LDAPAccountManager/lam/lib/2factor.inc

304 lines
9.7 KiB
PHP

<?php
namespace LAM\LIB\TWO_FACTOR;
use \selfServiceProfile;
use \LAMConfig;
/*
This code is part of LDAP Account Manager (http://www.ldap-account-manager.org/)
Copyright (C) 2017 Roland Gruber
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/**
* 2-factor authentication
*
* @package two_factor
* @author Roland Gruber
*/
interface TwoFactorProvider {
/**
* Returns a list of serial numbers of the user's tokens.
*
* @param string $user user name
* @param string $password password
* @throws \Exception error getting serials
*/
public function getSerials($user, $password);
/**
* Verifies if the provided 2nd factor is valid.
*
* @param string $user user name
* @param string $password password
* @param string $serial serial number of token
* @param string $twoFactorInput input for 2nd factor
* @return boolean true if verified and false if verification failed
* @throws \Exception error during check
*/
public function verify2ndFactor($user, $password, $serial, $twoFactorInput);
}
/**
* Provider for privacyIDEA.
*/
class PrivacyIDEAProvider implements TwoFactorProvider {
private $config;
/**
* Constructor.
*
* @param TwoFactorConfiguration $config configuration
*/
public function __construct(&$config) {
$this->config = $config;
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::getSerials()
*/
public function getSerials($user, $password) {
logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Getting serials for ' . $user);
$token = $this->authenticate($user, $password);
return $this->getSerialsForUser($user, $token);
}
/**
* {@inheritDoc}
* @see \LAM\LIB\TWO_FACTOR\TwoFactorProvider::verify2ndFactor()
*/
public function verify2ndFactor($user, $password, $serial, $twoFactorInput) {
logNewMessage(LOG_DEBUG, 'PrivacyIDEAProvider: Checking 2nd factor for ' . $user);
$token = $this->authenticate($user, $password);
return $this->verify($token, $serial, $twoFactorInput);
}
/**
* Authenticates against the server
*
* @param string $user user name
* @param string $password password
* @return string token
* @throws \Exception error during authentication
*/
private function authenticate($user, $password) {
$curl = $this->getCurl();
$url = $this->config->twoFactorAuthenticationURL . "/auth";
curl_setopt($curl, CURLOPT_URL, $url);
$header = array('Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$options = array(
'username' => $user,
'password' => $password,
);
curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
$json = curl_exec($curl);
curl_close($curl);
if (empty($json)) {
throw new \Exception("Unable to get server response from $url.");
}
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
if ($status != 1) {
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
throw new \Exception("Unable to login: " . $errCode . ' ' . $errMessage);
}
if (!isset($output->result->value) || !isset($output->result->value->token)) {
throw new \Exception("Unable to get token.");
}
return $output->result->value->token;
}
/**
* Returns the curl object.
*
* @return object curl handle
* @throws \Exception error during curl creation
*/
private function getCurl() {
$curl = curl_init();
if ($this->config->twoFactorAuthenticationInsecure) {
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 0);
}
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
return $curl;
}
/**
* Returns the serial numbers of the user.
*
* @param string $user user name
* @param string $token login token
* @throws \Exception error during serial reading
*/
private function getSerialsForUser($user, $token) {
$curl = $this->getCurl();
$url = $this->config->twoFactorAuthenticationURL . "/token/?user=" . $user;
curl_setopt($curl, CURLOPT_URL, $url);
$header = array('Authorization: ' . $token, 'Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$json = curl_exec($curl);
curl_close($curl);
if (empty($json)) {
throw new \Exception("Unable to get server response from $url.");
}
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
if (($status != 1) || !isset($output->result->value) || !isset($output->result->value->tokens)) {
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
throw new \Exception("Unable to get serials: " . $errCode . ' ' . $errMessage);
}
$serials = array();
foreach ($output->result->value->tokens as $tokenEntry) {
if (!isset($tokenEntry->active) || ($tokenEntry->active != 1) || !isset($tokenEntry->serial)) {
continue;
}
$serials[] = $tokenEntry->serial;
}
return $serials;
}
/**
* Verifies if the given 2nd factor input is valid.
*
* @param string $token login token
* @param string $serial serial number
* @param string $twoFactorInput 2factor pin + password
*/
private function verify($token, $serial, $twoFactorInput) {
$curl = $this->getCurl();
$url = $this->config->twoFactorAuthenticationURL . "/validate/check";
curl_setopt($curl, CURLOPT_URL, $url);
$options = array(
'pass' => $twoFactorInput,
'serial' => $serial,
);
curl_setopt($curl, CURLOPT_POSTFIELDS, $options);
$header = array('Authorization: ' . $token, 'Accept: application/json');
curl_setopt($curl, CURLOPT_HTTPHEADER, $header);
$json = curl_exec($curl);
curl_close($curl);
$output = json_decode($json);
if (empty($output) || !isset($output->result) || !isset($output->result->status) || !isset($output->result->value)) {
throw new \Exception("Unable to get json from $url.");
}
$status = $output->result->status;
$value = $output->result->value;
if (($status == 'true') && ($value == 'true')) {
return true;
}
$errCode = isset($output->result->error) && isset($output->result->error->code) ? $output->result->error->code : '';
$errMessage = isset($output->result->error) && isset($output->result->error->message) ? $output->result->error->message : '';
logNewMessage(LOG_DEBUG, "Unable to verify token: " . print_r($output, true));
return false;
}
}
/**
* Returns the correct 2 factor provider.
*/
class TwoFactorProviderService {
/** 2factor authentication disabled */
const TWO_FACTOR_NONE = 'none';
/** 2factor authentication via privacyIDEA */
const TWO_FACTOR_PRIVACYIDEA = 'privacyidea';
private $config;
/**
* Constructor.
*
* @param selfServiceProfile|LAMConfig $configObj profile
*/
public function __construct(&$configObj) {
if ($configObj instanceof selfServiceProfile) {
$this->config = $this->getConfigSelfService($configObj);
}
else {
$this->config = $this->getConfigAdmin($configObj);
}
}
/**
* Returns the provider for the given type.
*
* @param string $type authentication type
* @return TwoFactorProvider provider
* @throws \Exception unable to get provider
*/
public function getProvider() {
if ($this->config->twoFactorAuthentication == TwoFactorProviderService::TWO_FACTOR_PRIVACYIDEA) {
return new PrivacyIDEAProvider($this->config);
}
throw new \Exception('Invalid provider: ' . $this->config->twoFactorAuthentication);
}
/**
* Returns the configuration from self service.
*
* @param selfServiceProfile $profile profile
* @return TwoFactorConfiguration configuration
*/
private function getConfigSelfService(&$profile) {
$config = new TwoFactorConfiguration();
$config->twoFactorAuthentication = $profile->twoFactorAuthentication;
$config->twoFactorAuthenticationInsecure = $profile->twoFactorAuthenticationInsecure;
$config->twoFactorAuthenticationURL = $profile->twoFactorAuthenticationURL;
return $config;
}
/**
* Returns the configuration for admin interface.
*
* @param LAMConfig $conf configuration
* @return TwoFactorConfiguration configuration
*/
private function getConfigAdmin($conf) {
$config = new TwoFactorConfiguration();
$config->twoFactorAuthentication = $conf->getTwoFactorAuthentication();
$config->twoFactorAuthenticationInsecure = $conf->getTwoFactorAuthenticationInsecure();
$config->twoFactorAuthenticationURL = $conf->getTwoFactorAuthenticationURL();
return $config;
}
}
/**
* Configuration settings for 2-factor authentication.
*
* @author Roland Gruber
*/
class TwoFactorConfiguration {
public $twoFactorAuthentication = null;
public $twoFactorAuthenticationURL = null;
public $twoFactorAuthenticationInsecure = false;
}