First steps towards cross domain cookies

This commit is contained in:
djpbessems 2019-02-25 14:42:23 +01:00
commit d4ce9e4e67
8 changed files with 96 additions and 62 deletions

View File

@ -9,12 +9,12 @@ Forward Authentication for use with proxies (caddy, nginx, traefik, etc)
- Edit `include/lucidAuth.config.php.example` to reflect your configuration and save as `include/lucidAuth.config.php`
- Create a new website (within any php-capable webserver) and make sure that the documentroot points to the `public` folder
- Check if you are able to browse to `https://<fqdn>/lucidAuth.login.php` (where `<fqdn>` is the actual domain -or IP address- your webserver is listening on)
- Edit your proxy to use the new website as forward proxy:
#### in Caddy/nginx
*will come at a later stage*
#### in Traefik
Add the following lines (change to reflect your existing configuration):
```
- Edit your proxy's configuration to use the new website as forward proxy:
- #### ~~in Caddy/nginx~~ <small>(planned for a later stage)</small>
- #### in Traefik
Add the following lines (change to reflect your existing configuration):
```
[frontends.server1]
entrypoints = ["https"]
backend = "server1"
@ -23,7 +23,10 @@ Add the following lines (change to reflect your existing configuration):
[frontends.server1.routes]
[frontends.server1.routes.ext]
rule = "Host:<fqdn>"
```
```
- #### Important!
The domainname of the website made in step 3, needs to match the domainname (*ignoring subdomains, if any*) of the resource utilizing this authentication proxy.
## Questions or bugs
Feel free to open issues in this repository (or in its mirror on [GitHub](#)).

View File

@ -98,11 +98,17 @@ function validateToken (string $secureToken) {
$jwtPayload = JWT::decode($secureToken, base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
} catch (Exception $e) {
// Invalid token
if ($settings->Debug['LogToFile']) {
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- Provided token could not be decoded' . PHP_EOL, FILE_APPEND);
}
return ['status' => 'Fail', 'reason' => '1'];
}
if ((int)$jwtPayload->iat < (time() - (int)$settings->Session['Duration'])) {
// Expired token
if ($settings->Debug['LogToFile']) {
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- Provided token has expired' . PHP_EOL, FILE_APPEND);
}
return ['status' => 'Fail', 'reason' => '3'];
}
@ -131,6 +137,9 @@ function validateToken (string $secureToken) {
})) === 1) {
return ['status' => 'Success'];
} else {
if ($settings->Debug['LogToFile']) {
file_put_contents('../validateToken.log', (new DateTime())->format('Y-m-d\TH:i:s.u') . ' --- No matching token in database' . PHP_EOL, FILE_APPEND);
}
return ['status' => 'Fail', 'reason' => '2'];
}
}

View File

@ -2,7 +2,7 @@
error_reporting(E_ALL & ~E_NOTICE);
$pageLayout = <<<PAGE
$pageLayout['full'] = <<<'FULL'
<!DOCTYPE html>
<html lang="nl">
<head>
@ -19,40 +19,38 @@ $pageLayout = <<<PAGE
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
<script src="misc/script.theme.js"></script>
<script src="misc/script.translation.js"></script>
<script>var cred = { fn: '{$_SESSION['fullname']}', gn: '{$_SESSION['givenname']}' };</script>
</head>
<body>
<div id="horizon">
<div id="content" style="top: {$stylevar['content']['top']}; margin-left: {$stylevar['content']['margin-left']}; height: {$stylevar['content']['height']}; width: {$stylevar['content']['width']};">
<div id="content">
<div class="logo">
<div class="left"><div class="middle">lucidAuth</div></div><div class="right"></div>
<div class="sub"><em>Respect</em> the unexpected; mitigate your risks</div>
</div>
<div class="main">
<!--REPL_MAIN-->
</div>
</div>
<div id="error" style="display: none; top: -100px; margin-left: -225px; height: 200px; width: 450px;">
<div class="logo">
<div class="left"><div class="middle" data-translation="heading_error">FOUT!</div></div><div class="right"></div>
<div class="sub" id="errorsub"></div>
</div>
<div class="main">
<ul>
<li>
<span id="errordesc"></span>
</li>
<li>
<button id="btnerrcontinue" class="bttn-simple bttn-xs bttn-primary" tabindex="100" data-translation="button_continue">doorgaan</button>
<button id="btnerrcancel" class="bttn-simple bttn-xs bttn-primary" tabindex="200" data-translation="button_cancel">annuleer</button>
</li>
</ul>
%1$s
</div>
</div>
</div>
</body>
</html>
PAGE;
FULL;
$pageLayout['bare'] = <<<'BARE'
<!DOCTYPE html>
<html lang="nl">
<head>
<meta charset="utf-8" />
<title>lucidAuth</title>
<meta name="application-name" content="lucidAuth" />
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.2.1/jquery.js"></script>
<script src="misc/script.iframe.js"></script>
</head>
<body>
%1$s
</body>
</html>
BARE;
$contentLayout['login'] = <<<LOGIN
<script src="misc/script.index.js"></script>
@ -121,4 +119,5 @@ $contentLayout['dialog'] = <<<DIALOG
</ul>
DIALOG;
?>

View File

@ -8,8 +8,33 @@
if ($_POST['do'] == 'login') {
$result = authenticateLDAP($_POST['username'], $_POST['password']);
if ($result['status'] == 'Success') {
// Store authentication token; in database serverside & in cookie clientside
if (storeToken($result['token'], $settings->LDAP['Domain'] . '\\' . $_POST['username'], $_SERVER['HTTP_HOST'])['status'] !== 'Success') {
// Since this action is only ever called through an AJAX-request; return JSON object
echo '{"Result":"Fail","Reason":"Failed storing authentication token in database and/or cookie"}' . PHP_EOL;
exit;
}
// Convert base64 encoded string back from JSON;
// forcing it into an associative array (instead of javascript's default StdClass object)
try {
$proxyHeaders = json_decode(base64_decode($_POST['ref']), JSON_OBJECT_AS_ARRAY);
}
catch (Exception $e) {
// Since this action is only ever called through an AJAX-request; return JSON object
echo '{"Result":"Fail","Reason":"Original request URI lost in transition"}' . PHP_EOL;
exit;
}
$originalUri = !empty($proxyHeaders) ? $proxyHeaders['XForwardedProto'] . '://' . $proxyHeaders['XForwardedHost'] . $proxyHeaders['XForwardedUri'] : 'lucidAuth.manage.php';
// Since this request is only ever called through an AJAX-request; return JSON object
echo sprintf('{"Result":"Success","Location":"%1$s","CrossDomainLogin":%2$s}', $originalUri, $settings->Session['CrossDomainLogin'] ? 'True' : 'False') . PHP_EOL;
header('Content-Type: application/json');
echo json_encode([
"Result" => "Success",
"Location" => $originalUri,
"CrossDomainLogin" => $settings->Session['CrossDomainLogin']
]);
# echo sprintf('{"Result":"Success","Location":"%1$s","CrossDomainLogin":%2$s}', $originalUri, $settings->Session['CrossDomainLogin'] ? 'True' : 'False') . PHP_EOL;
} else {
switch ($result['reason']) {
case '1':
@ -20,15 +45,9 @@
}
}
} else {
$stylevar['content']['top'] = '-125px';
$stylevar['content']['margin-left'] = '-225px';
$stylevar['content']['height'] = '220px';
$stylevar['content']['width'] = '450px';
include_once('../include/lucidAuth.template.php');
$pageLayout = str_replace('<!--REPL_MAIN-->', $contentLayout['login'], $pageLayout);
echo $pageLayout;
echo sprintf($pageLayout['full'], $contentLayout['login']);
}
?>

View File

@ -3,16 +3,22 @@
include_once('../include/lucidAuth.functions.php');
// Start with checking $_REQUEST['ref']
// What do we need?
// token again?
// approach 1:
// origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already)
// this might be slower because it means one additional roundtrip between client and server
// Start with checking $_REQUEST['ref']
// What do we need?
// token again?
// approach 2:
// let the client setup multiple iframes for all domains other than origin domains
// this requires passing an array of domains to the client in asynchronous reply; which feels insecure
// approach 1:
// origin domain, so we can intersect with $settings->Session['CookieDomains'] and iterate through the remaining domains, serving them in one page (which contains iframes already)
// this might be slower because it means one additional roundtrip between client and server
// approach 2:
// let the client setup multiple iframes for all domains other than origin domains
// this requires passing an array of domains to the client in asynchronous reply; which feels insecure
include_once('../include/lucidAuth.template.php');
echo sprintf($pageLayout['bare',
'// iFrames go here'
);
?>

View File

@ -26,7 +26,7 @@
exit;
}
if (!empty($_COOKIE['JWT']) && validateToken($_COOKIE['JWT'])['status'] == "Success") {
if (!empty($_COOKIE['JWT']) && validateToken($_COOKIE['JWT'])['status'] === "Success") {
// Valid authentication token found
header("HTTP/1.1 202 Accepted");
exit;

View File

@ -20,27 +20,22 @@ $(document).ready(function(){
ref: $('#ref').val()
})
.done(function(data,status) {
try {
var ajaxData = JSON.parse(data);
}
catch (e) {
console.log(data);
}
if (ajaxData.Result === 'Success') {
if (data.Result === 'Success') {
$('#btnlogin').css({
'background': 'green url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAaklEQVQ4jeXOMQ5AQBBG4T2BC4i76EWich7ncAKbqCRuodTqnMNTkFgJs3ZU4tXz/Rlj/hUQv8EpMAClFk9sjUAiHVcCnoFMwhZYgPYG575Xe46aIOyMdJx7ji9GwrEzUgOFCu8DkRp/qxU2BKCUyZR6ygAAAABJRU5ErkJggg==) no-repeat center',
'transform': 'rotateX(0deg)'
});
setTimeout(function() {
$('#btnlogin').prop('disabled', false).css({
'background': '#B50000 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
'background': '#003399 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
'color': '#FFF'
});
if (ajaxData.CrossDomainLogin) {
if (data.CrossDomainLogin) {
// Create iframes for other domains
console.log('CrossDomainLogin initiated');
}
window.location.replace(ajaxData.Location);
console.log("Navigating to :" + data.Location);
window.location.replace(data.Location);
}, 2250);
} else {
$('#btnlogin').css({
@ -49,12 +44,12 @@ console.log('CrossDomainLogin initiated');
});
setTimeout(function() {
$('#btnlogin').prop('disabled', false).css({
'background': '#B50000 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
'background': '#003399 linear-gradient(0deg, rgba(255,255,255,0) 0%, rgba(255,255,255,0) 50%, rgba(255,255,255,0.25) 51%) no-repeat center',
'color': '#FFF'
});
// TODO: Add feedback (based on ajaxData.Reason)
// TODO: Add feedback (based on data.Reason)
// Is the redirect needed?
window.location.replace('lucidAuth.login.php'/*+ '?reason=' + ajaxData.Reason*/);
window.location.replace('lucidAuth.login.php'/*+ '?reason=' + data.Reason*/);
}, 2250);
}
});

View File

@ -20,8 +20,7 @@ body {
visibility: visible;
display: block;
}
#content,
#error {
#content {
background: url(/images/bg_main_bottom.gif) repeat-x bottom left;
font-family: Tahoma, sans-serif;
border: 3px solid #CCCCCC;
@ -30,6 +29,10 @@ body {
left: 50%;
visibility: visible;
border-radius: 5px;
top: -125px;
margin-left: -225px;
height: 220px;
width: 450px;
}
#error .main {
padding: 0 10px;