diff --git a/AdaptixServer/core/connector/connector.go b/AdaptixServer/core/connector/connector.go index 3784c5bd..af0f3ac4 100644 --- a/AdaptixServer/core/connector/connector.go +++ b/AdaptixServer/core/connector/connector.go @@ -105,7 +105,7 @@ type Teamserver interface { type TsConnector struct { Interface string Port int - Hash string + Operators map[string]string Endpoint string Cert string Key string @@ -150,10 +150,14 @@ func NewTsConnector(ts Teamserver, tsProfile profile.TsProfile, tsResponse profi connector.Interface = tsProfile.Interface connector.Port = tsProfile.Port connector.Endpoint = tsProfile.Endpoint - connector.Hash = krypt.SHA256([]byte(tsProfile.Password)) connector.Key = tsProfile.Key connector.Cert = tsProfile.Cert + connector.Operators = make(map[string]string, len(tsProfile.Operators)) + for username, password := range tsProfile.Operators { + connector.Operators[username] = krypt.SHA256([]byte(password)) + } + connector.Engine.POST(tsProfile.Endpoint+"/login", default404Middleware(tsResponse), connector.tcLogin) connector.Engine.POST(tsProfile.Endpoint+"/refresh", default404Middleware(tsResponse), token.RefreshTokenHandler) connector.Engine.POST(tsProfile.Endpoint+"/sync", token.ValidateAccessToken(), default404Middleware(tsResponse), connector.tcSync) diff --git a/AdaptixServer/core/connector/tc_client.go b/AdaptixServer/core/connector/tc_client.go index b977d423..11e458cf 100644 --- a/AdaptixServer/core/connector/tc_client.go +++ b/AdaptixServer/core/connector/tc_client.go @@ -34,7 +34,7 @@ func (tc *TsConnector) tcLogin(ctx *gin.Context) { recvHash := krypt.SHA256([]byte(creds.Password)) - if recvHash != tc.Hash { + if recvHash != tc.Operators[creds.Username] { _ = ctx.Error(errors.New("incorrect password")) return } diff --git a/AdaptixServer/core/profile/profile.go b/AdaptixServer/core/profile/profile.go index 12f408ef..af5907d2 100644 --- a/AdaptixServer/core/profile/profile.go +++ b/AdaptixServer/core/profile/profile.go @@ -24,8 +24,8 @@ func (p *AdaptixProfile) IsValid() error { valid = false } - if p.Server.Password == "" { - logs.Error("", "'Teamserver.password' must be set") + if len(p.Server.Operators) == 0 { + logs.Error("", "'Teamserver.operators' must be set") valid = false } diff --git a/AdaptixServer/core/profile/utils.go b/AdaptixServer/core/profile/utils.go index 8f4a92ad..ac4645d1 100644 --- a/AdaptixServer/core/profile/utils.go +++ b/AdaptixServer/core/profile/utils.go @@ -7,15 +7,15 @@ type AdaptixProfile struct { } type TsProfile struct { - Interface string `json:"interface"` - Port int `json:"port"` - Endpoint string `json:"endpoint"` - Password string `json:"password"` - Cert string `json:"cert"` - Key string `json:"key"` - Extenders []string `json:"extenders"` - ATokenLive int `json:"access_token_live_hours"` - RTokenLive int `json:"refresh_token_live_hours"` + Interface string `json:"interface"` + Port int `json:"port"` + Endpoint string `json:"endpoint"` + Operators map[string]string `json:"operators"` + Cert string `json:"cert"` + Key string `json:"key"` + Extenders []string `json:"extenders"` + ATokenLive int `json:"access_token_live_hours"` + RTokenLive int `json:"refresh_token_live_hours"` } type TsResponse struct { diff --git a/AdaptixServer/core/server/server.go b/AdaptixServer/core/server/server.go index 975022a1..b95c6219 100644 --- a/AdaptixServer/core/server/server.go +++ b/AdaptixServer/core/server/server.go @@ -48,12 +48,12 @@ func NewTeamserver() *Teamserver { return ts } -func (ts *Teamserver) SetSettings(host string, port int, endpoint string, password string, cert string, key string, extenders []string) { +func (ts *Teamserver) SetSettings(host string, port int, endpoint string, username string, password string, cert string, key string, extenders []string) { ts.Profile.Server = &profile.TsProfile{ Interface: host, Port: port, Endpoint: endpoint, - Password: password, + Operators: map[string]string{username: password}, Cert: cert, Key: key, Extenders: extenders, diff --git a/AdaptixServer/main.go b/AdaptixServer/main.go index 87900d99..88a4d413 100644 --- a/AdaptixServer/main.go +++ b/AdaptixServer/main.go @@ -20,6 +20,7 @@ func main() { host = flag.String("i", "0.0.0.0", "Teamserver listen interface") port = flag.Int("p", 0, "Teamserver handler port") endpoint = flag.String("e", "", "Teamserver URI endpoint") + username = flag.String("u", "", "Teamserver username") password = flag.String("pw", "", "Teamserver password") certPath = flag.String("sc", "", "Path to the SSL certificate") keyPath = flag.String("sk", "", "Path to the SSL key") @@ -34,7 +35,7 @@ func main() { flag.PrintDefaults() fmt.Printf("\nEither provide options individually or use a JSON config file with -config flag.\n\n") fmt.Printf("Example:\n") - fmt.Printf(" AdaptixServer -i 0.0.0.0 -p port -pw password -e endpoint -sc SslCert -sk SslKey [-ex ext1,ext2,...] [-debug]\n") + fmt.Printf(" AdaptixServer -i 0.0.0.0 -p port -u username -pw password -e endpoint -sc SslCert -sk SslKey [-ex ext1,ext2,...] [-debug]\n") fmt.Printf(" AdaptixServer -profile profile.json [-debug]\n") } flag.Parse() @@ -54,9 +55,9 @@ func main() { logs.Error("", err.Error()) os.Exit(1) } - } else if *port > 1 && *port < 65535 && *endpoint != "" && *password != "" { + } else if *port > 1 && *port < 65535 && *endpoint != "" && *username != "" && *password != "" { extenders := strings.Split(*extenderPath, ",") - ts.SetSettings(*host, *port, *endpoint, *password, *certPath, *keyPath, extenders) + ts.SetSettings(*host, *port, *endpoint, *username, *password, *certPath, *keyPath, extenders) } else { flag.Usage() os.Exit(0) diff --git a/AdaptixServer/profile.json b/AdaptixServer/profile.json index c74b46f5..b9b6a8d1 100644 --- a/AdaptixServer/profile.json +++ b/AdaptixServer/profile.json @@ -3,7 +3,9 @@ "interface": "0.0.0.0", "port": 4321, "endpoint": "/endpoint", - "password": "pass", + "operators": { + "user": "password" + }, "cert": "server.rsa.crt", "key": "server.rsa.key", "extenders": [