search

IssabelFoundation / issabelPBX

Asterisk configuration GUI
GNU General Public License v3.0
147 stars 48 forks source link

[PATCH] Adding external authentication to Issabel #38

Open marcogaio opened 2 years ago

marcogaio commented 2 years ago

[One year ago i've added this to the 'framework' project; i try also to add here, that seems at least have some feedback on bugs. Feel free to close this or that] I've produced a patch/POC to enable in Issabel authentication using external sources. This patch is working in my production environment, but clearly need work to be integrated.

First patch modify login input, because i've not found a way to pass to authenticateUser() the non-md5 password; probably this is a big security hole (i suspect that the plaintext password is then saved to session cookie...) but it works.

index.php.diff.txt

Second patch modify authenticateUser() decoupling check for user existance in the db for the effective password check; i've addedd an LDAP/AD password check and an example, untested, code to login to an POP/IMAP server. Last i've keeped the original code that check against md5 password on the DB.

paloSantoACL.class.php.diff.txt

I'm seeking feedback, expecially for the security things.

Thanks.

marcogaio commented 2 years ago

Sorry, forgot to link... original bugreport: https://github.com/IssabelFoundation/framework/issues/26 Thanks.