|
4 | 4 |
|
5 | 5 | namespace SimpleSAML\Module\sqlauth\Auth\Source; |
6 | 6 |
|
7 | | -use SimpleSAML\Assert\Assert; |
8 | | -use SimpleSAML\Error; |
9 | | -use SimpleSAML\Logger; |
10 | | -use SimpleSAML\Module\sqlauth\Auth\Source\SQL; |
11 | | - |
12 | | -use function array_key_exists; |
13 | | -use function array_keys; |
14 | | -use function count; |
15 | | -use function implode; |
16 | | -use function is_null; |
17 | | -use function password_verify; |
18 | | -use function sprintf; |
19 | | - |
20 | 7 | /** |
21 | 8 | * Simple SQL authentication source |
22 | 9 | * |
|
44 | 31 | * @package SimpleSAMLphp |
45 | 32 | */ |
46 | 33 |
|
47 | | -class PasswordVerify extends SQL |
| 34 | +class PasswordVerify extends PasswordVerify1Compat |
48 | 35 | { |
49 | | - /** |
50 | | - * The column in the result set containing the passwordhash. |
51 | | - */ |
52 | | - protected string $passwordhashcolumn = 'passwordhash'; |
53 | | - |
54 | | - |
55 | | - /** |
56 | | - * Constructor for this authentication source. |
57 | | - * |
58 | | - * @param array $info Information about this authentication source. |
59 | | - * @param array $config Configuration. |
60 | | - */ |
61 | | - public function __construct(array $info, array $config) |
62 | | - { |
63 | | - // Call the parent constructor first, as required by the interface |
64 | | - parent::__construct($info, $config); |
65 | | - |
66 | | - if (array_key_exists('passwordhashcolumn', $config)) { |
67 | | - $this->passwordhashcolumn = $config['passwordhashcolumn']; |
68 | | - } |
69 | | - } |
70 | | - |
71 | | - |
72 | | - /** |
73 | | - * Attempt to log in using the given username and password. |
74 | | - * |
75 | | - * On a successful login, this function should return the users attributes. On failure, |
76 | | - * it should throw an exception. If the error was caused by the user entering the wrong |
77 | | - * username or password, a \SimpleSAML\Error\Error('WRONGUSERPASS') should be thrown. |
78 | | - * |
79 | | - * Note that both the username and the password are UTF-8 encoded. |
80 | | - * |
81 | | - * @param string $username The username the user wrote. |
82 | | - * @param string $password The password the user wrote. |
83 | | - * @return array Associative array with the users attributes. |
84 | | - */ |
85 | | - protected function login(string $username, string $password): array |
86 | | - { |
87 | | - $this->verifyUserNameWithRegex($username); |
88 | | - |
89 | | - $db = $this->connect(); |
90 | | - $params = ['username' => $username]; |
91 | | - $attributes = []; |
92 | | - |
93 | | - $numQueries = count($this->query); |
94 | | - for ($x = 0; $x < $numQueries; $x++) { |
95 | | - $data = $this->executeQuery($db, $this->query[$x], $params); |
96 | | - |
97 | | - Logger::info('sqlauth:' . $this->authId . ': Got ' . count($data) . |
98 | | - ' rows from database'); |
99 | | - |
100 | | - /** |
101 | | - * Sanity check, passwordhash must be in each resulting tuple and must have |
102 | | - * the same value in every tuple. |
103 | | - * |
104 | | - * Note that $pwhash will contain the passwordhash value after this loop. |
105 | | - */ |
106 | | - $pwhash = null; |
107 | | - if ($x === 0) { |
108 | | - if (count($data) === 0) { |
109 | | - // No rows returned - invalid username/password |
110 | | - Logger::error(sprintf( |
111 | | - 'sqlauth:%s: No rows in result set. Probably wrong username/password.', |
112 | | - $this->authId, |
113 | | - )); |
114 | | - throw new Error\Error('WRONGUSERPASS'); |
115 | | - } |
116 | | - |
117 | | - foreach ($data as $row) { |
118 | | - if ( |
119 | | - !array_key_exists($this->passwordhashcolumn, $row) |
120 | | - || is_null($row[$this->passwordhashcolumn]) |
121 | | - ) { |
122 | | - Logger::error(sprintf( |
123 | | - 'sqlauth:%s: column `%s` must be in every result tuple.', |
124 | | - $this->authId, |
125 | | - $this->passwordhashcolumn, |
126 | | - )); |
127 | | - throw new Error\Error('WRONGUSERPASS'); |
128 | | - } |
129 | | - if ($pwhash) { |
130 | | - if ($pwhash != $row[$this->passwordhashcolumn]) { |
131 | | - Logger::error(sprintf( |
132 | | - 'sqlauth:%s: column %s must be THE SAME in every result tuple.', |
133 | | - $this->authId, |
134 | | - $this->passwordhashcolumn, |
135 | | - )); |
136 | | - throw new Error\Error('WRONGUSERPASS'); |
137 | | - } |
138 | | - } |
139 | | - $pwhash = $row[$this->passwordhashcolumn]; |
140 | | - } |
141 | | - |
142 | | - /** |
143 | | - * This should never happen as the count(data) test above would have already thrown. |
144 | | - * But checking twice doesn't hurt. |
145 | | - */ |
146 | | - Assert::notNull($pwhash); |
147 | | - |
148 | | - /** |
149 | | - * VERIFICATION! |
150 | | - * Now to check if the password the user supplied is actually valid |
151 | | - */ |
152 | | - if (!password_verify($password, $pwhash)) { |
153 | | - Logger::error(sprintf( |
154 | | - 'sqlauth:%s: password is incorrect.', |
155 | | - $this->authId, |
156 | | - )); |
157 | | - throw new Error\Error('WRONGUSERPASS'); |
158 | | - } |
159 | | - } |
160 | | - |
161 | | - $this->extractAttributes($attributes, $data, [$this->passwordhashcolumn]); |
162 | | - } |
163 | | - |
164 | | - Logger::info(sprintf( |
165 | | - 'sqlauth:%s: Attributes: %s', |
166 | | - $this->authId, |
167 | | - implode(',', array_keys($attributes)), |
168 | | - )); |
169 | | - |
170 | | - return $attributes; |
171 | | - } |
172 | 36 | } |
0 commit comments