Merge branch 'hans/ssh/enable_auth_methods_for_clients/OTP-14399'

4 files changed, 31 insertions, 16 deletions

diff --git a/lib/ssh/doc/src/ssh.xml b/lib/ssh/doc/src/ssh.xml
index 84b7cdd7a1..c659e093b9 100644
--- a/lib/ssh/doc/src/ssh.xml
+++ b/lib/ssh/doc/src/ssh.xml
@@ -293,6 +293,15 @@
 	    connection. For <c>gen_tcp</c> the time is in milli-seconds and the default value is
 	    <c>infinity</c>.</p>
 	  </item>
+
+	  <tag><c><![CDATA[{auth_methods, string()}]]></c></tag>
+	  <item>
+	    <p>Comma-separated string that determines which
+	    authentication methods that the client shall support and
+	    in which order they are tried. Defaults to
+	    <c><![CDATA["publickey,keyboard-interactive,password"]]></c></p>
+          </item>
+
 	  <tag><c><![CDATA[{user, string()}]]></c></tag>
           <item>
 	    <p>Provides a username. If this option is not given, <c>ssh</c>
@@ -300,6 +309,7 @@
 	    <c><![CDATA[USER]]></c> on UNIX,
 	    <c><![CDATA[USERNAME]]></c> on Windows).</p>
           </item>
+
 	  <tag><c><![CDATA[{password, string()}]]></c></tag>
           <item>
 	    <p>Provides a password for password authentication.
@@ -307,6 +317,7 @@
 	    password, if the password authentication method is
 	    attempted.</p>
           </item>
+
 	  <tag><c><![CDATA[{key_cb, key_cb()}]]></c></tag>
 	  <item>
 	    <p>Module implementing the behaviour <seealso
@@ -316,6 +327,7 @@
 	    module via the options passed to it under the key 'key_cb_private'.
 	    </p>
 	  </item>
+
 	  <tag><c><![CDATA[{quiet_mode, atom() = boolean()}]]></c></tag>
 	  <item>
 	    <p>If <c>true</c>, the client does not print anything on authorization.</p>
@@ -466,6 +478,7 @@
 	    authentication methods that the server is to support and
 	    in what order they are tried. Defaults to
 	    <c><![CDATA["publickey,keyboard-interactive,password"]]></c></p>
+	    <p>Note that the client is free to use any order and to exclude methods.</p>
           </item>
 
 	  <tag><c><![CDATA[{auth_method_kb_interactive_data, PromptTexts}]]></c>
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index 342583306b..39bd54869f 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -434,11 +434,7 @@ init_ssh_record(Role, Socket, Opts) ->
 
 init_ssh_record(Role, _Socket, PeerAddr, Opts) ->
     KeyCb = ?GET_OPT(key_cb, Opts),
-    AuthMethods =
-        case Role of
-            server -> ?GET_OPT(auth_methods, Opts);
-            client -> undefined
-        end,
+    AuthMethods = ?GET_OPT(auth_methods, Opts),
     S0 = #ssh{role = Role,
 	      key_cb = KeyCb,
 	      opts = Opts,
diff --git a/lib/ssh/src/ssh_options.erl b/lib/ssh/src/ssh_options.erl
index 0886d5b34d..78f68dbcb1 100644
--- a/lib/ssh/src/ssh_options.erl
+++ b/lib/ssh/src/ssh_options.erl
@@ -293,12 +293,6 @@ default(server) ->
             class => user_options
            },
 
-      {auth_methods, def} =>
-          #{default => ?SUPPORTED_AUTH_METHODS,
-            chk => fun check_string/1,
-            class => user_options
-           },
-
       {auth_method_kb_interactive_data, def} =>
           #{default => undefined, % Default value can be constructed when User is known
             chk => fun({S1,S2,S3,B}) ->
@@ -582,6 +576,21 @@ default(common) ->
             class => user_options
            },
 
+      {auth_methods, def} =>
+          #{default => ?SUPPORTED_AUTH_METHODS,
+            chk => fun(As) ->
+                           try
+                               Sup = string:tokens(?SUPPORTED_AUTH_METHODS, ","),
+                               New = string:tokens(As, ","),
+                               [] == [X || X <- New,
+                                           not lists:member(X,Sup)]
+                           catch
+                               _:_ -> false
+                           end
+                   end,
+            class => user_options
+           },
+
 %%%%% Undocumented
        {transport, def} =>
            #{default => ?DEFAULT_TRANSPORT,
diff --git a/lib/ssh/test/ssh_basic_SUITE.erl b/lib/ssh/test/ssh_basic_SUITE.erl
index b80c3ed5e2..1e591bc295 100644
--- a/lib/ssh/test/ssh_basic_SUITE.erl
+++ b/lib/ssh/test/ssh_basic_SUITE.erl
@@ -1173,13 +1173,10 @@ login_bad_pwd_no_retry3(Config) ->
     login_bad_pwd_no_retry(Config, "password,publickey,keyboard-interactive").
 
 login_bad_pwd_no_retry4(Config) ->
-    login_bad_pwd_no_retry(Config, "password,other,keyboard-interactive").
+    login_bad_pwd_no_retry(Config, "password,keyboard-interactive").
 
 login_bad_pwd_no_retry5(Config) ->
-    login_bad_pwd_no_retry(Config, "password,other,keyboard-interactive,password,password").
-
-
-
+    login_bad_pwd_no_retry(Config, "password,keyboard-interactive,password,password").
 
 
 login_bad_pwd_no_retry(Config, AuthMethods) ->