0000965: Admin Portal - Granular Access Control - PacketFence

PacketFence Granular Access Control By eSubnet 20100419 R Danielli President, eSubnet rdanielli@esubnet.com ===================================admin.perm====================================== # Packet Fence Customization : Granular Access Control # by kcreechan@esubnet.com eSubnet Enterprises 2010. # # pf/conf/admin.perm # User Definitions # Syntax: # u,<username>,{1|2|3|4|5} # # username MUST be an exact match to username in /usr/local/pf/conf/admin.conf u,rdanielli,5 u,admin,5 u,staff,4 u,hd-staff1,2 u,hd-staff2,2 u,hd-staff2,2 # Page Definitions # Syntax: # p,<pagename>,{1|2|3|4|5} p,status,1 p,person,4 p,node,1 p,violation,3 p,configuration,4 p,administration,4 EOF=================================================================================== ===================================adminperm.inc====================================== <?php //Packet Fence Customization : Granular Access Control // by kcreechan@esubnet.com eSubnet Enterprises 2010. // // File: pf/html/admin/adminperm.inc // $delim = "-"; // the usertype-username deliminator is set here. list($usertype) = explode($delim,$_SESSION['user']); $fname = "/usr/local/pf/conf/admin.perm"; $handle = fopen($fname, "r"); $users=array(); $pages=array(); while (!feof($handle)) { $buffer = trim(fgets($handle)); if (substr($buffer,0,1)!="#" AND $buffer!="") { if (substr($buffer,0,1)=="u") { list($type,$user,$perm) = explode(",",$buffer); $users[$user]=$perm; } if (substr($buffer,0,1)=="p") { list($type,$page,$perm) = explode(",",$buffer); $pages[$page]=$perm; } } } $fclose; if (array_key_exists($usertype, $users)!=TRUE) { echo "<html><head><meta http-equiv='refresh' content='4;url=/login.php?logout=true'></head><body>"; echo " <center>User does not exist in admin.perms Logging out. </canter>"; echo "</body></html>"; exit(); } if ($users[$usertype]<$pages[$current_top]) { // echo "BAD HIT"; if ($current_top!="status") { header("Location: /login.php"); } else { echo "<html><head><meta http-equiv='refresh' content='0;url=/login.php?'></head><body></body></html>"; } exit(); } else { echo ""; } ?> EOF=================================================================================== ===================================header.php====================================== // apend these line to the end of pf/html/admin/header.php <?php include("userperm.inc"); ?> EOF===================================================================================

Notes
(0001519) rdanielli (reporter) 2010-04-21 10:17	Please note as pointed out by my guy Kevin, I did a renaming of the files and forgot to update the line in the header.php snippet I presented :( my bad

(0001520) obilodeau (reporter) 2010-04-21 10:39	This is a solid demonstration of granular access control done easily. This was requested several times without anyone willing to pay for it. Thanks a lot for sharing! I did a little review and we are aiming to merge it as is in the upcoming 1.10.x (or 1.9.1). 1.9.0 is almost out so it won't cut it. Some remarks (for us for future work on it): - Opening a file on each page hit, it should be cached in session on login instead - No way to edit rights through web - Not conforming to our usual ini-style config files - Because it's done in header.php, can the security be circumvented if you already know the right POST or point directly to a popup URL? Thanks again for sharing this with us! Follow this bug to be updated when the merge will be done.

(0001521) obilodeau (reporter) 2010-04-21 10:40	Category change because 'security' is to track security issues.

(0001541) obilodeau (reporter) 2010-05-04 18:00	As expected, we are in release mode for 1.9.0 and this will have to be merged later. Targeting for 1.9.1.

(0001615) obilodeau (reporter) 2010-07-27 12:36 edited on: 2010-07-27 12:37	Imported your contriubtion into public branch: org.packetfence.feature.granular-admin-access http://mtn.inverse.ca [^] and added a task list: feature.granular-admin-access.TODO

(0001626) obilodeau (reporter) 2010-08-05 10:20	Feature merged into 1.9 branch. Following changes on top of your contribution were performed: - got rid of the delimiter approach for a role approach instead - using .ini style format instead of custom fileformat - using php .ini parser instead of custom parser - concept of a default role where a user with no entry will have the default role instead of being denied - not parsing the perms file on each page hit, cached in session on login instead - 'You don't have sufficient permissions' page instead of a redirect - Popups are handled also (were not before, you could load them straight) - Documentation in admin guide Your contribution has been attribute in NEWS and will be in the release notes. I will generate a snapshot release of 1.9.1 that will include all this pretty soon.

Issue History
Date Modified	Username	Field	Change
2010-04-19 18:52	rdanielli	New Issue
2010-04-19 18:52	rdanielli	File Added: PF-ADMIN_ACL.txt
2010-04-21 09:47	obilodeau	Status	new => assigned
2010-04-21 09:47	obilodeau	Assigned To	=> obilodeau
2010-04-21 10:17	rdanielli	Note Added: 0001519
2010-04-21 10:39	obilodeau	Note Added: 0001520
2010-04-21 10:40	obilodeau	Note Added: 0001521
2010-04-21 10:40	obilodeau	Severity	tweak => feature
2010-04-21 10:40	obilodeau	Category	security => web admin
2010-04-21 10:40	obilodeau	Target Version	=> 1.9.0
2010-05-04 18:00	obilodeau	Note Added: 0001541
2010-05-04 18:00	obilodeau	Target Version	1.9.0 => 1.9.1
2010-07-27 12:36	obilodeau	Note Added: 0001615
2010-07-27 12:37	obilodeau	Note Edited: 0001615
2010-08-05 10:20	obilodeau	mtn revision	=> ede8be2323f45d3c308e6a91bed0b19f11e8e1a5
2010-08-05 10:20	obilodeau	Note Added: 0001626
2010-08-05 10:20	obilodeau	Status	assigned => resolved
2010-08-05 10:20	obilodeau	Fixed in Version	=> 1.9.1
2010-08-05 10:20	obilodeau	Resolution	open => fixed
2011-01-26 15:38	obilodeau	Status	resolved => closed

Relationships