Htpasswd.php

Go to the documentation of this file.

<?php

use WhiteHat101\Crypt\APR1_MD5;

class sspmod_authcrypt_Auth_Source_Htpasswd extends sspmod_core_Auth_UserPassBase
{


    private $users;

    private $attributes = array();


    public function __construct($info, $config)
    {
        assert('is_array($info)');
        assert('is_array($config)');

        // Call the parent constructor first, as required by the interface
        parent::__construct($info, $config);

        $this->users = array();

        if (!$htpasswd = file_get_contents($config['htpasswd_file'])) {
            throw new Exception('Could not read '.$config['htpasswd_file']);
        }

        $this->users = explode("\n", trim($htpasswd));

        try {
            $this->attributes = SimpleSAML\Utils\Attributes::normalizeAttributesArray($config['static_attributes']);
        } catch (Exception $e) {
            throw new Exception('Invalid static_attributes in authentication source '.
                $this->authId.': '.$e->getMessage());
        }
    }


    protected function login($username, $password)
    {
        assert('is_string($username)');
        assert('is_string($password)');

        foreach ($this->users as $userpass) {
            $matches = explode(':', $userpass, 2);
            if ($matches[0] == $username) {
                $crypted = $matches[1];

                // This is about the only attribute we can add
                $attributes = array_merge(array('uid' => array($username)), $this->attributes);

                // Traditional crypt(3)
                if (SimpleSAML\Utils\Crypto::secureCompare($crypted, crypt($password, $crypted))) {
                    SimpleSAML\Logger::debug('User '.$username.' authenticated successfully');
                    SimpleSAML\Logger::warning(
                        'CRYPT authentication is insecure. Please consider using something else.'
                    );
                    return $attributes;
                }

                // Apache's custom MD5
                if (APR1_MD5::check($password, $crypted)) {
                    SimpleSAML\Logger::debug('User '.$username.' authenticated successfully');
                    return $attributes;
                }

                // SHA1 or plain-text
                if (SimpleSAML\Utils\Crypto::pwValid($crypted, $password)) {
                    SimpleSAML\Logger::debug('User '.$username.' authenticated successfully');
                    SimpleSAML\Logger::warning(
                        'SHA1 and PLAIN TEXT authentication are insecure. Please consider using something else.'
                    );
                    return $attributes;
                }
                throw new SimpleSAML_Error_Error('WRONGUSERPASS');
            }
        }
        throw new SimpleSAML_Error_Error('WRONGUSERPASS');
    }
}