Virtual users in ProVide

ProVide can integrate with almost any external system for user authentication and configuration through virtual, script-based users. Instead of storing accounts in ProVide, it calls your own script or program, which can connect to just about any data source (databases, management information systems, flat files, and more) to verify and configure accounts on the fly. You set up two access points: one script that verifies whether a user is allowed access, and one that returns the user’s configuration (home directory structure, limitations, security settings, and so on).

Tip 1: To learn the format of the settings you can return for a virtual user, create a user with the settings you want through the administration interface, then open that user’s username.uac file inside the accounts folder in the ProVide installation directory with Notepad or a similar editor.

Tip 2: Use groups to define common functionality, then simply return which groups a user should inherit its configuration from.

How it works #

The verification and configuration scripts are called separately. The verification script runs when the user supplies a password to be verified. The configuration script runs when the server needs the complete account setup, so if the configuration script returns a requirement such as public key authentication, that requirement is enforced.

Basic example: two virtual accounts #

This example creates two virtual accounts with different passwords and different home directories.

Verification script in ProVide:

C:\Scripts\login.cmd "%IP%" "%USERNAME%" "%PASSWORD%"

Contents of C:\Scripts\login.cmd:

@echo off
REM Extract IP and remove quotes
set IP=%1
for /f "usebackq tokens=*" %%a in ('%IP%') do set IP=%%~a
REM Extract Username and remove quotes
set USER=%2
for /f "usebackq tokens=*" %%a in ('%USER%') do set USER=%%~a
REM Extract Password and remove quotes
set PASS=%3
for /f "usebackq tokens=*" %%a in ('%PASS%') do set PASS=%%~a
REM Check for valid logins
if /I "%USER%" == "testuser1" (
    if "%PASS%" == "pass pass" (
        exit 0
    )
)
if /I "%USER%" == "testuser2" (
    if "%PASS%" == "password" (
        if "%IP%" == "127.0.0.1" (
            exit 0
        )
    )
)
REM No valid login found - deny access
exit 1

Configuration script in ProVide:

C:\Scripts\userconfig.cmd "%USERNAME%"

Contents of C:\Scripts\userconfig.cmd:

@echo off
REM Extract username and remove quotes
set USER=%1
for /f "usebackq tokens=*" %%a in ('%USER%') do set USER=%%~a
REM Configure accounts
if /I "%USER%" == "testuser1" (
    echo !Restriction - VirtualAccount
    echo /Virtual folder for testuser1^|^|
    echo /^|C:\^|RF,LD,RR
)
if /I "%USER%" == "testuser2" (
    echo !Restriction - VirtualAccount
    echo /a virtual folder^|^|
    echo /^|C:\^|RF,LD,RR
)

Advanced example: require public/private key authentication over SFTP #

Because the configuration script defines the account’s setup, it can require public key authentication. In this example the verification script denies all password logins, and the configuration script enforces SFTP-only access with a required public key.

Note: the line containing the public key (!Security - PubKey: [...]) must be on one single long line.

Verification script in ProVide:

C:\Scripts\login.cmd "%IP%" "%USERNAME%" "%PASSWORD%"

Contents of C:\Scripts\login.cmd:

@echo off
REM Extract IP and remove quotes
set IP=%1
for /f "usebackq tokens=*" %%a in ('%IP%') do set IP=%%~a
REM Extract Username and remove quotes
set USER=%2
for /f "usebackq tokens=*" %%a in ('%USER%') do set USER=%%~a
REM Extract Password and remove quotes
set PASS=%3
for /f "usebackq tokens=*" %%a in ('%PASS%') do set PASS=%%~a
REM We do not allow any password verifications for virtual users - deny all access
exit 1

Configuration script in ProVide:

C:\Scripts\userconfig.cmd "%USERNAME%"

Contents of C:\Scripts\userconfig.cmd:

@echo off
REM Extract username and remove quotes
set USER=%1
for /f "usebackq tokens=*" %%a in ('%USER%') do set USER=%%~a
REM Configure accounts
if /I "%USER%" == "testuser1" (
    echo !Restriction - VirtualAccount
    echo /Virtual folder for testuser1^|^|
    echo /^|C:\^|RF,LD,RR
    echo !Security - AllowFTP: False
    echo !Security - AllowFTPS: False
    echo !Security - AllowSFTP: True
    echo !Security - AllowTFTP: False
    echo !Security - AllowPubKey: False
    echo !Security - RequirePasswordIfNoPubKey: False
    echo !Security - RequirePubKey: True
    echo !Security - PubKey: ---- BEGIN SSH2 PUBLIC KEY ----\nComment: "rsa-key-20120316"\nAAAAB3Nza[...]
\n---- END SSH2 PUBLIC KEY ----\n
)
if /I "%USER%" == "testuser2" (
    echo !Restriction - VirtualAccount
    echo /a virtual folder^|^|
    echo /^|C:\^|RF,LD,RR
    echo !Security - AllowFTP: False
    echo !Security - AllowFTPS: False
    echo !Security - AllowSFTP: True
    echo !Security - AllowTFTP: False
    echo !Security - AllowPubKey: False
    echo !Security - RequirePasswordIfNoPubKey: False
    echo !Security - RequirePubKey: True
    echo !Security - PubKey: ---- BEGIN SSH2 PUBLIC KEY ----\nComment: "rsa-key-20120316"\nn0N9zoHof[...]
\n---- END SSH2 PUBLIC KEY ----\n
)

Where to configure it #

Log in to the web-based admin interface with an account that has admin privileges, then click Authentication Integration in the top menu.