Extension talk:AuthBugzilla
This extension is not working with bugzilla 3.4.x. Bugzilla has changed the passwort encryption method.
Here is a workaround:
I have copied the function bz_crypt from bugzilla source into a new file which is called from AuthBugzilla.php using a perl interpreter:
I had to install:
- http://mirrors.zerg.biz/cpan/authors/id/A/AV/AVAR/Digest-SHA2-1.1.1.tar.gz
- http://pecl.php.net/get/perl-1.0.0.tgz
In AuthBugzilla.php change:
function encryptPassword( $pass, $salt ) {
// return crypt( $pass,$salt );
$perl = new Perl();
$perl->require("/srv/www/htdocs/mediawiki/extensions/bz_crypt.pl");
return $perl->bz_crypt($pass, $salt);
}
bz_crypt.pl:
use Digest;
return 1;
sub bz_crypt {
my ($password, $salt) = @_;
my $algorithm;
if (!defined $salt) {
# If you don't use a salt, then people can create tables of
# hashes that map to particular passwords, and then break your
# hashing very easily if they have a large-enough table of common
# (or even uncommon) passwords. So we generate a unique salt for
# each password in the database, and then just prepend it to
# the hash.
$salt = generate_random_password(8);
$algorithm = 'SHA-256';
}
# We append the algorithm used to the string. This is good because then
# we can change the algorithm being used, in the future, without
# disrupting the validation of existing passwords. Also, this tells
# us if a password is using the old "crypt" method of hashing passwords,
# because the algorithm will be missing from the string.
if ($salt =~ /{([^}]+)}$/) {
$algorithm = $1;
}
my $crypted_password;
if (!$algorithm) {
# Wide characters cause crypt to die
#if (Bugzilla->params->{'utf8'}) {
# utf8::encode($password) if utf8::is_utf8($password);
#}
# Crypt the password.
$crypted_password = crypt($password, $salt);
# HACK: Perl has bug where returned crypted password is considered
# tainted. See http://rt.perl.org/rt3/Public/Bug/Display.html?id=59998
#unless(tainted($password) || tainted($salt)) {
# trick_taint($crypted_password);
#}
}
else {
my $hasher = Digest->new($algorithm);
# We only want to use the first characters of the salt, no
# matter how long of a salt we may have been passed.
$salt = substr($salt, 0, 8);
$hasher->add($password, $salt);
$crypted_password = $salt . $hasher->b64digest . "{$algorithm}";
}
# Return the crypted password.
return $crypted_password;
}
For Bugzilla 5[edit]
bz_crypt2.pl
use Digest;
sub bz_crypt {
my ($password, $salt) = @_;
my $algorithm;
if (!defined $salt) {
# If you don't use a salt, then people can create tables of
# hashes that map to particular passwords, and then break your
# hashing very easily if they have a large-enough table of common
# (or even uncommon) passwords. So we generate a unique salt for
# each password in the database, and then just prepend it to
# the hash.
$salt = generate_random_password(8);
$algorithm = 'SHA-256';
}
# We append the algorithm used to the string. This is good because then
# we can change the algorithm being used, in the future, without
# disrupting the validation of existing passwords. Also, this tells
# us if a password is using the old "crypt" method of hashing passwords,
# because the algorithm will be missing from the string.
if ($salt =~ /{([^}]+)}$/) {
$algorithm = $1;
}
# Wide characters cause crypt and Digest to die.
#if (Bugzilla->params->{'utf8'}) {
# utf8::encode($password) if utf8::is_utf8($password);
#}
my $crypted_password;
if (!$algorithm) {
# Crypt the password.
$crypted_password = crypt($password, $salt);
}
else {
my $hasher = Digest->new($algorithm);
# Newly created salts won't yet have a comma.
($salt) = $salt =~ /^([^,]+),?/;
$hasher->add($password, $salt);
$crypted_password = $salt . ',' . $hasher->b64digest . "{$algorithm}";
}
# Return the crypted password.
return $crypted_password;
}
$numArgs = $#ARGV + 1;
if ( $#ARGV != 1 ){
#print "two argumets expected\n";
exit 0;
}
$crypt_pw = bz_crypt ( $ARGV[0], $ARGV[1] );
#print "$crypt_pw\n";
#print "$ARGV[1]\n";
if ($crypt_pw eq $ARGV[1]){
#print "OK\n";
exit 1;
}
exit 0;
AuthBugzilla.php
<?php
/**
* @package MediaWiki
*/
# Copyright (C) 2004 Brion Vibber <brion@pobox.com>
# http://www.mediawiki.org/
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
# http://www.gnu.org/copyleft/gpl.html
/**
* Authentication plugin interface. Instantiate a subclass of AuthPlugin
* and set $wgAuth to it to authenticate against some external tool.
*
* The default behavior is not to do anything, and use the local user
* database for all authentication. A subclass can require that all
* accounts authenticate externally, or use it only as a fallback; also
* you can transparently create internal wiki accounts the first time
* someone logs in who can be authenticated externally.
*
* This interface is new, and might change a bit before 1.4.0 final is
* done...
*
* @package MediaWiki
*/
require_once( 'AuthPlugin.php' );
class AuthBugzilla extends AuthPlugin {
function AuthBugzilla() {
$this->bugzillatbl = "`bugs`.`profiles`";
}
function encryptPassword( $pass, $salt ) {
// return crypt( $pass,$salt );
// $perl = new Perl();
// $perl->require("/srv/www/htdocs/mediawiki/extensions/bz_crypt.pl");
// return $perl->bz_crypt($pass, $salt);
#wfDebug("perl /srv/www/htdocs/mediawiki/extensions/bz_crypt2.pl $pass $salt\n");
$result = 0;
passthru("perl /srv/www/htdocs/mediawiki/extensions/bz_crypt2.pl $pass $salt", $result);
return $result;
}
/**
* Check whether there exists a user account with the given name.
* The name will be normalized to MediaWiki's requirements, so
* you might need to munge it (for instance, for lowercase initial
* letters).
*
* @param $username String: username.
* @return bool
* @public
*/
function userExists( $username ) {
$dbr =& wfGetDB( DB_SLAVE );
$qusername = $dbr->addQuotes( $username );
$res = $dbr->selectRow(
$this->bugzillatbl,
array( 'userid' ),
"LCase(login_name)=LCase($qusername) and disabledtext=''",
"AuthBugzilla::userExist" );
return $res;
}
/**
* Check if a username+password pair is a valid login.
* The name will be normalized to MediaWiki's requirements, so
* you might need to munge it (for instance, for lowercase initial
* letters).
*
* @param $username String: username.
* @param $password String: user password.
* @return bool
* @public
*/
function authenticate( $username, $password ) {
#wfDebug("authenticate");
#wfDebug($username);
#wfDebug($password);
#wfDebug("-----------------------------------------\n");
$dbr = wfGetDB( DB_SLAVE );
$qusername = $dbr->addQuotes( $username );
$res = $dbr->selectRow(
$this->bugzillatbl,
array( "cryptpassword" ),
"LCase(login_name)=LCase($qusername) and disabledtext=''",
"AuthBugzilla::authenticate" );
if ( $res !== false ){
# Bugzilla user
return ($this->encryptPassword( $password, $res->cryptpassword ) == 1);
}
else{
return false;
}
}
/**
* Modify options in the login template.
*
* @param $template UserLoginTemplate object.
* @public
*/
function modifyUITemplate( &$template ) {
# Override this!
$template->set( 'usedomain', false );
}
/**
* Set the domain this plugin is supposed to use when authenticating.
*
* @param $domain String: authentication domain.
* @public
*/
function setDomain( $domain ) {
$this->domain = $domain;
}
/**
* Check to see if the specific domain is a valid domain.
*
* @param $domain String: authentication domain.
* @return bool
* @public
*/
function validDomain( $domain ) {
# Override this!
return true;
}
/**
* When a user logs in, optionally fill in preferences and such.
* For instance, you might pull the email address or real name from the
* external user database.
*
* The User object is passed by reference so it can be modified; don't
* forget the & on your function declaration.
*
* @param User $user
* @public
*/
function updateUser( &$user ) {
# Override this and do something
$realname = $user->getRealName();
$len = strlen( $realname );
# if ( $len = 0 )
{
$dbr = wfGetDB( DB_SLAVE );
$qusername = $dbr->addQuotes( $user->getName() );
$res = $dbr->selectRow(
$this->bugzillatbl,
array( "realname" ),
"LCase(login_name)=LCase($qusername)",
"AuthBugzilla::updateUser" );
$user->setRealName($res->realname);
$user->setEmail($user->getName());
$user->saveSettings();
}
return true;
}
/**
* Return true if the wiki should create a new local account automatically
* when asked to login a user who doesn't exist locally but does in the
* external auth database.
*
* If you don't automatically create accounts, you must still create
* accounts in some way. It's not possible to authenticate without
* a local account.
*
* This is just a question, and shouldn't perform any actions.
*
* @return bool
* @public
*/
function autoCreate() {
return true;
}
/**
* Can users change their passwords?
*
* @return bool
*/
function allowPasswordChange() {
return ;
}
/**
* Set the given password in the authentication database.
* As a special case, the password may be set to null to request
* locking the password to an unusable value, with the expectation
* that it will be set later through a mail reset or other method.
*
* Return true if successful.
*
* @param $user User object.
* @param $password String: password.
* @return bool
* @public
*/
function setPassword( $user, $password ) {
$saltchars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./';
# Generate the salt. We use an 8 character (48 bit) salt for maximum
# security on systems whose crypt uses MD5. Systems with older
# versions of crypt will just use the first two characters of the salt.
$salt = '';
for ($i=0 ; $i < 8 ; $i++ ) {
$salt .= $saltchars[rand(0,63)];
}
$dbr =& wfGetDB( DB_MASTER );
$qusername = $dbr->addQuotes( $user->mName );
$user = $dbr->tableName( 'user' );
$email = $dbr->selectField(
"$user",
"user_email",
"user_name=$qusername and user_email_authenticated is not null");
#$qemail = $dbr->addQuotes( $email );
$newpass = $this->encryptPassword($password,$salt);
$res = $dbr->update(
$this->bugzillatbl,
array( "cryptpassword" => $newpass),
array( "CONCAT(login_name,disabledtext)" => $email),
"AuthBugzilla::setPassword" );
return true;
}
/**
* Update user information in the external authentication database.
* Return true if successful.
*
* @param $user User object.
* @return bool
* @public
*/
function updateExternalDB( $user ) {
return true;
}
/**
* Check to see if external accounts can be created.
* Return true if external accounts can be created.
* @return bool
* @public
*/
function canCreateAccounts() {
return false;
}
/**
* Add a user to the external authentication database.
* Return true if successful.
*
* @param User $user
* @param string $password
* @return bool
* @public
*/
function addUser( $user, $password ) {
return true;
}
/**
* Return true to prevent logins that don't authenticate here from being
* checked against the local database's password fields.
*
* This is just a question, and shouldn't perform any actions.
*
* @return bool
* @public
*/
function strict() {
return false;
}
/**
* When creating a user account, optionally fill in preferences and such.
* For instance, you might pull the email address or real name from the
* external user database.
*
* The User object is passed by reference so it can be modified; don't
* forget the & on your function declaration.
*
* @param $user User object.
* @public
*/
function initUser( &$user ) {
# Override this to do something.
}
/**
* If you want to munge the case of an account name before the final
* check, now is your chance.
*/
function getCanonicalName( $username ) {
return $username;
}
}
?>