attauth.php

/*
=============================================================================================
The MIT License (MIT)

Copyright 2015 AT&T Intellectual Property. All other rights reserved.

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*/

<?php

if($pageurl=="") $pageurl="http://sidmoqrpt.dev.att.com/sseq/login.htm";

  header( "Expires: Fri, 07 Nov 1980 05:00:00 GMT" );
  header( "Cache-Control: no-store, no-cache, must-revalidate" );
  header( "Cache-Control: post-check=0, pre-check=0", false );
  header( "Pragma: no-cache" );

  //------------------------------------------------------------------------
  //
  // This is a Windows example PHP page that uses the esGateKeeper class to decrypt the attESSec cookie.
  // This file assumes that the OS environment is Windows.  The CSPDecrypt service must be installed and
  // registered according to the instructions found at http://csp.att.com/docs/CSPDecryptService.doc.
  // Also, the "<**insert hostname and correct URL here**>", and "<**insert sysname here**>"
  // parts of this code must be substituted with the real values for your system.
  // The CSP environment type is "PROD" for the www.e-access... URL; and "DEVL" for the webtest.csp... URL
  // provided in this example. To use this file for a non-Windows environment, modify the decryptCookie function
  // to use the jar files esgateKeeper class.  See javadoc.
  //------------------------------------------------------------------------

error_reporting (E_ALL);

// This URL encoding step only becomes necessary if you need parameters passed to your application as
// illustrated here with "fakeparameter".  Without parameters you could skip this step, although it doesn't hurt.
  $encReturnURL = urlencode($pageurl);  //Ex. http://bbob.att.com/trythis.asp
  // PROD environment URL
  //$cspAuthURL = 'https://www.e-access.att.com/empsvcs/hrpinmgt/pagLogin/?retURL='.$encReturnURL.'&sysName=SI_DMOQ>';
  //$tooWeakURL = 'https://www.e-access.att.com/empsvcs/hr/pagMenu_chgpin/?opt=12';
  // Do not mix environments for the noCookieURL and tooWeakURL.
  // Use both from (webtest) below or both from (Production) above.
  // DEVL environment URL
  $cspAuthURL = 'https://webtest.csp.att.com/empsvcs/hrpinmgt/pagLogin/?retURL='.$encReturnURL.'&sysName=SI_DMOQ';
  $cspAuthURL = 'https://www.e-access.att.com/empsvcs/hrpinmgt/pagLogin/?retURL='.$encReturnURL.'&sysName=SI_DMOQ';
  $tooWeakURL = 'https://webtest.csp.att.com/empsvcs/hr/pagMenu_chgpin/?opt=12';
  $tooWeakURL = 'https://www.e-access.att.com/empsvcs/hr/pagMenu_chgpin/?opt=12';

            
  if ( !isset( $_COOKIE['attESSec'] ) ) {
  	header( 'HTTP/1.0 302 Redirect' );
  	header( "Location: ".$cspAuthURL );
  	header( "Connection: close" );
	exit();
  }

  	$attESSecRaw = $_COOKIE['attESSec'];
	$attESSecRaw = $attESSecRaw."\r\n";//Add the carriage return and newline that PHP needs to make this work.
	$decryptedSecCookie  = decryptCookie($attESSecRaw);		// Defined below
	$d = getdate();

  if ($decryptedSecCookie == "") {
	echo 'attESSec Cookie decrypted to an empty string, is environment type and system name set right in this code?';
	// In the production version of your code the following line should be used.  It is commented out here
	// because it makes for easier debugging.  This next line catches cookies that have expired.
	header( 'HTTP/1.0 302 Redirect' );
	header( "Location: ".$cspAuthURL );
  	header( "Connection: close" );
	exit();
  }
  else	{
	$secCookieParts = explode( "|",$decryptedSecCookie );
	//print "<PRE>secCookieparts<br>";
	//print_r($secCookieParts);
	//print "</PRE>";
	$attid = $secCookieParts[5];
  	if ( $attid=="" ) {
  	  header( 'HTTP/1.0 302 Redirect' );
  	  header( "Location: ".$cspAuthURL );
  	  header( "Connection: close" );
	  exit();
  	}
  }

  //Everything checks out - Perform the work...

	//this is a post-like record on the employee
        $attESHr = $_COOKIE['attESHr'];		//Get attESHr cookie as well

	$HRCookieParts = explode( "|",$attESHr );

	$firstname = ucwords(strtolower($HRCookieParts[0]));
	$lastname  = ucwords(strtolower($HRCookieParts[1]));

	$hellostring = ucwords(strtolower($HRCookieParts[0] . " " . $HRCookieParts[1]));
	$emailaddress = $HRCookieParts[2] ;
	$hrlevel = $HRCookieParts[3] ;

	$userids = $HRCookieParts[7] ;
	$useridparts = explode(",",$userids);
	$hrid = $useridparts[0];
	$bosshrid = $useridparts[5];
	//print "<PRE>attESHr cookie parts";
	//print_r($HRCookieParts);
	//print "</PRE>";



//Log stuff

$selectedatestring = $_REQUEST["selectedatefield"];
$pl                = $_REQUEST["pl"];
$app                = $_REQUEST["app"];
$app = "ase";
$selectedatestring = date("n/j/Y H:i",time()-4*(3600));

        //$dbhostname = "sidmoqrpt.dev.att.com";
        //$dbhostname = "localhost";
        //$dblogin= "seqops1";
        //$dbpassword= "seqops1";
        //$dbname="seqops1";

        $dbhostname = "localhost";
        $dblogin= "seqops1";
        $dbpassword= "seqops1";
        $dbname="seqops1";


        error_reporting(E_PARSE);

        if(!($dbLink = mysql_connect($dbhostname,$dblogin,$dbpassword)))
                {
                print("Failed to connect to db server.");
                exit();
                }
        if(!mysql_select_db($dbname,$dbLink))
                {
                print("Failed to select database.");
                exit();
                }


$q = "INSERT into userlog set ";
$q .= "pageurl='"  . $pageurl . "', ";
$q .= "attuid='"  . $attid . "', ";
$q .= "tod='"  . time() . "', ";
$q .= "firstname='"  . addslashes($firstname) . "', ";
$q .= "lastname='"  .  addslashes($lastname) . "', ";
$q .= "hrid='"  . $hrid . "', ";
$q .= "cookie='"  . base64_encode(serialize($decryptedSecCookie)) . "', ";
$q .= "emailaddress='"  . addslashes($emailaddress). "', ";
$q .= "selectedatestring='"  . $selectedatestring . "', ";
$q .= "pl='"  . $pl. "', ";
$q .= "ipaddress='"  . $_SERVER["REMOTE_ADDR"] . "', ";
$q .= "app='"  . $app . "'; ";
//print $q;
	mysql_query($q,$dbLink);

$q2 = "SELECT * from users WHERE ";
$q2 .= "attid='" . $attid . "' ";
$q2 .= "ORDER BY modified DESC LIMIT 1;";
$dbr2 = mysql_query($q2,$dbLink);
$row2 = mysql_fetch_object($dbr2);
$uid = $row2->uix;

$username = $firstname . " " . $lastname;
$appurl = "http://sidmoqrpt.dev.att.com/sseq/index.htm?token=" . base64_encode(serialize($decryptedSecCookie));
$appurl .=  "&uid=" . $uid;
$appurl .=  "&username=" . base64_encode($username);
header("Location:  " . $appurl);
exit();


/* Note that this function expects the cookie value to be terminated with a "\r\n" */
function decryptCookie( $rawCookie ) {
	$retVal = '';

	/* Get the port for the WWW service. */
	$service_port = 1500;

	/* Get the IP address for the target host. */
	$address = gethostbyname('localhost');

	/* Create a TCP/IP socket. */
	$socket = socket_create (AF_INET, SOCK_STREAM, 0);
	if ($socket < 0) {
		echo "socket_create() failed: reason: ".
		socket_strerror ($socket) . "\n";
		return('');
	}
	$result = socket_connect ($socket, $address, $service_port);
	if ($result < 0) {
		echo "socket_connect() failed.\nReason: ($result) " . socket_strerror($result) . "\n";
		return('');
	}

	$in = $rawCookie;
	$out = '';

	socket_write ($socket, $in, strlen ($in));

	while ($out = socket_read ($socket, 2048)) {
	$retVal = $retVal.$out;
	}

	socket_close ($socket);
	return($retVal);
}
?>