SWAT/auth/SGlobalAuthModule.php5

<?php

class SGlobalAuthModule extends SObject {

    private $username;
    private $firstName;
    private $lastName;
    private $email;
    private $userId;
    private $ldapUserId;
    private $role;
    private $projects;
    private $groups;
    
    //This is only used for efficiency during ldap syncing
    private $groupObjects;
    
    private $ldap;
    private $user;
    
    public function __construct() {
        parent::__construct();
    }

    public function authenticate($username, $password) {
        $db = authDB::getDBI();
        
        # Report any errors connecting, exit
        if (count($db->getError()) > 0) {
            $this->setPrettyError('authenticate', 'Could not connect to authentication database.');
            return false;
        }
        
        //Get invalid login attempts
        $timePassed = date('Y-m-d H:i:s', intval(time() - (SConfig::getOption('auth.invalidLoginTimeoutMinutes') * 60)));
        $invalid = AuthInvalidLoginAttempt::getList(array(
            'username' => $username,
            '>=' => array(
                'requestTime' => $timePassed
            )
        ), array(), array(), true);
        
        //Reject credentials if there are too many invalid login attempts
        if($invalid >= SConfig::getOption('auth.maxLoginAttempts')) {
            $latest = AuthInvalidLoginAttempt::getList(
                array(
                    'username' => $username,
                    '>=' => array(
                        'requestTime' => $timePassed
                    )
                ),
                //limit
                array(1),
                //order by
                array(
                    'requestTime' => 'ASC'
                )
            );
            $wait = ceil(((SConfig::getOption('auth.invalidLoginTimeoutMinutes') * 60) + strtotime($latest[0]->requestTime) - time()) / 60);
            if($wait == 1) {
                $wait .= ' minute';
            } else {
                $wait .= ' minutes';
            }
            global $SWAT;
            $SWAT->authError('Too many failed login attempts. Please wait ' . $wait . '.');
            return false;
        }

        $users = AuthUser::getList(array('username' => $username), array(1));

        # Report any query errors
        if (count($db->getError()) > 0) {
            $this->setPrettyError('authenticate', $db->getError());
            return false;
        }

        # Reject user's credentials if not found in the DB
        if (count($users) == 0) {
            authDB::invalidLoginAttempt($username);
            return false;
        }
        $this->user = $users[0];
        
        if($this->user->ldapUserId != null) {
            $this->ldap = new SLdap;
            //Reject credentials if ldap login fails
            if(!$this->ldap->authenticate($username, $password)) {
                authDB::invalidLoginAttempt($username);
                return false;
            }
            
            //Retrieve ldap user information
            $this->username = $this->ldap->getUserName();
            $this->firstName = $this->ldap->getFirstName();
            $this->lastName = $this->ldap->getLastName();
            $this->email = $this->ldap->getEmail();
            $this->ldapUserId = $this->ldap->getUID();
        } else {
            //Get hash type and hash password
            $hash = new AuthHashType(array('id' => $this->user->hashTypeId));
            $hashedPassword = SHash::password($password, $this->user->salt, $hash->name);
            
            //Reject credentials if password is wrong
            if($this->user->password !== $hashedPassword) {
                authDB::invalidLoginAttempt($username);
                return false;
            }
            
            //Switch to a more secure hash if user is using old hashing system
            if($hash->name == 'md5') {
                authDB::setPassword($this->user, $password);
                $this->user->commit();
            }
            
            //Retrieve user information
            $this->username = $this->user->username;
            $this->firstName = $this->user->firstName;
            $this->lastName = $this->user->lastName;
            $this->email = $this->user->email;
        }

        $this->userId = $this->user->id;
        $this->role = 'other';

        //Get user projects
        $associations = AuthUserToProject::getList(array('userId' => $this->user->id));
        $projects = array();
        foreach($associations as $association) {
            $project = new AuthProject(array('id' => $association->projectId));
            $projects[] = $project->name;
        }
        $this->projects = $projects;
        
        //Get user groups
        $associations = AuthUserToGenGroup::getList(array('userId' => $this->user->id));
        $groups = array();
        $groupObjects = array();
        foreach($associations as $association) {
            $group = new AuthGenGroup(array('id' => $association->genGroupId));
            $groups[] = $group->name;
            $groupObjects[$group->name] = $group;
        }
        $this->groups = $groups;
        $this->groupObjects = $groupObjects;

        $this->syncUserWithLdap();
        $this->groupObjects = null;
        return true;
    }
    
    public function requireProjects($projects, $redirect = null) {
        if(!is_array($projects)) {
            $this->setPrettyError('SGLobalAuthModule::requireProjects', 'Projects should be an array, ' . gettype($projects) . ' given.');
            return;
        }
        if($redirect === null) {
            global $PATH;
            if(isset($PATH['access_denied'])) {
                $redirect = $PATH['access_denied'];
            } elseif(isset($PATH['main'])) {
                $redirect = $PATH['main'];
            } else {
                $redirect = '/';
            }
        }
        //Loop through projects and redirect if the user is not in one
        foreach($projects as $project) {
            if(!in_array($project, $this->projects)) {
                SWAT_Functions::redirect($redirect);
            }
        }
    }
    
    public function syncUserWithLdap() {
        //Find shodor internal project
        $internal = array_search(AuthProject::SHODOR_INTERNAL, $this->projects);
        
        //non-ldap users only
        if($this->ldapUserId === null || !($this->ldap instanceof SLdap)) {     
            //Non-ldap users shouldn't have this, remove it
            if($internal !== false) {
                authDB::removeProjectUser($this->user, AuthProject::SHODOR_INTERNAL);
                unset($this->projects[$internal]);
                $this->user->commit();
            }
            return;
        }
        
        if($internal === false) {
            authDB::addProjectUser($this->user, AuthProject::SHODOR_INTERNAL);
            $this->projects[] = AuthProject::SHODOR_INTERNAL;
            $this->user->commit();
        }
        
        $commit = false;
        if($this->user->firstName !== $this->firstName)  {
            $this->user->firstName = $this->firstName;
            $commit = true;
        }
        if($this->user->lastName !== $this->lastName)  {
            $this->user->lastName = $this->lastName;
            $commit = true;
        }
        if($this->user->email !== $this->email)  {
            $this->user->email = $this->email;
            $commit = true;
        }
        if($commit) {
            $this->user->commit();
        }
        
        $ldapGroups = $this->ldap->listGroups($this->ldapUserId);
        foreach($this->groups as $index => $groupName) {
            if(!in_array($groupName, $ldapGroups) && $this->groupObjects[$groupName]->ldapGroupId !== null) {
                authDB::removeGroupUser($this->user, $groupName);
                unset($this->groups[$index]);
            }
        }
        foreach($ldapGroups as $ldapGroupId => $ldapGroupName) {
            if(!authDB::groupExists($ldapGroupName)) {
                authDB::addGroup($ldapGroupName, $ldapGroupId);
            } else {
                $group = new AuthGenGroup(array('name' => $ldapGroupName));
                if($group->ldapGroupId !== $ldapGroupId) {
                    $group->ldapGroupId = $ldapGroupId;
                    $group->commit();
                }
            }
            if(!in_array($ldapGroupName, $this->groups)) {
                authDB::addGroupUser($this->user, $ldapGroupName);
                $this->groups[] = $ldapGroupName;
            }
        }
    }


    public function getProjects() {
        return $this->projects;
    }
    
    public function getGroups() {
        return $this->groups;
    }
    
    public function inProject($project) {
        return in_array($project, $this->projects);
    }
    
    public function getRole() {
        return $this->role;
    }

    public function getPermissions() {
        return false;
    }

    public function getUID() {
        return $this->userId;
    }
    
    public function getLdapUID() {
        return $this->ldapUserId;
    }

    public function getFirstName() {
        return $this->firstName;
    }

    public function getLastName() {
        return $this->lastName;
    }

    public function getEmail() {
        return $this->email;
    }

    public function getLdap() {
        return $this->ldap;
    }
    
    public function getUser() {
        return $this->user;
    }

    protected function setUID($uid) {
        $this->userId = $uid;
    }
    
    protected function setLdapUID($uid) {
        $this->ldapUserId = $uid;
    }

    protected function setUserName($username) {
        $this->username = $username;
    }

    protected function setEmail($email) {
        $this->email = $email;
    }

    public function __sleep() {
        return array_keys(get_object_vars($this));
    }

    public function __wakeup() {
        $this->user = AuthUser::retrieve(array('id' => $this->userId));
        return array_keys(get_object_vars($this));
    }

}

?>

---