Extension talk:AuthBugzilla

This extension is not working with bugzilla 3.4.x. Bugzilla has changed the passwort encryption method.

Here is a workaround:

I have copied the function bz_crypt from bugzilla source into a new file which is called from AuthBugzilla.php using a perl interpreter:

I had to install:

In AuthBugzilla.php change:

        function encryptPassword( $pass, $salt ) {
                // return crypt( $pass,$salt );
		$perl = new Perl();
		$perl->require("/srv/www/htdocs/mediawiki/extensions/bz_crypt.pl");
		return $perl->bz_crypt($pass, $salt);
        }

bz_crypt.pl:

use Digest;
return 1;

sub bz_crypt {
    my ($password, $salt) = @_;

    my $algorithm;
    if (!defined $salt) {
        # If you don't use a salt, then people can create tables of
        # hashes that map to particular passwords, and then break your
        # hashing very easily if they have a large-enough table of common
        # (or even uncommon) passwords. So we generate a unique salt for
        # each password in the database, and then just prepend it to
        # the hash.
        $salt = generate_random_password(8);
        $algorithm = 'SHA-256';
    }

    # We append the algorithm used to the string. This is good because then
    # we can change the algorithm being used, in the future, without 
    # disrupting the validation of existing passwords. Also, this tells
    # us if a password is using the old "crypt" method of hashing passwords,
    # because the algorithm will be missing from the string.
    if ($salt =~ /{([^}]+)}$/) {
        $algorithm = $1;
    }

    my $crypted_password;
    if (!$algorithm) {
        # Wide characters cause crypt to die
        #if (Bugzilla->params->{'utf8'}) {
        #    utf8::encode($password) if utf8::is_utf8($password);
        #}
    
        # Crypt the password.
        $crypted_password = crypt($password, $salt);

        # HACK: Perl has bug where returned crypted password is considered
        # tainted. See http://rt.perl.org/rt3/Public/Bug/Display.html?id=59998
        #unless(tainted($password) || tainted($salt)) {
        #    trick_taint($crypted_password);
        #} 
    }
    else {
        my $hasher = Digest->new($algorithm);
        # We only want to use the first characters of the salt, no
        # matter how long of a salt we may have been passed.
        $salt = substr($salt, 0, 8);
        $hasher->add($password, $salt);
        $crypted_password = $salt . $hasher->b64digest . "{$algorithm}";
    }

    # Return the crypted password.
    return $crypted_password;
}

For Bugzilla 5

bz_crypt2.pl

use Digest;

sub bz_crypt {
    my ($password, $salt) = @_;

    my $algorithm;
    if (!defined $salt) {
        # If you don't use a salt, then people can create tables of
        # hashes that map to particular passwords, and then break your
        # hashing very easily if they have a large-enough table of common
        # (or even uncommon) passwords. So we generate a unique salt for
        # each password in the database, and then just prepend it to
        # the hash.
        $salt = generate_random_password(8);
        $algorithm = 'SHA-256';
    }

    # We append the algorithm used to the string. This is good because then
    # we can change the algorithm being used, in the future, without 
    # disrupting the validation of existing passwords. Also, this tells
    # us if a password is using the old "crypt" method of hashing passwords,
    # because the algorithm will be missing from the string.
    if ($salt =~ /{([^}]+)}$/) {
        $algorithm = $1;
    }

    # Wide characters cause crypt and Digest to die.
    #if (Bugzilla->params->{'utf8'}) {
    #    utf8::encode($password) if utf8::is_utf8($password);
    #}

    my $crypted_password;
    if (!$algorithm) {
        # Crypt the password.
        $crypted_password = crypt($password, $salt);
    }
    else {
        my $hasher = Digest->new($algorithm);
        # Newly created salts won't yet have a comma.
        ($salt) = $salt =~ /^([^,]+),?/;
        $hasher->add($password, $salt);
        $crypted_password = $salt . ',' . $hasher->b64digest . "{$algorithm}";
    }

    # Return the crypted password.
    return $crypted_password;
}

$numArgs = $#ARGV + 1;

if ( $#ARGV != 1 ){
	#print "two argumets expected\n"; 
	exit 0;
}


$crypt_pw = bz_crypt ( $ARGV[0], $ARGV[1] );

#print "$crypt_pw\n";
#print "$ARGV[1]\n";

if ($crypt_pw eq $ARGV[1]){
	#print "OK\n";	
	exit 1; 
}

exit 0;

AuthBugzilla.php

<?php
/**
 * @package MediaWiki
 */
# Copyright (C) 2004 Brion Vibber <brion@pobox.com>
# http://www.mediawiki.org/
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
# http://www.gnu.org/copyleft/gpl.html
 
/**
 * Authentication plugin interface. Instantiate a subclass of AuthPlugin
 * and set $wgAuth to it to authenticate against some external tool.
 *
 * The default behavior is not to do anything, and use the local user
 * database for all authentication. A subclass can require that all
 * accounts authenticate externally, or use it only as a fallback; also
 * you can transparently create internal wiki accounts the first time
 * someone logs in who can be authenticated externally.
 *
 * This interface is new, and might change a bit before 1.4.0 final is
 * done...
 *
 * @package MediaWiki
 */
 
 require_once( 'AuthPlugin.php' );
 
class AuthBugzilla extends AuthPlugin {
 
        function AuthBugzilla() {
                $this->bugzillatbl = "`bugs`.`profiles`";
        }
 
        function encryptPassword( $pass, $salt ) {
                // return crypt( $pass,$salt );
		
		// $perl = new Perl();
		// $perl->require("/srv/www/htdocs/mediawiki/extensions/bz_crypt.pl");
		// return $perl->bz_crypt($pass, $salt);

                #wfDebug("perl /srv/www/htdocs/mediawiki/extensions/bz_crypt2.pl $pass $salt\n");

		$result = 0; 
		passthru("perl /srv/www/htdocs/mediawiki/extensions/bz_crypt2.pl $pass $salt", $result);	
		return $result;
        }
 
        /**
         * Check whether there exists a user account with the given name.
         * The name will be normalized to MediaWiki's requirements, so
         * you might need to munge it (for instance, for lowercase initial
         * letters).
         *
         * @param $username String: username.
         * @return bool
         * @public
         */
        function userExists( $username ) {

		$dbr =& wfGetDB( DB_SLAVE ); 
		
		$qusername = $dbr->addQuotes( $username );

		$res = $dbr->selectRow(
                       $this->bugzillatbl,
                        array( 'userid' ),
                        "LCase(login_name)=LCase($qusername) and disabledtext=''",
                        "AuthBugzilla::userExist" );		

                return $res;
        }
 
        /**
         * Check if a username+password pair is a valid login.
         * The name will be normalized to MediaWiki's requirements, so
         * you might need to munge it (for instance, for lowercase initial
         * letters).
         *
         * @param $username String: username.
         * @param $password String: user password.
         * @return bool
         * @public
         */
        function authenticate( $username, $password ) {
                #wfDebug("authenticate");
		#wfDebug($username);
		#wfDebug($password);
		#wfDebug("-----------------------------------------\n");
		
		$dbr = wfGetDB( DB_SLAVE );
                $qusername = $dbr->addQuotes( $username );
                 
                $res = $dbr->selectRow(
                        $this->bugzillatbl,
                        array( "cryptpassword" ),
                        "LCase(login_name)=LCase($qusername) and disabledtext=''",
                        "AuthBugzilla::authenticate" );
 
                if ( $res !== false ){
			# Bugzilla user
                        return ($this->encryptPassword( $password, $res->cryptpassword ) == 1);
      		}
                else{		
			return false;
		}
        }
 
        /**
         * Modify options in the login template.
         *
         * @param $template UserLoginTemplate object.
         * @public
         */
        function modifyUITemplate( &$template ) {
                # Override this!
                $template->set( 'usedomain', false );
        }
 
        /**
         * Set the domain this plugin is supposed to use when authenticating.
         *
         * @param $domain String: authentication domain.
         * @public
         */
        function setDomain( $domain ) {
                $this->domain = $domain;
        }
 
        /**
         * Check to see if the specific domain is a valid domain.
         *
         * @param $domain String: authentication domain.
         * @return bool
         * @public
         */
        function validDomain( $domain ) {
                # Override this!
                return true;
        }
 
        /**
         * When a user logs in, optionally fill in preferences and such.
         * For instance, you might pull the email address or real name from the
         * external user database.
         *
         * The User object is passed by reference so it can be modified; don't
         * forget the & on your function declaration.
         *
         * @param User $user
         * @public
         */
        function updateUser( &$user ) {
                # Override this and do something

		$realname = $user->getRealName();
		$len = strlen( $realname );
		
		# if ( $len = 0 )
		{
			$dbr = wfGetDB( DB_SLAVE );
			$qusername = $dbr->addQuotes( $user->getName() );
			
			$res = $dbr->selectRow(
				$this->bugzillatbl,
				array( "realname" ),
				"LCase(login_name)=LCase($qusername)",
				"AuthBugzilla::updateUser" );

			$user->setRealName($res->realname);
			$user->setEmail($user->getName());
			$user->saveSettings();
		}

		return true;
        }
 
 
        /**
         * Return true if the wiki should create a new local account automatically
         * when asked to login a user who doesn't exist locally but does in the
         * external auth database.
         *
         * If you don't automatically create accounts, you must still create
         * accounts in some way. It's not possible to authenticate without
         * a local account.
         *
         * This is just a question, and shouldn't perform any actions.
         *
         * @return bool
         * @public
         */
        function autoCreate() {
                return true;
        }
 
        /**
         * Can users change their passwords?
         *
         * @return bool
         */
        function allowPasswordChange() {
                return ;
        }
 
        /**
         * Set the given password in the authentication database.
         * As a special case, the password may be set to null to request
         * locking the password to an unusable value, with the expectation
         * that it will be set later through a mail reset or other method.
         *
         * Return true if successful.
         *
         * @param $user User object.
         * @param $password String: password.
         * @return bool
         * @public
         */
        function setPassword( $user, $password ) {
                $saltchars = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz./';
 
                # Generate the salt.  We use an 8 character (48 bit) salt for maximum
                # security on systems whose crypt uses MD5.  Systems with older
                # versions of crypt will just use the first two characters of the salt.
                $salt = '';
                for ($i=0 ; $i < 8 ; $i++ ) {
                        $salt .= $saltchars[rand(0,63)];
                }
 
                $dbr =& wfGetDB( DB_MASTER );
                $qusername = $dbr->addQuotes( $user->mName );
                $user = $dbr->tableName( 'user' );
                $email = $dbr->selectField(
                        "$user",
                        "user_email",
                        "user_name=$qusername and user_email_authenticated is not null");
                #$qemail = $dbr->addQuotes( $email );
 
                $newpass = $this->encryptPassword($password,$salt);
 
                $res = $dbr->update(
                        $this->bugzillatbl,
                        array( "cryptpassword" => $newpass),
                        array( "CONCAT(login_name,disabledtext)" => $email),
                        "AuthBugzilla::setPassword" );
 
                return true;
        }
 
        /**
         * Update user information in the external authentication database.
         * Return true if successful.
         *
         * @param $user User object.
         * @return bool
         * @public
         */
        function updateExternalDB( $user ) {
                return true;
        }
 
        /**
         * Check to see if external accounts can be created.
         * Return true if external accounts can be created.
         * @return bool
         * @public
         */
        function canCreateAccounts() {
                return false;
        }
 
        /**
         * Add a user to the external authentication database.
         * Return true if successful.
         *
         * @param User $user
         * @param string $password
         * @return bool
         * @public
         */
        function addUser( $user, $password ) {
                return true;
        }
 
 
        /**
         * Return true to prevent logins that don't authenticate here from being
         * checked against the local database's password fields.
         *
         * This is just a question, and shouldn't perform any actions.
         *
         * @return bool
         * @public
         */
        function strict() {
                return false;
        }
 
        /**
         * When creating a user account, optionally fill in preferences and such.
         * For instance, you might pull the email address or real name from the
         * external user database.
         *
         * The User object is passed by reference so it can be modified; don't
         * forget the & on your function declaration.
         *
         * @param $user User object.
         * @public
         */
        function initUser( &$user ) {
                # Override this to do something.
        }
 
        /**
         * If you want to munge the case of an account name before the final
         * check, now is your chance.
         */
        function getCanonicalName( $username ) {
                return $username;
        }
}
 
?>

Add topic