Skip to content

Commit 85a1196

Browse files
smarcetsmarcet
committed
[smarcet] - #13099
* (openid) nonce/asocciations table cleanup cron task * refactoring redirect url ( openid)
1 parent 2b7c6ca commit 85a1196

10 files changed

Lines changed: 191 additions & 76 deletions

File tree

‎cron_jobs_scheduler/_config/schedule.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,4 +110,8 @@ jobs:
110110
- name: "RevocationExecutorTask"
111111
params: "batch_size=10000"
112112
cron_expression: "59 11 * * *"
113-
enabled: 0
113+
enabled: 0
114+
115+
- name: "OpenStackIdCleanInvalidNoncesAssocsTask"
116+
cron_expression: "00 03 * * *" # run at 0300 AM every day
117+
enabled: 1

‎openstack/code/utils/DB/CustomMySQLDatabase.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ public function transactionEnd($chain = false){
9797

9898
public function query($sql, $errorLevel = E_USER_ERROR) {
9999
$query = parent::query($sql, $errorLevel);
100-
SS_Log::log($sql, SS_Log::DEBUG);
100+
//SS_Log::log($sql, SS_Log::DEBUG);
101101
return $query;
102102
}
103103

‎openstackid/_config/injector.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,19 @@ Injector:
99
OpenStackIdMySQLStore:
1010
constructor:
1111
0: %$OpenStackIdDatabaseConnection
12-
MyOpenIDConsumer:
13-
class: Auth_OpenID_Consumer
12+
Auth_OpenID_Consumer:
1413
constructor:
15-
0: %$OpenStackIdMySQLStore
16-
1: %$SilverStripeSessionWrapper
14+
0: '%$OpenStackIdMySQLStore'
15+
1: '%$SilverStripeSessionWrapper'
1716
Security:
18-
class: OpenStackIdSecurityController
17+
class: OpenStackIdSecurityController
18+
constructor:
19+
0: '%$Auth_OpenID_Consumer'
20+
OpenStackIdAuthenticator:
21+
constructor:
22+
0: '%$MemberRepository'
23+
1: '%$OpenStackIdMySQLStore'
24+
2: '%$Auth_OpenID_Consumer'
25+
OpenStackIdCleanInvalidNoncesAssocsTask:
26+
constructor:
27+
0: '%$OpenStackIdMySQLStore'

‎openstackid/code/OpenStackIdCommon.php‎

Lines changed: 38 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,36 @@ public static function redirectToSSL($url){
2121
die("<h1>Your browser is not accepting header redirects</h1><p>Please <a href=\"$dest\">click here</a>");
2222
}
2323

24+
/**
25+
* @return string
26+
*/
2427
public static function getReturnTo()
2528
{
2629
$trust_root = self::getTrustRoot();
27-
$return_to_url = $trust_root . '/OpenStackIdAuthenticator?url=/OpenStackIdAuthenticator';
28-
$back_url = Controller::curr()->getRequest()->getVar('BackURL');
29-
if(!empty($back_url)){
30-
$back_url = self::cleanBackUrl($back_url);
31-
if(!Director::is_site_url($back_url)){
32-
$back_url = Director::absoluteBaseURL();
33-
}
34-
$fragment = Controller::curr()->getRequest()->requestVar('fragment');
35-
if(!empty($fragment)) $back_url .= $fragment;
36-
$return_to_url .= '&BackURL='.urlencode($back_url);
37-
}
38-
return $return_to_url;
30+
$return_to_url = "{$trust_root}/OpenStackIdAuthenticator?url=/OpenStackIdAuthenticator";
31+
// check first on session ...
32+
$back_url = urlencode(self::getRedirectBackUrl());
33+
return "{$return_to_url}&BackURL={$back_url}";
34+
}
35+
36+
/**
37+
* @return string
38+
*/
39+
public static function getRedirectBackUrl(){
40+
// check first on session ...
41+
$back_url = Controller::curr()->getSession()->get("BackURL");
42+
if(empty($back_url))
43+
$back_url = Controller::curr()->getRequest()->requestVar('BackURL');
44+
$fragment = Controller::curr()->getRequest()->requestVar('fragment');
45+
46+
if(empty($back_url))
47+
$back_url = Director::baseURL();
48+
if(!empty($fragment))
49+
$back_url .= $fragment;
50+
51+
$back_url = Director::absoluteURL($back_url, true);
52+
53+
return $back_url;
3954
}
4055

4156
public static function getTrustRoot()
@@ -47,28 +62,6 @@ public static function escape($thing) {
4762
return htmlentities($thing);
4863
}
4964

50-
public static function getRedirectBackUrl(){
51-
$url = null;
52-
// Don't cache the redirect back ever
53-
HTTP::set_cache_age(0);
54-
// In edge-cases, this will be called outside of a handleRequest() context; in that case,
55-
// redirect to the homepage - don't break into the global state at this stage because we'll
56-
// be calling from a test context or something else where the global state is inappropraite
57-
if($request = Controller::curr()->getRequest()) {
58-
if($request->requestVar('BackURL')) {
59-
$url = $request->requestVar('BackURL');
60-
} else if($request->isAjax() && $request->getHeader('X-Backurl')) {
61-
$url = $request->getHeader('X-Backurl');
62-
}
63-
}
64-
65-
$url = self::cleanBackUrl($url);
66-
67-
if(strpos($url,'/Security/login') !== false ) $url = Director::baseURL();
68-
69-
return $url;
70-
}
71-
7265
public static function loginMember($member, $back_url){
7366

7467
$back_url = self::cleanBackUrl($back_url);
@@ -107,4 +100,15 @@ public static function cleanBackUrl($back_url){
107100
$back_url = Director::baseURL();
108101
return $back_url;
109102
}
103+
104+
/**
105+
* @param string $message
106+
* @param string $back_url
107+
* @return SS_HTTPResponse
108+
*/
109+
public static function error($message, $back_url){
110+
Session::set("Security.Message.message", $message);
111+
Session::set("Security.Message.type", "bad");
112+
return Controller::curr()->redirect("Security/error?BackURL={$back_url}");
113+
}
110114
}

‎openstackid/code/cron_tasks/OpenStackIdCleanInvalidNoncesAssocsTask.php‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<?php
2+
/**
3+
* Copyright 2017 OpenStack Foundation
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
* http://www.apache.org/licenses/LICENSE-2.0
8+
* Unless required by applicable law or agreed to in writing, software
9+
* distributed under the License is distributed on an "AS IS" BASIS,
10+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
* See the License for the specific language governing permissions and
12+
* limitations under the License.
13+
**/
14+
15+
/**
16+
* Class OpenStackIdCleanInvalidNoncesAssocsTask
17+
*/
18+
final class OpenStackIdCleanInvalidNoncesAssocsTask extends CronTask
19+
{
20+
21+
/**
22+
* @var Auth_OpenID_OpenIDStore
23+
*/
24+
private $openid_repository;
25+
26+
public function __construct(Auth_OpenID_OpenIDStore $openid_repository)
27+
{
28+
parent::__construct();
29+
$this->openid_repository = $openid_repository;
30+
}
31+
32+
/**
33+
* @return void
34+
*/
35+
public function run()
36+
{
37+
try
38+
{
39+
$init_time = time();
40+
list($nonces_expired, $assoc_expired) = $this->openid_repository->cleanup();
41+
$finish_time = time() - $init_time;
42+
echo "nonces expired {$nonces_expired}".PHP_EOL;
43+
echo "associations expired {$assoc_expired}".PHP_EOL;
44+
echo "time elapsed : {$finish_time} seconds.".PHP_EOL;
45+
}
46+
catch(Exception $ex)
47+
{
48+
SS_Log::log($ex->getMessage(), SS_Log::ERR);
49+
}
50+
}
51+
}

‎openstackid/code/infrastructure/OpenStackIdDatabaseConnection.php‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,25 @@
1818
*/
1919
class OpenStackIdDatabaseConnection extends Auth_OpenID_DatabaseConnection {
2020

21+
/**
22+
* @var
23+
*/
24+
private $last_affected_rows;
25+
2126
public function query($sql, $params = array()) {
2227
if(($sql = $this->generateQuery($sql, $params)) === false)
2328
return false;
2429

25-
return DB::query($sql);
30+
$query = DB::query($sql);
31+
$this->last_affected_rows = $query->numRecords();
32+
return $query;
33+
}
34+
35+
/**
36+
* @return int
37+
*/
38+
public function affectedRows(){
39+
return is_null($this->last_affected_rows) ? 0 : intval($this->last_affected_rows);
2640
}
2741

2842
public function getOne($sql, $params = array()) {
@@ -69,7 +83,6 @@ function begin()
6983
DB::getConn()->transactionStart();
7084
}
7185

72-
7386
public function commit() {
7487
DB::getConn()->transactionEnd();
7588
}

‎openstackid/code/ui/OpenStackIdAuthenticator.php‎

Lines changed: 35 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,37 @@ class OpenStackIdAuthenticator extends Controller
2626
*/
2727
private $member_repository;
2828

29-
public function __construct()
29+
/**
30+
* @var Auth_OpenID_Consumer
31+
*/
32+
private $openid_consumer;
33+
34+
/**
35+
* @var Auth_OpenID_OpenIDStore
36+
*/
37+
private $openid_repository;
38+
39+
/**
40+
* OpenStackIdAuthenticator constructor.
41+
* @param IMemberRepository $member_repository
42+
* @param Auth_OpenID_OpenIDStore $openid_repository
43+
* @param Auth_OpenID_Consumer $openid_consumer
44+
*/
45+
public function __construct
46+
(
47+
IMemberRepository $member_repository,
48+
Auth_OpenID_OpenIDStore $openid_repository,
49+
Auth_OpenID_Consumer $openid_consumer
50+
)
3051
{
3152
parent::__construct();
32-
$this->member_repository = new SapphireCLAMemberRepository();
53+
$this->member_repository = $member_repository;
54+
$this->openid_repository = $openid_repository;
55+
$this->openid_consumer = $openid_consumer;
3356
}
3457

3558
function index()
3659
{
37-
3860
try {
3961

4062
$member = Member::currentUser();
@@ -43,27 +65,27 @@ function index()
4365
// user is already logged in
4466
return $this->redirect(OpenStackIdCommon::getRedirectBackUrl());
4567
}
46-
47-
$consumer = Injector::inst()->get('MyOpenIDConsumer');
48-
4968
$query = Auth_OpenID::getQuery();
69+
5070
$message = Auth_OpenID_Message::fromPostArgs($query);
5171
$nonce = $message->getArg(Auth_OpenID_OPENID2_NS,'response_nonce');
5272
list($timestamp, $salt) = Auth_OpenID_splitNonce($nonce);
5373
$claimed_id = $message->getArg(Auth_OpenID_OPENID2_NS,'claimed_id');
5474

55-
SS_Log::log(sprintf('OpenStackIdAuthenticator : id %s - salt %s - timestamp %s',$claimed_id, $salt, $timestamp), SS_Log::DEBUG);
75+
SS_Log::log(sprintf('OpenStackIdAuthenticator : id %s - salt %s - timestamp %s - query %s',$claimed_id, $salt, $timestamp, implode(', ',$query)), SS_Log::DEBUG);
5676

5777
// Complete the authentication process using the server's response.
58-
$response = $consumer->complete(OpenStackIdCommon::getReturnTo());
78+
$response = $this->openid_consumer->complete(OpenStackIdCommon::getReturnTo());
5979

6080
if ($response->status == Auth_OpenID_CANCEL) {
6181
SS_Log ::log('OpenStackIdAuthenticator : Auth_OpenID_CANCEL', SS_Log::WARN);
6282
throw new Exception('The verification was cancelled. Please try again.');
63-
6483
} else if ($response->status == Auth_OpenID_FAILURE) {
65-
SS_Log ::log('OpenStackIdAuthenticator : Auth_OpenID_FAILURE', SS_Log::WARN);
66-
throw new Exception("The OpenID authentication failed.");
84+
SS_Log ::log("OpenStackIdAuthenticator : Auth_OpenID_FAILURE {$response->message}", SS_Log::WARN);
85+
// delete associations
86+
SS_Log ::log("OpenStackIdAuthenticator : Auth_OpenID_FAILURE cleaning openid_repository ...", SS_Log::WARN);
87+
$this->openid_repository->reset();
88+
throw new Exception("The OpenID authentication failed");
6789

6890
} else if ($response->status == Auth_OpenID_SUCCESS) {
6991
SS_Log ::log('OpenStackIdAuthenticator : Auth_OpenID_SUCCESS', SS_Log::DEBUG);
@@ -98,10 +120,8 @@ function index()
98120
throw new Exception("The OpenID authentication failed: can not find user ".$openid);
99121
}
100122
} catch (Exception $ex) {
101-
Session::set("Security.Message.message", $ex->getMessage());
102-
Session::set("Security.Message.type", "bad");
103-
SS_Log ::log($ex, SS_Log::DEBUG);
104-
return $this->redirect("Security/badlogin");
123+
SS_Log ::log($ex, SS_Log::WARN);
124+
return OpenStackIdCommon::error($ex->getMessage(), OpenStackIdCommon::getRedirectBackUrl());
105125
}
106126
}
107127

0 commit comments

Comments
 (0)