blackicedbear/FHC-Core
1
0
Fork 0
mirror of https://github.com/FH-Complete/FHC-Core.git synced 2026-07-25 16:44:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Removed method getCheckUserAuth form api/v1/CheckUserAuth

Browse Source 
- Changed LDAP_Model to a library: LDAPLib
- Removed controller system/Login

AuthLib:
- Added new private method _createAuthObjByPerson
- Moved config load from constructor to _authenticate
- Moved Person_Model load from constructor to _createAuthObjByPerson
- Removed method checkUserAuthByCode
- Removed method checkUserAuthByCodeEmail
- Adapted code to use LDAPLib
This commit is contained in:
Paolo
2019-03-13 11:57:36 +01:00
parent fd9a2266ec
commit 53a0b60ba8
5 changed files with 100 additions and 237 deletions
Download Patch File Download Diff File Expand all files Collapse all files
application/libraries/AuthLib.php
+97 -152
View File
@@ -36,12 +36,6 @@ class AuthLib
// Gets CI instance
$this->_ci =& get_instance();
// Loads auth configuration
$this->_ci->config->load('auth');
// Load model PersonModel
$this->_ci->load->model('person/person_model', 'PersonModel');
if ($authenticate === true) $this->_authenticate(); // if required -> authenticate the current user
}
@@ -57,71 +51,6 @@ class AuthLib
return getSessionElement(self::SESSION_NAME, self::SESSION_AUTH_OBJ);
}
/**
* Checks the authentication of an addon. Returns TRUE if valid, otherwise FALSE
*/
public function basicAuthentication($username, $password)
{
return isSuccess($this->_checkLDAPAuthentication($username, $password));
}
/**
* Checks if the given username and password of a final user are valid
*/
public function checkUserAuthByUsernamePassword($username, $password, $keys = false)
{
$result = error(false);
if (isset($username) && isset($password))
{
if (isSuccess($this->_checkLDAPAuthentication($username, $password)))
{
if ($keys === true)
{
$result = $this->_getFinalUserBasicDataByUID($username);
}
else
{
$result = success(true);
}
}
}
return $result;
}
/**
* Checks if the given code of a final user is valid
*/
public function checkUserAuthByCode($code)
{
$result = error(false);
$person = $this->_ci->PersonModel->loadWhere(array('zugangscode' => $code));
if (hasData($person))
{
$result = $this->_getFinalUserBasicDataByPersonID($person->retval[0]->person_id);
}
return $result;
}
/**
* Checks if the given code and email of a final user are valid
*/
public function checkUserAuthByCodeEmail($code, $email)
{
$result = error(false);
$person = $this->_ci->PersonModel->getPersonKontaktByZugangscode($code, $email);
if (hasData($person))
{
$result = $this->_getFinalUserBasicDataByPersonID($person->retval[0]->person_id);
}
return $result;
}
/**
* Logs out the current logged user
* If the user is using the LoginAs functionality then it is logged out from the acquired user
@@ -159,34 +88,56 @@ class AuthLib
*/
public function loginLDAP($username, $password)
{
// If already logged do NOT check another time, returns the authentication object
if ($this->_isLogged()) return $this->getAuthObj();
// Otherwise checks the given credentials
$loginUP = $this->_checkLDAPAuthentication($username, $password);
if (isSuccess($loginUP))
{
$this->_ci->PersonModel->resetQuery(); // Reset an eventually already built query
$loginUP = $this->_createAuthObjByPerson(array('uid' => $username));
// Retrieves user data from DB using the UID
$personResult = $this->_ci->PersonModel->getByUid($username);
if (hasData($personResult))
{
$person = getData($personResult)[0];
// Stores used data into the authentication object and then into a success object
$loginUP = success(
$this->_createAuthObj($person->person_id, $person->vorname, $person->nachname, $username),
AUTH_SUCCESS
);
$this->_storeAuthObj(getData($loginUP));
}
elseif (isError($personResult)) // blocking error
{
$loginUP = $personResult; // to be displayed
}
// If were possible to retrieve user's data without failing,
// then stores the authentication object into authentication session
if (isSuccess($loginUP)) $this->_storeAuthObj(getData($loginUP));
}
return $loginUP;
}
/**
* Checks the authentication of an addon. Returns TRUE if valid, otherwise FALSE
*/
public function basicAuthentication($username, $password)
{
return isSuccess($this->_checkLDAPAuthentication($username, $password));
}
/**
* Checks if the given username and password of a final user are valid
*/
public function checkUserAuthByUsernamePassword($username, $password, $keys = false)
{
$result = error(false);
if (isset($username) && isset($password))
{
if (isSuccess($this->_checkLDAPAuthentication($username, $password)))
{
if ($keys === true)
{
$result = $this->_getFinalUserBasicDataByUID($username);
}
else
{
$result = success(true);
}
}
}
return $result;
}
//------------------------------------------------------------------------------------------------------------------
// Private methods
@@ -204,9 +155,9 @@ class AuthLib
$authObj = new stdClass();
$authObj->{self::AO_PERSON_ID} = $person_id;
$authObj->{self::AO_NAME} = $name;
$authObj->{self::AO_SURNAME} = $surname;
$authObj->{self::AO_USERNAME} = $username;
$authObj->{self::AO_SURNAME} = $surname;
$authObj->{self::AO_NAME} = $name;
}
return $authObj;
@@ -276,27 +227,7 @@ class AuthLib
// Checks if an authentication were performed via BT
if (isset($_SESSION['bewerbung/personId']) && is_numeric($_SESSION['bewerbung/personId']) && isset($_SESSION['bewerbung/user']))
{
$this->_ci->PersonModel->resetQuery(); // Reset an eventually already built query
// Then retrieves the person data from DB using the person_id
$this->_ci->PersonModel->addSelect('vorname, nachname');
// Retrieves user data using its own person_id
$personResult = $this->_ci->PersonModel->load($_SESSION['bewerbung/personId']);
if (hasData($personResult)) // found!
{
$person = getData($personResult)[0];
// Stores used data into the authentication object and then into a success object
$bt = success(
$this->_createAuthObj($_SESSION['bewerbung/personId'], $person->vorname, $person->nachname),
AUTH_SUCCESS
);
}
elseif (isError($person)) // blocking error
{
$bt = $person; // return it!
}
$bt = $this->_createAuthObjByPerson(array('person_id' => $_SESSION['bewerbung/personId']));
}
return $bt;
@@ -318,24 +249,7 @@ class AuthLib
}
else // otherwise
{
$this->_ci->PersonModel->resetQuery(); // Reset an eventually already built query
// Retrieves user data from DB using the UID
$personResult = $this->_ci->PersonModel->getByUid($_SERVER['PHP_AUTH_USER']);
if (hasData($personResult))
{
$person = getData($personResult)[0];
// Stores used data into the authentication object and then into a success object
$hta = success(
$this->_createAuthObj($person->person_id, $person->vorname, $person->nachname, $_SERVER['PHP_AUTH_USER']),
AUTH_SUCCESS
);
}
elseif (isError($personResult)) // blocking error
{
$hta = $personResult; // to be displayed
}
$hta = $this->_createAuthObjByPerson(array('uid' => $_SERVER['PHP_AUTH_USER']));
}
// Invalid credentials
@@ -359,22 +273,23 @@ class AuthLib
private function _checkLDAPAuthentication($username, $password)
{
$ldap = error('Not authenticated', AUTH_NOT_AUTHENTICATED); // by default is NOT authenticated
$ldapModel = new LDAP_Model(); // LDAP model handles the LDAP connection
$ldapConnection = $ldapModel->connect(); // connect!
$this->_ci->load->library('LDAPLib'); // Loads the LDAP library
$ldapConnection = $this->_ci->ldaplib->connect(); // connect!
if (isSuccess($ldapConnection)) // connected!!
{
// Get the user DN from LDAP
$userDN = $ldapModel->getUserDN($username);
$userDN = $this->_ci->ldaplib->getUserDN($username);
if (isSuccess($userDN)) // got it!
{
$ldapModel->close(); // close the previous LDAP connection
$this->_ci->ldaplib->close(); // close the previous LDAP connection
// Connects to LDAP using the last working configuration + the retrieved user DN + the provided password
$ldapConnection = $ldapModel->connectUsernamePassword(getData($userDN), $password);
$ldapConnection = $this->_ci->ldaplib->connectUsernamePassword(getData($userDN), $password);
if (isSuccess($ldapConnection)) // connected!
{
$ldapModel->close(); // close the previous connection
$this->_ci->ldaplib->close(); // close the previous connection
$ldap = success('Authenticated', AUTH_SUCCESS); // authenticated!
}
else // blocking error
@@ -474,6 +389,8 @@ class AuthLib
// If NOT logged
if (!$this->_isLogged())
{
$this->_ci->config->load('auth'); // Loads auth configuration
// Checks if already logged with a foreign authentication method
$auth = $this->_checkForeignAuthentication();
if (hasData($auth)) // Authenticated with a foreign authentication method
@@ -492,6 +409,44 @@ class AuthLib
// else the user is already logged, then continue with the execution
}
/**
* It uses the given query where clause to select data for a user and then stores these data into a authentication object
*/
private function _createAuthObjByPerson($queryParamsArray)
{
$authObj = error('No user data found'); // pessimistic as usual
$this->_ci->load->model('person/person_model', 'PersonModel'); // Loads model PersonModel
$this->_ci->PersonModel->resetQuery(); // Reset an eventually already built query
// Needed information
$this->_ci->PersonModel->addSelect('person_id, vorname, nachname, uid');
// Retrieves the uid if it is possible
$this->_ci->PersonModel->addJoin('public.tbl_benutzer', 'person_id', 'LEFT');
$queryParamsArray['tbl_person.aktiv'] = true; // only active users!
// Execute query with where clause
$personResult = $this->_ci->PersonModel->loadWhere($queryParamsArray);
if (hasData($personResult))
{
$person = getData($personResult)[0];
// Stores user data into the authentication object and then into a success object
$authObj = success(
$this->_createAuthObj($person->person_id, $person->vorname, $person->nachname, $person->uid),
AUTH_SUCCESS
);
}
elseif (isError($personResult)) // blocking error
{
$authObj = $personResult; // to be returned
}
return $authObj;
}
/**
* Returns all the keys with which is possible to obtain personal data about a final user
* using the given username (uid)
@@ -506,23 +461,13 @@ class AuthLib
$benutzer = $this->_ci->BenutzerModel->load($uid);
if (hasData($benutzer))
{
$finalUserBasicDataByUID = $this->_getFinalUserBasicDataByPersonID($benutzer->retval[0]->person_id);
$finalUserBasicDataByPersonID = new stdClass();
// Store the person_id and eventually all the uid and prestudent_id related to this final user
$finalUserBasicDataByPersonID->person_id = $benutzer->retval[0]->person_id;
$finalUserBasicDataByUID = success($finalUserBasicDataByPersonID);
}
return $finalUserBasicDataByUID;
}
/**
* Returns all the keys with which is possible to obtain personal data about a final user
* using the given person_id
*/
private function _getFinalUserBasicDataByPersonID($person_id)
{
$finalUserBasicDataByPersonID = new stdClass(); // returned object
// Store the person_id and eventually all the uid and prestudent_id related to this final user
$finalUserBasicDataByPersonID->person_id = $person_id;
return success($finalUserBasicDataByPersonID);
}
}
application/libraries/LDAPLib.php
+224
View File
@@ -0,0 +1,224 @@
<?php
class LDAPLib
{
const LDAP_CONF_FILE = 'ldap'; // LDAP config file name
// LDAP configuration array elements
const SERVER = 'server';
const PORT = 'port';
const STARTTLS = 'starttls';
const BASEDN = 'basedn';
const USERNAME = 'username';
const PASSWORD = 'password';
const USF = 'usf';
const DN = 'dn'; // LDAP dn name
const LDAP_PROTOCOL_VERSION = 3; // Specifies the LDAP protocol to be used (V2 or V3) V2 is deprecated
const LDAP_REFERRALS = 0; // Specifies whether to automatically follow referrals returned by the LDAP server (0 = disabled)
const LDAP_INVALID_CREDENTIALS = 49; // LDAP invalid credentials code
// Private properties
private $_connection;
private $_workingConfigArray;
private $_ldapConfigArray;
/**
* Sets the properties and loads the LDAP configuration
*/
public function __construct()
{
$this->_connection = null;
$this->_workingConfigArray = null;
$this->_ldapConfigArray = null;
$this->_loadConfig(); // NOTE: always the last to be called!
}
//------------------------------------------------------------------------------------------------------------------
// Public methods
/**
* Tries to connect to LDAP using configurations in property _ldapConfigArray
* The first that works is used and stored in property _workingConfigArray
* The LDAP connection link is stored in _connection
*/
public function connect()
{
$connect = error('Did not found a working LDAP configuration');
// Loops through LDAP configurations
foreach ($this->_ldapConfigArray as $ldapConfigs)
{
// Tries to establish a connection
$connect = $this->_connect($ldapConfigs);
if (isSuccess($connect))
{
break; // found a working LDAP configuration and successfully connected!
}
else
{
$this->close(); // close the eventually established connection
}
}
return $connect;
}
/**
* Tries to reconnect using the given username and password and the last working configuration
*/
public function connectUsernamePassword($username, $password)
{
return $this->_connect($this->_workingConfigArray, $username, $password);
}
/**
* Close the current connection to LDAP if present
*/
public function close()
{
if ($this->_connection != null) @ldap_unbind($this->_connection);
}
/**
* Get the user DN from LDAP using the given username
*/
public function getUserDN($username)
{
$userDN = error('No user DN were found', LDAP_NO_USER_DN);
// Tries to search for a user DN using the given username
$searchResultIdentifier = @ldap_search(
$this->_connection,
$this->_workingConfigArray[self::BASEDN],
$this->_workingConfigArray[self::USF].'='.$username
);
if (!$searchResultIdentifier) // Error
{
$userDN = error(ldap_error($this->_connection));
}
// Counts the number of found entries
$countEntries = @ldap_count_entries($this->_connection, $searchResultIdentifier);
if ($countEntries === false) // Error
{
$userDN = error(ldap_error($this->_connection));
}
elseif ($countEntries == 0)
{
$userDN = error('No user DN were found', LDAP_NO_USER_DN);
}
elseif ($countEntries > 1)
{
$userDN = error('Too many users DN were found', LDAP_TOO_MANY_USER_DN);
}
else // One entry was found
{
$entries = @ldap_get_entries($this->_connection, $searchResultIdentifier);
if (!$entries) // Error
{
$userDN = error(ldap_error($this->_connection));
}
else
{
$userDN = success($entries[0][self::DN]);
}
}
return $userDN;
}
//------------------------------------------------------------------------------------------------------------------
// Private methods
/**
* Loads the LDAP configuration file and store the LDAP configuration array into _ldapConfigArray property
*/
private function _loadConfig()
{
// Tries to require the LDAP configuration file...
// ...first in the ENVIRONMENT subdirectory...
if (file_exists(APPPATH.'config/'.ENVIRONMENT.'/'.self::LDAP_CONF_FILE.'.php'))
{
require_once(APPPATH.'config/'.ENVIRONMENT.'/'.self::LDAP_CONF_FILE.'.php');
}
else // ...then in the default config directory
{
require_once(APPPATH.'config/'.self::LDAP_CONF_FILE.'.php');
}
$this->_ldapConfigArray = $ldap[$ldap_active_group]; // store the active LDAP configuration array
}
/**
* Establish a connection to LDAP with the given LDAP configuration array and eventually with
* with a given username and password
*/
private function _connect($ldapConfigs, $username = null, $password = null)
{
// Checks if the LDAP configuraion is empty
if (isEmptyArray($ldapConfigs))
{
return error('Wrong parameters given');
}
// LDAP connection
$ldapConnection = @ldap_connect($ldapConfigs[self::SERVER], $ldapConfigs[self::PORT]);
if ($ldapConnection) // if success
{
// Sets the LDAP protocol version
if (!@ldap_set_option($ldapConnection, LDAP_OPT_PROTOCOL_VERSION, self::LDAP_PROTOCOL_VERSION))
{
return error(ldap_error($ldapConnection));
}
// Enable/disable the LDAP referrals
if (!@ldap_set_option($ldapConnection, LDAP_OPT_REFERRALS, self::LDAP_REFERRALS))
{
return error(ldap_error($ldapConnection));
}
// Starts TLS if required
if ($ldapConfigs[self::STARTTLS] === true)
{
if (!@ldap_start_tls($ldapConnection))
{
return error(ldap_error($ldapConnection));
}
}
// If username and password are not provided...
if ($username == null || $password == null)
{
// ...uses those provided by the configuration
$username = $ldapConfigs[self::USERNAME];
$password = $ldapConfigs[self::PASSWORD];
}
// Binds to LDAP directory
if (!@ldap_bind($ldapConnection, $username, $password))
{
// Wrong username and/or password
if (ldap_errno($ldapConnection) == self::LDAP_INVALID_CREDENTIALS)
{
return error('Invalid credentials', AUTH_INVALID_CREDENTIALS);
}
else // Error
{
return error(ldap_error($ldapConnection));
}
}
$this->_connection = $ldapConnection; // save the connection into _connection property
$this->_workingConfigArray = $ldapConfigs; // save the working LDAP configuration into _workingConfigArray property
return success('Connected'); // connected!!!
}
else // Connection error
{
return error(ldap_error($ldapConnection));
}
}
}