diff --git a/lam/docs/manual-sources/chapter-configuration.xml b/lam/docs/manual-sources/chapter-configuration.xml
index 8b69b1e4..d4d77ec1 100644
--- a/lam/docs/manual-sources/chapter-configuration.xml
+++ b/lam/docs/manual-sources/chapter-configuration.xml
@@ -655,6 +655,11 @@
Duo
+
+
+ Webauthn/FIDO2
+
Configuration options:
@@ -752,6 +757,27 @@
+ Webauthn/FIDO2
+
+ Users will be asked to register a device during login if no
+ device is setup.
+
+
+
+ Domain: Please enter the WebAuthn domain. This is the public
+ domain of the web server (e.g. "example.com"). Do not include
+ protocol or port. Browsers will reject authentication if the
+ domain does not match the web server domain.
+
+
+
+ Optional: By default LAM will enforce to use a 2FA device
+ and reject users that do not setup one. You can set this check to
+ optional. But if a user has setup a device then this will always
+ be required.
+
+
+
diff --git a/lam/help/help.inc b/lam/help/help.inc
index f3cc3c99..7f9692aa 100644
--- a/lam/help/help.inc
+++ b/lam/help/help.inc
@@ -179,6 +179,8 @@ $helpArray = array (
"Text" => _("Here you can input simple filter expressions (e.g. 'value' or 'v*'). The filter is case-insensitive.")),
"251" => array ("Headline" => _("Remote server"),
"Text" => _("Please enter the syslog remote server in format \"server:port\".")),
+ "252" => array ("Headline" => _("User DN"),
+ "Text" => _("Please enter a part of the user's DN to search for registered devices.")),
"260" => array ("Headline" => _("Additional LDAP filter"),
"Text" => _('Use this to enter an additional LDAP filter (e.g. "(cn!=admin)") to reduce the number of visible elements for this account type.')
. ' ' . _('You can use the wildcard @@LOGIN_DN@@ which will be substituted with the DN of the user who is currently logged in to LAM.')
diff --git a/lam/lib/html.inc b/lam/lib/html.inc
index 14410395..52daa4db 100644
--- a/lam/lib/html.inc
+++ b/lam/lib/html.inc
@@ -1098,10 +1098,10 @@ class htmlButton extends htmlElement {
}
$id = ' id="btn_' . preg_replace('/[^a-zA-Z0-9_-]/', '', $this->name) . '"';
if ($this->isImageButton) {
- echo '';
+ echo 'getDataAttributesAsString() . '>';
}
else {
- echo '' . $this->value . '';
+ echo 'getDataAttributesAsString() . '>' . $this->value . '';
// text buttons get JQuery style
$icon = '';
if ($this->iconClass != null) {
diff --git a/lam/lib/webauthn.inc b/lam/lib/webauthn.inc
index d7402daf..9b1fabac 100644
--- a/lam/lib/webauthn.inc
+++ b/lam/lib/webauthn.inc
@@ -523,6 +523,62 @@ class PublicKeyCredentialSourceRepositorySQLite implements PublicKeyCredentialSo
return 'sqlite:' . $fileName;
}
+ /**
+ * Returns if there are any credentials in the database.
+ *
+ * @return bool at least one credential in the database
+ */
+ public function hasRegisteredCredentials() {
+ $pdo = $this->getPDO();
+ $statement = $pdo->prepare('select count(*) from ' . self::TABLE_NAME);
+ $statement->execute();
+ $results = $statement->fetchAll();
+ return ($results[0][0] > 0);
+ }
+
+ /**
+ * Performs a full-text search on the user names and returns all devices found.
+ *
+ * @param string $searchTerm search term for user field
+ * @return array list of devices array('dn' => ..., 'credentialId' => ..., 'lastUseTime' => ..., 'registrationTime' => ...)
+ */
+ public function searchDevices(string $searchTerm) {
+ $pdo = $this->getPDO();
+ $statement = $pdo->prepare('select * from ' . self::TABLE_NAME . ' where userId like :searchTerm');
+ $statement->execute(array(
+ ':searchTerm' => '%' . $searchTerm . '%'
+ ));
+ $results = $statement->fetchAll();
+ $devices = array();
+ foreach ($results as $result) {
+ $devices[] = array(
+ 'dn' => $result['userId'],
+ 'credentialId' => $result['credentialId'],
+ 'lastUseTime' => $result['lastUseTime'],
+ 'registrationTime' => $result['registrationTime']
+ );
+ }
+ return $devices;
+ }
+
+ /**
+ * Deletes a single device from the database.
+ *
+ * @param string $dn user DN
+ * @param string $credentialId credential id
+ * @return bool deletion was ok
+ */
+ public function deleteDevice(string $dn, string $credentialId) {
+ logNewMessage(LOG_NOTICE, 'Delete webauthn device ' . $credentialId . ' of ' . $dn);
+ $pdo = $this->getPDO();
+ $statement = $pdo->prepare('delete from ' . self::TABLE_NAME . ' where userId = :userId and credentialId = :credentialId');
+ $result = $statement->execute(array(
+ ':userId' => $dn,
+ ':credentialId' => $credentialId
+ ));
+ return $statement->rowCount() > 0;
+ }
+
/**
* Returns the PDO.
*
diff --git a/lam/style/500_layout.css b/lam/style/500_layout.css
index 32e07b6a..86a508ea 100644
--- a/lam/style/500_layout.css
+++ b/lam/style/500_layout.css
@@ -547,6 +547,9 @@ input.markOk {
text-decoration: line-through;
}
+div.lam-webauthn-results {
+ max-height: 10rem;
+}
/**
* table style for delete.php
diff --git a/lam/templates/config/mainmanage.php b/lam/templates/config/mainmanage.php
index 9ebab21c..1ef2836c 100644
--- a/lam/templates/config/mainmanage.php
+++ b/lam/templates/config/mainmanage.php
@@ -1,5 +1,6 @@
setPassword($_POST['masterpassword']);
$msg = _("New master password set successfully.");
unset($_SESSION["mainconf_password"]);
- }
- else {
+ } else {
$errors[] = _("Master passwords are different or empty!");
}
}
@@ -126,8 +127,7 @@ if (isset($_POST['submitFormData'])) {
}
}
$allowedHosts = implode(",", $allowedHostsList);
- }
- else {
+ } else {
$allowedHosts = "";
}
$cfg->allowedHosts = $allowedHosts;
@@ -150,8 +150,7 @@ if (isset($_POST['submitFormData'])) {
}
}
$allowedHostsSelfService = implode(",", $allowedHostsSelfServiceList);
- }
- else {
+ } else {
$allowedHostsSelfService = "";
}
$cfg->allowedHostsSelfService = $allowedHostsSelfService;
@@ -169,22 +168,18 @@ if (isset($_POST['submitFormData'])) {
// set log destination
if ($_POST['logDestination'] == "none") {
$cfg->logDestination = "NONE";
- }
- elseif ($_POST['logDestination'] == "syslog") {
+ } elseif ($_POST['logDestination'] == "syslog") {
$cfg->logDestination = "SYSLOG";
- }
- elseif ($_POST['logDestination'] == "remote") {
+ } elseif ($_POST['logDestination'] == "remote") {
$cfg->logDestination = "REMOTE:" . $_POST['logRemote'];
$remoteParts = explode(':', $_POST['logRemote']);
if ((sizeof($remoteParts) !== 2) || !get_preg($remoteParts[0], 'DNSname') || !get_preg($remoteParts[1], 'digit')) {
$errors[] = _("Please enter a valid remote server in format \"server:port\".");
}
- }
- else {
+ } else {
if (isset($_POST['logFile']) && ($_POST['logFile'] != "") && preg_match("/^[a-z0-9\\/\\\\:\\._-]+$/i", $_POST['logFile'])) {
$cfg->logDestination = $_POST['logFile'];
- }
- else {
+ } else {
$errors[] = _("The log file is empty or contains invalid characters! Valid characters are: a-z, A-Z, 0-9, /, \\, ., :, _ and -.");
}
}
@@ -207,16 +202,14 @@ if (isset($_POST['submitFormData'])) {
if (isset($_POST['sslCaCertUpload'])) {
if (!isset($_FILES['sslCaCert']) || ($_FILES['sslCaCert']['size'] == 0)) {
$errors[] = _('No file selected.');
- }
- else {
+ } else {
$handle = fopen($_FILES['sslCaCert']['tmp_name'], "r");
$data = fread($handle, 10000000);
fclose($handle);
$sslReturn = $cfg->uploadSSLCaCert($data);
if ($sslReturn !== true) {
$errors[] = $sslReturn;
- }
- else {
+ } else {
$messages[] = _('You might need to restart your webserver for changes to take effect.');
}
}
@@ -237,12 +230,10 @@ if (isset($_POST['submitFormData'])) {
$messages[] = _('Imported certificate from server.');
$messages[] = _('You might need to restart your webserver for changes to take effect.');
$cfg->uploadSSLCaCert($pemResult);
- }
- else {
+ } else {
$errors[] = _('Unable to import server certificate. Please use the upload function.');
}
- }
- else {
+ } else {
$errors[] = _('Invalid server name. Please enter "server" or "server:port".');
}
}
@@ -270,264 +261,279 @@ if (isset($_POST['submitFormData'])) {
echo $_SESSION['header'];
printHeaderContents(_("Edit general settings"), '../..');
?>
-
-
-
-
-
-
-
+
+
-
+