inc/auth-functions.php

   1 <?php
   2 /**
   3 * The authentication handling plugins can be used by the Session class to
   4 * provide authentication.
   5 *
   6 * Each authenticate hook needs to:
   7 *   - Accept a username / password
   8 *   - Confirm the username / password are correct
   9 *   - Create (or update) a 'usr' record in our database
  10 *   - Return the 'usr' record as an object
  11 *   - Return === false when authentication fails
  12 *
  13 * It can expect that:
  14 *   - Configuration data will be in $c->authenticate_hook['config'], which might be an array, or whatever is needed.
  15 *
  16 * In order to be called:
  17 *   - This file should be included
  18 *   - $c->authenticate_hook['call'] should be set to the name of the plugin
  19 *   - $c->authenticate_hook['config'] should be set up with any configuration data for the plugin
  20 *
  21 * @package   davical
  22 * @subpackage   authentication
  23 * @author    Andrew McMillan <andrew@mcmillan.net.nz>
  24 * @copyright Catalyst IT Ltd, Morphoss Ltd
  25 * @license   http://gnu.org/copyleft/gpl.html GNU GPL v2 or later
  26 */
  27
  28 require_once("DataUpdate.php");
  29
  30 if ( !function_exists('auth_functions_deprecated') ) {
  31   function auth_functions_deprecated( $method, $message = null ) {
  32     global $c;
  33     if ( isset($c->dbg['ALL']) || isset($c->dbg['deprecated']) ) {
  34       $stack = debug_backtrace();
  35       array_shift($stack);
  36       if ( preg_match( '{/inc/auth-functions.php$}', $stack[0]['file'] ) && $stack[0]['line'] > __LINE__ ) return;
  37       dbg_error_log("LOG", " auth-functions: Call to deprecated routine '%s'%s", $method, (isset($message)?': '.$message:'') );
  38       foreach( $stack AS $k => $v ) {
  39         dbg_error_log( 'LOG', ' auth-functions: Deprecated call from line %4d of %s', $v['line'], $v['file']);
  40       }
  41     }
  42   }
  43 }
  44
  45
  46 function getUserByName( $username, $use_cache=true ) {
  47   auth_functions_deprecated('getUserByName','replaced by Principal class');
  48   return new Principal('username', $username, $use_cache);
  49 }
  50
  51 function getUserByEMail( $email, $use_cache = true ) {
  52   auth_functions_deprecated('getUserByEMail','replaced by Principal class');
  53   return new Principal('email', $email, $use_cache);
  54 }
  55
  56 function getUserByID( $user_no, $use_cache = true ) {
  57   auth_functions_deprecated('getUserByID','replaced by Principal class');
  58   return new Principal('user_no', $user_no, $use_cache);
  59 }
  60
  61 function getPrincipalByID( $principal_id, $use_cache = true ) {
  62   auth_functions_deprecated('getPrincipalByID','replaced by Principal class');
  63   return new Principal('principal_id', $principal_id, $use_cache);
  64 }
  65
  66
  67 /**
  68 * Creates some default home collections for the user.
  69 * @param string $username The username of the user we are creating relationships for.
  70 */
  71 function CreateHomeCollections( $username, $defult_timezone = null ) {
  72   global $session, $c;
  73
  74   if ( !isset($c->default_collections) )
  75   {
  76     $c->default_collections = array();
  77
  78     if( !empty($c->home_calendar_name) )
  79       $c->default_collections[] = array( 'type' => 'calendar', 'name' => $c->home_calendar_name );
  80     if( !empty($c->home_addressbook_name) )
  81       $c->default_collections[] = array( 'type' => 'addressbook', 'name' => $c->home_addressbook_name );
  82   }
  83
  84   if ( !is_array($c->default_collections) || !count($c->default_collections) ) return true;
  85
  86   $principal = new Principal('username',$username);
  87
  88   $user_fullname = $principal->fullname;  // user fullname
  89   $user_rfullname = implode(' ', array_reverse(explode(' ', $principal->fullname)));  // user fullname in reverse order
  90
  91   $sql = 'INSERT INTO collection (user_no, parent_container, dav_name, dav_etag, dav_displayname, is_calendar, is_addressbook, default_privileges, created, modified, resourcetypes) ';
  92   $sql .= 'VALUES( :user_no, :parent_container, :collection_path, :dav_etag, :displayname, :is_calendar, :is_addressbook, :privileges::BIT(24), current_timestamp, current_timestamp, :resourcetypes );';
  93
  94   foreach( $c->default_collections as $v ) {
  95     if ( $v['type'] == 'calendar' || $v['type']=='addressbook' ) {
  96       if ( !empty($v['name']) ) {
  97         $qry = new AwlQuery( 'SELECT 1 FROM collection WHERE dav_name = :dav_name', array( ':dav_name' => $principal->dav_name().$v['name'].'/') );
  98         if ( !$qry->Exec() ) {
  99           $c->messages[] = i18n('There was an error reading from the database.');
 100           return false;
 101         }
 102         if ( $qry->rows() > 0 ) {
 103           $c->messages[] = i18n('Home '.( $v['type']=='calendar' ? 'calendar' : 'addressbook' ).' already exists.');
 104           return true;
 105         }
 106         else {
 107           $params[':user_no'] = $principal->user_no();
 108           $params[':parent_container'] = $principal->dav_name();
 109           $params[':dav_etag'] = '-1';
 110           $params[':collection_path'] = $principal->dav_name().$v['name'].'/';
 111           $params[':displayname'] = ( !isset($v['displayname']) || empty($v['displayname']) ? $user_fullname.( $v['type']=='calendar' ? ' calendar' : ' addressbook' ) : str_replace(array('%fn', '%rfn'), array($user_fullname, $user_rfullname), $v['displayname']) );
 112           $params[':resourcetypes'] = ( $v['type']=='calendar' ? '<DAV::collection/><urn:ietf:params:xml:ns:caldav:calendar/>' : '<DAV::collection/><urn:ietf:params:xml:ns:carddav:addressbook/>' );
 113           $params[':is_calendar'] = ( $v['type']=='calendar' ? true : false );
 114           $params[':is_addressbook'] = ( $v['type']=='addressbook' ? true : false );
 115           $params[':privileges'] = ( !isset($v['privileges']) || $v['privileges']===null ? null : privilege_to_bits($v['privileges']) );
 116
 117           $qry = new AwlQuery( $sql, $params );
 118           if ( $qry->Exec() ) {
 119             $c->messages[] = i18n('Home '.( $v['type']=='calendar' ? 'calendar' : 'addressbook' ).' added.');
 120             dbg_error_log("User",":Write: Created user's home ".( $v['type']=='calendar' ? 'calendar' : 'addressbook' )." at '%s'", $params[':collection_path'] );
 121           }
 122           else {
 123             $c->messages[] = i18n("There was an error writing to the database.");
 124             return false;
 125           }
 126         }
 127       }
 128     }
 129   }
 130   return true;
 131 }
 132
 133 /**
 134  * Backward compatibility
 135  * @param unknown_type $username
 136  */
 137 function CreateHomeCalendar($username) {
 138   auth_functions_deprecated('CreateHomeCalendar','renamed to CreateHomeCollections');
 139   return CreateHomeCollections($username);
 140 }
 141
 142 /**
 143 * Defunct function for creating default relationships.
 144 * @param string $username The username of the user we are creating relationships for.
 145 */
 146 function CreateDefaultRelationships( $username ) {
 147   global $c;
 148   if(! isset($c->default_relationships) || count($c->default_relationships) == 0) return true;
 149
 150   $changes = false;
 151   foreach($c->default_relationships as $group => $relationships)
 152   {
 153     $sql = 'INSERT INTO grants (by_principal, to_principal, privileges) VALUES(:by_principal, :to_principal, :privileges::INT::BIT(24))';
 154     $params = array(
 155       ':by_principal' => getUserByName($username)->principal_id,
 156       ':to_principal' => $group,
 157       ':privileges' => privilege_to_bits($relationships)
 158     );
 159     $qry = new AwlQuery($sql, $params);
 160
 161     if ( $qry->Exec() ) {
 162       $changes = true;
 163       dbg_error_log("User",":Write: Created user's default relationship by:'%s', to:'%s', privileges:'%s'",$params[':by_principal'],$params[':to_principal'],$params[':privileges']);
 164     }
 165     else {
 166       $c->messages[] = i18n("There was an error writing to the database.");
 167       return false;
 168     }
 169   }
 170
 171   if($changes)
 172     $c->messages[] = i18n("Default relationships added.");
 173
 174   return true;
 175 }
 176
 177
 178 function UpdateCollectionTimezones( $username, $new_timezone=null ) {
 179   if ( empty($new_timezone) ) return;
 180   $qry = new AwlQuery('UPDATE collection SET timezone=? WHERE dav_name LIKE ? AND is_calendar', '/'.$username.'/%', $new_timezone);
 181   $qry->Exec();
 182 }
 183
 184 /**
 185 * Update the local cache of the remote user details
 186 * @param object $usr The user details we read from the remote.
 187 */
 188 function UpdateUserFromExternal( &$usr ) {
 189   global $c;
 190
 191   auth_functions_deprecated('UpdateUserFromExternal','refactor to use the "Principal" class');
 192   /**
 193   * When we're doing the create we will usually need to generate a user number
 194   */
 195   if ( !isset($usr->user_no) || intval($usr->user_no) == 0 ) {
 196     $qry = new AwlQuery( "SELECT nextval('usr_user_no_seq');" );
 197     $qry->Exec('Login',__LINE__,__FILE__);
 198     $sequence_value = $qry->Fetch(true);  // Fetch as an array
 199     $usr->user_no = $sequence_value[0];
 200   }
 201
 202   $qry = new AwlQuery('SELECT * FROM usr WHERE user_no = :user_no', array(':user_no' => $usr->user_no) );
 203   if ( $qry->Exec('Login',__LINE__,__FILE__) && $qry->rows() == 1 ) {
 204     $type = "UPDATE";
 205     if ( $old = $qry->Fetch() ) {
 206       $changes = false;
 207       foreach( $usr AS $k => $v ) {
 208         if ( $old->{$k} != $v ) {
 209           $changes = true;
 210           dbg_error_log("Login","User '%s' field '%s' changed from '%s' to '%s'", $usr->username, $k, $old->{$k}, $v );
 211           break;
 212         }
 213       }
 214       if ( !$changes ) {
 215         dbg_error_log("Login","No changes to user record for '%s' - leaving as-is.", $usr->username );
 216         if ( isset($usr->active) && $usr->active == 'f' ) return false;
 217         return; // Normal case, if there are no changes
 218       }
 219       else {
 220         dbg_error_log("Login","Changes to user record for '%s' - updating.", $usr->username );
 221       }
 222     }
 223   }
 224   else
 225     $type = "INSERT";
 226
 227   $params = array();
 228   if ( $type != 'INSERT' ) $params[':user_no'] = $usr->user_no;
 229   $qry = new AwlQuery( sql_from_object( $usr, $type, 'usr', 'WHERE user_no= :user_no' ), $params );
 230   $qry->Exec('Login',__LINE__,__FILE__);
 231
 232   /**
 233   * We disallow login by inactive users _after_ we have updated the local copy
 234   */
 235   if ( isset($usr->active) && ($usr->active === 'f' || $usr->active === false) ) return false;
 236
 237   if ( $type == 'INSERT' ) {
 238     $qry = new AwlQuery( 'INSERT INTO principal( type_id, user_no, displayname, default_privileges) SELECT 1, user_no, fullname, :privs::INT::BIT(24) FROM usr WHERE username=(text(:username))',
 239                           array( ':privs' => privilege_to_bits($c->default_privileges), ':username' => $usr->username) );
 240     $qry->Exec('Login',__LINE__,__FILE__);
 241     CreateHomeCalendar($usr->username);
 242     CreateDefaultRelationships($usr->username);
 243   }
 244   else if ( $usr->fullname != $old->{'fullname'} ) {
 245     // Also update the displayname if the fullname has been updated.
 246     $qry->QDo( 'UPDATE principal SET displayname=:new_display WHERE user_no=:user_no',
 247                     array(':new_display' => $usr->fullname, ':user_no' => $usr->user_no)
 248              );
 249   }
 250 }
 251
 252
 253 /**
 254 * Authenticate against a different PostgreSQL database which contains a usr table in
 255 * the AWL format.
 256 *
 257 * Use this as in the following example config snippet:
 258 *
 259 * require_once('auth-functions.php');
 260 *  $c->authenticate_hook = array(
 261 *      'call'   => 'AuthExternalAwl',
 262 *      'config' => array(
 263 *           // A PgSQL database connection string for the database containing user records
 264 *          'connection[]' => 'dbname=wrms host=otherhost port=5433 user=general',
 265 *           // Which columns should be fetched from the database
 266 *          'columns'    => "user_no, active, email_ok, joined, last_update AS updated, last_used, username, password, fullname, email",
 267 *           // a WHERE clause to limit the records returned.
 268 *          'where'    => "active AND org_code=7"
 269 *      )
 270 *  );
 271 *
 272 */
 273 function AuthExternalAWL( $username, $password ) {
 274   global $c;
 275
 276   $persistent = isset($c->authenticate_hook['config']['use_persistent']) && $c->authenticate_hook['config']['use_persistent'];
 277
 278   if ( isset($c->authenticate_hook['config']['columns']) )
 279     $cols = $c->authenticate_hook['config']['columns'];
 280   else
 281     $cols = '*';
 282
 283   if ( isset($c->authenticate_hook['config']['where']) )
 284     $andwhere = ' AND '.$c->authenticate_hook['config']['where'];
 285   else
 286     $andwhere = '';
 287
 288   $qry = new AwlQuery('SELECT '.$cols.' FROM usr WHERE lower(username) = :username '. $andwhere, array( ':username' => strtolower($username) ));
 289   $authconn = $qry->SetConnection($c->authenticate_hook['config']['connection'], ($persistent ? array(PDO::ATTR_PERSISTENT => true) : null));
 290   if ( ! $authconn ) {
 291     echo <<<EOERRMSG
 292   <html><head><title>Database Connection Failure</title></head><body>
 293   <h1>Database Error</h1>
 294   <h3>Could not connect to PostgreSQL database</h3>
 295   </body>
 296   </html>
 297 EOERRMSG;
 298     @ob_flush();  exit(1);
 299   }
 300
 301   if ( $qry->Exec('Login',__LINE__,__FILE__) && $qry->rows() == 1 ) {
 302     $usr = $qry->Fetch();
 303     if ( session_validate_password( $password, $usr->password ) ) {
 304       $principal = new Principal('username',$username);
 305       if ( $principal->Exists() ) {
 306         if ( $principal->modified <= $usr->updated )
 307           $principal->Update($usr);
 308       }
 309       else {
 310         $principal->Create($usr);
 311         CreateHomeCollections($username);
 312       }
 313
 314       /**
 315       * We disallow login by inactive users _after_ we have updated the local copy
 316       */
 317       if ( isset($usr->active) && $usr->active == 'f' ) return false;
 318
 319       return $principal;
 320     }
 321   }
 322
 323   return false;
 324
 325 }