Rudimentary implementation of authentication processflow
This commit is contained in:
djpbessems
parent
afd134659b
commit
b04b2fb480
@ -5,6 +5,16 @@ if (!file_exists($configurationFile)) {
|
||||
throw new Exception(sprintf('Missing config file. Please rename \'%1$s.example\' to \'%1$s\' and edit it to reflect your setup.', explode('../', $configurationFile)[1]));
|
||||
}
|
||||
$settings = include_once($configurationFile);
|
||||
try {
|
||||
# switch ($settings->Database['Driver']) {
|
||||
# case 'sqlite':
|
||||
# $database = new PDO('sqlite:' . $settings->Database['Path']);
|
||||
$pdoDB = new PDO('sqlite:' . $settings->Sqlite['Path']);
|
||||
# }
|
||||
}
|
||||
catch (Exception $e) {
|
||||
throw new Exception(sprintf('Unable to connect to database \'%1$s\'', $settings->Sqlite['Path']));
|
||||
}
|
||||
|
||||
function authenticateLDAP (string $username, string $password) {
|
||||
global $settings;
|
||||
@ -45,21 +55,45 @@ function authenticateLDAP (string $username, string $password) {
|
||||
function storeToken (string $username, string $password, object $cookie) {
|
||||
global $settings;
|
||||
|
||||
|
||||
}
|
||||
|
||||
function retrieveToken (string $username, string $foo) {
|
||||
function retrieveTokenFromDB (string $username, string $foo) {
|
||||
global $settings;
|
||||
|
||||
}
|
||||
|
||||
function validateCookie (int $expiration, string $username, string $securetoken) {
|
||||
# $_COOKIE['Exp'], $_COOKIE['Sub'], $_COOKIE['JWT']
|
||||
function validateToken (array $cookieData) {
|
||||
global $settings;
|
||||
|
||||
If ($expiration > time()) {
|
||||
#moo
|
||||
try {
|
||||
$jwtPayload = JWT::decode($cookieData['token'], base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
|
||||
} catch (Exception $e) {
|
||||
// Invalid token, inform client (client should handle discarding invalid token)
|
||||
return ['status' => 'Fail', 'reason' => '3'];
|
||||
}
|
||||
|
||||
$pdoQuery = $pdoDB->prepare('
|
||||
SELECT SecureToken.Payload
|
||||
FROM SecureToken
|
||||
LEFT JOIN User
|
||||
ON (User.Id=SecureToken.UserId)
|
||||
WHERE User.Username = :username
|
||||
');
|
||||
$pdoQuery->execute([
|
||||
'username' => ($_COOKIE['Sub'] ?? "Danny")
|
||||
]);
|
||||
foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) {
|
||||
$tokens[] = $row['Payload'];
|
||||
}
|
||||
print_r($tokens);
|
||||
# if ($pdoResult['Username'])
|
||||
|
||||
|
||||
If ($cookieData['Exp'] < time()) {
|
||||
// Expired cookie (shouldn't the browser disregard it?)
|
||||
return ['status' => 'Fail', 'reason' => '3'];
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
?>
|
||||
@ -69,7 +69,8 @@ $contentLayout['login'] = <<<LOGIN
|
||||
<input type="password" id="password" name="password" tabindex="200" />
|
||||
</li>
|
||||
<li>
|
||||
<button id="btnlogin" class="bttn-simple bttn-xs bttn-primary" tabindex="300" data-translation="button_login">login</button>
|
||||
<input type="hidden" id="ref" name="ref" value="{$_GET['ref']}" />
|
||||
<button id="btnlogin" class="bttn-simple bttn-xs bttn-primary" tabindex="300" data-translation="button_login">login</button>
|
||||
</li>
|
||||
<li class="misc">
|
||||
<span class="indent"> </span>
|
||||
|
||||
@ -21,7 +21,7 @@ return (object) array(
|
||||
'DomainNames' => ['*.subdomain.domain.{(tld1|tld2)}'],
|
||||
|
||||
'Sqlite' => [
|
||||
'Path' => '../config/lucidAuth.sqlite.db'
|
||||
'Path' => '../data/lucidAuth.sqlite.db'
|
||||
// Relative path to the location where the database should be stored
|
||||
],
|
||||
|
||||
|
||||
@ -3,13 +3,23 @@
|
||||
|
||||
include_once('../include/lucidAuth.functions.php');
|
||||
|
||||
echo $settings->Debug['Verbose'];
|
||||
|
||||
if ($_POST['do'] == 'login') {
|
||||
$result = authenticateLDAP($_POST['username'], $_POST['password']);
|
||||
if ($result['status'] == 'Success') {
|
||||
// Convert base64 encoded string back from JSON;
|
||||
// forcing it into an associative array (instead of javascript's default StdClass object)
|
||||
try {
|
||||
$proxyHeaders = json_decode(base64_decode($_POST['ref']), JSON_OBJECT_AS_ARRAY);
|
||||
}
|
||||
catch (Exception $e) {
|
||||
// Since this request is only ever called through an AJAX-request; return JSON object
|
||||
echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
|
||||
exit;
|
||||
}
|
||||
$originalUri = $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'];
|
||||
|
||||
// Since this request is only ever called through an AJAX-request; return JSON object
|
||||
echo '{"Result":"Success","Location":"<originalurl>"}' . PHP_EOL;
|
||||
echo '{"Result":"Success","Location":"' . $originalUri . '"}' . PHP_EOL;
|
||||
} else {
|
||||
switch ($result['reason']) {
|
||||
case '1':
|
||||
|
||||
@ -16,7 +16,10 @@
|
||||
}, ARRAY_FILTER_USE_KEY);
|
||||
|
||||
// For debugging purposes - enable it in ../lucidAuth.config.php
|
||||
if ($settings->Debug['LogToFile']) file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT) . PHP_EOL), FILE_APPEND);
|
||||
if ($settings->Debug['LogToFile']) {
|
||||
file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- ' . (json_encode($proxyHeaders, JSON_FORCE_OBJECT)) . PHP_EOL, FILE_APPEND);
|
||||
file_put_contents('../requestHeaders.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --+ ' . (base64_encode(json_encode($proxyHeaders))) . PHP_EOL, FILE_APPEND);
|
||||
}
|
||||
|
||||
# if (sizeof($proxyHeaders) == 0) {
|
||||
if (False) {
|
||||
@ -25,16 +28,18 @@
|
||||
exit;
|
||||
}
|
||||
|
||||
# if (validateToken($_COOKIE['Exp'], $_COOKIE['Sub'], $_COOKIE['JWT']) != True) {
|
||||
if (False) {
|
||||
// No or invalid authentication token found, redirecting to loginpage
|
||||
header("HTTP/1.1 401 Unauthorized");
|
||||
#remember to include cookies/headers/something
|
||||
header("Location: lucidAuth.login.php");
|
||||
} else {
|
||||
if ((!empty($_COOKIE['Exp']) && !empty($_COOKIE['Sub']) && !empty($_COOKIE['JWT'])) && validateToken([
|
||||
'Exp' => $_COOKIE['Exp'],
|
||||
'Sub' => $_COOKIE['Sub'],
|
||||
'JWT' => $_COOKIE['JWT']
|
||||
])['status'] == "Success") {
|
||||
// Valid authentication token found
|
||||
header("HTTP/1.1 202 Accepted");
|
||||
exit;
|
||||
} else {
|
||||
// No cookie containing valid authentication token found, redirecting to loginpage
|
||||
header("HTTP/1.1 401 Unauthorized");
|
||||
header("Location: lucidAuth.login.php?ref=" . base64_encode(json_encode($proxyHeaders)));
|
||||
}
|
||||
|
||||
?>
|
||||
@ -16,7 +16,8 @@ $(document).ready(function(){
|
||||
$.post("lucidAuth.login.php", {
|
||||
do: "login",
|
||||
username: $('#username').val(),
|
||||
password: $('#password').val()
|
||||
password: $('#password').val(),
|
||||
ref: $('#ref').val()
|
||||
})
|
||||
.done(function(data,status) {
|
||||
try {
|
||||
|
||||
Loading…
Reference in New Issue
Block a user