nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-08-26 17:56:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Most of an implementation of Digest authentication is added.

Browse Source
This commit is contained in:
Andrew McMillan 2007-08-07 22:39:39 +12:00
parent 7d78b939c3
commit cab5bf737c
1 changed files with 105 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

120
inc/BasicAuthSession.php
View File

@ -1,9 +1,9 @@
<?php
/**
* A Class for handling HTTP Basic Authentication
* A Class for handling HTTP Authentication
*
* @package rscds
* @subpackage BasicAuthSession
* @subpackage HTTPAuthSession
* @author Andrew McMillan <andrew@catalyst.net.nz>
* @copyright Catalyst .Net Ltd
* @license http://gnu.org/copyleft/gpl.html GNU GPL v2
@ -14,7 +14,7 @@
*
* @package rscds
*/
class BasicAuthSession {
class HTTPAuthSession {
/**#@+
* @access private
*/
@ -45,30 +45,119 @@ class BasicAuthSession {
/**#@-*/
/**
* The constructor, which pretty much drives it all
* The constructor, which just calls the actual type configured
*/
function HTTPAuthSession() {
global $c;
if ( $c->http_auth_mode == "Digest" ) {
$this->DigestAuthSession();
}
else {
$this->BasicAuthSession();
}
}
/**
* Authorisation failed, so we send some headers to say so.
*
* @param string $auth_header The WWW-Authenticate header details.
*/
function AuthFailedResponse( $auth_header = "" ) {
global $c;
if ( $auth_header == "" ) {
$auth_header = sprintf( 'WWW-Authenticate: Basic realm="%s"', $c->system_name);
}
header('HTTP/1.1 401 Unauthorized', true, 401 );
header('Content-type: text/plain; ; charset="utf-8"' );
header( $auth_header );
echo 'Please log in for access to this system.';
dbg_error_log( "HTTPAuth", ":Session: User is not authorised" );
exit;
}
/**
* Handle Basic HTTP Authentication (not secure unless https)
*/
function BasicAuthSession() {
global $c;
if ( isset($_SERVER['PHP_AUTH_USER']) ) {
if ( $u = $this->CheckPassword( $_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW'] ) ) {
$this->AssignSessionDetails($u);
}
else {
unset($_SERVER['PHP_AUTH_USER']);
return;
}
}
if (!isset($_SERVER['PHP_AUTH_USER'])) {
header('HTTP/1.1 401 Unauthorized', true, 401 );
header('Content-type: text/plain; ; charset="utf-8"' );
header( sprintf( 'WWW-Authenticate: Basic realm="%s"', $c->system_name) );
echo 'Please log in for access to this system.';
dbg_error_log( "BasicAuth", ":Session: User is not authorised" );
exit;
}
$this->AuthFailedResponse();
// Does not return
}
/**
* Handle Digest HTTP Authentication (no passwords were harmed in this transaction!)
*
* Note that this will not actually work, unless we can either:
* (A) store the password plain text in the database
* (B) store an md5( username || realm || password ) in the database
*
* The problem is that potentially means that the administrator can collect the sorts
* of things people use as passwords. I believe this is quite a bad idea. In scenario (B)
* while they cannot see the password itself, they can see a hash which only varies when
* the password varies, so can see when two users have the same password, or can use
* some of the reverse lookup sites to attempt to reverse the hash. I think this is a
* less bad idea, but not ideal. Probably better than running Basic auth of HTTP though!
*/
function DigestAuthSession() {
global $c;
if ( ! empty($_SERVER['PHP_AUTH_DIGEST'])) {
// analyze the PHP_AUTH_DIGEST variable
if ( $data = $this->ParseDigestHeader($_SERVER['PHP_AUTH_DIGEST']) ) {
// generate the valid response
$user_password = "Don't be silly! Why would a user have a password like this!!?";
/**
* TODO: At this point we need to query the database for something fitting
* either strategy (A) or (B) above, in order to set $user_password to
* something useful!
*/
$A1 = md5($data['username'] . ':' . $c->system_name . ':' . $user_password);
$A2 = md5($_SERVER['REQUEST_METHOD'].':'.$data['uri']);
$valid_response = md5($A1.':'.$data['nonce'].':'.$data['nc'].':'.$data['cnonce'].':'.$data['qop'].':'.$A2);
if ( $data['response'] == $valid_response ) {
$this->AssignSessionDetails($u);
return;
}
}
}
$nonce = uniqid();
$opaque = md5($c->system_name);
$this->AuthFailedResponse( sprintf('WWW-Authenticate: Digest realm="%s", qop="auth,auth-int", nonce="%s", opaque="%s"', $c->system_name, $nonce, $opaque ) );
}
/**
* Parse the HTTP Digest Auth Header
* - largely sourced from the PHP documentation
*/
function ParseDigestHeader($auth_header) {
// protect against missing data
$needed_parts = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1, 'uri'=>1, 'response'=>1);
$data = array();
preg_match_all('@(\w+)=(?:([\'"])([^\2]+)\2|([^\s,]+))@', $auth_header, $matches, PREG_SET_ORDER);
foreach ($matches as $m) {
$data[$m[1]] = $m[3] ? $m[3] : $m[4];
unset($needed_parts[$m[1]]);
}
return $needed_parts ? false : $data;
}
/**
* CheckPassword does all of the password checking and
* returns a user record object, or false if it all ends in tears.
@ -146,4 +235,5 @@ class BasicAuthSession {
}
?>