Disable login for non-whitelisted IPs

[FrancoisChaumont]

Description:

This allows to disable login to non-whitelisted IPs and add some flexibility into the whitelist scope (i.e. for authentication & login).
A customized error message can be set to be displayed on the login page in order to inform about the reason for disabling login.

There are 3 new setting to play with:

• login_allowlist_apply_to_authentication
• login_allowlist_apply_to_login
• login_disabled_message

Review

• Functional review done
• Potential edge cases thought about (behavior of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• Documentation added if needed
• Existing documentation updated if needed

[MatomoForumNotifications]

This pull request has been mentioned on Matomo forums. There might be relevant details there:

https://forum.matomo.org/t/disable-login-and-all-emailing-for-non-superusers-admins/58013/3

[michalkleiner]

Hi @FrancoisChaumont, thank you for taking the time and submitting the PR.
Can you please explain a bit more what you see as the difference between authenticating and logging in? Do you mean access in general (e.g. also as a anonymous user) vs logging in as a known user?

[FrancoisChaumont]

Hi @FrancoisChaumont, thank you for taking the time and submitting the PR. Can you please explain a bit more what you see as the difference between authenticating and logging in? Do you mean access in general (e.g. also as a anonymous user) vs logging in as a known user?

Hi @michalkleiner, thanks for taking the time to look into this.
I see logging in as strictly through the login (aka sign-in) page using user's credentials (email/username & password), and authenticating as through requests that either use token or credentials provided in the URL.

Here's the use-case that lead to the PR:

• only the superuser should be allowed to login (using the sign-in page) from a specific IP address and access Matomo's interface
• other users should still have access to their widgetized dashboards
• API & tracking requests should be able to be received from any IP

[sgiehl]

@FrancoisChaumont Am I right that you are actually looking for a way how to restrict access for certain users to specific reports? So more something related to #1568

Restricting the login in the way you are trying to do it might not work as expected. The token_auth you would provide for loading a widgetized dashboard, can always be used to request/load any other widget and even the whole Matomo interface without the need to log in.

[FrancoisChaumont]

@FrancoisChaumont Am I right that you are actually looking for a way how to restrict access for certain users to specific reports? So more something related to #1568

Restricting the login in the way you are trying to do it might not work as expected. The token_auth you would provide for loading a widgetized dashboard, can always be used to request/load any other widget and even the whole Matomo interface without the need to log in.

Hi @sgiehl, not exactly.
All reports should remain accessible to all users.
No user should have access to Matomo interface unless accessing from specific IPs.

Just to confirm my understanding of accessing the "whole Matomo interface without the need to log in", is this only available when logme feature is active (config: login_allow_logme = 1)?

[FrancoisChaumont]

@FrancoisChaumont Am I right that you are actually looking for a way how to restrict access for certain users to specific reports? So more something related to #1568
Restricting the login in the way you are trying to do it might not work as expected. The token_auth you would provide for loading a widgetized dashboard, can always be used to request/load any other widget and even the whole Matomo interface without the need to log in.

Hi @sgiehl, not exactly. All reports should remain accessible to all users. No user should have access to Matomo interface unless accessing from specific IPs.

Just to confirm my understanding of accessing the "whole Matomo interface without the need to log in", is this only available when logme feature is active (config: login_allow_logme = 1)?

Hey @sgiehl, just wondering if you had any updates on this. Could this work for the intended purpose? Is it missing something? ... Thanks

[sgiehl]

@FrancoisChaumont sorry for not coming back earlier on this.
No this is unrelated to the logme feature. That feature allows to log in using username and md5-password as url parameters.
The token_auth is an authentication token, it can be used in widgets, api as well as for the UI.

[FrancoisChaumont]

@FrancoisChaumont sorry for not coming back earlier on this. No this is unrelated to the logme feature. That feature allows to log in using username and md5-password as url parameters. The token_auth is an authentication token, it can be used in widgets, api as well as for the UI.

@sgiehl No worries. Is login via token_auth only allowed with Login Token Auth plugin installed & activated or always? If always, is there an easy/built-in way to disable it? I'm still trying to figure out if this PR could fit my use-case.

[sgiehl]

It is always enabled, as that is how our API authentication works.
The normal login also uses a token_auth, which is session based only, but used to authenticate API requests sent through the UI.
Disabling that isn't possible.

[FrancoisChaumont]

Hi @FrancoisChaumont, thank you for taking the time and submitting the PR. Can you please explain a bit more what you see as the difference between authenticating and logging in? Do you mean access in general (e.g. also as a anonymous user) vs logging in as a known user?

Hi @michalkleiner, thanks for taking the time to look into this. I see logging in as strictly through the login (aka sign-in) page using user's credentials (email/username & password), and authenticating as through requests that either use token or credentials provided in the URL.

Here's the use-case that lead to the PR:

* only the superuser should be allowed to login (using the sign-in page) from a specific IP address and access Matomo's interface

* other users should still have access to their widgetized dashboards

* API & tracking requests should be able to be received from any IP

Hey @sgiehl, I think we're slowly drifting a bit from the original question. Do you think the above could be achieved? Using the changes provided in the PR? Or maybe some other ways already existing or yet to be implemented?

[sgiehl]

@FrancoisChaumont No, that won't be possible at the moment. Accessing UI, widgetized reports or API is possible with the same tokens. You can't easily restrict that without the risk to break something.

Matomo would need #21175 to allow something like that directly. So you could define tokens that are e.g. only valid for a certain widgeted reports or similar. That way a user wouldn't be able to use the same token for something else.

If you wish to restrict some parts of your instance, you might need to do a custom implementation / plugin and hook into certain events in order to deny normal user accounts to access it.

Anyway, thanks for your effort in creating this PR.