2016-04-01 07:24:27 +02:00
|
|
|
package Lemonldap::NG::Portal::Main::Process;
|
|
|
|
|
2016-04-07 23:31:56 +02:00
|
|
|
our $VERSION = '2.0.0';
|
|
|
|
|
|
|
|
package Lemonldap::NG::Portal::Main;
|
|
|
|
|
2016-04-01 07:24:27 +02:00
|
|
|
use strict;
|
2016-04-02 22:17:39 +02:00
|
|
|
use MIME::Base64;
|
2016-04-04 07:08:26 +02:00
|
|
|
use POSIX qw(strftime);
|
2016-04-01 07:24:27 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
# Main method
|
|
|
|
# -----------
|
|
|
|
# Launch all methods declared in request "steps" array. Methods can be
|
|
|
|
# declared by their name (in Lemonldap::NG::Portal::Main namespace) or point
|
|
|
|
# to a subroutine (see Lemonldap::NG::Portal::Main::Run.pm)
|
|
|
|
|
|
|
|
sub process {
|
2018-01-22 21:57:48 +01:00
|
|
|
my ( $self, $req, %args ) = @_;
|
2016-04-03 08:33:50 +02:00
|
|
|
|
|
|
|
#$req->error(PE_OK);
|
|
|
|
my $err = PE_OK;
|
|
|
|
while ( my $sub = shift @{ $req->steps } ) {
|
|
|
|
if ( ref $sub ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Processing code ref");
|
2018-01-22 21:57:48 +01:00
|
|
|
last if ( $err = $sub->( $req, %args ) );
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
else {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Processing $sub");
|
2018-01-22 21:57:48 +01:00
|
|
|
last if ( $err = $self->$sub( $req, %args ) );
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
}
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Returned error: $err") if ($err);
|
2016-04-03 08:33:50 +02:00
|
|
|
return $err;
|
|
|
|
}
|
|
|
|
|
2016-04-02 22:17:39 +02:00
|
|
|
# First process block: check args
|
|
|
|
# -------------------------------
|
|
|
|
|
|
|
|
# For post requests, parse datas
|
|
|
|
sub restoreArgs {
|
|
|
|
my ( $self, $req ) = @_;
|
2016-04-03 08:33:50 +02:00
|
|
|
$req->mustRedirect(1);
|
2016-12-18 09:07:48 +01:00
|
|
|
return PE_OK;
|
2016-04-02 22:17:39 +02:00
|
|
|
}
|
|
|
|
|
2016-04-14 20:42:59 +02:00
|
|
|
sub importHandlerDatas {
|
|
|
|
my ( $self, $req ) = @_;
|
2016-08-02 15:52:29 +02:00
|
|
|
$req->{sessionInfo} = $req->userData;
|
2016-05-22 19:06:55 +02:00
|
|
|
$req->id( $req->sessionInfo->{_session_id} );
|
2016-07-12 07:15:26 +02:00
|
|
|
$req->user( $req->sessionInfo->{ $self->conf->{whatToTrace} } );
|
2016-04-14 20:42:59 +02:00
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
2017-01-01 10:43:48 +01:00
|
|
|
# Verify url and confirm parameter
|
2016-04-02 22:17:39 +02:00
|
|
|
sub controlUrl {
|
|
|
|
my ( $self, $req ) = @_;
|
2017-01-01 10:43:48 +01:00
|
|
|
if ( my $c = $req->param('confirm') ) {
|
|
|
|
|
|
|
|
# Replace confirm stamp by 1 or -1
|
|
|
|
$c =~ s/^(-?)(.*)$/${1}1/;
|
|
|
|
|
|
|
|
# Decrypt confirm stamp if cipher available
|
|
|
|
# and confirm not already decrypted
|
|
|
|
if ( $self->conf->{cipher} and $2 ne "1" ) {
|
|
|
|
my $time = time() - $self->conf->{cipher}->decrypt($2);
|
|
|
|
if ( $time < 600 ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Confirm parameter accepted $c");
|
2017-01-04 17:36:54 +01:00
|
|
|
$req->set_param( 'confirm', $c );
|
2017-01-01 10:43:48 +01:00
|
|
|
}
|
|
|
|
else {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->notice('Confirmation to old, refused');
|
2017-01-04 17:36:54 +01:00
|
|
|
$req->set_param( 'confirm', 0 );
|
2017-01-01 10:43:48 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2016-04-03 18:51:23 +02:00
|
|
|
$req->{datas}->{_url} ||= '';
|
2017-10-26 22:13:10 +02:00
|
|
|
my $url = $req->param('url');
|
|
|
|
my $issuerUrl = $req->param('issuerUrldc');
|
|
|
|
if ( $url or $issuerUrl ) {
|
2017-03-21 07:23:58 +01:00
|
|
|
|
2017-03-27 18:51:18 +02:00
|
|
|
if ($issuerUrl) {
|
2017-03-21 07:23:58 +01:00
|
|
|
$req->urlNotBase64(1);
|
|
|
|
$url = $issuerUrl;
|
|
|
|
}
|
2016-04-02 22:17:39 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
# REJECT NON BASE64 URL
|
|
|
|
if ( $req->urlNotBase64 ) {
|
2016-05-23 18:55:18 +02:00
|
|
|
$req->{urldc} = $url;
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
else {
|
2016-04-02 22:17:39 +02:00
|
|
|
if ( $url =~ m#[^A-Za-z0-9\+/=]# ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->userLogger->error(
|
|
|
|
"Value must be in BASE64 (param: url | value: $url)");
|
2016-04-02 22:17:39 +02:00
|
|
|
return PE_BADURL;
|
|
|
|
}
|
2016-05-23 18:55:18 +02:00
|
|
|
$req->{urldc} = decode_base64($url);
|
|
|
|
$req->{urldc} =~ s/[\r\n]//sg;
|
2016-04-02 22:17:39 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
# For logout request, test if Referer comes from an authorizated site
|
2016-05-22 19:06:55 +02:00
|
|
|
my $tmp = (
|
|
|
|
$req->param('logout')
|
2016-05-23 18:55:23 +02:00
|
|
|
? $req->referer
|
2016-05-23 18:55:18 +02:00
|
|
|
: $req->{urldc}
|
2016-05-22 19:06:55 +02:00
|
|
|
);
|
2016-04-02 22:17:39 +02:00
|
|
|
|
|
|
|
# XSS attack
|
|
|
|
if (
|
|
|
|
$self->checkXSSAttack(
|
|
|
|
$req->param('logout') ? 'HTTP Referer' : 'urldc',
|
2016-05-23 18:55:18 +02:00
|
|
|
$req->{urldc}
|
2016-04-02 22:17:39 +02:00
|
|
|
)
|
|
|
|
)
|
|
|
|
{
|
2016-05-23 18:55:18 +02:00
|
|
|
delete $req->{urldc};
|
2016-04-02 22:17:39 +02:00
|
|
|
return PE_BADURL;
|
|
|
|
}
|
|
|
|
|
|
|
|
# Non protected hosts
|
|
|
|
if ( $tmp and !$self->isTrustedUrl($tmp) ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->userLogger->error(
|
|
|
|
"URL contains a non protected host (param: "
|
2016-04-02 22:17:39 +02:00
|
|
|
. ( $req->param('logout') ? 'HTTP Referer' : 'urldc' )
|
2017-02-15 07:41:50 +01:00
|
|
|
. " | value: $tmp)" );
|
2016-05-23 18:55:18 +02:00
|
|
|
delete $req->{urldc};
|
2016-04-02 22:17:39 +02:00
|
|
|
return PE_BADURL;
|
|
|
|
}
|
|
|
|
|
|
|
|
$req->datas->{_url} = $url;
|
|
|
|
}
|
|
|
|
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
2016-04-14 21:49:27 +02:00
|
|
|
sub checkLogout {
|
|
|
|
my ( $self, $req ) = @_;
|
2017-01-04 17:36:54 +01:00
|
|
|
if ( defined $req->param('logout') ) {
|
2016-05-23 18:55:23 +02:00
|
|
|
$req->steps(
|
|
|
|
[ @{ $self->beforeLogout }, 'authLogout', 'deleteSession' ] );
|
2016-04-18 22:23:40 +02:00
|
|
|
}
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
2016-05-01 09:30:21 +02:00
|
|
|
sub authLogout {
|
2016-05-23 23:52:32 +02:00
|
|
|
my ( $self, $req ) = @_;
|
2016-07-02 10:51:00 +02:00
|
|
|
return $self->_authentication->authLogout($req);
|
2016-05-01 09:30:21 +02:00
|
|
|
}
|
|
|
|
|
2016-04-18 22:23:40 +02:00
|
|
|
sub deleteSession {
|
|
|
|
my ( $self, $req ) = @_;
|
2017-02-19 08:17:48 +01:00
|
|
|
$req->userData( {} );
|
2018-04-09 22:33:59 +02:00
|
|
|
if ( my $id = $req->id ) {
|
|
|
|
my $apacheSession = $self->getApacheSession( $req->id );
|
|
|
|
unless ($apacheSession) {
|
|
|
|
$self->logger->debug("Session $id already deleted");
|
|
|
|
return PE_OK;
|
|
|
|
}
|
|
|
|
unless ( $self->_deleteSession( $req, $apacheSession ) ) {
|
|
|
|
$self->logger->error("Unable to delete session $id");
|
|
|
|
$self->logger->error( $apacheSession->error );
|
|
|
|
return PE_ERROR;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->logger->debug("Session $id deleted from global storage");
|
|
|
|
}
|
2016-04-18 22:23:40 +02:00
|
|
|
}
|
|
|
|
|
2016-08-09 14:08:49 +02:00
|
|
|
# TODO
|
2016-04-18 22:23:40 +02:00
|
|
|
# Collect logout services and build hidden iFrames
|
2016-12-20 11:43:22 +01:00
|
|
|
if ( $req->datas->{logoutServices} and %{ $req->datas->{logoutServices} } )
|
|
|
|
{
|
2016-04-18 22:23:40 +02:00
|
|
|
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Create iFrames to forward logout to services");
|
2016-04-18 22:23:40 +02:00
|
|
|
|
2017-10-10 13:04:40 +02:00
|
|
|
$req->info(
|
|
|
|
$self->loadTemplate(
|
|
|
|
'simpleInfo', params => { trspan => 'logoutFromOtherApp' }
|
|
|
|
)
|
|
|
|
);
|
2016-04-18 22:23:40 +02:00
|
|
|
|
2016-12-20 11:43:22 +01:00
|
|
|
foreach ( keys %{ $req->datas->{logoutServices} } ) {
|
|
|
|
my $logoutServiceName = $_;
|
|
|
|
my $logoutServiceUrl =
|
|
|
|
$req->datas->{logoutServices}->{$logoutServiceName};
|
2016-04-18 22:23:40 +02:00
|
|
|
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug(
|
|
|
|
"Find logout service $logoutServiceName ($logoutServiceUrl)");
|
2016-04-14 21:49:27 +02:00
|
|
|
|
2016-12-20 11:43:22 +01:00
|
|
|
my $iframe =
|
2017-01-19 14:20:02 +01:00
|
|
|
qq'<iframe src="$logoutServiceUrl" alt="$logoutServiceName"'
|
|
|
|
. ' marginwidth="0" marginheight="0" scrolling="no"'
|
|
|
|
. ' class="hiddenFrame" width="0" height="0"'
|
|
|
|
. ' frameborder="0"></iframe>';
|
2016-04-14 21:49:27 +02:00
|
|
|
|
2017-02-07 18:57:19 +01:00
|
|
|
$req->info($iframe);
|
2016-12-20 11:43:22 +01:00
|
|
|
}
|
2016-04-14 21:49:27 +02:00
|
|
|
|
2016-12-20 11:43:22 +01:00
|
|
|
# Redirect on logout page if no other target defined
|
|
|
|
if ( !$req->urldc and !$req->postUrl ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug('No other target defined, redirect on logout');
|
2017-01-04 17:36:54 +01:00
|
|
|
$req->urldc( $req->script_name . "?logout=1" );
|
2016-12-20 11:43:22 +01:00
|
|
|
}
|
|
|
|
}
|
2016-04-14 21:49:27 +02:00
|
|
|
|
2016-04-18 22:23:40 +02:00
|
|
|
# Redirect or Post if asked by authLogout
|
2016-12-20 11:43:22 +01:00
|
|
|
if ( $req->urldc and $req->urldc ne $self->conf->{portal} ) {
|
|
|
|
$req->steps( [] );
|
|
|
|
return PE_REDIRECT;
|
|
|
|
}
|
2016-04-14 21:49:27 +02:00
|
|
|
|
2016-12-20 11:43:22 +01:00
|
|
|
if ( $req->postUrl ) {
|
|
|
|
$req->steps( ['autoPost'] );
|
|
|
|
return PE_OK;
|
|
|
|
}
|
2016-04-14 21:49:27 +02:00
|
|
|
|
2016-04-18 22:23:40 +02:00
|
|
|
# If logout redirects to another URL, just remove next steps for the
|
|
|
|
# request so autoRedirect will be called
|
|
|
|
if ( $req->{urldc} and $req->{urldc} ne $self->conf->{portal} ) {
|
|
|
|
$req->steps( [] );
|
|
|
|
return PE_OK;
|
2016-04-14 21:49:27 +02:00
|
|
|
}
|
|
|
|
|
2016-04-18 22:23:40 +02:00
|
|
|
# Else display "error"
|
|
|
|
return PE_LOGOUT_OK;
|
2016-04-14 21:49:27 +02:00
|
|
|
}
|
|
|
|
|
2016-04-05 13:12:53 +02:00
|
|
|
# Check value to detect XSS attack
|
|
|
|
# @param name Parameter name
|
|
|
|
# @param value Parameter value
|
|
|
|
# @return 1 if attack detected, 0 else
|
|
|
|
sub checkXSSAttack {
|
|
|
|
my ( $self, $name, $value ) = @_;
|
|
|
|
|
|
|
|
# Empty values are not bad
|
|
|
|
return 0 unless $value;
|
|
|
|
|
|
|
|
# Test value
|
2016-06-29 21:40:42 +02:00
|
|
|
$value =~ s/\%25/\%/g;
|
|
|
|
if ( $value =~ m/(?:\0|<|'|"|`|\%(?:00|3C|22|27|2C))/ ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->userLogger->error(
|
|
|
|
"XSS attack detected (param: $name | value: $value)");
|
2016-04-05 13:12:53 +02:00
|
|
|
return $self->conf->{checkXSS};
|
|
|
|
}
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2016-04-02 22:17:39 +02:00
|
|
|
# Second block: auth process (call auth or userDB object)
|
|
|
|
# -------------------------------------------------------
|
|
|
|
|
2016-04-01 07:24:27 +02:00
|
|
|
sub extractFormInfo {
|
2016-05-23 23:52:32 +02:00
|
|
|
my ( $self, $req ) = @_;
|
2017-09-08 12:10:37 +02:00
|
|
|
return PE_ERROR unless ( $self->_authentication );
|
2016-05-25 21:30:43 +02:00
|
|
|
my $ret = $self->_authentication->extractFormInfo($req);
|
2016-12-01 23:25:05 +01:00
|
|
|
if ( $ret == PE_OK and not( $req->user or $req->continue ) ) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->error(
|
|
|
|
'Authentication module succeed but has not set $req->user');
|
2016-05-25 21:30:43 +02:00
|
|
|
return PE_ERROR;
|
|
|
|
}
|
2017-01-12 18:44:30 +01:00
|
|
|
elsif ( $ret == PE_FIRSTACCESS
|
|
|
|
and $req->cookies->{ $self->conf->{cookieName} } )
|
|
|
|
{
|
2017-01-13 15:35:02 +01:00
|
|
|
$req->addCookie(
|
|
|
|
$self->cookie(
|
|
|
|
name => $self->conf->{cookieName},
|
|
|
|
value => 0,
|
|
|
|
domain => $self->conf->{domain},
|
|
|
|
secure => 0,
|
2017-03-15 11:01:29 +01:00
|
|
|
expires => 'Wed, 21 Oct 2015 00:00:00 GMT'
|
2017-01-13 15:35:02 +01:00
|
|
|
)
|
|
|
|
);
|
2017-04-27 12:21:46 +02:00
|
|
|
if ( $self->conf->{portalErrorOnExpiredSession} ) {
|
|
|
|
$ret = PE_SESSIONEXPIRED;
|
|
|
|
}
|
2017-01-12 18:44:30 +01:00
|
|
|
}
|
2016-05-25 21:30:43 +02:00
|
|
|
return $ret;
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub getUser {
|
2018-01-23 23:01:17 +01:00
|
|
|
my ( $self, $req, %args ) = @_;
|
2017-09-08 12:10:37 +02:00
|
|
|
return PE_ERROR unless ( $self->_userDB );
|
2018-01-23 23:01:17 +01:00
|
|
|
return $self->_userDB->getUser( $req, %args );
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub authenticate {
|
2016-05-23 23:52:32 +02:00
|
|
|
my ( $self, $req ) = @_;
|
2017-06-13 15:03:13 +02:00
|
|
|
my $ret = $req->authResult( $self->_authentication->authenticate($req) );
|
|
|
|
|
|
|
|
if ( $ret == PE_OK ) {
|
|
|
|
$req->{sessionInfo}->{_lastAuthnUTime} = time();
|
|
|
|
}
|
|
|
|
|
|
|
|
return $ret;
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
2016-04-02 22:17:39 +02:00
|
|
|
# Third block: Session data providing
|
|
|
|
# -----------------------------------
|
2016-04-01 07:24:27 +02:00
|
|
|
|
2016-12-01 23:25:05 +01:00
|
|
|
sub setAuthSessionInfo {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
my $ret = $self->_authentication->setAuthSessionInfo($req);
|
2016-12-02 06:47:38 +01:00
|
|
|
if ( $ret == PE_OK
|
|
|
|
and not( defined $req->sessionInfo->{authenticationLevel} ) )
|
|
|
|
{
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->error('Authentication level is not set by auth module');
|
2016-12-01 23:25:05 +01:00
|
|
|
}
|
|
|
|
return $ret;
|
|
|
|
}
|
|
|
|
|
2016-04-01 07:24:27 +02:00
|
|
|
sub setSessionInfo {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
|
2016-04-05 22:46:11 +02:00
|
|
|
# Set _user
|
2016-12-01 23:25:05 +01:00
|
|
|
$req->{sessionInfo}->{_user} //= $req->{user};
|
2016-04-05 22:46:11 +02:00
|
|
|
|
2016-04-01 07:24:27 +02:00
|
|
|
# Get the current user module
|
2016-04-03 18:27:22 +02:00
|
|
|
$req->{sessionInfo}->{_auth} = $self->getModule( $req, "auth" );
|
|
|
|
$req->{sessionInfo}->{_userDB} = $self->getModule( $req, "user" );
|
2016-04-01 07:24:27 +02:00
|
|
|
|
|
|
|
# Store IP address from remote address or X-FORWARDED-FOR header
|
2017-01-04 17:36:54 +01:00
|
|
|
$req->{sessionInfo}->{ipAddr} = $req->address;
|
2016-04-01 07:24:27 +02:00
|
|
|
|
|
|
|
# Date and time
|
|
|
|
if ( $self->conf->{updateSession} ) {
|
2017-03-21 21:52:40 +01:00
|
|
|
$req->{sessionInfo}->{_updateTime} =
|
2016-04-01 07:24:27 +02:00
|
|
|
strftime( "%Y%m%d%H%M%S", localtime() );
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$req->{sessionInfo}->{_utime} ||= time();
|
2017-03-21 21:52:40 +01:00
|
|
|
$req->{sessionInfo}->{_startTime} =
|
2016-04-01 07:24:27 +02:00
|
|
|
strftime( "%Y%m%d%H%M%S", localtime() );
|
2016-04-02 22:17:39 +02:00
|
|
|
$req->{sessionInfo}->{_lastSeen} = time()
|
|
|
|
if $self->conf->{timeoutActivity};
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
# Store URL origin in session
|
2016-05-23 18:55:18 +02:00
|
|
|
$req->{sessionInfo}->{_url} = $req->{urldc};
|
2016-04-01 07:24:27 +02:00
|
|
|
|
2016-04-03 18:27:17 +02:00
|
|
|
# Share sessionInfo with underlying handler (needed for safe jail)
|
2016-08-03 09:31:36 +02:00
|
|
|
$req->userData( $req->sessionInfo );
|
2016-04-03 18:27:17 +02:00
|
|
|
|
2016-04-01 07:24:27 +02:00
|
|
|
# Call UserDB setSessionInfo
|
2016-04-03 08:33:50 +02:00
|
|
|
return $self->_userDB->setSessionInfo($req);
|
2016-04-01 07:24:27 +02:00
|
|
|
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
sub setMacros {
|
2016-04-03 08:33:50 +02:00
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
foreach ( sort keys %{ $self->_macros } ) {
|
2016-12-20 11:43:22 +01:00
|
|
|
$req->{sessionInfo}->{$_} =
|
2017-03-28 23:07:49 +02:00
|
|
|
$self->_macros->{$_}->( $req, $req->sessionInfo );
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
PE_OK;
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub setGroups {
|
2016-04-03 08:33:50 +02:00
|
|
|
my ( $self, $req ) = @_;
|
2016-05-23 23:52:32 +02:00
|
|
|
return $self->_userDB->setGroups($req);
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub setPersistentSessionInfo {
|
2016-04-03 08:33:50 +02:00
|
|
|
my ( $self, $req ) = @_;
|
2016-04-01 12:10:42 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
# Do not restore infos if session already opened
|
|
|
|
unless ( $req->{id} ) {
|
|
|
|
my $key = $req->{sessionInfo}->{ $self->conf->{whatToTrace} };
|
2016-04-01 12:10:42 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
return PE_OK unless ( $key and length($key) );
|
2016-04-01 12:10:42 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
my $persistentSession = $self->getPersistentSession($key);
|
2016-04-01 12:10:42 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
if ($persistentSession) {
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Persistent session found for $key");
|
2016-04-03 08:33:50 +02:00
|
|
|
foreach my $k ( keys %{ $persistentSession->data } ) {
|
2016-04-01 12:10:42 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
# Do not restore some parameters
|
|
|
|
next if $k =~ /^_(?:utime|session_(?:u?id|kind))$/;
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Restore persistent parameter $k");
|
2016-04-03 08:33:50 +02:00
|
|
|
$req->{sessionInfo}->{$k} = $persistentSession->data->{$k};
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2016-04-01 12:10:42 +02:00
|
|
|
|
2016-04-03 08:33:50 +02:00
|
|
|
PE_OK;
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub setLocalGroups {
|
2016-04-03 08:33:50 +02:00
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
foreach ( sort keys %{ $self->_groups } ) {
|
2017-03-28 23:07:49 +02:00
|
|
|
if ( $self->_groups->{$_}->( $req, $req->sessionInfo ) ) {
|
2016-04-03 08:33:50 +02:00
|
|
|
$req->{sessionInfo}->{groups} .=
|
|
|
|
$self->conf->{multiValuesSeparator} . $_;
|
|
|
|
$req->{sessionInfo}->{hGroups}->{$_}->{name} = $_;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
# Clear values separator at the beginning
|
|
|
|
if ( $req->{sessionInfo}->{groups} ) {
|
|
|
|
$req->{sessionInfo}->{groups} =~
|
2016-11-29 06:43:46 +01:00
|
|
|
s/^$self->conf->{multiValuesSeparator}//o;
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
PE_OK;
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub store {
|
2016-04-03 08:33:50 +02:00
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
|
|
|
|
# Now, user is authenticated => inform handler
|
|
|
|
$req->userData( $req->sessionInfo );
|
|
|
|
|
|
|
|
# Create second session for unsecure cookie
|
|
|
|
if ( $self->conf->{securedCookie} == 2 ) {
|
|
|
|
|
|
|
|
my %infos = %{ $req->{sessionInfo} };
|
|
|
|
$infos{_httpSessionType} = 1;
|
|
|
|
|
2017-02-20 22:00:05 +01:00
|
|
|
my $session2 = $self->getApacheSession( undef, info => \%infos );
|
2016-04-03 08:33:50 +02:00
|
|
|
|
|
|
|
$req->{sessionInfo}->{_httpSession} = $session2->id;
|
|
|
|
}
|
|
|
|
|
|
|
|
# Compute unsecure cookie value if needed
|
|
|
|
if ( $self->conf->{securedCookie} == 3 ) {
|
|
|
|
$req->{sessionInfo}->{_httpSession} =
|
2017-02-28 07:34:52 +01:00
|
|
|
$self->conf->{cipher}->encryptHex( $req->{id}, "http" );
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
# Fill session
|
|
|
|
my $infos = {};
|
|
|
|
foreach my $k ( keys %{ $req->{sessionInfo} } ) {
|
|
|
|
next unless defined $req->{sessionInfo}->{$k};
|
|
|
|
my $displayValue = $req->{sessionInfo}->{$k};
|
2016-04-04 22:39:22 +02:00
|
|
|
if ( $self->conf->{hiddenAttributes}
|
|
|
|
and $self->conf->{hiddenAttributes} =~ /\b$k\b/ )
|
|
|
|
{
|
2016-04-03 08:33:50 +02:00
|
|
|
$displayValue = '****';
|
|
|
|
}
|
2017-02-15 07:41:50 +01:00
|
|
|
$self->logger->debug("Store $displayValue in session key $k");
|
2016-04-03 08:33:50 +02:00
|
|
|
$self->_dump($displayValue) if ref($displayValue);
|
2016-04-05 13:12:53 +02:00
|
|
|
$infos->{$k} = $req->{sessionInfo}->{$k};
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
2017-02-20 22:00:05 +01:00
|
|
|
|
|
|
|
# Main session
|
|
|
|
my $session = $self->getApacheSession(
|
|
|
|
$req->{id},
|
|
|
|
force => $req->{force},
|
|
|
|
info => $infos
|
|
|
|
);
|
|
|
|
return PE_APACHESESSIONERROR unless ($session);
|
|
|
|
$req->id( $session->{id} );
|
2016-04-03 08:33:50 +02:00
|
|
|
|
|
|
|
PE_OK;
|
2016-04-01 07:24:27 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
sub buildCookie {
|
2016-04-03 08:33:50 +02:00
|
|
|
my ( $self, $req ) = @_;
|
2017-02-07 23:04:49 +01:00
|
|
|
if ( $req->id ) {
|
2017-01-13 15:35:02 +01:00
|
|
|
$req->addCookie(
|
|
|
|
$self->cookie(
|
2017-02-07 23:04:49 +01:00
|
|
|
name => $self->conf->{cookieName},
|
|
|
|
value => $req->{id},
|
2017-01-13 15:35:02 +01:00
|
|
|
domain => $self->conf->{domain},
|
2017-02-07 23:04:49 +01:00
|
|
|
secure => $self->conf->{securedCookie},
|
2017-01-13 15:35:02 +01:00
|
|
|
)
|
|
|
|
);
|
2017-02-07 23:04:49 +01:00
|
|
|
if ( $self->conf->{securedCookie} >= 2 ) {
|
|
|
|
$req->addCookie(
|
|
|
|
$self->cookie(
|
|
|
|
name => $self->conf->{cookieName} . "http",
|
|
|
|
value => $req->{sessionInfo}->{_httpSession},
|
|
|
|
domain => $self->conf->{domain},
|
|
|
|
secure => 0,
|
|
|
|
)
|
|
|
|
);
|
|
|
|
}
|
2016-04-03 08:33:50 +02:00
|
|
|
}
|
|
|
|
PE_OK;
|
2016-04-01 12:10:42 +02:00
|
|
|
}
|
|
|
|
|
2018-03-08 20:36:32 +01:00
|
|
|
sub secondFactor {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
return $self->_sfEngine->run($req);
|
|
|
|
}
|
|
|
|
|
2018-03-21 20:48:31 +01:00
|
|
|
sub storeHistory {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
if ( $self->conf->{loginHistoryEnabled} ) {
|
|
|
|
$self->registerLogin($req);
|
|
|
|
}
|
|
|
|
PE_OK;
|
|
|
|
}
|
|
|
|
|
2016-04-01 07:24:27 +02:00
|
|
|
1;
|