added more 2-factor options

This commit is contained in:
Roland Gruber 2017-01-31 20:50:51 +01:00
parent b3a917255d
commit 61f75e1dfa
4 changed files with 159 additions and 13 deletions

View File

@ -287,6 +287,10 @@ $helpArray = array (
"Text" => _('This will disable the check of the SSL certificates for the 2-factor authentication service. Not recommended for production usage.')), "Text" => _('This will disable the check of the SSL certificates for the 2-factor authentication service. Not recommended for production usage.')),
"517" => array ("Headline" => _('Label'), "517" => array ("Headline" => _('Label'),
"Text" => _('Use this to overwrite the default label for the 2-factor input field. Default is "PIN+Token".')), "Text" => _('Use this to overwrite the default label for the 2-factor input field. Default is "PIN+Token".')),
"518" => array ("Headline" => _('Caption'),
"Text" => _('This text is displayed on top of the 2-factor page. You can also input HTML code here.')),
"519" => array ("Headline" => _('Optional'),
"Text" => _('If checked then also users who did not setup a second factor are able to login.')),
"520" => array ("Headline" => _("Generate random password"), "520" => array ("Headline" => _("Generate random password"),
"Text" => _("This will set a random password and display it on the screen or send it to the user via mail. Please edit your LAM server profile to setup the mail settings.")), "Text" => _("This will set a random password and display it on the screen or send it to the user via mail. Please edit your LAM server profile to setup the mail settings.")),
"550" => array ("Headline" => _("From address"), "550" => array ("Headline" => _("From address"),

View File

@ -1,5 +1,7 @@
<?php <?php
namespace LAM\LIB\TWO_FACTOR; namespace LAM\LIB\TWO_FACTOR;
use \selfServiceProfile;
/* /*
This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/) This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
Copyright (C) 2017 Roland Gruber Copyright (C) 2017 Roland Gruber
@ -28,53 +30,188 @@ namespace LAM\LIB\TWO_FACTOR;
interface TwoFactorProvider { interface TwoFactorProvider {
/**
* Returns a list of serial numbers of the user's tokens.
*
* @param string $user user name
* @param string $password password
* @throws \Exception error getting serials
*/
public function getSerials($user, $password);
/** /**
* Verifies if the provided 2nd factor is valid. * Verifies if the provided 2nd factor is valid.
* *
* @param \selfServiceProfile $selfServiceProfile self service profile
* @param string $user user name * @param string $user user name
* @param string $password password * @param string $password password
* @param string $twoFactorInput input for 2nd factor * @param string $twoFactorInput input for 2nd factor
* @return boolean true if verified and false if verification failed
* @throws \Exception error during check * @throws \Exception error during check
*/ */
public function verify2ndFactor($selfServiceProfile, $user, $password, $twoFactorInput); public function verify2ndFactor($user, $password, $twoFactorInput);
} }
/**
* Provider for privacyIDEA.
*/
class PrivacyIDEAProvider implements TwoFactorProvider { class PrivacyIDEAProvider implements TwoFactorProvider {
private $profile;
/**
* Constructor.
*
* @param selfServiceProfile $profile profile
*/
public function __construct(&$profile) {
$this->profile = $profile;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
*/
public function getSerials($user, $password) {
logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user);
$token = $this->authenticate($user, $password);
return $this->getSerialsForUser($user, $token);
}
/** /**
* {@inheritDoc} * {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor() * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
*/ */
public function verify2ndFactor($selfServiceProfile, $user, $password, $twoFactorInput) { public function verify2ndFactor($user, $password, $twoFactorInput) {
logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user); logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user);
$token = $this->authenticate($selfServiceProfile, $user, $password); $token = $this->authenticate($user, $password);
return false;
} }
/** /**
* Authenticates against the server * Authenticates against the server
* *
* @param unknown $selfServiceProfile * @param string $user user name
* @param unknown $user * @param string $password password
* @param unknown $password
* @return string token * @return string token
* @throws \Exception error during authentication * @throws \Exception error during authentication
*/ */
private function authenticate($selfServiceProfile, $user, $password) { private function authenticate($user, $password) {
$curl = $this->getCurl($selfServiceProfile); $curl = $this->getCurl();
$url = $this->profile->twoFactorAuthenticationURL . "/auth";
curl_setopt($curl, CURLOPT_URL, $url);
$header = array('Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$options = array(
'username' => $user,
'password' => $password,
);
curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
$json = curl_exec($curl);
curl_close($curl);
if (empty($json)) {
throw new \Exception("Unable to get server response from $url.");
}
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
if ($status != 1) {
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage);
}
if (!isset($output->result->value) || !isset($output->result->value->token)) {
throw new \Exception("Unable to get token.");
}
return $output->result->value->token;
} }
/** /**
* Returns the curl object. * Returns the curl object.
* *
* @param unknown $selfServiceProfile
* @return object curl handle * @return object curl handle
* @throws \Exception error during curl creation * @throws \Exception error during curl creation
*/ */
private function getCurl($selfServiceProfile) { private function getCurl() {
$curl = curl_init(); $curl = curl_init();
if ($this->profile->twoFactorAuthenticationInsecure) {
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
}
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
return $curl; return $curl;
} }
/**
* Returns the serial numbers of the user.
*
* @param string $user user name
* @param string $token login token
* @throws \Exception error during serial reading
*/
private function getSerialsForUser($user, $token) {
$curl = $this->getCurl();
$url = $this->profile->twoFactorAuthenticationURL . "/token/?user=" . $user;
curl_setopt($curl, CURLOPT_URL, $url);
$header = array('Authorization: ' . $token, 'Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$json = curl_exec($curl);
curl_close($curl);
if (empty($json)) {
throw new \Exception("Unable to get server response from $url.");
}
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) {
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage);
}
$serials = array();
foreach ($output->result->value->tokens as $tokenEntry) {
if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) {
continue;
}
$serials[] = $tokenEntry->serial;
}
return $serials;
}
}
/**
* Returns the correct 2 factor provider.
*/
class TwoFactorProviderService {
private $profile;
/**
* Constructor.
*
* @param selfServiceProfile $profile profile
*/
public function __construct(&$profile) {
$this->profile = $profile;
}
/**
* Returns the provider for the given type.
*
* @param string $type authentication type
* @return TwoFactorProvider provider
* @throws \Exception unable to get provider
*/
public function getProvider() {
if ($this->profile->twoFactorAuthentication == selfServiceProfile::TWO_FACTOR_PRIVACYIDEA) {
return new PrivacyIDEAProvider($this->profile);
}
throw new \Exception('Invalid provider: ' . $this->profile->twoFactorAuthentication);
}
} }

View File

@ -535,10 +535,11 @@ function validateSecurityToken($post = true) {
* Adds a hidden input field to the given meta HTML table. * Adds a hidden input field to the given meta HTML table.
* Should be used to add token at the end of table. * Should be used to add token at the end of table.
* *
* @param htmlTable $container table * @param htmlTable|htmlGroup $container table
*/ */
function addSecurityTokenToMetaHTML(&$container) { function addSecurityTokenToMetaHTML(&$container) {
$container->addElement(new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]), true); $token = new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]);
$container->addElement($token, true);
} }
/** /**

View File

@ -385,6 +385,8 @@ class selfServiceProfile {
public $twoFactorAuthenticationURL = 'https://localhost'; public $twoFactorAuthenticationURL = 'https://localhost';
public $twoFactorAuthenticationInsecure = false; public $twoFactorAuthenticationInsecure = false;
public $twoFactorAuthenticationLabel = null; public $twoFactorAuthenticationLabel = null;
public $twoFactorAuthenticationOptional = false;
public $twoFactorAuthenticationCaption = '';
/** /**
* Constructor * Constructor
@ -427,6 +429,8 @@ class selfServiceProfile {
$this->twoFactorAuthenticationURL = 'https://localhost'; $this->twoFactorAuthenticationURL = 'https://localhost';
$this->twoFactorAuthenticationInsecure = false; $this->twoFactorAuthenticationInsecure = false;
$this->twoFactorAuthenticationLabel = null; $this->twoFactorAuthenticationLabel = null;
$this->twoFactorAuthenticationOptional = false;
$this->twoFactorAuthenticationCaption = '';
} }
} }