 vulncheck
|
25c8ef0866
|
feat(auth): multi-provider auth foundation (Strategy pattern + TOTP)
Phase 1 of the LDAPS / SAML 2.0 / OIDC integration. Lays the abstraction
so subsequent provider strategies (LDAP, OIDC, SAML) plug in without
re-wiring the login endpoint.
Backend changes:
- Alembic migration 008 adds users.auth_provider (enum: local/ldap/saml/oidc),
external_id (indexed), external_groups (JSON), totp_secret, totp_enabled,
last_provider_sync. password_hash becomes nullable for external users.
Audit event enum extended with LOGIN_LDAP_SUCCESS, LOGIN_SSO_SUCCESS,
AUTH_PROVIDER_FAILED, JIT_USER_CREATED, EXTERNAL_ROLE_MAPPED,
USER_AUTO_LINKED, MFA_ENABLED/DISABLED/VERIFIED/FAILED.
- app/auth/strategies/ — Strategy Pattern: AuthStrategy ABC + ExternalIdentity
portable identity + AuthResult. LocalAuthStrategy refactors existing
bcrypt login. Constant-time dummy verify on user-not-found to defeat
enumeration.
- app/auth/totp.py — RFC 6238 helpers (pyotp). Secret encrypted at rest
with Fernet (key from AUTH_PROVIDER_CRYPTO_KEY env var). Never logged.
- app/auth/role_mapper.py — fnmatch-based external-groups -> UserRole
mapping; rules in settings.auth_role_mappings JSON, admin-editable
(Phase 5 UI to follow).
- app/auth/jit_provisioner.py — JIT user creation with auto-link by email
on first SSO login (per requirements). Re-evaluates role on every login.
- app/auth/orchestrator.py — chains credential strategies in configurable
AUTH_LOOKUP_ORDER. Generic safe message for every failure (audit logs
the real reason).
- /auth/login refactored to use orchestrator. MFA gate: returns
mfa_required=true + short-lived mfa_token if user has TOTP enabled;
client POSTs /auth/mfa/verify with code to complete login.
- New endpoints: /auth/mfa/setup, /auth/mfa/activate, /auth/mfa/disable,
/auth/providers (public — frontend uses to render correct buttons).
- requirements.txt: pyotp, cryptography, ldap3, authlib, itsdangerous,
python3-saml, lxml.
- Dockerfile: libxml2-dev, libxmlsec1-dev, libxmlsec1-openssl, pkg-config
for python3-saml; libsasl2/libldap/libssl-dev for future python-ldap.
Phase 2 (LDAPS), Phase 3 (OIDC), Phase 4 (SAML), Phase 5 (Admin UI for
provider config + role-mapping) will follow as separate commits.
|
2026-05-12 19:02:47 +02:00 |
|
|
vulncheck
|
6969d0c62e
|
Initial release v1.0.0
VulnCheck - Open Source Vulnerability Management for Wazuh
Features:
- Vulnerability management with Wazuh integration
- AI-powered CVE analysis (OpenAI, Anthropic, Google, DeepSeek, Ollama, Infomaniak)
- SLA policy enforcement with automated email alerts
- Automated patch verification via Wazuh Syscollector
- Role-based access control (Admin, Editor, Readonly)
- PDF/CSV reporting for compliance workflows
- Full audit trail
https://gitea.isuit.ch/vulncheck/vulncheck
|
2026-02-08 10:15:20 +01:00 |
|