FOSS Fridays: OpenSSL in PHP
Well Twitter has “Follow Fridays” so I thought we should do FOSS Fridays. I don’t really have a plan for this and it might not last but let’s see where it goes.
In the last few days a couple of people have asked for tips on how to use OpenSSL from PHP. So here is a snippet on how to do it. This comes out of an application that provides a shared authentication system between our client’s LDAP system and their partner’s systems.
It works like so:
- Users login to the application using their LDAP credentials.
- When the users request to visit the partner site, our system packages up their login information, encrypts it, signs it, and shoots it along with the user to the partner site.
- Next, the partner checks if the user has an account and if they do it logs them in. Otherwise, it creates them a new account and logs them in.
All of this is done transparently so that the user doesn’t know they’ve actually left the original site.
Here is the code to do it. PS. it’s from a Symfony application.
<?php
$user = $this->getUser();
$profile = $user->getProfile();
if(is_null($profile)){ die("Could not get user profile?"); }
$email = $profile->getEmail();
$firstName = $profile->getFirstName();
$lastName = $profile->getLastName();
$password = $request->getParameter("password");
$keyText = file_get_contents(sfConfig::get("sf_root_dir") . "/" . sfConfig::get("app_their_public_key"));
$theirPublicKey = openssl_pkey_get_public($keyText);
$keyText = file_get_contents(sfConfig::get("sf_root_dir") . "/" . sfConfig::get("app_our_private_key"));
$outPrivateKey = openssl_pkey_get_private($keyText);
$arr = array();
$arr["U_EMAIL"] = $email;
$arr["U_PASSWORD"] = $password;
$arr["U_FIRST_NAME"] = $firstName;
$arr["U_LAST_NAME"] = $lastName;
$arr["RL_E"] = $this->generateUrl("ps_error", array(), true);
$arr["RL_S"] = "PRIVATE URL";
$arr["ETIME"] = time() + 60;
$queryString = http_build_query($arr);
$res = openssl_sign($queryString, $signature, $outPrivateKey);
if(!$res){ throw new sfException("Could not sign the payload!", 1); }
$t = openssl_pkey_get_details($theirPublicKey);
$t = (int) ($t['bits'] / 8 ) - 11;
$l=strlen($queryString);
$cryptPayload = '';
for ($i=0; $i<$l; $i+= $t) {
$block = substr($queryString, $i, $t);
if (!openssl_public_encrypt($block,$tS, $theirPublicKey)){
throw new sfException('failed encrypt', 1);
}
$cryptPayload .= $tS;
}
$this->encodedSignature = base64_encode($signature);
$this->encodedData = base64_encode($cryptPayload);The net result of all of this is an encrypted payload with the user’s credentials and a signature of the payload. The payload is encrypted with “their” public key and then signed with “our” private key. This ensures that only they can open the package and only we can generate valid signatures.
Happy Friday!