From 2844d6e1313146ec1b1d6b5773885cece78676c1 Mon Sep 17 00:00:00 2001 From: viharm Date: Wed, 18 Nov 2020 22:50:03 +0000 Subject: [PATCH] Added LDAP auth code --- composer.json | 4 +- src/psm/Service/User.php | 47 +++++++++++++++---- .../default/module/config/config.tpl.html | 42 +++++++++++++++++ 3 files changed, 83 insertions(+), 10 deletions(-) diff --git a/composer.json b/composer.json index 97c48262..31228c8a 100644 --- a/composer.json +++ b/composer.json @@ -18,8 +18,8 @@ "php-pushover/php-pushover": "dev-master", "paragonie/random_compat": "^2.0", "twig/twig": "~1.35", - "jaxl/jaxl": "^3.1", - "viharm/psm-ldap-auth": "^1.1" + "jaxl/jaxl": "^3.1", + "viharm/psm-ldap-auth": "^1.1" }, "autoload": { "files": [ diff --git a/src/psm/Service/User.php b/src/psm/Service/User.php index fce6213b..bc01db2a 100644 --- a/src/psm/Service/User.php +++ b/src/psm/Service/User.php @@ -230,20 +230,51 @@ class User { $user_name = trim($user_name); $user_password = trim($user_password); + $ldapauthstatus = false; if (empty($user_name) && empty($user_password)) { return false; } + + $dirauthconfig = psm_get_conf('dirauth_status'); + + // LDAP auth enabled + if ($dirauthconfig === '1') { + $ldaplibpath = realpath( + PSM_PATH_SRC . '..' . DIRECTORY_SEPARATOR . + 'vendor' . DIRECTORY_SEPARATOR . + 'viharm' . DIRECTORY_SEPARATOR . + 'psm-ldap-auth' . DIRECTORY_SEPARATOR . + 'psmldapauth.php' + ); + // If the library is found + if ($ldaplibpath) { + // Delegate the authentication to the PsmLDAPauth module. + // If LDAP auth fails or if library not found, fall back to native auth + include_once($ldaplibpath); + $ldapauthstatus = psmldapauth($user_name, $user_password, $GLOBALS['sm_config'], $this->db_connection); + } + } + $user = $this->getUserByUsername($user_name); - // using PHP 5.5's password_verify() function to check if the provided passwords - // fits to the hash of that user's password - if (!isset($user->user_id)) { - password_verify($user_password, 'dummy_call_against_timing'); - return false; - } elseif (!password_verify($user_password, $user->password)) { - return false; - } + // Authenticated + if ($ldapauthstatus === true) { + // Remove password to prevent it from being saved in the DB. + // Otherwise, user may still be authenticated if LDAP is disabled later. + $user_password = null; + @fn_Debug('Authenticated', $user); + } else { + + // using PHP 5.5's password_verify() function to check if the provided passwords + // fits to the hash of that user's password + if (!isset($user->user_id)) { + password_verify($user_password, 'dummy_call_against_timing'); + return false; + } elseif (!password_verify($user_password, $user->password)) { + return false; + } + } // not authenticated $this->setUserLoggedIn($user->user_id, true); diff --git a/src/templates/default/module/config/config.tpl.html b/src/templates/default/module/config/config.tpl.html index ffb36a54..db5ab029 100644 --- a/src/templates/default/module/config/config.tpl.html +++ b/src/templates/default/module/config/config.tpl.html @@ -7,6 +7,11 @@ role="tab" aria-controls="config-general" aria-selected="{% if general_active %}true{% else %}false{% endif %}">{{ label_general }} +
  • + {{ + label_tab_auth }} +