Yubico.php

Go to the documentation of this file.

<?php
class Auth_Yubico
{
        private $_id;

        private $_key;

        private $_response;

        public function __construct($id, $key = '')
        {
                $this->_id =  $id;
                $this->_key = base64_decode($key);
        }

        public function getLastResponse()
        {
                return $this->_response;
        }

        // TODO? Add functions to get parsed parts of server response?

        public function verify($token)
        {
                $parameters = "id=" . $this->_id . "&otp=" . $token;
                // Generate signature
                if ($this->_key <> "") {
                        $signature = base64_encode(hash_hmac('sha1', $parameters, $this->_key, true));
                        $parameters .= '&h=' . $signature;
                }
                /* Support https. */
                $url = "https://api.yubico.com/wsapi/verify?" . $parameters;

                $responseMsg = \SimpleSAML\Utils\HTTP::fetch($url);
                
                if (!preg_match("/status=([a-zA-Z0-9_]+)/", $responseMsg, $out)) {
                        throw new Exception('Could not parse response');
                }

                $status = $out[1];
                
                /* Verify signature. */
                if ($this->_key <> "") {
                        $rows = explode("\r\n", $responseMsg);
            $response = array();
            foreach ($rows as $val) {
                                // = is also used in BASE64 encoding so we only replace the first = by # which is not used in BASE64
                                $val = preg_replace('/=/', '#', $val, 1);
                                $row = explode("#", $val);
                                $response[$row[0]] = (isset($row[1])) ? $row[1] : "";
                        }

                        $check = 'status=' . $response['status'] . '&t='. $response['t'];
                        $checksignature = base64_encode(hash_hmac('sha1', $check, $this->_key, true));
                        
                        if ($response['h'] != $checksignature) {
                                throw new Exception('Checked Signature failed');
                        }
                }
                
                if ($status != 'OK') {
                        throw new Exception('Status was not OK: ' . $status);
                }

                return true;
        }
}