diff --git a/application/controllers/AuthenticationController.php b/application/controllers/AuthenticationController.php index 292ad81..88f73f0 100644 --- a/application/controllers/AuthenticationController.php +++ b/application/controllers/AuthenticationController.php @@ -11,15 +11,18 @@ use Icinga\Authentication\Auth; use Icinga\Exception\Http\HttpException; use Icinga\Module\Oidc\Common\Database; -use Icinga\Module\Oidc\LoginFormModifierHelper; use Icinga\Module\Oidc\Model\Group; use Icinga\Module\Oidc\Model\GroupMembership; use Icinga\Module\Oidc\Model\Provider; +use Icinga\Module\Oidc\ProvidedHook\LoginButtonHook; use Icinga\User; use Icinga\Module\Oidc\Model\User as OidcUser; use Icinga\Util\StringHelper; -use ipl\Html\Html; +use Icinga\Web\Notification; +use Icinga\Web\Session; +use Icinga\Web\Url as IcingaUrl; use ipl\Stdlib\Filter; +use ipl\Web\Url; use Jumbojett\OpenIDConnectClient; /** @@ -27,24 +30,6 @@ */ class AuthenticationController extends \Icinga\Controllers\AuthenticationController { - /** - * Log into the application - */ - public function loginAction() - { - $this->view->addHelperPath( - Icinga::app()->getBaseDir() - . DIRECTORY_SEPARATOR . "application/views/helpers/" - ); - $this->view->addScriptPath( - Icinga::app()->getBaseDir() - . DIRECTORY_SEPARATOR . "application/views/scripts/" - ); - parent::loginAction(); - LoginFormModifierHelper::init(); - $this->view->form = $this->view->form . "\n" . LoginFormModifierHelper::renderAfterForm(); - } - public function realmAction() { $name = $this->params->getRequired("name"); @@ -78,7 +63,10 @@ public function realmAction() if ($relogin) { setcookie( "oidc-internalurl", - $oidcUrl, + (string) Url::fromPath( + 'oidc/authentication/realm', + ['name' => $name] + )->getRelativeUrl(), time() + 60 * 60 * 24 * 3, str_replace("//", "/", Icinga::app()->getRequest()->getBasePath() . "/") ); // needs to be a cookie to work after logout @@ -102,7 +90,18 @@ public function realmAction() if ($oidc->authenticate()) { if (!empty($_COOKIE['oidc-redirect'])) { - $redirect = $_COOKIE['oidc-redirect']; + $redirectUrl = IcingaUrl::fromPath( + (string) $_COOKIE['oidc-redirect'], + [], + $this->getRequest() + ); + if ( + ! $redirectUrl->isExternal() + && ! str_contains((string) $redirectUrl->getPath(), 'authentication/logout') + ) { + $redirect = $redirectUrl; + } + setcookie( "oidc-redirect", "", @@ -144,11 +143,17 @@ public function realmAction() } } if (session_status() == PHP_SESSION_ACTIVE) { - // Icinga wants to handle the session so we destroy ours + // Destroy Jumbojett's native session before Icinga persists the authenticated user. session_destroy(); } } } catch (\Throwable $e) { + if (session_status() === PHP_SESSION_ACTIVE) { + // Jumbojett may leave its native PHP session active after an exception. + // Destroy it before Icinga handles the failure redirect. + session_destroy(); + } + Logger::error($e->getMessage()); Logger::error($e->getTraceAsString()); } @@ -321,21 +326,29 @@ public function filter_by_patterns($array, $patterns) }); } - public function failedAction() + public function failedAction(): void { - $this->loginAction(); - $div = Html::tag('div', ['class' => 'icinga-module module-oidc']); - $html = Html::tag('p', ['class' => 'oidc-error'], "OIDC: Something went wrong!"); - $div->add($html); - $this->view->form = $this->view->form . $div; - $this->_helper->viewRenderer->setRender('authentication/login', null, true); + setcookie( + 'oidc-internalurl', + '', + time() - 3600, + str_replace('//', '/', Icinga::app()->getRequest()->getBasePath() . '/') + ); + Notification::error(LoginButtonHook::ERROR_MESSAGE); + // Let Notification create and merge its internal message objects instead of + // duplicating their session format. Persist the queue before redirectNow() + // sends headers because Notification's destructor would write too late. The + // login hook consumes the queue because LoginPage does not render it. + $notifications = Notification::getInstance(); + $session = Session::getSession(); + $session->set(Notification::SESSION_KEY, $notifications->popMessages()); + $session->write(); + $this->redirectNow('authentication/login?oidc-error=1'); } - public function oidcLogoutAction() + public function oidcLogoutAction(): void { - // This workarround will not trigger the relogin - $this->_helper->viewRenderer->setRender('authentication/login', null, true); - $this->loginAction(); + $this->redirectNow('authentication/login?oidc-logout=1'); } } diff --git a/application/views/scripts/authentication/login.phtml b/application/views/scripts/authentication/login.phtml deleted file mode 100644 index 14245dc..0000000 --- a/application/views/scripts/authentication/login.phtml +++ /dev/null @@ -1,75 +0,0 @@ -
-
-
- translate( - 'Welcome to Icinga Web 2. For users of the screen reader Jaws full and expectant compliant' - . ' accessibility is possible only with use of the Firefox browser. VoiceOver on Mac OS X is tested on' - . ' Chrome, Safari and Firefox.' - ) ?> -
-
- -

translate( - 'It appears that you did not configure Icinga Web 2 yet so it\'s not possible to log in without any defined ' - . 'authentication method. Please define a authentication method by following the instructions in the' - . ' %1$sdocumentation%3$s or by using our %2$sweb-based setup-wizard%3$s.' - ), - '', - '', - '' - ) ?>

- - form ?> - - -
- -
-
img('img/orb-analytics.png'); ?>
-
img('img/orb-automation.png'); ?>
-
img('img/orb-cloud.png'); ?>
-
img('img/orb-icinga.png'); ?>
-
img('img/orb-infrastructure.png'); ?>
-
img('img/orb-metrics.png'); ?>
-
img('img/orb-notifications.png'); ?>
diff --git a/configuration.php b/configuration.php index 299401b..1e84192 100644 --- a/configuration.php +++ b/configuration.php @@ -69,9 +69,7 @@ ]); -?> -provideConfigTab('backend', array( 'title' => $this->translate('Configure the database backend'), @@ -85,8 +83,6 @@ 'url' => 'config/import-backend' )); -?> -add(N_('Provider')) ->setUrl('oidc/providers') ->setPermission('oidc/provider') @@ -112,9 +108,7 @@ ->setUrl('oidc/groups') ->setPermission('oidc/group') ->setPriority(30); -?> -add(N_('Files')) ->setUrl('oidc/file') @@ -127,9 +121,3 @@ ->setPermission('oidc/import') ->setPriority(40); } - - -$this->provideUserBackend('oidc',\Icinga\Module\Oidc\Backend\OidcUserBackend::class); -$this->provideUserGroupBackend('oidc',\Icinga\Module\Oidc\Backend\OidcUserGroupBackend::class); - -?> diff --git a/doc/02-Installation.md b/doc/02-Installation.md index cf8d1b2..aca0090 100644 --- a/doc/02-Installation.md +++ b/doc/02-Installation.md @@ -2,8 +2,9 @@ ## Requirements -* Icinga Web 2 (>= 2.12.1) -* PHP (>= 7.3) +* Icinga Web 2 (≥2.13.0) +* PHP (≥8.2) +* Icinga PHP Library (ipl) (≥0.19.0) ## Installation from .tar.gz diff --git a/doc/03-Configuration.md b/doc/03-Configuration.md index 32ff9b0..d13730b 100644 --- a/doc/03-Configuration.md +++ b/doc/03-Configuration.md @@ -87,10 +87,16 @@ This allows you to fetch the account using ldap with the IcingaWeb2 LDAP functio Under the Backend config you will also find all the settings that are experimental and can be turned on. ### Relogin -For this feature we store a cookie for the last used oidc login url so we can redirect to the oidc login page. +When enabled, the module stores the module-local route for the last OIDC +provider in the `oidc-internalurl` cookie. Opening the login page then starts +OIDC authentication automatically. Invalid values and references to missing or +disabled providers are discarded, and the login page opens normally. -Since this breaks the logic of the AuthenticationHook and redirect to a different logoutpage, make sure to use it only if no other AuthenticationHook implements an onLogout function +Explicit logout clears this cookie and opens the login page with an +`oidc-logout=1` parameter, which bypasses automatic reauthentication. +This feature changes the `AuthenticationHook` logout flow. Enable it only when +no other authentication hook implements `onLogout()`. diff --git a/library/Oidc/Common/Database.php b/library/Oidc/Common/Database.php index 5b686c4..3571e99 100644 --- a/library/Oidc/Common/Database.php +++ b/library/Oidc/Common/Database.php @@ -8,6 +8,7 @@ use Icinga\Application\Config; use Icinga\Data\ResourceFactory; use ipl\Sql; +use Pdo\Mysql; use PDO; final class Database @@ -46,7 +47,7 @@ private static function getDb(): Sql\Connection $options = [PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_OBJ]; if ($config->db === 'mysql') { - $options[PDO::MYSQL_ATTR_INIT_COMMAND] = "SET SESSION SQL_MODE='STRICT_TRANS_TABLES,NO_ZERO_IN_DATE" + $options[Mysql::ATTR_INIT_COMMAND] = "SET SESSION SQL_MODE='STRICT_TRANS_TABLES,NO_ZERO_IN_DATE" . ",NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION'"; } diff --git a/library/Oidc/LoginFormModifierHelper.php b/library/Oidc/LoginFormModifierHelper.php deleted file mode 100644 index 5a2a7f6..0000000 --- a/library/Oidc/LoginFormModifierHelper.php +++ /dev/null @@ -1,123 +0,0 @@ -getRequest()->getBasePath()."/")); - }else{ - setcookie("oidc-redirect", "", time() -3600, str_replace("//","/",Icinga::app()->getRequest()->getBasePath()."/")); - - } - $relogin = Config::module('oidc')->get("experimental","relogin", "0") === "1"; - - if ($relogin) { - if(strpos(Icinga::app()->getRequest()->getUrl(),"oidc-logout") === false){ - - if( !empty($_COOKIE['oidc-internalurl'] ) ){ - $redirect = $_COOKIE['oidc-internalurl']; - Icinga::app()->getRequest()->getResponse()->redirectAndExit($redirect); - } - } - } - - - - - - } - - public static function renderAfterForm() - { - $allProviders = Html::tag("div", ["class" => "icinga-module module-oidc"]); - - try { - $providers = Provider::on(Database::get())->filter(Filter::equal('enabled', 'y')); - if($providers->count() === 0){ - return ''; - } - }catch (\Throwable $e){ - Logger::error($e->getMessage()."\n".$e->getTraceAsString()); - $html = Html::tag('p', ['class' => 'oidc-error'], "OIDC: Something went wrong!"); - $allProviders->add($html); - return $allProviders->render(); - } - - $fileHelper = new FileHelper(Module::get('oidc')->getConfigDir() . DIRECTORY_SEPARATOR . "files"); - try { - foreach ($providers as $provider) { - $div = Html::tag("div", ['class' => 'oidc-button']); - $buttonColorStyle = (new StyleWithNonce()); - $buttonColorStyle->addFor( - $div, - ['background-color' => $provider->buttoncolor, 'color' => $provider->textcolor] - ); - - $file = $fileHelper->getFile($provider->logo); - if ($file != false) { - $extension = pathinfo($file['name'], PATHINFO_EXTENSION); - if ($extension === "svg") { - $extension .= "+xml"; - } - $left = Html::tag("div", ['class' => 'left-placeholder']); - $right = Html::tag("div", ['class' => 'right-placeholder']); - $imgContent = 'data:image/' . $extension . ';base64, ' . base64_encode( - file_get_contents($file['realPath']) - ); - $img = Html::tag("img", ['class' => 'logo-size', 'src' => $imgContent]); - $left->add($img); - $a = Html::tag( - "a", - [ - 'class' => 'button-content-align', - 'href' => Url::fromPath("oidc/authentication/realm", ['name' => $provider->name]), - 'target' => '_self' - ], - $provider->caption - ); - - $right->add($a); - $div->add($left); - $div->add($right); - } else { - $a = Html::tag( - "a", - [ - 'class' => 'button-content-align', - 'href' => Url::fromPath("oidc/authentication/realm", ['name' => $provider->name]), - 'target' => '_self' - ], - $provider->caption - ); - $div->add($a); - } - - $allProviders->add([$div, $buttonColorStyle]); - } - }catch (\Throwable $e){ - $html = Html::tag('p', ['class' => 'oidc-error'], "OIDC: Something went wrong!"); - Logger::error($e->getMessage()."\n".$e->getTraceAsString()); - $allProviders->add($html); - return $allProviders->render(); - } - return $allProviders->render(); - - } - -} diff --git a/library/Oidc/ProvidedHook/Authentication.php b/library/Oidc/ProvidedHook/Authentication.php index bced806..31876b9 100644 --- a/library/Oidc/ProvidedHook/Authentication.php +++ b/library/Oidc/ProvidedHook/Authentication.php @@ -24,7 +24,12 @@ public function onLogout(User $user): void if ($relogin) { $oidcProviderID = $user->getAdditional('provider_id'); - setcookie("oidc-internalurl", null, time() - 3600, str_replace("//","/",Icinga::app()->getRequest()->getBasePath()."/")); + setcookie( + "oidc-internalurl", + '', + time() - 3600, + str_replace("//", "/", Icinga::app()->getRequest()->getBasePath() . "/") + ); if($oidcProviderID !== null){ Auth::getInstance()->removeAuthorization(); diff --git a/library/Oidc/ProvidedHook/LoginButtonHook.php b/library/Oidc/ProvidedHook/LoginButtonHook.php new file mode 100644 index 0000000..db4e4ac --- /dev/null +++ b/library/Oidc/ProvidedHook/LoginButtonHook.php @@ -0,0 +1,309 @@ +getRequest(); + $buttons = $request->getParam('oidc-error') === '1' + ? $this->getErrorNotificationButtons() + : []; + + try { + // Core invokes login button hooks while assembling authentication/login. + if ( + Config::module('oidc')->get('experimental', 'relogin', '0') === '1' + && $request->getParam('oidc-logout') !== '1' + && array_key_exists('oidc-internalurl', $_COOKIE) + ) { + $providerName = self::parseReloginProviderName( + $_COOKIE['oidc-internalurl'], + $request->getBasePath() + ); + if ($providerName === null) { + $this->expireReloginCookie(); + } else { + $provider = Provider::on(Database::get()) + ->filter(Filter::equal('name', $providerName)) + ->filter(Filter::equal('enabled', 'y')) + ->first(); + if ($provider === null) { + $this->expireReloginCookie(); + } else { + $request->getResponse()->redirectAndExit( + Url::fromPath('oidc/authentication/realm', ['name' => $providerName]) + ); + } + } + } + + $providers = Provider::on(Database::get())->filter(Filter::equal('enabled', 'y')); + + foreach ($providers as $provider) { + $buttons[(string) $provider->id] = new LoginButton( + function () use ($provider): void { + $request = Icinga::app()->getRequest(); + $basePath = str_replace('//', '/', $request->getBasePath() . '/'); + $redirect = $request->getParam('redirect'); + $redirectUrl = $redirect === null || $redirect === '' + ? null + : Url::fromPath((string) $redirect, [], $request); + if ( + $redirectUrl !== null + && ! $redirectUrl->isExternal() + && ! str_contains((string) $redirectUrl->getPath(), 'authentication/logout') + ) { + setcookie('oidc-redirect', (string) $redirect, time() + 300, $basePath); + } else { + setcookie('oidc-redirect', '', time() - 3600, $basePath); + } + + $response = Icinga::app()->getResponse(); + $response->setHeader('X-Icinga-Redirect-Http', 'yes'); + $response->redirectAndExit( + Url::fromPath('oidc/authentication/realm', ['name' => $provider->name]) + ); + }, + $this->buildButtonContent($provider), + Attributes::create(['class' => 'oidc-btn-' . $provider->id]) + ); + } + } catch (Throwable $e) { + Logger::error('OIDC: Failed to load providers for login buttons: %s', $e); + Notification::error(self::ERROR_MESSAGE); + + return $this->getErrorNotificationButtons(); + } + + return $buttons; + } + + /** + * Extract the provider name from a current or legacy relogin cookie + * + * @param mixed $value Cookie value to parse + * @param string $basePath Current Icinga Web base path + * + * @return ?string + */ + protected static function parseReloginProviderName(mixed $value, string $basePath): ?string + { + if (! is_string($value) || $value === '') { + return null; + } + + // parse_url() accepts malformed percent escapes, so require every percent + // sign to start a complete two-digit hexadecimal escape. + if (preg_match('/%(?![0-9A-Fa-f]{2})/', $value) === 1) { + return null; + } + + try { + $parts = parse_url($value); + } catch (ValueError) { + return null; + } + + if ($parts === false || array_key_exists('fragment', $parts)) { + return null; + } + + // Legacy absolute cookies may carry any HTTP(S) host, but it is never used. + $scheme = $parts['scheme'] ?? null; + if ( + ($scheme !== null && ! in_array(strtolower($scheme), ['http', 'https'], true)) + || ($scheme === null && isset($parts['host'])) + || ($scheme !== null && ! isset($parts['host'])) + ) { + return null; + } + + // Compare the route without its optional base path or leading slash. + $path = ltrim($parts['path'] ?? '', '/'); + $normalizedBasePath = trim($basePath, '/'); + if ( + $normalizedBasePath !== '' + && str_starts_with($path, $normalizedBasePath . '/') + ) { + $path = substr($path, strlen($normalizedBasePath) + 1); + } + + if ($path !== 'oidc/authentication/realm' || ! isset($parts['query'])) { + return null; + } + + // Parse pairs explicitly to reject duplicate and array-valued names. + $providerName = null; + foreach (explode('&', $parts['query']) as $field) { + [$name, $encodedValue] = Str::symmetricSplit($field, '=', 2); + $name = rawurldecode((string) $name); + if ($name !== 'name') { + if (str_starts_with($name, 'name[')) { + return null; + } + + continue; + } + + if ($providerName !== null || $encodedValue === null) { + return null; + } + + $providerName = rawurldecode($encodedValue); + } + + return $providerName === null || $providerName === '' ? null : $providerName; + } + + /** + * Expire the automatic relogin cookie + */ + protected function expireReloginCookie(): void + { + setcookie( + 'oidc-internalurl', + '', + time() - 3600, + str_replace('//', '/', Icinga::app()->getRequest()->getBasePath() . '/') + ); + } + + /** + * Adapt the queued OIDC error for the notification-less core login page + * + * @return LoginButton[] + */ + protected function getErrorNotificationButtons(): array + { + $notifications = Notification::getInstance(); + $buttons = []; + + foreach ($notifications->popMessages() as $notification) { + if ( + $notification->type === Notification::ERROR + && $notification->message === self::ERROR_MESSAGE + ) { + $content = new HtmlDocument(); + $content->addHtml( + (new StyleWithNonce())->add( + '#login button.oidc-notification-error', + [ + 'background-color' => '#ff5566', + 'cursor' => 'default', + ] + ), + Html::tag('span', ['role' => 'alert'], new Text(self::ERROR_MESSAGE)) + ); + $buttons['notification'] = new LoginButton( + static function (): void { + }, + $content, + Attributes::create([ + 'class' => 'oidc-notification-error', + 'disabled' => 'disabled', + ]) + ); + } else { + match ($notification->type) { + Notification::ERROR => Notification::error($notification->message), + Notification::SUCCESS => Notification::success($notification->message), + Notification::WARNING => Notification::warning($notification->message), + default => Notification::info($notification->message), + }; + } + } + + return $buttons; + } + + /** + * Build button content with provider colors and an optional logo + * + * @param Provider $provider OIDC provider to render + * + * @return HtmlDocument + */ + protected function buildButtonContent(Provider $provider): HtmlDocument + { + $doc = new HtmlDocument(); + + // This selector must beat the core #login button rule. + $doc->addHtml( + (new StyleWithNonce())->add( + '#login button.oidc-btn-' . $provider->id, + [ + 'background-color' => $provider->buttoncolor, + 'color' => $provider->textcolor, + ] + ) + ); + + if ($provider->logo !== null && $provider->logo !== '') { + try { + $fileHelper = new FileHelper( + Module::get('oidc')->getConfigDir() . DIRECTORY_SEPARATOR . 'files' + ); + $file = $fileHelper->getFile($provider->logo); + if ($file === false) { + throw new RuntimeException(sprintf('Logo "%s" is not available', $provider->logo)); + } + + $content = file_get_contents($file['realPath']); + if ($content === false) { + throw new RuntimeException(sprintf('Logo "%s" cannot be read', $provider->logo)); + } + + $extension = pathinfo((string) $file['name'], PATHINFO_EXTENSION); + if ($extension === 'svg') { + $extension .= '+xml'; + } + + $doc->addHtml(Html::tag('img', [ + 'class' => 'logo-size', + 'src' => 'data:image/' . $extension . ';base64,' . base64_encode($content), + 'alt' => '' + ])); + } catch (Throwable $e) { + Logger::error('OIDC: Failed to load provider logo: %s', $e); + } + } + + $doc->addHtml(new Text($provider->caption)); + + return $doc; + } +} diff --git a/library/Oidc/ProvidedHook/LoginFormModifier.php b/library/Oidc/ProvidedHook/LoginFormModifier.php deleted file mode 100644 index 05159fc..0000000 --- a/library/Oidc/ProvidedHook/LoginFormModifier.php +++ /dev/null @@ -1,23 +0,0 @@ -=0.13.0), icinga-php-thirdparty (>=0.12.0) + Libraries: icinga-php-library (>=0.19.0), icinga-php-thirdparty (>=0.12.0) Description: oidc This module provides the ability to add an OpenIDConnect provider like authelia or dexidp as icingaweb2 login backend diff --git a/public/css/module.less b/public/css/module.less index 916c43c..889e004 100644 --- a/public/css/module.less +++ b/public/css/module.less @@ -46,34 +46,7 @@ } -.oidc-button { - min-width:100%; - border-radius: 4px; - border: none; - color: white; - padding: 10px 15px; - margin-bottom: 5px; - text-align: center; - text-decoration: none; - display: inline-block; - font-size: 16px; -} -.left-placeholder { - display: inline-block; width:10%; -} -.right-placeholder { - display: inline-block; width:80%; -} .logo-size { width:30px; height:30px; } - -.button-content-align { - vertical-align: super; -} -.oidc-error { - font-size:large; - font-weight:900; - color:red; -} \ No newline at end of file diff --git a/run.php b/run.php index 260a263..001efb2 100644 --- a/run.php +++ b/run.php @@ -2,27 +2,15 @@ /** @var $this \Icinga\Application\Modules\Module */ use Icinga\Application\Icinga; -use Icinga\Application\Modules\Module; +use Icinga\Module\Oidc\ProvidedHook\LoginButtonHook; require_once 'vendor/autoload.php'; -if(!Icinga::app()->isCli()){ - if(Module::exists('loginhooks') && Module::get('loginhooks')->isRegistered()){ - $this->provideHook('loginhooks/LoginFormModifier', \Icinga\Module\Oidc\ProvidedHook\LoginFormModifier::class, true); - }else{ - $this->addRoute('authentication/login', new Zend_Controller_Router_Route_Static( - 'authentication/login', - [ - 'controller' => 'authentication', - 'action' => 'login', - 'module' => 'oidc' - ] - )); - } - +if (! Icinga::app()->isCli()) { + LoginButtonHook::register(); } -$this->provideHook('DbMigration', '\\Icinga\\Module\\Oidc\\ProvidedHook\\DbMigration'); -$this->provideHook('Authentication', '\\Icinga\\Module\\Oidc\\ProvidedHook\\Authentication',true); - -//$this->provideHook('Oidc\\OidcImplementation', '\Icinga\Module\Oidc\ProvidedHook\Oidc\Default', true); +$this->provideHook('DbMigration', '\\Icinga\\Module\\Oidc\\ProvidedHook\\DbMigration'); +$this->provideHook('Authentication', '\\Icinga\\Module\\Oidc\\ProvidedHook\\Authentication', true); +$this->provideUserBackend('oidc', \Icinga\Module\Oidc\Backend\OidcUserBackend::class); +$this->provideUserGroupBackend('oidc', \Icinga\Module\Oidc\Backend\OidcUserGroupBackend::class);