Subversion Repositories oidplus

Rev

Rev 1116 | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
635 daniel-mar 1 
<?php
2 
 
3 
/*
4 
 * OIDplus 2.0
1086 daniel-mar 5 
 * Copyright 2019 - 2023 Daniel Marschall, ViaThinkSoft
635 daniel-mar 6 
 *
7 
 * Licensed under the Apache License, Version 2.0 (the "License");
8 
 * you may not use this file except in compliance with the License.
9 
 * You may obtain a copy of the License at
10 
 *
11 
 *     http://www.apache.org/licenses/LICENSE-2.0
12 
 *
13 
 * Unless required by applicable law or agreed to in writing, software
14 
 * distributed under the License is distributed on an "AS IS" BASIS,
15 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 
 * See the License for the specific language governing permissions and
17 
 * limitations under the License.
18 
 */
19 
 
1050 daniel-mar 20 
namespace ViaThinkSoft\OIDplus;
635 daniel-mar 21 
 
1086 daniel-mar 22 
// phpcs:disable PSR1.Files.SideEffects
23 
\defined('INSIDE_OIDPLUS') or die;
24 
// phpcs:enable PSR1.Files.SideEffects
25 
 
635 daniel-mar 26 
class OIDplusAuthPluginBCrypt extends OIDplusAuthPlugin {
27 
 
1116 daniel-mar 28 
        /**
1212 daniel-mar 29 
         * @return string
30 
         */
31 
        public function id(): string {
32 
                return 'A3_bcrypt';
33 
        }
34 
 
35 
        /**
1116 daniel-mar 36 
         * @param bool $html
37 
         * @return void
38 
         * @throws OIDplusException
39 
         */
40 
        public function init(bool $html=true) {
1088 daniel-mar 41 
                // Note: Example #3 here https://www.php.net/manual/en/function.password-hash.php can help you with finding a good cost value
1116 daniel-mar 42 
                OIDplus::config()->prepareConfigKey('ra_bcrypt_cost', 'How complex should the BCrypt hash of RA passwords be? (Only for plugin A3_bcrypt; values 4-31, default 10)', '10', OIDplusConfig::PROTECTION_EDITABLE, function($value) {
43 
                        if (empty($value) || !is_numeric($value) || ($value<4) || ($value>31)) {
635 daniel-mar 44 
                                throw new OIDplusException(_L('Invalid value for "cost" (must be 4-31, default 10).'));
45 
                        }
46 
                });
47 
        }
48 
 
1116 daniel-mar 49 
        /**
50 
         * @param string $authKey
51 
         * @return bool
52 
         */
53 
        private function supportedCryptAlgo(string $authKey): bool {
1088 daniel-mar 54 
                return str_starts_with($authKey, '$2$')  ||
55 
                       str_starts_with($authKey, '$2a$') ||
56 
                       str_starts_with($authKey, '$2b$') ||
57 
                       str_starts_with($authKey, '$2x$') ||
58 
                       str_starts_with($authKey, '$2y$');
59 
        }
60 
 
1116 daniel-mar 61 
        /**
62 
         * @param OIDplusRAAuthInfo $authInfo
63 
         * @param string $check_password
64 
         * @return bool
65 
         */
66 
        public function verify(OIDplusRAAuthInfo $authInfo, string $check_password): bool {
635 daniel-mar 67 
                $authKey = $authInfo->getAuthKey();
68 
 
1088 daniel-mar 69 
                if (!$this->supportedCryptAlgo($authKey)) {
70 
                        // Unsupported algorithm
635 daniel-mar 71 
                        return false;
72 
                }
1088 daniel-mar 73 
 
74 
                // $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy
75 
                //  \/ \/ \____________________/\_____________________________/
76 
                // Alg Cost   Salt (128 bit)             Hash
77 
 
78 
                return password_verify($check_password, $authKey);
635 daniel-mar 79 
        }
80 
 
1116 daniel-mar 81 
        /**
82 
         * @param string $password
83 
         * @return OIDplusRAAuthInfo
84 
         * @throws OIDplusException
85 
         */
86 
        public function generate(string $password): OIDplusRAAuthInfo {
1088 daniel-mar 87 
                if (strlen($password) > 72) throw new OIDplusException(_L('Password is too long (max %1 bytes)',72));
635 daniel-mar 88 
                $cost = OIDplus::config()->getValue('ra_bcrypt_cost', 10);
1088 daniel-mar 89 
                $calc_authkey = password_hash($password, PASSWORD_BCRYPT, array("cost" => $cost));
90 
                if (!$calc_authkey) throw new OIDplusException(_L('Error creating password hash'));
91 
                assert($this->supportedCryptAlgo($calc_authkey));
1090 daniel-mar 92 
                return new OIDplusRAAuthInfo($calc_authkey);
635 daniel-mar 93 
        }
94 
 
1116 daniel-mar 95 
        /**
96 
         * @param string $reason
97 
         * @return bool
98 
         */
99 
        public function availableForHash(string &$reason): bool {
1088 daniel-mar 100 
                if (version_compare(PHP_VERSION, '7.4.0') >= 0) {
101 
                        $ok = in_array('2',  password_algos()) ||
102 
                              in_array('2a', password_algos()) ||
103 
                              in_array('2b', password_algos()) ||
104 
                              in_array('2x', password_algos()) ||
105 
                              in_array('2y', password_algos());
106 
 
107 
                } else {
108 
                        $ok = defined('PASSWORD_BCRYPT');
109 
                }
110 
 
111 
                if ($ok) return true;
112 
 
113 
                $reason = _L('No fitting hash algorithm found');
114 
                return false;
115 
        }
116 
 
1116 daniel-mar 117 
        /**
118 
         * @param string $reason
119 
         * @return bool
120 
         */
121 
        public function availableForVerify(string &$reason): bool {
1099 daniel-mar 122 
                return $this->availableForHash($reason);
123 
        }
124 
 
635 daniel-mar 125 
}