djpbessems/lucidAuth
1
0
Fork 0
Code Issues Pull Requests Releases 2 Wiki Activity

First steps towards cross domain cookies

Browse Source
This commit is contained in:
djpbessems 2019-02-25 14:42:23 +01:00
commit d4ce9e4e67
8 changed files with 96 additions and 62 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
README.md
View File

@ -9,10 +9,10 @@ Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
- Edit `include/lucidAuth.config.php.example` to reflect your configuration and save as `include/lucidAuth.config.php` - Edit `include/lucidAuth.config.php.example` to reflect your configuration and save as `include/lucidAuth.config.php`
- Create a new website (within any php-capable webserver) and make sure that the documentroot points to the `public` folder - Create a new website (within any php-capable webserver) and make sure that the documentroot points to the `public` folder
- Check if you are able to browse to `https://<fqdn>/lucidAuth.login.php` (where `<fqdn>` is the actual domain -or IP address- your webserver is listening on) - Check if you are able to browse to `https://<fqdn>/lucidAuth.login.php` (where `<fqdn>` is the actual domain -or IP address- your webserver is listening on)
- Edit your proxy to use the new website as forward proxy: - Edit your proxy's configuration to use the new website as forward proxy:
#### in Caddy/nginx - #### ~~in Caddy/nginx~~ <small>(planned for a later stage)</small>
*will come at a later stage*
#### in Traefik - #### in Traefik
Add the following lines (change to reflect your existing configuration): Add the following lines (change to reflect your existing configuration):
``` ```
[frontends.server1] [frontends.server1]
@ -25,5 +25,8 @@ Add the following lines (change to reflect your existing configuration):
rule = "Host:<fqdn>" rule = "Host:<fqdn>"
``` ```
- #### Important!
The domainname of the website made in step 3, needs to match the domainname (*ignoring subdomains, if any*) of the resource utilizing this authentication proxy.
## Questions or bugs ## Questions or bugs
Feel free to open issues in this repository (or in its mirror on [GitHub](#)). Feel free to open issues in this repository (or in its mirror on [GitHub](#)).

9
include/lucidAuth.functions.php
View File

@ -98,11 +98,17 @@ function validateToken (string $secureToken) {
$jwtPayload = JWT::decode($secureToken, base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']); $jwtPayload = JWT::decode($secureToken, base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
} catch (Exception $e) { } catch (Exception $e) {
// Invalid token // Invalid token
if ($settings->Debug['LogToFile']) {
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- Provided token could not be decoded' . PHP_EOL, FILE_APPEND);
}
return ['status' => 'Fail', 'reason' => '1']; return ['status' => 'Fail', 'reason' => '1'];
} }
if ((int)$jwtPayload->iat < (time() - (int)$settings->Session['Duration'])) { if ((int)$jwtPayload->iat < (time() - (int)$settings->Session['Duration'])) {
// Expired token // Expired token
if ($settings->Debug['LogToFile']) {
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- Provided token has expired' . PHP_EOL, FILE_APPEND);
}
return ['status' => 'Fail', 'reason' => '3']; return ['status' => 'Fail', 'reason' => '3'];
} }
@ -131,6 +137,9 @@ function validateToken (string $secureToken) {
})) === 1) { })) === 1) {
return ['status' => 'Success']; return ['status' => 'Success'];
} else { } else {
if ($settings->Debug['LogToFile']) {
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- No matching token in database' . PHP_EOL, FILE_APPEND);
}
return ['status' => 'Fail', 'reason' => '2']; return ['status' => 'Fail', 'reason' => '2'];
} }
} }

43
include/lucidAuth.template.php
View File

@ -2,7 +2,7 @@
error_reporting(E_ALL & ~E_NOTICE); error_reporting(E_ALL & ~E_NOTICE);
$pageLayout = <<<PAGE $pageLayout['full'] = <<<'FULL'
<!DOCTYPE html> <!DOCTYPE html>
<html lang="nl"> <html lang="nl">
<head> <head>
@ -19,40 +19,38 @@ $pageLayout = <<<PAGE
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script> <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
<script src="misc/script.theme.js"></script> <script src="misc/script.theme.js"></script>
<script src="misc/script.translation.js"></script> <script src="misc/script.translation.js"></script>
<script>var cred = { fn: '{$_SESSION['fullname']}', gn: '{$_SESSION['givenname']}' };</script>
</head> </head>
<body> <body>
<div id="horizon"> <div id="horizon">
<div id="content" style="top: {$stylevar['content']['top']}; margin-left: {$stylevar['content']['margin-left']}; height: {$stylevar['content']['height']}; width: {$stylevar['content']['width']};"> <div id="content">
<div class="logo"> <div class="logo">
<div class="left"><div class="middle">lucidAuth</div></div><div class="right"></div> <div class="left"><div class="middle">lucidAuth</div></div><div class="right"></div>
<div class="sub"><em>Respect</em> the unexpected; mitigate your risks</div> <div class="sub"><em>Respect</em> the unexpected; mitigate your risks</div>
</div> </div>
<div class="main"> <div class="main">
<!--REPL_MAIN--> %1$s
</div>
</div>
<div id="error" style="display: none; top: -100px; margin-left: -225px; height: 200px; width: 450px;">
<div class="logo">
<div class="left"><div class="middle" data-translation="heading_error">FOUT!</div></div><div class="right"></div>
<div class="sub" id="errorsub"></div>
</div>
<div class="main">
<ul>
<li>
<span id="errordesc"></span>
</li>
<li>
<button id="btnerrcontinue" class="bttn-simple bttn-xs bttn-primary" tabindex="100" data-translation="button_continue">doorgaan</button>
<button id="btnerrcancel" class="bttn-simple bttn-xs bttn-primary" tabindex="200" data-translation="button_cancel">annuleer</button>
</li>
</ul>
</div> </div>
</div> </div>
</div> </div>
</body> </body>
</html> </html>
PAGE; FULL;
$pageLayout['bare'] = <<<'BARE'
<!DOCTYPE html>
<html lang="nl">
<head>
<meta charset="utf-8" />
<title>lucidAuth</title>
<meta name="application-name" content="lucidAuth" />
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
<script src="misc/script.iframe.js"></script>
</head>
<body>
%1$s
</body>
</html>
BARE;
$contentLayout['login'] = <<<LOGIN $contentLayout['login'] = <<<LOGIN
<script src="misc/script.index.js"></script> <script src="misc/script.index.js"></script>
@ -121,4 +119,5 @@ $contentLayout['dialog'] = <<<DIALOG
</ul> </ul>
DIALOG; DIALOG;
?> ?>

35
public/lucidAuth.login.php
View File

@ -8,8 +8,33 @@
if ($_POST['do'] == 'login') { if ($_POST['do'] == 'login') {
$result = authenticateLDAP($_POST['username'], $_POST['password']); $result = authenticateLDAP($_POST['username'], $_POST['password']);
if ($result['status'] == 'Success') { if ($result['status'] == 'Success') {
// Store authentication token; in database serverside & in cookie clientside
if (storeToken($result['token'], $settings->LDAP['Domain'] . '\\' . $_POST['username'], $_SERVER['HTTP_HOST'])['status'] !== 'Success') {
// Since this action is only ever called through an AJAX-request; return JSON object
echo '{"Result":"Fail","Reason":"Failed storing authentication token in database and/or cookie"}' . PHP_EOL;
exit;
}
// Convert base64 encoded string back from JSON;
// forcing it into an associative array (instead of javascript's default StdClass object)
try {
$proxyHeaders = json_decode(base64_decode($_POST['ref']), JSON_OBJECT_AS_ARRAY);
}
catch (Exception $e) {
// Since this action is only ever called through an AJAX-request; return JSON object
echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
exit;
}
$originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php';
// Since this request is only ever called through an AJAX-request; return JSON object // Since this request is only ever called through an AJAX-request; return JSON object
echo sprintf('{"Result":"Success","Location":"%1$s","CrossDomainLogin":%2$s}', $originalUri, $settings->Session['CrossDomainLogin'] ? 'True' : 'False') . PHP_EOL; header('Content-Type: application/json');
echo json_encode([
"Result" => "Success",
"Location" => $originalUri,
"CrossDomainLogin" => $settings->Session['CrossDomainLogin']
]);
# echo sprintf('{"Result":"Success","Location":"%1$s","CrossDomainLogin":%2$s}', $originalUri, $settings->Session['CrossDomainLogin'] ? 'True' : 'False') . PHP_EOL;
} else { } else {
switch ($result['reason']) { switch ($result['reason']) {
case '1': case '1':
@ -20,15 +45,9 @@
} }
} }
} else { } else {
$stylevar['content']['top'] = '-125px';
$stylevar['content']['margin-left'] = '-225px';
$stylevar['content']['height'] = '220px';
$stylevar['content']['width'] = '450px';
include_once('../include/lucidAuth.template.php'); include_once('../include/lucidAuth.template.php');
$pageLayout = str_replace('<!--REPL_MAIN-->', $contentLayout['login'], $pageLayout); echo sprintf($pageLayout['full'], $contentLayout['login']);
echo $pageLayout;
} }
?> ?>

6
public/lucidAuth.setXDomainCookie.php
View File

@ -3,6 +3,7 @@
include_once('../include/lucidAuth.functions.php'); include_once('../include/lucidAuth.functions.php');
// Start with checking $_REQUEST['ref'] // Start with checking $_REQUEST['ref']
// What do we need? // What do we need?
// token again? // token again?
@ -15,4 +16,9 @@
// let the client setup multiple iframes for all domains other than origin domains // let the client setup multiple iframes for all domains other than origin domains
// this requires passing an array of domains to the client in asynchronous reply; which feels insecure // this requires passing an array of domains to the client in asynchronous reply; which feels insecure
include_once('../include/lucidAuth.template.php');
echo sprintf($pageLayout['bare',
'// iFrames go here'
);
?> ?>

2
public/lucidAuth.validateRequest.php
View File

@ -26,7 +26,7 @@
exit; exit;
} }
if (!empty($_COOKIE['JWT']) && validateToken($_COOKIE['JWT'])['status'] == "Success") { if (!empty($_COOKIE['JWT']) && validateToken($_COOKIE['JWT'])['status'] === "Success") {
// Valid authentication token found // Valid authentication token found
header("HTTP/1.1 202 Accepted"); header("HTTP/1.1 202 Accepted");
exit; exit;

21
public/misc/script.index.js
View File

@ -20,27 +20,22 @@ $(document).ready(function(){
ref: $('#ref').val() ref: $('#ref').val()
}) })
.done(function(data,status) { .done(function(data,status) {
try { if (data.Result === 'Success') {
var ajaxData = JSON.parse(data);
}
catch (e) {
console.log(data);
}
if (ajaxData.Result === 'Success') {
$('#btnlogin').css({ $('#btnlogin').css({
'background': 'green url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAaklEQVQ4jeXOMQ5AQBBG4T2BC4i76EWich7ncAKbqCRuodTqnMNTkFgJs3ZU4tXz/Rlj/hUQv8EpMAClFk9sjUAiHVcCnoFMwhZYgPYG575Xe46aIOyMdJx7ji9GwrEzUgOFCu8DkRp/qxU2BKCUyZR6ygAAAABJRU5ErkJggg==) no-repeat center', 'background': 'green url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAaklEQVQ4jeXOMQ5AQBBG4T2BC4i76EWich7ncAKbqCRuodTqnMNTkFgJs3ZU4tXz/Rlj/hUQv8EpMAClFk9sjUAiHVcCnoFMwhZYgPYG575Xe46aIOyMdJx7ji9GwrEzUgOFCu8DkRp/qxU2BKCUyZR6ygAAAABJRU5ErkJggg==) no-repeat center',
'transform': 'rotateX(0deg)' 'transform': 'rotateX(0deg)'
}); });
setTimeout(function() { setTimeout(function() {
$('#btnlogin').prop('disabled', false).css({ $('#btnlogin').prop('disabled', false).css({
'background': '#B50000 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center', 'background': '#003399 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
'color': '#FFF' 'color': '#FFF'
}); });
if (ajaxData.CrossDomainLogin) { if (data.CrossDomainLogin) {
// Create iframes for other domains // Create iframes for other domains
console.log('CrossDomainLogin initiated'); console.log('CrossDomainLogin initiated');
} }
window.location.replace(ajaxData.Location); console.log("Navigating to :" + data.Location);
window.location.replace(data.Location);
}, 2250); }, 2250);
} else { } else {
$('#btnlogin').css({ $('#btnlogin').css({
@ -49,12 +44,12 @@ console.log('CrossDomainLogin initiated');
}); });
setTimeout(function() { setTimeout(function() {
$('#btnlogin').prop('disabled', false).css({ $('#btnlogin').prop('disabled', false).css({
'background': '#B50000 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center', 'background': '#003399 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
'color': '#FFF' 'color': '#FFF'
}); });
// TODO: Add feedback (based on ajaxData.Reason) // TODO: Add feedback (based on data.Reason)
// Is the redirect needed? // Is the redirect needed?
window.location.replace('lucidAuth.login.php'/*+ '?reason=' + ajaxData.Reason*/); window.location.replace('lucidAuth.login.php'/*+ '?reason=' + data.Reason*/);
}, 2250); }, 2250);
} }
}); });

7
public/misc/style.css
View File

@ -20,8 +20,7 @@ body {
visibility: visible; visibility: visible;
display: block; display: block;
} }
#content, #content {
#error {
background: url(/images/bg_main_bottom.gif) repeat-x bottom left; background: url(/images/bg_main_bottom.gif) repeat-x bottom left;
font-family: Tahoma, sans-serif; font-family: Tahoma, sans-serif;
border: 3px solid #CCCCCC; border: 3px solid #CCCCCC;
@ -30,6 +29,10 @@ body {
left: 50%; left: 50%;
visibility: visible; visibility: visible;
border-radius: 5px; border-radius: 5px;
top: -125px;
margin-left: -225px;
height: 220px;
width: 450px;
} }
#error .main { #error .main {
padding: 0 10px; padding: 0 10px;