Differential D949 Diff 2281 src/app/Auth/LDAPUserProvider.php

Changeset View

Standalone View

src/app/Auth/LDAPUserProvider.php

	<?php			<?php

	namespace App\Auth;			namespace App\Auth;

	use App\User;			use App\User;
	use Carbon\Carbon;
	use Illuminate\Auth\EloquentUserProvider;			use Illuminate\Auth\EloquentUserProvider;
	use Illuminate\Support\Facades\Hash;			use Illuminate\Support\Facades\Hash;
	use Illuminate\Contracts\Auth\Authenticatable;			use Illuminate\Contracts\Auth\Authenticatable;
	use Illuminate\Contracts\Auth\UserProvider;			use Illuminate\Contracts\Auth\UserProvider;

				/**
				* A user provider that integrates an LDAP deployment.
				*/
	class LDAPUserProvider extends EloquentUserProvider implements UserProvider			class LDAPUserProvider extends EloquentUserProvider implements UserProvider
	{			{
				/**
				* Retrieve the user by its ID.
				*
				* @param string $identifier The unique ID for the user to attempt to retrieve.
				*
				* @return \Illuminate\Contracts\Auth\Authenticatable\|null
				*/
	public function retrieveById($identifier)			public function retrieveById($identifier)
	{			{
	return parent::retrieveById($identifier);			return parent::retrieveById($identifier);
	}			}

				/**
				* Retrieve the user by its credentials.
				*
				* Please note that this function also validates the password.
				*
				* @param array $credentials An array containing the email and password.
				*
				* @return User\|null
				*/
	public function retrieveByCredentials(array $credentials)			public function retrieveByCredentials(array $credentials)
	{			{
	$entries = User::where('email', '=', $credentials['email']);			$entries = User::where('email', '=', $credentials['email']);

	if ($entries->count() == 1) {			if ($entries->count() == 1) {
	$user = $entries->select('id', 'email', 'password', 'password_ldap')->first();			$user = $entries->select(['id', 'email', 'password', 'password_ldap'])->first();

				if (!$this->validateCredentials($user, $credentials)) {
				return null;
				}

	return $user;			return $user;
				} else {
				if ($entries->count() > 1) {
				\Log::warning("Multiple entries for {$credentials['email']}");
				} else {
				\Log::warning("No entries for {$credentials['email']}");
				}
	}			}

	return null;			return null;
	}			}

				/**
				* Validate the credentials for a user.
				*
				* @param Authenticatable $user The user.
				* @param array $credentials The credentials.
				*
				* @return bool
				*/
	public function validateCredentials(Authenticatable $user, array $credentials)			public function validateCredentials(Authenticatable $user, array $credentials)
	{			{
	$authenticated = false;			$authenticated = false;

	if ($user->email == $credentials['email']) {			if ($user->email == $credentials['email']) {
	if (!empty($user->password)) {			if (!empty($user->password)) {
	if (Hash::check($credentials['password'], $user->password)) {			if (Hash::check($credentials['password'], $user->password)) {
	$authenticated = true;			$authenticated = true;
	}			}
	} elseif (!empty($user->password_ldap)) {			} elseif (!empty($user->password_ldap)) {
	$hash = '{SSHA512}' . base64_encode(			$hash = '{SSHA512}' . base64_encode(
	pack('H*', hash('sha512', $credentials['password']))			pack('H*', hash('sha512', $credentials['password']))
	);			);

	if ($hash == $user->password_ldap) {			if ($hash == $user->password_ldap) {
	$authenticated = true;			$authenticated = true;
	}			}
				} else {
				\Log::error("Incomplete credentials for {$user->email}");
	}			}
	}			}

	// TODO: update last login time			// TODO: update last login time
	// TODO: Update password if necessary, examine whether writing to			// TODO: Update password if necessary, examine whether writing to
	// user->password is sufficient?			// user->password is sufficient?
	if ($authenticated) {			if ($authenticated) {
				\Log::info("Successful authentication for {$user->email}");

				if (empty($user->password)) {
	$user->password = $credentials['password'];			$user->password = $credentials['password'];
	$user->save();			$user->save();
				}

				if (empty($user->ldap_password)) {
				$user->ldap_password = '{SSHA512}' . base64_encode(
				pack('H*', hash('sha512', $credentials['password']))
				);
				}
				machniakUnsubmitted Not Done Inline Actions This whole if statement is wrong. 1. I don't see $user->save() here after ldap_password is set. 2. It should be `password_ldap` not `ldap_password`. 3. Because of User::setPasswordAttribute() it shouldn't be needed at all. machniak: This whole if statement is wrong. 1. I don't see $user->save() here after ldap_password is set.
	} else {			} else {
	// TODO: Try actual LDAP?			// TODO: Try actual LDAP?
	\Log::info("Authentication failed for {$user->email}");			\Log::info("Authentication failed for {$user->email}");
	}			}

	return $authenticated;			return $authenticated;
	}			}
	}			}