Merge pull request #23 from LDAPAccountManager/2factor_auth

2factor auth

lam/HISTORY

@@ -1,3 +1,7 @@
+March 2017
+  - 2-factor authentication for admin login and self service with privacyIDEA
+
+
 18.12.2016 5.6
   - New mechanism to replace wildcards in user edit screen. Personal/Unix support more wildcards like "$firstname".
   - Windows: added support for pager, otherPager, mobile, otherMobile, company and proxyAddresses (disabled by default in server profile)

lam/docs/manual-sources/howto.xml

@@ -8563,7 +8563,7 @@ OK (10 msec)</programlisting>
       <title>Edit your new profile</title>
 
       <section id="selfServiceBasicSettings">
-        <title>Basic settings</title>
+        <title>General settings</title>
 
         <para>On top of the page you see the link to the user login page. Copy
         this link address and give it to your users.</para>
@@ -8708,6 +8708,52 @@ OK (10 msec)</programlisting>
             </tbody>
           </tgroup>
         </table>
+
+        <para></para>
+
+        <section>
+          <title>2-factor authentication</title>
+
+          <para>LAM supports 2-factor authentication for your users. This
+          means the user will not only authenticate by user+password but also
+          with e.g. a token generated by a mobile device. This adds more
+          security because the token is generated on a physically separated
+          device (typically mobile phone).</para>
+
+          <para>The token is validated by a second application. LAM currently
+          supports:</para>
+
+          <itemizedlist>
+            <listitem>
+              <para><ulink
+              url="https://www.privacyidea.org/">privacyIdea</ulink></para>
+            </listitem>
+          </itemizedlist>
+
+          <para>By default LAM will enforce to use a token and reject users
+          that did not setup one. You can set this check to optional. But if a
+          user has setup a token then this will always be required.</para>
+
+          <screenshot>
+            <mediaobject>
+              <imageobject>
+                <imagedata fileref="images/conf7.png" />
+              </imageobject>
+            </mediaobject>
+          </screenshot>
+
+          <para>After logging in with user + password LAM will ask for the 2nd
+          factor. If the user has setup multiple factors then he can choose
+          one of them.</para>
+
+          <screenshot>
+            <mediaobject>
+              <imageobject>
+                <imagedata fileref="images/conf8.png" />
+              </imageobject>
+            </mediaobject>
+          </screenshot>
+        </section>
       </section>
 
       <section>

lam/help/help.inc

@@ -4,7 +4,7 @@ $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
   Copyright (C) 2003 - 2006 Michael Duergner
-                2003 - 2016 Roland Gruber
+                2003 - 2017 Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -279,6 +279,18 @@ $helpArray = array (
 					"Text" => _('Use this to enter an additional LDAP filter (e.g. "(objectClass=passwordSelfReset)") to reduce the number of accounts who may use self service.')),
 				"513" => array ("Headline" => _('Use for all operations'),
 					"Text" => _('By default all modifications are done as the user that authenticated in self service. If active then LAM will use the connection user for all LDAP modifications and searches.')),
+				"514" => array ("Headline" => _('2-factor authentication'),
+					"Text" => _('You can enable 2-factor authentication here (e.g. via mobile device).')),
+				"515" => array ("Headline" => _('2-factor base URL'),
+					"Text" => _('URL of external 2-factor authentication service.')),
+				"516" => array ("Headline" => _('Disable certificate check'),
+					"Text" => _('This will disable the check of the SSL certificates for the 2-factor authentication service. Not recommended for production usage.')),
+				"517" => array ("Headline" => _('Label'),
+					"Text" => _('Use this to overwrite the default label for the 2-factor input field. Default is "PIN+Token".')),
+				"518" => array ("Headline" => _('Caption'),
+					"Text" => _('This text is displayed on top of the 2-factor page. You can also input HTML code here.')),
+				"519" => array ("Headline" => _('Optional'),
+					"Text" => _('If checked then also users who did not setup a second factor are able to login.')),
 				"520" => array ("Headline" => _("Generate random password"),
 					"Text" => _("This will set a random password and display it on the screen or send it to the user via mail. Please edit your LAM server profile to setup the mail settings.")),
 				"550" => array ("Headline" => _("From address"),

lam/lib/2factor.inc

@@ -0,0 +1,253 @@
+<?php
+namespace LAM\LIB\TWO_FACTOR;
+use \selfServiceProfile;
+
+/*
+  This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
+  Copyright (C) 2017  Roland Gruber
+
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+
+  This program is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+*/
+
+/**
+* 2-factor authentication
+*
+* @package two_factor
+* @author Roland Gruber
+*/
+
+interface TwoFactorProvider {
+
+	/**
+	 * Returns a list of serial numbers of the user's tokens.
+	 *
+	 * @param string $user user name
+	 * @param string $password password
+	 * @throws \Exception error getting serials
+	 */
+	public function getSerials($user, $password);
+
+	/**
+	 * Verifies if the provided 2nd factor is valid.
+	 *
+	 * @param string $user user name
+	 * @param string $password password
+	 * @param string $serial serial number of token
+	 * @param string $twoFactorInput input for 2nd factor
+	 * @return boolean true if verified and false if verification failed
+	 * @throws \Exception error during check
+	 */
+	public function verify2ndFactor($user, $password, $serial, $twoFactorInput);
+
+}
+
+/**
+ * Provider for privacyIDEA.
+ */
+class PrivacyIDEAProvider implements TwoFactorProvider {
+
+	private $profile;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param selfServiceProfile $profile profile
+	 */
+	public function __construct(&$profile) {
+		$this->profile = $profile;
+	}
+
+	/**
+	 * {@inheritDoc}
+	 * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
+	 */
+	public function getSerials($user, $password) {
+		logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user);
+		$token = $this->authenticate($user, $password);
+		return $this->getSerialsForUser($user, $token);
+	}
+
+	/**
+	 * {@inheritDoc}
+	 * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
+	 */
+	public function verify2ndFactor($user, $password, $serial, $twoFactorInput) {
+		logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user);
+		$token = $this->authenticate($user, $password);
+		return $this->verify($token, $serial, $twoFactorInput);
+	}
+
+	/**
+	 * Authenticates against the server
+	 *
+	 * @param string $user user name
+	 * @param string $password password
+	 * @return string token
+	 * @throws \Exception error during authentication
+	 */
+	private function authenticate($user, $password) {
+		$curl = $this->getCurl();
+		$url = $this->profile->twoFactorAuthenticationURL . "/auth";
+		curl_setopt($curl, CURLOPT_URL, $url);
+		$header = array('Accept: application/json');
+		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
+		$options = array(
+			'username' => $user,
+			'password' => $password,
+		);
+		curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
+		$json = curl_exec($curl);
+		curl_close($curl);
+		if (empty($json)) {
+			throw new \Exception("Unable to get server response from $url.");
+		}
+		$output = json_decode($json);
+		if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
+			throw new \Exception("Unable to get json from $url.");
+		}
+		$status = $output->result->status;
+		if ($status != 1) {
+			$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
+			$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
+			throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage);
+		}
+		if (!isset($output->result->value) || !isset($output->result->value->token)) {
+			throw new \Exception("Unable to get token.");
+		}
+		return $output->result->value->token;
+	}
+
+	/**
+	 * Returns the curl object.
+	 *
+	 * @return object curl handle
+	 * @throws \Exception error during curl creation
+	 */
+	private function getCurl() {
+		$curl = curl_init();
+		if ($this->profile->twoFactorAuthenticationInsecure) {
+			curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
+			curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
+		}
+		curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
+		return $curl;
+	}
+
+	/**
+	 * Returns the serial numbers of the user.
+	 *
+	 * @param string $user user name
+	 * @param string $token login token
+	 * @throws \Exception error during serial reading
+	 */
+	private function getSerialsForUser($user, $token) {
+		$curl = $this->getCurl();
+		$url = $this->profile->twoFactorAuthenticationURL . "/token/?user=" . $user;
+		curl_setopt($curl, CURLOPT_URL, $url);
+		$header = array('Authorization: ' . $token, 'Accept: application/json');
+		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
+		$json = curl_exec($curl);
+		curl_close($curl);
+		if (empty($json)) {
+			throw new \Exception("Unable to get server response from $url.");
+		}
+		$output = json_decode($json);
+		if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
+			throw new \Exception("Unable to get json from $url.");
+		}
+		$status = $output->result->status;
+		if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) {
+			$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
+			$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
+			throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage);
+		}
+		$serials = array();
+		foreach ($output->result->value->tokens as $tokenEntry) {
+			if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) {
+				continue;
+			}
+			$serials[] = $tokenEntry->serial;
+		}
+		return $serials;
+	}
+
+	/**
+	 * Verifies if the given 2nd factor input is valid.
+	 *
+	 * @param string $token login token
+	 * @param string $serial serial number
+	 * @param string $twoFactorInput 2factor pin + password
+	 */
+	private function verify($token, $serial, $twoFactorInput) {
+		$curl = $this->getCurl();
+		$url = $this->profile->twoFactorAuthenticationURL . "/validate/check";
+		curl_setopt($curl, CURLOPT_URL, $url);
+		$options = array(
+			'pass' => $twoFactorInput,
+			'serial' => $serial,
+		);
+		curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
+		$header = array('Authorization: ' . $token, 'Accept: application/json');
+		curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
+		$json = curl_exec($curl);
+		curl_close($curl);
+		$output = json_decode($json);
+		if (empty($output) || !isset($output->result) || !isset($output->result->status) || !isset($output->result->value)) {
+			throw new \Exception("Unable to get json from $url.");
+		}
+		$status = $output->result->status;
+		$value = $output->result->value;
+		if (($status == 'true') && ($value == 'true')) {
+			return true;
+		}
+		$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
+		$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
+		logNewMessage(LOG_DEBUG, "Unable to verify token: " . print_r($output, true));
+		return false;
+	}
+
+}
+
+/**
+ * Returns the correct 2 factor provider.
+ */
+class TwoFactorProviderService {
+
+	private $profile;
+
+	/**
+	 * Constructor.
+	 *
+	 * @param selfServiceProfile $profile profile
+	 */
+	public function __construct(&$profile) {
+		$this->profile = $profile;
+	}
+
+	/**
+	 * Returns the provider for the given type.
+	 *
+	 * @param string $type authentication type
+	 * @return TwoFactorProvider provider
+	 * @throws \Exception unable to get provider
+	 */
+	public function getProvider() {
+		if ($this->profile->twoFactorAuthentication == selfServiceProfile::TWO_FACTOR_PRIVACYIDEA) {
+			return new PrivacyIDEAProvider($this->profile);
+		}
+		throw new \Exception('Invalid provider: ' . $this->profile->twoFactorAuthentication);
+	}
+
+}

lam/lib/security.inc

@@ -535,10 +535,11 @@ function validateSecurityToken($post = true) {
  * Adds a hidden input field to the given meta HTML table.
  * Should be used to add token at the end of table.
  *
- * @param htmlTable $container table
+ * @param htmlTable|htmlGroup $container table
  */
 function addSecurityTokenToMetaHTML(&$container) {
-	$container->addElement(new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]), true);
+	$token = new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]);
+	$container->addElement($token, true);
 }
 
 /**

lam/lib/selfService.inc

@@ -3,7 +3,7 @@
 $Id$
 
   This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
-  Copyright (C) 2006 - 2016  Roland Gruber
+  Copyright (C) 2006 - 2017  Roland Gruber
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
@@ -302,6 +302,11 @@ function isSelfService() {
  */
 class selfServiceProfile {
 
+	/** 2factor authentication disabled */
+	const TWO_FACTOR_NONE = 'none';
+	/** 2factor authentication via privacyIDEA */
+	const TWO_FACTOR_PRIVACYIDEA = 'privacyidea';
+
 	/** server address */
 	public $serverURL;
 
@@ -376,6 +381,13 @@ class selfServiceProfile {
 
 	public $timeZone = 'Europe/London';
 
+	public $twoFactorAuthentication = selfServiceProfile::TWO_FACTOR_NONE;
+	public $twoFactorAuthenticationURL = 'https://localhost';
+	public $twoFactorAuthenticationInsecure = false;
+	public $twoFactorAuthenticationLabel = null;
+	public $twoFactorAuthenticationOptional = false;
+	public $twoFactorAuthenticationCaption = '';
+
 	/**
 	 * Constructor
 	 *
@@ -413,6 +425,12 @@ class selfServiceProfile {
 		$this->enforceLanguage = true;
 		$this->followReferrals = 0;
 		$this->timeZone = 'Europe/London';
+		$this->twoFactorAuthentication = selfServiceProfile::TWO_FACTOR_NONE;
+		$this->twoFactorAuthenticationURL = 'https://localhost';
+		$this->twoFactorAuthenticationInsecure = false;
+		$this->twoFactorAuthenticationLabel = null;
+		$this->twoFactorAuthenticationOptional = false;
+		$this->twoFactorAuthenticationCaption = '';
 	}
 
 }