diff --git a/application/config/constants.php b/application/config/constants.php index 2901080f3..6de4d3392 100644 --- a/application/config/constants.php +++ b/application/config/constants.php @@ -74,6 +74,14 @@ define('AUTH_SUCCESS', 0); define('AUTH_NOT_AUTHENTICATED', 1); define('AUTH_INVALID_CREDENTIALS', 2); +/* +|-------------------------------------------------------------------------- +| LDAP constants +|-------------------------------------------------------------------------- +*/ +define('LDAP_NO_USER_DN', 10); +define('LDAP_TOO_MANY_USER_DN', 11); + /* |-------------------------------------------------------------------------- | File and directory modes diff --git a/application/controllers/system/Login.php b/application/controllers/system/Login.php index 80d5a89e1..8ec52a341 100644 --- a/application/controllers/system/Login.php +++ b/application/controllers/system/Login.php @@ -20,6 +20,7 @@ class Login extends FHC_Controller */ public function usernamePassword() { + $this->load->view('system/login/usernamePassword'); } /** diff --git a/application/core/LDAP_Model.php b/application/core/LDAP_Model.php index bf8b80625..a43d5b768 100644 --- a/application/core/LDAP_Model.php +++ b/application/core/LDAP_Model.php @@ -89,7 +89,7 @@ class LDAP_Model extends FHC_Model */ public function getUserDN($username) { - $userDN = error('No user DN were found'); + $userDN = error('No user DN were found', LDAP_NO_USER_DN); // Tries to search for a user DN using the given username $searchResultIdentifier = @ldap_search( @@ -108,9 +108,13 @@ class LDAP_Model extends FHC_Model { $userDN = error(ldap_error($this->_connection)); } - elseif ($countEntries != 1) // 0 or > 1 + elseif ($countEntries == 0) { - $userDN = error('None or too many user DN were found'); + $userDN = error('No user DN were found', LDAP_NO_USER_DN); + } + elseif ($countEntries > 1) + { + $userDN = error('Too many users DN were found', LDAP_TOO_MANY_USER_DN); } else // One entry was found { diff --git a/application/libraries/AuthLib.php b/application/libraries/AuthLib.php index 642bbfe2e..7f5dd1078 100644 --- a/application/libraries/AuthLib.php +++ b/application/libraries/AuthLib.php @@ -227,7 +227,7 @@ class AuthLib // Prints date and time $this->_ci->eprintflib->printInfo('Date and time: '.date('Y.m.d H:i:s')); - $this->_ci->loglib->logError($errorMessage); + $this->_ci->loglib->logError($errorMessage); // CI log error exit; // immediately terminate the execution } @@ -301,11 +301,23 @@ class AuthLib } elseif (isError($personResult)) // blocking error { - $hta = $personResult; // return it! + $hta = $personResult; // to be displayed } } - return $hta; + // Invalid credentials + // NOTE: this is a corner case because of the HTTP basic authentication + if (getCode($hta) == AUTH_NOT_AUTHENTICATED || getCode($hta) == AUTH_INVALID_CREDENTIALS + || getCode($hta) == LDAP_NO_USER_DN || getCode($hta) == LDAP_TOO_MANY_USER_DN) + { + $this->_showInvalidAuthentication(); // this also stop the execution + } + elseif (isError($hta)) // display error and stop execution + { + $this->_showError(getData($hta)); + } + + return $hta; // if success then is returned! } /** @@ -330,7 +342,7 @@ class AuthLib if (isSuccess($ldapConnection)) // connected! { $ldapModel->close(); // close the previous connection - $ldap = success('Authenticated'); // authenticated! + $ldap = success('Authenticated', AUTH_SUCCESS); // authenticated! } else // blocking error { @@ -354,6 +366,8 @@ class AuthLib * Tries to find if the user is already logged via a foreign authentication method * using a list of foreign authentication methods provided with the configurations * If the user is logged via a foreign authentication method then an authentication object is returned + * NOTE: _checkHBALDAPAuthentication is the last to be called and it is a corner case due the HTTP basic + * authentication mechanism, and it does not return anything */ private function _checkForeignAuthentication() { @@ -374,13 +388,6 @@ class AuthLib break; } - // Invalid credentials - // NOTE: this is a corner case because of the HTTP basic authentication - if (getCode($auth) == AUTH_INVALID_CREDENTIALS) - { - $this->_showInvalidAuthentication(); // this also stop the execution - } - // If not authenticated with this method... if (getCode($auth) == AUTH_NOT_AUTHENTICATED) { @@ -416,7 +423,7 @@ class AuthLib // If the configuration is valid if (!isEmptyArray($alp) && isset($alp[$al])) { - header('HTTP/1.1 301 Moved Permanently'); // permanent redirection + header('HTTP/1.1 302 Moved temporary'); // temporary redirection header('Location: '.site_url().$alp[$al]); // redirect to the configured login page exit(); // stops execution! }