Allow login both from /users/login and /.

Author: robol

backend/config/bootstrap.php

@@ -65,8 +65,12 @@
     Configure::config('default', new PhpConfig());
     Configure::load('app', 'default', false);
 
-    // Debug configuration on startup (only in debug mode)
-    ConfigDebugger::debugConfig();
+    // Debug configuration on startup only for web requests and `bin/cake server`.
+    $isCakeServerCommand = PHP_SAPI === 'cli'
+        && ($_SERVER['argv'][1] ?? null) === 'server';
+    if (PHP_SAPI !== 'cli' || $isCakeServerCommand) {
+        ConfigDebugger::debugConfig();
+    }
 } catch (\Exception $e) {
     exit($e->getMessage() . "\n");
 }

backend/config/routes.php

@@ -32,6 +32,7 @@
          // Connect '/' to users/login, that will either show the
          // login form or redirect the user to the right location.
         $routes->connect('/', [ 'controller' => 'Users', 'action' => 'login' ]);
+        $routes->connect('/users/login', [ 'controller' => 'Users', 'action' => 'login' ]);
 
         $routes->prefix('api/v1', function (RouteBuilder $routes) {
             $api_controllers = [ 

backend/src/Application.php

@@ -150,12 +150,7 @@ public function getAuthenticationService(ServerRequestInterface $request) : Auth
 
         // Define where users should be redirected to when they are not authenticated
         $service->setConfig([
-            'unauthenticatedRedirect' => Router::url([
-                    'prefix' => false,
-                    'plugin' => null,
-                    'controller' => 'Users',
-                    'action' => 'login',
-            ]),
+            'unauthenticatedRedirect' => Router::url('/'),
             'queryParam' => 'redirect',
             // For API requests, we don't want to redirect to login page
             'authError' => 'Access denied',
@@ -173,12 +168,10 @@ public function getAuthenticationService(ServerRequestInterface $request) : Auth
         $service->loadAuthenticator('Authentication.Session');
         $service->loadAuthenticator('Authentication.Form', [
             'fields' => $fields,
-            'loginUrl' => Router::url([
-                'prefix' => false,
-                'plugin' => null,
-                'controller' => 'Users',
-                'action' => 'login',
-            ]),
+            'loginUrl' => [
+                Router::url('/'),
+                Router::url('/users/login'),
+            ],
         ]);
 
         // Load identifiers

backend/src/Command/GrantAdminCommand.php

@@ -30,13 +30,6 @@
 use App\Model\Entity\User;
 
 class GrantAdminCommand extends Command {
-
-    public function initialize() : void
-    {
-        parent::initialize();
-        $this->loadModel('Users');
-    }
-
     protected function buildOptionParser(ConsoleOptionParser $parser) : ConsoleOptionParser
     {
         $parser->addArgument('username', [
@@ -62,12 +55,13 @@ public function execute(Arguments $args, ConsoleIo $io)
     {
         $username = $args->getArgument('username');
         $password = $args->getOption('password');
+        $usersTable = $this->fetchTable('Users');
 
         if ($username == null) {
             $io->error("No user provided");
             return;
         }
-        $users = $this->Users->find()->where([ 'username' => $username ]);
+        $users = $usersTable->find()->where([ 'username' => $username ]);
 
         if ($users->count() == 0)
         {
@@ -80,7 +74,7 @@ public function execute(Arguments $args, ConsoleIo $io)
                 $user['givenname'] = '';
                 $user['surname'] = $username;
                 $user['number'] = '000000';
-                if ($this->Users->save($user)) {
+                if ($usersTable->save($user)) {
                     $io->info("New user $username created");
                 } else {
                     $io->error("Creation of new user failed");
@@ -101,7 +95,7 @@ public function execute(Arguments $args, ConsoleIo $io)
                 $user['password'] = $password;
                 $io->info("password set");
             }
-            if (! $this->Users->save($user))
+            if (! $usersTable->save($user))
             {
                 $io->error("Database error while saving user $username.");
             }

backend/src/Controller/UsersController.php

@@ -121,6 +121,12 @@ public function index() {
     }
 
     private function login_user($authuser) {
+        if ($authuser instanceof \App\Model\Entity\User) {
+            $this->Authentication->setIdentity($authuser);
+            Log::write('debug', 'Logged in local user ' . $authuser['username']);
+            return;
+        }
+
         // Try to find the user in the database
         $user = $this->Users->find()
             ->where([ 'username' => $authuser['username'] ])
@@ -181,6 +187,7 @@ public function login() {
 
         if ($this->request->is('post')) {
             $authuser = $this->Authentication->getIdentity();
+            $this->debugLocalAuthenticationAttempt($authuser);
 
             if (! $authuser) {
                 $this->Flash->error('Username o password non corretti');
@@ -216,6 +223,42 @@ public function login() {
         $this->set('redirect', $this->request->getQuery(('redirect')));
     }
 
+    private function debugLocalAuthenticationAttempt($authuser): void
+    {
+        $username = (string)$this->request->getData('username', '');
+        $password = (string)$this->request->getData('password', '');
+        $result = $this->Authentication->getResult();
+        $user = $username === ''
+            ? null
+            : $this->Users->find()
+                ->where(['username' => $username])
+                ->first();
+
+        $debug = [
+            'username' => $username,
+            'has_password_in_request' => $password !== '',
+            'authentication_result_status' => $result ? $result->getStatus() : null,
+            'authentication_result_valid' => $result ? $result->isValid() : null,
+            'authentication_result_errors' => $result ? $result->getErrors() : null,
+            'identity_class' => is_object($authuser) ? get_class($authuser) : null,
+            'identity_username' => $authuser ? ($authuser['username'] ?? null) : null,
+            'local_user_found' => $user !== null,
+            'local_user_id' => $user ? $user['id'] : null,
+            'local_user_admin' => $user ? (bool)$user['admin'] : null,
+            'local_password_hash_prefix' => ($user && $user['password'])
+                ? substr($user['password'], 0, 7)
+                : null,
+            'local_password_hash_length' => ($user && $user['password'])
+                ? strlen($user['password'])
+                : null,
+            'local_password_check' => ($user && $password !== '')
+                ? $user->checkPassword($password)
+                : null,
+        ];
+
+        Log::debug('Local authentication debug: ' . json_encode($debug));
+    }
+
     private function isOAuth2Enabled() {
         return !!getenv('OAUTH2_APPID');
     }

backend/src/Model/Entity/User.php

@@ -148,6 +148,6 @@ protected function _setPassword(string $password) : ?string
     }
 
     public function checkPassword(string $password): bool {
-        return (new DefaultPasswordHasher())->hash($password) == $this->password;
+        return (new DefaultPasswordHasher())->check($password, $this->password);
     }
 }