2017-03-07 23:20:51 +01:00
|
|
|
# Plugin to enable "stay connected on this device" feature
|
|
|
|
|
|
|
|
package Lemonldap::NG::Portal::Plugins::StayConnected;
|
|
|
|
|
|
|
|
use 5.16.0;
|
|
|
|
use strict;
|
|
|
|
use Mouse;
|
|
|
|
use Lemonldap::NG::Portal::Main::Constants qw(
|
|
|
|
PE_OK
|
|
|
|
PE_SENDRESPONSE
|
|
|
|
);
|
|
|
|
|
|
|
|
our $VERSION = '2.0.0';
|
|
|
|
|
|
|
|
extends 'Lemonldap::NG::Portal::Main::Plugin';
|
|
|
|
|
|
|
|
# INTERFACE
|
|
|
|
|
|
|
|
use constant afterDatas => 'newDevice';
|
|
|
|
|
|
|
|
use constant beforeAuth => 'check';
|
|
|
|
|
|
|
|
# INITIALIZATION
|
|
|
|
|
|
|
|
has ott => (
|
|
|
|
is => 'rw',
|
|
|
|
default => sub {
|
|
|
|
my $ott =
|
|
|
|
$_[0]->{p}->loadModule('Lemonldap::NG::Portal::Lib::OneTimeToken');
|
|
|
|
$ott->timeout( $_[0]->conf->{formTimeout} );
|
|
|
|
return $ott;
|
|
|
|
}
|
|
|
|
);
|
|
|
|
|
2017-03-08 20:37:31 +01:00
|
|
|
# Default timeout: 1 month
|
|
|
|
has timeout => (
|
|
|
|
is => 'rw',
|
|
|
|
default => sub {
|
|
|
|
$_[0]->{conf}->{stayConnectedTimeout} || 2678400;
|
|
|
|
}
|
|
|
|
);
|
|
|
|
|
2017-03-07 23:20:51 +01:00
|
|
|
sub init {
|
|
|
|
my ($self) = @_;
|
|
|
|
$self->addAuthRoute( registerbrowser => 'storeBrowser', ['POST'] );
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
# RUNNING METHODS
|
|
|
|
|
2017-03-08 20:37:31 +01:00
|
|
|
# Registration: detect if user wants to stay connected. Then ask for
|
|
|
|
# fingerprint
|
2017-03-07 23:20:51 +01:00
|
|
|
sub newDevice {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
|
|
|
|
if ( $req->param('stayconnected') ) {
|
|
|
|
my $token = $self->ott->createToken(
|
|
|
|
{
|
|
|
|
name => $req->sessionInfo->{ $self->conf->{whatToTrace} }
|
|
|
|
}
|
|
|
|
);
|
|
|
|
$req->response(
|
|
|
|
$self->p->sendHtml(
|
|
|
|
$req,
|
|
|
|
'../common/registerBrowser',
|
|
|
|
params => {
|
2017-03-08 20:37:31 +01:00
|
|
|
URL => $req->urldc,
|
|
|
|
TOKEN => $token,
|
|
|
|
ACTION => '/registerbrowser',
|
2017-03-07 23:20:51 +01:00
|
|
|
}
|
|
|
|
)
|
|
|
|
);
|
|
|
|
return PE_SENDRESPONSE;
|
|
|
|
}
|
|
|
|
return PE_OK;
|
|
|
|
}
|
|
|
|
|
2017-03-08 20:37:31 +01:00
|
|
|
# Store datas in a long-time session
|
2017-03-07 23:20:51 +01:00
|
|
|
sub storeBrowser {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
$req->urldc( $req->param('url') );
|
|
|
|
$req->mustRedirect(1);
|
|
|
|
if ( my $token = $req->param('token') ) {
|
|
|
|
if ( my $tmp = $self->ott->getToken($token) ) {
|
|
|
|
my $uid = $req->userData->{ $self->conf->{whatToTrace} };
|
|
|
|
if ( $tmp->{name} eq $uid ) {
|
|
|
|
if ( my $fg = $req->param('fg') ) {
|
|
|
|
my $ps = Lemonldap::NG::Common::Session->new(
|
2017-03-08 20:37:31 +01:00
|
|
|
storageModule => $self->conf->{globalStorage},
|
2017-03-07 23:20:51 +01:00
|
|
|
storageModuleOptions =>
|
2017-03-08 20:37:31 +01:00
|
|
|
$self->conf->{globalStorageOptions},
|
|
|
|
kind => "SSO",
|
2017-03-07 23:20:51 +01:00
|
|
|
info => {
|
2017-03-08 20:37:31 +01:00
|
|
|
_utime => time + $self->timeout,
|
2017-03-07 23:20:51 +01:00
|
|
|
_session_uid => $uid,
|
|
|
|
_connectedSince => time,
|
|
|
|
dataKeep => $req->datas->{dataToKeep},
|
2017-03-08 20:37:31 +01:00
|
|
|
fingerprint => $fg,
|
2017-03-07 23:20:51 +01:00
|
|
|
},
|
|
|
|
);
|
|
|
|
$req->addCookie(
|
|
|
|
$self->p->cookie(
|
|
|
|
name => 'llngconnexion',
|
|
|
|
value => $ps->id,
|
|
|
|
expires => '+1M',
|
|
|
|
)
|
|
|
|
);
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->logger->warn("Browser hasn't return fingerprint");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->userLogger->error(
|
|
|
|
"StayConnected: mismatch UID: $tmp->{name} / $uid");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->userLogger->error("StayConnected call with expired token");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->userLogger->error('StayConnected call without token');
|
|
|
|
}
|
|
|
|
|
|
|
|
# Deliver cookie llngbrowser
|
|
|
|
return $self->p->do( $req, [ sub { PE_OK } ] );
|
|
|
|
}
|
|
|
|
|
2017-03-08 20:37:31 +01:00
|
|
|
# Check for:
|
|
|
|
# - persistent connection cookie
|
|
|
|
# - valid session
|
|
|
|
# - uniq id is kept
|
|
|
|
# Then delete authentication methods from "steps" array.
|
2017-03-07 23:20:51 +01:00
|
|
|
sub check {
|
|
|
|
my ( $self, $req ) = @_;
|
|
|
|
if ( my $cid = $req->cookies->{llngconnexion} ) {
|
|
|
|
my $ps = Lemonldap::NG::Common::Session->new(
|
2017-03-08 20:37:31 +01:00
|
|
|
storageModule => $self->conf->{globalStorage},
|
|
|
|
storageModuleOptions => $self->conf->{globalStorageOptions},
|
|
|
|
kind => "SSO",
|
2017-03-07 23:20:51 +01:00
|
|
|
id => $cid,
|
|
|
|
);
|
2017-03-08 20:37:31 +01:00
|
|
|
if ( $ps and my $uid = $ps->data->{_session_uid} ) {
|
|
|
|
$self->logger->debug('Persistent connection found');
|
|
|
|
if ( my $fg = $req->param('fg')
|
|
|
|
and my $token = $req->param('token') )
|
|
|
|
{
|
|
|
|
if ( my $prm = $self->ott->getToken($token) ) {
|
2017-03-08 21:56:48 +01:00
|
|
|
$req->datas->{dataKeep} = $ps->data->{dataKeep};
|
2017-03-08 20:37:31 +01:00
|
|
|
$self->logger->debug('Persistent connection found');
|
2017-03-08 21:56:48 +01:00
|
|
|
if ( $fg eq $ps->data->{fingerprint} ) {
|
|
|
|
$req->user($uid);
|
|
|
|
my @steps =
|
|
|
|
grep {
|
|
|
|
!ref $_
|
|
|
|
and $_ !~ /^(?:extractFormInfo|authenticate)$/
|
|
|
|
} @{ $req->steps };
|
|
|
|
$req->steps( \@steps );
|
|
|
|
$self->userLogger->notice(
|
|
|
|
"$uid connected by StayConnected cookie");
|
|
|
|
return PE_OK;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->userLogger->warn("Fingerprint changed for $uid");
|
2017-03-08 20:37:31 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->userLogger->notice(
|
|
|
|
"StayConnected: expired token for $uid");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
my $token = $self->ott->createToken( $req->parameters );
|
|
|
|
$req->response(
|
|
|
|
$self->p->sendHtml(
|
|
|
|
$req,
|
|
|
|
'../common/registerBrowser',
|
|
|
|
params => {
|
|
|
|
TOKEN => $token,
|
|
|
|
ACTION => '#',
|
|
|
|
}
|
|
|
|
)
|
|
|
|
);
|
|
|
|
return PE_SENDRESPONSE;
|
2017-03-07 23:20:51 +01:00
|
|
|
}
|
2017-03-08 20:37:31 +01:00
|
|
|
}
|
|
|
|
else {
|
|
|
|
$self->userLogger->notice('Persistent connection expired');
|
2017-03-07 23:20:51 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
return PE_OK;
|
|
|
|
}
|
|
|
|
|
|
|
|
1;
|