7112e932a2
* inline totp image as data uri to prevent caching issues * allow 2fa for ldap and saml users * allow 2FA access for super admin to all profiles
38 lines
1.2 KiB
PHP
38 lines
1.2 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the Kimai time-tracking app.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace App\Security;
|
|
|
|
use App\Entity\User;
|
|
use Scheb\TwoFactorBundle\Security\TwoFactor\AuthenticationContextInterface;
|
|
use Scheb\TwoFactorBundle\Security\TwoFactor\Condition\TwoFactorConditionInterface;
|
|
use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
|
|
|
|
final class TwoFactorCondition implements TwoFactorConditionInterface
|
|
{
|
|
public function __construct(private AuthorizationCheckerInterface $authorizationChecker)
|
|
{
|
|
}
|
|
|
|
public function shouldPerformTwoFactorAuthentication(AuthenticationContextInterface $context): bool
|
|
{
|
|
/** @var User $user */
|
|
$user = $context->getUser();
|
|
|
|
// never require 2FA on API calls
|
|
if (str_starts_with($context->getRequest()->getRequestUri(), '/api/')) {
|
|
return false;
|
|
}
|
|
|
|
// if a user is remembered, it means he already passed the TOTP code
|
|
// do not bother again with the code
|
|
return !$this->authorizationChecker->isGranted('IS_AUTHENTICATED_REMEMBERED');
|
|
}
|
|
}
|