SSO Windows HTTP auth

[mad]

Hi,

the LDAP plugin worked, and now I wanted to setup SSO using apache mod_sspi. This sets REMOTE_USER to the correct domain\user, and now I want PMF to acknowledge that. I've tried looking at inc/PMF_Auth/AuthHTTP, but that wants to check a password, which I won't have.
Is there a way to tell PMF (downloaded stable yesterday) to "this username is logged in, trust me"?

Thanks in advance!

[Thorsten]

Hi,

yes, I think we need a new authentication plugin for this mechanism. I can add this for the next version of phpMyFAQ if you can help me!

bye
Thorsten

[mad]

Aww... Then I'll try digging into the source a bit more. It should be possible for me to help, I think.

[Thorsten]

Hi,

I created a file called AuthSso.php in the directory inc/PMF_Auth/ with the following code:

Code: Select all

<?php
/**
 * Manages user authentication with Apache's SSO authentication, e.g. mod_sspi
 *
 * PHP Version 5.2
 *
 * The contents of this file are subject to the Mozilla Public License
 * Version 1.1 (the "License"); you may not use this file except in
 * compliance with the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS"
 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See the
 * License for the specific language governing rights and limitations
 * under the License.
 * 
 * @category  phpMyFAQ 
 * @package   PMF_Auth
 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
 * @copyright 2011 phpMyFAQ Team
 * @license   http://www.mozilla.org/MPL/MPL-1.1.html Mozilla Public License Version 1.1
 * @link      http://www.phpmyfaq.de
 * @since     2011-06-22
 */

if (!defined('IS_VALID_PHPMYFAQ')) {
    exit();
}

/**
 * PMF_Auth_AuthDriver
 *
 * @category  phpMyFAQ 
 * @package   PMF_Auth
 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
 * @copyright 2011 phpMyFAQ Team
 * @license   http://www.mozilla.org/MPL/MPL-1.1.html Mozilla Public License Version 1.1
 * @link      http://www.phpmyfaq.de
 * @since     2011-06-22
 */
class PMF_Auth_AuthSso extends PMF_Auth implements PMF_Auth_AuthDriver
{
    /**
     * Adds a new user account to the authentication table.
     *
     * Returns true on success, otherwise false.
     *
     * @param  string $login Loginname
     * @param  string $pass  Password
     * @return boolean
     */
    public function add($login, $pass)
    {
        
    }

    /**
     * Changes the password for the account specified by login.
     *
     * Returns true on success, otherwise false.
     *
     * Error messages are added to the array errors.
     *
     * @param  string $login Loginname
     * @param  string $pass  Password
     * @return boolean
    */
    public function changePassword($login, $pass)
    {
        
    }
    
    /**
     * Deletes the user account specified by login.
     *
     * Returns true on success, otherwise false.
     *
     * Error messages are added to the array errors.
     *
     * @param  string $login Loginname
     * @return bool
     */
    public function delete($login)
    {
        
    }
    
    /**
     * Checks the password for the given user account.
     *
     * Returns true if the given password for the user account specified by
     * is correct, otherwise false.
     * Error messages are added to the array errors.
     *
     * This function is only called when local authentication has failed, so
     * we are about to create user account.
     *
     * @param  string $login        Loginname
     * @param  string $pass         Password
     * @param  array  $optionslData Optional data
     * @return boolean
     */
    public function checkPassword($login, $pass, Array $optionalData = null)
    {
        if (!isset($_SERVER['REMOTE_USER'])) {
            return false;
        } else {
            if ($_SERVER['REMOTE_USER'] == $login) {
                return true;
            } else {
                return false;
            }
        }
    }

    /**
     * Does nothing. A function required to be a valid auth.
     *
     * @param  string $login        Loginname
     * @param  array  $optionalData Optional data
     * @return integer
     */
    public function checkLogin($login, Array $optionalData = null)
    {
        return isset($_SERVER['REMOTE_USER']) ? true : false;
    }
}

This can be tested.

bye
Thorsten

[mad]

That was quick.
But it can't work, can it? checkPassword only gets called when there's faqPassword set? I don't want users to have to login... And it doesn't get the user information from LDAP, right?

[mad]

Ok, I managed to do what I want by hacking around. It's not beautiful...

Changes in index.php:

Code: Select all

$faqusername = PMF_Filter::filterInput(INPUT_POST, 'faqusername', FILTER_SANITIZE_STRING);
$faqpassword = PMF_Filter::filterInput(INPUT_POST, 'faqpassword', FILTER_SANITIZE_STRING);

/* added for SSO */
if (isset($_SERVER['REMOTE_USER'])) {
    $faqusername = $_SERVER['REMOTE_USER'];
    $faqpassword = "dummy";
    };

Changes in AuthLdap.php

Code: Select all

	/**        $this->ldap = new PMF_Ldap($PMF_LDAP['ldap_server'],
                                   $PMF_LDAP['ldap_port'],
                                   $PMF_LDAP['ldap_base'],
                                   $bindLogin, 
                                   $pass);
	
        if ($this->ldap->error) {
            $this->errors[] = $this->ldap->error;
            return false;
        } else {
            $this->add($login, $pass);
            return true;
	    }*/
	if (isset($_SERVER['REMOTE_USER'])) {
	    $this->add($login, $pass);
	    return true;
	} else {
	    return false;
	}

[Thorsten]

Hi,

yes, some code is missing... I'll add a configuration item to allow SSO authentication. I use your code as template.

I'll add it to phpMyFAQ 2.7.0-beta2.

bye
Thorsten

[Thorsten]

Hi,

please check these commits:

https://github.com/thorsten/phpMyFAQ/co ... 1f0964ed31
https://github.com/thorsten/phpMyFAQ/co ... b035155a97

Thanks!

bye
Thorsten

[mad]

Cool! I will do once I get it working behind the reverse proxy... So maybe tomorrow.

[Thorsten]

Hi,

would be cool!

bye
Thorsten