Skip to content

Commit 2c8ed1c

Browse files
jrauh01jrauh01
committed
Use one combined LoginForm
The form displays either the login inputs or the inputs to verify the totp token depending on whether `'2fa_must_challenge_token'` is set `true` in the session.
1 parent 5636a67 commit 2c8ed1c

5 files changed

Lines changed: 235 additions & 269 deletions

File tree

‎application/controllers/AuthenticationController.php‎

Lines changed: 51 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
use Icinga\Authentication\User\ExternalBackend;
1212
use Icinga\Common\Database;
1313
use Icinga\Exception\AuthenticationException;
14-
use Icinga\Forms\Authentication\Challenge2FAForm;
1514
use Icinga\Forms\Authentication\LoginForm;
1615
use Icinga\Web\Controller;
1716
use Icinga\Web\Helper\CookieHelper;
@@ -47,74 +46,62 @@ public function loginAction()
4746
if (($requiresSetup = $icinga->requiresSetup()) && $icinga->setupTokenExists()) {
4847
$this->redirectNow(Url::fromPath('setup'));
4948
}
50-
$skip2fa = false;
51-
$user = $this->Auth()->getUser();
52-
if ($user
53-
&& $user->getTwoFactorEnabled()
54-
&& Session::getSession()->get('2fa_must_challenge_token', false)
55-
) {
56-
$form = (new Challenge2FAForm())
57-
->setAction(Url::fromRequest()->getAbsoluteUrl())
58-
->on(Form::ON_SUBMIT, function (Challenge2FAForm $form) {
59-
if ($redirectUrl = $form->getRedirectUrl()) {
60-
$this->redirectNow($redirectUrl);
61-
}
62-
})
63-
->on(Form::ON_SENT, function (Challenge2FAForm $form) {
64-
$isCsrfValid = $form->getElement('CSRFToken')->isValid();
65-
$isCancelPressed = $form->getPressedSubmitElement()?->getName() === $form::SUBMIT_CANCEL;
66-
67-
if ($isCsrfValid && $isCancelPressed) {
68-
Session::getSession()->purge();
69-
$this->redirectNow(Url::fromRequest());
70-
}
71-
});
72-
} else {
73-
$form = (new LoginForm())
74-
->setAction(Url::fromRequest()->getAbsoluteUrl())
75-
->on(Form::ON_SUBMIT, function (LoginForm $form) {
76-
if ($redirectUrl = $form->getRedirectUrl()) {
77-
$this->redirectNow($redirectUrl);
78-
}
79-
})
80-
->on(Form::ON_REQUEST, function ($request, LoginForm $form) {
81-
$auth = Auth::getInstance();
82-
$onlyExternal = true;
83-
// TODO(el): This may be set on the auth chain once iterated. See Auth::authExternal().
84-
foreach ($auth->getAuthChain() as $backend) {
85-
if (! $backend instanceof ExternalBackend) {
86-
$onlyExternal = false;
87-
}
88-
}
89-
if ($onlyExternal) {
90-
$form->addMessage($this->translate(
91-
'You\'re currently not authenticated using any of the web server\'s authentication'
92-
. 'mechanisms. Make sure you\'ll configure such, otherwise you\'ll not be able to login.'
93-
));
94-
$form->onError();
95-
}
96-
});
9749

98-
if (RememberMe::hasCookie() && $this->hasDb()) {
99-
$authenticated = false;
100-
try {
101-
$rememberMeOld = RememberMe::fromCookie();
102-
$authenticated = $rememberMeOld->authenticate();
103-
if ($authenticated) {
104-
$rememberMe = $rememberMeOld->renew();
105-
$this->getResponse()->setCookie($rememberMe->getCookie());
106-
$rememberMe->persist($rememberMeOld->getAesCrypt()->getIV());
107-
$skip2fa = true;
50+
$form = (new LoginForm())
51+
->setAction(Url::fromRequest()->getAbsoluteUrl())
52+
->on(Form::ON_SUBMIT, function (LoginForm $form) {
53+
if ($redirectUrl = $form->getRedirectUrl()) {
54+
$this->redirectNow($redirectUrl);
55+
}
56+
})
57+
->on(Form::ON_SENT, function (LoginForm $form) {
58+
$isCsrfValid = $form->getElement('CSRFToken')->isValid();
59+
$isCancelPressed = $form->getPressedSubmitElement()?->getName() === $form::SUBMIT_CANCEL_2FA;
60+
61+
if ($isCsrfValid && $isCancelPressed) {
62+
Session::getSession()->purge();
63+
$this->redirectNow(Url::fromRequest());
64+
}
65+
})
66+
->on(Form::ON_REQUEST, function ($request, LoginForm $form) {
67+
$auth = Auth::getInstance();
68+
$onlyExternal = true;
69+
// TODO(el): This may be set on the auth chain once iterated. See Auth::authExternal().
70+
foreach ($auth->getAuthChain() as $backend) {
71+
if (! $backend instanceof ExternalBackend) {
72+
$onlyExternal = false;
10873
}
109-
} catch (RuntimeException $e) {
110-
Logger::error("Can't authenticate user via remember me cookie: %s", $e->getMessage());
111-
} catch (AuthenticationException $e) {
112-
Logger::error($e);
11374
}
75+
if ($onlyExternal) {
76+
$form->addMessage($this->translate(
77+
'You\'re currently not authenticated using any of the web server\'s authentication'
78+
. 'mechanisms. Make sure you\'ll configure such, otherwise you\'ll not be able to login.'
79+
));
80+
$form->onError();
81+
}
82+
});
83+
84+
$skip2fa = false;
11485

115-
if (! $authenticated) {
116-
$this->getResponse()->setCookie(RememberMe::forget());
86+
if (RememberMe::hasCookie() && $this->hasDb()) {
87+
$authenticated = false;
88+
try {
89+
$rememberMeOld = RememberMe::fromCookie();
90+
$authenticated = $rememberMeOld->authenticate();
91+
if ($authenticated) {
92+
$rememberMe = $rememberMeOld->renew();
93+
$this->getResponse()->setCookie($rememberMe->getCookie());
94+
$rememberMe->persist($rememberMeOld->getAesCrypt()->getIV());
95+
$skip2fa = true;
11796
}
97+
} catch (RuntimeException $e) {
98+
Logger::error("Can't authenticate user via remember me cookie: %s", $e->getMessage());
99+
} catch (AuthenticationException $e) {
100+
Logger::error($e);
101+
}
102+
103+
if (! $authenticated) {
104+
$this->getResponse()->setCookie(RememberMe::forget());
118105
}
119106
}
120107

‎application/forms/Authentication/Challenge2FAForm.php‎

Lines changed: 0 additions & 133 deletions
This file was deleted.

0 commit comments

Comments
 (0)