From 61f75e1dfa4b891fd0a7fc288adaf4c5b562834b Mon Sep 17 00:00:00 2001 From: Roland Gruber Date: Tue, 31 Jan 2017 20:50:51 +0100 Subject: [PATCH] added more 2-factor options --- lam/help/help.inc | 4 + lam/lib/2factor.inc | 159 +++++++++++++++++++++++++++++++++++++--- lam/lib/security.inc | 5 +- lam/lib/selfService.inc | 4 + 4 files changed, 159 insertions(+), 13 deletions(-) diff --git a/lam/help/help.inc b/lam/help/help.inc index 455cd87c..0f04db9f 100644 --- a/lam/help/help.inc +++ b/lam/help/help.inc @@ -287,6 +287,10 @@ $helpArray = array ( "Text" => _('This will disable the check of the SSL certificates for the 2-factor authentication service. Not recommended for production usage.')), "517" => array ("Headline" => _('Label'), "Text" => _('Use this to overwrite the default label for the 2-factor input field. Default is "PIN+Token".')), + "518" => array ("Headline" => _('Caption'), + "Text" => _('This text is displayed on top of the 2-factor page. You can also input HTML code here.')), + "519" => array ("Headline" => _('Optional'), + "Text" => _('If checked then also users who did not setup a second factor are able to login.')), "520" => array ("Headline" => _("Generate random password"), "Text" => _("This will set a random password and display it on the screen or send it to the user via mail. Please edit your LAM server profile to setup the mail settings.")), "550" => array ("Headline" => _("From address"), diff --git a/lam/lib/2factor.inc b/lam/lib/2factor.inc index 7ee11872..1dec7927 100644 --- a/lam/lib/2factor.inc +++ b/lam/lib/2factor.inc @@ -1,5 +1,7 @@ profile = $profile; + } + + /** + * {@inheritDoc} + * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials() + */ + public function getSerials($user, $password) { + logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user); + $token = $this->authenticate($user, $password); + return $this->getSerialsForUser($user, $token); + } + /** * {@inheritDoc} * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor() */ - public function verify2ndFactor($selfServiceProfile, $user, $password, $twoFactorInput) { + public function verify2ndFactor($user, $password, $twoFactorInput) { logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user); - $token = $this->authenticate($selfServiceProfile, $user, $password); + $token = $this->authenticate($user, $password); + return false; } /** * Authenticates against the server * - * @param unknown $selfServiceProfile - * @param unknown $user - * @param unknown $password + * @param string $user user name + * @param string $password password * @return string token * @throws \Exception error during authentication */ - private function authenticate($selfServiceProfile, $user, $password) { - $curl = $this->getCurl($selfServiceProfile); + private function authenticate($user, $password) { + $curl = $this->getCurl(); + $url = $this->profile->twoFactorAuthenticationURL . "/auth"; + curl_setopt($curl, CURLOPT_URL, $url); + $header = array('Accept: application/json'); + curl_setopt($curl, CURLOPT_HTTPHEADER, $header); + $options = array( + 'username' => $user, + 'password' => $password, + ); + curl_setopt($curl, CURLOPT_POSTFIELDS, $options); + $json = curl_exec($curl); + curl_close($curl); + if (empty($json)) { + throw new \Exception("Unable to get server response from $url."); + } + $output = json_decode($json); + if (empty($output) || !isset($output->result) || !isset($output->result->status)) { + throw new \Exception("Unable to get json from $url."); + } + $status = $output->result->status; + if ($status != 1) { + $errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : ''; + $errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : ''; + throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage); + } + if (!isset($output->result->value) || !isset($output->result->value->token)) { + throw new \Exception("Unable to get token."); + } + return $output->result->value->token; } /** * Returns the curl object. * - * @param unknown $selfServiceProfile * @return object curl handle * @throws \Exception error during curl creation */ - private function getCurl($selfServiceProfile) { + private function getCurl() { $curl = curl_init(); + if ($this->profile->twoFactorAuthenticationInsecure) { + curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0); + } + curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); return $curl; } + /** + * Returns the serial numbers of the user. + * + * @param string $user user name + * @param string $token login token + * @throws \Exception error during serial reading + */ + private function getSerialsForUser($user, $token) { + $curl = $this->getCurl(); + $url = $this->profile->twoFactorAuthenticationURL . "/token/?user=" . $user; + curl_setopt($curl, CURLOPT_URL, $url); + $header = array('Authorization: ' . $token, 'Accept: application/json'); + curl_setopt($curl, CURLOPT_HTTPHEADER, $header); + $json = curl_exec($curl); + curl_close($curl); + if (empty($json)) { + throw new \Exception("Unable to get server response from $url."); + } + $output = json_decode($json); + if (empty($output) || !isset($output->result) || !isset($output->result->status)) { + throw new \Exception("Unable to get json from $url."); + } + $status = $output->result->status; + if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) { + $errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : ''; + $errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : ''; + throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage); + } + $serials = array(); + foreach ($output->result->value->tokens as $tokenEntry) { + if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) { + continue; + } + $serials[] = $tokenEntry->serial; + } + return $serials; + } + +} + +/** + * Returns the correct 2 factor provider. + */ +class TwoFactorProviderService { + + private $profile; + + /** + * Constructor. + * + * @param selfServiceProfile $profile profile + */ + public function __construct(&$profile) { + $this->profile = $profile; + } + + /** + * Returns the provider for the given type. + * + * @param string $type authentication type + * @return TwoFactorProvider provider + * @throws \Exception unable to get provider + */ + public function getProvider() { + if ($this->profile->twoFactorAuthentication == selfServiceProfile::TWO_FACTOR_PRIVACYIDEA) { + return new PrivacyIDEAProvider($this->profile); + } + throw new \Exception('Invalid provider: ' . $this->profile->twoFactorAuthentication); + } + } diff --git a/lam/lib/security.inc b/lam/lib/security.inc index 1af098e3..5213ab8e 100644 --- a/lam/lib/security.inc +++ b/lam/lib/security.inc @@ -535,10 +535,11 @@ function validateSecurityToken($post = true) { * Adds a hidden input field to the given meta HTML table. * Should be used to add token at the end of table. * - * @param htmlTable $container table + * @param htmlTable|htmlGroup $container table */ function addSecurityTokenToMetaHTML(&$container) { - $container->addElement(new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]), true); + $token = new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]); + $container->addElement($token, true); } /** diff --git a/lam/lib/selfService.inc b/lam/lib/selfService.inc index a819f0b2..9c716439 100644 --- a/lam/lib/selfService.inc +++ b/lam/lib/selfService.inc @@ -385,6 +385,8 @@ class selfServiceProfile { public $twoFactorAuthenticationURL = 'https://localhost'; public $twoFactorAuthenticationInsecure = false; public $twoFactorAuthenticationLabel = null; + public $twoFactorAuthenticationOptional = false; + public $twoFactorAuthenticationCaption = ''; /** * Constructor @@ -427,6 +429,8 @@ class selfServiceProfile { $this->twoFactorAuthenticationURL = 'https://localhost'; $this->twoFactorAuthenticationInsecure = false; $this->twoFactorAuthenticationLabel = null; + $this->twoFactorAuthenticationOptional = false; + $this->twoFactorAuthenticationCaption = ''; } }