Rudimentary implementation of authentication processflow

include/lucidAuth.functions.php

@@ -5,6 +5,16 @@ if (!file_exists($configurationFile)) {
 	throw new Exception(sprintf('Missing config file. Please rename \'%1$s.example\' to \'%1$s\' and edit it to reflect your setup.', explode('../', $configurationFile)[1]));
 }
 $settings = include_once($configurationFile);
+try {
+#	switch ($settings->Database['Driver']) {
+#		case 'sqlite':
+#			$database = new PDO('sqlite:' . $settings->Database['Path']);
+	$pdoDB = new PDO('sqlite:' . $settings->Sqlite['Path']);
+#	}
+}
+catch (Exception $e) {
+	throw new Exception(sprintf('Unable to connect to database \'%1$s\'', $settings->Sqlite['Path']));
+}
 
 function authenticateLDAP (string $username, string $password) {
 	global $settings;
@@ -45,21 +55,45 @@ function authenticateLDAP (string $username, string $password) {
 function storeToken (string $username, string $password, object $cookie) {
 	global $settings;
 
-	
 }
 
-function retrieveToken (string $username, string $foo) {
+function retrieveTokenFromDB (string $username, string $foo) {
 	global $settings;
 	
 }
 
-function validateCookie (int $expiration, string $username, string $securetoken) {
+function validateToken (array $cookieData) {
-#													$_COOKIE['Exp'], $_COOKIE['Sub'], $_COOKIE['JWT']
 	global $settings;
 
-	If ($expiration > time()) {
+	try {
-		#moo
+		$jwtPayload = JWT::decode($cookieData['token'], base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
+	} catch (Exception $e) {
+		// Invalid token, inform client (client should handle discarding invalid token)
+		return ['status' => 'Fail', 'reason' => '3'];
 	}
+
+	$pdoQuery = $pdoDB->prepare('
+		SELECT SecureToken.Payload
+		FROM SecureToken
+		LEFT JOIN User 
+			ON (User.Id=SecureToken.UserId)
+		WHERE User.Username = :username
+	');
+	$pdoQuery->execute([
+			'username'	=>	($_COOKIE['Sub'] ?? "Danny")
+		]);
+	foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) {
+		$tokens[] = $row['Payload'];
+	}
+	print_r($tokens);
+#	if ($pdoResult['Username'])
+
+
+	If ($cookieData['Exp'] < time()) {
+		// Expired cookie (shouldn't the browser disregard it?)
+		return ['status' => 'Fail', 'reason' => '3'];
+	}
+	
 }
 
 ?>

include/lucidAuth.template.php

@@ -69,6 +69,7 @@ $contentLayout['login'] = <<<LOGIN
                 <input type="password" id="password" name="password" tabindex="200" />
               </li>
               <li>
+				<input type="hidden" id="ref" name="ref" value="{$_GET['ref']}" />
 				<button id="btnlogin" class="bttn-simple bttn-xs bttn-primary" tabindex="300" data-translation="button_login">login</button>
               </li>
               <li class="misc">

lucidAuth.config.php.example

@@ -21,7 +21,7 @@ return (object) array(
 	'DomainNames'	=> ['*.subdomain.domain.{(tld1|tld2)}'],
 
 	'Sqlite'	=> [
-		'Path'	=> '../config/lucidAuth.sqlite.db'
+		'Path'	=> '../data/lucidAuth.sqlite.db'
 		// Relative path to the location where the database should be stored
 	],
 	

public/lucidAuth.login.php

@@ -3,13 +3,23 @@
 
 	include_once('../include/lucidAuth.functions.php');
 	
-	echo $settings->Debug['Verbose'];
-  
 	if ($_POST['do'] == 'login') {
 		$result = authenticateLDAP($_POST['username'], $_POST['password']);
 		if ($result['status'] == 'Success') {
+			// Convert base64 encoded string back from JSON;
+			//   forcing it into an associative array (instead of javascript's default StdClass object)
+			try {
+				$proxyHeaders = json_decode(base64_decode($_POST['ref']), JSON_OBJECT_AS_ARRAY);
+			}
+			catch (Exception $e) {
 				// Since this request is only ever called through an AJAX-request; return JSON object
-			echo '{"Result":"Success","Location":"<originalurl>"}' . PHP_EOL;
+				echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
+				exit;
+			}
+			$originalUri = $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'];
+
+			// Since this request is only ever called through an AJAX-request; return JSON object
+			echo '{"Result":"Success","Location":"' . $originalUri . '"}' . PHP_EOL;
 		} else {
 			switch ($result['reason']) {
 				case '1':

public/lucidAuth.validateRequest.php

@@ -16,7 +16,10 @@
 	}, ARRAY_FILTER_USE_KEY);
 	
 	// For debugging purposes - enable it in ../lucidAuth.config.php
-	if ($settings->Debug['LogToFile']) file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT) . PHP_EOL), FILE_APPEND);
+	if ($settings->Debug['LogToFile']) {
+		file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT)) . PHP_EOL, FILE_APPEND);
+		file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --+ ' . (base64_encode(json_encode($proxyHeaders))) . PHP_EOL, FILE_APPEND);
+	}
 
 #	if (sizeof($proxyHeaders) == 0) {
 	if (False) {
@@ -25,16 +28,18 @@
 		exit;
 	}
 
-#	if (validateToken($_COOKIE['Exp'], $_COOKIE['Sub'], $_COOKIE['JWT']) != True) {
+	if ((!empty($_COOKIE['Exp']) && !empty($_COOKIE['Sub']) && !empty($_COOKIE['JWT'])) && validateToken([
-	if (False) {
+		'Exp' => $_COOKIE['Exp'],
-		// No or invalid authentication token found, redirecting to loginpage
+		'Sub' => $_COOKIE['Sub'],
-		header("HTTP/1.1 401 Unauthorized");
+		'JWT' => $_COOKIE['JWT']
-#remember to include cookies/headers/something
+	])['status'] == "Success") {
-		header("Location: lucidAuth.login.php");
-	} else {
 		// Valid authentication token found
 		header("HTTP/1.1 202 Accepted");
 		exit;
+	} else {
+		// No cookie containing valid authentication token found, redirecting to loginpage
+		header("HTTP/1.1 401 Unauthorized");
+		header("Location: lucidAuth.login.php?ref=" . base64_encode(json_encode($proxyHeaders)));
 	}
 
 ?>

public/misc/script.index.js

@@ -16,7 +16,8 @@ $(document).ready(function(){
 		$.post("lucidAuth.login.php", {
 			do: "login",
 			username: $('#username').val(),
-			password: $('#password').val()
+			password: $('#password').val(),
+			ref: $('#ref').val()
 		})
 		.done(function(data,status) {
 			try {