OpenXE/classes/Modules/Api/Auth/DigestAuth.php

<?php

namespace Xentral\Modules\Api\Auth;

use Xentral\Components\Database\Database;
use Xentral\Components\Http\Request;
use Xentral\Modules\Api\Error\ApiError;
use Xentral\Modules\Api\Exception\AuthorizationErrorException;

class DigestAuth
{
    /** @var Database $db */
    protected $db;

    /** @var Request $request */
    protected $request;

    /** @var bool $isAuthenticated Authentifizierung erfolgreich? */
    protected $isAuthenticated = false;

    /** @var bool $checkNonceCount Soll der NonceCount geprüft werden? */
    protected $checkNonceCount = false;

    /** @var int $nonceMaxAge Maximales Alter in Sekunden (86400 = 24 Stunden) */
    protected $nonceMaxAge = 86400;

    /** @var string $realm */
    protected $realm = 'Xentral-API';

    /** @var string $nonce Server-Nonce */
    protected $nonce;

    /** @var string $opaque */
    protected $opaque;

    /** @var array $digestParts Header-Bestandteile für Digest-Authentifizierung */
    protected $digestParts;

    /** @var int|null $apiAccountId */
    protected $apiAccountId;

    /**
     * @param Database $db
     * @param Request $request
     */
    public function __construct($db, $request)
    {
        $this->db = $db;
        $this->request = $request;

        // 30 Tage alte Serverkey löschen
        if (mt_rand(0, 99) === 0) {
            $this->db->exec('DELETE FROM `api_keys` WHERE zeitstempel < DATE_SUB(CURRENT_DATE, INTERVAL 30 DAY)');
        }
    }

    /**
     * @return void
     */
    public function checkLogin()
    {
        $authHeader = $this->getAuthorizationRequestHeader();
        if (!$authHeader) {
            throw new AuthorizationErrorException(
                'Unauthorized. You need to login.',
                ApiError::CODE_UNAUTHORIZED
            );
        }

        if (stripos($authHeader, 'digest ') !== 0) {
            throw new AuthorizationErrorException(
                'Authorization type not allowed.',
                ApiError::CODE_AUTH_TYPE_NOT_ALLOWED
            );
        }

        $digestHeader = $this->getDigestRequestHeader();
        if (!$digestHeader) {
            throw new AuthorizationErrorException(
                'Unauthorized. You need to login.',
                ApiError::CODE_UNAUTHORIZED
            );
        }

        // Parameter für Authentifizierung extrahieren
        $this->digestParts = $this->parseDigest($digestHeader);
        // Benötigte Teile im Digest-Header fehlen
        if ($this->digestParts === false) {
            throw new AuthorizationErrorException(
                'Authorization failure',
                ApiError::CODE_DIGEST_HEADER_INCOMPLETE
            );
        }

        // Benutzername wurde leer eingegeben
        if (empty($this->digestParts['username'])) {
            throw new AuthorizationErrorException(
                'Authorization failure. Username is empty.',
                ApiError::CODE_AUTH_USERNAME_EMPTY
            );
        }

        // Alle aktiven API-Zugänge aus DB laden
        $apiAccounts = $this->db->fetchAll(
            'SELECT a.remotedomain as appname, a.initkey, a.id FROM api_account AS a WHERE a.aktiv = 1'
        );

        if (empty($apiAccounts)) {
            throw new AuthorizationErrorException(
                'Authorization failure. API Account not existing.',
                ApiError::CODE_API_ACCOUNT_MISSING
            );
        }

        foreach ($apiAccounts as $account) {
            $validUser = $account['appname'];
            $validPass = $account['initkey'];

            // Username im Header stimmt nicht mit Account überein
            if ($validUser !== $this->digestParts['username']) {
                continue; // Nächsten Account probieren
            }

            // Digest-Algo validieren
            if (!$this->validateDigestLogin($validUser, $validPass)) {
                continue; // Mit nächsten Account weitermachen

                // @todo API-Accounts mit gleichen Usernamen verhindern?
                //throw new AuthorizationErrorException(
                //'Validation failure. Digest not valid.',
                // ApiError::CODE_DIGEST_VALIDDATION_FAILED
                //);
            }

            // Key-Details aus DB laden
            $keyDetails = $this->getKeyDetails($this->digestParts['nonce'], $this->digestParts['opaque']);

            // Authentifizierung war gültig; Serverkeys sind aber abgelaufen, oder Client hat sich die Keys ausgedacht
            if (!$keyDetails) {
                $this->nonce = $this->opaque = null;
                throw new AuthorizationErrorException(
                    'Authorization failure. Nonce is invalid or expired.',
                    ApiError::CODE_DIGEST_NONCE_INVALID
                );
            }

            // Serverkeys sind abgelaufen (aber noch vorhanden in DB)
            if ($keyDetails['age'] > $this->nonceMaxAge) {
                $this->nonce = $this->opaque = null;
                throw new AuthorizationErrorException(
                    'Authorization failure. Nonce is expired.',
                    ApiError::CODE_DIGEST_NONCE_EXPIRED
                );
            }

            // NonceCount prüfen?
            if ($this->checkNonceCount) {
                // NonceCount zu Hexadezimal wandeln
                $nonceCountHex = dechex($keyDetails['nonce_count_decimal']);
                $this->digestParts['nc'] = ltrim($this->digestParts['nc'], '0');

                // NonceCount stimmt nicht überein
                if ($this->digestParts['nc'] !== $nonceCountHex) {
                    throw new AuthorizationErrorException(
                        'Authorization failure. Nonce count doesn\'t match.',
                        ApiError::CODE_DIGEST_NC_NOT_MATCHING
                    );
                }
            }

            // NonceCount in DB hochzählen
            $this->incrementNonceCount($this->digestParts['nonce']);

            // Wenn bis hierhin kein Fehler passiert ist, passt alles.
            // Serverkeys sind noch gültig
            $this->isAuthenticated = true;
            $this->apiAccountId = (int)$account['id'];
            return;
        }

        // Alle Accounts durchprobiert > Kein Erfolg
        throw new AuthorizationErrorException(
            'Authorization failure. API Account invalid.',
            ApiError::CODE_API_ACCOUNT_INVALID
        );
    }

    /**
     * @return bool
     */
    public function isAuthenticated()
    {
        return $this->isAuthenticated;
    }

    /**
     * @return int|null
     */
    public function getApiAccountId()
    {
        return $this->apiAccountId;
    }

    /**
     * Header-String generieren den der Client zum Authentifizieren benötigt
     *
     * @return string
     */
    public function generateAuthenticationString()
    {
        // Neue Server-Key generieren
        if (!$this->nonce && !$this->opaque) {
            $this->createServerKeys();
        }

        return sprintf(
            'Digest realm="%s",qop="auth",nonce="%s",opaque="%s"',
            $this->realm, $this->nonce, $this->opaque
        );
    }

    /**
     * @param string $nonce
     * @param string $opaque
     *
     * @return array|bool
     */
    protected function getKeyDetails($nonce, $opaque)
    {
        if (empty($nonce) || empty($opaque)) {
            return false;
        }

        $keyDetails = $this->db->fetchAll(
            'SELECT k.nonce_count, k.zeitstempel FROM api_keys AS k '.
            'WHERE k.nonce = :nonce AND k.opaque = :opaque',
            array('nonce' => $nonce, 'opaque' => $opaque)
        );

        if (count($keyDetails) === 0) {
            return false;
        }

        return array(
            'nonce_count_decimal' => (int)$keyDetails[0]['nonce_count'],
            'age' => time() - strtotime($keyDetails[0]['zeitstempel']),
        );
    }

    /**
     * @param string $username
     * @param string $password
     *
     * @return bool Digest-Auth valide?
     */
    protected function validateDigestLogin($username, $password)
    {
        // Based on all the info we gathered we can figure out what the response should be
        $A1 = md5("{$username}:{$this->realm}:{$password}");
        $A2 = md5("{$this->request->getMethod()}:".stripslashes($this->request->getRequestUri()));

        // Im 'auth-int' Modus muss zusätzlich der Request-Body validiert werden
        if ($this->digestParts['qop'] === 'auth-int') {
            $A2 = md5("{$this->request->getMethod()}:".stripslashes($this->request->getRequestUri()).":{$this->request->getContent()}");
        }

        $validResponse = md5("{$A1}:{$this->digestParts['nonce']}:{$this->digestParts['nc']}:{$this->digestParts['cnonce']}:{$this->digestParts['qop']}:{$A2}");

        return ($this->digestParts['response'] === $validResponse);
    }

    /**
     * @param string $nonce
     */
    protected function incrementNonceCount($nonce)
    {
        $this->db->perform(
            'UPDATE api_keys SET nonce_count = nonce_count + 1 WHERE nonce = :nonce',
            array('nonce' => $nonce)
        );
    }

    /**
     * Neue Server-Keys (Nonce und Opaque) generieren und in DB ablegen
     */
    protected function createServerKeys()
    {
        $this->nonce = md5(uniqid('', true));
        $this->opaque = md5(uniqid('', true));

        // Neue Keys in Datenbank speichern
        $this->db->perform(
            'INSERT INTO api_keys (id, nonce, opaque) VALUES (NULL, :nonce, :opaque)',
            array('nonce' => $this->nonce, 'opaque' => $this->opaque)
        );
    }

    /**
     * This function returns the digest header
     *
     * @return string|false
     */
    protected function getDigestRequestHeader()
    {
        $authHeader = $this->getAuthorizationRequestHeader();
        if (stripos($authHeader, 'digest ') === 0) {
            return substr_replace($authHeader, '', 0, 7);
        }

        return false;
    }

    /**
     * Einzelnen Request-Header auslesen
     *
     * @param string $type z.B. "Authorization" oder "Content-Type"
     *
     * @return string|false
     */
    protected function getRequestHeader($type)
    {
        if ($this->request->header->has($type)) {
            return $this->request->header->get($type);
        }

        return false;
    }

    /**
     * @return string|false
     */
    protected function getAuthorizationRequestHeader()
    {
        return $this->getRequestHeader('Authorization');
    }

    /**
     * Digest-Header in einzelne Bestandteile zerlegen, und prüfen ob alle benötigten Teile vorhanden sind.
     *
     * @param string $digest
     *
     * @return array|false Einzelne Bestandteile als Array, oder false wenn Teile fehlen
     */
    protected function parseDigest($digest)
    {
        $neededParts = array(
            'nonce' => false,
            'opaque' => false,
            'nc' => false,
            'cnonce' => false,
            'qop' => false,
            'username' => false,
            'uri' => false,
            'response' => false,
        );
        $data = array();

        // Beispiel: username="Test", realm="API", nonce="5b308bec108f0", uri="/api/addresses", qop=auth, nc=00000029, ...
        $parts = explode(',', $digest);
        foreach ($parts as $part) {
            $atoms = explode('=', $part, 2);
            if (count($atoms) !== 2) {
                continue;
            }

            $key = trim($atoms[0], ' ');
            $val = trim($atoms[1], '"');
            $data[$key] = $val;
            unset($neededParts[$key]);
        }

        return empty($neededParts) ? $data : false;
    }
}