@@ -18,9 +18,9 @@ |
||
18 | 18 | */ |
19 | 19 | interface IRequestRouter |
20 | 20 | { |
21 | - /** |
|
22 | - * @return IRoutedTask |
|
23 | - * @throws Exception |
|
24 | - */ |
|
25 | - public function route(); |
|
21 | + /** |
|
22 | + * @return IRoutedTask |
|
23 | + * @throws Exception |
|
24 | + */ |
|
25 | + public function route(); |
|
26 | 26 | } |
27 | 27 | \ No newline at end of file |
@@ -13,17 +13,17 @@ |
||
13 | 13 | */ |
14 | 14 | function smarty_modifier_iphex($input) |
15 | 15 | { |
16 | - $output = $input; |
|
16 | + $output = $input; |
|
17 | 17 | |
18 | - if (filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) { |
|
19 | - $octets = explode('.', $input); |
|
20 | - $output = ''; |
|
21 | - foreach ($octets as $octet) { |
|
22 | - $output .= str_pad(dechex($octet), 2, '0', STR_PAD_LEFT); |
|
23 | - } |
|
18 | + if (filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false) { |
|
19 | + $octets = explode('.', $input); |
|
20 | + $output = ''; |
|
21 | + foreach ($octets as $octet) { |
|
22 | + $output .= str_pad(dechex($octet), 2, '0', STR_PAD_LEFT); |
|
23 | + } |
|
24 | 24 | |
25 | - $output = str_pad($output, 32, '0', STR_PAD_LEFT); |
|
26 | - } |
|
25 | + $output = str_pad($output, 32, '0', STR_PAD_LEFT); |
|
26 | + } |
|
27 | 27 | |
28 | - return $output; |
|
28 | + return $output; |
|
29 | 29 | } |
@@ -13,10 +13,10 @@ |
||
13 | 13 | */ |
14 | 14 | function smarty_modifier_demodhex($input) |
15 | 15 | { |
16 | - $hex = preg_replace( |
|
17 | - array('/c/', '/b/', '/d/', '/e/', '/f/', '/g/', '/h/', '/i/', '/j/', '/k/', '/l/', '/n/', '/r/', '/t/', '/u/', '/v/'), |
|
18 | - array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'), |
|
19 | - $input); |
|
16 | + $hex = preg_replace( |
|
17 | + array('/c/', '/b/', '/d/', '/e/', '/f/', '/g/', '/h/', '/i/', '/j/', '/k/', '/l/', '/n/', '/r/', '/t/', '/u/', '/v/'), |
|
18 | + array('0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f'), |
|
19 | + $input); |
|
20 | 20 | |
21 | - return hexdec($hex); |
|
21 | + return hexdec($hex); |
|
22 | 22 | } |
23 | 23 | \ No newline at end of file |
@@ -12,48 +12,48 @@ |
||
12 | 12 | |
13 | 13 | class EncryptionHelper |
14 | 14 | { |
15 | - /** |
|
16 | - * @var SiteConfiguration |
|
17 | - */ |
|
18 | - private $configuration; |
|
19 | - |
|
20 | - /** |
|
21 | - * EncryptionHelper constructor. |
|
22 | - * |
|
23 | - * @param SiteConfiguration $configuration |
|
24 | - */ |
|
25 | - public function __construct(SiteConfiguration $configuration) |
|
26 | - { |
|
27 | - $this->configuration = $configuration; |
|
28 | - } |
|
29 | - |
|
30 | - public function encryptData($secret) |
|
31 | - { |
|
32 | - $iv = openssl_random_pseudo_bytes(16); |
|
33 | - $password = $this->getEncryptionKey(); |
|
34 | - $encryptedKey = openssl_encrypt($secret, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv); |
|
35 | - |
|
36 | - $data = base64_encode($iv) . '|' . base64_encode($encryptedKey); |
|
37 | - |
|
38 | - return $data; |
|
39 | - } |
|
40 | - |
|
41 | - public function decryptData($data) |
|
42 | - { |
|
43 | - list($iv, $encryptedKey) = array_map('base64_decode', explode('|', $data)); |
|
44 | - |
|
45 | - $password = $this->getEncryptionKey(); |
|
46 | - |
|
47 | - $secret = openssl_decrypt($encryptedKey, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv); |
|
48 | - |
|
49 | - return $secret; |
|
50 | - } |
|
51 | - |
|
52 | - /** |
|
53 | - * @return string |
|
54 | - */ |
|
55 | - private function getEncryptionKey() |
|
56 | - { |
|
57 | - return openssl_digest($this->configuration->getTotpEncryptionKey(), 'sha256'); |
|
58 | - } |
|
15 | + /** |
|
16 | + * @var SiteConfiguration |
|
17 | + */ |
|
18 | + private $configuration; |
|
19 | + |
|
20 | + /** |
|
21 | + * EncryptionHelper constructor. |
|
22 | + * |
|
23 | + * @param SiteConfiguration $configuration |
|
24 | + */ |
|
25 | + public function __construct(SiteConfiguration $configuration) |
|
26 | + { |
|
27 | + $this->configuration = $configuration; |
|
28 | + } |
|
29 | + |
|
30 | + public function encryptData($secret) |
|
31 | + { |
|
32 | + $iv = openssl_random_pseudo_bytes(16); |
|
33 | + $password = $this->getEncryptionKey(); |
|
34 | + $encryptedKey = openssl_encrypt($secret, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv); |
|
35 | + |
|
36 | + $data = base64_encode($iv) . '|' . base64_encode($encryptedKey); |
|
37 | + |
|
38 | + return $data; |
|
39 | + } |
|
40 | + |
|
41 | + public function decryptData($data) |
|
42 | + { |
|
43 | + list($iv, $encryptedKey) = array_map('base64_decode', explode('|', $data)); |
|
44 | + |
|
45 | + $password = $this->getEncryptionKey(); |
|
46 | + |
|
47 | + $secret = openssl_decrypt($encryptedKey, 'aes-256-ctr', $password, OPENSSL_RAW_DATA, $iv); |
|
48 | + |
|
49 | + return $secret; |
|
50 | + } |
|
51 | + |
|
52 | + /** |
|
53 | + * @return string |
|
54 | + */ |
|
55 | + private function getEncryptionKey() |
|
56 | + { |
|
57 | + return openssl_digest($this->configuration->getTotpEncryptionKey(), 'sha256'); |
|
58 | + } |
|
59 | 59 | } |
60 | 60 | \ No newline at end of file |
@@ -19,137 +19,137 @@ |
||
19 | 19 | |
20 | 20 | class TotpCredentialProvider extends CredentialProviderBase |
21 | 21 | { |
22 | - /** @var EncryptionHelper */ |
|
23 | - private $encryptionHelper; |
|
24 | - |
|
25 | - /** |
|
26 | - * TotpCredentialProvider constructor. |
|
27 | - * |
|
28 | - * @param PdoDatabase $database |
|
29 | - * @param SiteConfiguration $configuration |
|
30 | - */ |
|
31 | - public function __construct(PdoDatabase $database, SiteConfiguration $configuration) |
|
32 | - { |
|
33 | - parent::__construct($database, $configuration, 'totp'); |
|
34 | - $this->encryptionHelper = new EncryptionHelper($configuration); |
|
35 | - } |
|
36 | - |
|
37 | - /** |
|
38 | - * Validates a user-provided credential |
|
39 | - * |
|
40 | - * @param User $user The user to test the authentication against |
|
41 | - * @param string $data The raw credential data to be validated |
|
42 | - * |
|
43 | - * @return bool |
|
44 | - * @throws ApplicationLogicException |
|
45 | - */ |
|
46 | - public function authenticate(User $user, $data) |
|
47 | - { |
|
48 | - if (is_array($data)) { |
|
49 | - return false; |
|
50 | - } |
|
51 | - |
|
52 | - $storedData = $this->getCredentialData($user->getId()); |
|
53 | - |
|
54 | - if ($storedData === null) { |
|
55 | - throw new ApplicationLogicException('Credential data not found'); |
|
56 | - } |
|
57 | - |
|
58 | - $provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData()); |
|
59 | - $totp = Factory::loadFromProvisioningUri($provisioningUrl); |
|
60 | - |
|
61 | - return $totp->verify($data, null, 2); |
|
62 | - } |
|
63 | - |
|
64 | - public function verifyEnable(User $user, $data) |
|
65 | - { |
|
66 | - $storedData = $this->getCredentialData($user->getId(), true); |
|
67 | - |
|
68 | - if ($storedData === null) { |
|
69 | - throw new ApplicationLogicException('Credential data not found'); |
|
70 | - } |
|
71 | - |
|
72 | - $provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData()); |
|
73 | - $totp = Factory::loadFromProvisioningUri($provisioningUrl); |
|
74 | - |
|
75 | - $result = $totp->verify($data, null, 2); |
|
76 | - |
|
77 | - if ($result && $storedData->getTimeout() > new DateTimeImmutable()) { |
|
78 | - $storedData->setDisabled(0); |
|
79 | - $storedData->setPriority(5); |
|
80 | - $storedData->setTimeout(null); |
|
81 | - $storedData->save(); |
|
82 | - } |
|
83 | - |
|
84 | - return $result; |
|
85 | - } |
|
86 | - |
|
87 | - /** |
|
88 | - * @param User $user The user the credential belongs to |
|
89 | - * @param int $factor The factor this credential provides |
|
90 | - * @param string $data Unused here, due to there being no user-provided data. We provide the user with the secret. |
|
91 | - */ |
|
92 | - public function setCredential(User $user, $factor, $data) |
|
93 | - { |
|
94 | - $issuer = 'ACC - ' . $this->getConfiguration()->getIrcNotificationsInstance(); |
|
95 | - $totp = TOTP::create(); |
|
96 | - $totp->setLabel($user->getUsername()); |
|
97 | - $totp->setIssuer($issuer); |
|
98 | - |
|
99 | - $storedData = $this->getCredentialData($user->getId(), null); |
|
100 | - |
|
101 | - if ($storedData !== null) { |
|
102 | - $storedData->delete(); |
|
103 | - } |
|
104 | - |
|
105 | - $storedData = $this->createNewCredential($user); |
|
106 | - |
|
107 | - $storedData->setData($this->encryptionHelper->encryptData($totp->getProvisioningUri())); |
|
108 | - $storedData->setFactor($factor); |
|
109 | - $storedData->setTimeout(new DateTimeImmutable('+ 1 hour')); |
|
110 | - $storedData->setDisabled(1); |
|
111 | - $storedData->setVersion(1); |
|
112 | - |
|
113 | - $storedData->save(); |
|
114 | - } |
|
115 | - |
|
116 | - public function getProvisioningUrl(User $user) |
|
117 | - { |
|
118 | - $storedData = $this->getCredentialData($user->getId(), true); |
|
119 | - |
|
120 | - if ($storedData->getTimeout() < new DateTimeImmutable()) { |
|
121 | - $storedData->delete(); |
|
122 | - $storedData = null; |
|
123 | - } |
|
124 | - |
|
125 | - if ($storedData === null) { |
|
126 | - throw new ApplicationLogicException('Credential data not found'); |
|
127 | - } |
|
128 | - |
|
129 | - return $this->encryptionHelper->decryptData($storedData->getData()); |
|
130 | - } |
|
131 | - |
|
132 | - public function isPartiallyEnrolled(User $user) |
|
133 | - { |
|
134 | - $storedData = $this->getCredentialData($user->getId(), true); |
|
135 | - |
|
136 | - if ($storedData->getTimeout() < new DateTimeImmutable()) { |
|
137 | - $storedData->delete(); |
|
138 | - |
|
139 | - return false; |
|
140 | - } |
|
141 | - |
|
142 | - if ($storedData === null) { |
|
143 | - return false; |
|
144 | - } |
|
22 | + /** @var EncryptionHelper */ |
|
23 | + private $encryptionHelper; |
|
24 | + |
|
25 | + /** |
|
26 | + * TotpCredentialProvider constructor. |
|
27 | + * |
|
28 | + * @param PdoDatabase $database |
|
29 | + * @param SiteConfiguration $configuration |
|
30 | + */ |
|
31 | + public function __construct(PdoDatabase $database, SiteConfiguration $configuration) |
|
32 | + { |
|
33 | + parent::__construct($database, $configuration, 'totp'); |
|
34 | + $this->encryptionHelper = new EncryptionHelper($configuration); |
|
35 | + } |
|
36 | + |
|
37 | + /** |
|
38 | + * Validates a user-provided credential |
|
39 | + * |
|
40 | + * @param User $user The user to test the authentication against |
|
41 | + * @param string $data The raw credential data to be validated |
|
42 | + * |
|
43 | + * @return bool |
|
44 | + * @throws ApplicationLogicException |
|
45 | + */ |
|
46 | + public function authenticate(User $user, $data) |
|
47 | + { |
|
48 | + if (is_array($data)) { |
|
49 | + return false; |
|
50 | + } |
|
51 | + |
|
52 | + $storedData = $this->getCredentialData($user->getId()); |
|
53 | + |
|
54 | + if ($storedData === null) { |
|
55 | + throw new ApplicationLogicException('Credential data not found'); |
|
56 | + } |
|
57 | + |
|
58 | + $provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData()); |
|
59 | + $totp = Factory::loadFromProvisioningUri($provisioningUrl); |
|
60 | + |
|
61 | + return $totp->verify($data, null, 2); |
|
62 | + } |
|
63 | + |
|
64 | + public function verifyEnable(User $user, $data) |
|
65 | + { |
|
66 | + $storedData = $this->getCredentialData($user->getId(), true); |
|
67 | + |
|
68 | + if ($storedData === null) { |
|
69 | + throw new ApplicationLogicException('Credential data not found'); |
|
70 | + } |
|
71 | + |
|
72 | + $provisioningUrl = $this->encryptionHelper->decryptData($storedData->getData()); |
|
73 | + $totp = Factory::loadFromProvisioningUri($provisioningUrl); |
|
74 | + |
|
75 | + $result = $totp->verify($data, null, 2); |
|
76 | + |
|
77 | + if ($result && $storedData->getTimeout() > new DateTimeImmutable()) { |
|
78 | + $storedData->setDisabled(0); |
|
79 | + $storedData->setPriority(5); |
|
80 | + $storedData->setTimeout(null); |
|
81 | + $storedData->save(); |
|
82 | + } |
|
83 | + |
|
84 | + return $result; |
|
85 | + } |
|
86 | + |
|
87 | + /** |
|
88 | + * @param User $user The user the credential belongs to |
|
89 | + * @param int $factor The factor this credential provides |
|
90 | + * @param string $data Unused here, due to there being no user-provided data. We provide the user with the secret. |
|
91 | + */ |
|
92 | + public function setCredential(User $user, $factor, $data) |
|
93 | + { |
|
94 | + $issuer = 'ACC - ' . $this->getConfiguration()->getIrcNotificationsInstance(); |
|
95 | + $totp = TOTP::create(); |
|
96 | + $totp->setLabel($user->getUsername()); |
|
97 | + $totp->setIssuer($issuer); |
|
98 | + |
|
99 | + $storedData = $this->getCredentialData($user->getId(), null); |
|
100 | + |
|
101 | + if ($storedData !== null) { |
|
102 | + $storedData->delete(); |
|
103 | + } |
|
104 | + |
|
105 | + $storedData = $this->createNewCredential($user); |
|
106 | + |
|
107 | + $storedData->setData($this->encryptionHelper->encryptData($totp->getProvisioningUri())); |
|
108 | + $storedData->setFactor($factor); |
|
109 | + $storedData->setTimeout(new DateTimeImmutable('+ 1 hour')); |
|
110 | + $storedData->setDisabled(1); |
|
111 | + $storedData->setVersion(1); |
|
112 | + |
|
113 | + $storedData->save(); |
|
114 | + } |
|
115 | + |
|
116 | + public function getProvisioningUrl(User $user) |
|
117 | + { |
|
118 | + $storedData = $this->getCredentialData($user->getId(), true); |
|
119 | + |
|
120 | + if ($storedData->getTimeout() < new DateTimeImmutable()) { |
|
121 | + $storedData->delete(); |
|
122 | + $storedData = null; |
|
123 | + } |
|
124 | + |
|
125 | + if ($storedData === null) { |
|
126 | + throw new ApplicationLogicException('Credential data not found'); |
|
127 | + } |
|
128 | + |
|
129 | + return $this->encryptionHelper->decryptData($storedData->getData()); |
|
130 | + } |
|
131 | + |
|
132 | + public function isPartiallyEnrolled(User $user) |
|
133 | + { |
|
134 | + $storedData = $this->getCredentialData($user->getId(), true); |
|
135 | + |
|
136 | + if ($storedData->getTimeout() < new DateTimeImmutable()) { |
|
137 | + $storedData->delete(); |
|
138 | + |
|
139 | + return false; |
|
140 | + } |
|
141 | + |
|
142 | + if ($storedData === null) { |
|
143 | + return false; |
|
144 | + } |
|
145 | 145 | |
146 | - return true; |
|
147 | - } |
|
146 | + return true; |
|
147 | + } |
|
148 | 148 | |
149 | - public function getSecret(User $user) |
|
150 | - { |
|
151 | - $totp = Factory::loadFromProvisioningUri($this->getProvisioningUrl($user)); |
|
149 | + public function getSecret(User $user) |
|
150 | + { |
|
151 | + $totp = Factory::loadFromProvisioningUri($this->getProvisioningUrl($user)); |
|
152 | 152 | |
153 | - return $totp->getSecret(); |
|
154 | - } |
|
153 | + return $totp->getSecret(); |
|
154 | + } |
|
155 | 155 | } |
@@ -12,32 +12,32 @@ |
||
12 | 12 | |
13 | 13 | interface ICredentialProvider |
14 | 14 | { |
15 | - /** |
|
16 | - * Validates a user-provided credential |
|
17 | - * |
|
18 | - * @param User $user The user to test the authentication against |
|
19 | - * @param string $data The raw credential data to be validated |
|
20 | - * |
|
21 | - * @return bool |
|
22 | - */ |
|
23 | - public function authenticate(User $user, $data); |
|
15 | + /** |
|
16 | + * Validates a user-provided credential |
|
17 | + * |
|
18 | + * @param User $user The user to test the authentication against |
|
19 | + * @param string $data The raw credential data to be validated |
|
20 | + * |
|
21 | + * @return bool |
|
22 | + */ |
|
23 | + public function authenticate(User $user, $data); |
|
24 | 24 | |
25 | - /** |
|
26 | - * @param User $user The user the credential belongs to |
|
27 | - * @param int $factor The factor this credential provides |
|
28 | - * @param string $data |
|
29 | - */ |
|
30 | - public function setCredential(User $user, $factor, $data); |
|
25 | + /** |
|
26 | + * @param User $user The user the credential belongs to |
|
27 | + * @param int $factor The factor this credential provides |
|
28 | + * @param string $data |
|
29 | + */ |
|
30 | + public function setCredential(User $user, $factor, $data); |
|
31 | 31 | |
32 | - /** |
|
33 | - * @param User $user |
|
34 | - */ |
|
35 | - public function deleteCredential(User $user); |
|
32 | + /** |
|
33 | + * @param User $user |
|
34 | + */ |
|
35 | + public function deleteCredential(User $user); |
|
36 | 36 | |
37 | - /** |
|
38 | - * @param int $userId |
|
39 | - * |
|
40 | - * @return bool |
|
41 | - */ |
|
42 | - public function userIsEnrolled($userId); |
|
37 | + /** |
|
38 | + * @param int $userId |
|
39 | + * |
|
40 | + * @return bool |
|
41 | + */ |
|
42 | + public function userIsEnrolled($userId); |
|
43 | 43 | } |
44 | 44 | \ No newline at end of file |
@@ -16,154 +16,154 @@ |
||
16 | 16 | |
17 | 17 | class YubikeyOtpCredentialProvider extends CredentialProviderBase |
18 | 18 | { |
19 | - /** @var HttpHelper */ |
|
20 | - private $httpHelper; |
|
21 | - /** |
|
22 | - * @var SiteConfiguration |
|
23 | - */ |
|
24 | - private $configuration; |
|
25 | - |
|
26 | - public function __construct(PdoDatabase $database, SiteConfiguration $configuration, HttpHelper $httpHelper) |
|
27 | - { |
|
28 | - parent::__construct($database, $configuration, 'yubikeyotp'); |
|
29 | - $this->httpHelper = $httpHelper; |
|
30 | - $this->configuration = $configuration; |
|
31 | - } |
|
32 | - |
|
33 | - public function authenticate(User $user, $data) |
|
34 | - { |
|
35 | - if (is_array($data)) { |
|
36 | - return false; |
|
37 | - } |
|
38 | - |
|
39 | - $credentialData = $this->getCredentialData($user->getId()); |
|
40 | - |
|
41 | - if ($credentialData === null) { |
|
42 | - return false; |
|
43 | - } |
|
44 | - |
|
45 | - if ($credentialData->getData() !== $this->getYubikeyId($data)) { |
|
46 | - // different device |
|
47 | - return false; |
|
48 | - } |
|
49 | - |
|
50 | - return $this->verifyToken($data); |
|
51 | - } |
|
52 | - |
|
53 | - public function setCredential(User $user, $factor, $data) |
|
54 | - { |
|
55 | - $keyId = $this->getYubikeyId($data); |
|
56 | - $valid = $this->verifyToken($data); |
|
57 | - |
|
58 | - if (!$valid) { |
|
59 | - throw new ApplicationLogicException("Provided token is not valid."); |
|
60 | - } |
|
61 | - |
|
62 | - $storedData = $this->getCredentialData($user->getId()); |
|
63 | - |
|
64 | - if ($storedData === null) { |
|
65 | - $storedData = $this->createNewCredential($user); |
|
66 | - } |
|
67 | - |
|
68 | - $storedData->setData($keyId); |
|
69 | - $storedData->setFactor($factor); |
|
70 | - $storedData->setVersion(1); |
|
71 | - $storedData->setPriority(8); |
|
72 | - |
|
73 | - $storedData->save(); |
|
74 | - } |
|
75 | - |
|
76 | - /** |
|
77 | - * Get the Yubikey ID. |
|
78 | - * |
|
79 | - * This looks like it's just dumping the "password" that's stored in the database, but it's actually fine. |
|
80 | - * |
|
81 | - * We only store the "serial number" of the Yubikey - if we get a validated (by webservice) token prefixed with the |
|
82 | - * serial number, that's a successful OTP authentication. Thus, retrieving the stored data is just retrieving the |
|
83 | - * yubikey's serial number (in modhex format), since the actual security credentials are stored on the device. |
|
84 | - * |
|
85 | - * Note that the serial number is actually the credential serial number - it's possible to regenerate the keys on |
|
86 | - * the device, and that will change the serial number too. |
|
87 | - * |
|
88 | - * More information about the structure of OTPs can be found here: |
|
89 | - * https://developers.yubico.com/OTP/OTPs_Explained.html |
|
90 | - * |
|
91 | - * @param int $userId |
|
92 | - * |
|
93 | - * @return null|string |
|
94 | - */ |
|
95 | - public function getYubikeyData($userId) |
|
96 | - { |
|
97 | - $credential = $this->getCredentialData($userId); |
|
98 | - |
|
99 | - if ($credential === null) { |
|
100 | - return null; |
|
101 | - } |
|
102 | - |
|
103 | - return $credential->getData(); |
|
104 | - } |
|
105 | - |
|
106 | - /** |
|
107 | - * @param $result |
|
108 | - * |
|
109 | - * @return array |
|
110 | - */ |
|
111 | - private function parseYubicoApiResult($result) |
|
112 | - { |
|
113 | - $data = array(); |
|
114 | - foreach (explode("\r\n", $result) as $line) { |
|
115 | - $pos = strpos($line, '='); |
|
116 | - if ($pos === false) { |
|
117 | - continue; |
|
118 | - } |
|
119 | - |
|
120 | - $data[substr($line, 0, $pos)] = substr($line, $pos + 1); |
|
121 | - } |
|
122 | - |
|
123 | - return $data; |
|
124 | - } |
|
125 | - |
|
126 | - private function getYubikeyId($data) |
|
127 | - { |
|
128 | - return substr($data, 0, -32); |
|
129 | - } |
|
130 | - |
|
131 | - private function verifyHmac($apiResponse, $apiKey) |
|
132 | - { |
|
133 | - ksort($apiResponse); |
|
134 | - $signature = $apiResponse['h']; |
|
135 | - unset($apiResponse['h']); |
|
136 | - |
|
137 | - $data = array(); |
|
138 | - foreach ($apiResponse as $key => $value) { |
|
139 | - $data[] = $key . "=" . $value; |
|
140 | - } |
|
141 | - $dataString = implode('&', $data); |
|
142 | - |
|
143 | - $hmac = base64_encode(hash_hmac('sha1', $dataString, base64_decode($apiKey), true)); |
|
144 | - |
|
145 | - return $hmac === $signature; |
|
146 | - } |
|
147 | - |
|
148 | - /** |
|
149 | - * @param $data |
|
150 | - * |
|
151 | - * @return bool |
|
152 | - */ |
|
153 | - private function verifyToken($data) |
|
154 | - { |
|
155 | - $result = $this->httpHelper->get('https://api.yubico.com/wsapi/2.0/verify', array( |
|
156 | - 'id' => $this->configuration->getYubicoApiId(), |
|
157 | - 'otp' => $data, |
|
158 | - 'nonce' => md5(openssl_random_pseudo_bytes(64)), |
|
159 | - )); |
|
160 | - |
|
161 | - $apiResponse = $this->parseYubicoApiResult($result); |
|
162 | - |
|
163 | - if (!$this->verifyHmac($apiResponse, $this->configuration->getYubicoApiKey())) { |
|
164 | - return false; |
|
165 | - } |
|
166 | - |
|
167 | - return $apiResponse['status'] == 'OK'; |
|
168 | - } |
|
19 | + /** @var HttpHelper */ |
|
20 | + private $httpHelper; |
|
21 | + /** |
|
22 | + * @var SiteConfiguration |
|
23 | + */ |
|
24 | + private $configuration; |
|
25 | + |
|
26 | + public function __construct(PdoDatabase $database, SiteConfiguration $configuration, HttpHelper $httpHelper) |
|
27 | + { |
|
28 | + parent::__construct($database, $configuration, 'yubikeyotp'); |
|
29 | + $this->httpHelper = $httpHelper; |
|
30 | + $this->configuration = $configuration; |
|
31 | + } |
|
32 | + |
|
33 | + public function authenticate(User $user, $data) |
|
34 | + { |
|
35 | + if (is_array($data)) { |
|
36 | + return false; |
|
37 | + } |
|
38 | + |
|
39 | + $credentialData = $this->getCredentialData($user->getId()); |
|
40 | + |
|
41 | + if ($credentialData === null) { |
|
42 | + return false; |
|
43 | + } |
|
44 | + |
|
45 | + if ($credentialData->getData() !== $this->getYubikeyId($data)) { |
|
46 | + // different device |
|
47 | + return false; |
|
48 | + } |
|
49 | + |
|
50 | + return $this->verifyToken($data); |
|
51 | + } |
|
52 | + |
|
53 | + public function setCredential(User $user, $factor, $data) |
|
54 | + { |
|
55 | + $keyId = $this->getYubikeyId($data); |
|
56 | + $valid = $this->verifyToken($data); |
|
57 | + |
|
58 | + if (!$valid) { |
|
59 | + throw new ApplicationLogicException("Provided token is not valid."); |
|
60 | + } |
|
61 | + |
|
62 | + $storedData = $this->getCredentialData($user->getId()); |
|
63 | + |
|
64 | + if ($storedData === null) { |
|
65 | + $storedData = $this->createNewCredential($user); |
|
66 | + } |
|
67 | + |
|
68 | + $storedData->setData($keyId); |
|
69 | + $storedData->setFactor($factor); |
|
70 | + $storedData->setVersion(1); |
|
71 | + $storedData->setPriority(8); |
|
72 | + |
|
73 | + $storedData->save(); |
|
74 | + } |
|
75 | + |
|
76 | + /** |
|
77 | + * Get the Yubikey ID. |
|
78 | + * |
|
79 | + * This looks like it's just dumping the "password" that's stored in the database, but it's actually fine. |
|
80 | + * |
|
81 | + * We only store the "serial number" of the Yubikey - if we get a validated (by webservice) token prefixed with the |
|
82 | + * serial number, that's a successful OTP authentication. Thus, retrieving the stored data is just retrieving the |
|
83 | + * yubikey's serial number (in modhex format), since the actual security credentials are stored on the device. |
|
84 | + * |
|
85 | + * Note that the serial number is actually the credential serial number - it's possible to regenerate the keys on |
|
86 | + * the device, and that will change the serial number too. |
|
87 | + * |
|
88 | + * More information about the structure of OTPs can be found here: |
|
89 | + * https://developers.yubico.com/OTP/OTPs_Explained.html |
|
90 | + * |
|
91 | + * @param int $userId |
|
92 | + * |
|
93 | + * @return null|string |
|
94 | + */ |
|
95 | + public function getYubikeyData($userId) |
|
96 | + { |
|
97 | + $credential = $this->getCredentialData($userId); |
|
98 | + |
|
99 | + if ($credential === null) { |
|
100 | + return null; |
|
101 | + } |
|
102 | + |
|
103 | + return $credential->getData(); |
|
104 | + } |
|
105 | + |
|
106 | + /** |
|
107 | + * @param $result |
|
108 | + * |
|
109 | + * @return array |
|
110 | + */ |
|
111 | + private function parseYubicoApiResult($result) |
|
112 | + { |
|
113 | + $data = array(); |
|
114 | + foreach (explode("\r\n", $result) as $line) { |
|
115 | + $pos = strpos($line, '='); |
|
116 | + if ($pos === false) { |
|
117 | + continue; |
|
118 | + } |
|
119 | + |
|
120 | + $data[substr($line, 0, $pos)] = substr($line, $pos + 1); |
|
121 | + } |
|
122 | + |
|
123 | + return $data; |
|
124 | + } |
|
125 | + |
|
126 | + private function getYubikeyId($data) |
|
127 | + { |
|
128 | + return substr($data, 0, -32); |
|
129 | + } |
|
130 | + |
|
131 | + private function verifyHmac($apiResponse, $apiKey) |
|
132 | + { |
|
133 | + ksort($apiResponse); |
|
134 | + $signature = $apiResponse['h']; |
|
135 | + unset($apiResponse['h']); |
|
136 | + |
|
137 | + $data = array(); |
|
138 | + foreach ($apiResponse as $key => $value) { |
|
139 | + $data[] = $key . "=" . $value; |
|
140 | + } |
|
141 | + $dataString = implode('&', $data); |
|
142 | + |
|
143 | + $hmac = base64_encode(hash_hmac('sha1', $dataString, base64_decode($apiKey), true)); |
|
144 | + |
|
145 | + return $hmac === $signature; |
|
146 | + } |
|
147 | + |
|
148 | + /** |
|
149 | + * @param $data |
|
150 | + * |
|
151 | + * @return bool |
|
152 | + */ |
|
153 | + private function verifyToken($data) |
|
154 | + { |
|
155 | + $result = $this->httpHelper->get('https://api.yubico.com/wsapi/2.0/verify', array( |
|
156 | + 'id' => $this->configuration->getYubicoApiId(), |
|
157 | + 'otp' => $data, |
|
158 | + 'nonce' => md5(openssl_random_pseudo_bytes(64)), |
|
159 | + )); |
|
160 | + |
|
161 | + $apiResponse = $this->parseYubicoApiResult($result); |
|
162 | + |
|
163 | + if (!$this->verifyHmac($apiResponse, $this->configuration->getYubicoApiKey())) { |
|
164 | + return false; |
|
165 | + } |
|
166 | + |
|
167 | + return $apiResponse['status'] == 'OK'; |
|
168 | + } |
|
169 | 169 | } |
@@ -18,43 +18,43 @@ |
||
18 | 18 | */ |
19 | 19 | class GlobalStateProvider implements IGlobalStateProvider |
20 | 20 | { |
21 | - /** |
|
22 | - * @return array |
|
23 | - */ |
|
24 | - public function &getServerSuperGlobal() |
|
25 | - { |
|
26 | - return $_SERVER; |
|
27 | - } |
|
21 | + /** |
|
22 | + * @return array |
|
23 | + */ |
|
24 | + public function &getServerSuperGlobal() |
|
25 | + { |
|
26 | + return $_SERVER; |
|
27 | + } |
|
28 | 28 | |
29 | - /** |
|
30 | - * @return array |
|
31 | - */ |
|
32 | - public function &getGetSuperGlobal() |
|
33 | - { |
|
34 | - return $_GET; |
|
35 | - } |
|
29 | + /** |
|
30 | + * @return array |
|
31 | + */ |
|
32 | + public function &getGetSuperGlobal() |
|
33 | + { |
|
34 | + return $_GET; |
|
35 | + } |
|
36 | 36 | |
37 | - /** |
|
38 | - * @return array |
|
39 | - */ |
|
40 | - public function &getPostSuperGlobal() |
|
41 | - { |
|
42 | - return $_POST; |
|
43 | - } |
|
37 | + /** |
|
38 | + * @return array |
|
39 | + */ |
|
40 | + public function &getPostSuperGlobal() |
|
41 | + { |
|
42 | + return $_POST; |
|
43 | + } |
|
44 | 44 | |
45 | - /** |
|
46 | - * @return array |
|
47 | - */ |
|
48 | - public function &getSessionSuperGlobal() |
|
49 | - { |
|
50 | - return $_SESSION; |
|
51 | - } |
|
45 | + /** |
|
46 | + * @return array |
|
47 | + */ |
|
48 | + public function &getSessionSuperGlobal() |
|
49 | + { |
|
50 | + return $_SESSION; |
|
51 | + } |
|
52 | 52 | |
53 | - /** |
|
54 | - * @return array |
|
55 | - */ |
|
56 | - public function &getCookieSuperGlobal() |
|
57 | - { |
|
58 | - return $_COOKIE; |
|
59 | - } |
|
53 | + /** |
|
54 | + * @return array |
|
55 | + */ |
|
56 | + public function &getCookieSuperGlobal() |
|
57 | + { |
|
58 | + return $_COOKIE; |
|
59 | + } |
|
60 | 60 | } |
61 | 61 | \ No newline at end of file |
@@ -14,28 +14,28 @@ |
||
14 | 14 | */ |
15 | 15 | interface IGlobalStateProvider |
16 | 16 | { |
17 | - /** |
|
18 | - * @return array |
|
19 | - */ |
|
20 | - public function getServerSuperGlobal(); |
|
17 | + /** |
|
18 | + * @return array |
|
19 | + */ |
|
20 | + public function getServerSuperGlobal(); |
|
21 | 21 | |
22 | - /** |
|
23 | - * @return array |
|
24 | - */ |
|
25 | - public function getGetSuperGlobal(); |
|
22 | + /** |
|
23 | + * @return array |
|
24 | + */ |
|
25 | + public function getGetSuperGlobal(); |
|
26 | 26 | |
27 | - /** |
|
28 | - * @return array |
|
29 | - */ |
|
30 | - public function getPostSuperGlobal(); |
|
27 | + /** |
|
28 | + * @return array |
|
29 | + */ |
|
30 | + public function getPostSuperGlobal(); |
|
31 | 31 | |
32 | - /** |
|
33 | - * @return array |
|
34 | - */ |
|
35 | - public function getSessionSuperGlobal(); |
|
32 | + /** |
|
33 | + * @return array |
|
34 | + */ |
|
35 | + public function getSessionSuperGlobal(); |
|
36 | 36 | |
37 | - /** |
|
38 | - * @return array |
|
39 | - */ |
|
40 | - public function getCookieSuperGlobal(); |
|
37 | + /** |
|
38 | + * @return array |
|
39 | + */ |
|
40 | + public function getCookieSuperGlobal(); |
|
41 | 41 | } |
42 | 42 | \ No newline at end of file |