134 lines
3.7 KiB
Perl
134 lines
3.7 KiB
Perl
package Koha::Auth::TwoFactorAuth;
|
|
|
|
# This file is part of Koha.
|
|
#
|
|
# Koha is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Koha is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Koha; if not, see <https://www.gnu.org/licenses>.
|
|
|
|
use Modern::Perl;
|
|
use GD::Barcode;
|
|
use MIME::Base64 qw( encode_base64 );
|
|
|
|
use C4::Context;
|
|
use C4::Letters;
|
|
use Koha::Exceptions;
|
|
use Koha::Exceptions::Patron;
|
|
|
|
use base qw( Auth::GoogleAuth );
|
|
|
|
=head1 NAME
|
|
|
|
Koha::Auth::TwoFactorAuth- Koha class deal with Two factor authentication
|
|
|
|
=head1 SYNOPSIS
|
|
|
|
use Koha::Auth::TwoFactorAuth;
|
|
|
|
my $secret = Koha::AuthUtils::generate_salt( 'weak', 16 );
|
|
my $auth = Koha::Auth::TwoFactorAuth->new({ patron => $patron, secret => $secret });
|
|
my $image_src = $auth->qr_code;
|
|
my $ok = $auth->verify( $pin_code, 1 );
|
|
|
|
It's based on Auth::GoogleAuth
|
|
|
|
=head2 METHODS
|
|
|
|
=head3 new
|
|
|
|
$obj = Koha::Auth::TwoFactorAuth->new({ patron => $p, secret => $s });
|
|
|
|
Patron is mandatory.
|
|
Secret is optional, defaults to patron's secret.
|
|
Passing secret32 overrules secret! Secret32 should be base32.
|
|
|
|
=cut
|
|
|
|
sub new {
|
|
my ( $class, $params ) = @_;
|
|
my $patron = $params->{patron};
|
|
my $secret32 = $params->{secret32};
|
|
my $secret = $params->{secret};
|
|
|
|
# FIXME Raise an exception if the syspref is disabled
|
|
|
|
Koha::Exceptions::MissingParameter->throw("Mandatory patron parameter missing")
|
|
unless $patron && ref($patron) eq 'Koha::Patron';
|
|
|
|
my $type = 'secret32';
|
|
if ($secret32) {
|
|
Koha::Exceptions::BadParameter->throw("Secret32 should be base32")
|
|
if $secret32 =~ /[^a-z2-7]/;
|
|
} elsif ($secret) {
|
|
$type = 'secret';
|
|
} elsif ( $patron->secret ) {
|
|
$secret32 = $patron->decoded_secret; # saved already in base32
|
|
} else {
|
|
Koha::Exceptions::MissingParameter->throw("No secret passed or patron has no secret");
|
|
}
|
|
|
|
my $issuer = Encode::encode_utf8( $patron->library->branchname );
|
|
my $key_id = sprintf "%s_%s",
|
|
$issuer, ( $patron->email || $patron->userid );
|
|
|
|
return $class->SUPER::new(
|
|
{
|
|
$type => $secret32 || $secret,
|
|
issuer => $issuer,
|
|
key_id => $key_id,
|
|
}
|
|
);
|
|
}
|
|
|
|
=head3 qr_code
|
|
|
|
my $image_src = $auth->qr_code;
|
|
|
|
Replacement for (unsafer) Auth::GoogleAuth::qr_code.
|
|
Returns the data URL to fill the src attribute of the
|
|
image tag on the registration form.
|
|
|
|
=cut
|
|
|
|
sub qr_code {
|
|
my ($self) = @_;
|
|
|
|
my $otpauth = $self->SUPER::qr_code( undef, undef, undef, 1 );
|
|
|
|
# no need to pass secret, key and issuer again
|
|
my $qrcode = GD::Barcode->new( 'QRcode', $otpauth, { Ecc => 'M', ModuleSize => 4 } );
|
|
my $data = $qrcode->plot->png;
|
|
return "data:image/png;base64," . encode_base64( $data, q{} ); # does not contain newlines
|
|
}
|
|
|
|
=head3 verify
|
|
|
|
my $verified = $auth->verify($otp_token);
|
|
|
|
Replacement for Auth::GoogleAuth::verify.
|
|
This uses a system wide default for range.
|
|
|
|
=cut
|
|
|
|
sub verify {
|
|
my ( $self, $code, $range, $secret32, $timestamp, $interval ) = @_;
|
|
if ( !defined $range ) {
|
|
my $mfa_range = C4::Context->config('mfa_range') ? int( C4::Context->config('mfa_range') ) : 1;
|
|
if ($mfa_range) {
|
|
$range = $mfa_range;
|
|
}
|
|
}
|
|
return $self->SUPER::verify( $code, $range, $secret32, $timestamp, $interval );
|
|
}
|
|
|
|
1;
|