cacert-testmgr/manager/application/controllers/LoginController.php

286 lines
12 KiB
PHP
Raw Normal View History

<?php
/**
* @author markus
* $Id: LoginController.php 75 2010-02-25 14:40:10Z markus $
*/
require_once('helpers/GetEnv.php');
require_once('config/Config.php');
class LoginController extends Zend_Controller_Action
{
public function init() {
/* Initialize action controller here */
$config = new Zend_Config_Ini(APPLICATION_PATH . '/configs/application.ini', APPLICATION_ENV);
$db = Zend_Db::factory($config->ca_mgr->db->auth->pdo, $config->ca_mgr->db->auth);
Zend_Registry::set('auth_dbc', $db);
$db2 = Zend_Db::factory($config->ca_mgr->db->auth2->pdo, $config->ca_mgr->db->auth2);
Zend_Registry::set('auth2_dbc', $db2);
}
public function indexAction() {
$this->view->form = $this->getForm();
$this->render('index');
}
public function loginAction() {
$form = $this->getForm();
if ($form->isValid($_POST)) {
$config = new Zend_Config_Ini(APPLICATION_PATH . '/configs/application.ini', APPLICATION_ENV);
$db = Zend_Registry::get('auth_dbc');
$db2 = Zend_Registry::get('auth2_dbc');
$auth = new Zend_Auth_Adapter_DbTable($db);
$auth->setTableName($config->ca_mgr->db->auth->tablename)
->setIdentityColumn('email')
->setCredentialColumn('password');
$auth->setIdentity( $this->getRequest()->getParam('login_name'))
->setCredential( sha1($this->getRequest()->getParam('login_password')))
->setCredentialTreatment('?');
$result = $auth->authenticate();
$code = $result->getCode();
switch ($code) {
case Zend_Auth_Result::FAILURE:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE) to log in ' . $this->getRequest()->getParam('login_name'));
throw new Exception(__METHOD__ . ': unknown error');
case Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND) to log in ' . $this->getRequest()->getParam('login_name'));
throw new Exception(__METHOD__ . ': ID unknown');
case Zend_Auth_Result::FAILURE_IDENTITY_AMBIGUOUS:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_IDENTITY_AMBIGUOUS) to log in ' . $this->getRequest()->getParam('login_name'));
throw new Exception(__METHOD__ . ': ID not unique');
case Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID) to log in ' . $this->getRequest()->getParam('login_name'));
throw new Exception(__METHOD__ . ': ID unknown'); // to prevent brute force password attachs
case Zend_Auth_Result::FAILURE_UNCATEGORIZED:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_UNCATEGORIZED) to log in ' . $this->getRequest()->getParam('login_name'));
throw new Exception(__METHOD__ . ': unknown error');
}
$this->getAuthDetailsIntoSession($auth, false);
Log::Log()->info(__METHOD__ . ' user logged in ' . $this->view->session->authdata['authed_username'] .
' (' . $this->getRequest()->getParam('login_name') . ')');
#$this->_forward('index', 'index'); // only "soft" forward, we need to change the url in browser
$this->_redirect($this->view->url(array('controller' => 'index', 'action' => 'index'), 'default', true));
/*
$viewRenderer = Zend_Controller_Action_HelperBroker::getStaticHelper('viewRenderer');
$viewRenderer->setRender('loginresult');
$this->view->request = $this->getRequest();
*/
}
else {
$this->view->form = $form;
return $this->render('index');
}
}
public function crtAction() {
$ssl_client_s_dn = GetEnv::getEnvVar('SSL_CLIENT_S_DN');
$ssl_client_i_dn = GetEnv::getEnvVar('SSL_CLIENT_I_DN');
$config = new Zend_Config_Ini(APPLICATION_PATH . '/configs/application.ini', APPLICATION_ENV);
$db = Zend_Registry::get('auth_dbc');
$db2 = Zend_Registry::get('auth2_dbc');
$auth = new Zend_Auth_Adapter_DbTable($db2);
$auth->setTableName($config->ca_mgr->db->auth2->tablename)
->setIdentityColumn('user_client_crt_s_dn_i_dn')
->setCredentialColumn('user_client_crt_s_dn_i_dn');
$auth->setIdentity( $ssl_client_s_dn . '//' . $ssl_client_i_dn)
->setCredential($ssl_client_s_dn . '//' . $ssl_client_i_dn)
->setCredentialTreatment('?');
$result = $auth->authenticate();
$code = $result->getCode();
switch ($code) {
case Zend_Auth_Result::FAILURE:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE) to log in ' . $ssl_client_s_dn . '//' . $ssl_client_i_dn);
throw new Exception(__METHOD__ . ': unknown error');
case Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_IDENTITY_NOT_FOUND) to log in ' . $ssl_client_s_dn . '//' . $ssl_client_i_dn);
throw new Exception(__METHOD__ . ': ID unknown');
case Zend_Auth_Result::FAILURE_IDENTITY_AMBIGUOUS:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_IDENTITY_AMBIGUOUS) to log in ' . $ssl_client_s_dn . '//' . $ssl_client_i_dn);
throw new Exception(__METHOD__ . ': ID not unique');
case Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_CREDENTIAL_INVALID) to log in ' . $ssl_client_s_dn . '//' . $ssl_client_i_dn);
throw new Exception(__METHOD__ . ': ID unknown'); // to prevent brute force password attachs
case Zend_Auth_Result::FAILURE_UNCATEGORIZED:
Log::Log()->info(__METHOD__ . ' user failed (Zend_Auth_Result::FAILURE_UNCATEGORIZED) to log in ' . $ssl_client_s_dn . '//' . $ssl_client_i_dn);
throw new Exception(__METHOD__ . ': unknown error');
}
$this->getAuthDetailsIntoSession($auth, true);
/*
$viewRenderer = Zend_Controller_Action_HelperBroker::getStaticHelper('viewRenderer');
$viewRenderer->setRender('loginresult');
*/
Log::Log()->info(__METHOD__ . ' user logged in ' . $this->view->session->authdata['authed_username'] .
' (' . $ssl_client_s_dn . '//' . $ssl_client_i_dn . ')');
#$this->_forward('index', 'index'); // only "soft" forward, we need to change the url in browser
$this->_redirect($this->view->url(array('controller' => 'index', 'action' => 'index'), 'default', true));
}
/**
* get user data from Zend_Auth result and store data in session
* @param Zend_Auth_Result $auth
*/
protected function getAuthDetailsIntoSession($auth, $crt) {
$session = Zend_Registry::get('session');
$db = Zend_Registry::get('auth_dbc');
$db2 = Zend_Registry::get('auth2_dbc');
/**
* non existent in our case, look up a 2nd table (ca_mgr.system_user by login name (email)) and
* get id from there, defaulting to User (1) when no db entry exists
*/
$auth_res = $auth->getResultRowObject();
if (!isset($auth_res->system_role_id) || $auth_res->system_role_id == 0) {
$res = $db2->query('select * from system_user where login=?', array($auth_res->email));
if ($res->rowCount() > 0) {
$res_ar = $res->fetch();
$system_roles_id = $res_ar['system_role_id'];
}
else {
// no extra user info in manager database, assume standard user
$system_roles_id = 1;
}
}
else
$system_roles_id = $auth_res->system_role_id;
$session->authdata['authed'] = true;
$session->authdata['authed_id'] = $auth_res->id;
if (!isset($auth_res->fname) || !isset($auth_res->lname)) {
$res = $db->query('select * from users where email=?', array($auth_res->login));
$res_ar = $res->fetch();
$session->authdata['authed_username'] = 'crt' . $res_ar['login'];
$session->authdata['authed_fname'] = $res_ar['fname'];
$session->authdata['authed_lname'] = $res_ar['lname'];
}
else {
$session->authdata['authed_username'] = $auth_res->email;
$session->authdata['authed_fname'] = $auth_res->fname;
$session->authdata['authed_lname'] = $auth_res->lname;
}
$session->authdata['authed_by_crt'] = $crt;
$session->authdata['authed_by_cli'] = true;
$res = $db2->query('select * from system_role where id=?', array($system_roles_id));
$res_ar = $res->fetch();
$session->authdata['authed_role'] = $res_ar['role'];
$acl = $this->makeAcl($db2);
$session->authdata['authed_permissions'] = $acl;
/* test cases
Log::Log()->debug(($acl->isAllowed('User', 'Administration', 'view') == true)?'true':'false');
Log::Log()->debug(($acl->isAllowed('User', 'Administration', 'edit') == true)?'true':'false');
Log::Log()->debug(($acl->isAllowed('User', 'Account', 'view') == true)?'true':'false');
Log::Log()->debug(($acl->isAllowed('User', 'Account', 'edit') == true)?'true':'false');
Log::Log()->debug(($acl->isAllowed('Admin', 'Administration', 'view') == true)?'true':'false');
Log::Log()->debug(($acl->isAllowed('Admin', 'Account', 'view') == true)?'true':'false');
*/
$this->view->session = $session;
}
/**
* build login form and return to requesting method
* @return Zend_Form
*/
protected function getForm() {
$form = new Zend_Form();
$form->setAction('/login/login')
->setMethod('post');
#$form->setAttrib('id', 'loginform');
$al = new Zend_Validate_Alnum();
$al->setDefaultTranslator(I18n::getTranslate());
$al->setDisableTranslator(false);
$username = new Zend_Form_Element_Text('login_name');
$username->setRequired(true)
->setLabel(I18n::_('User Name'))
->addFilter(new Zend_Filter_StringTrim())
->addFilter(new Zend_Filter_StripTags());
$password = new Zend_Form_Element_Password('login_password');
$password->setRequired(true)
->setLabel(I18n::_('Password'))
->addFilter(new Zend_Filter_StringTrim());
$submit = new Zend_Form_Element_Submit('submit');
$submit->setLabel(I18n::_('Login'));
$form->addElement($username)
->addElement($password)
->addElement($submit);
return $form;
}
/**
* get roles and resources from db, build Zend_Acl structure and add permissions
* @param Zend_Db $db
*/
protected function makeAcl($db) {
$acl = new Zend_Acl();
$res = $db->fetchAll('select * from system_role');
foreach ($res as $obj) {
if ($obj['inherit_role'] != '') {
if ($acl->hasRole($obj['inherit_role'])) {
$acl->addRole(new Zend_Acl_Role($obj['role']), $obj['inherit_role']);
}
else {
/**
* @todo very simply system to order roles, add role before inherited role
*/
$res[] = $obj;
continue;
}
}
else {
$acl->addRole(new Zend_Acl_Role($obj['role']));
}
}
$res = $db->fetchAll('select * from system_resource');
foreach ($res as $obj) {
$acl->addResource(new Zend_Acl_Resource($obj['resource']));
}
$res = $db->fetchAll('select r.role as role, rs.resource as resource, permission, privilege '.
'from system_role as r join system_role_has_system_resource as m on ' .
'(r.id = m.system_role_id) join system_resource as rs on (m.system_resource_id = rs.id)');
foreach ($res as $obj) {
$privilege = explode(',', $obj['privilege']);
if ($obj['permission'] == 'allow') {
$acl->allow($obj['role'], $obj['resource'], $privilege);
}
else {
$acl->deny($obj['role'], $obj['resource'], $privilege);
}
}
return $acl;
}
}