|
1
|
|
|
<?php |
|
2
|
|
|
namespace Firesphere\YubiAuth; |
|
3
|
|
|
|
|
4
|
|
|
use Config; |
|
5
|
|
|
use Controller; |
|
6
|
|
|
use DateTime; |
|
7
|
|
|
use Form; |
|
8
|
|
|
use Member; |
|
9
|
|
|
use MemberAuthenticator; |
|
10
|
|
|
use ValidationResult; |
|
11
|
|
|
|
|
12
|
|
|
/** |
|
13
|
|
|
* Class YubikeyAuthenticator |
|
14
|
|
|
* |
|
15
|
|
|
* Enable Yubikey Authentication. |
|
16
|
|
|
*/ |
|
17
|
|
|
class YubikeyAuthenticator extends MemberAuthenticator |
|
18
|
|
|
{ |
|
19
|
|
|
|
|
20
|
|
|
/** |
|
21
|
|
|
* @inheritdoc |
|
22
|
|
|
* |
|
23
|
|
|
* @param array $data |
|
24
|
|
|
* @param Form|null $form |
|
25
|
|
|
* |
|
26
|
|
|
* @return null|Member |
|
27
|
|
|
*/ |
|
28
|
|
|
public static function authenticate($data, Form $form = null) |
|
29
|
|
|
{ |
|
30
|
|
|
Config::inst()->update('Security', 'login_recording', false); // Disable login_recording for this auth. |
|
31
|
|
|
// First, let's see if we know the member |
|
32
|
|
|
$member = parent::authenticate($data, $form); |
|
33
|
|
|
Config::inst()->update('Security', 'login_recording', true); |
|
34
|
|
|
$validationError = ValidationResult::create(false, |
|
35
|
|
|
_t('YubikeyAuthenticator.ERRORYUBIKEY', 'Yubikey authentication error')); |
|
36
|
|
|
if ($member && $member instanceof Member) { |
|
37
|
|
|
// If we know the member, and it's YubiAuth enabled, continue. |
|
38
|
|
|
if ($member && |
|
39
|
|
|
($member->YubiAuthEnabled || $data['Yubikey'] !== '') |
|
40
|
|
|
) { |
|
41
|
|
|
$data['Yubikey'] = strtolower($data['Yubikey']); |
|
42
|
|
|
$yubiCode = QwertyConvertor::convertString($data['Yubikey']); |
|
43
|
|
|
$yubiFingerprint = substr($yubiCode, 0, -32); |
|
44
|
|
|
// If the member has a yubikey ID set, compare it to the fingerprint. |
|
45
|
|
|
if ($member->Yubikey && strpos($yubiFingerprint, $member->Yubikey) !== 0) { |
|
46
|
|
|
self::updateForm($validationError, $form); |
|
47
|
|
|
|
|
48
|
|
|
return null; // Yubikey id doesn't match the member. |
|
49
|
|
|
} |
|
50
|
|
|
$clientID = YUBIAUTH_CLIENTID; |
|
51
|
|
|
$apiKey = YUBIAUTH_APIKEY; |
|
52
|
|
|
$service = new \Yubikey\Validate($apiKey, $clientID); |
|
53
|
|
|
if ($url = self::config()->get('AuthURL')) { |
|
54
|
|
|
$service->setHost($url); |
|
55
|
|
|
} |
|
56
|
|
|
$result = $service->check($yubiCode); |
|
57
|
|
|
|
|
58
|
|
|
if ($result->success() === true) { |
|
59
|
|
|
self::updateMember($member, $yubiFingerprint); |
|
60
|
|
|
if ($member) { |
|
61
|
|
|
$member->registerSuccessfulLogin(); |
|
62
|
|
|
$member->MaxNoYubiLogins = 0; |
|
63
|
|
|
$member->write(); |
|
64
|
|
|
} |
|
65
|
|
|
|
|
66
|
|
|
return $member; |
|
67
|
|
|
} else { |
|
68
|
|
|
self::updateForm($validationError, $form); |
|
69
|
|
|
|
|
70
|
|
|
return null; |
|
71
|
|
|
} |
|
72
|
|
|
} elseif (!$member->YubiAuthEnabled) { // We do not have to check the YubiAuth for now. |
|
73
|
|
|
$member->NoYubikeyCount += 1; |
|
74
|
|
|
$member->write(); |
|
75
|
|
|
$maxNoYubi = Config::inst()->get('YubikeyAuthenticator', 'MaxNoYubiLogin'); |
|
76
|
|
View Code Duplication |
if ($maxNoYubi > 0 && $maxNoYubi <= $member->NoYubikeyCount) { |
|
|
|
|
|
|
77
|
|
|
$validationError = ValidationResult::create(false, |
|
78
|
|
|
_t('YubikeyAuthenticator.ERRORMAXYUBIKEY', 'Maximum login without yubikey exceeded')); |
|
79
|
|
|
self::updateForm($validationError, $form); |
|
80
|
|
|
$member->registerFailedLogin(); |
|
81
|
|
|
|
|
82
|
|
|
return null; |
|
83
|
|
|
} |
|
84
|
|
|
$date1 = new DateTime($member->Created); |
|
85
|
|
|
$date2 = new DateTime(date('Y-m-d')); |
|
86
|
|
|
|
|
87
|
|
|
$diff = $date2->diff($date1)->format("%a"); |
|
88
|
|
|
$maxNoYubiDays = Config::inst()->get('YubikeyAuthenticator', 'MaxNoYubiLoginDays'); |
|
89
|
|
|
|
|
90
|
|
View Code Duplication |
if ($maxNoYubiDays > 0 && $diff >= $maxNoYubiDays) { |
|
|
|
|
|
|
91
|
|
|
$validationError = ValidationResult::create(false, |
|
92
|
|
|
_t('YubikeyAuthenticator.ERRORMAXYUBIKEYDAYS', 'Maximum days without yubikey exceeded')); |
|
93
|
|
|
self::updateForm($validationError, $form); |
|
94
|
|
|
$member->registerFailedLogin(); |
|
95
|
|
|
|
|
96
|
|
|
return null; |
|
97
|
|
|
|
|
98
|
|
|
} |
|
99
|
|
|
|
|
100
|
|
|
return $member; |
|
101
|
|
|
} |
|
102
|
|
|
} |
|
103
|
|
|
if ($member) { |
|
104
|
|
|
$member->registerFailedLogin(); |
|
105
|
|
|
} |
|
106
|
|
|
self::updateForm($validationError, $form); |
|
107
|
|
|
|
|
108
|
|
|
return null; |
|
109
|
|
|
} |
|
110
|
|
|
|
|
111
|
|
|
/** |
|
112
|
|
|
* @param Controller $controller |
|
113
|
|
|
* |
|
114
|
|
|
* @return Form |
|
115
|
|
|
*/ |
|
116
|
|
|
public static function get_login_form(Controller $controller) |
|
117
|
|
|
{ |
|
118
|
|
|
return YubikeyLoginForm::create($controller, 'LoginForm'); |
|
119
|
|
|
} |
|
120
|
|
|
|
|
121
|
|
|
public static function get_name() |
|
122
|
|
|
{ |
|
123
|
|
|
return _t('YubikeyAuthenticator.TITLE', 'Yubikey login'); |
|
124
|
|
|
} |
|
125
|
|
|
|
|
126
|
|
|
/** |
|
127
|
|
|
* Update the member to forcefully enable YubiAuth |
|
128
|
|
|
* Also, register the Yubikey to the member. |
|
129
|
|
|
* Documentation: |
|
130
|
|
|
* https://developers.yubico.com/yubikey-val/Getting_Started_Writing_Clients.html |
|
131
|
|
|
* |
|
132
|
|
|
* @param Member $member |
|
133
|
|
|
* @param string $yubiString |
|
134
|
|
|
*/ |
|
135
|
|
|
private static function updateMember($member, $yubiString) |
|
136
|
|
|
{ |
|
137
|
|
|
if (!$member->YubiAuthEnabled) { |
|
138
|
|
|
$member->YubiAuthEnabled = true; |
|
139
|
|
|
} |
|
140
|
|
|
if (!$member->Yubikey) { |
|
141
|
|
|
$member->Yubikey = $yubiString; |
|
142
|
|
|
} |
|
143
|
|
|
$member->write(); |
|
144
|
|
|
} |
|
145
|
|
|
|
|
146
|
|
|
/** |
|
147
|
|
|
* @param ValidationResult $validation |
|
148
|
|
|
* @param null|Form $form |
|
149
|
|
|
*/ |
|
150
|
|
|
private static function updateForm($validation, $form) |
|
151
|
|
|
{ |
|
152
|
|
|
if ($form) { |
|
153
|
|
|
$form->sessionMessage($validation->message(), 'bad'); |
|
154
|
|
|
} |
|
155
|
|
|
|
|
156
|
|
|
} |
|
157
|
|
|
|
|
158
|
|
|
} |
Firesphere /
silverstripe-yubiauth
Loading history...
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.
You can also find more detailed suggestions in the “Code” section of your repository.