Skip to content

Commit 56a4a09

Browse files
jaapmarcusScIT-Raphael
jaapmarcus
and
ScIT-Raphael
authored
[Feature] [hestiacp#1460] PMA SSO Support (hestiacp#1495)
* Add support for Single Sign on into PHPmyAdmin * Undo commeting out error_reporting for debugging * Limit time token is valid Removed IP from pass trough * - Delete temp user after log out * - Delete temp user after logout - Improved comments * - Check for valid return message * Update /edit/server + Added support for proposed pma changes * Fix typo in command * Fix issue with sed target… * Fix sed target * Revert change to error_reporting Co-authored-by: Raphael Schneeberger <rs@scit.ch>
1 parent 32557db commit 56a4a09

File tree

12 files changed

+599
-7
lines changed

12 files changed

+599
-7
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ All notable changes to this project will be documented in this file.
33

44
## [DEVELOPMENT]
55
### Features
6-
- No new features have been introduced in this release.
6+
- Introduced support for PHPmyAdmin Single Sign On
77

88
### Bugfixes
99
- Fixed an issue where user name was duplicated when editing FTP users (#1411)

‎bin/v-add-database-temp-user‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
#!/bin/bash
2+
# info: add temp database user
3+
# options: USER DATABASE [TYPE] [HOST] [TTL]
4+
# labels: hestia database
5+
#
6+
# example: v-add-database-temp-user wordress wordpress_db mysql
7+
#
8+
# The function creates an temporary database user mysql_sso_db_XXXXXXXX and a random password
9+
# The user has an limited validity and only granted access to the specific database
10+
# Returns json to be read SSO Script
11+
12+
#----------------------------------------------------------#
13+
# Variable&Function #
14+
#----------------------------------------------------------#
15+
16+
# Argument definition
17+
user=$1
18+
database="$2"
19+
type=${3-mysql}
20+
host=$4
21+
ttl=$5
22+
23+
if [ "$ttl" == '' ]; then
24+
ttl=60
25+
fi
26+
27+
# Includes
28+
source $HESTIA/func/main.sh
29+
source $HESTIA/func/db.sh
30+
source $HESTIA/conf/hestia.conf
31+
32+
#----------------------------------------------------------#
33+
# Verifications #
34+
#----------------------------------------------------------#
35+
36+
check_args '2' "$#" 'USER DATABASE [TYPE] [HOST]'
37+
is_format_valid 'user' 'database'
38+
is_system_enabled "$DB_SYSTEM" 'DB_SYSTEM'
39+
is_object_valid 'user' 'USER' "$user"
40+
is_object_unsuspended 'user' 'USER' "$user"
41+
is_object_valid 'db' 'DB' "$database"
42+
is_object_unsuspended 'db' 'DB' "$database"
43+
get_next_dbhost
44+
45+
# Perform verification if read-only mode is enabled
46+
check_hestia_demo_mode
47+
48+
#----------------------------------------------------------#
49+
# Action #
50+
#----------------------------------------------------------#
51+
52+
# Get database values
53+
get_database_values
54+
55+
#generate password and unique user
56+
dbpass=$(generate_password);
57+
dbuser="hestia_sso_$(generate_password)";
58+
59+
add_mysql_database_temp_user
60+
if [ $? -ne 0 ]; then
61+
echo "Error: Unable to create temp user"
62+
exit 2
63+
fi;
64+
65+
if [[ "$ttl" -gt 0 ]]; then
66+
echo "$BIN/v-delete-database-temp-user $user $database $dbuser mysql $host" | at "now +${ttl} minute" > /dev/null 2>&1
67+
fi
68+
echo '{
69+
"login": {
70+
"user": "'$dbuser'",
71+
"password": "'$dbpass'"
72+
}
73+
}'
74+
75+
#----------------------------------------------------------#
76+
# Hestia #
77+
#----------------------------------------------------------#
78+
log_history "Granted $dbuser access to $database"
79+
80+
# Logging
81+
log_event "$OK" "$ARGUMENTS"
82+
exit

‎bin/v-add-sys-pma-sso‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
#!/bin/bash
2+
# info: enables support for single sign on PHPmyAdmin
3+
# options: [mode]
4+
# labels:
5+
#
6+
# example: v-add-sys-pma-sso
7+
#
8+
# Enables support for SSO to PHPmyAdmin
9+
10+
#----------------------------------------------------------#
11+
# Variable&Function #
12+
#----------------------------------------------------------#
13+
14+
MODE=$1
15+
16+
# Includes
17+
source $HESTIA/func/main.sh
18+
source $HESTIA/conf/hestia.conf
19+
20+
PMA_INSTALL="/usr/share/phpmyadmin"
21+
PMA_CONFIG="/etc/phpmyadmin"
22+
23+
#----------------------------------------------------------#
24+
# Verifications #
25+
#----------------------------------------------------------#
26+
27+
# Perform verification if read-only mode is enabled
28+
check_hestia_demo_mode
29+
30+
# Checking root permissions
31+
if [ "x$(id -u)" != 'x0' ]; then
32+
echo "Error: Script can be run executed only by root"
33+
exit 10
34+
fi
35+
36+
if [ ! -z "$PHPMYADMIN_KEY" ] && [ "$PHPMYADMIN_KEY" != "" ] ; then
37+
echo "Error: SSO has been installed before to reenable it please run v-delete-pma-sso first"
38+
exit 1;
39+
fi
40+
41+
# Ensure that $HESTIA (/usr/local/hestia/) and other variables are valid.
42+
if [ -z "$HESTIA" ]; then
43+
HESTIA="/usr/local/hestia"
44+
fi
45+
46+
if [ -z "$HOMEDIR" ] || [ -z "$HESTIA_INSTALL_DIR" ]; then
47+
echo "Error: Hestia environment vars not present"
48+
exit 2
49+
fi
50+
51+
if [ -f "/usr/share/phpmyadmin/hestia-sso.php" ]; then
52+
echo "Error: hestia-sso.php is already installed"
53+
exit 2
54+
fi
55+
56+
if [ -f "/usr/local/hesta/web/api/index.php" ]; then
57+
echo "Error: API script not installed"
58+
exit 2
59+
fi
60+
61+
if [ "$API" != "yes" ]; then
62+
echo "Error: API is not enabled"
63+
exit 2
64+
fi
65+
66+
#----------------------------------------------------------#
67+
# Action #
68+
#----------------------------------------------------------#
69+
70+
# Generate the keys to secure everything
71+
phpmyadminkey=$(generate_password);
72+
apikey=$($BIN/v-generate-api-key);
73+
74+
# copy config dir to /usr/share/phpmyadmin/
75+
cp -f $HESTIA_INSTALL_DIR/phpmyadmin/hestia-sso.php $PMA_INSTALL/hestia-sso.php
76+
chmod 644 $PMA_INSTALL/hestia-sso.php
77+
78+
sed -i "s/%PHPMYADMIN_KEY%/$phpmyadminkey/g" $PMA_INSTALL/hestia-sso.php
79+
sed -i "s/%API_KEY%/$apikey/g" $PMA_INSTALL/hestia-sso.php
80+
sed -i "s/%API_HOST_NAME%/$(hostname)/g" $PMA_INSTALL/hestia-sso.php
81+
sed -i "s/%API_HESTIA_PORT%/$BACKEND_PORT/g" $PMA_INSTALL/hestia-sso.php
82+
83+
84+
# Check if config already contains the keys
85+
86+
touch $PMA_CONFIG/hestia-sso.inc.php
87+
chmod 644 $PMA_CONFIG/hestia-sso.inc.php
88+
echo "<?php
89+
if(isset(\$_GET['hestia_token']) || isset(\$_COOKIE['SignonSession'])){
90+
\$cfg['Servers'][\$i]['auth_type'] = 'signon';
91+
\$cfg['Servers'][\$i]['SignonSession'] = 'SignonSession';
92+
\$cfg['Servers'][\$i]['SignonURL'] = 'hestia-sso.php';
93+
\$cfg['Servers'][\$i]['LogoutURL'] = 'hestia-sso.php?logout=1';
94+
}
95+
?>" >> $PMA_CONFIG/hestia-sso.inc.php
96+
97+
file=$(cat $PMA_CONFIG/config.inc.php)
98+
if ! [[ $file =~ "hestia-sso.inc.php" ]]; then
99+
if [[ $file =~ "//Add Hestia SSO code here" ]]; then
100+
sed -i "s|//Add Hestia SSO code here|//Add Hestia SSO code here\n include ('$PMA_CONFIG/hestia-sso.inc.php');|g" $PMA_CONFIG/config.inc.php
101+
else
102+
echo "include ('$PMA_CONFIG/hestia-sso.inc.php');" >> $PMA_CONFIG/config.inc.php
103+
fi
104+
fi
105+
106+
$BIN/v-change-sys-config-value 'PHPMYADMIN_KEY' "$phpmyadminkey"
107+
108+
#----------------------------------------------------------#
109+
# Logging #
110+
#----------------------------------------------------------#
111+
112+
if [ "$MODE" != "quiet" ]; then
113+
echo "PMA Hestia-SSO plugin has been succesfully installed"
114+
fi
115+
116+
log_history "PMA Hestia-SSO plugin has been succesfully installed" '' 'admin'
117+
log_event "$OK" "$ARGUMENTS"

‎bin/v-delete-database-temp-user‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
# info: deletes temp database user
3+
# options: USER DBUSER [TYPE] [HOST]
4+
# labels: hestia database
5+
#
6+
# example: v-add-database-temp-user wordress hestia_sso_user mysql
7+
#
8+
# Revokes "temp user" access to a database and removes the user
9+
# To be used in combination with v-add-database-temp-user
10+
11+
#----------------------------------------------------------#
12+
# Variable&Function #
13+
#----------------------------------------------------------#
14+
15+
# Argument definition
16+
user=$1
17+
database=$2
18+
dbuser=$3
19+
type=${4-mysql}
20+
host=$5
21+
22+
# Includes
23+
source $HESTIA/func/main.sh
24+
source $HESTIA/func/db.sh
25+
source $HESTIA/conf/hestia.conf
26+
27+
#----------------------------------------------------------#
28+
# Verifications #
29+
#----------------------------------------------------------#
30+
31+
check_args '3' "$#" 'USER DATABASE DBUSER [TYPE] [HOST]'
32+
is_format_valid 'user' 'dbuser'
33+
is_system_enabled "$DB_SYSTEM" 'DB_SYSTEM'
34+
is_object_valid 'user' 'USER' "$user"
35+
is_object_unsuspended 'user' 'USER' "$user"
36+
is_object_valid 'db' 'DB' "$database"
37+
is_object_unsuspended 'db' 'DB' "$database"
38+
get_next_dbhost
39+
40+
if [[ $dbuser != *"hestia_sso"* ]]; then
41+
echo "DBUSER is invalid SSO user"
42+
exit $E_INVALID;
43+
fi
44+
45+
# Perform verification if read-only mode is enabled
46+
check_hestia_demo_mode
47+
48+
#----------------------------------------------------------#
49+
# Action #
50+
#----------------------------------------------------------#
51+
52+
# Get database values
53+
get_database_values
54+
55+
delete_mysql_database_temp_user
56+
57+
#----------------------------------------------------------#
58+
# Hestia #
59+
#----------------------------------------------------------#
60+
log_history "Revoked $dbuser access to $database"
61+
62+
# Logging
63+
log_event "$OK" "$ARGUMENTS"
64+
exit

‎bin/v-delete-sys-pma-sso‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/bin/bash
2+
# info: disables support for single sign on PHPMYADMIN
3+
# options: [mode]
4+
# labels: hestia
5+
#
6+
# example: v-delete-sys-pma-sso
7+
#
8+
# Disables support for SSO to PHPmyAdmin
9+
10+
MODE=$1
11+
12+
# Includes
13+
source $HESTIA/func/main.sh
14+
source $HESTIA/conf/hestia.conf
15+
16+
PMA_INSTALL="/usr/share/phpmyadmin"
17+
PMA_CONFIG="/etc/phpmyadmin"
18+
19+
#----------------------------------------------------------#
20+
# Verifications #
21+
#----------------------------------------------------------#
22+
23+
# Perform verification if read-only mode is enabled
24+
check_hestia_demo_mode
25+
26+
if [ "x$(id -u)" != 'x0' ]; then
27+
echo "Error: Script can be run executed only by root"
28+
exit 10
29+
fi
30+
31+
if [ ! -e "$PMA_INSTALL/hestia-sso.php" ]; then
32+
echo 'Error: PMA Single Sign On already disabled'
33+
exit 1;
34+
fi
35+
36+
#----------------------------------------------------------#
37+
# Action #
38+
#----------------------------------------------------------#
39+
40+
apikey=$(grep -Po "'API_KEY', '(.*)'" /usr/share/phpmyadmin/hestia-sso.php | cut "-d'" -f4 )
41+
42+
$BIN/v-revoke-api-key $apikey
43+
44+
#remove new files
45+
rm /usr/share/phpmyadmin/hestia-sso.php
46+
rm /etc/phpmyadmin/hestia-sso.inc.php
47+
48+
#revert config
49+
sed -i "/hestia-sso.inc.php/d" $PMA_CONFIG/config.inc.php
50+
51+
# disable key
52+
$BIN/v-change-sys-config-value 'PHPMYADMIN_KEY' ""
53+
54+
#----------------------------------------------------------#
55+
# Hestia #
56+
#----------------------------------------------------------#
57+
58+
if [ "$MODE" != "quiet" ]; then
59+
echo "PMA Hestia-SSO plugin has been succesfully removed/disabled"
60+
fi
61+
62+
63+
log_history "Disabled support SSO" '' 'admin'
64+
65+
# Logging
66+
log_event "$OK" "$ARGUMENTS"
67+
exit

‎bin/v-list-sys-config‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,10 +61,9 @@ json_list() {
6161
"DB_PMA_ALIAS": "'$DB_PMA_ALIAS'",
6262
"DB_PGA_ALIAS": "'$DB_PGA_ALIAS'",
6363
"LOGIN_STYLE": "'$LOGIN_STYLE'",
64-
"INACTIVE_SESSION_TIMEOUT": "'$INACTIVE_SESSION_TIMEOUT'",
65-
"SOFTACULOUS": "'$SOFTACULOUS'"
64+
"PHPMYADMIN_KEY": "'$PHPMYADMIN_KEY'"
6665
}
67-
}'
66+
}'
6867
}
6968

7069
# Shell list

0 commit comments

Comments
 (0)