SSO and Admin Login

karimg

Joined: 2012-05-18
Posts: 6
Posted: Fri, 2012-05-18 14:37

Hi,

we wanted to merge the gallery3 login-script with our htaccess-login so the user don't have to login two times.. that worked well for the user accounts but when I tried to log in as admin it told me to reauthenticate because my administration session is expired.

Thanks to the SSO-plugin that did not work so I decided to re-write the reauthentication-procedure.

I added the following lines to create the session manually:

Quote:
file: /modules/gallery/controllers/reauthenticate.php
in function: _show_form($form)
I added the following lines:
auth::login(IdentityProvider::instance()->admin_user());
header("location: index.php/admin");

That's not the best solution but it works for now. If anyone got a better and safer idea, please let me know.

Regards,

Karim
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 25968
Posted: Fri, 2012-05-18 17:14

I'm no security expert..
Doesn't that give the whoever is logged in to be a admin_user?

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team
 
karimg

Joined: 2012-05-18
Posts: 6
Posted: Fri, 2012-05-18 21:10

Yeah that pretty much describes our problem.. It's a big security hole they should fix.. sure we could add an if-statement to check if the user is administrator, but that's not secure at all..

Is there anyone who could fix the admin-bug in the SSO-plugin?

Karim
 
floridave
floridave's picture

Joined: 2003-12-22
Posts: 25968
Posted: Fri, 2012-05-18 22:32

No docs for the module and only 2 files:
https://github.com/gallery/gallery3-contrib/tree/master/3.0/modules/sso
so I guess your on your own.

Dave
_____________________________________________
Blog & G2 || floridave - Gallery Team
 
karimg

Joined: 2012-05-18
Posts: 6
Posted: Fri, 2012-05-18 22:38

Damn.. are there any alternative htaccess-authentifications or do we have to live with that unsecure solution?

Karim
 
jnash
jnash's picture

Joined: 2004-08-02
Posts: 613
Posted: Fri, 2012-05-18 22:48

I would be willing to guess you could add these lines in to the sso_event.php wrapped around with an if admin

untested, but you could try:

right after the try {

if($sso_username == "admin"){
   auth::login(IdentityProvider::instance()->admin_user());
   header("location: index.php/admin"); 
}
 
karimg

Joined: 2012-05-18
Posts: 6
Posted: Fri, 2012-05-18 23:04

Yeah but that's hard-coded.. so it only takes the user "admin" as admin.. I want to give all users from the admin-group defined in the gallery admin permissions..
 
jnash
jnash's picture

Joined: 2004-08-02
Posts: 613
Posted: Fri, 2012-05-18 23:31

ah, I see... let me think about that for a moment then. Should be simple enough if the code I shared above worked... can you confirm that?
 
jnash
jnash's picture

Joined: 2004-08-02
Posts: 613
Posted: Fri, 2012-05-18 23:37

okay, after the:

      try {
        identity::set_active_user(identity::lookup_user_by_name($sso_username));

add the following instead of what I previously suggested in the post above:

  if(identity::active_user()->admin){
    auth::login(IdentityProvider::instance()->admin_user());
    header("location: index.php/admin"); 
  }
 
karimg

Joined: 2012-05-18
Posts: 6
Posted: Mon, 2012-05-21 17:27

Yeah that works but it somehow still messes up the permissions.. it denies all actions I want to do like uploading images or creating a new gallery. When I'm manually setting the permissions to true, it creates new pictures and gallerys but the user is always "Guest User"
 
jnash
jnash's picture

Joined: 2004-08-02
Posts: 613
Posted: Mon, 2012-05-21 19:10

I'm guessing the session is not being set for the admin user as it would be through the authentication mechanism. I'm not sure how to proceed unfortunately.
 
karimg

Joined: 2012-05-18
Posts: 6
Posted: Tue, 2012-05-22 16:19

Looks like it doesn't set a user session at all.. I tried to set it manually on login but that did not work..
 
tkott

Joined: 2010-06-07
Posts: 225
Posted: Sun, 2012-05-27 00:40

Maybe try

Session::instance()->regenerate();

Right after the auth::login, but before the header. I would also recommend switching to:

url::redirect("index.php/admin")

EDIT: Ok, I think this should get the code displaying correctly...

----
Publish on Gallery 3 (WLPG Plugin) | XMP Module