wip

Author: lippserd

application/controllers/AuthenticationController.php

@@ -91,8 +91,13 @@ public function loginAction()
                     ->sendResponse();
                 exit;
             }
+            // FORM DOES NOT REDIRECT, IF USER HAS 2FA ENABLED and token hasn't been challenged
             $form->handleRequest();
         }
+//        if ($user->has2FA() && irgendwas_mit_session()) {
+//            // 2 FA form erstellen und zeigen und handeln
+        // in der session speichern ob der token gepasst hat
+//        }
         $this->view->form = $form;
         $this->view->defaultTitle = $this->translate('Icinga Web 2 Login');
         $this->view->requiresSetup = $requiresSetup;

application/forms/Authentication/LoginForm.php

@@ -161,6 +161,18 @@ public function onSuccess()
 
             // Call provided AuthenticationHook(s) after successful login
             AuthenticationHook::triggerLogin($user);
+
+            // If user has 2FA enabled and the token hasn't been validated, redirect to login again, so that
+            // the token is challenged.
+            $redirect = $this->getElement('redirect');
+            $old = $redirect->getValue();
+            $new = [];
+            if ($old) {
+                $new['redirect'] = $old;
+            }
+            $redirect->setValue(Url::fromPath('authentication/login', $new)->getRelativeUrl());
+            return true;
+
             $this->getResponse()->setRerenderLayout(true);
             return true;
         }

library/Icinga/Authentication/Auth.php

@@ -88,13 +88,19 @@ public function getAuthChain()
      */
     public function isAuthenticated()
     {
+        // return false just for testing. isAuthenticated must return false if the user is authentiacted but has 2FA enabled and the token hasn't been challenged yet.
+        return false;
+
         if ($this->user !== null) {
             return true;
         }
         $this->authenticateFromSession();
         if ($this->user === null && ! $this->authExternal()) {
             return false;
         }
+
+        // real 2fa check from above must happen here
+
         return true;
     }
 
@@ -130,6 +136,7 @@ public function setAuthenticated(User $user, $persist = true)
             $this->persistCurrentUser();
         }
 
+        // don't log if 2fa hasn't been challenged yet
         AuditHook::logActivity('login', 'User logged in');
     }
 
@@ -452,5 +459,7 @@ public function setupUser(User $user)
         // Load the user's roles
         $admissionLoader = new AdmissionLoader();
         $admissionLoader->applyRoles($user);
+
+        // Set 2FA status from the user preferences in the user obect
     }
 }

library/Icinga/User/Preferences/PreferencesStore.php

@@ -282,8 +282,9 @@ protected function update(array $preferences, string $section): void
             }
         } catch (Exception $e) {
             throw new NotWritableError(
-                'Cannot update preferences for user %s in database',
+                'Cannot update preferences for user %s in database: %s',
                 $this->getUser()->getUsername(),
+                $e->getMessage(),
                 $e
             );
         }