LDAPAccountManager/lam/lib/2factor.inc

800 lines
24 KiB
PHP
Raw Normal View History

2017-01-30 19:02:31 +00:00
<?php
namespace LAM\LIB\TWO_FACTOR;
2020-01-05 16:53:12 +00:00
use \htmlResponsiveRow;
use \LAM\LOGIN\WEBAUTHN\WebauthnManager;
2017-01-31 19:50:51 +00:00
use \selfServiceProfile;
2017-02-11 18:39:05 +00:00
use \LAMConfig;
2019-08-13 15:03:30 +00:00
use \htmlScript;
use \htmlIframe;
2019-11-17 20:38:57 +00:00
use \htmlImage;
2019-11-21 18:34:01 +00:00
use \htmlButton;
use \htmlJavaScript;
use \htmlStatusMessage;
2019-12-19 21:01:54 +00:00
use \htmlOutputText;
2019-11-21 18:34:01 +00:00
use \htmlDiv;
2019-11-16 07:28:24 +00:00
use \LAMException;
2020-01-05 16:53:12 +00:00
use \Webauthn\PublicKeyCredentialCreationOptions;
2017-01-31 19:50:51 +00:00
2017-01-30 19:02:31 +00:00
/*
This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
2020-01-08 19:38:26 +00:00
Copyright (C) 2017 - 2020 Roland Gruber
2017-01-30 19:02:31 +00:00
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/**
* 2-factor authentication
*
* @package two_factor
* @author Roland Gruber
*/
interface TwoFactorProvider {
2017-01-31 19:50:51 +00:00
/**
* Returns a list of serial numbers of the user's tokens.
*
* @param string $user user name
* @param string $password password
2018-12-26 08:39:51 +00:00
* @return string[] serials
2017-01-31 19:50:51 +00:00
* @throws \Exception error getting serials
*/
public function getSerials($user, $password);
2017-01-30 19:02:31 +00:00
/**
* Verifies if the provided 2nd factor is valid.
*
* @param string $user user name
* @param string $password password
2017-02-08 17:45:15 +00:00
* @param string $serial serial number of token
2017-01-30 19:02:31 +00:00
* @param string $twoFactorInput input for 2nd factor
2017-01-31 19:50:51 +00:00
* @return boolean true if verified and false if verification failed
2017-01-30 19:02:31 +00:00
* @throws \Exception error during check
*/
2017-02-08 17:45:15 +00:00
public function verify2ndFactor($user, $password, $serial, $twoFactorInput);
2017-01-30 19:02:31 +00:00
2019-08-13 15:03:30 +00:00
/**
* Returns if the service has a custom input form.
* In this case the token field is not displayed.
*
* @return has custom input form
*/
public function hasCustomInputForm();
/**
* Adds the custom input fields to the form.
*
* @param htmlResponsiveRow $row row where to add the input fields
* @param string user DN
*/
public function addCustomInput(&$row, $userDn);
2019-08-13 15:29:02 +00:00
/**
* Returns if the submit button should be shown.
*
* @return bool show submit button
*/
public function isShowSubmitButton();
2017-01-30 19:02:31 +00:00
}
2017-01-31 19:50:51 +00:00
/**
2019-08-13 15:03:30 +00:00
* Base class for 2-factor authentication providers.
*
* @author Roland Gruber
2017-01-31 19:50:51 +00:00
*/
2019-08-13 15:03:30 +00:00
abstract class BaseProvider implements TwoFactorProvider {
2017-01-30 19:02:31 +00:00
2019-08-13 15:03:30 +00:00
protected $config;
2017-01-31 19:50:51 +00:00
/**
2019-08-13 15:03:30 +00:00
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::hasCustomInputForm()
2017-01-31 19:50:51 +00:00
*/
2019-08-13 15:03:30 +00:00
public function hasCustomInputForm() {
return false;
2017-01-31 19:50:51 +00:00
}
/**
* {@inheritDoc}
2019-08-13 15:03:30 +00:00
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::addCustomInput()
2017-01-31 19:50:51 +00:00
*/
2019-08-13 15:03:30 +00:00
public function addCustomInput(&$row, $userDn) {
// must be filled by subclass if used
2019-08-11 07:39:47 +00:00
}
/**
* Returns the value of the user attribute in LDAP.
*
* @param string $userDn user DN
* @return string user name
*/
2019-08-13 15:03:30 +00:00
protected function getLoginAttributeValue($userDn) {
2019-08-11 07:39:47 +00:00
$attrName = $this->config->twoFactorAuthenticationSerialAttributeName;
$userData = ldapGetDN($userDn, array($attrName));
if (empty($userData[$attrName])) {
return null;
}
if (is_array($userData[$attrName])) {
return $userData[$attrName][0];
}
return $userData[$attrName];
2017-01-31 19:50:51 +00:00
}
2019-08-13 15:29:02 +00:00
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::isShowSubmitButton()
*/
public function isShowSubmitButton() {
return true;
}
2019-08-13 15:03:30 +00:00
}
/**
* Provider for privacyIDEA.
*/
class PrivacyIDEAProvider extends BaseProvider {
/**
* Constructor.
*
* @param TwoFactorConfiguration $config configuration
*/
public function __construct(&$config) {
$this->config = $config;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
*/
public function getSerials($user, $password) {
logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user);
$loginAttribute = $this->getLoginAttributeValue($user);
$token = $this->authenticate($loginAttribute, $password);
return $this->getSerialsForUser($loginAttribute, $token);
}
2017-01-30 19:02:31 +00:00
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
*/
2017-02-08 17:45:15 +00:00
public function verify2ndFactor($user, $password, $serial, $twoFactorInput) {
2017-01-30 19:02:31 +00:00
logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user);
2019-08-11 07:39:47 +00:00
$loginAttribute = $this->getLoginAttributeValue($user);
$token = $this->authenticate($loginAttribute, $password);
2017-02-08 17:45:15 +00:00
return $this->verify($token, $serial, $twoFactorInput);
2017-01-30 19:02:31 +00:00
}
/**
* Authenticates against the server
*
2017-01-31 19:50:51 +00:00
* @param string $user user name
* @param string $password password
2017-01-30 19:02:31 +00:00
* @return string token
* @throws \Exception error during authentication
*/
2017-01-31 19:50:51 +00:00
private function authenticate($user, $password) {
$curl = $this->getCurl();
2017-02-11 18:39:05 +00:00
$url = $this->config->twoFactorAuthenticationURL . "/auth";
2017-01-31 19:50:51 +00:00
curl_setopt($curl, CURLOPT_URL, $url);
$header = array('Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$options = array(
'username' => $user,
'password' => $password,
);
curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
$json = curl_exec($curl);
curl_close($curl);
if (empty($json)) {
throw new \Exception("Unable to get server response from $url.");
}
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
if ($status != 1) {
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage);
}
if (!isset($output->result->value) || !isset($output->result->value->token)) {
throw new \Exception("Unable to get token.");
}
return $output->result->value->token;
2017-01-30 19:02:31 +00:00
}
/**
* Returns the curl object.
*
* @return object curl handle
* @throws \Exception error during curl creation
*/
2017-01-31 19:50:51 +00:00
private function getCurl() {
2017-01-30 19:02:31 +00:00
$curl = curl_init();
2017-02-11 18:39:05 +00:00
if ($this->config->twoFactorAuthenticationInsecure) {
2017-01-31 19:50:51 +00:00
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
}
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
2017-01-30 19:02:31 +00:00
return $curl;
}
2017-01-31 19:50:51 +00:00
/**
* Returns the serial numbers of the user.
*
* @param string $user user name
* @param string $token login token
2018-12-26 08:39:51 +00:00
* @return string[] serials
2017-01-31 19:50:51 +00:00
* @throws \Exception error during serial reading
*/
private function getSerialsForUser($user, $token) {
$curl = $this->getCurl();
2017-02-11 18:39:05 +00:00
$url = $this->config->twoFactorAuthenticationURL . "/token/?user=" . $user;
2017-01-31 19:50:51 +00:00
curl_setopt($curl, CURLOPT_URL, $url);
$header = array('Authorization: ' . $token, 'Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$json = curl_exec($curl);
curl_close($curl);
if (empty($json)) {
throw new \Exception("Unable to get server response from $url.");
}
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) {
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage);
}
$serials = array();
foreach ($output->result->value->tokens as $tokenEntry) {
if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) {
continue;
}
$serials[] = $tokenEntry->serial;
}
return $serials;
}
2017-02-08 17:45:15 +00:00
/**
* Verifies if the given 2nd factor input is valid.
*
* @param string $token login token
* @param string $serial serial number
* @param string $twoFactorInput 2factor pin + password
*/
private function verify($token, $serial, $twoFactorInput) {
$curl = $this->getCurl();
2017-02-11 18:39:05 +00:00
$url = $this->config->twoFactorAuthenticationURL . "/validate/check";
2017-02-08 17:45:15 +00:00
curl_setopt($curl, CURLOPT_URL, $url);
$options = array(
'pass' => $twoFactorInput,
'serial' => $serial,
);
curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
$header = array('Authorization: ' . $token, 'Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$json = curl_exec($curl);
curl_close($curl);
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status) || !isset($output->result->value)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
$value = $output->result->value;
if (($status == 'true') && ($value == 'true')) {
return true;
}
logNewMessage(LOG_DEBUG, "Unable to verify token: " . print_r($output, true));
return false;
}
2017-01-31 19:50:51 +00:00
}
2018-12-31 09:51:44 +00:00
/**
* Authentication via YubiKeys.
*
* @author Roland Gruber
*/
2019-08-13 15:03:30 +00:00
class YubicoProvider extends BaseProvider {
2018-12-31 09:51:44 +00:00
/**
* Constructor.
*
* @param TwoFactorConfiguration $config configuration
*/
public function __construct(&$config) {
$this->config = $config;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
*/
public function getSerials($user, $password) {
2018-12-31 11:39:20 +00:00
$keyAttributeName = strtolower($this->config->twoFactorAuthenticationSerialAttributeName);
2019-01-01 09:54:31 +00:00
if (isset($_SESSION['selfService_clientDN'])) {
$loginDn = lamDecrypt($_SESSION['selfService_clientDN'], 'SelfService');
}
else {
$loginDn = $_SESSION['ldap']->getUserName();
}
2018-12-31 09:51:44 +00:00
$handle = getLDAPServerHandle();
$ldapData = ldapGetDN($loginDn, array($keyAttributeName), $handle);
if (empty($ldapData[$keyAttributeName])) {
return array();
}
return array(implode(', ', $ldapData[$keyAttributeName]));
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
*/
public function verify2ndFactor($user, $password, $serial, $twoFactorInput) {
include_once(__DIR__ . "/3rdParty/yubico/Yubico.php");
$serialData = $this->getSerials($user, $password);
if (empty($serialData)) {
return false;
}
$serials = explode(', ', $serialData[0]);
$serialMatched = false;
foreach ($serials as $serial) {
if (strpos($twoFactorInput, $serial) === 0) {
$serialMatched = true;
break;
}
}
if (!$serialMatched) {
throw new \Exception(_('YubiKey id does not match allowed list of key ids.'));
}
2019-11-16 07:28:24 +00:00
$urls = $this->config->twoFactorAuthenticationURL;
shuffle($urls);
2018-12-31 09:51:44 +00:00
$httpsverify = !$this->config->twoFactorAuthenticationInsecure;
$clientId = $this->config->twoFactorAuthenticationClientId;
$secretKey = $this->config->twoFactorAuthenticationSecretKey;
2019-11-16 07:28:24 +00:00
foreach ($urls as $url) {
try {
$auth = new \Auth_Yubico($clientId, $secretKey, $url, $httpsverify);
$auth->verify($twoFactorInput);
return true;
}
catch (LAMException $e) {
logNewMessage(LOG_DEBUG, 'Unable to verify 2FA: ' . $e->getMessage());
}
}
return false;
2018-12-31 09:51:44 +00:00
}
}
2019-08-13 15:03:30 +00:00
/**
* Provider for DUO.
*/
class DuoProvider extends BaseProvider {
/**
* Constructor.
*
* @param TwoFactorConfiguration $config configuration
*/
public function __construct(&$config) {
$this->config = $config;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
*/
public function getSerials($user, $password) {
return array('DUO');
}
2019-08-13 15:29:02 +00:00
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::isShowSubmitButton()
*/
public function isShowSubmitButton() {
return false;
}
2019-08-13 15:03:30 +00:00
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::hasCustomInputForm()
*/
public function hasCustomInputForm() {
return true;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\BaseProvider::addCustomInput()
*/
public function addCustomInput(&$row, $userDn) {
$loginAttribute = $this->getLoginAttributeValue($userDn);
$aKey = $this->getAKey();
include_once(__DIR__ . "/3rdParty/duo/Web.php");
$signedRequest = \Duo\Web::signRequest($this->config->twoFactorAuthenticationClientId,
$this->config->twoFactorAuthenticationSecretKey,
$aKey,
$loginAttribute);
2019-08-13 15:29:02 +00:00
if ($this->config->isSelfService) {
$row->add(new htmlScript("../lib/extra/duo/Duo-Web-v2.js", false, false), 12);
}
else {
$row->add(new htmlScript("lib/extra/duo/Duo-Web-v2.js", false, false), 12);
}
2019-08-13 15:03:30 +00:00
$iframe = new htmlIframe('duo_iframe');
$iframe->addDataAttribute('host', $this->config->twoFactorAuthenticationURL);
$iframe->addDataAttribute('sig-request', $signedRequest);
$row->add($iframe, 12);
}
/**
* Returns the aKey.
*
* @return String aKey
*/
private function getAKey() {
if (empty($_SESSION['duo_akey'])) {
$_SESSION['duo_akey'] = generateRandomPassword(40);
}
return $_SESSION['duo_akey'];
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
*/
public function verify2ndFactor($user, $password, $serial, $twoFactorInput) {
2019-11-28 20:19:44 +00:00
logNewMessage(LOG_DEBUG, 'DuoProvider: Checking 2nd factor for ' . $user);
2019-08-13 15:03:30 +00:00
$loginAttribute = $this->getLoginAttributeValue($user);
$response = $_POST['sig_response'];
include_once(__DIR__ . "/3rdParty/duo/Web.php");
$result = \Duo\Web::verifyResponse(
$this->config->twoFactorAuthenticationClientId,
$this->config->twoFactorAuthenticationSecretKey,
$this->getAKey(),
$response);
if ($result === $loginAttribute) {
return true;
}
logNewMessage(LOG_ERR, 'DUO authentication failed');
return false;
}
}
2019-11-17 20:38:57 +00:00
/**
* Provider for Webauthn.
*/
class WebauthnProvider extends BaseProvider {
/**
* Constructor.
*
* @param TwoFactorConfiguration $config configuration
*/
2020-01-01 17:08:30 +00:00
public function __construct($config) {
2019-11-17 20:38:57 +00:00
$this->config = $config;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
*/
public function getSerials($user, $password) {
return array('WEBAUTHN');
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::isShowSubmitButton()
*/
public function isShowSubmitButton() {
return false;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::hasCustomInputForm()
*/
public function hasCustomInputForm() {
return true;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\BaseProvider::addCustomInput()
*/
public function addCustomInput(&$row, $userDn) {
if (version_compare(phpversion(), '7.2.0') < 0) {
$row->add(new htmlStatusMessage('ERROR', 'Webauthn requires PHP 7.2.'), 12);
return;
}
if (!extension_loaded('PDO')) {
$row->add(new htmlStatusMessage('ERROR', 'Webauthn requires the PDO extension for PHP.'), 12);
return;
}
$pdoDrivers = \PDO::getAvailableDrivers();
if (!in_array('sqlite', $pdoDrivers)) {
$row->add(new htmlStatusMessage('ERROR', 'Webauthn requires the sqlite PDO driver for PHP.'), 12);
return;
}
2020-01-05 16:53:12 +00:00
include_once __DIR__ . '/webauthn.inc';
$webauthnManager = $this->getWebauthnManager();
$hasTokens = $webauthnManager->isRegistered($userDn);
if ($hasTokens) {
$row->add(new htmlStatusMessage('INFO', _('Please authenticate with your security device.')), 12);
}
else {
$row->add(new htmlStatusMessage('INFO', _('Please register a security device.')), 12);
}
$row->addVerticalSpacer('2rem');
2019-11-17 20:38:57 +00:00
$pathPrefix = $this->config->isSelfService ? '../' : '';
2020-01-08 19:38:26 +00:00
$selfServiceParam = $this->config->isSelfService ? 'true' : 'false';
2019-11-17 20:38:57 +00:00
$row->add(new htmlImage($pathPrefix . '../graphics/webauthn.svg'), 12);
2019-11-21 18:34:01 +00:00
$row->addVerticalSpacer('1rem');
$registerButton = new htmlButton('register_webauthn', _('Register new key'));
$registerButton->setCSSClasses(array('fullwidth hidden'));
$row->add($registerButton, 12);
$loginButton = new htmlButton('login_webauthn', _('Login'));
$loginButton->setCSSClasses(array('fullwidth hidden'));
$row->add($loginButton, 12);
2019-12-07 11:49:45 +00:00
$errorMessage = new htmlStatusMessage('ERROR', '', _('This service requires a browser with "WebAuthn" support.'));
2019-11-21 18:34:01 +00:00
$row->add(new htmlDiv(null, $errorMessage, array('hidden webauthn-error')), 12);
2019-12-09 20:35:37 +00:00
if ($this->config->twoFactorAuthenticationOptional === true) {
if (!$hasTokens) {
$skipButton = new htmlButton('skip_webauthn', _('Skip'));
$skipButton->setCSSClasses(array('fullwidth'));
$row->add($skipButton, 12);
}
}
2019-12-19 21:01:54 +00:00
$errorMessageDiv = new htmlDiv('generic-webauthn-error', new htmlOutputText(''));
$errorMessageDiv->addDataAttribute('button', _('Ok'));
$errorMessageDiv->addDataAttribute('title', _('Webauthn failed'));
$row->add($errorMessageDiv, 12);
2020-01-08 19:38:26 +00:00
$row->add(new htmlJavaScript('window.lam.webauthn.start(\'' . $pathPrefix . '\', ' . $selfServiceParam . ');'), 0);
2019-11-17 20:38:57 +00:00
}
2020-01-01 17:08:30 +00:00
/**
* Returns the webauthn manager.
*
* @return WebauthnManager manager
*/
public function getWebauthnManager() {
return new WebauthnManager();
}
2019-11-17 20:38:57 +00:00
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
*/
public function verify2ndFactor($user, $password, $serial, $twoFactorInput) {
2019-11-28 20:19:44 +00:00
logNewMessage(LOG_DEBUG, 'WebauthnProvider: Checking 2nd factor for ' . $user);
include_once __DIR__ . '/webauthn.inc';
2020-01-01 17:08:30 +00:00
$webauthnManager = $this->getWebauthnManager();
2019-12-31 16:01:51 +00:00
if (!empty($_SESSION['ldap'])) {
$userDn = $_SESSION['ldap']->getUserName();
2019-12-09 20:35:37 +00:00
}
2019-12-31 16:01:51 +00:00
else {
2020-01-08 19:38:26 +00:00
$userDn = lamDecrypt($_SESSION['selfService_clientDN'], 'SelfService');
2019-12-31 16:01:51 +00:00
}
$hasTokens = $webauthnManager->isRegistered($userDn);
if (!$hasTokens) {
if ($this->config->twoFactorAuthenticationOptional && !$webauthnManager->isRegistered($user) && ($_POST['sig_response'] === 'skip')) {
logNewMessage(LOG_DEBUG, 'Skipped 2FA for ' . $user . ' as no devices are registered and 2FA is optional.');
return true;
}
$response = base64_decode($_POST['sig_response']);
$registrationObject = PublicKeyCredentialCreationOptions::createFromString($_SESSION['webauthn_registration']);
return $webauthnManager->storeNewRegistration($registrationObject, $response);
}
else {
logNewMessage(LOG_DEBUG, 'Checking webauthn response of ' . $userDn);
$response = base64_decode($_POST['sig_response']);
return $webauthnManager->isValidAuthentication($response, $userDn);
2019-11-17 20:38:57 +00:00
}
}
}
2017-01-31 19:50:51 +00:00
/**
* Returns the correct 2 factor provider.
*/
class TwoFactorProviderService {
2017-02-11 17:16:08 +00:00
/** 2factor authentication disabled */
const TWO_FACTOR_NONE = 'none';
/** 2factor authentication via privacyIDEA */
const TWO_FACTOR_PRIVACYIDEA = 'privacyidea';
2018-12-31 09:51:44 +00:00
/** 2factor authentication via YubiKey */
const TWO_FACTOR_YUBICO = 'yubico';
2019-08-13 15:03:30 +00:00
/** 2factor authentication via DUO */
const TWO_FACTOR_DUO = 'duo';
2019-11-17 20:38:57 +00:00
/** 2factor authentication via webauthn */
const TWO_FACTOR_WEBAUTHN = 'webauthn';
2017-02-11 17:16:08 +00:00
2017-02-11 18:39:05 +00:00
private $config;
2017-01-31 19:50:51 +00:00
/**
* Constructor.
*
2017-02-11 18:39:05 +00:00
* @param selfServiceProfile|LAMConfig $configObj profile
2017-01-31 19:50:51 +00:00
*/
2017-02-11 18:39:05 +00:00
public function __construct(&$configObj) {
if ($configObj instanceof selfServiceProfile) {
$this->config = $this->getConfigSelfService($configObj);
}
else {
$this->config = $this->getConfigAdmin($configObj);
}
2017-01-31 19:50:51 +00:00
}
/**
* Returns the provider for the given type.
*
* @param string $type authentication type
* @return TwoFactorProvider provider
* @throws \Exception unable to get provider
*/
public function getProvider() {
2017-02-11 18:39:05 +00:00
if ($this->config->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_PRIVACYIDEA) {
return new PrivacyIDEAProvider($this->config);
2017-01-31 19:50:51 +00:00
}
2018-12-31 09:51:44 +00:00
elseif ($this->config->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_YUBICO) {
return new YubicoProvider($this->config);
}
2019-08-13 15:03:30 +00:00
elseif ($this->config->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_DUO) {
return new DuoProvider($this->config);
}
2019-11-17 20:51:24 +00:00
elseif ($this->config->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_WEBAUTHN) {
return new WebauthnProvider($this->config);
}
2017-02-11 18:39:05 +00:00
throw new \Exception('Invalid provider: ' . $this->config->twoFactorAuthentication);
}
/**
* Returns the configuration from self service.
*
* @param selfServiceProfile $profile profile
* @return TwoFactorConfiguration configuration
*/
private function getConfigSelfService(&$profile) {
2018-12-31 09:51:44 +00:00
$tfConfig = new TwoFactorConfiguration();
2019-08-13 15:29:02 +00:00
$tfConfig->isSelfService = true;
2018-12-31 09:51:44 +00:00
$tfConfig->twoFactorAuthentication = $profile->twoFactorAuthentication;
$tfConfig->twoFactorAuthenticationInsecure = $profile->twoFactorAuthenticationInsecure;
2019-12-09 20:35:37 +00:00
$tfConfig->twoFactorAuthenticationOptional = $profile->twoFactorAuthenticationOptional;
2019-11-17 16:44:30 +00:00
if ($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_YUBICO) {
$tfConfig->twoFactorAuthenticationURL = explode("\r\n", $profile->twoFactorAuthenticationURL);
}
else {
$tfConfig->twoFactorAuthenticationURL = $profile->twoFactorAuthenticationURL;
}
2019-01-01 09:54:31 +00:00
$tfConfig->twoFactorAuthenticationClientId = $profile->twoFactorAuthenticationClientId;
$tfConfig->twoFactorAuthenticationSecretKey = $profile->twoFactorAuthenticationSecretKey;
if ($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_YUBICO) {
$moduleSettings = $profile->moduleSettings;
if (!empty($moduleSettings['yubiKeyUser_attributeName'][0])) {
$tfConfig->twoFactorAuthenticationSerialAttributeName = $moduleSettings['yubiKeyUser_attributeName'][0];
}
else {
$tfConfig->twoFactorAuthenticationSerialAttributeName = 'yubiKeyId';
}
}
2019-08-13 15:03:30 +00:00
if (($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_PRIVACYIDEA)
|| ($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_DUO)) {
2019-08-11 07:39:47 +00:00
$attrName = $profile->twoFactorAuthenticationAttribute;
if (empty($attrName)) {
$attrName = 'uid';
}
$tfConfig->twoFactorAuthenticationSerialAttributeName = strtolower($attrName);
}
2018-12-31 09:51:44 +00:00
return $tfConfig;
2017-01-31 19:50:51 +00:00
}
2017-02-11 18:54:57 +00:00
/**
* Returns the configuration for admin interface.
*
* @param LAMConfig $conf configuration
* @return TwoFactorConfiguration configuration
*/
private function getConfigAdmin($conf) {
2018-12-31 09:51:44 +00:00
$tfConfig = new TwoFactorConfiguration();
2019-08-13 15:29:02 +00:00
$tfConfig->isSelfService = false;
2018-12-31 09:51:44 +00:00
$tfConfig->twoFactorAuthentication = $conf->getTwoFactorAuthentication();
$tfConfig->twoFactorAuthenticationInsecure = $conf->getTwoFactorAuthenticationInsecure();
2019-12-09 20:35:37 +00:00
$tfConfig->twoFactorAuthenticationOptional = $conf->getTwoFactorAuthenticationOptional();
2019-11-16 07:28:24 +00:00
if ($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_YUBICO) {
$tfConfig->twoFactorAuthenticationURL = explode("\r\n", $conf->getTwoFactorAuthenticationURL());
}
else {
$tfConfig->twoFactorAuthenticationURL = $conf->getTwoFactorAuthenticationURL();
}
2018-12-31 09:51:44 +00:00
$tfConfig->twoFactorAuthenticationClientId = $conf->getTwoFactorAuthenticationClientId();
$tfConfig->twoFactorAuthenticationSecretKey = $conf->getTwoFactorAuthenticationSecretKey();
2018-12-31 11:39:20 +00:00
if ($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_YUBICO) {
$moduleSettings = $conf->get_moduleSettings();
if (!empty($moduleSettings['yubiKeyUser_attributeName'][0])) {
$tfConfig->twoFactorAuthenticationSerialAttributeName = $moduleSettings['yubiKeyUser_attributeName'][0];
}
else {
$tfConfig->twoFactorAuthenticationSerialAttributeName = 'yubiKeyId';
}
}
2019-08-13 15:03:30 +00:00
if (($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_PRIVACYIDEA)
|| ($tfConfig->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_DUO)) {
2019-08-11 07:39:47 +00:00
$tfConfig->twoFactorAuthenticationSerialAttributeName = strtolower($conf->getTwoFactorAuthenticationAttribute());
}
2018-12-31 09:51:44 +00:00
return $tfConfig;
2017-02-11 18:54:57 +00:00
}
2017-01-30 19:02:31 +00:00
}
2017-02-11 18:39:05 +00:00
/**
* Configuration settings for 2-factor authentication.
*
* @author Roland Gruber
*/
class TwoFactorConfiguration {
2018-12-31 09:51:44 +00:00
2019-08-13 15:29:02 +00:00
/**
* @var bool is self service
*/
public $isSelfService = false;
2018-12-31 09:51:44 +00:00
/**
* @var string provider id
*/
2017-02-11 18:39:05 +00:00
public $twoFactorAuthentication = null;
2018-12-31 09:51:44 +00:00
/**
2019-11-16 07:28:24 +00:00
* @var string|array service URL(s)
2018-12-31 09:51:44 +00:00
*/
2017-02-11 18:39:05 +00:00
public $twoFactorAuthenticationURL = null;
2018-12-31 09:51:44 +00:00
/**
* @var disable certificate check
*/
2017-02-11 18:39:05 +00:00
public $twoFactorAuthenticationInsecure = false;
2018-12-31 09:51:44 +00:00
/**
* @var client ID for API access
*/
public $twoFactorAuthenticationClientId = null;
/**
* @var secret key for API access
*/
public $twoFactorAuthenticationSecretKey = null;
2018-12-31 11:39:20 +00:00
/**
* @var LDAP attribute name that stores the token serials
*/
public $twoFactorAuthenticationSerialAttributeName = null;
2019-12-09 20:35:37 +00:00
/**
* @var bool 2FA is optional
*/
public $twoFactorAuthenticationOptional = false;
2017-02-11 18:39:05 +00:00
}