YubikeyMemberAuthenticator::authenticateNoYubikey() - Code Metrics - Inspection of "Merge pull request #13 from Firesphere/marco/maste..." - Firesphere/silverstripe-yubiauth - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Branch — master (1ad6c0)

by Simon

created 2018-05-19 23:16 UTC

authenticateNoYubikey() A

↳ Parent: YubikeyMemberAuthenticator

Complexity

Conditions	2
Paths	2

Size

Total Lines	10
Code Lines	6

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	2
eloc	6
nc	2
nop	1
dl	0
loc	10
rs	9.4285
c	0
b	0
f	0

<?php

namespace Firesphere\YubiAuth\Authenticators;

use Exception;
use Firesphere\BootstrapMFA\Authenticators\BootstrapMFAAuthenticator;
use Firesphere\BootstrapMFA\Handlers\BootstrapMFALoginHandler;
filter:
    dependency_paths: ["lib/*"]
use Firesphere\YubiAuth\Handlers\YubikeyLoginHandler;
use Firesphere\YubiAuth\Helpers\QwertyConvertor;
use Firesphere\YubiAuth\Providers\YubikeyAuthProvider;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Core\Config\Config;
use SilverStripe\Core\Environment;
use SilverStripe\Core\Injector\Injector;
use SilverStripe\ORM\ValidationException;
use SilverStripe\ORM\ValidationResult;
use SilverStripe\Security\Authenticator;
use SilverStripe\Security\Member;
use SilverStripe\Security\MemberAuthenticator\LoginHandler;
use Yubikey\Response;
use Yubikey\Validate;

/**
 * Class YubikeyAuthenticator
 *
 * Enable Yubikey Authentication for SilverStripe CMS and member-protected pages.
 */
class YubikeyMemberAuthenticator extends BootstrapMFAAuthenticator
{

    /**
     * @var Validate
     */
    protected $yubiService;

    /**
     * @var YubikeyAuthProvider
     */
    protected $provider;

    /**
     * @var string
     */
    private $authenticatorName = 'yubiauth';


    /**
     * Set the provider to a YubikeyAuthProvider instance
     *
     * YubikeyMemberAuthenticator constructor.
     */
    public function __construct()
    {
        if (!$this->provider) {
            $this->provider = Injector::inst()->get(YubikeyAuthProvider::class);
        }
    }

    /**
     * Name of this authenticator
     *
     * @return string
     */
    public static function get_name()
    {
        return _t('YubikeyAuthenticator.TITLE', 'Yubikey 2 factor login');
    }

    /**
     * @return YubikeyAuthProvider
     */
    public function getProvider()
    {
        return $this->provider;
    }

    /**
     * @param YubikeyAuthProvider $provider
     * @return $this
     */
    public function setProvider($provider)
    {
        $this->provider = $provider;

        return $this;
    }

    /**
     * @return int
     */
    public function supportedServices()
    {
        // Bitwise-OR of all the supported services in this Authenticator, to make a bitmask
        return Authenticator::LOGIN | Authenticator::LOGOUT | Authenticator::CHANGE_PASSWORD
            | Authenticator::RESET_PASSWORD | Authenticator::CHECK_PASSWORD;
    }

    /**
     * @inheritdoc
     *
     * @param array $data
     * @param HTTPRequest $request
     * @param ValidationResult $validationResult
     *
     * @return ValidationResult|Member
     * @throws ValidationException
     */
    public function validateToken($data, $request, &$validationResult = null)
    {
        if (!$validationResult instanceof ValidationResult) {
            $validationResult = ValidationResult::create();
        }

        $memberID = $request->getSession()->get(BootstrapMFALoginHandler::SESSION_KEY . '.MemberID');
        // First, let's see if we know the member
        /** @var Member|null $member */
        $member = Member::get()->filter(['ID' => $memberID])->first();

        // Continue if we have a valid member
        if ($member instanceof Member) {

            // We do not have to check the YubiAuth for this situation.
            if (!$member->MFAEnabled && empty($data['yubiauth'])) {
                return $this->authenticateNoYubikey($member);
            }

            // If we know the member, and it's YubiAuth enabled, continue.
            return $this->checkYubikey($data, $member);
        }

        $validationResult->addError(_t(__CLASS__ . '.MEMBERNOTFOUND', 'Could not identify member'));

        return $validationResult;
    }

    /**
     * Handle login if the user did not enter a Yubikey string.
     * Will break out and return NULL if the member should use their Yubikey
     *
     * @param  Member $member
     * @return ValidationResult|Member
     * @throws ValidationException
     */
    private function authenticateNoYubikey($member)
    {
        ++$member->NoYubikeyCount;
        $member->write();
        $yubiAuthNoYubi = $this->provider->checkNoYubiAttempts($member);
        if ($yubiAuthNoYubi instanceof ValidationResult) {
            return $yubiAuthNoYubi;
        }

        return $member;
    }

    /**
     * @param $data
     * @param $member
     * @return ValidationResult|Member
     * @throws ValidationException
     */
    protected function checkYubikey($data, $member)
    {
        /** @var Validate $service */
        $this->yubiService = Injector::inst()->createWithArgs(
            Validate::class,
            [
                Environment::getEnv('YUBIAUTH_APIKEY'),
                Environment::getEnv('YUBIAUTH_CLIENTID'),
            ]
        );

        return $this->authenticateYubikey($data, $member);
    }

    /**
     * Validate a member plus it's yubikey login. It compares the fingerprintt and after that,
     * tries to validate the Yubikey string
     *
     * @todo improve this, it's a bit overly complicated
     * @todo use the ValidationResult as e reference instead of returning
     *
     * @param  array $data
     * @param  Member $member
     * @return ValidationResult|Member
     * @throws ValidationException
     */
    private function authenticateYubikey($data, $member)
    {
        if ($url = Config::inst()->get(self::class, 'AuthURL')) {
            $this->yubiService->setHost($url);
        }
        $yubiCode = QwertyConvertor::convertString($data['yubiauth']);
        $yubiFingerprint = substr($yubiCode, 0, -32);
        $validationResult = ValidationResult::create();

        if ($member->Yubikey) {
            $validationResult = $this->provider->validateToken($member, $yubiFingerprint);
            if (!$validationResult->isValid()) {
                $member->registerFailedLogin();

                return $validationResult;
            }
        }
        try {
            /** @var Response $result */
            $result = $this->yubiService->check($yubiCode);

            // Only check if the call itself doesn't throw an error
            if ($result->success() === true) {
                $this->updateMember($member, $yubiFingerprint);

                return $member;
            }
        } catch (Exception $e) {
            $validationResult->addError($e->getMessage());

            $member->registerFailedLogin();

            return $validationResult;
        }

        $validationResult->addError(_t('YubikeyAuthenticator.ERROR', 'Yubikey authentication error'));
        $member->registerFailedLogin();

        return $validationResult;
    }

    /**
     * Update the member to forcefully enable YubiAuth
     * Also, register the Yubikey to the member.
     * Documentation:
     * https://developers.yubico.com/yubikey-val/Getting_Started_Writing_Clients.html
     *
     * @param Member $member
     * @param string $yubiString The Identifier String of the Yubikey
     * @throws ValidationException
     */
    private function updateMember($member, $yubiString)
    {
        $member->registerSuccessfulLogin();
        $member->NoYubikeyCount = 0;

        if (!$member->MFAEnabled) {
            $member->MFAEnabled = true;
        }
        if (!$member->Yubikey) {
            $member->Yubikey = $yubiString;
        }
        $member->write();
    }

    /**
     * @param string $link
     * @return LoginHandler|static
     */
    public function getLoginHandler($link)
    {
        return YubikeyLoginHandler::create($link, $this);
    }
}


1			<?php
2
3			namespace Firesphere\YubiAuth\Authenticators;
4
5			use Exception;
6			use Firesphere\BootstrapMFA\Authenticators\BootstrapMFAAuthenticator;
7			use Firesphere\BootstrapMFA\Handlers\BootstrapMFALoginHandler;
			0 ignored issues – show Bug introduced 2018-05-15 07:06 UTC by Report Bug Copy Issue Report The type `Firesphere\BootstrapMFA\...ootstrapMFALoginHandler` was not found. Maybe you did not declare it correctly or list all dependencies? The issue could also be caused by a filter entry in the build configuration. If the path has been excluded in your configuration, e.g. `excluded_paths: ["lib/"]`, you can move it to the dependency path list as follows: filter: dependency_paths: ["lib/"] For further information see https://scrutinizer-ci.com/docs/tools/php/php-scrutinizer/#list-dependency-paths Loading history...
8			use Firesphere\YubiAuth\Handlers\YubikeyLoginHandler;
9			use Firesphere\YubiAuth\Helpers\QwertyConvertor;
10			use Firesphere\YubiAuth\Providers\YubikeyAuthProvider;
11			use SilverStripe\Control\HTTPRequest;
12			use SilverStripe\Core\Config\Config;
13			use SilverStripe\Core\Environment;
14			use SilverStripe\Core\Injector\Injector;
15			use SilverStripe\ORM\ValidationException;
16			use SilverStripe\ORM\ValidationResult;
17			use SilverStripe\Security\Authenticator;
18			use SilverStripe\Security\Member;
19			use SilverStripe\Security\MemberAuthenticator\LoginHandler;
20			use Yubikey\Response;
21			use Yubikey\Validate;
22
23			/**
24			* Class YubikeyAuthenticator
25			*
26			* Enable Yubikey Authentication for SilverStripe CMS and member-protected pages.
27			*/
28			class YubikeyMemberAuthenticator extends BootstrapMFAAuthenticator
29			{
30
31			/**
32			* @var Validate
33			*/
34			protected $yubiService;
35
36			/**
37			* @var YubikeyAuthProvider
38			*/
39			protected $provider;
40
41			/**
42			* @var string
43			*/
44			private $authenticatorName = 'yubiauth';
			0 ignored issues – show introduced 2017-11-15 06:00 UTC by Report Bug Copy Issue Report The private property `$authenticatorName` is not used, and could be removed. Loading history...
45
46			/**
47			* Set the provider to a YubikeyAuthProvider instance
48			*
49			* YubikeyMemberAuthenticator constructor.
50			*/
51			public function __construct()
52			{
53			if (!$this->provider) {
54			$this->provider = Injector::inst()->get(YubikeyAuthProvider::class);
55			}
56			}
57
58			/**
59			* Name of this authenticator
60			*
61			* @return string
62			*/
63			public static function get_name()
64			{
65			return _t('YubikeyAuthenticator.TITLE', 'Yubikey 2 factor login');
66			}
67
68			/**
69			* @return YubikeyAuthProvider
70			*/
71			public function getProvider()
72			{
73			return $this->provider;
74			}
75
76			/**
77			* @param YubikeyAuthProvider $provider
78			* @return $this
79			*/
80			public function setProvider($provider)
81			{
82			$this->provider = $provider;
83
84			return $this;
85			}
86
87			/**
88			* @return int
89			*/
90			public function supportedServices()
91			{
92			// Bitwise-OR of all the supported services in this Authenticator, to make a bitmask
93			return Authenticator::LOGIN \| Authenticator::LOGOUT \| Authenticator::CHANGE_PASSWORD
94			\| Authenticator::RESET_PASSWORD \| Authenticator::CHECK_PASSWORD;
95			}
96
97			/**
98			* @inheritdoc
99			*
100			* @param array $data
101			* @param HTTPRequest $request
102			* @param ValidationResult $validationResult
103			*
104			* @return ValidationResult\|Member
105			* @throws ValidationException
106			*/
107			public function validateToken($data, $request, &$validationResult = null)
108			{
109			if (!$validationResult instanceof ValidationResult) {
110			$validationResult = ValidationResult::create();
111			}
112
113			$memberID = $request->getSession()->get(BootstrapMFALoginHandler::SESSION_KEY . '.MemberID');
114			// First, let's see if we know the member
115			/** @var Member\|null $member */
116			$member = Member::get()->filter(['ID' => $memberID])->first();
117
118			// Continue if we have a valid member
119			if ($member instanceof Member) {
120
121			// We do not have to check the YubiAuth for this situation.
122			if (!$member->MFAEnabled && empty($data['yubiauth'])) {
123			return $this->authenticateNoYubikey($member);
124			}
125
126			// If we know the member, and it's YubiAuth enabled, continue.
127			return $this->checkYubikey($data, $member);
128			}
129
130			$validationResult->addError(_t(__CLASS__ . '.MEMBERNOTFOUND', 'Could not identify member'));
131
132			return $validationResult;
133			}
134
135			/**
136			* Handle login if the user did not enter a Yubikey string.
137			* Will break out and return NULL if the member should use their Yubikey
138			*
139			* @param Member $member
140			* @return ValidationResult\|Member
141			* @throws ValidationException
142			*/
143			private function authenticateNoYubikey($member)
144			{
145			++$member->NoYubikeyCount;
146			$member->write();
147			$yubiAuthNoYubi = $this->provider->checkNoYubiAttempts($member);
148			if ($yubiAuthNoYubi instanceof ValidationResult) {
149			return $yubiAuthNoYubi;
150			}
151
152			return $member;
153			}
154
155			/**
156			* @param $data
157			* @param $member
158			* @return ValidationResult\|Member
159			* @throws ValidationException
160			*/
161			protected function checkYubikey($data, $member)
162			{
163			/** @var Validate $service */
164			$this->yubiService = Injector::inst()->createWithArgs(
165			Validate::class,
166			[
167			Environment::getEnv('YUBIAUTH_APIKEY'),
168			Environment::getEnv('YUBIAUTH_CLIENTID'),
169			]
170			);
171
172			return $this->authenticateYubikey($data, $member);
173			}
174
175			/**
176			* Validate a member plus it's yubikey login. It compares the fingerprintt and after that,
177			* tries to validate the Yubikey string
178			*
179			* @todo improve this, it's a bit overly complicated
180			* @todo use the ValidationResult as e reference instead of returning
181			*
182			* @param array $data
183			* @param Member $member
184			* @return ValidationResult\|Member
185			* @throws ValidationException
186			*/
187			private function authenticateYubikey($data, $member)
188			{
189			if ($url = Config::inst()->get(self::class, 'AuthURL')) {
190			$this->yubiService->setHost($url);
191			}
192			$yubiCode = QwertyConvertor::convertString($data['yubiauth']);
193			$yubiFingerprint = substr($yubiCode, 0, -32);
194			$validationResult = ValidationResult::create();
195
196			if ($member->Yubikey) {
197			$validationResult = $this->provider->validateToken($member, $yubiFingerprint);
198			if (!$validationResult->isValid()) {
199			$member->registerFailedLogin();
200
201			return $validationResult;
202			}
203			}
204			try {
205			/** @var Response $result */
206			$result = $this->yubiService->check($yubiCode);
207
208			// Only check if the call itself doesn't throw an error
209			if ($result->success() === true) {
210			$this->updateMember($member, $yubiFingerprint);
211
212			return $member;
213			}
214			} catch (Exception $e) {
215			$validationResult->addError($e->getMessage());
216
217			$member->registerFailedLogin();
218
219			return $validationResult;
220			}
221
222			$validationResult->addError(_t('YubikeyAuthenticator.ERROR', 'Yubikey authentication error'));
223			$member->registerFailedLogin();
224
225			return $validationResult;
226			}
227
228			/**
229			* Update the member to forcefully enable YubiAuth
230			* Also, register the Yubikey to the member.
231			* Documentation:
232			* https://developers.yubico.com/yubikey-val/Getting_Started_Writing_Clients.html
233			*
234			* @param Member $member
235			* @param string $yubiString The Identifier String of the Yubikey
236			* @throws ValidationException
237			*/
238			private function updateMember($member, $yubiString)
239			{
240			$member->registerSuccessfulLogin();
241			$member->NoYubikeyCount = 0;
242
243			if (!$member->MFAEnabled) {
244			$member->MFAEnabled = true;
245			}
246			if (!$member->Yubikey) {
247			$member->Yubikey = $yubiString;
248			}
249			$member->write();
250			}
251
252			/**
253			* @param string $link
254			* @return LoginHandler\|static
255			*/
256			public function getLoginHandler($link)
257			{
258			return YubikeyLoginHandler::create($link, $this);
259			}
260			}
261

Firesphere / silverstripe-yubiauth

Branch — master (1ad6c0)

authenticateNoYubikey() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like