libraries/auth/signon.auth.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Set of functions used to run single signon authentication.
   5  *
   6  * @package phpMyAdmin-Auth-Signon
   7  */
   8
   9
  10 /**
  11  * Displays authentication form
  12  *
  13  * @global  string    the font face to use in case of failure
  14  * @global  string    the default font size to use in case of failure
  15  * @global  string    the big font size to use in case of failure
  16  *
  17  * @return  boolean   always true (no return indeed)
  18  *
  19  * @access  public
  20  */
  21 function PMA_auth()
  22 {
  23     unset($_SESSION['LAST_SIGNON_URL']);
  24     if (empty($GLOBALS['cfg']['Server']['SignonURL'])) {
  25         PMA_fatalError('You must set SignonURL!');
  26     } elseif (!empty($_REQUEST['old_usr']) && !empty($GLOBALS['cfg']['Server']['LogoutURL'])) {
  27         /* Perform logout to custom URL */
  28         PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['LogoutURL']);
  29     } else {
  30         PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['SignonURL']);
  31     }
  32     exit();
  33 } // end of the 'PMA_auth()' function
  34
  35
  36 /**
  37  * Gets advanced authentication settings
  38  *
  39  * @global  string    the username if register_globals is on
  40  * @global  string    the password if register_globals is on
  41  * @global  array     the array of server variables if register_globals is
  42  *                    off
  43  * @global  array     the array of environment variables if register_globals
  44  *                    is off
  45  * @global  string    the username for the ? server
  46  * @global  string    the password for the ? server
  47  * @global  string    the username for the WebSite Professional server
  48  * @global  string    the password for the WebSite Professional server
  49  * @global  string    the username of the user who logs out
  50  *
  51  * @return  boolean   whether we get authentication settings or not
  52  *
  53  * @access  public
  54  */
  55 function PMA_auth_check()
  56 {
  57     global $PHP_AUTH_USER, $PHP_AUTH_PW;
  58
  59     /* Check if we're using same sigon server */
  60     if (isset($_SESSION['LAST_SIGNON_URL']) && $_SESSION['LAST_SIGNON_URL'] != $GLOBALS['cfg']['Server']['SignonURL']) {
  61         return false;
  62     }
  63
  64     /* Script name */
  65     $script_name = $GLOBALS['cfg']['Server']['SignonScript'];
  66
  67     /* Session name */
  68     $session_name = $GLOBALS['cfg']['Server']['SignonSession'];
  69
  70     /* Login URL */
  71     $signon_url = $GLOBALS['cfg']['Server']['SignonURL'];
  72
  73     /* Current host */
  74     $single_signon_host = $GLOBALS['cfg']['Server']['host'];
  75
  76     /* Current port */
  77     $single_signon_port = $GLOBALS['cfg']['Server']['port'];
  78
  79     /* No configuration updates */
  80     $single_signon_cfgupdate = array();
  81
  82     /* Are we requested to do logout? */
  83     $do_logout = !empty($_REQUEST['old_usr']);
  84
  85     /* Handle script based auth */
  86     if (!empty($script_name)) {
  87         if (! file_exists($script_name)) {
  88             PMA_fatalError(__('Can not find signon authentication script:') . ' ' . $script_name);
  89         }
  90         require $script_name;
  91
  92         list ($PHP_AUTH_USER, $PHP_AUTH_PW) = get_login_credentials($cfg['Server']['user']);
  93
  94     /* Does session exist? */
  95     } elseif (isset($_COOKIE[$session_name])) {
  96         /* End current session */
  97         $old_session = session_name();
  98         $old_id = session_id();
  99         session_write_close();
 100
 101         /* Load single signon session */
 102         session_name($session_name);
 103         session_id($_COOKIE[$session_name]);
 104         session_start();
 105
 106         /* Clear error message */
 107         unset($_SESSION['PMA_single_signon_error_message']);
 108
 109         /* Grab credentials if they exist */
 110         if (isset($_SESSION['PMA_single_signon_user'])) {
 111             if ($do_logout) {
 112                 $PHP_AUTH_USER = '';
 113             } else {
 114                 $PHP_AUTH_USER = $_SESSION['PMA_single_signon_user'];
 115             }
 116         }
 117         if (isset($_SESSION['PMA_single_signon_password'])) {
 118             if ($do_logout) {
 119                 $PHP_AUTH_PW = '';
 120             } else {
 121                 $PHP_AUTH_PW = $_SESSION['PMA_single_signon_password'];
 122             }
 123         }
 124         if (isset($_SESSION['PMA_single_signon_host'])) {
 125             $single_signon_host = $_SESSION['PMA_single_signon_host'];
 126         }
 127
 128         if (isset($_SESSION['PMA_single_signon_port'])) {
 129             $single_signon_port = $_SESSION['PMA_single_signon_port'];
 130         }
 131
 132         if (isset($_SESSION['PMA_single_signon_cfgupdate'])) {
 133             $single_signon_cfgupdate = $_SESSION['PMA_single_signon_cfgupdate'];
 134         }
 135
 136
 137         /* Also get token as it is needed to access subpages */
 138         if (isset($_SESSION['PMA_single_signon_token'])) {
 139             /* No need to care about token on logout */
 140             $pma_token = $_SESSION['PMA_single_signon_token'];
 141         }
 142
 143         /* End single signon session */
 144         session_write_close();
 145
 146         /* Restart phpMyAdmin session */
 147         session_name($old_session);
 148         if (!empty($old_id)) {
 149             session_id($old_id);
 150         }
 151         session_start();
 152
 153         /* Set the single signon host */
 154         $GLOBALS['cfg']['Server']['host'] = $single_signon_host;
 155
 156         /* Set the single signon port */
 157         $GLOBALS['cfg']['Server']['port'] = $single_signon_port;
 158
 159         /* Configuration update */
 160         $GLOBALS['cfg']['Server'] = array_merge($GLOBALS['cfg']['Server'], $single_signon_cfgupdate);
 161
 162         /* Restore our token */
 163         if (!empty($pma_token)) {
 164             $_SESSION[' PMA_token '] = $pma_token;
 165         }
 166
 167         /**
 168          * Clear user cache.
 169          */
 170         PMA_clearUserCache();
 171     }
 172
 173     // Returns whether we get authentication settings or not
 174     if (empty($PHP_AUTH_USER)) {
 175         unset($_SESSION['LAST_SIGNON_URL']);
 176         return false;
 177     } else {
 178         $_SESSION['LAST_SIGNON_URL'] = $GLOBALS['cfg']['Server']['SignonURL'];
 179         return true;
 180     }
 181 } // end of the 'PMA_auth_check()' function
 182
 183
 184 /**
 185  * Set the user and password after last checkings if required
 186  *
 187  * @global  array     the valid servers settings
 188  * @global  integer   the id of the current server
 189  * @global  array     the current server settings
 190  * @global  string    the current username
 191  * @global  string    the current password
 192  *
 193  * @return  boolean   always true
 194  *
 195  * @access  public
 196  */
 197 function PMA_auth_set_user()
 198 {
 199     global $cfg;
 200     global $PHP_AUTH_USER, $PHP_AUTH_PW;
 201
 202     $cfg['Server']['user']     = $PHP_AUTH_USER;
 203     $cfg['Server']['password'] = $PHP_AUTH_PW;
 204
 205     return true;
 206 } // end of the 'PMA_auth_set_user()' function
 207
 208
 209 /**
 210  * User is not allowed to login to MySQL -> authentication failed
 211  *
 212  * @return  boolean   always true (no return indeed)
 213  *
 214  * @access  public
 215  */
 216 function PMA_auth_fails()
 217 {
 218     /* Session name */
 219     $session_name = $GLOBALS['cfg']['Server']['SignonSession'];
 220
 221     /* Does session exist? */
 222     if (isset($_COOKIE[$session_name])) {
 223         /* End current session */
 224         $old_session = session_name();
 225         $old_id = session_id();
 226         session_write_close();
 227
 228         /* Load single signon session */
 229         session_name($session_name);
 230         session_id($_COOKIE[$session_name]);
 231         session_start();
 232
 233         /* Set error message */
 234         if (! empty($GLOBALS['login_without_password_is_forbidden'])) {
 235             $_SESSION['PMA_single_signon_error_message'] = __('Login without a password is forbidden by configuration (see AllowNoPassword)');
 236         } elseif (! empty($GLOBALS['allowDeny_forbidden'])) {
 237             $_SESSION['PMA_single_signon_error_message'] = __('Access denied');
 238         } elseif (! empty($GLOBALS['no_activity'])) {
 239             $_SESSION['PMA_single_signon_error_message'] = sprintf(__('No activity within %s seconds; please log in again'), $GLOBALS['cfg']['LoginCookieValidity']);
 240         } elseif (PMA_DBI_getError()) {
 241             $_SESSION['PMA_single_signon_error_message'] = PMA_sanitize(PMA_DBI_getError());
 242         } else {
 243             $_SESSION['PMA_single_signon_error_message'] = __('Cannot log in to the MySQL server');
 244         }
 245     }
 246     PMA_auth();
 247 } // end of the 'PMA_auth_fails()' function
 248
 249 ?>