class.AuthUser.php

Go to the documentation of this file.

<?php
/**
 * wCMF - wemove Content Management Framework
 * Copyright (C) 2005-2014 wemove digital solutions GmbH
 *
 * Licensed under the terms of any of the following licenses
 * at your choice:
 *
 * - GNU Lesser General Public License (LGPL)
 *   http://www.gnu.org/licenses/lgpl.html
 * - Eclipse Public License (EPL)
 *   http://www.eclipse.org/org/documents/epl-v10.php
 *
 * See the license.txt file distributed with this work for
 * additional information.
 *
 * $Id: class.AuthUser.php 1462 2014-02-04 23:52:27Z iherwig $
 */
require_once(BASE."wcmf/lib/security/class.User.php");
require_once(BASE."wcmf/lib/security/class.UserManager.php");
require_once(BASE."wcmf/lib/security/class.RightsManager.php");
require_once(BASE."wcmf/lib/core/class.WCMFException.php");
require_once(BASE."wcmf/lib/util/class.ObjectFactory.php");
require_once(BASE."wcmf/lib/util/class.InifileParser.php");

/**
 * @class AuthUser
 * @ingroup Security
 * @brief AuthUser provides a storage and methods for user data used for
 * authentication/authorization purposes. This class requires php >= 4.1.0
 *
 * @author      ingo herwig <ingo@wemove.com>
 */
class AuthUser extends User
{
  var $_login_time = "";
  var $_policies = array();
  var $_defaulPolicy = true;
  var $_user = null;

  /**
   * Log a user into the application.
   * @param login The login string of the user
   * @param password The password string of the user
   * @param isPasswordEncrypted True/False wether the password is encrypted or not [default: false]
   * @return True/False whether login succeeded.
   */
  function login($login, $password, $isPasswordEncrypted=false)
  {
    $parser = &InifileParser::getInstance();

    // encrypt password if not done already
    if (!$isPasswordEncrypted)
      $password = UserManager::encryptPassword($password);

    // because there is no authorized user already, we propably have to deactivate the
    // RightsManager for this operation to allow user retrieval from the persistent storage
    $rightsManager = &RightsManager::getInstance();
    $isAnonymous = $rightsManager->isAnonymous();
    if (!$isAnonymous)
      $rightsManager->deactivate();

    // try to receive the user with given credentials
    $persistenceFacade = &PersistenceFacade::getInstance();
    $userInstance = &$persistenceFacade->create(UserManager::getUserClassName(), BUILDDEPTH_SINGLE);
    $user = &$userInstance->getUser($login, $password);

    // check if user exists
    $loginOk = false;
    if ($user != null)
    {
      // login succeeded, store the user instance
      $this->_user = &$user->duplicate();
      $this->setOID($user->getOID());

      // load user config initially
      $config = $this->getConfig();
      if (strlen($config) > 0)
      {
        if (!$parser->parseIniFile($GLOBALS['CONFIG_PATH'].$config, true))
          WCMFException::throwEx($parser->getErrorMsg(), __FILE__, __LINE__);
      }

      // add policies
      if (($policies = $parser->getSection('authorization')) === false)
        WCMFException::throwEx($parser->getErrorMsg(), __FILE__, __LINE__);
      else
            $this->addPolicies($policies);

      $this->_login_time = strftime("%c", mktime());
          $loginOk = true;
          }

    // reactivate the RightsManager if necessary
    if (!$isAnonymous)
      $rightsManager->activate();

    return $loginOk;
  }

  /**
   * Adds one ore more policies to the policy repository of the user.
   * @param policies An associative array with the policy information (key=action, value=policy string).
   * @note A policy string looks like this "+*, -guest, +admin"
   */
  function addPolicies($policies)
  {
        foreach ($policies AS $key => $value)
        {
          if (!isset($this->_policies[$key]))
          {
        $parsedPolicies = $this->parsePolicy($value);
        $this->_policies[$key] = $parsedPolicies;
          }
        }
  }

  /**
   * Checks, if the user is authorized for this action.
   * Returns defaulPolicy if action key is not defined.
   * @param actionKey An action key string
   * @return True/False whether authorization succeeded
   */
  function authorize($actionKey)
  {
        if ($actionKey == '')
          return $this->_defaulPolicy;

          if (isset($this->_policies[$actionKey]))
            return $this->matchRoles($this->_policies[$actionKey]);

        return $this->_defaulPolicy;
  }

  /**
   * Matches the roles of the user and the roles for a certain key
   * @param val An array containing policy information as an associative array with the keys ('default', 'allow', 'deny'). Where
   *          'allow', 'deny' are arrays itselves holding roles. 'allow' overwrites 'deny' overwrites 'default'
   * @return True/False whether the user has access right according to this policy.
   */
  function matchRoles($val)
  {
        if (isset($val['allow']))
        foreach ($val['allow'] as $value)
          if ($this->hasRole($value))
                return true;

        if (isset($val['deny']))
        foreach ($val['deny'] as $value)
          if ($this->hasRole($value))
                return false;

        return $val['default'];
  }

  /**
   * Parse an policy string and returns an associative array with the keys ('default', 'allow', 'deny'). Where
   * 'allow', 'deny' are arrays itselves holding roles. 'deny' overwrites 'allow' overwrites 'default'
   * @param val An role string (+*, +admin, -guest, entries without '+' or '-' prefix default to allow rules).
   * @return An array containing the policy data as an associative array with the keys 'default', 'allow', 'deny'.
   */
  function parsePolicy($val)
  {
        $rtn = array();

        $roles = explode(" ", $val);
        foreach ($roles as $value)
        {
          $value=trim($value);
          if (strlen($value)==2 && substr($value,1,1) == "*")
          {
                if (substr($value,0,1)=="+")
                  $rtn['default'] = true;
                else if (substr($value,0,1)=="-")
                  $rtn['default'] = false;
          }
          else
          {
                if (substr($value,0,1)=="+")
                  $rtn['allow'][] = substr($value,1);
                else if (substr($value,0,1)=="-")
                  $rtn['deny'][] = substr($value,1);
                else
                {
                  // entries without '+' or '-' prefix default to allow rules
                  $rtn['allow'][] = $value;
                }
          }
        }
        return $rtn;
  }

  /**
   * Assign the default policy.
   * @param val A boolean value.
   */
  function setDefaultPolicy($val)
  {
    $this->_defaulPolicy = $val;
  }

  /**
   * Get login time of the user.
   * @return A formatted time string.
   */
  function getLoginTime()
  {
    return $this->_login_time;
  }

  /**
   * Get a string representation of the user.
   * @return The string
   */
  function toString()
  {
    if ($this->_user != null)
      return $this->_user->toString();
    return "";
  }

  /**
   * Implementation of abstract base class methods.
   * Delegates to internal user instance.
   */

  /**
   * Get the type
   */
  function getType()
  {
        return UserManager::getUserClassName();
  }
  
  /**
   * @see User::setLogin()
   */
  function setLogin($login)
  {
    if ($this->_user != null)
      $this->_user->setLogin($login);
  }

  /**
   * @see User::getLogin()
   */
  function getLogin()
  {
    if ($this->_user != null)
      return $this->_user->getLogin();
    return "";
  }

  /**
   * @see User::setPassword()
   */
  function setPassword($password)
  {
    if ($this->_user != null)
      $this->_user->setPassword($password);
  }

  /**
   * @see User::getPassword()
   */
  function getPassword()
  {
    if ($this->_user != null)
      return $this->_user->getPassword();
    return "";
  }

  /**
   * @see User::setName()
   */
  function setName($name)
  {
    if ($this->_user != null)
      $this->_user->setName($name);
  }

  /**
   * @see User::getName()
   */
  function getName()
  {
    if ($this->_user != null)
      return $this->_user->getName();
    return "";
  }

  /**
   * @see User::setFirstname()
   */
  function setFirstname($firstname)
  {
    if ($this->_user != null)
      $this->_user->setFirstname($firstname);
  }

  /**
   * @see User::getFirstname()
   */
  function getFirstname()
  {
    if ($this->_user != null)
      return $this->_user->getFirstname();
    return "";
  }

  /**
   * @see User::setConfig()
   */
  function setConfig($config)
  {
    if ($this->_user != null)
      $this->_user->setConfig($config);
  }

  /**
   * @see User::getConfig()
   */
  function getConfig()
  {
    // strip path from config name for compatibility with old versions,
    // where the path was stored
    if ($this->_user != null)
      return basename($this->_user->getConfig());
    return "";
  }

  /**
   * @see User::addRole()
   */
  function addRole($rolename)
  {
    // not supported by AuthUser
  }

  /**
   * @see User::removeRole()
   */
  function removeRole($rolename)
  {
    // not supported by AuthUser
  }

  /**
   * @see User::hasRole()
   */
  function hasRole($rolename)
  {
    if ($this->_user != null)
      return $this->_user->hasRole($rolename);

    return false;
  }

  /**
   * @see User::getRoles()
   */
  function getRoles()
  {
    if ($this->_user != null)
      return $this->_user->getRoles();

    return array();
  }

  /**
   * Implementation of the storable interface.
   */

  /**
   * @see Storable::getClassDefinitionFiles()
   */
  function getClassDefinitionFiles()
  {
    $parser = &InifileParser::getInstance();
    $objectFactory = &ObjectFactory::getInstance();

    if (($userClassName = $parser->getValue('User', 'implementation')) === false)
      WCMFException::throwEx($parser->getErrorMsg());
    $userClassFile = $objectFactory->getClassfileFromConfig($userClassName);

    if (($roleClassName = $parser->getValue('Role', 'implementation')) === false)
      WCMFException::throwEx($parser->getErrorMsg());
    $roleClassName = $objectFactory->getClassfileFromConfig($roleClassName);

    return array(__FILE__, BASE.$userClassFile, BASE.$roleClassName);
  }

  /**
   * @see Storable::loadFromSession()
   * Load the user object.
   */
  function loadFromSession()
  {
  }
}
?>