php oath server suite
4.0.5
Un ensemble de classes pour fournir une authentification à deuxième facteur comme Yubico OTP (Yubikey), Oath (TOTP, HOTP, GoogleAuthenticator) côté serveur.
Pour plus d'informations sur Oath, consultez https://openauthentication.org/.
Plus d’informations sur TOTP (Time-based One-time Password Algorithm) sont disponibles sur Wikipedia.
Plus d’informations sur HOTP (algorithme de mot de passe à usage unique basé sur HMAC) sont disponibles sur Wikipedia.
Pour plus d'informations sur le mécanisme d'authentification Yubico OTP, lisez l'article « Qu'est-ce que YubiKey OTP ? » sur https://developers.yubico.com/OTP/.
{
"require": {
"chroma-x/oath-server-suite": "~4.0"
}
}
require_once('path/to/vendor/autoload.php');
Pour utiliser Yubico OTP, vous avez besoin d'un accès YubiCloud. Vous pouvez obtenir des informations d'identification API gratuites sur https://upgrade.yubico.com/getapikey/.
use ChromaXCommonExceptionNetworkExceptionBaseNetworkException;
$otp = $_POST['otp'];
$userPublicId = 'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationYubicoOtpValidator('yubiCloudClientId', 'yubiCloudSecretKey');
try {
$validator->validate($otp, $userPublicId);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
} catch (NetworkException $exception) {
// Accessing the YubiCloud webservice failed.
}
Pour permettre l'authentification, le client et le serveur doivent partager un secret. Habituellement, le serveur définit un secret et l'affiche avec le nom de la clé et le mécanisme d'authentification sous forme de code QR.
Google Authenticator et certaines autres applications et éléments matériels – comme le Yubikey – ne suivent pas la norme en attendant les secrets non pas sous forme hexadécimale mais sous forme de données codées en Base32.
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderTotpBase32SharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for TOTP (Time-based One-time Password Algorithm)
$contentEncoder = new TotpBase32SharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for TOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new TotpBase32SharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderHotpBase32SharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for HOTP (HMAC-based One-time Password Algorithm)
$contentEncoder = new HotpBase32SharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for HOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new HotpBase32SharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
$totp = $_POST['totp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathTotpValidator();
$validator->validate($totp, $sharedSecret);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
$hotp = $_POST['hotp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$counter = (int)'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathHotpValidator();
$validator->validate($hotp, $sharedSecret, $counter);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderTotpSharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for TOTP (Time-based One-time Password Algorithm)
$contentEncoder = new TotpSharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for TOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new TotpSharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
use ChromaXOathServerSuiteSecretSharingSharedSecretQrCodeProviderSharedSecretQrCodeProvider;
use ChromaXOathServerSuiteSecretSharingSharedSecretUrlEncoderHotpSharedSecretUrlEncoder;
use ChromaXQrCodeSuiteQrEncodeQrEncoder;
// Initialize Oath URL encoder for HOTP (HMAC-based One-time Password Algorithm)
$contentEncoder = new HotpSharedSecretUrlEncoder();
// Setting the key name
$keyName = 'My Username';
// Setting the issuer name
$issuerName = 'Awesome Application';
// Setting a secret
// Attention: This is just an example value
// Use a random value of a proper length stored with your user credentials
$sharedSecret = openssl_random_pseudo_bytes(30);
// Getting the shared secret URL for usage wihtout QR code provision
$sharedSecretUrl = $contentEncoder->encode($keyName, $sharedSecret);
// Start QR code provision
// Initialize the QR code provider with Oath URL encoder for HOTP
$sharedSecretQrProvider = new SharedSecretQrCodeProvider(new HotpSharedSecretUrlEncoder(), $keyName, $sharedSecret, $issuerName);
// Configure the QR code renderer for your needs
$sharedSecretQrProvider->getQrEncoder()
->setLevel(QrEncoder::QR_CODE_LEVEL_LOW)
->setTempDir('/path/to/a/writable/temp-dir');
// Persist the QR code PNG to the filesystem
$sharedSecretQrProvider->provideQrCode('/path/to/the/qrcode.png');
$totp = $_POST['totp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathTotpValidator();
$validator->validate($totp, $sharedSecret);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
$hotp = $_POST['hotp'];
$sharedSecret = 'fetchedFromDatabaseOrSimilar';
$counter = (int)'fetchedFromDatabaseOrSimilar';
$validator = new OathServerSuiteValidationOathHotpValidator();
$validator->validate($hotp, $sharedSecret, $counter);
if ($validator->isValid()) {
// Validation was successful
} else {
// Validation failed
}
php oath server suite fournit différentes exceptions – certaines fournies par le projet PHP Common Exceptions – pour une gestion correcte.
Vous pouvez trouver plus d’informations sur les exceptions communes PHP sur Github.
Contribuer à nos projets est toujours très apprécié.
Mais : veuillez suivre les directives de contribution écrites dans le document CONTRIBUTING.md.
php oath server suite est sous licence MIT.
