diff --git a/application/controllers/AuthenticationController.php b/application/controllers/AuthenticationController.php index bbb475989..47825c210 100644 --- a/application/controllers/AuthenticationController.php +++ b/application/controllers/AuthenticationController.php @@ -14,6 +14,7 @@ use Icinga\Exception\AuthenticationException; use Icinga\Exception\NotReadableError; use Icinga\Exception\ConfigurationError; use Icinga\User; +use Icinga\Web\Session; use Icinga\Web\Url; /** @@ -67,6 +68,9 @@ class AuthenticationController extends ActionController $authenticated = $backend->authenticate($user); if ($authenticated === true) { $auth->setAuthenticated($user); + $session = Session::getSession()->getNamespace('authentication'); + $session->set('is_remote_user', true); + $session->write(); $this->rerenderLayout()->redirectNow($redirectUrl); } } @@ -131,9 +135,12 @@ class AuthenticationController extends ActionController public function logoutAction() { $auth = $this->Auth(); + + $session = Session::getSession()->getNamespace('authentication'); + $auth->removeAuthorization(); - if ($auth->isAuthenticatedFromRemoteUser()) { + if ($session->get('is_remote_user', false) === true) { $this->_helper->layout->setLayout('login'); $this->_response->setHttpResponseCode(401); } else { diff --git a/application/views/scripts/authentication/logout.phtml b/application/views/scripts/authentication/logout.phtml index eb0d6dc44..9b03d190f 100644 --- a/application/views/scripts/authentication/logout.phtml +++ b/application/views/scripts/authentication/logout.phtml @@ -7,10 +7,7 @@ in every further request until the browser was closed. To allow logout and to allow the user to change the logged-in user this JavaScript provides a workaround to force a new authentication prompt in most browsers. --> - -
-
-
+

-
-
-
-
- +
-
- diff --git a/library/Icinga/Authentication/Manager.php b/library/Icinga/Authentication/Manager.php index 01964ef00..a0465d306 100644 --- a/library/Icinga/Authentication/Manager.php +++ b/library/Icinga/Authentication/Manager.php @@ -204,35 +204,4 @@ class Manager { return $this->user->getGroups(); } - - /** - * Tries to authenticate the user from the session, and then from the REMOTE_USER superglobal, that can be set by - * an external authentication provider. - */ - public function authenticateFromRemoteUser() - { - if (array_key_exists('REMOTE_USER', $_SERVER)) { - $this->fromRemoteUser = true; - } - $this->authenticateFromSession(); - if ($this->user !== null) { - if (array_key_exists('REMOTE_USER', $_SERVER) && $this->user->getUsername() !== $_SERVER["REMOTE_USER"]) { - // Remote user has changed, clear all sessions - $this->removeAuthorization(); - } - return; - } - if (array_key_exists('REMOTE_USER', $_SERVER) && $_SERVER["REMOTE_USER"]) { - $this->user = new User($_SERVER["REMOTE_USER"]); - $this->persistCurrentUser(); - } - } - - /** - * If the session was established from the REMOTE_USER server variable. - */ - public function isAuthenticatedFromRemoteUser() - { - return $this->fromRemoteUser; - } }