identifyUser()

Complexity

Conditions	39
Paths	308

Size

Total Lines	399
Code Lines	245

Duplication

Lines	0
Ratio	0 %

Importance

Changes	11
Bugs	1	Features	0

<?php
function identifyUser(string $sentData, array $SETTINGS): bool
{
    $session = SessionManager::getSession();
    $request = SymfonyRequest::createFromGlobals();
    $lang = new Language($session->get('user-language') ?? 'english');
    $session = SessionManager::getSession();
    
    // Prepare GET variables
    $sessionAdmin = $session->get('user-admin');
    $sessionPwdAttempts = $session->get('pwd_attempts');
    $sessionUrl = $session->get('user-initial_url');
    $server = [];
    $server['PHP_AUTH_USER'] =  $request->getUser();
    $server['PHP_AUTH_PW'] = $request->getPassword();
    
    // decrypt and retreive data in JSON format
    if ($session->get('key') === null) {
        $dataReceived = $sentData;
    } else {
        $dataReceived = prepareExchangedData(
            $sentData,
            'decode',
            $session->get('key')
        );
    }

    // Base64 decode sensitive data
    if (isset($dataReceived['pw'])) {
        $dataReceived['pw'] = base64_decode($dataReceived['pw']);
    }
    
    // Check if Duo auth is in progress and pass the pw and login back to the standard login process
    if(
        isKeyExistingAndEqual('duo', 1, $SETTINGS) === true
        && $dataReceived['user_2fa_selection'] === 'duo'
        && $session->get('user-duo_status') === 'IN_PROGRESS'
        && !empty($dataReceived['duo_state'])
    ){
        $key = hash('sha256', $dataReceived['duo_state']);
        $iv = substr(hash('sha256', $dataReceived['duo_state']), 0, 16);
        $duo_data_dec = openssl_decrypt(base64_decode($session->get('user-duo_data')), 'AES-256-CBC', $key, 0, $iv);
        // Clear the data from the Duo process to continue clean with the standard login process
        $session->set('user-duo_data','');
        if($duo_data_dec === false) {
            // Add failed authentication log
            addFailedAuthentication(filter_var($dataReceived['login'], FILTER_SANITIZE_FULL_SPECIAL_CHARS), getClientIpServer());

            echo prepareExchangedData(
                [
                    'error' => true,
                    'message' => $lang->get('duo_error_decrypt'),
                ],
                'encode'
            );
            return false;
        }
        $duo_data = unserialize($duo_data_dec);
        $dataReceived['pw'] = $duo_data['duo_pwd'];
        $dataReceived['login'] = $duo_data['duo_login'];
    }

    if(isset($dataReceived['pw']) === false || isset($dataReceived['login']) === false) {
        echo json_encode([
            'data' => prepareExchangedData(
                [
                    'error' => true,
                    'message' => $lang->get('ga_enter_credentials'),
                ],
                'encode'
            ),
            'key' => $session->get('key')
        ]);
        return false;
    }

    // prepare variables
    // IMPORTANT: Do NOT sanitize passwords - they should be treated as opaque binary data
    // Sanitization was removed to fix authentication issues (see upgrade 3.1.5.10)
    $userCredentials = identifyGetUserCredentials(
        $SETTINGS,
        (string) $server['PHP_AUTH_USER'],
        (string) $server['PHP_AUTH_PW'],
        (string) $dataReceived['pw'], // No more sanitization
        (string) filter_var($dataReceived['login'], FILTER_SANITIZE_FULL_SPECIAL_CHARS)
    );
    $username = $userCredentials['username'];
    $passwordClear = $userCredentials['passwordClear'];
    
    // DO initial checks
    $userInitialData = identifyDoInitialChecks(
        $SETTINGS,
        (int) $sessionPwdAttempts,
        (string) $username,
        (int) $sessionAdmin,
        (string) $sessionUrl,
        (string) filter_var($dataReceived['user_2fa_selection'], FILTER_SANITIZE_FULL_SPECIAL_CHARS)
    );

    // if user doesn't exist in Teampass then return error
    if ($userInitialData['error'] === true) {
        // Add log on error unless skip_anti_bruteforce flag is set to true
        if (empty($userInitialData['skip_anti_bruteforce'])
            || !$userInitialData['skip_anti_bruteforce']) {

            // Add failed authentication log
            addFailedAuthentication($username, getClientIpServer());
        }

        echo prepareExchangedData(
            $userInitialData['array'],
            'encode'
        );
        return false;
    }

    $userInfo = $userInitialData['userInfo'] + $dataReceived;
    $return = '';

    // Check if LDAP is enabled and user is in AD
    $userLdap = identifyDoLDAPChecks(
        $SETTINGS,
        $userInfo,
        (string) $username,
        (string) $passwordClear,
        (int) $sessionAdmin,
        (string) $sessionUrl,
        (int) $sessionPwdAttempts
    );
    if ($userLdap['error'] === true) {
        // Log LDAP/AD failed authentication into teampass_log_system
        logEvents(
            $SETTINGS,
            'failed_auth',
            'password_is_not_correct',
            '',
            stripslashes($username),
            stripslashes($username)
        );

        // Anti-bruteforce log
        addFailedAuthentication($username, getClientIpServer());

        echo prepareExchangedData(
            $userLdap['array'],
            'encode'
        );
        return false;
    }

    if (isset($userLdap['user_info']) === true && (int) $userLdap['user_info']['has_been_created'] === 1) {
        // Add failed authentication log
        addFailedAuthentication($username, getClientIpServer());

        echo json_encode([
            'data' => prepareExchangedData(
                [
                    'error' => true,
                    'message' => '',
                    'extra' => 'ad_user_created',
                ],
                'encode'
            ),
            'key' => $session->get('key')
        ]);
        return false;
    }
    
    // Is oauth2 user exists?
    $userOauth2 = checkOauth2User(
        (array) $SETTINGS,
        (array) $userInfo,
        (string) $username,
        (string) $passwordClear,
        (int) $userLdap['user_info']['has_been_created']
    );
    if ($userOauth2['error'] === true) {
        $session->set('userOauth2Info', '');

        // Add failed authentication log
        if ($userOauth2['no_log_event'] !== true) {
            addFailedAuthentication($username, getClientIpServer());
        }

        // deepcode ignore ServerLeak: File and path are secured directly inside the function decryptFile()        
        echo prepareExchangedData(
            [
                'error' => true,
                'message' => $lang->get($userOauth2['message']),
                'extra' => 'oauth2_user_not_found',
            ],
            'encode'
        );
        return false;
    }

    // Check user and password
    $authResult = checkCredentials($passwordClear, $userInfo);
    if ($userLdap['userPasswordVerified'] === false && $userOauth2['userPasswordVerified'] === false && $authResult['authenticated'] !== true) {
        // Log failure (wrong password on existing account) into teampass_log_system
        logEvents($SETTINGS, 'failed_auth', 'password_is_not_correct', '', stripslashes($username), stripslashes($username));
        // Add failed authentication log
        addFailedAuthentication($username, getClientIpServer());
        echo prepareExchangedData(
            [
                'value' => '',
                'error' => true,
                'message' => $lang->get('error_bad_credentials'),
            ],
            'encode'
        );
        return false;
    }
    
    // If password was migrated, then update private key
    if ($authResult['password_migrated'] === true) {
        $userInfo['private_key'] = $authResult['private_key_reencrypted'];
    }
    
    // Check if MFA is required
    if ((
        isOneVarOfArrayEqualToValue(
            [
                (int) $SETTINGS['yubico_authentication'],
                (int) $SETTINGS['google_authentication'],
                (int) $SETTINGS['duo']
            ],
            1
        ) === true)
        && (((int) $userInfo['admin'] !== 1 && (int) $userInfo['mfa_enabled'] === 1 && $userInfo['mfa_auth_requested_roles'] === true)
        || ((int) $SETTINGS['admin_2fa_required'] === 1 && (int) $userInfo['admin'] === 1))
    ) {
        // Check user against MFA method if selected
        $userMfa = identifyDoMFAChecks(
            $SETTINGS,
            $userInfo,
            $dataReceived,
            $userInitialData,
            (string) $username
        );
        if ($userMfa['error'] === true) {
            // Add failed authentication log
            addFailedAuthentication($username, getClientIpServer());

            echo prepareExchangedData(
                [
                    'error' => true,
                    'message' => $userMfa['mfaData']['message'],
                    'mfaStatus' => $userMfa['mfaData']['mfaStatus'],
                ],
                'encode'
            );
            return false;
        } elseif ($userMfa['mfaQRCodeInfos'] === true) {
            // Add failed authentication log
            addFailedAuthentication($username, getClientIpServer());

            // Case where user has initiated Google Auth
            // Return QR code
            echo prepareExchangedData(
                [
                    'value' => $userMfa['mfaData']['value'],
                    'user_admin' => isset($sessionAdmin) ? (int) $sessionAdmin : 0,
                    'initial_url' => isset($sessionUrl) === true ? $sessionUrl : '',
                    'pwd_attempts' => (int) $sessionPwdAttempts,
                    'error' => false,
                    'message' => $userMfa['mfaData']['message'],
                    'mfaStatus' => $userMfa['mfaData']['mfaStatus'],
                ],
                'encode'
            );
            return false;
        } elseif ($userMfa['duo_url_ready'] === true) {
            // Add failed authentication log
            addFailedAuthentication($username, getClientIpServer());

            // Case where user has initiated Duo Auth
            // Return the DUO redirect URL
            echo prepareExchangedData(
                [
                    'user_admin' => isset($sessionAdmin) ? (int) $sessionAdmin : 0,
                    'initial_url' => isset($sessionUrl) === true ? $sessionUrl : '',
                    'pwd_attempts' => (int) $sessionPwdAttempts,
                    'error' => false,
                    'message' => $userMfa['mfaData']['message'],
                    'duo_url_ready' => $userMfa['mfaData']['duo_url_ready'],
                    'duo_redirect_url' => $userMfa['mfaData']['duo_redirect_url'],
                    'mfaStatus' => $userMfa['mfaData']['mfaStatus'],
                ],
                'encode'
            );
            return false;
        }
    }

    // Can connect if
    // 1- no LDAP mode + user enabled + pw ok
    // 2- LDAP mode + user enabled + ldap connection ok + user is not admin
    // 3- LDAP mode + user enabled + pw ok + usre is admin
    // This in order to allow admin by default to connect even if LDAP is activated
    if (canUserGetLog(
            $SETTINGS,
            (int) $userInfo['disabled'],
            $username,
            $userLdap['ldapConnection']
        ) === true
    ) {
        $session->set('pwd_attempts', 0);

        // Check if any unsuccessfull login tries exist
        handleLoginAttempts(
            $userInfo['id'],
            $userInfo['login'],
            $userInfo['last_connexion'],
            $username,
            $SETTINGS,
        );

        // Avoid unlimited session.
        $max_time = isset($SETTINGS['maximum_session_expiration_time']) ? (int) $SETTINGS['maximum_session_expiration_time'] : 60;
        $session_time = min($dataReceived['duree_session'], $max_time);
        $lifetime = time() + ($session_time * 60);

        // Build user session - Extracted to separate function for readability
        $sessionData = buildUserSession($session, $userInfo, $username, $passwordClear, $SETTINGS, $lifetime);
        $old_key = $sessionData['old_key'];
        $returnKeys = $sessionData['returnKeys'];
        
        // Setup user roles and permissions - Extracted to separate function for readability
        $rolesDbUpdateData = setupUserRolesAndPermissions($session, $userInfo, $SETTINGS);
        
        // Perform post-login tasks - Extracted to separate function for readability
        $isNewExternalUser = $userLdap['user_initial_creation_through_external_ad'] === true 
            || $userOauth2['retExternalAD']['has_been_created'] === 1;
        
        // Merge roles DB update into returnKeys for performPostLoginTasks
        $returnKeys['roles_db_update'] = $rolesDbUpdateData;
        
        performPostLoginTasks(
            $session,
            $userInfo,
            $passwordClear,
            $SETTINGS,
            $dataReceived,
            $returnKeys,
            $isNewExternalUser
        );
        
        // send back the random key
        $return = $dataReceived['randomstring'];
        
        // Ensure Complexity levels are translated
        defineComplexity();
        echo prepareExchangedData(
            buildAuthResponse(
                $session,
                (string) $sessionUrl,
                (int) $sessionPwdAttempts,
                (string) $return,
                (array) $userInfo ?? [],
                true  // success
            ),
            'encode',
            $old_key
        );
    
        return true;

    } elseif ((int) $userInfo['disabled'] === 1) {
        // User and password is okay but account is locked
        echo prepareExchangedData(
            buildAuthResponse(
                $session,
                (string) $sessionUrl,
                0,
                (string) $return,
                (array) $userInfo ?? [],
                false,  // not success
                'user_is_locked',
                $lang->get('account_is_locked')
            ),
            'encode'
        );
        return false;
    }

    echo prepareExchangedData(
        buildAuthResponse(
            $session,
            (string) $sessionUrl,
            (int) $sessionPwdAttempts,
            (string) $return,
            (array) $userInfo ?? [],
            false,  // not success
            true,
            $lang->get('error_not_allowed_to_authenticate')
        ),
        'encode'
    );
    return false;
}