phpmyadmin/libraries/plugins/auth/AuthenticationSignon.class.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * SignOn Authentication plugin for phpMyAdmin
   5  *
   6  * @package    PhpMyAdmin-Authentication
   7  * @subpackage SignOn
   8  */
   9 if (! defined('PHPMYADMIN')) {
  10     exit;
  11 }
  12
  13 /* Get the authentication interface */
  14 require_once 'libraries/plugins/AuthenticationPlugin.class.php';
  15
  16 /**
  17  * Handles the SignOn authentication method
  18  *
  19  * @package PhpMyAdmin-Authentication
  20  */
  21 class AuthenticationSignon extends AuthenticationPlugin
  22 {
  23     /**
  24      * Displays authentication form
  25      *
  26      * @global  string    the font face to use in case of failure
  27      * @global  string    the default font size to use in case of failure
  28      * @global  string    the big font size to use in case of failure
  29      *
  30      * @return boolean   always true (no return indeed)
  31      */
  32     public function auth()
  33     {
  34         unset($_SESSION['LAST_SIGNON_URL']);
  35         if (empty($GLOBALS['cfg']['Server']['SignonURL'])) {
  36             PMA_fatalError('You must set SignonURL!');
  37         } elseif (! empty($_REQUEST['old_usr'])
  38             && ! empty($GLOBALS['cfg']['Server']['LogoutURL'])
  39         ) {
  40             /* Perform logout to custom URL */
  41             PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['LogoutURL']);
  42         } else {
  43             PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['SignonURL']);
  44         }
  45         exit();
  46     }
  47
  48      /**
  49      * Gets advanced authentication settings
  50      *
  51      * @global  string    the username if register_globals is on
  52      * @global  string    the password if register_globals is on
  53      * @global  array     the array of server variables if register_globals is
  54      *                    off
  55      * @global  array     the array of environment variables if register_globals
  56      *                    is off
  57      * @global  string    the username for the ? server
  58      * @global  string    the password for the ? server
  59      * @global  string    the username for the WebSite Professional server
  60      * @global  string    the password for the WebSite Professional server
  61      * @global  string    the username of the user who logs out
  62      *
  63      * @return boolean   whether we get authentication settings or not
  64      */
  65     public function authCheck()
  66     {
  67         global $PHP_AUTH_USER, $PHP_AUTH_PW;
  68
  69         /* Check if we're using same sigon server */
  70         $signon_url = $GLOBALS['cfg']['Server']['SignonURL'];
  71         if (isset($_SESSION['LAST_SIGNON_URL'])
  72             && $_SESSION['LAST_SIGNON_URL'] != $signon_url
  73         ) {
  74             return false;
  75         }
  76
  77         /* Script name */
  78         $script_name = $GLOBALS['cfg']['Server']['SignonScript'];
  79
  80         /* Session name */
  81         $session_name = $GLOBALS['cfg']['Server']['SignonSession'];
  82
  83         /* Login URL */
  84         $signon_url = $GLOBALS['cfg']['Server']['SignonURL'];
  85
  86         /* Current host */
  87         $single_signon_host = $GLOBALS['cfg']['Server']['host'];
  88
  89         /* Current port */
  90         $single_signon_port = $GLOBALS['cfg']['Server']['port'];
  91
  92         /* No configuration updates */
  93         $single_signon_cfgupdate = array();
  94
  95         /* Are we requested to do logout? */
  96         $do_logout = !empty($_REQUEST['old_usr']);
  97
  98         /* Handle script based auth */
  99         if (!empty($script_name)) {
 100             if (! file_exists($script_name)) {
 101                 PMA_fatalError(
 102                     __('Can not find signon authentication script:')
 103                     . ' '. $script_name
 104                 );
 105             }
 106             include $script_name;
 107
 108             list ($PHP_AUTH_USER, $PHP_AUTH_PW)
 109                 = get_login_credentials($cfg['Server']['user']);
 110
 111         } elseif (isset($_COOKIE[$session_name])) { /* Does session exist? */
 112             /* End current session */
 113             $old_session = session_name();
 114             $old_id = session_id();
 115             session_write_close();
 116
 117             /* Load single signon session */
 118             session_name($session_name);
 119             session_id($_COOKIE[$session_name]);
 120             session_start();
 121
 122             /* Clear error message */
 123             unset($_SESSION['PMA_single_signon_error_message']);
 124
 125             /* Grab credentials if they exist */
 126             if (isset($_SESSION['PMA_single_signon_user'])) {
 127                 if ($do_logout) {
 128                     $PHP_AUTH_USER = '';
 129                 } else {
 130                     $PHP_AUTH_USER = $_SESSION['PMA_single_signon_user'];
 131                 }
 132             }
 133             if (isset($_SESSION['PMA_single_signon_password'])) {
 134                 if ($do_logout) {
 135                     $PHP_AUTH_PW = '';
 136                 } else {
 137                     $PHP_AUTH_PW = $_SESSION['PMA_single_signon_password'];
 138                 }
 139             }
 140             if (isset($_SESSION['PMA_single_signon_host'])) {
 141                 $single_signon_host = $_SESSION['PMA_single_signon_host'];
 142             }
 143
 144             if (isset($_SESSION['PMA_single_signon_port'])) {
 145                 $single_signon_port = $_SESSION['PMA_single_signon_port'];
 146             }
 147
 148             if (isset($_SESSION['PMA_single_signon_cfgupdate'])) {
 149                 $single_signon_cfgupdate = $_SESSION['PMA_single_signon_cfgupdate'];
 150             }
 151
 152
 153             /* Also get token as it is needed to access subpages */
 154             if (isset($_SESSION['PMA_single_signon_token'])) {
 155                 /* No need to care about token on logout */
 156                 $pma_token = $_SESSION['PMA_single_signon_token'];
 157             }
 158
 159             /* End single signon session */
 160             session_write_close();
 161
 162             /* Restart phpMyAdmin session */
 163             session_name($old_session);
 164             if (!empty($old_id)) {
 165                 session_id($old_id);
 166             }
 167             session_start();
 168
 169             /* Set the single signon host */
 170             $GLOBALS['cfg']['Server']['host'] = $single_signon_host;
 171
 172             /* Set the single signon port */
 173             $GLOBALS['cfg']['Server']['port'] = $single_signon_port;
 174
 175             /* Configuration update */
 176             $GLOBALS['cfg']['Server'] = array_merge(
 177                 $GLOBALS['cfg']['Server'],
 178                 $single_signon_cfgupdate
 179             );
 180
 181             /* Restore our token */
 182             if (!empty($pma_token)) {
 183                 $_SESSION[' PMA_token '] = $pma_token;
 184             }
 185
 186             /**
 187              * Clear user cache.
 188              */
 189             PMA_Util::clearUserCache();
 190         }
 191
 192         // Returns whether we get authentication settings or not
 193         if (empty($PHP_AUTH_USER)) {
 194             unset($_SESSION['LAST_SIGNON_URL']);
 195             return false;
 196         } else {
 197             $_SESSION['LAST_SIGNON_URL'] = $GLOBALS['cfg']['Server']['SignonURL'];
 198             return true;
 199         }
 200     }
 201
 202     /**
 203      * Set the user and password after last checkings if required
 204      *
 205      * @global  array     the valid servers settings
 206      * @global  integer   the id of the current server
 207      * @global  array     the current server settings
 208      * @global  string    the current username
 209      * @global  string    the current password
 210      *
 211      * @return boolean   always true
 212      */
 213     public function authSetUser()
 214     {
 215         global $cfg;
 216         global $PHP_AUTH_USER, $PHP_AUTH_PW;
 217
 218         $cfg['Server']['user']     = $PHP_AUTH_USER;
 219         $cfg['Server']['password'] = $PHP_AUTH_PW;
 220
 221         return true;
 222     }
 223
 224     /**
 225      * User is not allowed to login to MySQL -> authentication failed
 226      *
 227      * @return boolean   always true (no return indeed)
 228      */
 229     public function authFails()
 230     {
 231         /* Session name */
 232         $session_name = $GLOBALS['cfg']['Server']['SignonSession'];
 233
 234         /* Does session exist? */
 235         if (isset($_COOKIE[$session_name])) {
 236             /* End current session */
 237             $old_session = session_name();
 238             $old_id = session_id();
 239             session_write_close();
 240
 241             /* Load single signon session */
 242             session_name($session_name);
 243             session_id($_COOKIE[$session_name]);
 244             session_start();
 245
 246             /* Set error message */
 247             if (! empty($GLOBALS['login_without_password_is_forbidden'])) {
 248                 $_SESSION['PMA_single_signon_error_message'] = __(
 249                     'Login without a password is forbidden by configuration '
 250                     . '(see AllowNoPassword)'
 251                 );
 252             } elseif (! empty($GLOBALS['allowDeny_forbidden'])) {
 253                 $_SESSION['PMA_single_signon_error_message'] = __('Access denied');
 254             } elseif (! empty($GLOBALS['no_activity'])) {
 255                 $_SESSION['PMA_single_signon_error_message'] = sprintf(
 256                     __('No activity within %s seconds; please log in again'),
 257                     $GLOBALS['cfg']['LoginCookieValidity']
 258                 );
 259             } elseif (PMA_DBI_getError()) {
 260                 $_SESSION['PMA_single_signon_error_message'] = PMA_sanitize(
 261                     PMA_DBI_getError()
 262                 );
 263             } else {
 264                 $_SESSION['PMA_single_signon_error_message'] = __(
 265                     'Cannot log in to the MySQL server'
 266                 );
 267             }
 268         }
 269         $this->auth();
 270     }
 271
 272     /**
 273      * This method is called when any PluginManager to which the observer
 274      * is attached calls PluginManager::notify()
 275      *
 276      * @param SplSubject $subject The PluginManager notifying the observer
 277      *                            of an update.
 278      *
 279      * @return void
 280      */
 281     public function update (SplSubject $subject)
 282     {
 283     }
 284 }