X-Git-Url: https://git-public.kairo.at/?a=blobdiff_plain;f=app%2Fauthutils.php-class;h=d2737d9d7ebb3e6ff1326060fdee92368e0d3422;hb=refs%2Fheads%2Fmaster;hp=690d5e7a82e832f2ea6f720e9a396b59551f011f;hpb=74b24877f2b3e75aa00e7788b4ed23209e81991d;p=authserver.git
diff --git a/app/authutils.php-class b/app/authutils.php-class
index 690d5e7..17eb8da 100755
--- a/app/authutils.php-class
+++ b/app/authutils.php-class
@@ -7,12 +7,11 @@ class AuthUtils {
// KaiRo.at authentication utilities PHP class
// This class contains helper functions for the authentication system.
//
- // function __construct($settings)
+ // function __construct()
// CONSTRUCTOR
- // Settings are an associative array with a numeric pwd_cost field and an array pwd_nonces field.
//
// public $settings
- // Ab array of settings for the auth server website.
+ // An array of settings for the auth server website.
//
// public $db
// A PDO database object for interaction.
@@ -107,26 +106,70 @@ class AuthUtils {
// function appendLoginForm($dom_element, $session, $user, [$addfields])
// Append a login form for the given session to the given DOM element, possibly prefilling the email from the given user info array.
// The optional $addfields parameter is an array of name=>value pairs of hidden fields to add to the form.
+ //
+ // function updateDBSchema()
+ // update DB Schema to current requirements as specified by getDBSchema().
+ //
+ // function getDBSchema()
+ // Return a DB schema with all tables, fields, etc. that the app requires.
- function __construct($settings) {
+ function __construct() {
// *** constructor ***
- $this->settings = $settings;
- $this->db = new PDO($this->settings['dbdata']['dsn'], $this->settings['dbdata']['username'], $this->settings['dbdata']['password']);
- $this->db->exec("SET time_zone='+00:00';"); // Execute directly on PDO object, set session to UTC to make our gmdate() values match correctly.
+ $this->settings = json_decode(@file_get_contents('/etc/kairo/auth_settings.json'), true);
+ if (!is_array($this->settings)) { throw new ErrorException('Authentication system settings not found', 0); }
+
+ // Sanitize settings.
+ $this->settings['piwik_enabled'] = $this->settings['piwik_enabled'] ?? false;
+ $this->settings['piwik_site_id'] = intval($this->settings['piwik_site_id'] ?? 0);
+ $this->settings['piwik_url'] = strlen($this->settings['piwik_url'] ?? '') ? $this->settings['piwik_url'] : '/matomo/';
+ $this->settings['piwik_tracker_path'] = strlen($this->settings['piwik_tracker_path'] ?? '') ? $this->settings['piwik_tracker_path'] : '../vendor/matomo/matomo-php-tracker/';
+ $this->settings['skin'] = (($this->settings['skin'] ?? false) && is_dir('skin/'.$this->settings['skin'])) ? $this->settings['skin'] : 'default';
+ $this->settings['operator_name'] = $this->settings['operator_name'] ?? 'Example';
+ $this->settings['operator_contact_url'] = $this->settings['operator_contact_url'] ?? 'https://github.com/KaiRo_at/authserver/';
+ $this->settings['info_from_email'] = $this->settings['info_from_email'] ?? 'noreply@example.com';
+
+ // Initialize database.
+ $config = new \Doctrine\DBAL\Configuration();
+ $connectionParams = array(
+ 'dbname' => $this->settings['db_name'],
+ 'user' => $this->settings['db_username'],
+ 'password' => $this->settings['db_password'],
+ 'host' => $this->settings['db_host'],
+ 'driver' => 'pdo_mysql',
+ );
+ $this->db = \Doctrine\DBAL\DriverManager::getConnection($connectionParams, $config);
+ $this->db->executeQuery('SET time_zone = "+00:00";'); // Make sure the DB runs on UTC for this connection.
+ // Update DB schema if needed (if the utils PHP file has been changed since we last checked the DB, we trigger the update functionality).
+ try {
+ $last_log = $this->db->fetchColumn('SELECT time_logged FROM auth_log WHERE code = \'db_checked\' ORDER BY id DESC LIMIT 1', array(1), 0);
+ $utils_mtime = filemtime(__FILE__);
+ }
+ catch (Exception $e) {
+ $last_log = false;
+ }
+ if (!$last_log || strtotime($last_log) < $utils_mtime) {
+ $this->updateDBSchema();
+ }
+
+ // Set local variables.
// For debugging, potentially add |robert\.box\.kairo\.at to that regex temporarily.
$this->running_on_localhost = preg_match('/^((.+\.)?localhost|127\.0\.0\.\d+)$/', $_SERVER['SERVER_NAME']);
- if (array_key_exists('pwd_cost', $settings)) {
+ if (array_key_exists('pwd_cost', $this->settings)) {
$this->pwd_cost = $this->settings['pwd_cost'];
}
- if (array_key_exists('pwd_nonces', $settings)) {
+ if (array_key_exists('pwd_nonces', $this->settings)) {
$this->pwd_nonces = $this->settings['pwd_nonces'];
}
+ if (array_key_exists('client_reg_email_whitelist', $this->settings) && is_array($this->settings['client_reg_email_whitelist'])) {
+ // If the config lists any emails, set whitelist to them, otherwise there is no whitelist and any user can add OAuth2 clients.
+ $this->client_reg_email_whitelist = $this->settings['client_reg_email_whitelist'];
+ }
}
public $settings = null;
public $db = null;
public $running_on_localhost = false;
- public $client_reg_email_whitelist = array('kairo@kairo.at', 'com@kairo.at');
+ public $client_reg_email_whitelist = false;
private $pwd_cost = 10;
private $pwd_nonces = array();
@@ -167,7 +210,7 @@ class AuthUtils {
function initSession() {
$session = null;
- if (strlen(@$_COOKIE['sessionkey'])) {
+ if (strlen($_COOKIE['sessionkey'] ?? '')) {
// Fetch the session - or at least try to.
$result = $this->db->prepare('SELECT * FROM `auth_sessions` WHERE `sesskey` = :sesskey AND `time_expire` > :expire;');
$result->execute(array(':sesskey' => $_COOKIE['sessionkey'], ':expire' => gmdate('Y-m-d H:i:s')));
@@ -213,14 +256,16 @@ class AuthUtils {
}
else {
$utils->log('create_session_failure', 'at login, prev session: '.$session['id'].', new user: '.$userid);
- $errors[] = _('The session system is not working.').' '._('Please contact KaiRo.at and tell the team about this.');
+ $errors[] = _('The session system is not working.').' '
+ .sprintf(_('Please contact %s and tell the team about this.'), $this->settings['operator_contact_url'], $this->settings['operator_name']);
}
}
else {
$result = $this->db->prepare('UPDATE `auth_sessions` SET `sesskey` = :sesskey, `user` = :userid, `logged_in` = TRUE, `time_expire` = :expire WHERE `id` = :sessid;');
if (!$result->execute(array(':sesskey' => $sesskey, ':userid' => $userid, ':expire' => gmdate('Y-m-d H:i:s', strtotime('+1 day')), ':sessid' => $session['id']))) {
$utils->log('login_failure', 'session: '.$session['id'].', user: '.$userid);
- $errors[] = _('Login failed unexpectedly.').' '._('Please contact KaiRo.at and tell the team about this.');
+ $errors[] = _('Login failed unexpectedly.').' '
+ .sprintf(_('Please contact %s and tell the team about this.'), $this->settings['operator_contact_url'], $this->settings['operator_name']);
}
else {
// After update, actually fetch the session row from the DB so we have all values.
@@ -251,7 +296,7 @@ class AuthUtils {
function doRedirectIfSet($session) {
$success = false;
// If the session has a redirect set, make sure it's performed.
- if (strlen(@$session['saved_redirect'])) {
+ if (strlen($session['saved_redirect'] ?? '')) {
// Remove redirect.
$result = $this->db->prepare('UPDATE `auth_sessions` SET `saved_redirect` = :redir WHERE `id` = :sessid;');
if (!$result->execute(array(':redir' => '', ':sessid' => $session['id']))) {
@@ -268,7 +313,7 @@ class AuthUtils {
function resetRedirect($session) {
$success = false;
// If the session has a redirect set, remove it.
- if (strlen(@$session['saved_redirect'])) {
+ if (strlen($session['saved_redirect'] ?? '')) {
$result = $this->db->prepare('UPDATE `auth_sessions` SET `saved_redirect` = :redir WHERE `id` = :sessid;');
if (!$result->execute(array(':redir' => '', ':sessid' => $session['id']))) {
$this->log('redir_save_failure', 'session: '.$session['id'].', redirect: (empty)');
@@ -327,9 +372,9 @@ class AuthUtils {
$time = time();
$rest = is_null($offset)?($time % $valid_seconds):intval($offset); // T0, will be sent as part of code to make it valid for the full duration.
$counter = floor(($time - $rest) / $valid_seconds);
- $hmac = mhash(MHASH_SHA1, $counter, $session['id'].$session['sesskey']);
- $offset = hexdec(substr(bin2hex(substr($hmac, -1)), -1)); // Get the last 4 bits as a number.
- $totp = hexdec(bin2hex(substr($hmac, $offset, 4))) & 0x7FFFFFFF; // Take 4 bytes at the offset, discard highest bit.
+ $hmac_hex = hash_hmac('sha1', $counter, $session['id'].$session['sesskey']);
+ $offset = hexdec(substr($hmac_hex, -1)); // Get the last 4 bits as a number.
+ $totp = hexdec(substr($hmac_hex, $offset, 8)) & 0x7FFFFFFF; // Take 4 bytes (8 hex chars) at the offset, discard highest bit.
$totp_value = sprintf('%0'.$code_digits.'d', substr($totp, -$code_digits));
return $rest.'.'.$totp_value;
}
@@ -341,6 +386,12 @@ class AuthUtils {
return false;
}
+ /*
+ Some resources for how to store passwords:
+ - https://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-password-storage/
+ - https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines
+ oauth-server-php: https://bshaffer.github.io/oauth2-server-php-docs/cookbook
+ */
function pwdHash($new_password) {
$hash_prefix = '';
if (count($this->pwd_nonces)) {
@@ -393,12 +444,17 @@ class AuthUtils {
function negotiateLocale($supportedLanguages) {
$nlocale = $supportedLanguages[0];
$headers = getAllHeaders();
- $accLcomp = explode(',', @$headers['Accept-Language']);
+ $accLcomp = explode(',', ($headers['Accept-Language'] ?? ''));
$accLang = array();
foreach ($accLcomp as $lcomp) {
if (strlen($lcomp)) {
$ldef = explode(';', $lcomp);
- $accLang[$ldef[0]] = (float)((strpos(@$ldef[1],'q=')===0)?substr($ldef[1],2):1);
+ if (count($ldef) > 1 && strpos($ldef[1], 'q=') === 0) {
+ $accLang[$ldef[0]] = substr($ldef[1], 2);
+ }
+ else {
+ $accLang[$ldef[0]] = 1;
+ }
}
}
if (count($accLang)) {
@@ -428,10 +484,10 @@ class AuthUtils {
function getOAuthServer() {
// Simple server based on https://bshaffer.github.io/oauth2-server-php-docs/cookbook
-
- // dbata needs to be set and be an associative array with the members 'dsn', 'username', and 'password'.
- // dsn is the Data Source Name for your database, for exmaple "mysql:dbname=my_oauth2_db;host=localhost"
- $oauth2_storage = new OAuth2\Storage\Pdo($this->settings['dbdata']);
+ $dbdata = array('dsn' => 'mysql:dbname='.$this->settings['db_name'].';host='.$this->settings['db_host'],
+ 'username' => $this->settings['db_username'],
+ 'password' => $this->settings['db_password']);
+ $oauth2_storage = new OAuth2\Storage\Pdo($dbdata);
// Set configuration
$oauth2_config = array(
@@ -452,6 +508,12 @@ class AuthUtils {
// Add the "Refresh Token" grant type (required to get longer-living resource access by generating new access tokens)
$server->addGrantType(new OAuth2\GrantType\RefreshToken($oauth2_storage, array('always_issue_new_refresh_token' => true)));
+ // Add 'token' response type (mirroring what getDefaultResponseTypes is doing).
+ $server->addResponseType(new OAuth2\ResponseType\AccessToken($oauth2_storage, $oauth2_storage, $oauth2_config));
+
+ // Add 'code' response type (mirroring what getDefaultResponseTypes is doing).
+ $server->addResponseType(new OAuth2\ResponseType\AuthorizationCode($oauth2_storage));
+
return $server;
}
@@ -465,12 +527,19 @@ class AuthUtils {
$style = $head->appendElement('link');
$style->setAttribute('rel', 'stylesheet');
$style->setAttribute('href', 'authsystem.css');
+ $style = $head->appendElement('link');
+ $style->setAttribute('rel', 'stylesheet');
+ $style->setAttribute('href', 'skin/'.$settings['skin'].'/authskin.css');
$head->appendJSFile('authsystem.js');
if ($settings['piwik_enabled']) {
$head->setAttribute('data-piwiksite', $settings['piwik_site_id']);
$head->setAttribute('data-piwikurl', $settings['piwik_url']);
$head->appendJSFile('piwik.js', true, true);
}
+ $icon = $head->appendElement('link');
+ $icon->setAttribute('rel', 'shortcut icon');
+ $icon->setAttribute('href', 'skin/'.$settings['skin'].'/icon32.png');
+ $icon->setAttribute('type', 'image/png');
$title->appendText($titletext);
$h1 = $body->appendElement('h1', $headlinetext);
@@ -505,7 +574,7 @@ class AuthUtils {
$ulist = $form->appendElement('ul');
$ulist->setAttribute('class', 'flat login');
$litem = $ulist->appendElement('li');
- $inptxt = $litem->appendInputEmail('email', 30, 20, 'login_email', (intval(@$user['id'])?$user['email']:''));
+ $inptxt = $litem->appendInputEmail('email', 30, 20, 'login_email', (intval($user['id'] ?? 0) ? $user['email'] : ''));
$inptxt->setAttribute('autocomplete', 'email');
$inptxt->setAttribute('required', '');
$inptxt->setAttribute('placeholder', _('Email'));
@@ -533,5 +602,104 @@ class AuthUtils {
$submit = $litem->appendInputSubmit(_('Log in / Register'));
$submit->setAttribute('class', 'loginbutton');
}
+
+ function updateDBSchema() {
+ $newSchema = $this->getDBSchema();
+ $synchronizer = new \Doctrine\DBAL\Schema\Synchronizer\SingleDatabaseSynchronizer($this->db);
+ $up_sql = $synchronizer->getUpdateSchema($newSchema); // for logging only
+ $synchronizer->updateSchema($newSchema);
+ $this->log('db_checked', implode("\n", $up_sql));
+ }
+
+ function getDBSchema() {
+ $schema = new \Doctrine\DBAL\Schema\Schema();
+
+ $table = $schema->createTable('auth_sessions');
+ $table->addColumn('id', 'bigint', array('unsigned' => true, 'notnull' => true, 'autoincrement' => true));
+ $table->addColumn('sesskey', 'string', array('length' => 150, 'notnull' => true, 'default' => ''));
+ $table->addColumn('user', 'integer', array('unsigned' => true, 'notnull' => false, 'default' => null));
+ $table->addColumn('logged_in', 'boolean', array('notnull' => true, 'default' => false));
+ $table->addColumn('time_created', 'datetime', array('notnull' => true, 'default' => 'CURRENT_TIMESTAMP'));
+ $table->addColumn('time_expire', 'datetime', array('notnull' => true, 'default' => 'CURRENT_TIMESTAMP'));
+ $table->addColumn('saved_redirect', 'string', array('length' => 2000, 'notnull' => true, 'default' => ''));
+ $table->setPrimaryKey(array('id'), 'id');
+ $table->addIndex(array('sesskey'), 'sesskey');
+ $table->addIndex(array('time_expire'), 'time_expire');
+
+ $table = $schema->createTable('auth_users');
+ $table->addColumn('id', 'integer', array('unsigned' => true, 'notnull' => true, 'autoincrement' => true));
+ $table->addColumn('email', 'string', array('length' => 255, 'notnull' => true, 'default' => ''));
+ $table->addColumn('pwdhash', 'string', array('length' => 255, 'notnull' => true, 'default' => ''));
+ $table->addColumn('status', 'string', array('length' => 20, 'notnull' => true, 'default' => 'unverified'));
+ $table->addColumn('verify_hash', 'string', array('length' => 150, 'notnull' => false, 'default' => null));
+ $table->addColumn('group_id', 'integer', array('unsigned' => true, 'notnull' => true, 'default' => 0));
+ $table->addColumn('hcheck_question', 'string', array('length' => 100, 'notnull' => false, 'default' => null));
+ $table->addColumn('hcheck_solution', 'string', array('length' => 20, 'notnull' => false, 'default' => null));
+ $table->setPrimaryKey(array('id'), 'id');
+ $table->addUniqueIndex(array('email'), 'email');
+
+ $table = $schema->createTable('auth_log');
+ $table->addColumn('id', 'bigint', array('unsigned' => true, 'notnull' => true, 'autoincrement' => true));
+ $table->addColumn('code', 'string', array('length' => 100, 'notnull' => true, 'default' => ''));
+ $table->addColumn('info', 'text', array('notnull' => false, 'default' => null));
+ $table->addColumn('ip_addr', 'string', array('length' => 50, 'notnull' => false, 'default' => null));
+ $table->addColumn('time_logged', 'datetime', array('notnull' => true, 'default' => 'CURRENT_TIMESTAMP'));
+ $table->setPrimaryKey(array('id'), 'id');
+ $table->addIndex(array('time_logged'), 'time_logged');
+
+ /* Doctrine DBAL variant of http://bshaffer.github.io/oauth2-server-php-docs/cookbook/#define-your-schema */
+ $table = $schema->createTable('oauth_clients');
+ $table->addColumn('client_id', 'string', array('length' => 80, 'notnull' => true));
+ $table->addColumn('client_secret', 'string', array('length' => 80, 'notnull' => false));
+ $table->addColumn('redirect_uri', 'string', array('length' => 2000, 'notnull' => true));
+ $table->addColumn('grant_types', 'string', array('length' => 80, 'notnull' => false));
+ $table->addColumn('scope', 'string', array('length' => 100, 'notnull' => false));
+ $table->addColumn('user_id', 'string', array('length' => 80, 'notnull' => false));
+ $table->setPrimaryKey(array('client_id'), 'clients_client_id_pk');
+
+ $table = $schema->createTable('oauth_access_tokens');
+ $table->addColumn('access_token', 'string', array('length' => 40, 'notnull' => true));
+ $table->addColumn('client_id', 'string', array('length' => 80, 'notnull' => true));
+ $table->addColumn('user_id', 'string', array('length' => 255, 'notnull' => false));
+ $table->addColumn('expires', 'datetime', array('notnull' => true));
+ $table->addColumn('scope', 'string', array('length' => 2000, 'notnull' => false));
+ $table->setPrimaryKey(array('access_token'), 'access_token_pk');
+
+ $table = $schema->createTable('oauth_authorization_codes');
+ $table->addColumn('authorization_code', 'string', array('length' => 40, 'notnull' => true));
+ $table->addColumn('client_id', 'string', array('length' => 80, 'notnull' => true));
+ $table->addColumn('user_id', 'string', array('length' => 255, 'notnull' => false));
+ $table->addColumn('redirect_uri', 'string', array('length' => 2000, 'notnull' => false));
+ $table->addColumn('expires', 'datetime', array('notnull' => true));
+ $table->addColumn('scope', 'string', array('length' => 2000, 'notnull' => false));
+ $table->setPrimaryKey(array('authorization_code'), 'auth_code_pk');
+
+ $table = $schema->createTable('oauth_refresh_tokens');
+ $table->addColumn('refresh_token', 'string', array('length' => 40, 'notnull' => true));
+ $table->addColumn('client_id', 'string', array('length' => 80, 'notnull' => true));
+ $table->addColumn('user_id', 'string', array('length' => 255, 'notnull' => false));
+ $table->addColumn('expires', 'datetime', array('notnull' => true));
+ $table->addColumn('scope', 'string', array('length' => 2000, 'notnull' => false));
+ $table->setPrimaryKey(array('refresh_token'), 'refresh_token_pk');
+
+ $table = $schema->createTable('oauth_users');
+ $table->addColumn('username', 'string', array('length' => 255, 'notnull' => true));
+ $table->addColumn('password', 'string', array('length' => 2000, 'notnull' => false));
+ $table->addColumn('first_name', 'string', array('length' => 255, 'notnull' => false));
+ $table->addColumn('last_name', 'string', array('length' => 255, 'notnull' => false));
+ $table->setPrimaryKey(array('username'), 'username_pk');
+
+ $table = $schema->createTable('oauth_scopes');
+ $table->addColumn('scope', 'text', array('notnull' => false));
+ $table->addColumn('is_default', 'boolean', array('notnull' => false));
+
+ $table = $schema->createTable('oauth_jwt');
+ $table->addColumn('client_id', 'string', array('length' => 80, 'notnull' => true));
+ $table->addColumn('subject', 'string', array('length' => 80, 'notnull' => false));
+ $table->addColumn('public_key', 'string', array('length' => 2000, 'notnull' => false));
+ $table->setPrimaryKey(array('client_id'), 'client_id_pk');
+
+ return $schema;
+ }
}
?>