Skip to content
Snippets Groups Projects
Commit d83d0291 authored by Thijs Kinkhorst's avatar Thijs Kinkhorst
Browse files

Code style: spaces, lowercase keywords. 

No functional changes.

For: #458
parent 078b1e23
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
modules/authX509/lib/Auth/Process/ExpiryWarning.php
+ 2
− 2
View file @ d83d0291
...@@ -56,7 +56,7 @@ class sspmod_authX509_Auth_Process_ExpiryWarning extends SimpleSAML_Auth_Process ...@@ -56,7 +56,7 @@ class sspmod_authX509_Auth_Process_ExpiryWarning extends SimpleSAML_Auth_Process
public function process(&$state) { public function process(&$state) {
assert('is_array($state)'); assert('is_array($state)');
if (isset($state['isPassive']) && $state['isPassive'] === TRUE) { if (isset($state['isPassive']) && $state['isPassive'] === true) {
// We have a passive request. Skip the warning // We have a passive request. Skip the warning
return; return;
} }
...@@ -68,7 +68,7 @@ class sspmod_authX509_Auth_Process_ExpiryWarning extends SimpleSAML_Auth_Process ...@@ -68,7 +68,7 @@ class sspmod_authX509_Auth_Process_ExpiryWarning extends SimpleSAML_Auth_Process
$client_cert = $_SERVER['SSL_CLIENT_CERT']; $client_cert = $_SERVER['SSL_CLIENT_CERT'];
$client_cert_data = openssl_x509_parse($client_cert); $client_cert_data = openssl_x509_parse($client_cert);
if ($client_cert_data == FALSE) { if ($client_cert_data == false) {
SimpleSAML\Logger::error('authX509: invalid cert'); SimpleSAML\Logger::error('authX509: invalid cert');
return; return;
} }
......
modules/authX509/lib/Auth/Source/X509userCert.php
+ 229
− 228
View file @ d83d0291
...@@ -9,233 +9,234 @@ ...@@ -9,233 +9,234 @@
*/ */
class sspmod_authX509_Auth_Source_X509userCert extends SimpleSAML_Auth_Source { class sspmod_authX509_Auth_Source_X509userCert extends SimpleSAML_Auth_Source {
/** /**
* x509 attributes to use from the certificate * x509 attributes to use from the certificate
* for searching the user in the LDAP directory. * for searching the user in the LDAP directory.
*/ */
private $x509attributes = array('UID' => 'uid'); private $x509attributes = array('UID' => 'uid');
/** /**
* LDAP attribute containing the user certificate * LDAP attribute containing the user certificate
*/ */
private $ldapusercert = array('userCertificate;binary'); private $ldapusercert = array('userCertificate;binary');
/** /**
* LDAPConfigHelper object * LDAPConfigHelper object
*/ */
private $ldapcf; private $ldapcf;
/** /**
* Constructor for this authentication source. * Constructor for this authentication source.
* *
* All subclasses who implement their own constructor must call this * All subclasses who implement their own constructor must call this
* constructor before using $config for anything. * constructor before using $config for anything.
* *
* @param array $info Information about this authentication source. * @param array $info Information about this authentication source.
* @param array &$config Configuration for this authentication source. * @param array &$config Configuration for this authentication source.
*/ */
public function __construct($info, &$config) { public function __construct($info, &$config) {
assert('is_array($info)'); assert('is_array($info)');
assert('is_array($config)'); assert('is_array($config)');
if (isset($config['authX509:x509attributes'])) if (isset($config['authX509:x509attributes']))
$this->x509attributes = $this->x509attributes =
$config['authX509:x509attributes']; $config['authX509:x509attributes'];
if (array_key_exists('authX509:ldapusercert', $config)) if (array_key_exists('authX509:ldapusercert', $config))
$this->ldapusercert = $this->ldapusercert =
$config['authX509:ldapusercert']; $config['authX509:ldapusercert'];
parent::__construct($info, $config); parent::__construct($info, $config);
$this->ldapcf = new sspmod_ldap_ConfigHelper($config, $this->ldapcf = new sspmod_ldap_ConfigHelper($config,
'Authentication source ' . var_export($this->authId, TRUE)); 'Authentication source ' . var_export($this->authId, true));
return; return;
} }
/** /**
* Convert certificate from PEM to DER * Convert certificate from PEM to DER
* *
* @param array $pem_data PEM-encoded certificate * @param array $pem_data PEM-encoded certificate
*/ */
private function pem2der($pem_data) { private function pem2der($pem_data) {
$begin = "CERTIFICATE-----"; $begin = "CERTIFICATE-----";
$end = "-----END"; $end = "-----END";
$pem_data = substr($pem_data, $pem_data = substr($pem_data,
strpos($pem_data, $begin)+strlen($begin)); strpos($pem_data, $begin)+strlen($begin));
$pem_data = substr($pem_data, 0, strpos($pem_data, $end)); $pem_data = substr($pem_data, 0, strpos($pem_data, $end));
$der = base64_decode($pem_data); $der = base64_decode($pem_data);
return $der; return $der;
} }
/** /**
* Convert certificate from DER to PEM * Convert certificate from DER to PEM
* *
* @param array $der_data DER-encoded certificate * @param array $der_data DER-encoded certificate
*/ */
private function der2pem($der_data) { private function der2pem($der_data) {
$pem = chunk_split(base64_encode($der_data), 64, "\n"); $pem = chunk_split(base64_encode($der_data), 64, "\n");
$pem = "-----BEGIN CERTIFICATE-----\n".$pem. $pem = "-----BEGIN CERTIFICATE-----\n".$pem.
"-----END CERTIFICATE-----\n"; "-----END CERTIFICATE-----\n";
return $pem; return $pem;
} }
/** /**
* Finish a failed authentication. * Finish a failed authentication.
* *
* This function can be overloaded by a child authentication * This function can be overloaded by a child authentication
* class that wish to perform some operations on failure * class that wish to perform some operations on failure
* *
* @param array &$state Information about the current authentication. * @param array &$state Information about the current authentication.
*/ */
public function authFailed(&$state) { public function authFailed(&$state) {
$config = SimpleSAML_Configuration::getInstance(); $config = SimpleSAML_Configuration::getInstance();
$t = new SimpleSAML_XHTML_Template($config, $t = new SimpleSAML_XHTML_Template($config,
'authX509:X509error.php'); 'authX509:X509error.php');
$t->data['errorcode'] = $state['authX509.error']; $t->data['errorcode'] = $state['authX509.error'];
$t->show(); $t->show();
exit(); exit();
} }
/** /**
* Validate certificate and login * Validate certificate and login
* *
* This function try to validate the certificate. * This function try to validate the certificate.
* On success, the user is logged in without going through * On success, the user is logged in without going through
* o login page. * o login page.
* On failure, The authX509:X509error.php template is * On failure, The authX509:X509error.php template is
* loaded. * loaded.
* *
* @param array &$state Information about the current authentication. * @param array &$state Information about the current authentication.
*/ */
public function authenticate(&$state) { public function authenticate(&$state) {
assert('is_array($state)'); assert('is_array($state)');
$ldapcf = $this->ldapcf; $ldapcf = $this->ldapcf;
if (!isset($_SERVER['SSL_CLIENT_CERT']) || if (!isset($_SERVER['SSL_CLIENT_CERT']) ||
($_SERVER['SSL_CLIENT_CERT'] == '')) { ($_SERVER['SSL_CLIENT_CERT'] == '')) {
$state['authX509.error'] = "NOCERT"; $state['authX509.error'] = "NOCERT";
$this->authFailed($state); $this->authFailed($state);
assert('FALSE'); // NOTREACHED assert('false'); // NOTREACHED
return; return;
} }
$client_cert = $_SERVER['SSL_CLIENT_CERT']; $client_cert = $_SERVER['SSL_CLIENT_CERT'];
$client_cert_data = openssl_x509_parse($client_cert); $client_cert_data = openssl_x509_parse($client_cert);
if ($client_cert_data == FALSE) { if ($client_cert_data == false) {
SimpleSAML\Logger::error('authX509: invalid cert'); SimpleSAML\Logger::error('authX509: invalid cert');
$state['authX509.error'] = "INVALIDCERT"; $state['authX509.error'] = "INVALIDCERT";
$this->authFailed($state); $this->authFailed($state);
assert('FALSE'); // NOTREACHED assert('false'); // NOTREACHED
return; return;
} }
$dn = NULL; $dn = null;
foreach ($this->x509attributes as $x509_attr => $ldap_attr) { foreach ($this->x509attributes as $x509_attr => $ldap_attr) {
/* value is scalar */ /* value is scalar */
if (array_key_exists($x509_attr, $client_cert_data['subject'])) { if (array_key_exists($x509_attr, $client_cert_data['subject'])) {
$value = $client_cert_data['subject'][$x509_attr]; $value = $client_cert_data['subject'][$x509_attr];
SimpleSAML\Logger::info('authX509: cert '. SimpleSAML\Logger::info('authX509: cert '.
$x509_attr.' = '.$value); $x509_attr.' = '.$value);
$dn = $ldapcf->searchfordn($ldap_attr, $value, TRUE); $dn = $ldapcf->searchfordn($ldap_attr, $value, true);
if ($dn !== NULL) if ($dn !== null) {
break; break;
} }
} }
}
if ($dn === NULL) {
SimpleSAML\Logger::error('authX509: cert has '. if ($dn === null) {
'no matching user in LDAP'); SimpleSAML\Logger::error('authX509: cert has '.
$state['authX509.error'] = "UNKNOWNCERT"; 'no matching user in LDAP');
$this->authFailed($state); $state['authX509.error'] = "UNKNOWNCERT";
$this->authFailed($state);
assert('FALSE'); /* NOTREACHED */
return; assert('false'); /* NOTREACHED */
} return;
}
if ($this->ldapusercert === NULL) { // do not check for certificate match
$attributes = $ldapcf->getAttributes($dn); if ($this->ldapusercert === null) { // do not check for certificate match
assert('is_array($attributes)'); $attributes = $ldapcf->getAttributes($dn);
$state['Attributes'] = $attributes; assert('is_array($attributes)');
$this->authSuccesful($state); $state['Attributes'] = $attributes;
$this->authSuccesful($state);
assert('FALSE'); /* NOTREACHED */
return; assert('false'); /* NOTREACHED */
} return;
}
$ldap_certs = $ldapcf->getAttributes($dn, $this->ldapusercert);
if ($ldap_certs === FALSE) { $ldap_certs = $ldapcf->getAttributes($dn, $this->ldapusercert);
SimpleSAML\Logger::error('authX509: no certificate '. if ($ldap_certs === false) {
'found in LDAP for dn='.$dn); SimpleSAML\Logger::error('authX509: no certificate '.
$state['authX509.error'] = "UNKNOWNCERT"; 'found in LDAP for dn='.$dn);
$this->authFailed($state); $state['authX509.error'] = "UNKNOWNCERT";
$this->authFailed($state);
assert('FALSE'); /* NOTREACHED */
return; assert('false'); /* NOTREACHED */
} return;
}
$merged_ldapcerts = array();
foreach ($this->ldapusercert as $attr) $merged_ldapcerts = array();
$merged_ldapcerts = array_merge($merged_ldapcerts, foreach ($this->ldapusercert as $attr)
$ldap_certs[$attr]); $merged_ldapcerts = array_merge($merged_ldapcerts,
$ldap_certs = $merged_ldapcerts; $ldap_certs[$attr]);
$ldap_certs = $merged_ldapcerts;
foreach ($ldap_certs as $ldap_cert) {
$pem = $this->der2pem($ldap_cert); foreach ($ldap_certs as $ldap_cert) {
$ldap_cert_data = openssl_x509_parse($pem); $pem = $this->der2pem($ldap_cert);
if($ldap_cert_data == FALSE) { $ldap_cert_data = openssl_x509_parse($pem);
SimpleSAML\Logger::error('authX509: cert in '. if($ldap_cert_data == false) {
'LDAP in invalid for '. SimpleSAML\Logger::error('authX509: cert in '.
'dn = '.$dn); 'LDAP in invalid for '.
continue; 'dn = '.$dn);
} continue;
}
if ($ldap_cert_data === $client_cert_data) {
$attributes = $ldapcf->getAttributes($dn); if ($ldap_cert_data === $client_cert_data) {
assert('is_array($attributes)'); $attributes = $ldapcf->getAttributes($dn);
$state['Attributes'] = $attributes; assert('is_array($attributes)');
$this->authSuccesful($state); $state['Attributes'] = $attributes;
$this->authSuccesful($state);
assert('FALSE'); /* NOTREACHED */
return; assert('false'); /* NOTREACHED */
} return;
} }
}
SimpleSAML\Logger::error('authX509: no matching cert in '.
'LDAP for dn = '.$dn); SimpleSAML\Logger::error('authX509: no matching cert in '.
$state['authX509.error'] = "UNKNOWNCERT"; 'LDAP for dn = '.$dn);
$this->authFailed($state); $state['authX509.error'] = "UNKNOWNCERT";
$this->authFailed($state);
assert('FALSE'); /* NOTREACHED */
return; assert('false'); /* NOTREACHED */
} return;
}
/**
* Finish a succesfull authentication. /**
* * Finish a succesful authentication.
* This function can be overloaded by a child authentication *
* class that wish to perform some operations after login. * This function can be overloaded by a child authentication
* * class that wish to perform some operations after login.
* @param array &$state Information about the current authentication. *
*/ * @param array &$state Information about the current authentication.
public function authSuccesful(&$state) { */
SimpleSAML_Auth_Source::completeAuth($state); public function authSuccesful(&$state) {
SimpleSAML_Auth_Source::completeAuth($state);
assert('FALSE'); /* NOTREACHED */
return; assert('false'); /* NOTREACHED */
} return;
}
} }
modules/authX509/templates/X509error.php
+ 1
− 1
View file @ d83d0291
...@@ -6,7 +6,7 @@ $this->includeAtTemplateBase('includes/header.php'); ...@@ -6,7 +6,7 @@ $this->includeAtTemplateBase('includes/header.php');
?> ?>
<?php <?php
if ($this->data['errorcode'] !== NULL) { if ($this->data['errorcode'] !== null) {
?> ?>
<div style="border-left: 1px solid #e8e8e8; border-bottom: 1px solid #e8e8e8; background: #f5f5f5"> <div style="border-left: 1px solid #e8e8e8; border-bottom: 1px solid #e8e8e8; background: #f5f5f5">
<img src="/<?php echo $this->data['baseurlpath']; ?>resources/icons/experience/gtk-dialog-error.48x48.png" class="float-l" style="margin: 15px" alt="" /> <img src="/<?php echo $this->data['baseurlpath']; ?>resources/icons/experience/gtk-dialog-error.48x48.png" class="float-l" style="margin: 15px" alt="" />
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment