Smart.Unicorn (Multi-Account) Auth Admins Handler
This class provide a complex authentication for admin area (admin.php|task.php) using multi-accounts system with SQLite DB
Supports: HTTP Basic Auth ; HTTP Bear Auth (SWT) *optional* ; built-in HTTP Basic Token Auth (STK) *optional*
Required (only init, after dissalowed) constants: APP_AUTH_ADMIN_INIT_IP_ADDRESS, APP_AUTH_ADMIN_USERNAME, APP_AUTH_ADMIN_PASSWORD (must be set in set in config-admin.php only for init, thereafter must be unset)
Required constants: APP_AUTH_PRIVILEGES (must be set in set in config-admin.php)
Required configuration: $configs['app-auth']['adm-namespaces'][ 'Admins Manager' => 'admin.php?page=auth-admins.manager.stml', ... ] (must be set in set in config-admin.php)
Language: PHP
Located at: modules/mod-auth-admins/libs/SmartAuthAdminsHandler.php
Package: development:modules:AuthAdmins
Namespace: \SmartModExtLib\AuthAdmins\
Class Name: SmartAuthAdminsHandler
Version: v.20240119
Inheritance Chart:
class \SmartModExtLib\AuthAdmins\SmartAuthAdminsHandler →
↳ class \SmartModExtLib\AuthAdmins\AbstractAuthHandler →
public staticfunctionAuthenticate (
bool$enforce_https = false
) {} :: VOID
reimplemented over \SmartModExtLib\AuthAdmins\AuthHandlerInterface
Auth Handler Authenticate
THIS MUST BE EXTENDED TO HANDLE AN AUTHENTICATION METHOD
RETURN: VOID ; On FAILED Logins this method should STOP EXECUTION and provide the proper HTTP Status Message: ex: 401, 403, 429, ...
final protected staticfunctiongetClassName (
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
RETURN: STRING ; The current called class name that has been extended from this one, without namespace prefix
final protected staticfunctionpreCheckForbiddenConditions (
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Auth Pre-Check FORBIDDEN Conditions : Status 403
This method should not be called more than once !
IMPORTANT: All messages from this method may be display to public via HTTP Status Pages
DO NOT INCLUDE SENSITIVE INFORMATION IN THIS MESSAGES !
RETURN: STRING ; 'ERR-Message' or ''
final protected staticfunctionpreCheckInternalErrorConditions (
bool$disable_tokens = false,
bool$disable_2fa = false
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Auth Pre-Check INTERNAL ERROR Conditions : Status 500
This method should not be called more than once !
IMPORTANT: All messages from this method may be display to public via HTTP Status Pages
DO NOT INCLUDE SENSITIVE INFORMATION IN THIS MESSAGES !
RETURN: STRING ; 'ERR-Message' or ''
final protected staticfunctionpreCheckBadGatewayConditions (
bool$enforce_https
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Auth Pre-Check BAD GATEWAY Conditions : Status 502
This method should not be called more than once !
IMPORTANT: All messages from this method may be display to public via HTTP Status Pages
DO NOT INCLUDE SENSITIVE INFORMATION IN THIS MESSAGES !
RETURN: STRING ; 'ERR-Message' or ''
final protected staticfunctionpreCheckServiceUnavailableConditions (
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Auth Pre-Check SERVICE UNAVAILABLE Conditions : Status 503
This method should not be called more than once !
IMPORTANT: All messages from this method may be display to public via HTTP Status Pages
DO NOT INCLUDE SENSITIVE INFORMATION IN THIS MESSAGES !
RETURN: STRING ; 'ERR-Message' or ''
final protected staticfunctiongetAuthCredentials (
bool$enforce_https,
bool$disable_tokens,
bool$disable_2fa
) {} :: ARRAY
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Auth Get Credentials
It will retry the Auth Credentials from the HTTP Headers (Basic Auth or Bearer Auth)
This method should not be called more than once !
RETURN: ARRAY ; see the AUTH_CREDENTIALS array definition in this class ...
final protected staticfunctiontryAuthGuard (
) {} :: BOOL
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Try Authentication Guard
This will detect the single following situation, that will skip Try Auth (this is the entry page):
- current script ends in `.php`
- current REQUEST_METHOD is GET or HEAD
- there are no input variables from REQUEST_URI, QUERY_STRING, PATH_INFO, REQUEST, GET, POST, FILES
For all the rest of situations will return TRUE (ask Try Auth)
There is no need to check for COOKIES, this is an HTTP Auth Handler, not managing Auth by Cookies ...
REQUEST_URI != SCRIPT_NAME (it means have query variables)
RETURN: BOOL ; if TRUE, Auth is required, otherwise if FALSE should not
final protected staticfunctionisAuthLogout (
) {} :: BOOL
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Detect Logout Request
This will detect the single following situation, that will display the Logout page:
- current script ends in `.php`
- current REQUEST_METHOD is GET or HEAD
- the $_REQUEST['logout'] variable is set and not empty
RETURN: BOOL ; if TRUE, Auth will display the Logout Page
final protected staticfunctionrenderAuthLogoutPage (
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Render the Logout Page
RETURN: STRING ; HTML MAIN TPL
final protected staticfunctionrenderAuthLoginPage (
bool$disable_2fa,
string$auth_user_name,
string$auth_mode,
string$auth_desc_mode,
string$html_inc_code_poweredby_area = ""
) {} :: STRING
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Render the Login Page
RETURN: STRING ; HTML MAIN TPL
final protected staticfunctionisAuthLoginValid (
string$auth_user_name,
string$hash_of_pass,
array$account_data
) {} :: BOOL
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Validate the Account Data against Auth UserName / PassHash ;
RETURN: BOOL ; if TRUE, the Login is SUCCESS ; Otherwise Login is FAIL
final protected staticfunctionisAuth2FAValid (
string$auth_user_name,
bool$use_2fa,
string$valid_2fa_pin_token = ""
) {} :: BOOL
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Validate the 2FA login Value from Cookies compared with 2FA Token Pin or Visitor UUID Hash
IMPORTANT: the value of cookie will be compared with the provided $valid_2fa_pin_token which have to be a valid TOTP Pin Token
RETURN: BOOL ; if TRUE, the 2FA is VALID ; otherwise is INVALID
final protected staticfunctionisAuthIPAddressValid (
string$restricted_ip_list
) {} :: BOOL
inherited from \SmartModExtLib\AuthAdmins\AbstractAuthHandler
Validate the IP Restrictions login Value using the User IPAddress List Restrictions ; ex: <ip1>,<ip2>,...
RETURN: BOOL ; if TRUE, the Current Visitor IP is VALID ; otherwise is INVALID
This class provide a complex authentication for admin area (admin.php|task.php) using multi-accounts system with SQLite DB
Supports: HTTP Basic Auth ; HTTP Bear Auth (SWT) *optional* ; built-in HTTP Basic Token Auth (STK) *optional*
Required (only init, after dissalowed) constants: APP_AUTH_ADMIN_INIT_IP_ADDRESS, APP_AUTH_ADMIN_USERNAME, APP_AUTH_ADMIN_PASSWORD (must be set in set in config-admin.php only for init, thereafter must be unset)
Required constants: APP_AUTH_PRIVILEGES (must be set in set in config-admin.php)
Required configuration: $configs['app-auth']['adm-namespaces'][ 'Admins Manager' => 'admin.php?page=auth-admins.manager.stml', ... ] (must be set in set in config-admin.php)