Newest Development Version Logging in Problems

system · May 31, 2013, 1:40pm

bb2013 wrote on Friday, May 31, 2013:

Can somebody shed insight on why when I try to go into the latest dev version it doesn’t let me log in? I installed from XAMPP successfully. I put in admin, pass as default login credentials. It seems as though it is trying to login but then kicks me out.

Thanks for any help on this.

system · May 31, 2013, 4:17pm

yehster wrote on Friday, May 31, 2013:

It’s most likely a bug somewhere with the recent code changes for security.

Any detail you can provide about your XAMPP package version or error_log entries would be helpful in trying to figure this out.

system · May 31, 2013, 7:18pm

yehster wrote on Friday, May 31, 2013:

Brady,
The development demo at http://demo.open-emr.org:2089/ is showing similar behavior, and I get something similar when using the automated install with the development appliance.

However, if I re-run setup on the development appliance, all is well. My suspicion is that the mechanism the dev demo and the appliance use to create the initial user wasn’t updated for the new schema.

There’s a bug in the authentication code though in that a non-existent user behaves differently than a valid user with an incorrect password. Non-existent user seems to login, but then is kicked out vs. incorrect password going directly to login screen with an error message. Should be an easy fix.

system · May 31, 2013, 7:33pm

yehster wrote on Friday, May 31, 2013:

Here’s the fix. It’s embarrassing to have a bug like this, but the good news is that it confirms that the other layers of security are working.

system · May 31, 2013, 7:34pm

yehster wrote on Friday, May 31, 2013:

The fix has been pushed to the official repository BTW.

system · May 31, 2013, 8:12pm

sunsetsystems wrote on Friday, May 31, 2013:

Kevin, one more thing to fix that I just ran into while doing a bleeding-edge install for a client’s testing. Please remove the trailing white space from library/authentication/common_operations.php; it causes logout to crash when it attempts to write a HTTP header. Thanks!

Rod
http://www.sunsetsystems.com/

system · May 31, 2013, 8:52pm

yehster wrote on Friday, May 31, 2013:

Rod, done…

system · June 1, 2013, 11:17am

yehster wrote on Saturday, June 01, 2013:

Ok. I Figured out how the auto installer works.

github.com

openemr/openemr/blob/master/contrib/util/installScripts/InstallerAuto.php#L79


//          d. Can continue installing new instances as needed ...
//             php -f InstallerAuto.php login=openemr3 pass=openemr3 dbname=openemr3 site=default3 source_site_id=default clone_database=yes
//     6) Provide pre-created database and restricted privilege user access credentials - example from Planettel.com.sg Proxmox OpenVZ Template
//        (otherwise use default configuration settings - do not use for cloning / migration)
//          php -f /var/www/openemr/contrib/util/installScripts/InstallerAuto.php no_root_db_access=1 iuserpass=oemr123 login=oemrusr pass=${UPASSWD} > /dev/null 2>&1
//


// This exit is to avoid malicious use of this script.
exit;


require_once(dirname(__FILE__).'/../../../library/classes/Installer.class.php');
require_once(dirname(__FILE__).'/../../../library/authentication/password_hashing.php');
// Set up default configuration settings
$installSettings = array();
$installSettings['iuser']                    = 'admin';
$installSettings['iuname']                   = 'Administrator';
$installSettings['iuserpass']                = 'pass';
$installSettings['igroup']                   = 'Default';
$installSettings['server']                   = 'localhost'; // mysql server
$installSettings['loginhost']                = 'localhost'; // php/apache server
$installSettings['port']                     = '3306';

It needs to include the password hashing PHP file here to create the initial user. I will plan to make the update later when I am on a real machine instead of my tablet.

system · June 1, 2013, 6:03pm

yehster wrote on Saturday, June 01, 2013:

I’ve made the corrections and pushed to sourceforge. I have successfully tested the auto installer script locally. I’ll double check the development demo after it updates tomorrow.

system · June 1, 2013, 9:40pm

yehster wrote on Saturday, June 01, 2013:

It also looks like XAMPP is not typically configured with OPENSSL by default

This is needed for the RSA encryption/decryption algorithms.

system · June 3, 2013, 6:18am

bradymiller wrote on Monday, June 03, 2013:

Hi,

Here’s some testing info on issue to help out(using xampp 1.8.0 which is version included with the OpenEMR-4.1.1-xampp package):

When try to login, nothing happens and get the following error in php error log:
PHP Fatal error: Call to undefined function openssl_pkey_new() in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 47

Then if enable openssl in php xampp per following instructions (I just added these instructions):
http://www.open-emr.org/wiki/index.php/OpenEMR_4.1.1_XAMPP_Package_Installation#Enable_openssl

Then when try to login, get “Invalid username or password” and following errors in error log:
[03-Jun-2013 05:54:44 UTC] PHP Warning: openssl_pkey_get_details() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 48
[03-Jun-2013 05:54:44 UTC] PHP Warning: openssl_pkey_export(): cannot get key from parameter 1 in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 50
[03-Jun-2013 05:54:45 UTC] PHP Warning: openssl_private_decrypt(): key parameter is not a valid private key in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 87
[03-Jun-2013 05:54:54 UTC] PHP Warning: openssl_pkey_get_details() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 48
[03-Jun-2013 05:54:54 UTC] PHP Warning: openssl_pkey_export(): cannot get key from parameter 1 in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 50
[03-Jun-2013 05:54:54 UTC] PHP Warning: openssl_private_decrypt(): key parameter is not a valid private key in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 87
[03-Jun-2013 05:54:59 UTC] PHP Warning: openssl_pkey_get_details() expects parameter 1 to be resource, boolean given in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 48
[03-Jun-2013 05:54:59 UTC] PHP Warning: openssl_pkey_export(): cannot get key from parameter 1 in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 50
[03-Jun-2013 05:55:00 UTC] PHP Warning: openssl_private_decrypt(): key parameter is not a valid private key in C:\xampp\htdocs\openemr\library\authentication\rsa.php on line 87

The database elements look ok. Was gonna try to manually place a salt/hash for ‘pass’ and see if that would work, but forgot where you placed it on the github comments. Was hoping to get it from you again to try it out.

-brady
OpenEMR

system · June 3, 2013, 6:23am

bradymiller wrote on Monday, June 03, 2013:

Hi,

I also manually re-updated the development demo (it got hung up today on the early am auto refresh when it couldn’t grab the translations from github (this happens when github goes down). And not able to login via generic credentials; guessing there is a minor bug somewhere. Regarding above bug, should consider what we should do when the openssl module is not installed (and if installed, testing if it working correctly); if not, then need to at least state the OpenEMR will not work until the module is installed (and not even allow login attempts) with considerations of a work around (not sure what it would be but something that requires minimal work and also issues a huge WARNING statement that would be best to install openssl).

-brady
OpenEMR

system · June 3, 2013, 6:50am

bradymiller wrote on Monday, June 03, 2013:

Regarding xampp bug, guessing that the openssl_pkey_new() call is returning false rather than a key pair.

system · June 3, 2013, 6:52am

bradymiller wrote on Monday, June 03, 2013:

I seriously hope this is not the issue:
http://www.apachefriends.org/f/viewtopic.php?p=198305&sid=ad4411d744c9d4f4248024ee36c67017

system · June 3, 2013, 7:40am

bradymiller wrote on Monday, June 03, 2013:

Hi,

I think the following will be very helpful here now that we are including a module that may cause issues (I do think keeping the openssl pass use is worth the work though):

Create a login_diagnostics.php script
On login screen, call the login_diagnostics.php script via an ajax call (place a progress spinner in place of login elements with message ‘Please Wait…’ or something like that until it is done).
For now have the login_diagnostics.php do the following a) create a key pair b)encrypt ‘dummy’ and ensure the encrypted value is a string and is not ‘dummy’ (ie. ensure a encryption is actually done) c) unencrypt the value and ensure it is ‘dummy’. If any of these error out then return a test fail (as a json object with test:result pair, which will allow easy addition of further tests in the future).
For the fails in above script, which just return a simple fail which then on login screen could show something like (“OpenEMR is not configured correctly. Unable to login. Contact your administrator.”) rather than offering a login and then place the real error messages in the php error log. For example if openssl_pkey_new() fails then place the string from openssl_error_string() in the error log etc.
Make this ajax call controlled by a global (on by default, but then allows it to be turned off if people/vendors don’t want to be bothered by it after they have successfully installed/configured OpenEMR.).
In library/authentication/rsa.php, place an error check at openssl_pkey_get_details() call along with considering a encryption check (like above using ‘dummy’) along with a way to error out (could just be silent with a message thrown to the error_log since just means user gets stuck at the login screen).

-brady
OpenEMR

system · June 3, 2013, 1:56pm

sunsetsystems wrote on Monday, June 03, 2013:

Brady, here’s what Kevin posted on github at https://github.com/yehster/openemr/commit/0b093d863a3ea8970c639b21718c9b74e4b7c425#commitcomment-3241093 :

$2a$05$dVOzFEH3Pi4llgdwJQaEB.qZ3VlunBh77ZXSJr9pFBmF48URl4DUi for password and
$2a$05$dVOzFEH3Pi4llgdwJQaEB$ for salt
matches ‘pass’

Rod
http://www.sunsetsystems.com/

system · June 3, 2013, 3:06pm

yehster wrote on Monday, June 03, 2013:

One part of what is going on with the setup in the Dev appliance is the AutoInstaller uses the Suhosin patch, which does have CRYPT_BLOWFISH, but then Suhosin is disabled, which removes it. So the autoinstaller creates the initial users with blowfish based passwords, but then OpenEMR is unable to understand them.

The autoinstaller needs to disable the Suhosin patch/extension before running the OpenEMR installer.

system · June 3, 2013, 3:18pm

yehster wrote on Monday, June 03, 2013:

Restated… The sequence of event/system state in the dev appliance (and presumably the dev demo server) is as follows.

After all the utilities/setup Suhosin security patch for PHP is installed and enabled.
Initial user is created using blowfish hashing (Suhosin is enabled)
Scripts disable Suhosin and restarts apache/php
When users try to login, OpenEMR doesn’t understand the password hash stored in the DB for the initial user. (CRYPT_BLOWFISH===0)

At this point if you:
Re-enable Suhosin patch by editing /etc/php.d/Z98_suhosin.ini, login with the initial user is possible.

system · June 3, 2013, 3:25pm

sunsetsystems wrote on Monday, June 03, 2013:

So to get blowfish you need either Suhosin or PHP 5.3? Do I have that right?

Rod
http://www.sunsetsystems.com/

system · June 3, 2013, 3:39pm

yehster wrote on Monday, June 03, 2013:

Yes, except the developer appliance which comes pre-loaded with Suhosin, explicitly disables it at install with a warning
“Disabling suhosin patch which is not compatible with OpenEMR”
I do not know the details of why that is the case.