include/auth_ejabberd.php

   1 #!/usr/bin/php
   2 <?php
   3 /*
   4  * ejabberd extauth script for the integration with friendica
   5  *
   6  * Originally written for joomla by Dalibor Karlovic <dado@krizevci.info>
   7  * modified for Friendica by Michael Vogel <icarus@dabo.de>
   8  * published under GPL
   9  *
  10  * Latest version of the original script for joomla is available at:
  11  * http://87.230.15.86/~dado/ejabberd/joomla-login
  12  *
  13  * Installation:
  14  *
  15  *      - Change it's owner to whichever user is running the server, ie. ejabberd
  16  *        $ chown ejabberd:ejabberd /path/to/friendica/include/auth_ejabberd.php
  17  *
  18  *      - Change the access mode so it is readable only to the user ejabberd and has exec
  19  *        $ chmod 700 /path/to/friendica/include/auth_ejabberd.php
  20  *
  21  *      - Edit your ejabberd.cfg file, comment out your auth_method and add:
  22  *        {auth_method, external}.
  23  *        {extauth_program, "/path/to/friendica/include/auth_ejabberd.php"}.
  24  *
  25  *      - Restart your ejabberd service, you should be able to login with your friendica auth info
  26  *
  27  * Other hints:
  28  *      - if your users have a space or a @ in their nickname, they'll run into trouble
  29  *        registering with any client so they should be instructed to replace these chars
  30  *        " " (space) is replaced with "%20"
  31  *        "@" is replaced with "(a)"
  32  *
  33  */
  34
  35 if (sizeof($_SERVER["argv"]) == 0)
  36         die();
  37
  38 $directory = dirname($_SERVER["argv"][0]);
  39
  40 if (substr($directory, 0, 1) != "/")
  41         $directory = $_SERVER["PWD"]."/".$directory;
  42
  43 $directory = realpath($directory."/..");
  44
  45 chdir($directory);
  46 require_once("boot.php");
  47
  48 global $a, $db;
  49
  50 if(is_null($a)) {
  51         $a = new App;
  52 }
  53
  54 if(is_null($db)) {
  55         @include(".htconfig.php");
  56         require_once("include/dba.php");
  57         $db = new dba($db_host, $db_user, $db_pass, $db_data);
  58         unset($db_host, $db_user, $db_pass, $db_data);
  59 };
  60
  61 // the logfile to which to write, should be writeable by the user which is running the server
  62 $sLogFile = get_config('jabber','logfile');
  63
  64 // set true to debug if needed
  65 $bDebug = get_config('jabber','debug');
  66
  67 $oAuth = new exAuth($sLogFile, $bDebug);
  68
  69 class exAuth
  70 {
  71         private $sLogFile;
  72         private $bDebug;
  73
  74         private $rLogFile;
  75
  76         public function __construct($sLogFile, $bDebug)
  77         {
  78                 global $a, $db;
  79
  80                 // setter
  81                 $this->sLogFile         = $sLogFile;
  82                 $this->bDebug           = $bDebug;
  83
  84                 // ovo ne provjeravamo jer ako ne mozes kreirati log file, onda si u kvascu :)
  85                 if ($this->sLogFile != '')
  86                         $this->rLogFile = fopen($this->sLogFile, "a") or die("Error opening log file: ". $this->sLogFile);
  87
  88                 $this->writeLog("[exAuth] start");
  89
  90                 // ovdje bi trebali biti spojeni na MySQL, imati otvoren log i zavrtit cekalicu
  91                 do {
  92                         $iHeader        = fgets(STDIN, 3);
  93                         $aLength        = unpack("n", $iHeader);
  94                         $iLength        = $aLength["1"];
  95                         if($iLength > 0) {
  96                                 // ovo znaci da smo nesto dobili
  97                                 $sData = fgets(STDIN, $iLength + 1);
  98                                 $this->writeDebugLog("[debug] received data: ". $sData);
  99                                 $aCommand = explode(":", $sData);
 100                                 if (is_array($aCommand)){
 101                                         switch ($aCommand[0]){
 102                                                 case "isuser":
 103                                                         // provjeravamo je li korisnik dobar
 104                                                         if (!isset($aCommand[1])){
 105                                                                 $this->writeLog("[exAuth] invalid isuser command, no username given");
 106                                                                 fwrite(STDOUT, pack("nn", 2, 0));
 107                                                         } else {
 108                                                                 // ovdje provjeri je li korisnik OK
 109                                                                 $sUser = str_replace(array("%20", "(a)"), array(" ", "@"), $aCommand[1]);
 110                                                                 $this->writeDebugLog("[debug] checking isuser for ". $sUser);
 111                                                                 $sQuery = "SELECT `uid` FROM `user` WHERE `nickname`='". $db->escape($sUser) ."'";
 112                                                                 $this->writeDebugLog("[debug] using query ". $sQuery);
 113                                                                 if ($oResult = q($sQuery)){
 114                                                                         if ($oResult) {
 115                                                                                 // korisnik OK
 116                                                                                 $this->writeLog("[exAuth] valid user: ". $sUser);
 117                                                                                 fwrite(STDOUT, pack("nn", 2, 1));
 118                                                                         } else {
 119                                                                                 // korisnik nije OK
 120                                                                                 $this->writeLog("[exAuth] invalid user: ". $sUser);
 121                                                                                 fwrite(STDOUT, pack("nn", 2, 0));
 122                                                                         }
 123                                                                         //$oResult->close();
 124                                                                 } else {
 125                                                                         $this->writeLog("[MySQL] invalid query: ". $sQuery);
 126                                                                         fwrite(STDOUT, pack("nn", 2, 0));
 127                                                                 }
 128                                                         }
 129                                                 break;
 130                                                 case "auth":
 131                                                         // provjeravamo autentifikaciju korisnika
 132                                                         if (sizeof($aCommand) != 4){
 133                                                                 $this->writeLog("[exAuth] invalid auth command, data missing");
 134                                                                 fwrite(STDOUT, pack("nn", 2, 0));
 135                                                         } else {
 136                                                                 // ovdje provjeri prijavu
 137                                                                 $sUser = str_replace(array("%20", "(a)"), array(" ", "@"), $aCommand[1]);
 138                                                                 $this->writeDebugLog("[debug] doing auth for ".$sUser."@".$aCommand[2]);
 139
 140                                                                 // If the hostnames doesn't match, we try to authenticate remotely
 141                                                                 if ($a->get_hostname() != $aCommand[2])
 142                                                                         $Error = !$this->check_credentials($aCommand[2], $aCommand[1], $aCommand[3], true);
 143                                                                 else {
 144
 145                                                                         //$sQuery = "SELECT `uid`, `password` FROM `user` WHERE `password`='".hash('whirlpool',$aCommand[3])."' AND `nickname`='". $db->escape($sUser) ."'";
 146                                                                         $sQuery = "SELECT `uid`, `password` FROM `user` WHERE `nickname`='". $db->escape($sUser) ."'";
 147                                                                         $this->writeDebugLog("[debug] using query ". $sQuery);
 148                                                                         if ($oResult = q($sQuery)){
 149                                                                                 $uid = $oResult[0]["uid"];
 150                                                                                 $Error = ($oResult[0]["password"] != hash('whirlpool',$aCommand[3]));
 151                                                                         } else {
 152                                                                                 $this->writeLog("[MySQL] invalid query: ". $sQuery);
 153                                                                                 $Error = true;
 154                                                                                 $uid = -1;
 155                                                                         }
 156                                                                         if ($Error) {
 157                                                                                 $oConfig = q("SELECT `v` FROM `pconfig` WHERE `uid`=%d AND `cat` = 'xmpp' AND `k`='password' LIMIT 1;", intval($uid));
 158                                                                                 $this->writeLog("[exAuth] got password ".$oConfig[0]["v"]);
 159                                                                                 $Error = ($aCommand[3] != $oConfig[0]["v"]);
 160                                                                         }
 161                                                                 }
 162                                                                 if ($Error) {
 163                                                                         $this->writeLog("[exAuth] authentification failed for user ". $sUser ."@". $aCommand[2]);
 164                                                                         fwrite(STDOUT, pack("nn", 2, 0));
 165                                                                 } else {
 166                                                                         $this->writeLog("[exAuth] authentificated user ". $sUser ."@". $aCommand[2]);
 167                                                                         fwrite(STDOUT, pack("nn", 2, 1));
 168                                                                 }
 169                                                         }
 170                                                 break;
 171                                                 case "setpass":
 172                                                         // postavljanje zaporke, onemoguceno
 173                                                         $this->writeLog("[exAuth] setpass command disabled");
 174                                                         fwrite(STDOUT, pack("nn", 2, 0));
 175                                                 break;
 176                                                 default:
 177                                                         // ako je uhvaceno ista drugo
 178                                                         $this->writeLog("[exAuth] unknown command ". $aCommand[0]);
 179                                                         fwrite(STDOUT, pack("nn", 2, 0));
 180                                                 break;
 181                                         }
 182                                 } else {
 183                                         $this->writeDebugLog("[debug] invalid command string");
 184                                         fwrite(STDOUT, pack("nn", 2, 0));
 185                                 }
 186                         }
 187                         unset ($iHeader);
 188                         unset ($aLength);
 189                         unset ($iLength);
 190                         unset($aCommand);
 191                 } while (true);
 192         }
 193
 194         public function __destruct()
 195         {
 196                 // zatvori log file
 197                 $this->writeLog("[exAuth] stop");
 198
 199                 if (is_resource($this->rLogFile)){
 200                         fclose($this->rLogFile);
 201                 }
 202         }
 203
 204         private function check_credentials($host, $user, $password, $ssl) {
 205
 206                 $url = ($ssl ? "https":"http")."://".$host."/api/account/verify_credentials.json";
 207
 208                 $ch = curl_init();
 209                 curl_setopt($ch, CURLOPT_URL, $url);
 210                 curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
 211                 curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5);
 212                 curl_setopt($ch, CURLOPT_HEADER, true);
 213                 curl_setopt($ch, CURLOPT_NOBODY, true);
 214                 curl_setopt($ch, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
 215                 curl_setopt($ch, CURLOPT_USERPWD, $user.':'.$password);
 216
 217                 $header = curl_exec($ch);
 218                 $curl_info = @curl_getinfo($ch);
 219                 $http_code = $curl_info["http_code"];
 220                 curl_close($ch);
 221
 222                 return($http_code == 200);
 223         }
 224
 225         private function writeLog($sMessage)
 226         {
 227                 if (is_resource($this->rLogFile)) {
 228                         fwrite($this->rLogFile, date("r") ." ". $sMessage ."\n");
 229                 }
 230         }
 231
 232         private function writeDebugLog($sMessage)
 233         {
 234                 if ($this->bDebug){
 235                         $this->writeLog($sMessage);
 236                 }
 237         }
 238
 239 }
 240 ?>
 241
 242