| blob | 1cb7f5d57ef9592878b782b58d8450e6569bc27a |
1 ;;; auth-source.el --- authentication sources for Gnus and Emacs -*- lexical-binding: t -*-
3 ;; Copyright (C) 2008-2017 Free Software Foundation, Inc.
5 ;; Author: Ted Zlatanov <tzz@lifelogs.com>
6 ;; Keywords: news
8 ;; This file is part of GNU Emacs.
10 ;; GNU Emacs is free software: you can redistribute it and/or modify
11 ;; it under the terms of the GNU General Public License as published by
12 ;; the Free Software Foundation, either version 3 of the License, or
13 ;; (at your option) any later version.
15 ;; GNU Emacs is distributed in the hope that it will be useful,
16 ;; but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ;; GNU General Public License for more details.
20 ;; You should have received a copy of the GNU General Public License
21 ;; along with GNU Emacs. If not, see <https://www.gnu.org/licenses/>.
23 ;;; Commentary:
25 ;; This is the auth-source.el package. It lets users tell Gnus how to
26 ;; authenticate in a single place. Simplicity is the goal. Instead
27 ;; of providing 5000 options, we'll stick to simple, easy to
28 ;; understand options.
30 ;; See the auth.info Info documentation for details.
32 ;; TODO:
34 ;; - never decode the backend file unless it's necessary
35 ;; - a more generic way to match backends and search backend contents
36 ;; - absorb netrc.el and simplify it
37 ;; - protect passwords better
38 ;; - allow creating and changing netrc lines (not files) e.g. change a password
40 ;;; Code:
75 "Authentication sources."
79 ;;;###autoload
81 "How many seconds passwords are cached, or nil to disable
82 expiring. Overrides `password-cache-expiry' through a
83 let-binding."
92 ;; The slots below correspond with the `auth-source-search' spec,
93 ;; so a backend with :host set, for instance, would match only
94 ;; searches for that host. Normally they are nil.
98 :type symbol
99 :custom symbol
102 :type string
103 :custom string
106 :initform t
107 :type t
108 :custom string
111 :initform t
112 :type t
113 :custom string
116 :initform t
117 :type t
118 :custom string
121 :initform nil
124 :initform ignore
125 :type function
126 :custom function
129 :initform ignore
130 :type function
131 :custom function
139 "List of authentication protocols and their names"
149 ;; Generate all the protocols in a format Customize can use.
150 ;; TODO: generate on the fly from auth-source-protocols
156 p)))
157 auth-source-protocols))
160 ;; FIXME: AFAICT this is not set (or let-bound) anywhere!
169 "If set, auth-source will respect it for save behavior."
178 ;; TODO: make the default (setq auth-source-netrc-use-gpg-tokens `((,(if (boundp 'epa-file-auto-mode-alist-entry) (car epa-file-auto-mode-alist-entry) "\\.gpg\\'") never) (t gpg)))
179 ;; TODO: or maybe leave as (setq auth-source-netrc-use-gpg-tokens 'never)
182 "Set this to tell auth-source when to create GPG password
183 tokens in netrc files. It's either an alist or `never'.
184 Note that if EPA/EPG is not available, this should NOT be used."
204 "Whether auth-source should cache information with `password-cache'."
210 "Whether auth-source should log debug messages.
212 If the value is nil, debug messages are not logged.
214 If the value is t, debug messages are logged with `message'. In
215 that case, your authentication data will be in the clear (except
216 for passwords).
218 If the value is a function, debug messages are logged by calling
219 that function using the same arguments as `message'."
226 trivia)
231 "List of authentication sources.
232 Each entry is the authentication type with optional properties.
233 Entries are tried in the order in which they appear.
234 See Info node `(auth)Help for users' for details.
237 EPA/EPG set up, the file will be encrypted and decrypted
238 automatically. See Info node `(epa)Encrypting/decrypting gpg files'
239 for details.
242 can get pretty complex."
253 macos-keychain-internet)
256 macos-keychain-generic)
310 "List of recipient keys that `authinfo.gpg' encrypted to.
311 If the value is not a list, symmetric encryption will be used."
329 ;; set logger to either the function in auth-source-debug or 'message
330 ;; note that it will be 'message if auth-source-debug is nil
332 auth-source-debug
334 msg))
337 "Read one of CHOICES by `read-char-choice', or `read-char'.
338 `dropdown-list' support is disabled because it doesn't work reliably.
339 Only one of CHOICES will be returned. The PROMPT is augmented
347 k)
351 k)))
354 "List of auth-source parser functions.
355 Each function takes an entry from `auth-sources' as parameter and
356 returns a backend or nil if the entry is not supported. Add a
357 parser function to this list with `add-hook'. Searching for a
358 backend starts with the first element on the list and stops as
362 "Create an auth-source-backend from an ENTRY in `auth-sources'."
370 ;; none of the parsers worked
379 ;; take just a file name use it as a netrc/plist file
380 ;; matching any user, host, and protocol
384 ;; a file name with parameters
401 ;; Note this function should be last in the parser functions, so we add it first
405 ;; take macos-keychain-{internet,generic}:XYZ and use it as macOS
406 ;; Keychain "XYZ" matching any user, host, and protocol
408 entry))
412 entry))
415 ;; take 'macos-keychain-internet or generic and use it as a Mac OS
416 ;; Keychain collection matching any user, host, and protocol
422 ;; the macOS Keychain
433 'macos-keychain-generic
436 :macos-keychain-generic
444 :source source
445 :type keychain-type
452 ;; take secrets:XYZ and use it as Secrets API collection "XYZ"
453 ;; matching any user, host, and protocol
456 ;; take 'default and use it as a Secrets API default collection
457 ;; matching any user, host, and protocol
461 ;; the Secrets API. We require the package, in order to have a
462 ;; defined value for `secrets-enabled'.
472 ;; the source is either the :secrets key in ENTRY or
473 ;; if that's missing or nil, it's "session"
476 ;; if the source is a symbol, we look for the alias named so,
477 ;; and if that alias is missing, we use "Login"
485 :source source
499 "Fills in the extra auth-source-backend parameters of ENTRY.
500 Using the plist ENTRY, get the :host, :port, and :user search
501 parameters."
503 nil
504 entry))
505 val)
512 backend)
514 ;; (mapcar 'auth-source-backend-parse auth-sources)
517 &key max require create delete
519 "Search or modify authentication backends according to SPEC.
521 This function parses `auth-sources' for matches of the SPEC
522 plist. It can optionally create or update an authentication
523 token if requested. A token is just a standard Emacs property
524 list with a :secret property that can be a function; all the
525 other properties will always hold scalar values.
527 Typically the :secret property, if present, contains a password.
529 Common search keys are :max, :host, :port, and :user. In
530 addition, :create specifies if and how tokens will be created.
531 Finally, :type can specify which backend types you want to check.
533 A string value is always matched literally. A symbol is matched
534 as its string value, literally. All the SPEC values can be
535 single values (symbol or string) or lists thereof (in which case
536 any of the search terms matches).
538 :create t means to create a token if possible.
540 A new token will be created if no matching tokens were found.
541 The new token will have only the keys the backend requires. For
542 the netrc backend, for instance, that's the user, host, and
543 port keys.
545 Here's an example:
551 :create t))
553 which says:
556 `netrc', maximum one result.
558 Create a new entry if you found none. The netrc backend will
559 automatically require host, user, and port. The host will be
560 `mine'. We prompt for the user with default `defaultUser' and
561 for the port without a default. We will not prompt for A, Q,
562 or P. The resulting token will only have keys user, host, and
567 The behavior is like :create t but if the list contains any
568 parameter, that parameter will be required in the resulting
569 token. The value for that parameter will be obtained from the
570 search parameters or from user input. If any queries are needed,
571 the alist `auth-source-creation-defaults' will be checked for the
572 default value. If the user, host, or port are missing, the alist
573 `auth-source-creation-prompts' will be used to look up the
574 prompts IN THAT ORDER (so the `user' prompt will be queried first,
575 then `host', then `port', and finally `secret'). Each prompt string
576 can use %u, %h, and %p to show the user, host, and port.
578 Here's an example:
582 (auth-source-creation-prompts
588 which says:
591 or `twosuch' in backends of type `netrc', maximum one result.
593 Create a new entry if you found none. The netrc backend will
594 automatically require host, user, and port. The host will be
595 `nonesuch' and Q will be `qqqq'. We prompt for the password
596 with the shown prompt. We will not prompt for Q. The resulting
597 token will have keys user, host, port, A, B, and Q. It will not
598 have P with any value, even though P is used in the search to
601 When multiple values are specified in the search parameter, the
602 user is prompted for which one. So :host (X Y Z) would ask the
603 user to choose between X, Y, and Z.
605 This creation can fail if the search was not specific enough to
606 create a new token (it's up to the backend to decide that). You
607 should `catch' the backend-specific error as usual. Some
608 backends (netrc, at least) will prompt the user rather than throw
609 an error.
611 :require (A B C) means that only results that contain those
612 tokens will be returned. Thus for instance requiring :secret
613 will ensure that any results will actually have a :secret
614 property.
616 :delete t means to delete any found entries. nil by default.
617 Use `auth-source-delete' in ELisp code instead of calling
618 `auth-source-search' directly with this parameter.
620 :type (X Y Z) will check only those backend types. `netrc' and
621 `secrets' are the only ones supported right now.
623 :max N means to try to return at most N items (defaults to 1).
624 More than N items may be returned, depending on the search and
625 the backend.
627 When :max is 0 the function will return just t or nil to indicate
628 if any matches were found.
630 :host (X Y Z) means to match only hosts X, Y, or Z according to
631 the match rules above. Defaults to t.
633 :user (X Y Z) means to match only users X, Y, or Z according to
634 the match rules above. Defaults to t.
636 :port (P Q R) means to match only protocols P, Q, or R.
637 Defaults to t.
639 :K (V1 V2 V3) for any other key K will match values V1, V2, or
640 V3 (note the match rules above).
642 The return value is a list with at most :max tokens. Each token
643 is a plist with keys :backend :host :port :user, plus any other
644 keys provided by the backend (notably :secret). But note the
645 exception for :max 0, which see above.
647 The token can hold a :save-function key. If you call that, the
648 user will be prompted to save the data to the backend. You can't
649 request that this should happen right after creation, because
650 `auth-source-search' has no way of knowing if the token is
651 actually useful. So the caller must arrange to call this function.
653 The token's :secret key can hold a function. In that case you
654 must call it to obtain the actual value."
662 ;; note that we may have cached results but found is still nil
663 ;; (there were no results from the search)
665 filtered-backends)
669 "auth-source-search: found %d CACHED results matching %S"
683 ;; ignore invalid slots
693 "auth-source-search: found %d backends matching %S"
696 ;; (debug spec "filtered" filtered-backends)
697 ;; First go through all the backends without :create, so we can
698 ;; query them all.
700 spec
701 ;; to exit early
702 max
703 ;; create is always nil here
704 nil delete
705 require))
708 "auth-source-search: found %d results (max %d) matching %S"
711 ;; If we didn't find anything, then we allow the backend(s) to
712 ;; create the entries.
716 spec
717 ;; to exit early
718 max
719 create delete
720 require))
722 "auth-source-search: CREATED %d results (max %d) matching %S"
725 ;; note we remember the lack of result too, if it's applicable
731 found)))
735 matches)
740 :backend backend
742 ;; note we're overriding whatever the spec
743 ;; has for :max, :require, :create, and :delete
744 :max max
745 :require require
746 :create create
747 :delete delete
748 spec)))
751 "auth-source-search-backend: got %d (max %d) in %s:%s matching %S"
755 spec)
757 matches))
760 "Delete entries from the authentication backends according to SPEC.
761 Calls `auth-source-search' with the :delete property in SPEC set to t.
762 The backend may not actually delete the entries.
764 Returns the deleted entries."
768 "Returns t is VALUE is t or COLLECTION is t or COLLECTION contains VALUE."
772 ;; (debug :collection collection :value value)
781 "Forget all cached auth-source data."
785 ;; remove that key
787 password-data)
791 "Format SPEC entry to put it in the password cache."
795 "Remember FOUND search results for SPEC."
801 "Recall FOUND search results for SPEC."
805 "Check if SPEC is remembered."
810 "Forget any cached data matching SPEC exactly.
812 This is the same SPEC you passed to `auth-source-search'.
813 Returns t or nil for forgotten or not found."
817 "Forget any cached data matching SPEC. Returns forgotten count.
819 This is not a full `auth-source-search' spec but works similarly.
821 cached data that was found with a search for those two hosts,
822 while \(:host t) would find all host entries."
827 ;; and the spec matches what was stored in the cache
829 ;; remove that key
832 password-data)
833 count))
846 "Pick the first secret found from applying SPEC to `auth-source-search'."
852 secret)))
855 "Format PROMPT using %x (for any character x) specifiers in ALIST."
862 prompt nil t)))))
863 prompt)
867 values
873 value))
874 values)))
876 ;;; Backend specific parsing: netrc/authinfo backend
893 ;; (auth-source-netrc-parse :file "~/.authinfo.gpg")
896 "Parse FILE and return a list of all entries in the file.
897 Note that the MAX parameter is used so we can exit the parse early."
899 ;; We got already parsed contents; just return it.
900 file
912 host
916 t))
918 user
923 t))
925 port
929 t))
931 ;; the required list of keys is nil, or
933 ;; every element of require is in n (normalized)
938 result)
945 "auth-source-netrc-parse: using CACHED file data for %s"
946 file)
949 ;; cache all netrc files (used to be just .gpg files)
950 ;; Store the contents of the file heavily encrypted in memory.
951 ;; (note for the irony-impaired: they are just obfuscated)
953 auth-source-netrc-cache file
959 alist)
965 ;; (see bug#7487) making `epa-file-encrypt-to' local to
966 ;; this buffer lets epa-file skip the key selection query
967 ;; (see the `local-variable-p' check in
968 ;; `epa-file-write-region').
974 ;; ask AFTER we've successfully opened the file
976 file modified))
979 "auth-source-netrc-parse: modified %d lines in %s"
980 modified file)))
985 "Advance to the next interesting position in the current buffer."
986 ;; If we're looking at a comment or are at the end of the line, move forward
994 "Read one thing from the current buffer."
1004 ;; with thanks to org-mode
1008 ;; works also in narrowed buffer, because we start at 1, not point-min
1012 "Parse up to MAX netrc entries, passed by CHECK, from the current buffer."
1015 alist
1019 all))
1020 item item2 all alist default)
1023 ;; We're starting a new machine. Save the old one.
1027 ;; (auth-source-do-trivia
1028 ;; "auth-source-netrc-parse-entries: got entry %S" alist)
1030 alist nil))
1031 ;; In default entries, we don't have a next token.
1032 ;; We store them as ("machine" . t)
1035 ;; Not a default entry. Grab the next item.
1037 ;; Did we get a "machine" value?
1040 "%s: Unexpected `machine' token at line %d"
1041 "auth-source-netrc-parse-entries"
1045 ;; Clean up: if there's an entry left over, use it.
1048 ;; (auth-source-do-trivia
1049 ;; "auth-source-netrc-parse-entries: got2 entry %S" alist)
1050 )
1058 passphrase)
1059 ;; return the saved passphrase, calling a function if needed
1070 t))
1073 passphrase))))
1076 "Pass either the decoded SECRET or the gpg:BASE64DATA version.
1077 FILE is the file from which we obtained this token."
1082 context
1084 file))
1092 cipher)
1095 context
1097 file))
1116 ;; apply key aliases
1123 ;; send back the secret in a function (lexical binding)
1128 ;; it's a GPG token: create a token decoder
1129 ;; which unsets itself once
1134 val
1135 filename)
1140 lexv))))
1143 v))))
1144 ret))
1145 alist))
1148 &key backend require create
1149 type max host user port
1151 "Given a property list SPEC, return search matches from the :backend.
1152 See `auth-source-search' for details on SPEC."
1153 ;; just in case, check that the type is correct (null or same as the backend)
1159 :max max
1160 :require require
1167 ;; if we need to create an entry AND none were found to match
1171 ;; create based on the spec and record the value
1173 ;; if the user did not want to create the entry
1174 ;; in the file, it will be returned
1176 ;; if not, we do the search again without :create
1177 ;; to get the updated data.
1179 ;; the result will be returned, even if the search fails
1182 results))
1187 v))
1189 ;; (auth-source-search :host "nonesuch" :type 'netrc :max 1 :create t)
1190 ;; (auth-source-search :host "nonesuch" :type 'netrc :max 1 :create t :create-extra-keys '((A "default A") (B)))
1193 &key backend host port create
1196 ;; we know (because of an assertion in auth-source-search) that the
1197 ;; :create parameter is either t or a list (which includes nil)
1200 :host host
1205 ;; `valist' is an alist
1206 valist
1207 ;; `artificial' will be returned if no creation is needed
1208 artificial)
1210 ;; only for base required elements (defined as function parameters):
1211 ;; fill in the valist with whatever data we may have from the search
1212 ;; we complete the first value if it's a list and use the value otherwise
1217 ;; all-accepting choice (predicate is t)
1219 ;; just the value otherwise
1224 ;; for extra required elements, see if the spec includes a value for them
1232 ;; for each required element
1235 ;; take the first element if the data is a list
1239 ;; this is the default to be offered
1241 auth-source-creation-defaults r))
1242 ;; the default supplementals are simple:
1243 ;; for the user, try `given-default' and then (user-login-name);
1244 ;; otherwise take `given-default'
1276 prompt
1281 ;; Store the data, prompting for the password if needed.
1284 ;; Special case prompt for passwords.
1285 ;; TODO: make the default (setq auth-source-netrc-use-gpg-tokens `((,(if (boundp 'epa-file-auto-mode-alist-entry) (car epa-file-auto-mode-alist-entry) "\\.gpg\\'") nil) (t gpg)))
1286 ;; TODO: or maybe leave as (setq auth-source-netrc-use-gpg-tokens 'never)
1294 auth-source-netrc-use-gpg-tokens))
1295 item ret)
1302 ;; FIXME: `ret' unused.
1303 ;; Should we return it here?
1304 ))
1307 ;; ask if we don't know what to do (in which case
1308 ;; auth-source-netrc-use-gpg-tokens must be a list)
1311 ;; TODO: save the defcustom now? or ask?
1314 auth-source-netrc-use-gpg-tokens)))
1317 plain))
1323 nil nil default)
1332 data))))
1334 ;; When r is not an empty string...
1337 ;; this function is not strictly necessary but I think it
1338 ;; makes the code clearer -tzz
1340 ;; append the key (the symbol name of r)
1341 ;; and the value in r
1343 ;; prepend a space
1345 ;; remap auth-source tokens to netrc
1354 data)))))
1358 artificial
1359 :save-function
1367 "Save a line ADD in FILE, prompting along the way.
1368 Respects `auth-source-save-behavior'. Uses
1369 `auth-source-netrc-cache' to avoid prompting more than once."
1375 "auth-source-netrc-saver: found previous run for key %s, returning"
1376 key)
1381 ;; (see bug#7487) making `epa-file-encrypt-to' local to
1382 ;; this buffer lets epa-file skip the key selection query
1383 ;; (see the `local-variable-p' check in
1384 ;; `epa-file-write-region').
1389 ;; we want the new data to be found first, so insert at beginning
1392 ;; Ask AFTER we've successfully opened the file.
1396 k)
1409 ;; Why? Doesn't with-output-to-temp-buffer already do
1410 ;; the exact same thing anyway? --Stef
1414 done t))
1415 (?N
1417 done t)
1425 ;; Make sure the info is not saved.
1435 ;; Make the .authinfo file non-world-readable.
1438 "auth-source-netrc-create: wrote 1 new line to %s"
1439 file)
1441 nil))))
1444 ;;; Backend specific parsing: Secrets API backend
1447 "Convert a pattern with lists to a list of string patterns.
1452 only string values for patterns, so this routine returns a list
1453 of patterns that is equivalent to the single original pattern
1454 when interpreted such that if a secret matches any pattern in the
1455 list, it matches the original pattern."
1468 &key backend create delete label max
1470 "Search the Secrets API; spec is like `auth-source'.
1472 The :label key specifies the item's label. It is the only key
1473 that can specify a substring. Any :label value besides a string
1474 will allow any label.
1476 All other search keys must match exactly. If you need substring
1477 matching, do a wider search and narrow it down yourself.
1479 You'll get back all the properties of the token as a plist.
1481 Here's an example that looks for the first item in the `Login'
1482 Secrets collection:
1485 (auth-source-search :max 1)
1487 Here's another that looks for the first item in the `Login'
1488 Secrets collection whose label contains `gnus':
1493 And this one looks for the first item in the `Login' Secrets
1494 collection that's a Google Chrome entry for the git.gnus.org site
1495 authentication tokens:
1499 "
1501 ;; TODO
1504 ;; TODO
1505 ;; (secrets-delete-item coll elt)
1515 ;; build a search spec without the ignored keys
1516 ;; if a search key is nil or t (match anything), we skip it
1522 nil
1524 search-keys))))
1525 ;; needed keys (always including host, login, port, and secret)
1528 search-keys)))
1531 for search-spec in search-specs
1532 nconc
1536 collect item)))
1537 ;; TODO: respect max in `secrets-search-items', not after the fact
1539 ;; convert the item name to a full plist
1542 ;; make an entry for the secret (password) element
1544 :secret
1547 ;; rewrite the entry from ((k1 v1) (k2 v2)) to plist
1552 items))
1553 ;; ensure each item has each key in `returned-keys'
1559 nil
1561 returned-keys))
1562 plist))
1563 items)))
1564 items))
1567 ;; TODO
1568 ;; (apply 'secrets-create-item (auth-get-source entry) name passwd spec)
1571 ;;; Backend specific parsing: Mac OS Keychain (using /usr/bin/security) backend
1574 &key backend create delete type max
1576 "Search the macOS Keychain; spec is like `auth-source'.
1578 All search keys must match exactly. If you need substring
1579 matching, do a wider search and narrow it down yourself.
1581 You'll get back all the properties of the token as a plist.
1583 The :type key is either `macos-keychain-internet' or
1584 `macos-keychain-generic'.
1586 For the internet keychain type, the :label key searches the
1590 \(note PROT has to be a 4-character string).
1592 For the generic keychain type, the :label key searches the item's
1597 Here's an example that looks for the first item in the default
1598 generic macOS Keychain:
1601 (auth-source-search :max 1)
1603 Here's another that looks for the first item in the internet
1604 macOS Keychain collection whose label is `gnus':
1609 And this one looks for the first item in the internet keychain
1610 entries for git.gnus.org:
1614 "
1615 ;; TODO
1618 ;; TODO
1619 ;; (macos-keychain-delete-item coll elt)
1625 ;; Filter out ignored keys from the spec
1627 ;; Build a search spec without the ignored keys
1628 ;; FIXME make this loop a function? it's used in at least 3 places
1632 ;; If a search key value is nil or t (match anything), we skip it
1637 nil
1639 search-keys)))
1640 ;; needed keys (always including host, login, port, and secret)
1643 search-keys)))
1644 ;; Extract host and port from spec
1649 ;; Loop through all combinations of host/port and pass each of these to
1650 ;; auth-source-macos-keychain-search-items
1656 coll
1657 type
1658 max
1659 host port
1660 search-spec)))
1664 ;; ensure each item has each key in `returned-keys'
1670 nil
1672 returned-keys))
1673 plist))
1674 items)))
1675 items))
1690 else
1691 collect var))
1695 &key label type user
1699 "find-generic-password"
1715 port)))))
1727 ret
1728 keychain-generic
1729 "secret"
1733 ;; TODO: check if this is really the label
1734 ;; match 0x00000007 <blob>="AppleID"
1738 ret
1739 keychain-generic
1740 "label"
1742 ;; match "crtr"<uint32>="aapl"
1743 ;; match "svce"<blob>="AppleID"
1747 ret
1748 keychain-generic
1752 ;; return `ret' iff it has the :secret key
1760 ;; for generic keychains, creator is host, service is port
1763 ;; for internet keychains, protocol is port, server is host
1767 result))
1770 ;; TODO
1773 ;;; Backend specific parsing: PLSTORE backend
1776 &key backend create delete max
1778 "Search the PLSTORE; spec is like `auth-source'."
1785 ;; build a search spec without the ignored keys
1786 ;; if a search key is nil or t (match anything), we skip it
1792 nil
1796 search-keys)))
1797 ;; needed keys (always including host, login, port, and secret)
1800 search-keys)))
1804 ;; convert the item to a full plist
1813 plist))
1814 items))
1815 ;; ensure each item has each key in `returned-keys'
1821 nil
1823 returned-keys))
1824 plist))
1825 items)))
1827 ;; if we need to create an entry AND none were found to match
1831 ;; create based on the spec and record the value
1833 ;; if the user did not want to create the entry
1834 ;; in the file, it will be returned
1836 ;; if not, we do the search again without :create
1837 ;; to get the updated data.
1839 ;; the result will be returned, even if the search fails
1843 item-names)
1847 items))
1850 &key backend host port create
1854 ;; we know (because of an assertion in auth-source-search) that the
1855 ;; :create parameter is either t or a list (which includes nil)
1858 :host host
1861 ;; `valist' is an alist
1862 valist
1863 ;; `artificial' will be returned if no creation is needed
1864 artificial
1865 secret-artificial)
1867 ;; only for base required elements (defined as function parameters):
1868 ;; fill in the valist with whatever data we may have from the search
1869 ;; we complete the first value if it's a list and use the value otherwise
1874 ;; all-accepting choice (predicate is t)
1876 ;; just the value otherwise
1881 ;; for extra required elements, see if the spec includes a value for them
1889 ;; for each required element
1892 ;; take the first element if the data is a list
1896 ;; this is the default to be offered
1898 auth-source-creation-defaults r))
1899 ;; the default supplementals are simple:
1900 ;; for the user, try `given-default' and then (user-login-name);
1901 ;; otherwise take `given-default'
1933 prompt
1938 ;; Store the data, prompting for the password if needed.
1948 nil nil default)
1956 data))
1959 data))))))
1965 artificial secret-artificial)
1970 ;;; older API
1972 ;; (auth-source-user-or-password '("login" "password") "imap.myhost.com" t "tzz")
1974 ;; deprecate the old interface
1982 "Find MODE (string or list of strings) matching HOST and PORT.
1984 DEPRECATED in favor of `auth-source-search'!
1987 across the Secret Service API (see secrets.el) if the resulting
1988 items don't have a username. This means that if you search for
1992 A non nil DELETE-EXISTING means deleting any matching password
1993 entry in the respective sources. This is useful only when
1994 CREATE-MISSING is non nil as well; the intended use case is to
1995 remove wrong password entries.
1997 If no matching entry is found, and CREATE-MISSING is non nil,
1998 the password will be retrieved interactively, and it will be
1999 stored in the password database which matches best (see
2000 `auth-sources').
2004 "auth-source-user-or-password: DEPRECATED get %s for %s (%s) + user=%s"
2005 mode host port username)
2009 ;; (cname (if username
2010 ;; (format "%s %s:%s %s" mode host port username)
2011 ;; (format "%s %s:%s" mode host port)))
2016 search))
2019 search))
2020 ;; (found (if (not delete-existing)
2021 ;; (gethash cname auth-source-cache)
2022 ;; (remhash cname auth-source-cache)
2023 ;; nil)))
2028 "auth-source-user-or-password: DEPRECATED cached %s=%s for %s (%s) + %s"
2029 mode
2030 ;; don't show the password
2032 "SECRET"
2033 found)
2034 host port username)
2036 ;; else, if not found, search with a max of 1
2051 found))
2057 :host host
2058 :user user
2063 :host host
2075 ;;; auth-source.el ends here