Simplify backend api and use secure comparison

Author: divoxx

assertion_jwt_grant_type.go

@@ -68,7 +68,7 @@ func (gt AssertionJWTGrantType) TokenHandler(c *Client, ew *EncoderResponseWrite
 		return
 	}
 
-	u, err := gt.persistence.GetUserByLogin(jwtTk.Subject)
+	u, err := gt.persistence.GetUserByUsername(jwtTk.Subject)
 	if err != nil {
 		log.Println("JWT subject is not a valid user")
 		ew.Encode(ErrInvalidGrant)

backend.go

@@ -52,8 +52,7 @@ type PersistenceBackend interface {
 	//*
 	// User persistence
 	//*
-	GetUserByLogin(login string) (*User, error)
-	GetUserByCredentials(username, password string) (*User, error)
+	GetUserByUsername(username string) (*User, error)
 }
 
 type AuthorizationPageData struct {

common.go

@@ -26,7 +26,7 @@ import (
 )
 
 type User struct {
-	Login    string
+	Username string
 	Password string
 }
 
@@ -155,3 +155,18 @@ func secureRandomBytes(bytes uint) ([]byte, error) {
 	_, err := rand.Read(r)
 	return r, err
 }
+
+// secureCompare will compare two slice of bytes in constant time, ensuring no timing information
+// is leaked in order to prevent timing attacks.
+func secureCompare(a, b []byte) bool {
+	if len(a) != len(b) {
+		return false
+	}
+
+	var result byte
+	for i := 0; i < len(a); i++ {
+		result |= a[i] ^ b[i]
+	}
+
+	return result == 0
+}

in_memory_persistence.go

@@ -133,9 +133,9 @@ func (b *InMemoryPersistence) SaveScope(s *Scope) error {
 	return nil
 }
 
-// GetUserByLogin lookup the user that matches the login
-func (b *InMemoryPersistence) GetUserByLogin(login string) (*User, error) {
-	u, exst := b.users[login]
+// GetUserByUsername lookup the user that matches the login
+func (b *InMemoryPersistence) GetUserByUsername(username string) (*User, error) {
+	u, exst := b.users[username]
 	if !exst {
 		return nil, ErrNotFound
 	}
@@ -155,6 +155,6 @@ func (b *InMemoryPersistence) GetUserByCredentials(username, password string) (*
 // SaveUser persists the user in the backend, it's not part of the Backend interface
 // but we need a way to add users to the Backend.
 func (b *InMemoryPersistence) SaveUser(u *User) error {
-	b.users[u.Login] = u
+	b.users[u.Username] = u
 	return nil
 }

integration_test.go

@@ -95,7 +95,7 @@ func setupProvider() (oauth2.PersistenceBackend, *oauth2.ClientAgent, *httptest.
 		panic(err)
 	}
 
-	user := oauth2.User{Login: "username"}
+	user := oauth2.User{Username: "username"}
 	if err := inMemory.SaveUser(&user); err != nil {
 		panic(err)
 	}
@@ -168,7 +168,7 @@ func TestAuthorizationCodeGrantType(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if persistedAuth.Client.ID != clt.ID || persistedAuth.User.Login != "username" {
+	if persistedAuth.Client.ID != clt.ID || persistedAuth.User.Username != "username" {
 		t.Errorf("Authorization does not match client or user")
 	}
 
@@ -192,7 +192,7 @@ func TestAuthorizationCodeGrantType(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if refreshedPersistedAuth.Client.ID != clt.ID || refreshedPersistedAuth.User.Login != "username" {
+	if refreshedPersistedAuth.Client.ID != clt.ID || refreshedPersistedAuth.User.Username != "username" {
 		t.Errorf("Authorization does not match client or user")
 	}
 
@@ -247,7 +247,7 @@ func TestPasswordGrantType(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if a2.Client.ID != clt.ID || a2.User.Login != "username" {
+	if a2.Client.ID != clt.ID || a2.User.Username != "username" {
 		t.Errorf("Authorization does not match client or user")
 	}
 
@@ -282,7 +282,7 @@ func TestAssertionGrantType(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	if a2.Client.ID != clt.ID || a2.User.Login != "username" {
+	if a2.Client.ID != clt.ID || a2.User.Username != "username" {
 		t.Errorf("Authorization does not match client or user")
 	}
 

resource_owner_credentials_grant_type.go

@@ -57,12 +57,17 @@ func (gt ResourceOwnerCredentialsGrantType) TokenHandler(c *Client, ew *EncoderR
 		return
 	}
 
-	u, err := gt.persistence.GetUserByCredentials(username, password)
+	u, err := gt.persistence.GetUserByUsername(username)
 	if err != nil {
 		log.Println("invalid credentials")
 		ew.Encode(ErrAccessDenied)
 		return
 	}
+	if !secureCompare([]byte(username), []byte(u.Username)) {
+		log.Println("invalid password")
+		ew.Encode(ErrAccessDenied)
+		return
+	}
 
 	auth, err := NewAuthorization(c, u, scope, true, false)
 	if err != nil {