Skip to content

Commit 0d014fa

Browse files
stevedsteved
committed
convert native remote authentication usage to JWT
1 parent 18728c7 commit 0d014fa

File tree

2 files changed

+226
-4
lines changed

2 files changed

+226
-4
lines changed

‎src/app/code/community/Zendesk/Zendesk/Helper/JWT.php

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
<?php
2+
3+
// Retrieved 2013-04-29 - commit 82113fd351cea127ded3d07e40eb46865db9e8f2
4+
// https://github.com/firebase/php-jwt
5+
6+
/**
7+
* JSON Web Token implementation, based on this spec:
8+
* http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06
9+
*
10+
* PHP version 5
11+
*
12+
* @category Authentication
13+
* @package Authentication_JWT
14+
* @author Neuman Vong <neuman@twilio.com>
15+
* @author Anant Narayanan <anant@php.net>
16+
* @license http://opensource.org/licenses/BSD-3-Clause 3-clause BSD
17+
* @link https://github.com/firebase/php-jwt
18+
*/
19+
/**
20+
* JSON Web Token implementation, based on this spec:
21+
* http://tools.ietf.org/html/draft-ietf-oauth-json-web-token-06
22+
*
23+
* @category Authentication
24+
* @package Authentication_JWT
25+
* @author Neuman Vong <neuman@twilio.com>
26+
* @author Anant Narayanan <anant@php.net>
27+
* @license http://opensource.org/licenses/BSD-3-Clause 3-clause BSD
28+
* @link https://github.com/firebase/php-jwt
29+
*/
30+
class JWT
31+
{
32+
/**
33+
* Decodes a JWT string into a PHP object.
34+
*
35+
* @param string $jwt The JWT
36+
* @param string|null $key The secret key
37+
* @param bool $verify Don't skip verification process
38+
*
39+
* @return object The JWT's payload as a PHP object
40+
* @throws UnexpectedValueException Provided JWT was invalid
41+
* @throws DomainException Algorithm was not provided
42+
*
43+
* @uses jsonDecode
44+
* @uses urlsafeB64Decode
45+
*/
46+
public static function decode($jwt, $key = null, $verify = true)
47+
{
48+
$tks = explode('.', $jwt);
49+
if (count($tks) != 3) {
50+
throw new UnexpectedValueException('Wrong number of segments');
51+
}
52+
list($headb64, $bodyb64, $cryptob64) = $tks;
53+
if (null === ($header = JWT::jsonDecode(JWT::urlsafeB64Decode($headb64)))) {
54+
throw new UnexpectedValueException('Invalid segment encoding');
55+
}
56+
if (null === $payload = JWT::jsonDecode(JWT::urlsafeB64Decode($bodyb64))) {
57+
throw new UnexpectedValueException('Invalid segment encoding');
58+
}
59+
$sig = JWT::urlsafeB64Decode($cryptob64);
60+
if ($verify) {
61+
if (empty($header->alg)) {
62+
throw new DomainException('Empty algorithm');
63+
}
64+
if ($sig != JWT::sign("$headb64.$bodyb64", $key, $header->alg)) {
65+
throw new UnexpectedValueException('Signature verification failed');
66+
}
67+
}
68+
return $payload;
69+
}
70+
71+
/**
72+
* Converts and signs a PHP object or array into a JWT string.
73+
*
74+
* @param object|array $payload PHP object or array
75+
* @param string $key The secret key
76+
* @param string $algo The signing algorithm. Supported
77+
* algorithms are 'HS256', 'HS384' and 'HS512'
78+
*
79+
* @return string A signed JWT
80+
* @uses jsonEncode
81+
* @uses urlsafeB64Encode
82+
*/
83+
public static function encode($payload, $key, $algo = 'HS256')
84+
{
85+
$header = array('typ' => 'JWT', 'alg' => $algo);
86+
87+
$segments = array();
88+
$segments[] = JWT::urlsafeB64Encode(JWT::jsonEncode($header));
89+
$segments[] = JWT::urlsafeB64Encode(JWT::jsonEncode($payload));
90+
$signing_input = implode('.', $segments);
91+
92+
$signature = JWT::sign($signing_input, $key, $algo);
93+
$segments[] = JWT::urlsafeB64Encode($signature);
94+
95+
return implode('.', $segments);
96+
}
97+
98+
/**
99+
* Sign a string with a given key and algorithm.
100+
*
101+
* @param string $msg The message to sign
102+
* @param string $key The secret key
103+
* @param string $method The signing algorithm. Supported
104+
* algorithms are 'HS256', 'HS384' and 'HS512'
105+
*
106+
* @return string An encrypted message
107+
* @throws DomainException Unsupported algorithm was specified
108+
*/
109+
public static function sign($msg, $key, $method = 'HS256')
110+
{
111+
$methods = array(
112+
'HS256' => 'sha256',
113+
'HS384' => 'sha384',
114+
'HS512' => 'sha512',
115+
);
116+
if (empty($methods[$method])) {
117+
throw new DomainException('Algorithm not supported');
118+
}
119+
return hash_hmac($methods[$method], $msg, $key, true);
120+
}
121+
122+
/**
123+
* Decode a JSON string into a PHP object.
124+
*
125+
* @param string $input JSON string
126+
*
127+
* @return object Object representation of JSON string
128+
* @throws DomainException Provided string was invalid JSON
129+
*/
130+
public static function jsonDecode($input)
131+
{
132+
$obj = json_decode($input);
133+
if (function_exists('json_last_error') && $errno = json_last_error()) {
134+
JWT::_handleJsonError($errno);
135+
} else if ($obj === null && $input !== 'null') {
136+
throw new DomainException('Null result with non-null input');
137+
}
138+
return $obj;
139+
}
140+
141+
/**
142+
* Encode a PHP object into a JSON string.
143+
*
144+
* @param object|array $input A PHP object or array
145+
*
146+
* @return string JSON representation of the PHP object or array
147+
* @throws DomainException Provided object could not be encoded to valid JSON
148+
*/
149+
public static function jsonEncode($input)
150+
{
151+
$json = json_encode($input);
152+
if (function_exists('json_last_error') && $errno = json_last_error()) {
153+
JWT::_handleJsonError($errno);
154+
} else if ($json === 'null' && $input !== null) {
155+
throw new DomainException('Null result with non-null input');
156+
}
157+
return $json;
158+
}
159+
160+
/**
161+
* Decode a string with URL-safe Base64.
162+
*
163+
* @param string $input A Base64 encoded string
164+
*
165+
* @return string A decoded string
166+
*/
167+
public static function urlsafeB64Decode($input)
168+
{
169+
$remainder = strlen($input) % 4;
170+
if ($remainder) {
171+
$padlen = 4 - $remainder;
172+
$input .= str_repeat('=', $padlen);
173+
}
174+
return base64_decode(strtr($input, '-_', '+/'));
175+
}
176+
177+
/**
178+
* Encode a string with URL-safe Base64.
179+
*
180+
* @param string $input The string you want encoded
181+
*
182+
* @return string The base64 encode of what you passed in
183+
*/
184+
public static function urlsafeB64Encode($input)
185+
{
186+
return str_replace('=', '', strtr(base64_encode($input), '+/', '-_'));
187+
}
188+
189+
/**
190+
* Helper method to create a JSON error.
191+
*
192+
* @param int $errno An error number from json_last_error()
193+
*
194+
* @return void
195+
*/
196+
private static function _handleJsonError($errno)
197+
{
198+
$messages = array(
199+
JSON_ERROR_DEPTH => 'Maximum stack depth exceeded',
200+
JSON_ERROR_CTRL_CHAR => 'Unexpected control character found',
201+
JSON_ERROR_SYNTAX => 'Syntax error, malformed JSON'
202+
);
203+
throw new DomainException(
204+
isset($messages[$errno])
205+
? $messages[$errno]
206+
: 'Unknown JSON error: ' . $errno
207+
);
208+
}
209+
210+
}
211+

‎src/app/code/community/Zendesk/Zendesk/controllers/Adminhtml/ZendeskController.php

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@
1515
* limitations under the License.
1616
*/
1717

18+
require_once(plugin_dir_path( __FILE__ ) . '../Helper/JWT.php');
19+
1820
class Zendesk_Zendesk_Adminhtml_ZendeskController extends Mage_Adminhtml_Controller_Action
1921
{
2022
protected $_publicActions = array('redirect', 'authenticate');
@@ -75,16 +77,25 @@ public function authenticateAction()
7577
$this->_redirect(Mage::getSingleton('admin/session')->getUser()->getStartupPageUrl());
7678
}
7779

80+
$now = time();
81+
$jti = md5($now . rand());
82+
7883
$user = Mage::getSingleton('admin/session')->getUser();
7984
$name = $user->getName();
8085
$email = $user->getEmail();
8186
$externalId = $user->getId();
8287

83-
$timestamp = $this->getRequest()->getParam('timestamp', time());
84-
$message = $name.$email.$externalId.$token.$timestamp;
85-
$hash = md5($message);
88+
$payload = array(
89+
"iat" => $now,
90+
"jti" => $jti,
91+
"name" => $name,
92+
"email" => $email,
93+
"external_id" => $externalId
94+
);
95+
96+
$jwt = JWT::encode($payload, $token);
8697

87-
$url = "http://".$domain."/access/remote/?name=".$name."&email=".$email."&external_id=".$externalId."&timestamp=".$timestamp."&hash=".$hash;
98+
$url = "http://".$domain."/access/jwt/?jwt=" . $jwt;
8899

89100
$this->_redirectUrl($url);
90101
}

0 commit comments

Comments
 (0)