duo_auth/duo_auth.php at master · tweakier/duo_auth · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
<?php
/**
 * Two Factor Authentication using Duo Security for RoundCube
 *
 * @version 1.01
 *
 * Author(s): Alexios Polychronopoulos <[email protected]>
 * Date: 27/03/2015
 */

require_once 'duo_web.php';

class duo_auth extends rcube_plugin
{

	function init()
	{
		$rcmail = rcmail::get_instance();

		$this->add_hook('login_after', array($this, 'login_after'));
		$this->add_hook('send_page', array($this, 'check_2FA'));

		$this->load_config();
	}

	//hook called after successful user/pass authentication.
	function login_after($args)
	{
		$rcmail = rcmail::get_instance();

		$this->register_handler('plugin.body', array($this, 'generate_html'));

		//indicates that user/pass authentication has succeeded.
		$_SESSION['_Duo_Auth'] = True;

		$rcmail->output->send('plugin');
	}

	//intermediate page for Duo 2FA. Fetches the Duo javascript, initializes Duo and renders the Duo iframe.
	function generate_html()
	{
		$rcmail = rcmail::get_instance();
		$rcmail->output->set_pagetitle('Duo Authentication');

		$this->include_script('Duo-Web-v1.bundled.min.js');

		$ikey = $this->get('IKEY');
		$skey = $this->get('SKEY');
        	$host = $this->get('HOST');
        	$akey = $this->get('AKEY');

        	$user = get_input_value('_user', RCUBE_INPUT_POST);

		$sig_request = Duo::signRequest($ikey, $skey, $akey, $user);

		$content =	"<script>
						Duo.init({
							'host': '" . $host . "',
							'post_action': '.',
							'sig_request': '" . $sig_request . "'
						});
				</script>
				<center>
					<iframe id=\"duo_iframe\" width=\"620\" height=\"500\" frameborder=\"0\" allowtransparency=\"true\" style=\"background: transparent;\"></iframe>
				</center>";

		return($content);
	}


	//hook called on every roundcube page request. Makes sure that user is authenticated using 2 factors.
	function check_2FA($p)
	{
		$rcmail = rcmail::get_instance();

		//user has gone through 2FA
		if($_SESSION['_Duo_Auth'] && $_SESSION['_Duo_2FAuth'])
		{
			return $p;
		}

		//login page has to allow requests that are not 2 factor authenticated.
		else if($rcmail->task == 'login')
		{
			return $p;
		}

		//checking 2nd factor of authentication.
		else if(isset($_POST['sig_response']))
		{
			$ikey = $this->get('IKEY');
			$skey = $this->get('SKEY');
			$akey = $this->get('AKEY');

			$resp = Duo::verifyResponse($ikey, $skey, $akey, $_POST['sig_response']);

			//successful 2FA login.
			if($resp != NULL)
			{
				//indicates successful Duo 2FA.
				$_SESSION['_Duo_2FAuth'] = True;

				//redirect to inbox.
				header('Location: ?_task=mail');
				return $p;
			}
			else {
				$this->fail();
			}
		}

		//in any other case, log the user out.
		$this->fail();
	}

	private function get($v)
	{
		return rcmail::get_instance()->config->get($v);
	}

	//unsets all the session variables used in the plugin,
	//invalidates the user's session and redirects to the login page.
	private function fail()
	{
		$rcmail = rcmail::get_instance();

		unset($_SESSION['_Duo_Auth']);
		unset($_SESSION['_Duo_2FAuth']);

		$rcmail->kill_session();
		header('Location: ?_task=login');

		exit;
	}

}