impersonation) is deliberately out of scope: the person signs in as a filex account, and filex's own storage permissions decide what they can touch.
Index ¶
- Constants
- func SetLogonForTest(f func(user, domain, password string) (*Logon, error)) (restore func())
- type Driver
- func (d *Driver) Authenticate(_ *http.Request) (*model.User, error)
- func (d *Driver) Capabilities() auth.Capabilities
- func (d *Driver) Init(_ context.Context, cfg map[string]any) error
- func (d *Driver) IsSystemAccount(_ context.Context, name string) (bool, error)
- func (d *Driver) Login(ctx context.Context, identifier, password string) (*model.User, string, error)
- func (d *Driver) Logout(ctx context.Context, token string) error
- func (d *Driver) Name() string
- func (d *Driver) Probe(ctx context.Context, cfg map[string]any, _ *http.Request) []auth.ProbeCheck
- func (d *Driver) StrictProbe() bool
- func (d *Driver) VerifyPassword(ctx context.Context, identifier, password string) (*model.User, error)
- type Logon
- type LogonError
Constants ¶
const DriverName = "windows"
DriverName is the name the provider is known by (registry, page, settings).
Variables ¶
This section is empty.
Functions ¶
func SetLogonForTest ¶
SetLogonForTest replaces the operating-system sign-in call — for tests of this and other packages that need a Windows provider to run on any machine (the handlers' HTTP tests, the live-set tests). It returns the function that puts the previous one back; a test defers it. Passing nil makes the provider behave as it does off Windows.
⚠ It swaps a package variable: tests that use it must not run in parallel.
Types ¶
type Driver ¶
type Driver struct {
// contains filtered or unexported fields
}
Driver is the Windows sign-in provider.
func (*Driver) Authenticate ¶
Authenticate is a no-op: a Windows account's requests carry the ordinary session cookie, which the local driver resolves (see the LDAP driver for why being "enabled" is not enough to be reachable — Login is reached through the login chain).
func (*Driver) Capabilities ¶
func (d *Driver) Capabilities() auth.Capabilities
Capabilities implements auth.Driver.
func (*Driver) Init ¶
Init configures the driver and checks that this machine can run it.
⚠ It is also the "is it still all right" check the admin page's providers get every time they are (re)loaded: a provider that cannot start is left out of the running set with its reason, and the operator is told.
func (*Driver) IsSystemAccount ¶
IsSystemAccount implements identity.SystemAccountChecker for the Windows service identities (machine accounts).
func (*Driver) Login ¶
func (d *Driver) Login(ctx context.Context, identifier, password string) (*model.User, string, error)
Login verifies the credentials with Windows and mints a browser session for the resulting account.
func (*Driver) Logout ¶
Logout revokes a session minted by Login (and makes *Driver an auth.LoginDriver, so it can be placed in the login chain at all).
func (*Driver) Probe ¶
Probe tests the provider the only way that proves anything: by signing a real account in with the operating system, exactly as a login would.
config the configuration reads (a valid default domain)
platform this machine can ask Windows — on any other OS the test stops
here with unsupported_os
test_account an account was given on the test request
logon that account signed in (the reason is named when it did not)
account the account is one filex would accept: not a system, service or
built-in account
The account and its password come from the request that asked for the test (auth.TestAccountFrom): used for this one call, never stored, never logged, audited or returned. On success the prober records the account's filex address on it (TestAccount.Email) — the handler makes that account the instance's super administrator, so whoever sets this provider up cannot lock themselves out (auth.GrantSuperAdmin).
⚠ Nothing is written and no session is created.
func (*Driver) StrictProbe ¶
StrictProbe implements auth.StrictProber: an operating-system provider is never switched on over a failing test (the panel's "switch on anyway" does not exist for it), because the only proof it works is a real sign-in.
func (*Driver) VerifyPassword ¶
func (d *Driver) VerifyPassword(ctx context.Context, identifier, password string) (*model.User, error)
VerifyPassword checks a password with Windows and returns the local account, WITHOUT minting a session — the file protocols (WebDAV, SFTP, FTPS, S3, NFS) present the password on every request. See internal/protocolauth.
type Logon ¶
type Logon struct {
// SID is the account's security identifier, `S-1-5-21-…-1001`.
SID string
// Groups are the names of the groups in the account's token, in both forms:
// `CORP\Editors` and `Editors`, so an operator can write either.
Groups []string
}
Logon is what a successful Windows sign-in tells filex: who the account is (its SID) and which groups its token carries. Nothing else leaves the OS call — in particular not the password, and not the token handle.
type LogonError ¶
type LogonError struct {
// Code is the Win32 error (GetLastError).
Code uint32
}
LogonError is a Win32 failure of the sign-in call.
func (*LogonError) Error ¶
func (e *LogonError) Error() string
Source Files