diff --git a/lam/HISTORY b/lam/HISTORY index efff9345..50116e1e 100644 --- a/lam/HISTORY +++ b/lam/HISTORY @@ -1,3 +1,7 @@ +March 2017 + - 2-factor authentication for admin login and self service with privacyIDEA + + 18.12.2016 5.6 - New mechanism to replace wildcards in user edit screen. Personal/Unix support more wildcards like "$firstname". - Windows: added support for pager, otherPager, mobile, otherMobile, company and proxyAddresses (disabled by default in server profile) diff --git a/lam/docs/manual-sources/howto.xml b/lam/docs/manual-sources/howto.xml index 8dcca869..5039fdcc 100644 --- a/lam/docs/manual-sources/howto.xml +++ b/lam/docs/manual-sources/howto.xml @@ -8563,7 +8563,7 @@ OK (10 msec) Edit your new profile
- Basic settings + General settings On top of the page you see the link to the user login page. Copy this link address and give it to your users. @@ -8708,6 +8708,52 @@ OK (10 msec) + + + +
+ 2-factor authentication + + LAM supports 2-factor authentication for your users. This + means the user will not only authenticate by user+password but also + with e.g. a token generated by a mobile device. This adds more + security because the token is generated on a physically separated + device (typically mobile phone). + + The token is validated by a second application. LAM currently + supports: + + + + privacyIdea + + + + By default LAM will enforce to use a token and reject users + that did not setup one. You can set this check to optional. But if a + user has setup a token then this will always be required. + + + + + + + + + + After logging in with user + password LAM will ask for the 2nd + factor. If the user has setup multiple factors then he can choose + one of them. + + + + + + + + +
diff --git a/lam/docs/manual-sources/images/conf4.png b/lam/docs/manual-sources/images/conf4.png index 554cf0de..f26b45fb 100644 Binary files a/lam/docs/manual-sources/images/conf4.png and b/lam/docs/manual-sources/images/conf4.png differ diff --git a/lam/docs/manual-sources/images/conf7.png b/lam/docs/manual-sources/images/conf7.png new file mode 100644 index 00000000..718b0773 Binary files /dev/null and b/lam/docs/manual-sources/images/conf7.png differ diff --git a/lam/docs/manual-sources/images/conf8.png b/lam/docs/manual-sources/images/conf8.png new file mode 100644 index 00000000..9e00f2d3 Binary files /dev/null and b/lam/docs/manual-sources/images/conf8.png differ diff --git a/lam/help/help.inc b/lam/help/help.inc index 762936b2..0f04db9f 100644 --- a/lam/help/help.inc +++ b/lam/help/help.inc @@ -4,7 +4,7 @@ $Id$ This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/) Copyright (C) 2003 - 2006 Michael Duergner - 2003 - 2016 Roland Gruber + 2003 - 2017 Roland Gruber This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -279,6 +279,18 @@ $helpArray = array ( "Text" => _('Use this to enter an additional LDAP filter (e.g. "(objectClass=passwordSelfReset)") to reduce the number of accounts who may use self service.')), "513" => array ("Headline" => _('Use for all operations'), "Text" => _('By default all modifications are done as the user that authenticated in self service. If active then LAM will use the connection user for all LDAP modifications and searches.')), + "514" => array ("Headline" => _('2-factor authentication'), + "Text" => _('You can enable 2-factor authentication here (e.g. via mobile device).')), + "515" => array ("Headline" => _('2-factor base URL'), + "Text" => _('URL of external 2-factor authentication service.')), + "516" => array ("Headline" => _('Disable certificate check'), + "Text" => _('This will disable the check of the SSL certificates for the 2-factor authentication service. Not recommended for production usage.')), + "517" => array ("Headline" => _('Label'), + "Text" => _('Use this to overwrite the default label for the 2-factor input field. Default is "PIN+Token".')), + "518" => array ("Headline" => _('Caption'), + "Text" => _('This text is displayed on top of the 2-factor page. You can also input HTML code here.')), + "519" => array ("Headline" => _('Optional'), + "Text" => _('If checked then also users who did not setup a second factor are able to login.')), "520" => array ("Headline" => _("Generate random password"), "Text" => _("This will set a random password and display it on the screen or send it to the user via mail. Please edit your LAM server profile to setup the mail settings.")), "550" => array ("Headline" => _("From address"), diff --git a/lam/lib/2factor.inc b/lam/lib/2factor.inc new file mode 100644 index 00000000..7218178e --- /dev/null +++ b/lam/lib/2factor.inc @@ -0,0 +1,253 @@ +profile = $profile; + } + + /** + * {@inheritDoc} + * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials() + */ + public function getSerials($user, $password) { + logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user); + $token = $this->authenticate($user, $password); + return $this->getSerialsForUser($user, $token); + } + + /** + * {@inheritDoc} + * @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor() + */ + public function verify2ndFactor($user, $password, $serial, $twoFactorInput) { + logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user); + $token = $this->authenticate($user, $password); + return $this->verify($token, $serial, $twoFactorInput); + } + + /** + * Authenticates against the server + * + * @param string $user user name + * @param string $password password + * @return string token + * @throws \Exception error during authentication + */ + private function authenticate($user, $password) { + $curl = $this->getCurl(); + $url = $this->profile->twoFactorAuthenticationURL . "/auth"; + curl_setopt($curl, CURLOPT_URL, $url); + $header = array('Accept: application/json'); + curl_setopt($curl, CURLOPT_HTTPHEADER, $header); + $options = array( + 'username' => $user, + 'password' => $password, + ); + curl_setopt($curl, CURLOPT_POSTFIELDS, $options); + $json = curl_exec($curl); + curl_close($curl); + if (empty($json)) { + throw new \Exception("Unable to get server response from $url."); + } + $output = json_decode($json); + if (empty($output) || !isset($output->result) || !isset($output->result->status)) { + throw new \Exception("Unable to get json from $url."); + } + $status = $output->result->status; + if ($status != 1) { + $errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : ''; + $errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : ''; + throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage); + } + if (!isset($output->result->value) || !isset($output->result->value->token)) { + throw new \Exception("Unable to get token."); + } + return $output->result->value->token; + } + + /** + * Returns the curl object. + * + * @return object curl handle + * @throws \Exception error during curl creation + */ + private function getCurl() { + $curl = curl_init(); + if ($this->profile->twoFactorAuthenticationInsecure) { + curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false); + curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0); + } + curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); + return $curl; + } + + /** + * Returns the serial numbers of the user. + * + * @param string $user user name + * @param string $token login token + * @throws \Exception error during serial reading + */ + private function getSerialsForUser($user, $token) { + $curl = $this->getCurl(); + $url = $this->profile->twoFactorAuthenticationURL . "/token/?user=" . $user; + curl_setopt($curl, CURLOPT_URL, $url); + $header = array('Authorization: ' . $token, 'Accept: application/json'); + curl_setopt($curl, CURLOPT_HTTPHEADER, $header); + $json = curl_exec($curl); + curl_close($curl); + if (empty($json)) { + throw new \Exception("Unable to get server response from $url."); + } + $output = json_decode($json); + if (empty($output) || !isset($output->result) || !isset($output->result->status)) { + throw new \Exception("Unable to get json from $url."); + } + $status = $output->result->status; + if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) { + $errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : ''; + $errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : ''; + throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage); + } + $serials = array(); + foreach ($output->result->value->tokens as $tokenEntry) { + if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) { + continue; + } + $serials[] = $tokenEntry->serial; + } + return $serials; + } + + /** + * Verifies if the given 2nd factor input is valid. + * + * @param string $token login token + * @param string $serial serial number + * @param string $twoFactorInput 2factor pin + password + */ + private function verify($token, $serial, $twoFactorInput) { + $curl = $this->getCurl(); + $url = $this->profile->twoFactorAuthenticationURL . "/validate/check"; + curl_setopt($curl, CURLOPT_URL, $url); + $options = array( + 'pass' => $twoFactorInput, + 'serial' => $serial, + ); + curl_setopt($curl, CURLOPT_POSTFIELDS, $options); + $header = array('Authorization: ' . $token, 'Accept: application/json'); + curl_setopt($curl, CURLOPT_HTTPHEADER, $header); + $json = curl_exec($curl); + curl_close($curl); + $output = json_decode($json); + if (empty($output) || !isset($output->result) || !isset($output->result->status) || !isset($output->result->value)) { + throw new \Exception("Unable to get json from $url."); + } + $status = $output->result->status; + $value = $output->result->value; + if (($status == 'true') && ($value == 'true')) { + return true; + } + $errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : ''; + $errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : ''; + logNewMessage(LOG_DEBUG, "Unable to verify token: " . print_r($output, true)); + return false; + } + +} + +/** + * Returns the correct 2 factor provider. + */ +class TwoFactorProviderService { + + private $profile; + + /** + * Constructor. + * + * @param selfServiceProfile $profile profile + */ + public function __construct(&$profile) { + $this->profile = $profile; + } + + /** + * Returns the provider for the given type. + * + * @param string $type authentication type + * @return TwoFactorProvider provider + * @throws \Exception unable to get provider + */ + public function getProvider() { + if ($this->profile->twoFactorAuthentication == selfServiceProfile::TWO_FACTOR_PRIVACYIDEA) { + return new PrivacyIDEAProvider($this->profile); + } + throw new \Exception('Invalid provider: ' . $this->profile->twoFactorAuthentication); + } + +} diff --git a/lam/lib/security.inc b/lam/lib/security.inc index 1af098e3..5213ab8e 100644 --- a/lam/lib/security.inc +++ b/lam/lib/security.inc @@ -535,10 +535,11 @@ function validateSecurityToken($post = true) { * Adds a hidden input field to the given meta HTML table. * Should be used to add token at the end of table. * - * @param htmlTable $container table + * @param htmlTable|htmlGroup $container table */ function addSecurityTokenToMetaHTML(&$container) { - $container->addElement(new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]), true); + $token = new htmlHiddenInput(getSecurityTokenName(), $_SESSION[getSecurityTokenName()]); + $container->addElement($token, true); } /** diff --git a/lam/lib/selfService.inc b/lam/lib/selfService.inc index 2967b174..9c716439 100644 --- a/lam/lib/selfService.inc +++ b/lam/lib/selfService.inc @@ -3,7 +3,7 @@ $Id$ This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/) - Copyright (C) 2006 - 2016 Roland Gruber + Copyright (C) 2006 - 2017 Roland Gruber This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -302,6 +302,11 @@ function isSelfService() { */ class selfServiceProfile { + /** 2factor authentication disabled */ + const TWO_FACTOR_NONE = 'none'; + /** 2factor authentication via privacyIDEA */ + const TWO_FACTOR_PRIVACYIDEA = 'privacyidea'; + /** server address */ public $serverURL; @@ -376,6 +381,13 @@ class selfServiceProfile { public $timeZone = 'Europe/London'; + public $twoFactorAuthentication = selfServiceProfile::TWO_FACTOR_NONE; + public $twoFactorAuthenticationURL = 'https://localhost'; + public $twoFactorAuthenticationInsecure = false; + public $twoFactorAuthenticationLabel = null; + public $twoFactorAuthenticationOptional = false; + public $twoFactorAuthenticationCaption = ''; + /** * Constructor * @@ -413,6 +425,12 @@ class selfServiceProfile { $this->enforceLanguage = true; $this->followReferrals = 0; $this->timeZone = 'Europe/London'; + $this->twoFactorAuthentication = selfServiceProfile::TWO_FACTOR_NONE; + $this->twoFactorAuthenticationURL = 'https://localhost'; + $this->twoFactorAuthenticationInsecure = false; + $this->twoFactorAuthenticationLabel = null; + $this->twoFactorAuthenticationOptional = false; + $this->twoFactorAuthenticationCaption = ''; } }