688f5f5477dfe0101d8767804348ece4de7f9193
2 /***************************************************************************
3 * Copyright (C) 2003-2008 Polytechnique.org *
4 * http://opensource.polytechnique.org/ *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
22 /** Authentication level.
23 * Only AUTH_PUBLIC is mandatory. The others are defined as useful values,
24 * but can be overwritten by others auth levels definitions.
26 define('AUTH_SUID', -1);
27 define('AUTH_PUBLIC', 0);
28 define('AUTH_COOKIE', 5);
29 define('AUTH_MDP', 10);
32 /** The PlSession is a wrapper around the user session management.
34 abstract class PlSession
36 /** Build a new session object.
37 * If a session is already started, this just wraps the session... if no
38 * session is currently started, this set the base session variables.
39 * * auth contains the current authentication level. The level is
40 * an integer that grows with the security of the authentication
42 * * perms contains the current permission flags of the user. This flags
43 * depends on the category of the user.
44 * * challenge contains a random uniq id for authentication.
45 * * xsrf_token contains a random uniq id for xsrf prevention.
46 * * user contains a reference to the current user.
48 public function __construct()
53 /** Build the session structure with system fields.
55 private function fillSession()
57 S
::bootstrap('user', null
);
58 S
::bootstrap('auth', AUTH_PUBLIC
);
59 S
::bootstrap('challenge', sha1(uniqid(rand(), true
)));
60 S
::bootstrap('xsrf_token', rand_url_id());
61 S
::bootstrap('perms', new PlFlagSet());
64 /** Write current session and close it.
66 public function close()
68 session_write_close();
71 /** Create a new session
73 private function create()
79 /** Kill the current session.
81 public function destroy()
88 /** Check if the user has at least the given authentication level.
90 public function checkAuth($level)
92 return S
::i('auth') >= $level;
95 /** Check if the user has the given permissions.
97 public function checkPerms($perms)
99 return S
::v('perms')->hasFlagCombination($perms);
102 /** Run authentication procedure to reach at least the given level.
104 public function start($level)
106 $backup = S
::i($level);
107 if ($this->checkAuth($level)) {
110 $user = $this->doAuth($level);
111 if (is_null($user)) {
114 if (!$this->checkAuth($level)) {
118 if ($this->startSessionAs($user, $level)) {
119 if (is_null(S
::v('user'))) {
120 S
::set('user', $user);
130 /*** Abstract methods ***/
132 /** Function that check authentication at build time of the session object.
133 * This is useful to perform authentication from a cookie or when coming
134 * back from a authentication service.
136 * This function must NOT try to launch a new authenticatioin procedure. It
137 * just tests if the environment contains sufficient information to start
140 * This function return false if informations are available but lead to an
141 * authentication failure (invalid cookie, invalid service return data...)
143 abstract public function startAvailableAuth();
145 /** Run the effectively authentication procedure to reach the given user.
146 * This method must return a user object (that will be used to fill the
147 * $_SESSION['user'] field).
149 * If auth failed, the function MUST return null. If auth succeed, the
150 * field $_SESSION['auth'] MUST be filled to the current effective level.
152 abstract protected function doAuth($level);
154 /** Set the session environment to the given user and authentication level.
155 * This function MUST return false if a session is already started and the
158 * On succes, this function MUST return true.
159 * If $level is set to -1, this means you are building a new SUID session.
161 abstract protected function startSessionAs($user, $level);
163 /** Check authentication with the given token.
165 * Token authentication is a light-weight authentication based on a user-specific token.
166 * This can be used for protocols that requires a 'cookie'-free authentication, such as
167 * RSS, iCal registration...
169 * This function returns a valid user object if authentication is successful, or null if
172 abstract public function tokenAuth($login, $token);
175 /*** SUID management ***/
177 /** Start a new SUID session.
179 public function startSUID($user)
181 if (S
::has('suid')) {
186 $this->fillSession();
187 S
::set('suid', $backup);
188 if (!$this->startSessionAs($user, AUTH_SUID
)) {
192 S
::set('user', $user);
196 /** Stop a SUID session
198 public function stopSUID()
200 if (!S
::has('suid')) {
203 $_SESSION = $_SESSION['suid'];
210 /** Minimum level of authentication that is considered as logged.
212 abstract public function loggedLevel();
214 /** Minimum level of authentication that is considered as sure.
216 abstract public function sureLevel();
219 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: