Project

General

Profile

« Previous | Next » 

Revision 8901958c

Added by Jim Pingle almost 15 years ago

Add backend code to verify username against cn on login if set by user. Needs GUI code to set the option yet. Ticket #887

View differences:

etc/inc/openvpn.auth-user.php
85 85 
/* read data from environment */
86 86 
$username = getenv("username");
87 87 
$password = getenv("password");
88 
$common_name = getenv("common_name");
88 89 

  		




  89
  90
  
    
if (!$username || !$password) {


  		




  90
  91
  
    
	syslog(LOG_ERR, "invalid user authentication environment");


  		




  ......




  95
  96
  
    
//<template>


  		




  96
  97
  
    

  		




  97
  98
  
    
$authenticated = false;


  		




  
  99
  
    

  		




  
  100
  
    
if (($strictusercn === true) && ($common_name != $username)) {


  		




  
  101
  
    
	syslog(LOG_WARNING, "Username does not match certificate common name ({$username} != {$common_name}), access denied.\n");


  		




  
  102
  
    
	exit(1);


  		




  
  103
  
    
}


  		




  
  104
  
    

  		




  98
  105
  
    
foreach ($authmodes as $authmode) {


  		




  99
  106
  
    
	$authcfg = auth_get_authserver($authmode);


  		




  100
  107
  
    
	if (!$authcfg && $authmode != "local")


  		












  

    
      etc/inc/openvpn.inc
    
  





  392
  392
  
    
						$firstsed = 1;


  		




  393
  393
  
    
						$sed .= "\"{$authcfg}\"";


  		




  394
  394
  
    
					}


  		




  395
  
  
    
					$sed .= ");";


  		




  
  395
  
    
					$sed .= ");\\\n";


  		




  
  396
  
    
					if (isset($settings['strictusercn']))


  		




  
  397
  
    
						$sed .= "\$strictusercn = true;";


  		




  396
  398
  
    
					mwexec("/bin/cat /etc/inc/openvpn.auth-user.php | /usr/bin/sed 's/\/\/<template>/{$sed}/g' >  {$g['varetc_path']}/openvpn/{$mode_id}.php");


  		




  397
  399
  
    
					mwexec("/bin/chmod a+x {$g['varetc_path']}/openvpn/{$mode_id}.php");


  		




  398
  400
  
    
					$conf .= "auth-user-pass-verify {$g['varetc_path']}/openvpn/{$mode_id}.php via-env\n";


  		












Also available in:  Unified diff