WebAuthnController.php 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2020, Roeland Jago Douma <roeland@famdouma.nl>
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Roeland Jago Douma <roeland@famdouma.nl>
  8. * @author Richard Steinmetz <richard@steinmetz.cloud>
  9. *
  10. * @license GNU AGPL version 3 or any later version
  11. *
  12. * This program is free software: you can redistribute it and/or modify
  13. * it under the terms of the GNU Affero General Public License as
  14. * published by the Free Software Foundation, either version 3 of the
  15. * License, or (at your option) any later version.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  24. *
  25. */
  26. namespace OC\Core\Controller;
  27. use OC\Authentication\Login\LoginData;
  28. use OC\Authentication\Login\WebAuthnChain;
  29. use OC\Authentication\WebAuthn\Manager;
  30. use OC\URLGenerator;
  31. use OCP\AppFramework\Controller;
  32. use OCP\AppFramework\Http;
  33. use OCP\AppFramework\Http\JSONResponse;
  34. use OCP\IRequest;
  35. use OCP\ISession;
  36. use OCP\Util;
  37. use Psr\Log\LoggerInterface;
  38. use Webauthn\PublicKeyCredentialRequestOptions;
  39. class WebAuthnController extends Controller {
  40. private const WEBAUTHN_LOGIN = 'webauthn_login';
  41. private const WEBAUTHN_LOGIN_UID = 'webauthn_login_uid';
  42. private Manager $webAuthnManger;
  43. private ISession $session;
  44. private LoggerInterface $logger;
  45. private WebAuthnChain $webAuthnChain;
  46. private UrlGenerator $urlGenerator;
  47. public function __construct($appName, IRequest $request, Manager $webAuthnManger, ISession $session, LoggerInterface $logger, WebAuthnChain $webAuthnChain, URLGenerator $urlGenerator) {
  48. parent::__construct($appName, $request);
  49. $this->webAuthnManger = $webAuthnManger;
  50. $this->session = $session;
  51. $this->logger = $logger;
  52. $this->webAuthnChain = $webAuthnChain;
  53. $this->urlGenerator = $urlGenerator;
  54. }
  55. /**
  56. * @NoAdminRequired
  57. * @PublicPage
  58. * @UseSession
  59. */
  60. public function startAuthentication(string $loginName): JSONResponse {
  61. $this->logger->debug('Starting WebAuthn login');
  62. $this->logger->debug('Converting login name to UID');
  63. $uid = $loginName;
  64. Util::emitHook(
  65. '\OCA\Files_Sharing\API\Server2Server',
  66. 'preLoginNameUsedAsUserName',
  67. ['uid' => &$uid]
  68. );
  69. $this->logger->debug('Got UID: ' . $uid);
  70. $publicKeyCredentialRequestOptions = $this->webAuthnManger->startAuthentication($uid, $this->request->getServerHost());
  71. $this->session->set(self::WEBAUTHN_LOGIN, json_encode($publicKeyCredentialRequestOptions));
  72. $this->session->set(self::WEBAUTHN_LOGIN_UID, $uid);
  73. return new JSONResponse($publicKeyCredentialRequestOptions);
  74. }
  75. /**
  76. * @NoAdminRequired
  77. * @PublicPage
  78. * @UseSession
  79. */
  80. public function finishAuthentication(string $data): JSONResponse {
  81. $this->logger->debug('Validating WebAuthn login');
  82. if (!$this->session->exists(self::WEBAUTHN_LOGIN) || !$this->session->exists(self::WEBAUTHN_LOGIN_UID)) {
  83. $this->logger->debug('Trying to finish WebAuthn login without session data');
  84. return new JSONResponse([], Http::STATUS_BAD_REQUEST);
  85. }
  86. // Obtain the publicKeyCredentialOptions from when we started the registration
  87. $publicKeyCredentialRequestOptions = PublicKeyCredentialRequestOptions::createFromString($this->session->get(self::WEBAUTHN_LOGIN));
  88. $uid = $this->session->get(self::WEBAUTHN_LOGIN_UID);
  89. $this->webAuthnManger->finishAuthentication($publicKeyCredentialRequestOptions, $data, $uid);
  90. //TODO: add other parameters
  91. $loginData = new LoginData(
  92. $this->request,
  93. $uid,
  94. ''
  95. );
  96. $this->webAuthnChain->process($loginData);
  97. return new JSONResponse([
  98. 'defaultRedirectUrl' => $this->urlGenerator->linkToDefaultPageUrl(),
  99. ]);
  100. }
  101. }