HybridAuth CakePHP3.X,how to save user after successful login? - cakephp-3.0

I have read the description over,
Once a user is authenticated through the provider the authenticator gets the user profile from the identity provider and using that tries to find the corresponding user record in your app's users table. If no user is found and registrationCallback option is specified the specified method from the User model is called. You can use the callback to save user record to database.
But where to define/declare registrationCallback

If you want user to register if not exist then this code will execute :
if (!empty($this->_config['registrationCallback'])) {
$return = call_user_func_array(
[
TableRegistry::get($userModel),
$this->_config['registrationCallback']
],
[$provider, $providerProfile]
);
if ($return) {
$user = $this->_fetchUserFromDb($conditions);
if ($user) {
return $user;
}
}
You need to define the registration function in config ( in __construct) and regarding call_user_func_array read this link - https://php.net/call-user-func-array

To Store user in database after login
1>defines the function in UsersTabel.php
public function registration($provider, $profile) {
$user = $this->newEntity([
'username' => $profile->displayName,
'provider' => $provider,
'provider_uid' => $profile->identifier
]);
if(!$this->save($user))
{
Log::write(LOG_ERR, 'Failed to create new user record');
return false;
}
return true;
}
2>Replace the function of file vendor ▸ admad ▸ cakephp-hybridauth ▸ src ▸ Auth▸ HybridAuthAuthenticate.php
public function __construct(ComponentRegistry $registry, $config)
{
$this->config([
'fields' => [
'provider' => 'provider',
'provider_uid' => 'provider_uid',
'openid_identifier' => 'openid_identifier'
],
'hauth_return_to' => null,
'registrationCallback'=>'registration'
]);
parent::__construct($registry, $config);
}

Related

How to view own entities in yii2?

I have User table which has a field called 'society_id' Which defines which society the user belongs to. Similarly, I have 'society_id' field in another table called 'expense_details' which identifies the society_id of the user who has entered the data in 'expense_details'.
this is my user table
https://i.stack.imgur.com/1hBky.png
this is my expense-details table
https://i.stack.imgur.com/Z3cQU.png
I know we can access the society_id of logged in user like this :
I want Logged in users to access their view but I want the user not to access data from table 'expense_details' related to other users with change url.
I know we can get society_id of logged in user like this Yii::$app->user->identity->society_id
But I am wondering how can i use it here and what changes i am supposed to make in my actionView and/or Model.
Here is my Expensedetails view controller.
public function actionView($id) {
$details = \app\models\ExpenseDetails::find()->where(['expense_id' => $id])->all();
$searchModel = new \app\models\ExpenseDetailsSearch();
$dataProvider = $searchModel->search(Yii::$app->request->queryParams);
$dataProvider->query->where("expense_id=$id");
return $this->render('view', [
'model' => $this->findModel($id),
'details' => $details,
'searchModel' => $searchModel,
'dataProvider' => $dataProvider,
]);
}
PS : English is not my native language. I am newbie to yii2 and stackoverflow, please excuse me for the mistakes. Thanks.
I solved it.
In My ExpenseDetails Model
protected function findModel($id)
{
if (($model =ExpenseDetails::findOne($id)) !== null) {
return $model;
}
throw new NotFoundHttpException('The requested page does not exist.');
}
In My Expensedetails view controller
protected function findModel($id)
{
if (($model = ExpenseDetails::findOne($id)) !== null) {
return $model;
}
throw new NotFoundHttpException('The requested page does not exist.');
}
As each user has society_id which can be same for any 2 user's records, so when you will fetch the table like this:
ExpenseDetails::find()->where(['expense_id' => $id, 'society_id' => Yii::$app->user->identity->society_id])->all();
it will return all the records on specific expense_id and specific society_id but those records would be of multiple users, if you want another condition that one user can not access anothers user's record, you can add "user_id" attribute in "expense_details" table and set the "users" table "id" attribute to it, as per need so you can fetch the records with specific expense_id, society_id and specific "user_id":
ExpenseDetails::find()->where(['expense_id' => $id, 'society_id' => Yii::$app->user->identity->society_id, "user_id" => 1])->all();
or for current logged in user :
ExpenseDetails::find()->where(['expense_id' => $id, 'society_id' => Yii::$app->user->identity->society_id, "user_id" => Yii::$app->user->id])->all();

Login access not working in yii2

Im using yii2 for my project. I need to use two different tables for login (Login page is same). I have two models Admin and User. And i have one LoginFrom for login.
I can login properly but the problem is after logged in i cannot get whether the admin is logged in or the user is logged in.
I have set it in config file (web.php) like below:
'admin' => [
'identityClass' => 'app\models\Admin',
'enableAutoLogin' => false,
'class' => 'yii\web\User',
'authTimeout' => 1200, // in Seconds. 1200 seconds means 20 mins
],
'user' => [
'identityClass' => 'app\models\User',
'enableAutoLogin' => false,
'authTimeout' => 1200
],
So im getting logged in user details by using below method:
\Yii::$app->admin->identity;
\Yii::$app->user->identity;
My problem is if im logged in as admin i can get user values also by using this : \Yii::$app->user->identity; or if im logged in as user i can get admin values by using this : \Yii::$app->admin->identity;.
My LoginForm.php is :
<?php
namespace app\models;
use Yii;
use yii\base\Model;
class LoginForm extends Model
{
public $username;
public $password;
public $rememberMe = true;
private $_user = false;
public function rules()
{
return [
// username and password are both required
[['username', 'password'], 'required'],
// rememberMe must be a boolean value
['rememberMe', 'boolean'],
// password is validated by validatePassword()
['password', 'validatePassword'],
];
}
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser();
if (!$user || !$user->validatePassword($this->password)) {
$this->addError($attribute, 'Incorrect username or password.');
}
}
}
public function login()
{
if ($this->validate()) {
if(!empty($this->getUser()['phone_number'])) {
return Yii::$app->admin->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
} else {
return Yii::$app->user->login($this->getUser(), $this->rememberMe ? 3600*24*30 : 0);
}
}
return false;
}
public function getUser()
{
if ($this->_user === false) {
$this->_user = User::findByUsername($this->username);
if(!$this->_user) {
$this->_user = Admin::findByUsername($this->username);
}
}
return $this->_user;
}
}
I cant find the problem and if i logged in identity creating for both the users so i could'nt write access rules in particular controller to allow admin only to access the controller.Please help me :(
From reading the comments I think you should just create a unifying table for the two identities where they both get their IDs from. Then make that the identity class. The reason you are able to see the details in both identity classes is that they have the same ID.

Yii: How to validatePassword with Edvlerblog\Adldap2 using userprincipalname instead of samaccountname

Question
Currently looking for how other people handled the validate password function when they need to authenticate with the userprincipalname instead of the Edvlerblog\Adldap2 validatePassword function which uses samaccountname.
Please provide feedback in the comments if you are struggling with
anything specific so we can update the documentation.
Current Implementation
For app/common/model/LoginForm
getUser
The Edvlerblog\Adldap2 getUser() function works, and even caches the queryLdapUserObject, allowing you to fetch any of the AD attributes.
protected function getUser()
{
if ($this->_user === null) {
$this->_user = \Edvlerblog\Adldap2\model\UserDbLdap::findByUsername($this->username);
}
return $this->_user;
}
validatePassword()
Currently, the following validatePassword function does not work for me because in my instance AD must authenticate against the userprincipalname instead of the samaccount name.
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser();
if (!$user || !$user->validatePassword($this->password)) {
$this->addError($attribute, 'Incorrect username or password.');
}
}
}
A solution
Here is one workaround thanks to the Edvlerblog\Adldap2 who recently released 3.0.5 addressing a couple issues and providing some examples in his readme docs.
Please note the addition of findByAttribute(), allowing the following:
$this->_user = \Edvlerblog\Adldap2\model\UserDbLdap::findByUsername($this->username);
validatePassword() w/ userprincipalname
Update your login model: common\models\LoginForm.php
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser();
if (!$user) {
$this->addError('username', 'Incorrect username.');
} else {
// Note: queryLdapUserObject is a cached object,
// so the ldap fetch does not get called :-).
$userprincipalname = $this->_user->queryLdapUserObject()->getAttribute('userprincipalname');
$auth = Yii::$app->ad->auth()->attempt($userprincipalname[0], $this->password);
if (!$auth) {
$this->addError('password', 'Incorrect password.');
}
}
}
}
getUser() w/userprincipalname
/**
* Finds user by [[username]]
*
* #return User|null
*/
protected function getUser()
{
if ($this->_user === null) {
$this->_user = \Edvlerblog\Adldap2\model\UserDbLdap::findByUsername($this->username);
}
return $this->_user;
}
Yii2 ldap Component Configuration
Reference: https://github.com/Adldap2/Adldap2/blob/master/docs/configuration.md
Config in your frontend\config\main:
'components' => [
'log' => [... ],
'authManager' => [... ],
'ad' => [
'class' => 'Edvlerblog\Adldap2\Adldap2Wrapper',
'providers' => [
'default' => [
'autoconnect' => true,
'config' => [
'domain_controllers' => ['your.ldap.domain.com'],
'base_dn' => "OU=XXX,OU=XXX,DC=ccccccc,DC=xxxx,DC=com",
'admin_username' => "your_username",
'admin_password' => "your_password",
'port' => 389,
],
],
],
],
],

reset password validation in Yii2

I have a form in which I am trying to reset the password. I have 3 fields password, changepassword and re-enterpassword.
First I need to check whether the password field matches with database password.
While user signup I have used the default Yii2 functionality which generates random password and saves that password into database. Also I used the default login functionality while user login.
And now, for validating the password, I am trying to use the same default Yii2 validation which is used in login. But, it is not working fine. It is always giving validation true when I had echoed and checked in the controller with $user->validate(), which you will find in the below code.
I have a view resetProfilePassword.php in which I have a form
<?php $form = ActiveForm::begin(['options' => ['enctype' => 'multipart/form-data']]); ?>
<?php
echo $form->field($resetpasswordmodel, 'password');
echo $form->field($resetpasswordmodel, 'changepassword');
echo $form->field($resetpasswordmodel, 'reenterpassword');
?>
<div class="form-group">
<?= Html::submitButton('Submit', ['class' => 'btn btn-primary']) ?>
</div>
<?php ActiveForm::end(); ?>
I have a model resetProfilePasswordForm.php
<?php
namespace frontend\models;
use common\models\User;
use yii\base\Model;
class ResetProfilePasswordForm extends Model
{
public $password;
public $changepassword;
public $reenterpassword;
public function rules()
{
return [
['password', 'validatePassword'],
['changepassword', 'required'],
['reenterpassword', 'required'],
['reenterpassword', 'compare', 'compareAttribute'=>'changepassword', 'message'=>"Passwords don't match" ]
];
}
public function attributeLabels()
{
return [
//'user_profile_id' => 'User Profile ID',
//'user_ref_id' => 'User Ref ID',
'password' => 'Password',
'changepassword' => 'Change Password',
'reenterpassword' => 'Re-enter Password',
];
}
public function validatePassword($attribute, $params)
{
if (!$this->hasErrors()) {
$user = $this->getUser();
if (!$user || !$user->validatePassword($this->password)) {
$this->addError($attribute, 'Incorrect username or password.');
}
}
}
protected function getUser()
{
if ($this->_user === null) {
$this->_user = User::findByUsername($this->username);
}
return $this->_user;
}
}
This is controller ProfileController.php
public function actionResetProfilePassword()
{
$resetpasswordmodel = new ResetProfilePasswordForm();
if ($resetpasswordmodel->load(Yii::$app->request->post())) {
$user = User::find()->where(['id' => Yii::$app->user->identity->id])->one();
if($user->validate()){
$user->save(false);
}
}
return $this->render('ResetProfilePassword', [
'resetpasswordmodel' => $resetpasswordmodel
]);
}
Please help me where I am facing the issue.
If this is not the right way to validate, please help me in providing the better way to validate password
To apply resetpasswordmodel validation - just run the validate() method and then - update user model like that:
public function actionResetProfilePassword()
{
$resetpasswordmodel = new ResetProfilePasswordForm();
if ($resetpasswordmodel->load(Yii::$app->request->post())) {
$user = User::find()->where(['id' => Yii::$app->user->identity->id])->one();
# here we run our validation rules on the model
if ($resetpasswordmodel->validate()) {
# if it is ok - setting the password property of user
$user->password = $resetpasswordmodel->changepassword;
# and finally save it
$user->save();
}
return $this->render('ResetProfilePassword', [
'resetpasswordmodel' => $resetpasswordmodel
]);
}
you can create new hash and replace it in database with older password
*note: salt is your email account that you want restore it.
$salt= 'omid.ahmadyani#Outlook.com';
$pass = crypt('00000000',$salt);
die($pass);
my new password is 00000000
and my hashed pass is omXXQw/O/i1po
S F My English!

Prevent show data from another user

How to prevent all detailView show data from another user ??
For example, this happens when you type an product ID of another user in the URL. The detailView shows the details of the product normally, however belongs to another User, and may even change it and delete it.
You can do something like this in the controller if you don't want to use RBAC :
protected function findModel($id)
{
//Check if the author is the current user
if (($model = Product::findOne($id)) !== null && $model->author_id==Yii::$app->user->id) {
return $model;
} else {
throw new NotFoundHttpException('The requested page does not exist.');
}
}
Like this users which are not the author can't view, update or delete the product.
http://www.yiiframework.com/forum/index.php/topic/61915-prevent-show-data-from-another-user/page__view__findpost__p__274644
Several options:
1) simplest one, in the controller before showing the view check that the current user can see the product. If he cannot redirect him (by throwing an error) to a 404 page (or whatever error you want to show).
2) use RBAC to set up roles and what those roles can do. This is the most professional option
3) you may be able to modify the accessfilter to do this too too
If you need to ask how to do this go with option 1.
If you want option 2 or 3 start by reading this http://www.yiiframework.com/doc-2.0/guide-security-authorization.html
An example to what Mihai have suggested.
public function behaviors()
{
return [
'accessControl' => [
'class' => \yii\filters\AccessControl::className(),
'rules' => [
[
'actions' => ['view'],
'allow' => true,
'matchCallback' => function () {
$request = \Yii::$app->request;
$user = \Yii::$app->user->identity;
$product = Product::findOne($request->get('id'));
if ($user && $product->owner_id == $user->id) {
return true;
}
return false;
}
],
[
'allow' => false,
'roles' => ['*'],
],
],
]
];
}