YubiKey.php

Go to the documentation of this file.

<?php
 
/*
 * Copyright (C) 2009  Andreas Åkre Solberg <andreas.solberg@uninett.no>
 * Copyright (C) 2009  Simon Josefsson <simon@yubico.com>.
 *
 * This file is part of SimpleSAMLphp
 *
 * SimpleSAMLphp is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public License
 * as published by the Free Software Foundation; either version 3 of
 * the License, or (at your option) any later version.
 *
 * SimpleSAMLphp is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public
 * License License along with GNU SASL Library; if not, write to the
 * Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
 * Boston, MA 02110-1301, USA.
 *
 */
 
class sspmod_authYubiKey_Auth_Source_YubiKey extends SimpleSAML_Auth_Source {
 
        const STAGEID = 'sspmod_authYubiKey_Auth_Source_YubiKey.state';
 
        const TOKENSIZE = 32;
 
        const AUTHID = 'sspmod_authYubiKey_Auth_Source_YubiKey.AuthId';
 
        private $yubi_id;
        private $yubi_key;
 
        public function __construct($info, $config) {
                assert('is_array($info)');
                assert('is_array($config)');
 
                // Call the parent constructor first, as required by the interface
                parent::__construct($info, $config);
 
                if (array_key_exists('id', $config)) {
                        $this->yubi_id = $config['id'];
                }
 
                if (array_key_exists('key', $config)) {
                        $this->yubi_key = $config['key'];
                }
        }
 
 
        public function authenticate(&$state) {
                assert('is_array($state)');
 
                // We are going to need the authId in order to retrieve this authentication source later
                $state[self::AUTHID] = $this->authId;
 
                $id = SimpleSAML_Auth_State::saveState($state, self::STAGEID);
 
                $url = SimpleSAML\Module::getModuleURL('authYubiKey/yubikeylogin.php');
                \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('AuthState' => $id));
        }
        
        
        public static function handleLogin($authStateId, $otp) {
                assert('is_string($authStateId)');
                assert('is_string($otp)');
 
                /* Retrieve the authentication state. */
                $state = SimpleSAML_Auth_State::loadState($authStateId, self::STAGEID);
 
                /* Find authentication source. */
                assert('array_key_exists(self::AUTHID, $state)');
                $source = SimpleSAML_Auth_Source::getById($state[self::AUTHID]);
                if ($source === NULL) {
                        throw new Exception('Could not find authentication source with id ' . $state[self::AUTHID]);
                }
 
 
                try {
                        /* Attempt to log in. */
                        $attributes = $source->login($otp);
                } catch (SimpleSAML_Error_Error $e) {
                        /* An error occurred during login. Check if it is because of the wrong
                         * username/password - if it is, we pass that error up to the login form,
                         * if not, we let the generic error handler deal with it.
                         */
                        if ($e->getErrorCode() === 'WRONGUSERPASS') {
                                return 'WRONGUSERPASS';
                        }
 
                        /* Some other error occurred. Rethrow exception and let the generic error
                         * handler deal with it.
                         */
                        throw $e;
                }
 
                $state['Attributes'] = $attributes;
                SimpleSAML_Auth_Source::completeAuth($state);
        }
        
        public static function getYubiKeyPrefix($otp) {
                $uid = substr ($otp, 0, strlen ($otp) - self::TOKENSIZE);
                return $uid;
        }
 
        protected function login($otp) {
                assert('is_string($otp)');
 
                require_once dirname(dirname(dirname(dirname(__FILE__)))) . '/libextinc/Yubico.php';
 
                $attributes = array();
 
                try {
                        $yubi = new Auth_Yubico($this->yubi_id, $this->yubi_key);
                        $auth = $yubi->verify($otp);
                        $uid = self::getYubiKeyPrefix($otp);
                        $attributes = array('uid' => array($uid));
                } catch (Exception $e) {
                        SimpleSAML\Logger::info('YubiKey:' . $this->authId . ': Validation error (otp ' . $otp . '), debug output: ' . $yubi->getLastResponse());
 
                        throw new SimpleSAML_Error_Error('WRONGUSERPASS', $e);
                }
 
                SimpleSAML\Logger::info('YubiKey:' . $this->authId . ': YubiKey otp ' . $otp . ' validated successfully: ' . $yubi->getLastResponse());
 
                return $attributes;
        }
 
}