dev

application/Espo/Core/Api/Auth.php

@@ -68,16 +68,26 @@ class Auth
         $this->isResolvedUseNoAuth = true;
     }
 
+    /**
+     * Logged in succesfully.
+     */
     public function isResolved() : bool
     {
         return $this->isResolved;
     }
 
+    /**
+     * No need to log in.
+     */
     public function isResolvedUseNoAuth() : bool
     {
         return $this->isResolvedUseNoAuth;
     }
 
+    /**
+     * Determines which auth method to use. Fetches a username and password from headers and server parameters.
+     * Then tries to log in.
+     */
     public function process(Request $request, Response $response)
     {
         $httpMethod = $request->getMethod();
@@ -95,6 +105,8 @@ class Auth
             $authenticationMethod = 'Hmac';
         } else if ($request->hasHeader('X-Api-Key')) {
             $authenticationMethod = 'ApiKey';
+        } else if ($request->hasHeader('X-Auth-Method')) {
+            $authenticationMethod = $request->getHeader('X-Auth-Method');
         }
 
         if (!$authenticationMethod) {

application/Espo/Core/Utils/Auth.php

@@ -146,6 +146,13 @@ class Auth
     ) : ?array {
         $isByTokenOnly = false;
 
+        if ($authenticationMethod) {
+            if (!$this->metadata->get(['authenticationMethods', $authenticationMethod, 'api'])) {
+                $GLOBALS['log']->warning("AUTH: Trying to use not allowed authentication method '{$authenticationMethod}'.");
+                return null;
+            }
+        }
+
         if (!$authenticationMethod) {
             if ($request->getHeader('Espo-Authorization-By-Token') === 'true') {
                 $isByTokenOnly = true;

application/Espo/Resources/metadata/authenticationMethods/ApiKey.json

@@ -0,0 +1,3 @@
+{
+    "api": true
+}

application/Espo/Resources/metadata/authenticationMethods/Espo.json

@@ -1,5 +1,4 @@
 {
-
     "settings": {
         "isAvailable": true
     }

application/Espo/Resources/metadata/authenticationMethods/Hmac.json

@@ -0,0 +1,3 @@
+{
+    "api": true
+}

application/Espo/Resources/metadata/authenticationMethods/LDAP.json

@@ -1,5 +1,4 @@
 {
-
     "settings": {
         "isAvailable": true,
         "layout": {