roopa
Hi ntozier
I have updated osticket version with the latest version.
For SSO implementation , I have written a script.
- Fetch "Employee Code" and "Employee username" from Request URL.
- Created a new table in database for storing sso_login_user : Where all the user details are stored.
- Check that if the user is allowed for SSO login.
- If yes, than fetch user email and user name from sso_login_user table.
- Check user email exists in user_email table.
a) If No, than insert data in "user" and "user_email" table
"user_account" insert user details (employee code as "username" and Passwd::hash($employee_code.$bytes) as "password")
b) If Yes
Update "user" table updated column with latest timestamp
Update "user_account" table passwd, registered with Passwd::hash($employee_code.$bytes) as "password" and latest timestamp.
- The I set username and passwd as :
$username = $emp_code;
$passwd = $emp_code.$bytes;
Updated login.php is as :
<?php
require_once('client.inc.php');
if(!defined('INCLUDE_DIR')) die('Fatal Error');
define('CLIENTINC_DIR',INCLUDE_DIR.'client/');
define('OSTCLIENTINC',TRUE); //make includes happy
require_once(INCLUDE_DIR.'class.client.php');
require_once(INCLUDE_DIR.'class.ticket.php');
if ($cfg->getClientRegistrationMode() == 'disabled'
|| isset($_POST['lticket']))
$inc = 'accesslink.inc.php';
else
$inc = 'login.inc.php';
$suggest_pwreset = false;
// Check the CSRF token, and ensure that future requests will have to use a
// different CSRF token. This will help ward off both parallel and serial
// brute force attacks, because new tokens will have to be requested for
// each attempt.
if ($_POST) {
// Check CSRF token
if (!$ost->checkCSRFToken())
Http::response(400, __('Valid CSRF Token Required'));
// Rotate the CSRF token (original cannot be reused)
$ost->getCSRF()->rotate();
}
//Check if user coming from portal for single sign on
if (isset($GET['e']) && !empty($GET['c'])) {
include_once 'singleSignOn.php';
$POST['luser'] = $username;
$POST['lpasswd'] = $passwd;
}
if (($POST && isset($POST['luser'])) ) {
if (!$POST['luser'])
$errors['err'] = __('Valid username or email address is required');
elseif (($user = UserAuthenticationBackend::process($POST['luser'],$_POST['lpasswd'], $errors))) {
if ($user instanceof ClientCreateRequest) {
if ($cfg && $cfg->isClientRegistrationEnabled()) {
// Attempt to automatically register
if ($user->attemptAutoRegister())
Http::redirect('tickets.php');
// Auto-registration failed. Show the user the info we have
$inc = 'register.inc.php';
$user_form = UserForm::getUserForm()->getForm($user->getInfo());
}
else {
$errors['err'] = __('Access Denied. Contact your help desk administrator to have an account registered for you');
// fall through to show login page again
}
}
else {
Http::redirect($_SESSION['_client']['auth']['dest']
?: 'tickets.php');
}
} elseif(!$errors['err']) {
$errors['err'] = sprintf('%s - %s', __('Invalid username or password'), __('Please try again!'));
}
$suggest_pwreset = true;
}
elseif ($POST && isset($POST['lticket'])) {
if (!Validator::is_email($POST['lemail']))
$errors['err'] = __('Valid email address and ticket number required');
elseif (($user = UserAuthenticationBackend::process($POST['lemail'],
$_POST['lticket'], $errors))) {
// If email address verification is not required, then provide
// immediate access to the ticket!
if (!$cfg->isClientEmailVerificationRequired())
Http::redirect('tickets.php');
// This will succeed as it is checked in the authentication backend
$ticket = Ticket::lookupByNumber($_POST['lticket'], $_POST['lemail']);
// We're using authentication backend so we can guard aganist brute
// force attempts (which doesn't buy much since the link is emailed)
$ticket->sendAccessLink($user);
$msg = sprintf(__("%s - access link sent to your email!"),
Format::htmlchars($user->getName()->getFirst()));
$_POST = null;
} elseif(!$errors['err']) {
$errors['err'] = sprintf('%s - %s', __('Invalid email or ticket number'), __('Please try again!'));
}
}
elseif (isset($GET['do'])) {
switch($GET['do']) {
case 'ext':
// Lookup external backend
if ($bk = UserAuthenticationBackend::getBackend($_GET['bk']))
$bk->triggerAuth();
}
}
elseif ($user = UserAuthenticationBackend::processSignOn($errors, false)) {
// Users from the ticket access link
if ($user && $user instanceof TicketUser && $user->getTicketId())
Http::redirect('tickets.php?id='.$user->getTicketId());
// Users imported from an external auth backend
elseif ($user instanceof ClientCreateRequest) {
if ($cfg && $cfg->isClientRegistrationEnabled()) {
// Attempt to automatically register
if ($user->attemptAutoRegister())
Http::redirect('tickets.php');
// Unable to auto-register. Fill in what we have and let the
// user complete the info
$inc = 'register.inc.php';
}
else {
$errors['err'] = __('Access Denied. Contact your help desk administrator to have an account registered for you');
// fall through to show login page again
}
}
elseif ($user instanceof AuthenticatedUser) {
Http::redirect($_SESSION['_client']['auth']['dest']
?: 'tickets.php');
}
}
if (!$nav) {
$nav = new UserNav();
$nav->setActiveNav('status');
}
// Browsers shouldn't suggest saving that username/password
Http::response(422);
require CLIENTINC_DIR.'header.inc.php';
require CLIENTINC_DIR.$inc;
require CLIENTINC_DIR.'footer.inc.php';
?>
Now when I hit the url from other portal it moves to osticket portal but gives "Access Denied" message.
Even though "Username","Profile" and "Sign out" option is crearly visible in Menu.
So why it is giving Access denied message?
Any other variable that needs to be initialised/set?
