added more 2-factor options

lam/help/help.inc

@@ -287,6 +287,10 @@ $helpArray = array (
 					"Text" => _('This will disable the check of the SSL certificates for the 2-factor authentication service. Not recommended for production usage.')),
 				"517" => array ("Headline" => _('Label'),
 					"Text" => _('Use this to overwrite the default label for the 2-factor input field. Default is "PIN+Token".')),
+				"518" => array ("Headline" => _('Caption'),
+					"Text" => _('This text is displayed on top of the 2-factor page. You can also input HTML code here.')),
+				"519" => array ("Headline" => _('Optional'),
+					"Text" => _('If checked then also users who did not setup a second factor are able to login.')),
 				"520" => array ("Headline" => _("Generate random password"),
 					"Text" => _("This will set a random password and display it on the screen or send it to the user via mail. Please edit your LAM server profile to setup the mail settings.")),
 				"550" => array ("Headline" => _("From address"),

lam/lib/2factor.inc

@@ -1,5 +1,7 @@
 <?php
 namespace LAM\LIB\TWO_FACTOR;
+use \selfServiceProfile;
+
 /*
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
   Copyright (C) 2017  Roland Gruber
@@ -28,53 +30,188 @@ namespace LAM\LIB\TWO_FACTOR;
 
 interface TwoFactorProvider {
 
+	/**
+	 * Returns a list of serial numbers of the user's tokens.
+	 *
+	 * @param string $user user name
+	 * @param string $password password
+	 * @throws \Exception error getting serials
+	 */
+	public function getSerials($user, $password);
+
 	/**
 	 * Verifies if the provided 2nd factor is valid.
 	 *
-	 * @param \selfServiceProfile $selfServiceProfile self service profile
 	 * @param string $user user name
 	 * @param string $password password
 	 * @param string $twoFactorInput input for 2nd factor
+	 * @return boolean true if verified and false if verification failed
 	 * @throws \Exception error during check
 	 */
-	public function verify2ndFactor($selfServiceProfile, $user, $password, $twoFactorInput);
+	public function verify2ndFactor($user, $password, $twoFactorInput);
 
 }
 
+/**
+ * Provider for privacyIDEA.
+ */
 class PrivacyIDEAProvider implements TwoFactorProvider {
 
+	private $profile;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param selfServiceProfile $profile profile
+	 */
+	public function __construct(&$profile) {
+		$this->profile = $profile;
+	}
+
+	/**
+	 * {@inheritDoc}
+	 * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
+	 */
+	public function getSerials($user, $password) {
+		logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user);
+		$token = $this->authenticate($user, $password);
+		return $this->getSerialsForUser($user, $token);
+	}
+
 	/**
 	 * {@inheritDoc}
 	 * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
 	 */
-	public function verify2ndFactor($selfServiceProfile, $user, $password, $twoFactorInput) {
+	public function verify2ndFactor($user, $password, $twoFactorInput) {
 		logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user);
-		$token = $this->authenticate($selfServiceProfile, $user, $password);
+		$token = $this->authenticate($user, $password);
+		return false;
 	}
 
 	/**
 	 * Authenticates against the server
 	 *
-	 * @param unknown $selfServiceProfile
-	 * @param unknown $user
-	 * @param unknown $password
+	 * @param string $user user name
+	 * @param string $password password
 	 * @return string token
 	 * @throws \Exception error during authentication
 	 */
-	private function authenticate($selfServiceProfile, $user, $password) {
-		$curl = $this->getCurl($selfServiceProfile);
+	private function authenticate($user, $password) {
+		$curl = $this->getCurl();
+		$url = $this->profile->twoFactorAuthenticationURL . "/auth";
+		curl_setopt($curl, CURLOPT_URL, $url);
+		$header = array('Accept: application/json');
+		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
+		$options = array(
+			'username' => $user,
+			'password' => $password,
+		);
+		curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
+		$json = curl_exec($curl);
+		curl_close($curl);
+		if (empty($json)) {
+			throw new \Exception("Unable to get server response from $url.");
+		}
+		$output = json_decode($json);
+		if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
+			throw new \Exception("Unable to get json from $url.");
+		}
+		$status = $output->result->status;
+		if ($status != 1) {
+			$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
+			$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
+			throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage);
+		}
+		if (!isset($output->result->value) || !isset($output->result->value->token)) {
+			throw new \Exception("Unable to get token.");
+		}
+		return $output->result->value->token;
 	}
 
 	/**
 	 * Returns the curl object.
 	 *
-	 * @param unknown $selfServiceProfile
 	 * @return object curl handle
 	 * @throws \Exception error during curl creation
 	 */
-	private function getCurl($selfServiceProfile) {
+	private function getCurl() {
 		$curl = curl_init();
+		if ($this->profile->twoFactorAuthenticationInsecure) {
+			curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
+			curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
+		}
+		curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
 		return $curl;
 	}
 
+	/**
+	 * Returns the serial numbers of the user.
+	 *
+	 * @param string $user user name
+	 * @param string $token login token
+	 * @throws \Exception error during serial reading
+	 */
+	private function getSerialsForUser($user, $token) {
+		$curl = $this->getCurl();
+		$url = $this->profile->twoFactorAuthenticationURL . "/token/?user=" . $user;
+		curl_setopt($curl, CURLOPT_URL, $url);
+		$header = array('Authorization: ' . $token, 'Accept: application/json');
+		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
+		$json = curl_exec($curl);
+		curl_close($curl);
+		if (empty($json)) {
+			throw new \Exception("Unable to get server response from $url.");
+		}
+		$output = json_decode($json);
+		if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
+			throw new \Exception("Unable to get json from $url.");
+		}
+		$status = $output->result->status;
+		if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) {
+			$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
+			$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
+			throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage);
+		}
+		$serials = array();
+		foreach ($output->result->value->tokens as $tokenEntry) {
+			if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) {
+				continue;
+			}
+			$serials[] = $tokenEntry->serial;
+		}
+		return $serials;
+	}
+
+}
+
+/**
+ * Returns the correct 2 factor provider.
+ */
+class TwoFactorProviderService {
+
+	private $profile;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param selfServiceProfile $profile profile
+	 */
+	public function __construct(&$profile) {
+		$this->profile = $profile;
+	}
+
+	/**
+	 * Returns the provider for the given type.
+	 *
+	 * @param string $type authentication type
+	 * @return TwoFactorProvider provider
+	 * @throws \Exception unable to get provider
+	 */
+	public function getProvider() {
+		if ($this->profile->twoFactorAuthentication == selfServiceProfile::TWO_FACTOR_PRIVACYIDEA) {
+			return new PrivacyIDEAProvider($this->profile);
+		}
+		throw new \Exception('Invalid provider: ' . $this->profile->twoFactorAuthentication);
+	}
+
 }

lam/lib/security.inc

@@ -535,10 +535,11 @@ function validateSecurityToken($post = true) {
  * Adds a hidden input field to the given meta HTML table.
  * Should be used to add token at the end of table.
  *
- * @param htmlTable $container table
+ * @param htmlTable|htmlGroup $container table
  */
 function addSecurityTokenToMetaHTML(&$container) {
-	$container->addElement(new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]), true);
+	$token = new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]);
+	$container->addElement($token, true);
 }
 
 /**

lam/lib/selfService.inc

@@ -385,6 +385,8 @@ class selfServiceProfile {
 	public $twoFactorAuthenticationURL = 'https://localhost';
 	public $twoFactorAuthenticationInsecure = false;
 	public $twoFactorAuthenticationLabel = null;
+	public $twoFactorAuthenticationOptional = false;
+	public $twoFactorAuthenticationCaption = '';
 
 	/**
 	 * Constructor
@@ -427,6 +429,8 @@ class selfServiceProfile {
 		$this->twoFactorAuthenticationURL = 'https://localhost';
 		$this->twoFactorAuthenticationInsecure = false;
 		$this->twoFactorAuthenticationLabel = null;
+		$this->twoFactorAuthenticationOptional = false;
+		$this->twoFactorAuthenticationCaption = '';
 	}
 
 }