Commit 46d117e6 authored by Laurent Lecluse's avatar Laurent Lecluse
Browse files

Merge branch 'master' of https://git.unicaen.fr/lib/unicaen/auth into laminas_migration 

 Conflicts:
	src/UnicaenAuth/Authentication/Adapter/Ldap.php
	src/UnicaenAuth/Authentication/Storage/AuthFactory.php
	src/UnicaenAuth/Authentication/Storage/DbFactory.php
	src/UnicaenAuth/Authentication/Storage/LdapFactory.php
	src/UnicaenAuth/Authentication/Storage/ShibFactory.php
	src/UnicaenAuth/Authentication/Storage/UsurpationFactory.php
parents 8644847a 74cd6ed5

CHANGELOG.md

+17 −1
Original line number Diff line number Diff line 
CHANGELOG

=========



3.2.8

-----

- [FIX] Données d'authentification : utilisation du SessionManager global pour avoir les durées de conservation des cookies correctes.



3.2.6 / 3.2.7

-----

- Ajout d'un événement avec le détail des erreurs LDAP



3.2.5

-----

- [FIX] Petite correction d'une NOTICE qui apparaissait lorsqu'on se déconnectait.



3.2.3

-----

- [FIX] Meilleure gestion d'erreur en cas de demande d'usurpation d'un compte inexistant : retour à l'accueil + message.



3.2.2

-----

- L'URL de connexion accepte désormais role=ROLE_ID pour sélectionner automatiquement ce rôle une fois authentifié.

src/UnicaenAuth/Authentication/Adapter/Ldap.php

+34 −11
Original line number Diff line number Diff line
@@ -10,6 +10,7 @@ use UnicaenAuth\Service\User; 
use Laminas\Authentication\Adapter\Ldap as LdapAuthAdapter;

use Laminas\Authentication\Exception\ExceptionInterface;

use Laminas\Authentication\Result as AuthenticationResult;

use Laminas\EventManager\Event;

use Laminas\EventManager\EventInterface;

use Laminas\EventManager\EventManager;

use Laminas\EventManager\EventManagerAwareInterface;
@@ -29,6 +30,8 @@ class Ldap extends AbstractAdapter implements EventManagerAwareInterface 


    const USURPATION_USERNAMES_SEP = '=';



    const LDAP_AUTHENTIFICATION_FAIL = 'authentification.ldap.fail';



    /**

     * @var string

     */
@@ -88,7 +91,8 @@ class Ldap extends AbstractAdapter implements EventManagerAwareInterface 
        // NB: Dans la version 3.0.0 de zf-commons/zfc-user, cette méthode prend un EventInterface.

        // Mais dans la branche 3.x, c'est un AdapterChainEvent !

        // Si un jour c'est un AdapterChainEvent qui est attendu, plus besoin de faire $e->getTarget().

        $event = $e->getTarget(); /* @var $event AdapterChainEvent */

        $event = $e->getTarget();

        /* @var $event AdapterChainEvent */



        if ($this->isSatisfied()) {

            try {
@@ -203,12 +207,29 @@ class Ldap extends AbstractAdapter implements EventManagerAwareInterface 
        // LDAP auth

        $result = $this->getLdapAuthAdapter()->setUsername($username)->setPassword($credential)->authenticate();



        // Envoi des erreurs LDAP dans un événement

        if (!$result->isValid()) {

            $messages = "LDAP ERROR : ";

            $errorMessages = $result->getMessages();

            if (count($errorMessages) > 0) {

                // On ne prend que les 2 premières lignes d'erreur (les suivantes contiennent souvent

                // les mots de passe de l'utilisateur, et les mot de passe dans les logs... bof bof).

                for ($i = 0; $i < 2 && count($errorMessages) >= $i; $i++) {

                    $messages .= $errorMessages[$i] . " ";

                }

            }

            $errorEvent = new Event(self::LDAP_AUTHENTIFICATION_FAIL, null, ['messages' => $messages]);

            $this->getEventManager()->triggerEvent($errorEvent);

        }



        $success = $result->isValid();



        // verif existence du login usurpé

        if ($this->usernameUsurpe) {

            // s'il nexiste pas, échec de l'authentification

            if (!@$this->getLdapAuthAdapter()->getLdap()->searchEntries("(".$this->moduleOptions->getLdapUsername()."=$this->usernameUsurpe)")) {

            if (!@$this->getLdapAuthAdapter()->getLdap()->searchEntries(

                "(" . $this->moduleOptions->getLdapUsername() . "=$this->usernameUsurpe)"

            )) {

                $this->usernameUsurpe = null;

                $success = false;

            }
@@ -293,10 +314,12 @@ class Ldap extends AbstractAdapter implements EventManagerAwareInterface 
     */

    public function setEventManager(EventManagerInterface $eventManager): self

    {

        $eventManager->setIdentifiers([

        $eventManager->setIdentifiers(

            [

                __NAMESPACE__,

                __CLASS__,

        ]);

            ]

        );

        $this->eventManager = $eventManager;



        return $this;

src/UnicaenAuth/Authentication/Storage/AuthFactory.php

+19 −2
Original line number Diff line number Diff line
@@ -4,6 +4,9 @@ namespace UnicaenAuth\Authentication\Storage; 


use Interop\Container\ContainerInterface;

use Laminas\Authentication\Storage\Session;

use Laminas\Authentication\Storage\Session;

use Laminas\Session\Exception\RuntimeException;

use Laminas\Session\SessionManager;



class AuthFactory

{
@@ -14,8 +17,22 @@ class AuthFactory 
     */

    public function __invoke(ContainerInterface $container, string $requestedName): Auth

    {

        /** @var SessionManager $sessionManager */

        $sessionManager = $container->get(SessionManager::class);



        $storage = new Auth();

        $storage->setStorage(new Session(Usurpation::class));



        try {

            $storage->setStorage(new Session(Usurpation::class, null, $sessionManager));

        } catch (RuntimeException $e) {

            /**

             * Tentative de réagir en cas d'erreur suivante :

             * "PHP Fatal error:  Uncaught Zend\Session\Exception\RuntimeException: Session validation failed in

             * /var/www/sygal/vendor/zendframework/zend-session/src/SessionManager.php:160"

             */

            $sessionManager->regenerateId(true);

            $storage->setStorage(new Session(Usurpation::class, null, $sessionManager));

        }



        return $storage;

    }

src/UnicaenAuth/Authentication/Storage/DbFactory.php

+5 −1
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ use Interop\Container\ContainerInterface; 
use UnicaenAuth\Authentication\Adapter\Db as DbAdapter;

use UnicaenAuth\Options\ModuleOptions;

use Laminas\Authentication\Storage\Session;

use Laminas\Session\SessionManager;

use ZfcUser\Mapper\UserInterface as UserMapper;



class DbFactory
@@ -24,8 +25,11 @@ class DbFactory 
        /** @var ModuleOptions $moduleOptions */

        $moduleOptions = $container->get('unicaen-auth_module_options');



        /** @var SessionManager $sessionManager */

        $sessionManager = $container->get(SessionManager::class);



        $storage = new Db();

        $storage->setStorage(new Session(DbAdapter::class));

        $storage->setStorage(new Session(DbAdapter::class, null, $sessionManager));

        $storage->setMapper($mapper);

        $storage->setModuleOptions($moduleOptions);

src/UnicaenAuth/Authentication/Storage/LdapFactory.php

+5 −1
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ use UnicaenApp\Mapper\Ldap\People as LdapPeopleMapper; 
use UnicaenAuth\Authentication\Adapter\Ldap as LdapAdapter;

use UnicaenAuth\Options\ModuleOptions;

use Laminas\Authentication\Storage\Session;

use Laminas\Session\SessionManager;



class LdapFactory

{
@@ -18,8 +19,11 @@ class LdapFactory 
        /** @var ModuleOptions $moduleOptions */

        $moduleOptions = $container->get('unicaen-auth_module_options');



        /** @var SessionManager $sessionManager */

        $sessionManager = $container->get(SessionManager::class);



        $storage = new Ldap();

        $storage->setStorage(new Session(LdapAdapter::class));

        $storage->setStorage(new Session(LdapAdapter::class, null, $sessionManager));

        $storage->setMapper($mapper);

        $storage->setModuleOptions($moduleOptions);