diff --git a/ldap_authentication/ldap_authentication.install b/ldap_authentication/ldap_authentication.install index 8b6f8c5..042d11b 100644 --- a/ldap_authentication/ldap_authentication.install +++ b/ldap_authentication/ldap_authentication.install @@ -40,6 +40,28 @@ function ldap_authentication_uninstall() { variable_del('ldap_authentication_conf'); } +/** + * Implements hook_enable(). + */ +function ldap_authentication_enable() { + // store old file path to be able to restore it when this module gets disabled again + variable_set('ldap_authentication_old_password_inc', variable_get('password_inc', 'includes/password.inc')); + + // set file path to our own password.inc + variable_set('password_inc', drupal_get_path('module', 'ldap_authentication') . '/ldap_authentication.password.inc'); +} + +/** + * Implements hook_disable(). + */ +function ldap_authentication_disable() { + // restore file path to previous value + variable_set('password_inc', variable_get('ldap_authentication_old_password_inc', 'includes/password.inc')); + + // delete our variable + variable_del('ldap_authentication_old_password_inc'); +} + /** * ldap_authentication and ldap_sso. enable ldap_sso if sso was enabled in ldap_authentication previously */ diff --git a/ldap_authentication/ldap_authentication.password.inc b/ldap_authentication/ldap_authentication.password.inc new file mode 100644 index 0000000..3285862 --- /dev/null +++ b/ldap_authentication/ldap_authentication.password.inc @@ -0,0 +1,322 @@ +uid == 1) { + // User 1 is always being authenticated via Drupal + return core_user_check_password($password, $account); + } + elseif ($auth_conf->authenticationMode == 1) { + // Mixed authentication mode => check via Drupal first + if (core_user_check_password($password, $account)) { + return TRUE; + } + } + + // If we're using sso then a password check would be meaningless, since we have no password + $sso_login = FALSE; + $authname = $account->name; + $watchdog_tokens = array('%username' => $authname, '%authname' => $authname); + + ldap_servers_module_load_include('inc', 'ldap_authentication', 'ldap_authentication'); + list($authentication_result, , ) = ldap_authentication_test_credentials($auth_conf, $sso_login, $authname, $password, $watchdog_tokens); + + return $authentication_result == LDAP_AUTHENTICATION_RESULT_SUCCESS; +} + +/** + * Hash a password using a secure hash. + * + * @param $password + * A plain-text password. + * @internal param $count_log2 Optional integer to specify the iteration count. Generally used only during* Optional integer to specify the iteration count. Generally used only during + * mass operations where a value less than the default is needed for speed. + * + * @return bool|string A string containing the hashed password (and a salt), or FALSE on failure. + */ +function user_hash_password($password) { + // Drupal requires a hash even though a user is not being authenticating using this hash + // so this would actually be useless, unless mixed authentication mode is enabled + // and user 1 is always authenticated via Drupal + if (empty($count_log2)) { + // Use the standard iteration count. + $count_log2 = variable_get('password_count_log2', DRUPAL_HASH_COUNT); + } + return _password_crypt('sha512', $password, _password_generate_salt($count_log2)); +} + +/** + * Check whether a user's hashed password needs to be replaced with a new hash. + * + * This is typically called during the login process when the plain text + * password is available. A new hash is needed when the desired iteration count + * has changed through a change in the variable password_count_log2 or + * DRUPAL_HASH_COUNT or if the user's password hash was generated in an update + * like user_update_7000(). + * + * Alternative implementations of this function might use other criteria based + * on the fields in $account. + * + * @param $account + * A user object with at least the fields from the {users} table. + * + * @return bool TRUE or FALSE. + */ +function user_needs_new_hash($account) { + // Drupal requires a hash even though a user is not being authenticating using this hash + // so this would actually be useless, unless mixed authentication mode is enabled + // and user 1 is always authenticated via Drupal + // Check whether this was an updated password. + if ((substr($account->pass, 0, 3) != '$S$') || (strlen($account->pass) != DRUPAL_HASH_LENGTH)) { + return TRUE; + } + // Ensure that $count_log2 is within set bounds. + $count_log2 = _password_enforce_log2_boundaries(variable_get('password_count_log2', DRUPAL_HASH_COUNT)); + // Check whether the iteration count used differs from the standard number. + return (_password_get_count_log2($account->pass) !== $count_log2); +} + +/** + * Check whether a plain text password matches a stored hashed password. + * + * Alternative implementations of this function may use other data in the + * $account object, for example the uid to look up the hash in a custom table + * or remote database. + * + * @param $password + * A plain-text password + * @param $account + * A user object with at least the fields from the {users} table. + * + * @return bool TRUE or FALSE. + */ +function core_user_check_password($password, $account) { + if (substr($account->pass, 0, 2) == 'U$') { + // This may be an updated password from user_update_7000(). Such hashes + // have 'U' added as the first character and need an extra md5(). + $stored_hash = substr($account->pass, 1); + $password = md5($password); + } + else { + $stored_hash = $account->pass; + } + + $type = substr($stored_hash, 0, 3); + switch ($type) { + case '$S$': + // A normal Drupal 7 password using sha512. + $hash = _password_crypt('sha512', $password, $stored_hash); + break; + case '$H$': + // phpBB3 uses "$H$" for the same thing as "$P$". + case '$P$': + // A phpass password generated using md5. This is an + // imported password or from an earlier Drupal version. + $hash = _password_crypt('md5', $password, $stored_hash); + break; + default: + return FALSE; + } + + return ($hash && $stored_hash == $hash); +} + +/** + * Hash a password using a secure stretched hash. + * + * By using a salt and repeated hashing the password is "stretched". Its + * security is increased because it becomes much more computationally costly + * for an attacker to try to break the hash by brute-force computation of the + * hashes of a large number of plain-text words or strings to find a match. + * + * @param $algo + * The string name of a hashing algorithm usable by hash(), like 'sha256'. + * @param $password + * The plain-text password to hash. + * @param $setting + * An existing hash or the output of _password_generate_salt(). Must be + * at least 12 characters (the settings and salt). + * + * @return bool|string A string containing the hashed password (and salt) or FALSE on failure. + */ +function _password_crypt($algo, $password, $setting) { + // The first 12 characters of an existing hash are its setting string. + $setting = substr($setting, 0, 12); + + if ($setting[0] != '$' || $setting[2] != '$') { + return FALSE; + } + $count_log2 = _password_get_count_log2($setting); + // Hashes may be imported from elsewhere, so we allow != DRUPAL_HASH_COUNT + if ($count_log2 < DRUPAL_MIN_HASH_COUNT || $count_log2 > DRUPAL_MAX_HASH_COUNT) { + return FALSE; + } + $salt = substr($setting, 4, 8); + // Hashes must have an 8 character salt. + if (strlen($salt) != 8) { + return FALSE; + } + + // Convert the base 2 logarithm into an integer. + $count = 1 << $count_log2; + + // We rely on the hash() function being available in PHP 5.2+. + $hash = hash($algo, $salt . $password, TRUE); + do { + $hash = hash($algo, $hash . $password, TRUE); + } while (--$count); + + $len = strlen($hash); + $output = $setting . _password_base64_encode($hash, $len); + // _password_base64_encode() of a 16 byte MD5 will always be 22 characters. + // _password_base64_encode() of a 64 byte sha512 will always be 86 characters. + $expected = 12 + ceil((8 * $len) / 6); + return (strlen($output) == $expected) ? substr($output, 0, DRUPAL_HASH_LENGTH) : FALSE; +} + +/** + * Parse the log2 iteration count from a stored hash or setting string. + */ +function _password_get_count_log2($setting) { + $itoa64 = _password_itoa64(); + return strpos($itoa64, $setting[3]); +} + +/** + * Returns a string for mapping an int to the corresponding base 64 character. + */ +function _password_itoa64() { + return './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'; +} + +/** + * Encodes bytes into printable base 64 using the *nix standard from crypt(). + * + * @param $input + * The string containing bytes to encode. + * @param $count + * The number of characters (bytes) to encode. + * + * @return string Encoded string + */ +function _password_base64_encode($input, $count) { + $output = ''; + $i = 0; + $itoa64 = _password_itoa64(); + do { + $value = ord($input[$i++]); + $output .= $itoa64[$value & 0x3f]; + if ($i < $count) { + $value |= ord($input[$i]) << 8; + } + $output .= $itoa64[($value >> 6) & 0x3f]; + if ($i++ >= $count) { + break; + } + if ($i < $count) { + $value |= ord($input[$i]) << 16; + } + $output .= $itoa64[($value >> 12) & 0x3f]; + if ($i++ >= $count) { + break; + } + $output .= $itoa64[($value >> 18) & 0x3f]; + } while ($i < $count); + + return $output; +} + +/** + * Generates a random base 64-encoded salt prefixed with settings for the hash. + * + * Proper use of salts may defeat a number of attacks, including: + * - The ability to try candidate passwords against multiple hashes at once. + * - The ability to use pre-hashed lists of candidate passwords. + * - The ability to determine whether two users have the same (or different) + * password without actually having to guess one of the passwords. + * + * @param $count_log2 + * Integer that determines the number of iterations used in the hashing + * process. A larger value is more secure, but takes more time to complete. + * + * @return string A 12 character string containing the iteration count and a random salt. + */ +function _password_generate_salt($count_log2) { + $output = '$S$'; + // Ensure that $count_log2 is within set bounds. + $count_log2 = _password_enforce_log2_boundaries($count_log2); + // We encode the final log2 iteration count in base 64. + $itoa64 = _password_itoa64(); + $output .= $itoa64[$count_log2]; + // 6 bytes is the standard salt for a portable phpass hash. + $output .= _password_base64_encode(drupal_random_bytes(6), 6); + return $output; +} + +/** + * Ensures that $count_log2 is within set bounds. + * + * @param $count_log2 + * Integer that determines the number of iterations used in the hashing + * process. A larger value is more secure, but takes more time to complete. + * + * @return int Integer within set bounds that is closest to $count_log2. + */ +function _password_enforce_log2_boundaries($count_log2) { + if ($count_log2 < DRUPAL_MIN_HASH_COUNT) { + return DRUPAL_MIN_HASH_COUNT; + } + elseif ($count_log2 > DRUPAL_MAX_HASH_COUNT) { + return DRUPAL_MAX_HASH_COUNT; + } + + return (int) $count_log2; +}