add passwordCheck hook (#219)

Author: David Coutadeur

conf/config.inc.php

@@ -336,6 +336,7 @@
 #        "ignoreError" => false,
 #        "encodebase64" => false
 #    ),
+#    "passwordCheck" => array(),
 #    "passwordLock" => array(),
 #    "passwordUnlock" => array(),
 #    "accountEnable" => array(),
@@ -346,6 +347,7 @@
 #    "deleteAccount" => array()
 #);
 # passwordReset, passwordLock,...: entrypoints triggering hooks
+#  * passwordCheck:       input: login, new password
 #  * passwordReset:       input: login, new password
 #  * passwordLock:        input: login
 #  * passwordUnlock:      input: login

htdocs/checkpassword.php

@@ -23,6 +23,7 @@
 
     require_once("../conf/config.inc.php");
     require __DIR__ . '/../vendor/autoload.php';
+    require_once("../lib/hook.inc.php");
 
     # Connect to LDAP
     $ldap_connection = $ldapInstance->connect();
@@ -36,20 +37,38 @@
         error_log("LDAP - $dn not found using the configured search settings, reject request");
     } else {
 
-        if ($use_checkpasswordhistory) {
-            $password_history = $ldapInstance->get_attribute_values($dn, "pwdHistory");
-            foreach ($password_history as $previous_password) {
-                preg_match("/(?<={).*(?=})/", $previous_password, $algorithm);
-                preg_match("/{(?<={).*/", $previous_password, $hash);
-                if (\Ltb\Password::check_password($password, $hash[0], $algorithm[0])) {
-                    $result = "passwordinhistory";
+
+        if ( isset($hook_login_attribute) ) {
+            $hook_login = get_hook_login($dn, $ldapInstance, $hook_login_attribute);
+        }
+
+        list($prehook_return, $prehook_message) =
+            hook($prehook, 'passwordCheck', $hook_login, array( 'password' => $password ));
+
+
+        if ( $prehook_return > 0 and !$prehook['passwordCheck']['ignoreError']) {
+            $result = "passwordinvalid";
+        } else {
+            if ($use_checkpasswordhistory) {
+                $password_history = $ldapInstance->get_attribute_values($dn, "pwdHistory");
+                foreach ($password_history as $previous_password) {
+                    preg_match("/(?<={).*(?=})/", $previous_password, $algorithm);
+                    preg_match("/{(?<={).*/", $previous_password, $hash);
+                    if (\Ltb\Password::check_password($password, $hash[0], $algorithm[0])) {
+                        $result = "passwordinhistory";
+                    }
                 }
             }
+
+            if (!$result) {
+                $bind = ldap_bind($ldap, $dn, $password);
+                $result = $bind ? "passwordok" : "passwordinvalid";
+            }
         }
 
-        if (!$result) {
-	    $bind = ldap_bind($ldap, $dn, $password);
-	    $result = $bind ? "passwordok" : "passwordinvalid";
+        if ( $result === "passwordok" ) {
+            list($posthook_return, $posthook_message) =
+                hook($posthook, 'passwordCheck', $hook_login, array( 'password' => $password ));
         }
 
     }
@@ -59,4 +78,11 @@
     auditlog($audit_log_file, $dn, $audit_admin, "checkpassword", $result, NULL);
 }
 
-header('Location: index.php?page=display&dn='.$dn.'&checkpasswordresult='.$result);
+$location = 'index.php?page=display&dn='.$dn.'&checkpasswordresult='.$result;
+if ( isset($prehook_return) and $prehook['passwordCheck']['displayError'] and $prehook_return > 0 ) {
+    $location .= '&prehookresult='.$prehook_message;
+}
+if ( isset($posthook_return) and $posthook['passwordCheck']['displayError'] and $posthook_return > 0 ) {
+    $location .= '&posthookresult='.$posthook_message;
+}
+header('Location: '.$location);

htdocs/resetpassword.php

@@ -92,7 +92,7 @@
                 hook($prehook, 'passwordReset', $hook_login, array( 'password' => $password ));
 
 
-            if ( $prehook_return > 0 and !$ignore_prehook_return) {
+            if ( $prehook_return > 0 and !$prehook['passwordReset']['ignoreError']) {
                 $result = "passwordrefused";
             } else {
             $reset = ($pwdreset === "true") ? true : false;

lib/hook.inc.php

@@ -76,6 +76,7 @@ function call_external_command($hookConfig, $entrypoint, $login_value, $params)
 
     switch ($entrypoint) {
 
+        case "passwordCheck":
         case "passwordReset":
             $password = $params['password'];
             $command = password_hook_command($hookConfig[$entrypoint]['externalScript'],
@@ -131,6 +132,7 @@ function call_external_function($hookConfig, $entrypoint, $login_value, $params)
 
     switch ($entrypoint) {
 
+        case "passwordCheck":
         case "passwordReset":
             $password = $params['password'];
             if( isset($hookConfig[$entrypoint]['encodebase64']) &&