src/Wallabag/CoreBundle/Security/Authentication/Provider/WsseProvider.php

   1 <?php
   2 namespace Wallabag\CoreBundle\Security\Authentication\Provider;
   3
   4 use Symfony\Component\Security\Core\Authentication\Provider\AuthenticationProviderInterface;
   5 use Symfony\Component\Security\Core\User\UserProviderInterface;
   6 use Symfony\Component\Security\Core\Exception\AuthenticationException;
   7 use Symfony\Component\Security\Core\Exception\NonceExpiredException;
   8 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
   9 use Wallabag\CoreBundle\Security\Authentication\Token\WsseUserToken;
  10
  11 class WsseProvider implements AuthenticationProviderInterface
  12 {
  13     private $userProvider;
  14     private $cacheDir;
  15
  16     public function __construct(UserProviderInterface $userProvider, $cacheDir)
  17     {
  18         $this->userProvider = $userProvider;
  19         $this->cacheDir     = $cacheDir;
  20     }
  21
  22     public function authenticate(TokenInterface $token)
  23     {
  24         $user = $this->userProvider->loadUserByUsername($token->getUsername());
  25
  26         if (!$user) {
  27             throw new AuthenticationException("Bad credentials. Did you forgot your username?");
  28         }
  29
  30         if ($user && $this->validateDigest($token->digest, $token->nonce, $token->created, $user->getPassword())) {
  31             $authenticatedToken = new WsseUserToken($user->getRoles());
  32             $authenticatedToken->setUser($user);
  33
  34             return $authenticatedToken;
  35         }
  36
  37         throw new AuthenticationException('The WSSE authentication failed.');
  38     }
  39
  40     protected function validateDigest($digest, $nonce, $created, $secret)
  41     {
  42         // Check created time is not in the future
  43         if (strtotime($created) > time()) {
  44             throw new AuthenticationException("Back to the future...");
  45         }
  46
  47         // Expire timestamp after 5 minutes
  48         if (time() - strtotime($created) > 300) {
  49             throw new AuthenticationException("Too late for this timestamp... Watch your watch.");
  50         }
  51
  52         // Validate nonce is unique within 5 minutes
  53         if (file_exists($this->cacheDir.'/'.$nonce) && file_get_contents($this->cacheDir.'/'.$nonce) + 300 > time()) {
  54             throw new NonceExpiredException('Previously used nonce detected');
  55         }
  56
  57         // If cache directory does not exist we create it
  58         if (!is_dir($this->cacheDir)) {
  59             mkdir($this->cacheDir, 0777, true);
  60         }
  61
  62         file_put_contents($this->cacheDir.'/'.$nonce, time());
  63
  64         // Validate Secret
  65         $expected = base64_encode(sha1(base64_decode($nonce).$created.$secret, true));
  66
  67         if ($digest !== $expected) {
  68             throw new AuthenticationException("Bad credentials ! Digest is not as expected.");
  69         }
  70
  71         return $digest === $expected;
  72     }
  73
  74     public function supports(TokenInterface $token)
  75     {
  76         return $token instanceof WsseUserToken;
  77     }
  78 }