First steps towards cross domain cookies
This commit is contained in:
djpbessems
commit
d4ce9e4e67
17
README.md
17
README.md
@ -9,12 +9,12 @@ Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
|
||||
- Edit `include/lucidAuth.config.php.example` to reflect your configuration and save as `include/lucidAuth.config.php`
|
||||
- Create a new website (within any php-capable webserver) and make sure that the documentroot points to the `public` folder
|
||||
- Check if you are able to browse to `https://<fqdn>/lucidAuth.login.php` (where `<fqdn>` is the actual domain -or IP address- your webserver is listening on)
|
||||
- Edit your proxy to use the new website as forward proxy:
|
||||
#### in Caddy/nginx
|
||||
*will come at a later stage*
|
||||
#### in Traefik
|
||||
Add the following lines (change to reflect your existing configuration):
|
||||
```
|
||||
- Edit your proxy's configuration to use the new website as forward proxy:
|
||||
- #### ~~in Caddy/nginx~~ <small>(planned for a later stage)</small>
|
||||
|
||||
- #### in Traefik
|
||||
Add the following lines (change to reflect your existing configuration):
|
||||
```
|
||||
[frontends.server1]
|
||||
entrypoints = ["https"]
|
||||
backend = "server1"
|
||||
@ -23,7 +23,10 @@ Add the following lines (change to reflect your existing configuration):
|
||||
[frontends.server1.routes]
|
||||
[frontends.server1.routes.ext]
|
||||
rule = "Host:<fqdn>"
|
||||
```
|
||||
```
|
||||
|
||||
- #### Important!
|
||||
The domainname of the website made in step 3, needs to match the domainname (*ignoring subdomains, if any*) of the resource utilizing this authentication proxy.
|
||||
|
||||
## Questions or bugs
|
||||
Feel free to open issues in this repository (or in its mirror on [GitHub](#)).
|
||||
@ -98,11 +98,17 @@ function validateToken (string $secureToken) {
|
||||
$jwtPayload = JWT::decode($secureToken, base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
|
||||
} catch (Exception $e) {
|
||||
// Invalid token
|
||||
if ($settings->Debug['LogToFile']) {
|
||||
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- Provided token could not be decoded' . PHP_EOL, FILE_APPEND);
|
||||
}
|
||||
return ['status' => 'Fail', 'reason' => '1'];
|
||||
}
|
||||
|
||||
if ((int)$jwtPayload->iat < (time() - (int)$settings->Session['Duration'])) {
|
||||
// Expired token
|
||||
if ($settings->Debug['LogToFile']) {
|
||||
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- Provided token has expired' . PHP_EOL, FILE_APPEND);
|
||||
}
|
||||
return ['status' => 'Fail', 'reason' => '3'];
|
||||
}
|
||||
|
||||
@ -131,6 +137,9 @@ function validateToken (string $secureToken) {
|
||||
})) === 1) {
|
||||
return ['status' => 'Success'];
|
||||
} else {
|
||||
if ($settings->Debug['LogToFile']) {
|
||||
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- No matching token in database' . PHP_EOL, FILE_APPEND);
|
||||
}
|
||||
return ['status' => 'Fail', 'reason' => '2'];
|
||||
}
|
||||
}
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
|
||||
error_reporting(E_ALL & ~E_NOTICE);
|
||||
|
||||
$pageLayout = <<<PAGE
|
||||
$pageLayout['full'] = <<<'FULL'
|
||||
<!DOCTYPE html>
|
||||
<html lang="nl">
|
||||
<head>
|
||||
@ -19,40 +19,38 @@ $pageLayout = <<<PAGE
|
||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
|
||||
<script src="misc/script.theme.js"></script>
|
||||
<script src="misc/script.translation.js"></script>
|
||||
<script>var cred = { fn: '{$_SESSION['fullname']}', gn: '{$_SESSION['givenname']}' };</script>
|
||||
</head>
|
||||
<body>
|
||||
<div id="horizon">
|
||||
<div id="content" style="top: {$stylevar['content']['top']}; margin-left: {$stylevar['content']['margin-left']}; height: {$stylevar['content']['height']}; width: {$stylevar['content']['width']};">
|
||||
<div id="content">
|
||||
<div class="logo">
|
||||
<div class="left"><div class="middle">lucidAuth</div></div><div class="right"></div>
|
||||
<div class="sub"><em>Respect</em> the unexpected; mitigate your risks</div>
|
||||
</div>
|
||||
<div class="main">
|
||||
<!--REPL_MAIN-->
|
||||
</div>
|
||||
</div>
|
||||
<div id="error" style="display: none; top: -100px; margin-left: -225px; height: 200px; width: 450px;">
|
||||
<div class="logo">
|
||||
<div class="left"><div class="middle" data-translation="heading_error">FOUT!</div></div><div class="right"></div>
|
||||
<div class="sub" id="errorsub"></div>
|
||||
</div>
|
||||
<div class="main">
|
||||
<ul>
|
||||
<li>
|
||||
<span id="errordesc"></span>
|
||||
</li>
|
||||
<li>
|
||||
<button id="btnerrcontinue" class="bttn-simple bttn-xs bttn-primary" tabindex="100" data-translation="button_continue">doorgaan</button>
|
||||
<button id="btnerrcancel" class="bttn-simple bttn-xs bttn-primary" tabindex="200" data-translation="button_cancel">annuleer</button>
|
||||
</li>
|
||||
</ul>
|
||||
%1$s
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
PAGE;
|
||||
FULL;
|
||||
|
||||
$pageLayout['bare'] = <<<'BARE'
|
||||
<!DOCTYPE html>
|
||||
<html lang="nl">
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<title>lucidAuth</title>
|
||||
<meta name="application-name" content="lucidAuth" />
|
||||
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
|
||||
<script src="misc/script.iframe.js"></script>
|
||||
</head>
|
||||
<body>
|
||||
%1$s
|
||||
</body>
|
||||
</html>
|
||||
BARE;
|
||||
|
||||
$contentLayout['login'] = <<<LOGIN
|
||||
<script src="misc/script.index.js"></script>
|
||||
@ -121,4 +119,5 @@ $contentLayout['dialog'] = <<<DIALOG
|
||||
</ul>
|
||||
DIALOG;
|
||||
|
||||
|
||||
?>
|
||||
@ -8,8 +8,33 @@
|
||||
if ($_POST['do'] == 'login') {
|
||||
$result = authenticateLDAP($_POST['username'], $_POST['password']);
|
||||
if ($result['status'] == 'Success') {
|
||||
// Store authentication token; in database serverside & in cookie clientside
|
||||
if (storeToken($result['token'], $settings->LDAP['Domain'] . '\\' . $_POST['username'], $_SERVER['HTTP_HOST'])['status'] !== 'Success') {
|
||||
// Since this action is only ever called through an AJAX-request; return JSON object
|
||||
echo '{"Result":"Fail","Reason":"Failed storing authentication token in database and/or cookie"}' . PHP_EOL;
|
||||
exit;
|
||||
}
|
||||
|
||||
// Convert base64 encoded string back from JSON;
|
||||
// forcing it into an associative array (instead of javascript's default StdClass object)
|
||||
try {
|
||||
$proxyHeaders = json_decode(base64_decode($_POST['ref']), JSON_OBJECT_AS_ARRAY);
|
||||
}
|
||||
catch (Exception $e) {
|
||||
// Since this action is only ever called through an AJAX-request; return JSON object
|
||||
echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
|
||||
exit;
|
||||
}
|
||||
$originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php';
|
||||
|
||||
// Since this request is only ever called through an AJAX-request; return JSON object
|
||||
echo sprintf('{"Result":"Success","Location":"%1$s","CrossDomainLogin":%2$s}', $originalUri, $settings->Session['CrossDomainLogin'] ? 'True' : 'False') . PHP_EOL;
|
||||
header('Content-Type: application/json');
|
||||
echo json_encode([
|
||||
"Result" => "Success",
|
||||
"Location" => $originalUri,
|
||||
"CrossDomainLogin" => $settings->Session['CrossDomainLogin']
|
||||
]);
|
||||
# echo sprintf('{"Result":"Success","Location":"%1$s","CrossDomainLogin":%2$s}', $originalUri, $settings->Session['CrossDomainLogin'] ? 'True' : 'False') . PHP_EOL;
|
||||
} else {
|
||||
switch ($result['reason']) {
|
||||
case '1':
|
||||
@ -20,15 +45,9 @@
|
||||
}
|
||||
}
|
||||
} else {
|
||||
$stylevar['content']['top'] = '-125px';
|
||||
$stylevar['content']['margin-left'] = '-225px';
|
||||
$stylevar['content']['height'] = '220px';
|
||||
$stylevar['content']['width'] = '450px';
|
||||
|
||||
include_once('../include/lucidAuth.template.php');
|
||||
|
||||
$pageLayout = str_replace('<!--REPL_MAIN-->', $contentLayout['login'], $pageLayout);
|
||||
echo $pageLayout;
|
||||
echo sprintf($pageLayout['full'], $contentLayout['login']);
|
||||
}
|
||||
|
||||
?>
|
||||
@ -3,16 +3,22 @@
|
||||
|
||||
include_once('../include/lucidAuth.functions.php');
|
||||
|
||||
// Start with checking $_REQUEST['ref']
|
||||
// What do we need?
|
||||
// token again?
|
||||
|
||||
// approach 1:
|
||||
// origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already)
|
||||
// this might be slower because it means one additional roundtrip between client and server
|
||||
// Start with checking $_REQUEST['ref']
|
||||
// What do we need?
|
||||
// token again?
|
||||
|
||||
// approach 2:
|
||||
// let the client setup multiple iframes for all domains other than origin domains
|
||||
// this requires passing an array of domains to the client in asynchronous reply; which feels insecure
|
||||
// approach 1:
|
||||
// origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already)
|
||||
// this might be slower because it means one additional roundtrip between client and server
|
||||
|
||||
// approach 2:
|
||||
// let the client setup multiple iframes for all domains other than origin domains
|
||||
// this requires passing an array of domains to the client in asynchronous reply; which feels insecure
|
||||
|
||||
include_once('../include/lucidAuth.template.php');
|
||||
|
||||
echo sprintf($pageLayout['bare',
|
||||
'// iFrames go here'
|
||||
);
|
||||
?>
|
||||
@ -26,7 +26,7 @@
|
||||
exit;
|
||||
}
|
||||
|
||||
if (!empty($_COOKIE['JWT']) && validateToken($_COOKIE['JWT'])['status'] == "Success") {
|
||||
if (!empty($_COOKIE['JWT']) && validateToken($_COOKIE['JWT'])['status'] === "Success") {
|
||||
// Valid authentication token found
|
||||
header("HTTP/1.1 202 Accepted");
|
||||
exit;
|
||||
|
||||
@ -20,27 +20,22 @@ $(document).ready(function(){
|
||||
ref: $('#ref').val()
|
||||
})
|
||||
.done(function(data,status) {
|
||||
try {
|
||||
var ajaxData = JSON.parse(data);
|
||||
}
|
||||
catch (e) {
|
||||
console.log(data);
|
||||
}
|
||||
if (ajaxData.Result === 'Success') {
|
||||
if (data.Result === 'Success') {
|
||||
$('#btnlogin').css({
|
||||
'background': 'green url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAaklEQVQ4jeXOMQ5AQBBG4T2BC4i76EWich7ncAKbqCRuodTqnMNTkFgJs3ZU4tXz/Rlj/hUQv8EpMAClFk9sjUAiHVcCnoFMwhZYgPYG575Xe46aIOyMdJx7ji9GwrEzUgOFCu8DkRp/qxU2BKCUyZR6ygAAAABJRU5ErkJggg==) no-repeat center',
|
||||
'transform': 'rotateX(0deg)'
|
||||
});
|
||||
setTimeout(function() {
|
||||
$('#btnlogin').prop('disabled', false).css({
|
||||
'background': '#B50000 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
|
||||
'background': '#003399 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
|
||||
'color': '#FFF'
|
||||
});
|
||||
if (ajaxData.CrossDomainLogin) {
|
||||
if (data.CrossDomainLogin) {
|
||||
// Create iframes for other domains
|
||||
console.log('CrossDomainLogin initiated');
|
||||
}
|
||||
window.location.replace(ajaxData.Location);
|
||||
console.log("Navigating to :" + data.Location);
|
||||
window.location.replace(data.Location);
|
||||
}, 2250);
|
||||
} else {
|
||||
$('#btnlogin').css({
|
||||
@ -49,12 +44,12 @@ console.log('CrossDomainLogin initiated');
|
||||
});
|
||||
setTimeout(function() {
|
||||
$('#btnlogin').prop('disabled', false).css({
|
||||
'background': '#B50000 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
|
||||
'background': '#003399 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
|
||||
'color': '#FFF'
|
||||
});
|
||||
// TODO: Add feedback (based on ajaxData.Reason)
|
||||
// TODO: Add feedback (based on data.Reason)
|
||||
// Is the redirect needed?
|
||||
window.location.replace('lucidAuth.login.php'/*+ '?reason=' + ajaxData.Reason*/);
|
||||
window.location.replace('lucidAuth.login.php'/*+ '?reason=' + data.Reason*/);
|
||||
}, 2250);
|
||||
}
|
||||
});
|
||||
|
||||
@ -20,8 +20,7 @@ body {
|
||||
visibility: visible;
|
||||
display: block;
|
||||
}
|
||||
#content,
|
||||
#error {
|
||||
#content {
|
||||
background: url(/images/bg_main_bottom.gif) repeat-x bottom left;
|
||||
font-family: Tahoma, sans-serif;
|
||||
border: 3px solid #CCCCCC;
|
||||
@ -30,6 +29,10 @@ body {
|
||||
left: 50%;
|
||||
visibility: visible;
|
||||
border-radius: 5px;
|
||||
top: -125px;
|
||||
margin-left: -225px;
|
||||
height: 220px;
|
||||
width: 450px;
|
||||
}
|
||||
#error .main {
|
||||
padding: 0 10px;
|
||||
|
||||
Loading…
Reference in New Issue
Block a user