Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
0.00% covered (danger)
0.00%
0 / 35
0.00% covered (danger)
0.00%
0 / 3
 CRAP
0.00% covered (danger)
0.00%
0 / 1
AuthAdapter
0.00% covered (danger)
0.00%
0 / 35
0.00% covered (danger)
0.00%
0 / 3
 132
0.00% covered (danger)
0.00%
0 / 1
 getPasswordHash
0.00% covered (danger)
0.00%
0 / 1
0.00% covered (danger)
0.00%
0 / 1
 2
 setCredentials
0.00% covered (danger)
0.00%
0 / 2
0.00% covered (danger)
0.00%
0 / 1
 2
 authenticate
0.00% covered (danger)
0.00%
0 / 32
0.00% covered (danger)
0.00%
0 / 1
 90
1<?php
2
3/**
4 * This program is free software; you can redistribute it and/or
5 * modify it under the terms of the GNU General Public License
6 * as published by the Free Software Foundation; under version 2
7 * of the License (non-upgradable).
8 *
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12 * GNU General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write to the Free Software
16 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
17 *
18 * Copyright (c) 2017 (original work) Open Assessment Technologies SA (under the project TAO-PRODUCT);
19 *
20 */
21
22namespace oat\generis\model\user;
23
24use core_kernel_users_Service;
25use core_kernel_classes_Class;
26use common_exception_InconsistentData;
27use core_kernel_classes_Property;
28use core_kernel_users_InvalidLoginException;
29use oat\generis\Helper\UserHashForEncryption;
30use oat\generis\model\GenerisRdf;
31use oat\generis\model\OntologyRdfs;
32use oat\oatbox\Configurable;
33use oat\oatbox\service\ServiceManager;
34use oat\oatbox\user\auth\LoginAdapter;
35
36/**
37 * Authentication adapter interface to be implemented by authentication methodes
38 *
39 * @access public
40 * @author Joel Bout, <joel@taotesting.com>
41 * @package generis
42 */
43class AuthAdapter extends Configurable implements LoginAdapter
44{
45    public const OPTION_PATTERN = 'pattern';
46    public const OPTION_USERFACTORY = 'user_factory';
47
48    /**
49     * Returns the hashing algorithm defined in generis configuration
50     * use core_kernel_users_Service::getPasswordHash() instead
51     *
52     * @return \helpers_PasswordHash
53     * @deprecated
54     */
55    public static function getPasswordHash()
56    {
57        return core_kernel_users_Service::getPasswordHash();
58    }
59
60    /**
61     * Username to verify
62     *
63     * @var string
64     */
65    protected $username;
66
67    /**
68     * Password to verify
69     *
70     * @var $password
71     */
72    protected $password;
73
74    /**
75     * (non-PHPdoc)
76     * @see \oat\oatbox\user\auth\LoginAdapter::setCredentials()
77     */
78    public function setCredentials($login, $password)
79    {
80        $this->username = $login;
81        $this->password = $password;
82    }
83
84    /**
85     * (non-PHPdoc)
86     * @see \common_user_auth_Adapter::authenticate()
87     * @throws \Exception
88     */
89    public function authenticate()
90    {
91
92        if ($this->hasOption(self::OPTION_PATTERN)) {
93            if (preg_match($this->getOption(self::OPTION_PATTERN), $this->username) === 0) {
94                throw new core_kernel_users_InvalidLoginException(
95                    "Invalid pattern for user '" . $this->username . "'."
96                );
97            }
98        }
99
100        $userClass = new core_kernel_classes_Class(GenerisRdf::CLASS_GENERIS_USER);
101        $filters = [GenerisRdf::PROPERTY_USER_LOGIN => $this->username];
102        $options = ['like' => false, 'recursive' => true];
103        $users = $userClass->searchInstances($filters, $options);
104
105
106        if (count($users) > 1) {
107            // Multiple users matching
108            throw new common_exception_InconsistentData(
109                "Multiple Users found with the same login '" . $this->username . "'."
110            );
111        }
112        if (empty($users)) {
113            // fake code execution to prevent timing attacks
114            $label = new core_kernel_classes_Property(OntologyRdfs::RDFS_LABEL);
115            $hash = $label->getUniquePropertyValue($label);
116            if (!core_kernel_users_Service::getPasswordHash()->verify($this->password, $hash)) {
117                throw new core_kernel_users_InvalidLoginException('Unknown user "' . $this->username . '"');
118            }
119            // should never happen, added for integrity
120            throw new core_kernel_users_InvalidLoginException(
121                'Inexisting user did not fail password check, this should not happen'
122            );
123        }
124
125        $userResource = current($users);
126        $hash = $userResource->getUniquePropertyValue(
127            new core_kernel_classes_Property(GenerisRdf::PROPERTY_USER_PASSWORD)
128        );
129        if (!core_kernel_users_Service::getPasswordHash()->verify($this->password, $hash)) {
130            throw new core_kernel_users_InvalidLoginException('Invalid password for user "' . $this->username . '"');
131        }
132
133        if ($this->hasOption(self::OPTION_USERFACTORY)) {
134            $userFactory = ServiceManager::getServiceManager()->get($this->getOption(self::OPTION_USERFACTORY)) ;
135
136            if ($userFactory instanceof UserFactoryServiceInterface) {
137                return $userFactory->createUser($userResource, UserHashForEncryption::hash($this->password));
138            }
139        }
140
141        return (new UserFactoryService())->createUser($userResource);
142    }
143}