1.3. Example for authentication integration¶
Adding LinOTP authentication to your existing source code is quite simple. In this chapter we describe how to authenticate users against LinOTP in the programming languages:
Python
C#
Java
Java Script (server side)
C
PHP
First of all, you will need a working LinOTP. If you don’t have a running LinOTP yet, check https://linotp.org/doc/latest/part-installation/server-installation/index.html to get the installation done. After your LinOTP is installed login to the management Web UI http(s)://LINOTPSERVER/manage and add a UserIDResolver and a Realm. (https://linotp.org/doc/latest/part-management/quickstart.html)
1.3.1. Python integration¶
To create a stand alone Python example save the following code as a Python file and run it; i.e. “python3 <file_name>.py”
import requests
import json
def main():
# prepare hostname and user which want to login
hostname = "linotpexample.com"
controller = "validate"
action = "check"
url = "https://" + hostname + "/" + \
controller + "/" + action
post_params = {"user": "testuser",
"pass": "123456",
"realm": "realmname"}
# do request
response = requests.post(url, data=post_params)
# parse response as json
json_response = json.loads(response.text)
authenticated = json_response[u"result"][u"value"]
if authenticated:
print("authenticated successful")
else:
print("not authenticated")
print("json response: {}".format(json_response))
if __name__ == '__main__':
# execute only if run as the entry point into the program
main()
The json response is the same as described by the curl request.
1.3.2. C# integration¶
To test the following code you can create a new C# (console) project add the following code. This code will work on Microsoft Visual Studio as well as Xamarin.
If you run it you will see the “authenticated” or “not authenticated” text in the console.
using System;
using System.Net;
using System.Collections.Specialized;
using Newtonsoft.Json;
namespace authlinotp
{
class MainClass
{
public static void Main(string[] args)
{
string hostname = "linotpexample.com";
string controller = "validate";
string action = "check";
string URI = "https://" + hostname + "/" + controller + "/" + action;
var postParameters = new
NameValueCollection{{ "user", "username"},
{ "pass", "123456"},
{ "realm", "realmname"}};
byte[] response;
using (WebClient client = new WebClient())
{
response = client.UploadValues(URI, postParameters);
}
dynamic jsonResp = JsonConvert.DeserializeObject(System.Text.Encoding.UTF8.GetString(response));
bool authenticated = jsonResp.result.value;
if (authenticated)
{
Console.WriteLine("authenticated");
}
else
{
Console.WriteLine("not authenticated");
}
Console.WriteLine(System.Text.Encoding.UTF8.GetString(response));
}
}
}
The json response is the same as described by the curl request.
1.3.3. Java integration¶
The following code is built using IntelliJ IDEA CE with gradle.
File -> New Project -> Gradle -> Java (hook).
Insert your GroupId (com.example.sample) and ArtifactId (linotp-auth).
Hook “Use auto-import” and “Create directories for empty content roots automatically”.
Create a new java class by clicking right on src/main/java and copy the following code into this file. .. image:: images/java_ide_add_class.png To your “build.grade” file add:
dependencies {
compile 'org.apache.httpcomponents:httpclient:4.5'
compile group: 'org.glassfish', name: 'javax.json', version: '1.0.4'
}
Then run your code via the IDE click on the green triangle and click “Run”
package com.example.linotpauth;
import java.io.StringReader;
import java.util.ArrayList;
import java.util.List;
import javax.json.Json;
import javax.json.JsonObject;
import javax.json.JsonReader;
import org.apache.http.HttpEntity;
import org.apache.http.NameValuePair;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.message.BasicNameValuePair;
import org.apache.http.util.EntityUtils;
import org.apache.http.client.entity.UrlEncodedFormEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
public class LinOTPAuth {
public static void main(String[] args) throws Exception {
String hostname = "linotpexample.com";
String controller = "validate";
String action = "check";
String requestURL = "https://" + hostname + "/" + controller + "/" + action;
// Create HTTP request via ssl port (https) and pass post parameters
CloseableHttpClient httpclient = HttpClients.createDefault();
try {
HttpPost httpPost = new HttpPost(requestURL);
List <NameValuePair> nvps = new ArrayList <NameValuePair>();
nvps.add(new BasicNameValuePair("user", "username"));
nvps.add(new BasicNameValuePair("pass", "password"));
nvps.add(new BasicNameValuePair("realm", "realmname"));
httpPost.setEntity(new UrlEncodedFormEntity(nvps));
CloseableHttpResponse response = httpclient.execute(httpPost);
try {
HttpEntity entity = response.getEntity();
String s_response = EntityUtils.toString(entity);
JsonReader reader = Json.createReader(new StringReader(s_response));
JsonObject j_response = reader.readObject();
//parse json response for result value
JsonObject j_result = j_response.getJsonObject("result");
Boolean authenticated = j_result.getBoolean("value", false);
if (authenticated) {
System.out.println("authenticated");
}
else {
System.out.println("not authenticated");
}
System.out.println(s_response);
// consume will release the entity
EntityUtils.consume(entity);
} finally {
response.close();
}
} finally {
httpclient.close();
}
}
}
The json response is the same as described by the curl request.
1.3.4. Java Script integration for server side implementation¶
Get nodejs from (https://nodejs.org/en/) and install the request dependency via npm command.
npm install request
var request = require('request');
var hostname = "linotpexample.com"
var controller = "validate"
var action = "check"
var reqeustUrl = "https://" + hostname + "/" + controller + "/" + action;
var postParameters = {
user: "username",
pass: "123456",
realm: "realmname"
};
request.post(reqeustUrl, {form: postParameters}, function callback(err, response, body) {
if(err) {
return console.error('request failed', err);
}
var data = JSON.parse(body);
if(data.result.value === true) {
console.log("authenticated")
}
else {
console.log("not authenticated")
}
console.log(body)
});
Save the code above (i.e. linotpauth.js) and run it with:
node linotpauth.js
The json response is the same as described by the curl request.
1.3.5. C integration¶
For usual binary programs written in C, you could take a look at the pam_linotp implementation which can be obtained from our GitHub repository https://github.com/LinOTP/LinOTP. The pam_linotp.c file is located in auth_modules/src/libpam-linotp/src/
This creates the URL, that needs to be sent
char * createUrl(CURL *curl_handle,
const char * validateurl,
const char * realm, const char * resConf,
const char * user, const char * password)
{
char * url = NULL;
int size = 300;
int nchars = 0;
// escape user and password
char *escPassword;
char *escUser;
escPassword = curl_easy_escape(curl_handle, password, 0);
escUser = curl_easy_escape(curl_handle, user, 0);
char *escRealm = curl_easy_escape(curl_handle, realm, 0);
char *escResConf = curl_easy_escape(curl_handle, resConf, 0);
if (escPassword == NULL || escUser == NULL)
{
log_error("ERROR: failed to escape user or password");
goto cleanup;
}
url = (char*) malloc (size);
if (url == NULL)
{
log_error("ERROR: could allocate size for url");
goto cleanup;
}
// allocate the memory for url string
memset(url,'\0',size);
nchars = snprintf( url, size-1, "%s?user=%s&pass=%s&realm=%s&resConf=%s",
validateurl,
escUser, escPassword,
escRealm, escResConf );
if (nchars >= size-1)
{
// reallocate
size = nchars +1;
url = (char*) myrealloc (url, size);
if (url == NULL)
{
log_error("ERROR: failed to alloc space for url + user and password");
goto cleanup;
}
memset(url,'\0',size);
snprintf(url, size-1, "%s?user=%s&pass=%s&realm=%s&resConf=%s", validateurl,
escUser, escPassword,
escRealm, escResConf );
}
cleanup:
return url;
}
The authentication itself could look like this
int linotp_auth(const char *user, const char *password, const char *validateurl,
const char *realm, const char *resConf,
int nosslhostnameverify, int nosslcertverify, int debug)
{
CURL *curl_handle = NULL;
int returnValue = PAM_AUTH_ERR;
char *url = NULL;
CURLcode all_status = 0;
char errorBuffer[CURL_ERROR_SIZE];
struct MemoryStruct chunk;
chunk.memory = NULL; /* we expect realloc(NULL, size) to work */
chunk.size = 0; /* no data at this point */
curl_global_init(CURL_GLOBAL_ALL);
curl_handle = curl_easy_init();
if (curl_handle == NULL)
{
log_error("ERROR: could not get curl_handle!");
returnValue = PAM_AUTH_ERR;
goto cleanup;
}
curl_easy_setopt(curl_handle, CURLOPT_ERRORBUFFER, errorBuffer);
url = createUrl(curl_handle, validateurl, realm, resConf, user, password);
if (url == NULL)
{
log_error("ERROR: could allocate size for url");
goto cleanup;
}
if (debug)
{
log_debug("DEBUG: connecting to url:%s",url);
}
all_status = sendRequest(curl_handle, url,
(void *)&chunk, nosslhostnameverify, nosslcertverify);
/* set default return*/
returnValue = PAM_AUTH_ERR;
if (all_status != 0)
{
log_error("ERROR: Error talking to linotpd server at %s: %s", url, errorBuffer);
returnValue = PAM_AUTH_ERR;
goto cleanup;
}
if(chunk.memory == NULL)
{
log_error("ERROR: No response returned for %s: %s", url, errorBuffer);
returnValue = PAM_AUTH_ERR;
goto cleanup;
}
if (strcmp(chunk.memory, LINOTPD_REJECT) == 0)
{
log_warning("WARNING: user '%s' rejected", user);
returnValue = PAM_AUTH_ERR;
goto cleanup;
}
if (strcmp(chunk.memory, LINOTPD_FAIL ) == 0)
{
log_warning("WARNING: authentication for '%s' failed", user);
returnValue = PAM_AUTH_ERR;
goto cleanup;
}
if (strcmp( chunk.memory, LINOTPD_OK ) == 0)
{
log_info("INFO: user '%s' authenticated successfully\n", user);
returnValue = PAM_SUCCESS;
goto cleanup;
}
// default
{
log_error("ERROR: An error occurred for '%s' on '%s'\n", user, validateurl);
returnValue = PAM_AUTH_ERR;
goto cleanup;
}
cleanup:
if (chunk.memory!= NULL)
{
free(chunk.memory);
}
if (url != NULL)
{
free(url);
}
/* we're done with libcurl, so clean it up
cleanup also takes care of escPassword and escUser
*/
curl_global_cleanup();
if (debug)
{
log_debug("linotp_auth exited normally.");
}
return (returnValue);
}
In this example we defined a helper function sendRequest
int sendRequest(CURL *curl_handle, char * url,
struct MemoryStruct * chunk,
int nosslhostnameverify, int nosslcertverify)
{
int all_status = 0;
int status = 0;
all_status = 0;
status = curl_easy_setopt(curl_handle, CURLOPT_URL, url);
all_status += status;
status = curl_easy_setopt(curl_handle, CURLOPT_WRITEFUNCTION, WriteMemoryCallback);
all_status += status;
status = curl_easy_setopt(curl_handle, CURLOPT_WRITEDATA, chunk);
all_status += status;
status = curl_easy_setopt(curl_handle, CURLOPT_USERAGENT, "libcurl-agent/1.0");
all_status += status;
if ( nosslhostnameverify )
status = curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYHOST, 0L);
else
status = curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYHOST, 2L);
all_status += status;
if ( nosslcertverify )
status = curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYPEER, 0L);
else
status = curl_easy_setopt(curl_handle, CURLOPT_SSL_VERIFYPEER, 1L);
all_status += status;
status = curl_easy_perform(curl_handle);
all_status += status;
curl_easy_cleanup(curl_handle);
return all_status;
}
1.3.6. PHP integration¶
For usual web applications or portals that might be written in PHP you could use code like this:
<?php
public function linotp_auth($user="", $pass="", $realm="") {
$ret=false;
try {
$server = $this->server;
$REQUEST="https://$server/validate/check?pass=$pass&user=$user";
if (""!=$realm)
$REQUEST="$REQUEST&realm=$realm";
if (!function_exists("curl_init"))
die("cURL extension is not installed!");
$ch=curl_init($REQUEST);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, $this->verify_peer);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, $this->verify_host);
$r=curl_exec($ch);
curl_close($ch);
$Object = json_decode($r);
if (true == $Object->{'result'}->{'status'} )
if (true == $Object->{'result'}->{'value'} )
$ret=true;
} catch (Exception $e) {
print "Error in receiving response from LinOTP server: $e";
}
return $ret;
}
?>