如何驗證帳戶的密碼

Question

我在我的應用程序中詢問帳戶的密碼（在mac中登錄的密碼）。我如何驗證輸入用戶的密碼？

我想類似的東西，但它不工作：

-(BOOL)authenticatePassword:(char *)password adminName:(char *)userName 
{ 

    BOOL retValue = NO; 

    OSStatus status,status1; 
    AuthorizationFlags flag; 
    AuthorizationItem items[2]; 
    items[0].name = kAuthorizationEnvironmentPassword; 
    items[0].value = password; 
    items[0].valueLength = strlen(password); 
    items[0].flags = 0; 

    items[1].name = kAuthorizationEnvironmentUsername; 
    items[1].value = userName; 
    items[1].valueLength = strlen(userName); 
    items[1].flags = 0; 

    AuthorizationItemSet itemSet = {2,items}; 
    status = AuthorizationCreate(NULL, &itemSet, kAuthorizationFlagDefaults, &authorization_); 
    if(status == errAuthorizationSuccess) { 
     AuthorizationRights rights = {2,&items}; 
     //AuthorizationEnvironment kEnviroment = {2, items}; 
     AuthorizationFlags flag1 = kAuthorizationFlagDefaults; 
     status1 = AuthorizationCopyRights(authorization_, &rights,NULL, flag1, NULL); 

     if(status1 == errAuthorizationSuccess) { 
      retValue = YES; 
     } 
    } 

    return retValue; 

} 

Answer 1

authorization services API將覈實，如果密碼錯誤再次提示。

Answer 2

在AuthorizationCopyRights調用驗證的用戶憑據應該在環境參數（您註釋掉的行）中，並且權限參數確實應該包含您想要使用此用戶憑據獲得的權限。

權限可以包含內置權限或用戶創建的權限，使用內置權限會更簡單，因爲創建用戶定義的權限需要管理員權限。

此代碼波紋管會做的伎倆爲你，只需要調用AuthenticateForRight與用戶名/密碼的參數，它會試圖獲取這是一個建於一個在authorizationDB，需要一個有效的用戶憑據允許權。

要使用自定義使用權，你應該調用一次SetupAuthorizationForRight與在authenticationDB創建正確的管理權限，在這之後，你可以隨時通過AuthenticateForRight檢查用戶憑據作爲普通用戶只需通過rightName PARAM你也通過爲SetupAuthorizationForRight第一次。

// original code: https://developer.apple.com/library/mac/#technotes/tn2095/_index.html 
//    https://developer.apple.com/library/mac/documentation/Security/Conceptual/authorization_concepts/03authtasks/authtasks.html#//apple_ref/doc/uid/TP30000995-CH206-BCIGEHDI 


bool SetupAuthorizationForRight(const char* rightName) 
// Called as the application starts up. Creates a connection 
// to Authorization Services and then makes sure that our 
// right is defined. 
{ 
    OSStatus err; 

    // Connect to Authorization Services. 

    AuthorizationRef authorization = NULL; 
    err = AuthorizationCreate(NULL, NULL, 0, &authorization); 

    // Set up our rights. 

    if (err == noErr) { 
     // Check whether our right is already defined. 
     err = AuthorizationRightGet(rightName, NULL); 
     if (err == noErr) { 

      // A right already exists, either set up in advance by 
      // the system administrator or because this is the second 
      // time we've run. Either way, there's nothing more for 
      // us to do. 

     } else if (err == errAuthorizationDenied) { 

      // The right is not already defined. Let's create a 
      // right definition based on the custom (not canned) rule defined 
      // in the dictionary below. 
      // The system administrator can modify this right as they 
      // see fit. 
      CFStringRef keys[2] = {CFSTR("class"), CFSTR("group")}; 
      CFStringRef values[2] = {CFSTR("user"), CFSTR("everyone")}; 
      // Allow access for every user - all of local and remote users are in the 
      // 'everyone' group, so this is a safe rule 
      CFDictionaryRef aDict = CFDictionaryCreate(NULL, (const void **)keys, (const void **)values, 2, 
                 &kCFCopyStringDictionaryKeyCallBacks, 
                 &kCFTypeDictionaryValueCallBacks); 

      err = AuthorizationRightSet(
             authorization,   // authRef 
             rightName,    // rightName 
             aDict,     // rightDefinition 
             CFSTR("Authenticate to log in via YourAppName."),   // descriptionKey 
             NULL,     // bundle, NULL indicates main 
             NULL     // localeTableName, 
             ); // NULL indicates "Localizable.strings" 

      if (aDict) { 
       CFRelease(aDict); 
      } 

      if (err != noErr) { 
       NSLog(@"Cannot set up authorization entry. Error: %d", err); 
      } 
     } 
    } else { 
     NSLog(@"Cannot open authorization database. Error: %d", err); 
    } 

    return (err == noErr); 
} 

bool AuthenticateForRight(const char* username, const char* password, const char* rightName) 
{ 
    OSStatus status = noErr; 

    if (rightName) { 
     if ((status = SetupAuthorizationForRight(rightName)) != noErr) 
      return false; 
    } 
    else 
     rightName = "allow"; // Allow right rule always defined by default and only authenticated users has this right 

    AuthorizationRef authRef = 0; 

    AuthorizationItem environment[2] = {{NULL, 0, NULL, 0}, {NULL, 0, NULL, 0}}; 
    int numItems = 0; 
    if (username) { 
     AuthorizationItem item = { kAuthorizationEnvironmentUsername, strlen(username), (char*)username, 0 }; 
     environment[numItems++] = item; 
     if (password) { 
      AuthorizationItem passItem = { kAuthorizationEnvironmentPassword, strlen(password), (char*)password, 0 }; 
      environment[numItems++] = passItem; 
     } 
    } 

    AuthorizationItem right = {NULL, 0, NULL, 0}; 
    right.name = rightName; 
    right.valueLength = 0; 
    right.value = 0; 
    AuthorizationRights rightSet = { 1, &right }; 
    AuthorizationRights environmentSet = { static_cast<unsigned int>(numItems), environment }; 

    status = AuthorizationCreate(NULL, &environmentSet, kAuthorizationFlagDefaults, &authRef); 
    if (status != noErr) { 
     NSLog(@"Cannot create authorization reference. Error: %d", status); 
     return false; 
    } 

    AuthorizationFlags flags = kAuthorizationFlagExtendRights | kAuthorizationFlagPreAuthorize;  // | kAuthorizationFlagInteractionAllowed; <- Just for debugging, will display the OS auth dialog if needed!!! 
    status = AuthorizationCopyRights(authRef, &rightSet, &environmentSet, flags, NULL); 
    AuthorizationFree(authRef,kAuthorizationFlagDestroyRights); 

    return (status == noErr); 
} 

Answer 3

這是我的代碼供您參考。

char *password = "password"; 
char *userName = "account"; 

AuthorizationRef authorization = NULL; 
AuthorizationItem items[2]; 
items[0].name = kAuthorizationEnvironmentPassword; 
items[0].value = password; 
items[0].valueLength = strlen(password); 
items[0].flags = 0; 
items[1].name = kAuthorizationEnvironmentUsername; 
items[1].value = userName; 
items[1].valueLength = strlen(userName); 
items[1].flags = 0; 

AuthorizationRights rights = {2, items}; 
AuthorizationEnvironment enviroment = {2, items}; 
// Creates a new authorization reference and provides an option to authorize or preauthorize rights. 
AuthorizationCreate(NULL, &enviroment, kAuthorizationFlagDefaults, &authorization); 
AuthorizationFlags flag = kAuthorizationFlagDefaults| kAuthorizationFlagExtendRights; 

OSStatus status = AuthorizationCopyRights(authorization, &rights, &enviroment, flag, NULL); 
if(status == errAuthorizationSuccess) 
{ 
    NSLog(@"Pass"); 
} 
else 
{ 
    NSLog(@"Fail"); 
}