Subversion Repositories oidplus

Rev

Rev 1099 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
635 daniel-mar 1 
<?php
2 
 
3 
/*
4 
 * OIDplus 2.0
1086 daniel-mar 5 
 * Copyright 2019 - 2023 Daniel Marschall, ViaThinkSoft
635 daniel-mar 6 
 *
7 
 * Licensed under the Apache License, Version 2.0 (the "License");
8 
 * you may not use this file except in compliance with the License.
9 
 * You may obtain a copy of the License at
10 
 *
11 
 *     http://www.apache.org/licenses/LICENSE-2.0
12 
 *
13 
 * Unless required by applicable law or agreed to in writing, software
14 
 * distributed under the License is distributed on an "AS IS" BASIS,
15 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 
 * See the License for the specific language governing permissions and
17 
 * limitations under the License.
18 
 */
19 
 
1050 daniel-mar 20 
namespace ViaThinkSoft\OIDplus;
635 daniel-mar 21 
 
1086 daniel-mar 22 
// phpcs:disable PSR1.Files.SideEffects
23 
\defined('INSIDE_OIDPLUS') or die;
24 
// phpcs:enable PSR1.Files.SideEffects
25 
 
635 daniel-mar 26 
class OIDplusAuthPluginBCrypt extends OIDplusAuthPlugin {
27 
 
1116 daniel-mar 28 
        /**
29 
         * @param bool $html
30 
         * @return void
31 
         * @throws OIDplusException
32 
         */
33 
        public function init(bool $html=true) {
1088 daniel-mar 34 
                // Note: Example #3 here https://www.php.net/manual/en/function.password-hash.php can help you with finding a good cost value
1116 daniel-mar 35 
                OIDplus::config()->prepareConfigKey('ra_bcrypt_cost', 'How complex should the BCrypt hash of RA passwords be? (Only for plugin A3_bcrypt; values 4-31, default 10)', '10', OIDplusConfig::PROTECTION_EDITABLE, function($value) {
36 
                        if (empty($value) || !is_numeric($value) || ($value<4) || ($value>31)) {
635 daniel-mar 37 
                                throw new OIDplusException(_L('Invalid value for "cost" (must be 4-31, default 10).'));
38 
                        }
39 
                });
40 
        }
41 
 
1116 daniel-mar 42 
        /**
43 
         * @param string $authKey
44 
         * @return bool
45 
         */
46 
        private function supportedCryptAlgo(string $authKey): bool {
1088 daniel-mar 47 
                return str_starts_with($authKey, '$2$')  ||
48 
                       str_starts_with($authKey, '$2a$') ||
49 
                       str_starts_with($authKey, '$2b$') ||
50 
                       str_starts_with($authKey, '$2x$') ||
51 
                       str_starts_with($authKey, '$2y$');
52 
        }
53 
 
1116 daniel-mar 54 
        /**
55 
         * @param OIDplusRAAuthInfo $authInfo
56 
         * @param string $check_password
57 
         * @return bool
58 
         */
59 
        public function verify(OIDplusRAAuthInfo $authInfo, string $check_password): bool {
635 daniel-mar 60 
                $authKey = $authInfo->getAuthKey();
61 
 
1088 daniel-mar 62 
                if (!$this->supportedCryptAlgo($authKey)) {
63 
                        // Unsupported algorithm
635 daniel-mar 64 
                        return false;
65 
                }
1088 daniel-mar 66 
 
67 
                // $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
68 
                //  \/ \/ \____________________/\_____________________________/
69 
                // Alg Cost   Salt (128 bit)             Hash
70 
 
71 
                return password_verify($check_password, $authKey);
635 daniel-mar 72 
        }
73 
 
1116 daniel-mar 74 
        /**
75 
         * @param string $password
76 
         * @return OIDplusRAAuthInfo
77 
         * @throws OIDplusException
78 
         */
79 
        public function generate(string $password): OIDplusRAAuthInfo {
1088 daniel-mar 80 
                if (strlen($password) > 72) throw new OIDplusException(_L('Password is too long (max %1 bytes)',72));
635 daniel-mar 81 
                $cost = OIDplus::config()->getValue('ra_bcrypt_cost', 10);
1088 daniel-mar 82 
                $calc_authkey = password_hash($password, PASSWORD_BCRYPT, array("cost" => $cost));
83 
                if (!$calc_authkey) throw new OIDplusException(_L('Error creating password hash'));
84 
                assert($this->supportedCryptAlgo($calc_authkey));
1090 daniel-mar 85 
                return new OIDplusRAAuthInfo($calc_authkey);
635 daniel-mar 86 
        }
87 
 
1116 daniel-mar 88 
        /**
89 
         * @param string $reason
90 
         * @return bool
91 
         */
92 
        public function availableForHash(string &$reason): bool {
1088 daniel-mar 93 
                if (version_compare(PHP_VERSION, '7.4.0') >= 0) {
94 
                        $ok = in_array('2',  password_algos()) ||
95 
                              in_array('2a', password_algos()) ||
96 
                              in_array('2b', password_algos()) ||
97 
                              in_array('2x', password_algos()) ||
98 
                              in_array('2y', password_algos());
99 
 
100 
                } else {
101 
                        $ok = defined('PASSWORD_BCRYPT');
102 
                }
103 
 
104 
                if ($ok) return true;
105 
 
106 
                $reason = _L('No fitting hash algorithm found');
107 
                return false;
108 
        }
109 
 
1116 daniel-mar 110 
        /**
111 
         * @param string $reason
112 
         * @return bool
113 
         */
114 
        public function availableForVerify(string &$reason): bool {
1099 daniel-mar 115 
                return $this->availableForHash($reason);
116 
        }
117 
 
635 daniel-mar 118 
}