1aae1eab23
DBUserBackend: Replace internal crypt handling with PasswordHelper
...
refs #2954
2017-11-21 08:26:24 +01:00
f57277aa96
Introduce PasswordHelper for safer passwords
...
refs #2954
2017-11-21 08:26:24 +01:00
f495b390da
Apply role to all users if the role is defined with users=*
...
If the users directive contains at least one single asterisk, the role is applied to all users.
So, this supports roles which define users=username, ..., * and users=*
refs #3095
2017-11-16 12:02:41 +01:00
c196a7c7c4
Modify authentication function to support alternative algorithms
...
The existing usage of crypt() was borderline incorrect. This simplified
function will allow hashes of other types (e.g. bcrypt) and thus
mitigate #2954 (use password_hash) until this can be implemented.
The getSalt protected method was also removed as this is no longer
required, though this can be added again in future.
2017-11-06 22:48:42 +13:00
f65759ace8
LdapUserGroupBackend: Base ambiguity decision based on isDN
...
Problem was: When a DN did not contain the same base DN, the check failed
This happens when you have an entry referencing a DN of another domain.
(And this value is tested as a sample)
2017-10-20 15:17:11 +02:00
ab7fa9f925
Add domain part to user groups if the user group backend is reponsible for a domain
2017-07-31 09:03:40 +02:00
b13c38b65b
Auth/Groups: Prefer the domain from the LDAP/MSAD user backend
...
If a LDAP/MSAD user group backend is linked w/ a user backend, the domain from the user backend is preferred over the domain configured for the user group backend.
2017-07-11 17:09:24 +02:00
4b11afe7d5
Remove unused method LdapUserBackend::setConfig()
2017-07-11 17:08:16 +02:00
bd23d008ca
Auth: Make sure to set the configured domain on LDAP/MSAD user backends
2017-07-11 17:02:32 +02:00
cbde758fc6
Remove unused domain-aware auth related functions from UserBackend
...
These functions made it into the master branch accidentally.
2017-07-11 17:01:06 +02:00
686d022987
Merge pull request #2863 from Icinga/feature/domain-support-for-authn-authz-2153
2017-06-21 13:16:36 +02:00
cfbd5c500e
Make LDAP user group backends domain-aware
...
refs #2153
2017-06-12 13:31:07 +02:00
0cbec01743
Make auth via LDAP user backends domain-aware
...
refs #2153
2017-06-12 13:31:07 +02:00
05288e9bea
Add interface for user backends which are responsible for a specific domain
...
refs #2153
2017-06-12 13:31:07 +02:00
41acffdc24
Login: set the default domain if necessary
...
refs #2153
2017-06-12 13:31:07 +02:00
2b9e9bf2b3
User: split the username into localpart and domain (if given)
2017-06-12 13:31:07 +02:00
f323310174
DbUserBackend: don't fail at validation if there aren't any active users
...
refs #2598
2017-02-24 15:29:05 +01:00
181e2ef05c
Swag: Fix swag (aka a whole bunch of code style issues..)
2017-01-27 14:48:59 +01:00
08a82daea3
Update to icinga.com
...
refs #2687
2017-01-18 12:04:43 +01:00
0716f87852
Update german translation
2016-12-13 13:57:27 +01:00
648f088564
Conform to coding guidelines
...
refs #12598
2016-12-07 17:45:50 +01:00
59f1a70d5e
Add support for nested AD groups resolved from the user
...
This will make sure that nested groups also work with roles.
Signed-off-by: Alexander A. Klimov <alexander.klimov@icinga.com>
refs #12598
2016-12-07 17:15:59 +01:00
4eb61c2bcf
Revert breaking change in Auth::isAuthenticated()
...
refs #12580
fixes #13281
2016-12-06 12:41:22 +01:00
78be71bc92
Merge branch 'bugfix/evaluate-redirect_remote_user-12164'
...
fixes #12164
2016-11-21 08:53:35 +01:00
f7e5cd3b71
Check the correct return type in case preg_replace fails in ExternalBackend.php
2016-11-16 14:10:31 +01:00
3a816ce0f7
ExternalBackend: Don't throw an error if it's not possible to clean usernames
2016-11-16 12:04:46 +01:00
0bd00ba3d0
ExternalBackend: Simplify how remote users are identified
...
refs #12164
2016-11-16 11:55:54 +01:00
f7a8524dce
DbUserGroupBackend: Group by group.id when joining group memberships
...
Prevents duplicate results in case a group has multiple members.
2016-11-11 09:19:59 +01:00
2b060d9bd4
Challenge API requests only if the controller requires auth
...
fixes #12580
2016-11-07 10:40:38 +01:00
d9330486e9
Replace ExternalBackend::getRemoteUserEnvvars() with an attribute
...
refs #12164
2016-11-04 17:27:36 +01:00
d6ac6c8374
setup/AuthenticationPage: don't show the warning about external backend configuration if REDIRECT_REMOTE_USER is set
...
refs #12164
2016-10-18 15:19:13 +02:00
4d6160d987
ExternalBackend::getRemoteUser(): restore previous default behavior
...
refs #12164
2016-10-18 10:22:06 +02:00
ab01d2f915
ExternalBackend: don't reference more than necessary from the config
...
refs #12164
2016-10-18 10:17:21 +02:00
ce951295d3
ExternalBackend: make the variable a webserver assigns a username to configurable
...
refs #12164
2016-10-17 18:46:00 +02:00
29c221418b
External authentication: respect REDIRECT_REMOTE_USER as well
...
refs #12164
2016-10-17 16:19:26 +02:00
e62d94209f
Allow users to change their password if backend is db
...
refs #10616
2016-07-21 17:38:19 +02:00
99d08bf03b
Get remote user from $_SERVER if env does not have it in external auth
...
refs #11391
2016-04-11 14:09:04 +02:00
2ac54d7c3e
lib: Add ExternalBackend::getRemoteUser()
...
If the user is authenticated via the web server, this method should be used to retrieve the user because
it supports both reading the user from the environment or from the $_SERVER variable as fallback.
refs #11391
2016-04-11 14:01:36 +02:00
c803ec64c5
lib: Move getters before setters in ExternalBackend
2016-04-11 10:57:01 +02:00
e0781cf8b5
Fix PHPDoc of AdmissionLoader::applyRoles()
...
refs #10887
2016-03-29 11:26:00 +02:00
5b5978787b
Move permission and restriction initialization in AdmissionLoader
...
refs #10887
2016-03-29 11:25:55 +02:00
32c6a03000
Remove Role::addPermission()
...
Method is not used.
refs #10887
2016-03-29 11:25:53 +02:00
123488cfc0
Remove Role::addRestriction()
...
Method is not used.
refs #10887
2016-03-29 11:25:51 +02:00
08b70267cd
Move setters after getter in Role.php
...
refs #10887
2016-03-29 11:25:47 +02:00
df0d3aaf1e
AdmissionLoader: set the roles of the user
...
refs #10887
2016-03-24 16:24:24 +01:00
57ce39834d
Role: implement setPermissions() and setRestrictions()
...
refs #10887
2016-03-24 16:11:31 +01:00
f1f4cdc3cb
lib: Use AdmissionLoader::applyRoles() in Auth
...
refs #10887
2016-03-24 15:30:30 +01:00
6ec1878977
lib: Add Authentication/Role
...
refs #10887
2016-03-24 15:29:39 +01:00
2699d2c9ed
lib: Rename AdmissionLoader::applyPerm... to applyRoles()
...
refs #10887
2016-03-24 15:28:21 +01:00
929f45deea
Fix session resume for external auths
...
When REMOTE_USER is not available from _SERVER (PHP internal webserver)
fixes #11277
2016-03-02 17:39:05 +01:00
9d5e21e71e
Remove IniUserGroupBackend.php
...
Does not conform to its interface anymore and is not in use.
2016-02-26 10:32:13 +01:00
c78a7912e7
Fix parse error in Auth.php
2016-02-15 14:50:33 +01:00
74b4c344d6
Shorten check for empty auth header
...
refs #11151
2016-02-15 14:22:36 +01:00
8a4f15d32c
Don't redirect unauthenticated API requests to the login page
...
refs #11151
2016-02-15 13:36:29 +01:00
a464e74aa4
Allow basic auth for API requests only
...
refs #11151
2016-02-15 10:53:32 +01:00
dc9cfc1c81
Call getRequest() only once in Auth::authHttp()
...
refs #11151
2016-02-15 10:44:33 +01:00
4c97fb7d01
Don't request basic auth if auth scheme isn't basic
...
fixes #10506
2016-02-15 10:39:18 +01:00
32876ca8ae
LdapUserGroupBackend: respect config option group_filter
...
refs #11142
2016-02-11 15:49:28 +01:00
474803fee4
Change all license headers to only reflect a file's year of creation
...
refs #11000
2016-02-08 15:41:00 +01:00
7fd575080e
PHP7: Rename String to StringHelper
...
refs #10251
2016-01-27 16:46:55 +01:00
9968fb9011
Reload CSS after login because the user may have a different theme (WIP)
...
This is just a quick fix.
refs #10957
2016-01-18 12:56:02 +01:00
fc8873ec0a
Use getenv() instead of $_SERVER to get REMOTE_USER
...
refs #10488
2015-12-18 13:46:34 +01:00
916c417666
LdapUserGroupBackend: Avoid inspecting a group with no members
...
fixes #10659
2015-11-24 09:45:49 +01:00
0cc54ce34b
Refresh session every 10 minutes
...
Quick and dirty fix.
fixes #10229
2015-11-16 14:19:33 +01:00
d2cc854a61
LdapUserBackend: Set a query's base DN when a table gets required
...
This ensures that the query receives the correct base DN even if the table
gets adjusted by calling from() subsequently.
refs #10567
2015-11-11 12:55:17 +01:00
8bf4e8d217
LdapUserGroupBackend: Set a query's base DN when a table gets required
...
This ensures that the query receives the correct base DN even if the table
gets adjusted by calling from() subsequently.
refs #10567
2015-11-11 12:54:49 +01:00
2917f352b5
Merge branch 'master' into bugfix/unreliable-attribute-ambiguity-check-10567
...
Conflicts:
library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php
library/Icinga/Protocol/Ldap/LdapConnection.php
2015-11-11 11:53:19 +01:00
453aa864cc
LdapUserGroupBackend: Set the appropriate base dn when resolving dns
...
refs #10567
2015-11-11 11:38:32 +01:00
72f3ba1161
LdapUserGroupBackend: Offer "user_name" as filter column instead of "user"
...
refs #10370
2015-11-10 11:52:06 +01:00
d56056bba7
LdapUserGroupBackend: Utilize $virtualTables
2015-11-10 09:56:58 +01:00
505f5902c7
LdapUserBackend: Utilize $virtualTables
2015-11-10 09:56:27 +01:00
c416216822
LdapUserGroupBackend: Fix typo in method requireTable()
...
refs #10370
2015-11-09 16:00:55 +01:00
ffcc2ed56b
LdapUserGroupBackend: Fix exception when searching for single chars
...
refs #10370
2015-11-09 16:00:24 +01:00
9b826e6e5f
Drop class Ldap\Expression and introduce LdapQuery::$nativeFilter
...
I'm about to add support for our Data\Filter implementation, since it cannot
parse native LDAP filters and a user may have configured such, we need to
differentiate the two types of filter.
refs #10370
2015-11-09 13:04:02 +01:00
cfb26e22b3
LdapUserGroupBackend: Dynamically verify member attribute ambiguity
...
refs #10567
2015-11-09 11:41:11 +01:00
99719bec7d
Merge branch 'master' into bugfix/broken-user-and-group-management-10367
...
Conflicts:
library/Icinga/Authentication/User/LdapUserBackend.php
library/Icinga/Authentication/UserGroup/LdapUserGroupBackend.php
2015-10-29 08:52:07 +01:00
36340aafa6
Repository: Ensure that we'll internally only work with virtual table names
...
refs #10367
2015-10-27 13:31:47 +01:00
0b9a141591
LdapUserGroupBackend: Use the group_base_dn as user_base_dn..
...
..if neither the config nor the defaults provide a value.
refs #10402
2015-10-20 11:28:18 +02:00
33956e02f8
Fix collection of user_base_dn from the UserBackend
...
Currently the group_base_dn is used, unless a user_base_dn is configured in the group backend.
refs #10402
2015-10-20 10:02:42 +02:00
878bd78587
LdapUserBackend: Unfold the user_name_attribute automatically
...
This is.. the currently easiest solution. As long as attribute unfolding
is not very performance intensive this solution suffices.
refs #10367
refs #10332
2015-10-16 17:25:42 +02:00
8ed489c637
LdapUserGroupBackend: Add method persistUserName()
...
refs #10367
refs #10370
2015-10-16 15:28:44 +02:00
58fc87b2e5
Repository: Ensure that we'll internally only work with virtual table names
...
refs #10367
2015-10-16 14:46:44 +02:00
1b7dc1098c
DbUserGroupBackend: Use LEFT JOIN to join the group_membership table
...
Fixes the issue that groups are not found if they do not have any members
even though they meet the where clause
2015-10-16 13:10:39 +02:00
7ef76932d4
DbRepository: Validate the table when inserting, updating and deleting
2015-10-16 12:36:47 +02:00
33037eebbb
Revert "Fix group base DN is erroneously used in place of user base DN"
...
This reverts commit ac7546d9f2
2015-10-16 10:08:14 +02:00
34bf0c3cb0
Add method getUserBackendName() to UserGroupBackendInterface
...
refs #10367
refs #10373
2015-10-15 15:28:03 +02:00
331822ad15
Merge pull request #47 from anenviousguest/master
2015-10-15 12:53:10 +02:00
ac7546d9f2
Fix group base DN is erroneously used in place of user base DN
...
refs #10340
refs #10367
Signed-off-by: Eric Lippmann <eric.lippmann@netways.de>
2015-10-15 12:52:17 +02:00
d6432cd881
LdapUserGroupBackend: Fix invalid query column initialization, again
...
I've mistakenly reverted a change from Aaron Collins that would have
prevented this issue from occuring.
fixes #10318
2015-10-09 03:53:22 +02:00
8358f82885
LdapUserGroupBackend: Do not consider every "member" as a "user"
...
Not all members of a group are actual user objects. I would have liked to
actually only show real users, but this is currently not possible.
refs #9772
2015-09-29 11:29:05 +02:00
d33b1954aa
LdapUserGroupBackend: Fetch the uid for a member's DN
...
refs #9772
2015-09-29 09:48:57 +02:00
ef1a81897b
LdapUserGroupBackend: Automatically unfold the user_name attribute
...
refs #9772
2015-09-29 09:48:22 +02:00
b7ddb6e4c2
LdapUserGroupBackend: Register the user backend for later use
...
refs #9772
2015-09-29 09:44:01 +02:00
e7e3520375
LdapUserGroupBackend: Fix method getMemberships()
...
refs #9950
2015-09-28 10:57:17 +02:00
e5f2174c1e
LdapUserGroupBackend: Restore method requireTable()
...
refs #9950
2015-09-25 16:24:16 +02:00
fe9ee48d65
LdapUserGroupBackend: Fix incorrect table name initialization
...
refs #9950
2015-09-25 16:23:13 +02:00
b19ecbfb43
LdapUserGroupBackend: Remove the remaining code duplicates
...
refs #9950
refs #9772
2015-09-25 16:21:33 +02:00
23631c8f39
changed order of posix check
...
refs #9950
Signed-off-by: Eric Lippmann <eric.lippmann@netways.de>
2015-09-25 14:35:08 +02:00
73715c94b1
Fixes for ldap group auth
...
The current LdapUserGroupBackend was incomplete and suffered from a little over zealous copy pasta. It had over written certain functions that where unnecessary such as the constructor and a table validator. This patch aims to clean those up. Additionally it also makes this group auth work with posixGroup that use the username as the member identifier and not just inetGroups that use the full dn
refs #9950
Signed-off-by: Eric Lippmann <eric.lippmann@netways.de>
2015-09-25 14:34:33 +02:00
b69311165c
Conform to coding guidelines
2015-09-22 14:53:29 +02:00
Markus Frosch
Eric Lippmann
ss23
Alexander A. Klimov
Johannes Meyer
Michael Friedrich
Johannes Meyer
Rune Darrud
Eric Lippmann
Alexander A. Klimov
Markus Frosch
Markus Frosch
Vladislav Ponomarev
Aaron Collins
Matthias Jentsch