Two-factor authentication

application/clicommands/TwofactorCommand.php

@@ -0,0 +1,116 @@
+<?php
+
+namespace Icinga\Clicommands;
+
+use DateTime;
+use Icinga\Cli\Command;
+use Icinga\Common\Database;
+use ipl\Sql\Delete;
+use ipl\Sql\Select;
+use Throwable;
+
+class TwofactorCommand extends Command
+{
+    use Database;
+
+    /**
+     * List all users that have 2FA enabled
+     *
+     * This command lists all users that have 2FA enabled and when they enabled it.
+     *
+     * USAGE
+     *
+     * icingacli twofactor list
+     */
+    public function listAction(): void
+    {
+        $rows = $this->getDb()->select(
+            (new Select())
+                ->from('icingaweb_2fa')
+                ->columns(['username', 'ctime'])
+        )->fetchAll();
+
+        if (empty($rows)) {
+            echo "Currently there are no users that have 2FA enabled.\n";
+
+            return;
+        }
+
+        printf("%-20s %-20s\n", 'USER', 'ENABLED 2FA');
+
+        foreach ($rows as $row) {
+            printf(
+                "%-20s %-20s\n",
+                $row->username,
+                DateTime::createFromFormat('U.u', $row->ctime / 1000)->format('Y-m-d H:i:s')
+            );
+        }
+
+        echo "\n";
+    }
+
+    /**
+     * Disable 2FA for a specific user
+     *
+     * This command disables 2FA for a specific user. It asks for confirmation before deleting the secret. The deletion
+     * cannot be undone.
+     *
+     * USAGE
+     *
+     * icingacli twofactor disable [<user>]
+     *
+     * OPTIONS
+     *
+     * --force  Disable 2FA for user without confirmation
+     */
+    public function disableAction(): void
+    {
+        $user = $this->params->shift();
+
+        if (! $user) {
+            fwrite(STDERR, "User must be provided!\n");
+            $this->showUsage('disable');
+
+            exit(1);
+        }
+
+        if (! $this->params->shift('force')) {
+            $input = readline(sprintf(
+                "Are you sure you want to disable 2FA for user '%s'? This cannot be undone! [y/N] ",
+                $user
+            ));
+
+            if (! $input || ! in_array(strtolower(trim($input)), ['y', 'yes'])) {
+                echo "No changes made.\n";
+
+                return;
+            }
+        }
+
+        try {
+            $delete = $this->getDb()->prepexec(
+                (new Delete())
+                    ->from('icingaweb_2fa')
+                    ->where(['LOWER(username) = ?' => strtolower($user)])
+            );
+        } catch (Throwable $e) {
+            fprintf(
+                STDERR,
+                "%s: Failed to disable 2FA for '%s': %s\n",
+                $this->screen->colorize('ERROR', 'red'),
+                $user,
+                $e->getMessage()
+            );
+
+            exit(1);
+        }
+
+        if ($delete->rowCount() < 1) {
+            printf("The user '%s' doesn't have 2FA enabled.\n", $user);
+
+            return;
+        }
+
+        printf("Successfully disabled 2FA for user '%s'.\n", $user);
+    }
+}

application/controllers/AccountController.php

@@ -6,7 +6,10 @@
 namespace Icinga\Controllers;
 
 use Icinga\Application\Config;
+use Icinga\Application\Hook;
+use Icinga\Application\Hook\TwoFactorHook;
 use Icinga\Authentication\User\UserBackend;
+use Icinga\Common\Database;
 use Icinga\Data\ConfigObject;
 use Icinga\Exception\ConfigurationError;
 use Icinga\Forms\Account\ChangePasswordForm;
@@ -19,6 +22,8 @@
  */
 class AccountController extends Controller
 {
+    use Database;
+
     /**
      * {@inheritdoc}
      */
@@ -43,6 +48,13 @@ public function init()
                     'url'   => 'my-devices'
                 )
             );
+        if (Hook::has(TwoFactorHook::NAME)) {
+            $this->getTabs()->add('two-factor', [
+                'title' => $this->translate('Configure two-factor authentication'),
+                'label' => $this->translate('Two-Factor Auth'),
+                'url'   => 'two-factor/config',
+            ]);
+        }
     }
 
     /**

application/controllers/AuthenticationController.php

@@ -5,28 +5,35 @@
 
 namespace Icinga\Controllers;
 
-use GuzzleHttp\Psr7\ServerRequest;
 use Icinga\Application\ClassLoader;
 use Icinga\Application\Hook\AuthenticationHook;
 use Icinga\Application\Hook\LoginButtonHook;
 use Icinga\Application\Icinga;
 use Icinga\Application\Logger;
 use Icinga\Authentication\LoginButton;
 use Icinga\Authentication\LoginButtonForm;
+use Icinga\Authentication\Auth;
+use Icinga\Authentication\TwoFactorState;
+use Icinga\Authentication\User\ExternalBackend;
 use Icinga\Common\Database;
 use Icinga\Exception\AuthenticationException;
 use Icinga\Forms\Authentication\LoginForm;
-use Icinga\Web\Controller;
+use Icinga\Forms\Authentication\TwoFactorChallengeForm;
 use Icinga\Web\Helper\CookieHelper;
 use Icinga\Web\RememberMe;
+use Icinga\Web\Session;
 use Icinga\Web\Url;
+use Icinga\Web\Widget\LoginPage;
+use ipl\Html\HtmlDocument;
+use ipl\Html\Contract\Form;
+use ipl\Web\Compat\CompatController;
 use RuntimeException;
 use Throwable;
 
 /**
  * Application wide controller for authentication
  */
-class AuthenticationController extends Controller
+class AuthenticationController extends CompatController
 {
     use Database;
 
@@ -45,11 +52,40 @@ class AuthenticationController extends Controller
      */
     public function loginAction()
     {
+        $twoFactorState = new TwoFactorState();
+        if ($twoFactorState->isChallenged()) {
+            $this->redirectNow($this->withRedirect('authentication/twofactor'));
+        }
+
         $icinga = Icinga::app();
         if (($requiresSetup = $icinga->requiresSetup()) && $icinga->setupTokenExists()) {
             $this->redirectNow(Url::fromPath('setup'));
         }
-        $form = new LoginForm();
+
+        $form = (new LoginForm())
+            ->setAction(Url::fromRequest()->getAbsoluteUrl())
+            ->on(Form::ON_SUBMIT, function (LoginForm $form) {
+                if ($redirectUrl = $form->getRedirectUrl()) {
+                    $this->redirectNow($redirectUrl);
+                }
+            })
+            ->on(Form::ON_REQUEST, function ($request, LoginForm $form) {
+                $auth = Auth::getInstance();
+                $onlyExternal = true;
+                // TODO(el): This may be set on the auth chain once iterated. See Auth::authExternal().
+                foreach ($auth->getAuthChain() as $backend) {
+                    if (! $backend instanceof ExternalBackend) {
+                        $onlyExternal = false;
+                    }
+                }
+                if ($onlyExternal) {
+                    $form->addMessage($this->translate(
+                        'You\'re currently not authenticated using any of the web server\'s authentication'
+                        . 'mechanisms. Make sure you\'ll configure such, otherwise you\'ll not be able to login.'
+                    ));
+                    $form->onError();
+                }
+            });
 
         if (RememberMe::hasCookie() && $this->hasDb()) {
             $authenticated = false;
@@ -84,11 +120,13 @@ public function loginAction()
                     $this->httpBadRequest('nope');
                 }
             } else {
-                $redirectUrl = $form->getRedirectUrl();
+                $redirectUrl = $form->createRedirectUrl();
             }
 
             $this->redirectNow($redirectUrl);
         }
+
+        $request = $this->getServerRequest();
         if (! $requiresSetup) {
             $cookies = new CookieHelper($this->getRequest());
             if (! $cookies->isSupported()) {
@@ -99,11 +137,10 @@ public function loginAction()
                     ->sendResponse();
                 exit;
             }
-            $form->handleRequest();
+            $form->handleRequest($request);
         }
 
         $loginButtons = [];
-        $request = ServerRequest::fromGlobals();
 
         foreach (LoginButtonHook::all() as $class => $hook) {
             try {
@@ -125,11 +162,11 @@ public function loginAction()
                 continue;
             }
         }
+        $this->setTitle($this->translate('Icinga Web 2 Login'));
 
-        $this->view->form = $form;
-        $this->view->loginButtons = $loginButtons;
-        $this->view->defaultTitle = $this->translate('Icinga Web 2 Login');
-        $this->view->requiresSetup = $requiresSetup;
+        // Suppress the rendering of an empty tab bar
+        $this->controls = new HtmlDocument();
+        $this->addContent(new LoginPage($form, $loginButtons, $requiresSetup));
     }
 
     /**
@@ -158,4 +195,46 @@ public function logoutAction()
             $this->redirectToLogin();
         }
     }
+
+    public function twofactorAction(): void
+    {
+        $twoFactorState = new TwoFactorState();
+        if (! $twoFactorState->isChallenged()) {
+            $this->redirectToLogin();
+        }
+
+        $form = (new TwoFactorChallengeForm())
+            ->setAction(Url::fromRequest()->getAbsoluteUrl())
+            ->on(Form::ON_SUBMIT, function (TwoFactorChallengeForm $form) {
+                if ($redirectUrl = $form->getRedirectUrl()) {
+                    $this->redirectNow($redirectUrl);
+                }
+            })
+            ->on(Form::ON_SENT, function (TwoFactorChallengeForm $form) {
+                $isCsrfValid = $form->getElement('CSRFToken')->isValid();
+                $isCancelPressed =
+                    $form->getPressedSubmitElement()?->getName() === TwoFactorChallengeForm::SUBMIT_CANCEL;
+
+                if ($isCsrfValid && $isCancelPressed) {
+                    Session::getSession()->purge();
+                    $this->redirectNow($this->withRedirect('authentication/login'));
+                }
+            })
+            ->handleRequest($this->getServerRequest());
+
+        $this->setTitle($this->translate('Icinga Web 2 Two-Factor Auth'));
+
+        // Suppress the rendering of an empty tab bar
+        $this->controls = new HtmlDocument();
+        $this->addContent(new LoginPage($form));
+    }
+
+    protected function withRedirect(string $path): Url
+    {
+        $url = Url::fromPath($path);
+        if ($redirect = $this->params->get('redirect')) {
+            $url->setParam('redirect', $redirect);
+        }
+        return $url;
+    }
 }

application/controllers/MyDevicesController.php

@@ -5,6 +5,8 @@
 
 namespace Icinga\Controllers;
 
+use Icinga\Application\Hook;
+use Icinga\Application\Hook\TwoFactorHook;
 use Icinga\Common\Database;
 use Icinga\Web\Notification;
 use Icinga\Web\RememberMe;
@@ -47,6 +49,14 @@ public function init()
                     'url'   => 'my-devices'
                 )
             )->activate('devices');
+
+        if (Hook::has(TwoFactorHook::NAME)) {
+            $this->getTabs()->add('two-factor', [
+                'title' => $this->translate('Configure two-factor authentication'),
+                'label' => $this->translate('Two-Factor Auth'),
+                'url'   => 'two-factor/config',
+            ]);
+        }
     }
 
     public function indexAction()

application/controllers/NavigationController.php

@@ -7,6 +7,8 @@
 
 use Exception;
 use Icinga\Application\Config;
+use Icinga\Application\Hook;
+use Icinga\Application\Hook\TwoFactorHook;
 use Icinga\Exception\NotFoundError;
 use Icinga\Data\DataArray\ArrayDatasource;
 use Icinga\Data\Filter\FilterMatchCaseInsensitive;
@@ -156,6 +158,13 @@ public function indexAction()
                 'url'   => 'my-devices'
             )
         );
+        if (Hook::has(TwoFactorHook::NAME)) {
+            $this->getTabs()->add('two-factor', [
+                'title' => $this->translate('Configure two-factor authentication'),
+                'label' => $this->translate('Two-Factor Auth'),
+                'url'   => 'two-factor/config',
+            ]);
+        }
         $this->setupSortControl(
             array(
                 'type'  => $this->translate('Type'),