WebAuthnController.php 3.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Roeland Jago Douma <roeland@famdouma.nl>
  8. * @author Richard Steinmetz <richard@steinmetz.cloud>
  9. *
  10. * @license GNU AGPL version 3 or any later version
  11. *
  12. * This program is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License as
  14. * published by the Free Software Foundation, either version 3 of the
  15. * License, or (at your option) any later version.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  24. *
  25. */
  26. namespace OC\Core\Controller;
  27. use OC\Authentication\Login\LoginData;
  28. use OC\Authentication\Login\WebAuthnChain;
  29. use OC\Authentication\WebAuthn\Manager;
  30. use OC\URLGenerator;
  31. use OCP\AppFramework\Controller;
  32. use OCP\AppFramework\Http;
  33. use OCP\AppFramework\Http\Attribute\FrontpageRoute;
  34. use OCP\AppFramework\Http\Attribute\UseSession;
  35. use OCP\AppFramework\Http\JSONResponse;
  36. use OCP\IRequest;
  37. use OCP\ISession;
  38. use OCP\Util;
  39. use Psr\Log\LoggerInterface;
  40. use Webauthn\PublicKeyCredentialRequestOptions;
  41. class WebAuthnController extends Controller {
  42. private const WEBAUTHN_LOGIN = 'webauthn_login';
  43. private const WEBAUTHN_LOGIN_UID = 'webauthn_login_uid';
  44. public function __construct(
  45. string $appName,
  46. IRequest $request,
  47. private Manager $webAuthnManger,
  48. private ISession $session,
  49. private LoggerInterface $logger,
  50. private WebAuthnChain $webAuthnChain,
  51. private URLGenerator $urlGenerator,
  52. ) {
  53. parent::__construct($appName, $request);
  54. }
  55. /**
  56. * @NoAdminRequired
  57. * @PublicPage
  58. */
  59. #[UseSession]
  60. #[FrontpageRoute(verb: 'POST', url: 'login/webauthn/start')]
  61. public function startAuthentication(string $loginName): JSONResponse {
  62. $this->logger->debug('Starting WebAuthn login');
  63. $this->logger->debug('Converting login name to UID');
  64. $uid = $loginName;
  65. Util::emitHook(
  66. '\OCA\Files_Sharing\API\Server2Server',
  67. 'preLoginNameUsedAsUserName',
  68. ['uid' => &$uid]
  69. );
  70. $this->logger->debug('Got UID: ' . $uid);
  71. $publicKeyCredentialRequestOptions = $this->webAuthnManger->startAuthentication($uid, $this->request->getServerHost());
  72. $this->session->set(self::WEBAUTHN_LOGIN, json_encode($publicKeyCredentialRequestOptions));
  73. $this->session->set(self::WEBAUTHN_LOGIN_UID, $uid);
  74. return new JSONResponse($publicKeyCredentialRequestOptions);
  75. }
  76. /**
  77. * @NoAdminRequired
  78. * @PublicPage
  79. */
  80. #[UseSession]
  81. #[FrontpageRoute(verb: 'POST', url: 'login/webauthn/finish')]
  82. public function finishAuthentication(string $data): JSONResponse {
  83. $this->logger->debug('Validating WebAuthn login');
  84. if (!$this->session->exists(self::WEBAUTHN_LOGIN) || !$this->session->exists(self::WEBAUTHN_LOGIN_UID)) {
  85. $this->logger->debug('Trying to finish WebAuthn login without session data');
  86. return new JSONResponse([], Http::STATUS_BAD_REQUEST);
  87. }
  88. // Obtain the publicKeyCredentialOptions from when we started the registration
  89. $publicKeyCredentialRequestOptions = PublicKeyCredentialRequestOptions::createFromString($this->session->get(self::WEBAUTHN_LOGIN));
  90. $uid = $this->session->get(self::WEBAUTHN_LOGIN_UID);
  91. $this->webAuthnManger->finishAuthentication($publicKeyCredentialRequestOptions, $data, $uid);
  92. //TODO: add other parameters
  93. $loginData = new LoginData(
  94. $this->request,
  95. $uid,
  96. ''
  97. );
  98. $this->webAuthnChain->process($loginData);
  99. return new JSONResponse([
  100. 'defaultRedirectUrl' => $this->urlGenerator->linkToDefaultPageUrl(),
  101. ]);
  102. }
  103. }