1 files changed, 48 insertions, 0 deletions
diff --git a/bsdauth/bsdauth.go b/bsdauth/bsdauth.go
new file mode 100644
index 0000000..6105360
--- /dev/null
+++ b/bsdauth/bsdauth.go
@@ -0,0 +1,48 @@
+//go:build openbsd && cgo
+
+package bsdauth
+
+/*
+#cgo CFLAGS: -DOPENBSD
+#cgo LDFLAGS: -lutil
+#include <stdlib.h>
+#include <sys/types.h>
+#include <login_cap.h>
+#include <bsd_auth.h>
+
+// Tiny wrapper to keep the cgo call site clean.
+static int go_auth_userokay(const char *name, const char *style, const char *atype, const char *password) {
+    return auth_userokay((char*)name, (char*)style, (char*)atype, (char*)password);
+}
+*/
+import "C"
+import (
+	"errors"
+	"unsafe"
+)
+
+// Authenticate verifies a username and password using OpenBSD’s BSD Authentication subsystem.
+// `atype` identifies the service name (e.g., "auth-myapp").
+// `style` is left empty to use the system default style from login.conf.
+func Authenticate(username, password, atype string) (bool, error) {
+	if username == "" {
+		return false, errors.New("bsdauth: empty username")
+	}
+	if atype == "" {
+		atype = "auth-myapp"
+	}
+
+	cUser := C.CString(username)
+	cPass := C.CString(password)
+	cType := C.CString(atype)
+	var cStyle *C.char = nil // default style from login.conf
+	defer func() {
+		C.free(unsafe.Pointer(cUser))
+		C.free(unsafe.Pointer(cPass))
+		C.free(unsafe.Pointer(cType))
+	}()
+
+	ok := C.go_auth_userokay(cUser, cStyle, cType, cPass)
+	return ok != 0, nil
+}
+