53250d621b9b5f64d3920fa05249b9364903d9e0
2 /***************************************************************************
3 * Copyright (C) 2003-2011 Polytechnique.org *
4 * http://opensource.polytechnique.org/ *
6 * This program is free software; you can redistribute it and/or modify *
7 * it under the terms of the GNU General Public License as published by *
8 * the Free Software Foundation; either version 2 of the License, or *
9 * (at your option) any later version. *
11 * This program is distributed in the hope that it will be useful, *
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of *
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
14 * GNU General Public License for more details. *
16 * You should have received a copy of the GNU General Public License *
17 * along with this program; if not, write to the Free Software *
19 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA *
20 ***************************************************************************/
22 class AuthModule
extends PLModule
27 'groupex/donne-chall.php' => $this->make_hook('chall', AUTH_PUBLIC
),
28 'groupex/export-econfiance.php' => $this->make_hook('econf', AUTH_PUBLIC
, 'user', NO_HTTPS
),
30 'webservices/manageurs.php' => $this->make_hook('manageurs', AUTH_PUBLIC
, 'user', NO_HTTPS
),
32 'auth-redirect.php' => $this->make_hook('redirect', AUTH_COOKIE
, 'user'),
33 'auth-groupex.php' => $this->make_hook('groupex_old', AUTH_COOKIE
, ''),
34 'auth-groupex' => $this->make_hook('groupex', AUTH_PUBLIC
, ''),
35 'admin/auth-groupes-x' => $this->make_hook('admin_authgroupesx', AUTH_PASSWD
, 'admin'),
39 function handler_chall($page)
41 $_SESSION["chall"] = uniqid(rand(), 1);
42 echo $_SESSION["chall"] . "\n" . session_id();
46 function handler_econf($page)
50 $cle = $globals->core
->econfiance
;
52 $res = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<membres>\n\n";
54 if (S
::v('chall') && Get
::s('PASS') == md5(S
::v('chall').$cle)) {
55 $list = new MMList(User
::getWithUID(10154), "x-econfiance.polytechnique.org");
56 $members = $list->get_members('membres');
57 if (is_array($members)) {
59 foreach($members[1] as $member) {
60 $user = User
::getSilent($member[1]);
61 if ($user && $user->hasProfile()) {
62 $profile = $user->profile();
64 $res .= "\t<nom>" . $profile->lastName() . "</nom>\n";
65 $res .= "\t<prenom>" . $profile->firstName() . "</prenom>\n";
66 $res .= "\t<email>" . $user->forlifeEmail() . "</email>\n";
67 $res .= "</membre>\n\n";
71 $res .= "</membres>\n\n";
73 pl_content_headers("text/xml");
79 function handler_manageurs($page)
83 require_once 'webservices/manageurs.server.inc.php';
85 $ips = array_flip(explode(' ', $globals->manageurs
->authorized_ips
));
86 if ($ips && isset($ips[$_SERVER['REMOTE_ADDR']])) {
87 $server = xmlrpc_server_create();
89 xmlrpc_server_register_method($server, 'get_annuaire_infos', 'get_annuaire_infos');
90 xmlrpc_server_register_method($server, 'get_nouveau_infos', 'get_nouveau_infos');
92 $request = @$GLOBALS['HTTP_RAW_POST_DATA'];
93 $response = xmlrpc_server_call_method($server, $request, null
);
94 pl_content_headers("text/xml");
96 xmlrpc_server_destroy($server);
102 function handler_redirect($page)
104 http_redirect(Env
::v('dest', '/'));
107 function handler_groupex_old($page)
109 return $this->handler_groupex($page, 'iso-8859-1');
112 /** Handles the 'auth-groupe-x' authentication.
113 * Expects the following GET parameters:
114 * - pass: the 'password' for the authentication
115 * - challenge: the authentication challenge
116 * - url: the return URL
117 * - session: the remote PHP session ID
119 function handler_groupex($page, $charset = 'utf8')
121 $ext_url = urldecode(Get
::s('url'));
124 $page->assign('external_auth', true
);
125 $page->assign('ext_url', $ext_url);
126 $page->setTitle('Authentification');
127 $page->setDefaultSkin('group_login');
129 if (Get
::has('group')) {
130 $res = XDB
::query('SELECT nom
132 WHERE diminutif = {?}', Get
::s('group'));
133 $page->assign('group', $res->fetchOneCell());
135 $page->assign('group', null
);
137 // Add a P3P header for compatibility with IE in iFrames (http://www.w3.org/TR/P3P11/#compact_policies)
138 header('P3P: CP="CAO COR CURa ADMa DEVa OUR IND PHY ONL COM NAV DEM CNT STA PRE"');
142 if (!S
::user()->checkPerms('groups')) {
146 $this->load('auth.inc.php');
148 $gpex_pass = Get
::s('pass');
149 if (Get
::has('session')) {
150 if (strpos($ext_url, '?') === false
) {
151 $ext_url .= "?PHPSESSID=" . Get
::s('session');
153 $ext_url .= "&PHPSESSID=" . Get
::s('session');
157 // Normalize the return URL.
158 if (!preg_match("/^(http|https):\/\/.*/",$ext_url)) {
159 $ext_url = "http://$ext_url";
161 $gpex_challenge = Get
::s('challenge');
163 // Update the last login information (unless the user is in SUID).
167 S
::logger($uid)->log('connexion_auth_ext', $platal->path
.' '.urldecode($_GET['url']));
170 if (Get
::has('group')) {
171 $req_group_id = XDB
::fetchOneCell('SELECT id
173 WHERE diminutif = {?}',
176 $req_group_id = null
;
179 // Iterate over the auth token to find which one did sign the request.
181 'SELECT ga.privkey, ga.name, ga.datafields, ga.returnurls,
182 ga.group_id, ga.flags, g.nom
183 FROM group_auth AS ga
184 LEFT JOIN groups AS g ON (g.id = ga.group_id)');
186 while (list($privkey, $name, $datafields, $returnurls, $group_id, $group_flags, $group_name) = $res->next()) {
187 if (md5($gpex_challenge.$privkey) == $gpex_pass) {
188 $returnurls = trim($returnurls);
189 // We check that the return url matches a per-key regexp to prevent
190 // replay attacks (more exactly to force replay attacks to redirect
191 // the user to the real GroupeX website, which defeats the attack).
192 if (empty($returnurls) || @preg_match
($returnurls, $ext_url)) {
193 $returl = $ext_url . gpex_make_params($gpex_challenge, $privkey, $datafields, $charset);
194 XDB
::execute('UPDATE group_auth
195 SET last_used = DATE(NOW())
199 // Two conditions control access to the return URL:
200 // - If that URL is attached to a group:
201 // - If the user belongs to the group, OK
202 // - If the user is 'xnet' and doesn't belong, NOK
203 // - If the user is not 'xnet' and the group is not 'strict', OK
204 // - If the user is not 'xnet' and the group is 'strict', NOK
205 // - Otherwise, all but 'xnet' accounts may access the URL.
206 $user_is_xnet = S
::user()->type
== 'xnet';
207 $group_flags = new PlFlagSet($group_flags);
209 // If this key is not attached to a group, but a group was
210 // requested (e.g query from wiki / blogs / ...), use the
211 // requested group_id.
212 if (!$group_id && $req_group_id) {
213 $group_id = $req_group_id;
217 // Check group permissions
218 $is_member = XDB
::fetchOneCell('SELECT COUNT(*)
220 WHERE uid = {?} AND asso_id = {?}',
221 S
::user()->id(), $group_id);
222 if (!$is_member && ($user_is_xnet ||
$group_flags->hasFlag('group_only'))) {
223 $page->kill("Le site demandé est réservé aux membres du groupe $group_name.");
226 } else if ($user_is_xnet && !$group_flags->hasFlag('allow_xnet')) {
227 $page->kill("Le site demandé est réservé aux polytechniciens.");
230 // If we logged in specifically for this 'external_auth' request
231 // and didn't want to "keep access to services", we kill the session
232 // just before returning.
233 // See classes/xorgsession.php:startSessionAs
234 if (S
::b('external_auth_exit')) {
235 S
::logger()->log('decconnexion', @$_SERVER['HTTP_REFERER']);
236 Platal
::session()->killAccessCookie();
237 Platal
::session()->destroy();
239 http_redirect($returl);
240 } else if (S
::admin()) {
241 $page->kill("La requête d'authentification a échoué (url de retour invalide).");
246 // Otherwise (if no valid request was found, or if the return URL is not
247 // acceptable), the user is redirected back to our homepage.
251 function handler_admin_authgroupesx($page, $action = 'list', $id = null
)
253 $page->setTitle('Administration - Auth groupes X');
254 $page->assign('title', 'Gestion de l\'authentification centralisée');
255 $table_editor = new PLTableEditor('admin/auth-groupes-x','group_auth','id');
256 $table_editor->describe('name','nom',true
);
257 $table_editor->describe('privkey','clé privée',false
, true
);
258 $table_editor->describe('datafields','champs renvoyés',true
);
259 $table_editor->describe('returnurls','urls de retour',true
);
260 $table_editor->describe('last_used', 'dernière utilisation', true
);
261 $table_editor->apply($page, $action, $id);
265 // vim:set et sw=4 sts=4 sws=4 foldmethod=marker enc=utf-8: