libraries/auth/signon.auth.lib.php

   1 <?php
   2 /* vim: set expandtab sw=4 ts=4 sts=4: */
   3 /**
   4  * Set of functions used to run single signon authentication.
   5  *
   6  * @package phpMyAdmin-Auth-Signon
   7  */
   8
   9
  10 /**
  11  * Displays authentication form
  12  *
  13  * @global  string    the font face to use in case of failure
  14  * @global  string    the default font size to use in case of failure
  15  * @global  string    the big font size to use in case of failure
  16  *
  17  * @return  boolean   always true (no return indeed)
  18  *
  19  * @access  public
  20  */
  21 function PMA_auth() {
  22     unset($_SESSION['LAST_SIGNON_URL']);
  23     if (empty($GLOBALS['cfg']['Server']['SignonURL'])) {
  24         PMA_fatalError('You must set SignonURL!');
  25     } elseif (!empty($_REQUEST['old_usr']) && !empty($GLOBALS['cfg']['Server']['LogoutURL'])) {
  26         /* Perform logout to custom URL */
  27         PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['LogoutURL']);
  28     } else {
  29         PMA_sendHeaderLocation($GLOBALS['cfg']['Server']['SignonURL']);
  30     }
  31     exit();
  32 } // end of the 'PMA_auth()' function
  33
  34
  35 /**
  36  * Gets advanced authentication settings
  37  *
  38  * @global  string    the username if register_globals is on
  39  * @global  string    the password if register_globals is on
  40  * @global  array     the array of server variables if register_globals is
  41  *                    off
  42  * @global  array     the array of environment variables if register_globals
  43  *                    is off
  44  * @global  string    the username for the ? server
  45  * @global  string    the password for the ? server
  46  * @global  string    the username for the WebSite Professional server
  47  * @global  string    the password for the WebSite Professional server
  48  * @global  string    the username of the user who logs out
  49  *
  50  * @return  boolean   whether we get authentication settings or not
  51  *
  52  * @access  public
  53  */
  54 function PMA_auth_check()
  55 {
  56     global $PHP_AUTH_USER, $PHP_AUTH_PW;
  57
  58     /* Check if we're using same sigon server */
  59     if (isset($_SESSION['LAST_SIGNON_URL']) && $_SESSION['LAST_SIGNON_URL'] != $GLOBALS['cfg']['Server']['SignonURL']) {
  60         return false;
  61     }
  62
  63     /* Session name */
  64     $session_name = $GLOBALS['cfg']['Server']['SignonSession'];
  65
  66     /* Login URL */
  67     $signon_url = $GLOBALS['cfg']['Server']['SignonURL'];
  68
  69     /* Current host */
  70     $single_signon_host = $GLOBALS['cfg']['Server']['host'];
  71
  72     /* Current port */
  73     $single_signon_port = $GLOBALS['cfg']['Server']['port'];
  74
  75     /* No configuration updates */
  76     $single_signon_cfgupdate = array();
  77
  78     /* Are we requested to do logout? */
  79     $do_logout = !empty($_REQUEST['old_usr']);
  80
  81     /* Does session exist? */
  82     if (isset($_COOKIE[$session_name])) {
  83         /* End current session */
  84         $old_session = session_name();
  85         $old_id = session_id();
  86         session_write_close();
  87
  88         /* Load single signon session */
  89         session_name($session_name);
  90         session_id($_COOKIE[$session_name]);
  91         session_start();
  92
  93         /* Clear error message */
  94         unset($_SESSION['PMA_single_signon_error_message']);
  95
  96         /* Grab credentials if they exist */
  97         if (isset($_SESSION['PMA_single_signon_user'])) {
  98             if ($do_logout) {
  99                 $PHP_AUTH_USER = '';
 100             } else {
 101                 $PHP_AUTH_USER = $_SESSION['PMA_single_signon_user'];
 102             }
 103         }
 104         if (isset($_SESSION['PMA_single_signon_password'])) {
 105             if ($do_logout) {
 106                 $PHP_AUTH_PW = '';
 107             } else {
 108                 $PHP_AUTH_PW = $_SESSION['PMA_single_signon_password'];
 109             }
 110         }
 111         if (isset($_SESSION['PMA_single_signon_host'])) {
 112                 $single_signon_host = $_SESSION['PMA_single_signon_host'];
 113         }
 114
 115         if (isset($_SESSION['PMA_single_signon_port'])) {
 116             $single_signon_port = $_SESSION['PMA_single_signon_port'];
 117         }
 118
 119         if (isset($_SESSION['PMA_single_signon_cfgupdate'])) {
 120             $single_signon_cfgupdate = $_SESSION['PMA_single_signon_cfgupdate'];
 121         }
 122
 123
 124         /* Also get token as it is needed to access subpages */
 125         if (isset($_SESSION['PMA_single_signon_token'])) {
 126             /* No need to care about token on logout */
 127             $pma_token = $_SESSION['PMA_single_signon_token'];
 128         }
 129
 130         /* End single signon session */
 131         session_write_close();
 132
 133         /* Restart phpMyAdmin session */
 134         session_name($old_session);
 135         if (!empty($old_id)) {
 136             session_id($old_id);
 137         }
 138         session_start();
 139
 140         /* Set the single signon host */
 141         $GLOBALS['cfg']['Server']['host'] = $single_signon_host;
 142
 143         /* Set the single signon port */
 144         $GLOBALS['cfg']['Server']['port'] = $single_signon_port;
 145
 146         /* Configuration update */
 147         $GLOBALS['cfg']['Server'] = array_merge($GLOBALS['cfg']['Server'], $single_signon_cfgupdate);
 148
 149         /* Restore our token */
 150         if (!empty($pma_token)) {
 151             $_SESSION[' PMA_token '] = $pma_token;
 152         }
 153
 154         /**
 155          * Clear user cache.
 156          */
 157         PMA_clearUserCache();
 158     }
 159
 160     // Returns whether we get authentication settings or not
 161     if (empty($PHP_AUTH_USER)) {
 162         unset($_SESSION['LAST_SIGNON_URL']);
 163         return false;
 164     } else {
 165         $_SESSION['LAST_SIGNON_URL'] = $GLOBALS['cfg']['Server']['SignonURL'];
 166         return true;
 167     }
 168 } // end of the 'PMA_auth_check()' function
 169
 170
 171 /**
 172  * Set the user and password after last checkings if required
 173  *
 174  * @global  array     the valid servers settings
 175  * @global  integer   the id of the current server
 176  * @global  array     the current server settings
 177  * @global  string    the current username
 178  * @global  string    the current password
 179  *
 180  * @return  boolean   always true
 181  *
 182  * @access  public
 183  */
 184 function PMA_auth_set_user()
 185 {
 186     global $cfg;
 187     global $PHP_AUTH_USER, $PHP_AUTH_PW;
 188
 189     $cfg['Server']['user']     = $PHP_AUTH_USER;
 190     $cfg['Server']['password'] = $PHP_AUTH_PW;
 191
 192     return true;
 193 } // end of the 'PMA_auth_set_user()' function
 194
 195
 196 /**
 197  * User is not allowed to login to MySQL -> authentication failed
 198  *
 199  * @return  boolean   always true (no return indeed)
 200  *
 201  * @access  public
 202  */
 203 function PMA_auth_fails()
 204 {
 205     if (! empty($GLOBALS['login_without_password_is_forbidden'])) {
 206         $_SESSION['PMA_single_signon_error_message'] = __('Login without a password is forbidden by configuration (see AllowNoPassword)');
 207     } elseif (! empty($GLOBALS['allowDeny_forbidden'])) {
 208         $_SESSION['PMA_single_signon_error_message'] = __('Access denied');
 209     } elseif (! empty($GLOBALS['no_activity'])) {
 210         $_SESSION['PMA_single_signon_error_message'] = sprintf(__('No activity within %s seconds; please log in again'), $GLOBALS['cfg']['LoginCookieValidity']);
 211     } elseif (PMA_DBI_getError()) {
 212         $_SESSION['PMA_single_signon_error_message'] = PMA_sanitize(PMA_DBI_getError());
 213     } elseif (isset($php_errormsg)) {
 214         $_SESSION['PMA_single_signon_error_message'] = $php_errormsg;
 215     } else {
 216         $_SESSION['PMA_single_signon_error_message'] = __('Cannot log in to the MySQL server');
 217     }
 218     PMA_auth();
 219 } // end of the 'PMA_auth_fails()' function
 220
 221 ?>