moodle/auth/mnet/auth.php

<?php

/**
 * @author Martin Dougiamas
 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
 * @package moodle multiauth
 *
 * Authentication Plugin: Moodle Network Authentication
 *
 * Multiple host authentication support for Moodle Network.
 *
 * 2006-11-01  File created.
 */

// This page cannot be called directly
if (!isset($CFG)) {
    exit;
}

/**
 * Moodle Network authentication plugin.
 */
class auth_plugin_mnet
{

    /**
     * The configuration details for the plugin.
     */
    var $config;

    /**
     * Constructor.
     */
    function auth_plugin_mnet() {
        $this->config = get_config('auth/mnet');
    }

    /**
     * Provides the allowed RPC services from this class as an array.
     * @return array  Allowed RPC services.
     */
    function mnet_publishes() {

        $sso_idp = array();
        $sso_idp['name']        = 'sso_idp'; // Name & Description go in lang file
        $sso_idp['apiversion']  = 1;
        $sso_idp['methods']     = array('user_authorise','keepalive_server', 'kill_children', 'refresh_log', 'fetch_user_image', 'fetch_theme_info');

        $sso_sp = array();
        $sso_sp['name']         = 'sso_sp'; // Name & Description go in lang file
        $sso_sp['apiversion']   = 1;
        $sso_sp['methods']      = array('keepalive_client','kill_child');

        return array($sso_idp, $sso_sp);
    }

    /**
     * This function is normally used to determine if the username and password
     * are correct for local logins. Always returns false, as local users do not
     * need to login over mnet xmlrpc.
     *
     * @param string $username The username
     * @param string $password The password
     * @returns bool Authentication success or failure.
     */
    function user_login($username, $password) {
        return false; // error("Remote MNET users cannot login locally.");
    }

    /**
     * Return user data for the provided token, compare with user_agent string.
     *
     * @param  string $token    The unique ID provided by remotehost.
     * @param  string $UA       User Agent string.
     * @return array  $userdata Array of user info for remote host
     */
    function user_authorise($token, $useragent) {
        global $CFG;
        global $MNET;
        require_once $CFG->dirroot . '/mnet/xmlrpc/server.php';

        $mnet_session = get_record('mnet_session', 'token', $token, 'useragent', $useragent);
        if (empty($mnet_session)) {
            echo mnet_server_fault(1, get_string('authfail_nosessionexists', 'mnet'));
            exit;
        }

        // check session confirm timeout
        if ($mnet_session->confirm_timeout < time()) {
            echo mnet_server_fault(2, get_string('authfail_sessiontimedout', 'mnet'));
            exit;
        }

        // session okay, try getting the user
        if (!$user = get_complete_user_data('id', $mnet_session->userid)) {
            echo mnet_server_fault(3, get_string('authfail_usermismatch', 'mnet'));
            exit;
        }

        $userdata = array();
        $userdata['username']                = $user->username;
        $userdata['email']                   = $user->email;
        $userdata['auth']                    = 'mnet';
        $userdata['confirmed']               = $user->confirmed;
        $userdata['deleted']                 = $user->deleted;
        $userdata['firstname']               = $user->firstname;
        $userdata['lastname']                = $user->lastname;
        $userdata['city']                    = $user->city;
        $userdata['country']                 = $user->country;
        $userdata['lang']                    = $user->lang;
        $userdata['timezone']                = $user->timezone;
        $userdata['description']             = $user->description;
        $userdata['mailformat']              = $user->mailformat;
        $userdata['maildigest']              = $user->maildigest;
        $userdata['maildisplay']             = $user->maildisplay;
        $userdata['htmleditor']              = $user->htmleditor;
        $userdata['wwwroot']                 = $MNET->wwwroot;
        $userdata['session.gc_maxlifetime']  = ini_get('session.gc_maxlifetime');
        $userdata['picture']                 = $user->picture;
        if (!empty($user->picture)) {
            $imagefile = "{$CFG->dataroot}/users/{$user->id}/f1.jpg";
            if (file_exists($imagefile)) {
                $userdata['imagehash'] = sha1(file_get_contents($imagefile));
            }
        }
        return $userdata;
    }

    /**
     * Generate a random string for use as an RPC session token.
     */
    function generate_token() {
        return sha1(str_shuffle('' . mt_rand() . time()));
    }

    /**
     * Starts an RPC jump session and returns the jump redirect URL.
     */
    function start_jump_session($mnethostid, $wantsurl) {
        global $CFG;
        global $USER;
        global $MNET;
        require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';

        // check remote login permissions
        if (! has_capability('moodle/site:mnetlogintoremote', get_context_instance(CONTEXT_SYSTEM, SITEID))
                or is_mnet_remote_user($USER)
                or $USER->username == 'guest'
                or empty($USER->id)) {
            error(get_string('notpermittedtojump', 'mnet'));
        }

        // check for SSO publish permission first
        if ($this->has_service($mnethostid, 'sso_sp') == false) {
            error(get_string('hostnotconfiguredforsso', 'mnet'));
        }

        // set RPC timeout to 30 seconds if not configured
        // TODO: Is this needed/useful/problematic?
        if (empty($this->config->rpc_negotiation_timeout)) {
            set_config('rpc_negotiation_timeout', '30', 'auth/mnet');
        }

        // get the host info
        $mnet_peer = new mnet_peer();
        $mnet_peer->set_id($mnethostid);

        // set up the session
        $mnet_session = get_record('mnet_session', 'userid', $USER->id, 'mnethostid', $mnethostid, 'useragent', sha1($_SERVER['HTTP_USER_AGENT']));
        if ($mnet_session == false) {
            $mnet_session = new object();
            $mnet_session->mnethostid = $mnethostid;
            $mnet_session->userid = $USER->id;
            $mnet_session->username = $USER->username;
            $mnet_session->useragent = sha1($_SERVER['HTTP_USER_AGENT']);
            $mnet_session->token = $this->generate_token();
            $mnet_session->confirm_timeout = time() + $this->config->rpc_negotiation_timeout;
            $mnet_session->expires = time() + (integer)ini_get('session.gc_maxlifetime');
            $mnet_session->session_id = session_id();
            if (! $mnet_session->id = insert_record('mnet_session', $mnet_session)) {
                error(get_string('databaseerror', 'mnet'));
            }
        } else {
            $mnet_session->useragent = sha1($_SERVER['HTTP_USER_AGENT']);
            $mnet_session->token = $this->generate_token();
            $mnet_session->confirm_timeout = time() + $this->config->rpc_negotiation_timeout;
            $mnet_session->expires = time() + (integer)ini_get('session.gc_maxlifetime');
            $mnet_session->session_id = session_id();
            if (false == update_record('mnet_session', $mnet_session)) {
                error(get_string('databaseerror', 'mnet'));
            }
        }

        // construct the redirection URL
        //$transport = mnet_get_protocol($mnet_peer->transport);
        $wantsurl = urlencode($wantsurl);
        $url = "{$mnet_peer->wwwroot}/auth/mnet/land.php?token={$mnet_session->token}&idp={$MNET->wwwroot}&wantsurl={$wantsurl}";

        return $url;
    }

    /**
     * This function confirms the remote (ID provider) host's mnet session
     * by communicating the token and UA over the XMLRPC transport layer, and
     * returns the local user record on success.
     *
     *   @param string $token           The random session token.
     *   @param string $remotewwwroot   The ID provider wwwroot.
     *   @returns array The local user record.
     */
    function confirm_mnet_session($token, $remotewwwroot) {
        global $CFG, $MNET;
        require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';

        // verify the remote host is configured locally before attempting RPC call
        if (! $remotehost = get_record('mnet_host', 'wwwroot', $remotewwwroot)) {
            error(get_string('notpermittedtoland', 'mnet'));
        }

        // get the originating (ID provider) host info
        $remotepeer = new mnet_peer();
        $remotepeer->set_wwwroot($remotewwwroot);

        // set up the RPC request
        $mnetrequest = new mnet_xmlrpc_client();
        $mnetrequest->set_method('auth/mnet/auth.php/user_authorise');

        // set $token and $useragent parameters
        $mnetrequest->add_param($token);
        $mnetrequest->add_param(sha1($_SERVER['HTTP_USER_AGENT']));

        // Thunderbirds are go! Do RPC call and store response
        if ($mnetrequest->send($remotepeer) === true) {
            $remoteuser = (object) $mnetrequest->response;
        } else {
            foreach ($mnetrequest->error as $code => $errormessage) {
                $message .= "ERROR $code:<br/>$errormessage<br/>";
            }
            error("RPC auth/mnet/user_authorise:<br/>$message");
        }

        if (empty($remoteuser) or empty($remoteuser->username)) {
            error(get_string('unknownerror', 'mnet'));
        }

        // get the local record for the remote user
        $localuser = get_record('user', 'username', $remoteuser->username, 'mnethostid', $remotehost->id);

        // add the remote user to the database if necessary, and if allowed
        // TODO: refactor into a separate function
        if (! $localuser->id) {
            if (empty($this->config->auto_add_remote_users)) {
                error(get_string('nolocaluser', 'mnet'));
            }
            $remoteuser->mnethostid = $remotehost->id;
            if (! insert_record('user', $remoteuser)) {
                error(get_string('databaseerror', 'mnet'));
            }
            if (! $localuser = get_record('user', 'username', $remoteuser->username, 'mnethostid', $remotehost->id)) {
                error(get_string('nolocaluser', 'mnet'));
            }
        }

        // check sso access control list for permission first
        if (!$this->can_login_remotely($localuser->username, $remotehost->id)) {
            error("Username '$localuser->username' is not permitted to login from '$remotehost->name'.");
        }

        $session_gc_maxlifetime = 1440;

        // update the local user record with remote user data
        foreach ((array) $remoteuser as $key => $val) {
            if ($key == 'session.gc_maxlifetime') {
                $session_gc_maxlifetime = $val;
                continue;
            }

            // TODO: fetch image if it has changed
            if ($key == 'imagehash') {
                $dirname = "{$CFG->dataroot}/users/{$localuser->id}";
                $filename = "$dirname/f1.jpg";

                $localhash = '';
                if (file_exists($filename)) {
                    $localhash = sha1(file_get_contents($filename));
                } elseif (!file_exists($dirname)) {
                    mkdir($dirname);
                }

                if ($localhash != $val) {
                    // fetch image from remote host
                    $fetchrequest = new mnet_xmlrpc_client();
                    $fetchrequest->set_method('auth/mnet/auth.php/fetch_user_image');
                    $fetchrequest->add_param($localuser->username);
                    if ($fetchrequest->send($remotepeer) === true) {
                        if (strlen($fetchrequest->response['f1']) > 0) {
                            $imagecontents = base64_decode($fetchrequest->response['f1']);
                            file_put_contents($filename, $imagecontents);
                        }
                        if (strlen($fetchrequest->response['f2']) > 0) {
                            $imagecontents = base64_decode($fetchrequest->response['f2']);
                            file_put_contents($dirname.'/f2.jpg', $imagecontents);
                        }
                    }
                }
            }

            $localuser->{$key} = $val;
        }

        $localuser->mnethostid = $remotepeer->id;

        $bool = update_record('user', $localuser);
        if (!$bool) {
            //TODO: Jonathan to clean up mess:
            exit("updating user failed in mnet/auth/confirm_mnet_session ");
        }

        // set up the session
        $mnet_session = get_record('mnet_session', 'userid', $localuser->id, 'mnethostid', $remotepeer->id, 'useragent', sha1($_SERVER['HTTP_USER_AGENT']));
        if ($mnet_session == false) {
            $mnet_session = new object();
            $mnet_session->mnethostid = $remotepeer->id;
            $mnet_session->userid = $localuser->id;
            $mnet_session->username = $localuser->username;
            $mnet_session->useragent = sha1($_SERVER['HTTP_USER_AGENT']);
            $mnet_session->token = ''; //Not needed on the SP side
            $mnet_session->confirm_timeout = time();
            $mnet_session->expires = time() + (integer)$session_gc_maxlifetime;
            $mnet_session->session_id = session_id();
            if (! $mnet_session->id = insert_record('mnet_session', $mnet_session)) {
                error(get_string('databaseerror', 'mnet'));
            }
        } else {
            $mnet_session->expires = time() + (integer)$session_gc_maxlifetime;
            update_record('mnet_session', $mnet_session);
        }

        return $localuser;
    }

    /**
     * Returns true if this authentication plugin is 'internal'.
     *
     * @returns bool
     */
    function is_internal() {
        return false;
    }

    /**
     * Returns true if this authentication plugin can change the user's
     * password.
     *
     * @returns bool
     */
    function can_change_password() {
        return false;
    }

    /**
     * Returns the URL for changing the user's pw, or false if the default can
     * be used.
     *
     * @returns bool
     */
    function change_password_url() {
        return false;
    }

    /**
     * Prints a form for configuring this authentication plugin.
     *
     * This function is called from admin/auth.php, and outputs a full page with
     * a form for configuring this plugin.
     *
     * @param array $page An object containing all the data for this page.
     */
    function config_form($config, $err) {
        include "config.html";
    }

    /**
     * Processes and stores configuration data for this authentication plugin.
     */
    function process_config($config) {
        // set to defaults if undefined
        if (!isset ($config->rpc_negotiation_timeout)) {
            $config->host = '30';
        }
        if (!isset ($config->auto_add_remote_users)) {
            $config->auto_add_remote_users = '0';
        }

        // save settings
        set_config('rpc_negotiation_timeout', $config->rpc_negotiation_timeout, 'auth/mnet');
        set_config('auto_add_remote_users',   $config->auto_add_remote_users,   'auth/mnet');

        return true;
    }

    /**
     * Poll the IdP server to let it know that a user it has authenticated is still
     * online
     *
     * @return  void
     */
    function keepalive_client() {
        global $CFG;
        $cutoff = time() - 300; // TODO - find out what the remote server's session
                                // cutoff is, and preempt that

        $sql = "
            select
                id,
                username,
                mnethostid
            from
                {$CFG->prefix}user
            where
                lastaccess > '$cutoff' AND
                mnethostid != '{$CFG->mnet_localhost_id}'
            order by
                mnethostid";

        $immigrants = get_records_sql($sql);

        if ($immigrants == false) {
            return true;
        }

        $usersArray = array();
        foreach($immigrants as $immigrant) {
            $usersArray[$immigrant->mnethostid][] = $immigrant->username;
        }

        require_once $CFG->dirroot . '/mnet/xmlrpc/client.php';
        foreach($usersArray as $mnethostid => $users) {
            $mnet_peer = new mnet_peer();
            $mnet_peer->set_id($mnethostid);

            $mnet_request = new mnet_xmlrpc_client();
            $mnet_request->set_method('auth/mnet/auth.php/keepalive_server');

            // set $token and $useragent parameters
            $mnet_request->add_param($users);

            if ($mnet_request->send($mnet_peer) === true) {
                if (!isset($mnet_request->response['code'])) {
                    debugging("Server side error has occured on host $mnethostid");
                    continue;
                } elseif ($mnet_request->response['code'] > 0) {
                    debugging($mnet_request->response['message']);
                }
                
                if (!isset($mnet_request->response['last log id'])) {
                    debugging("Server side error has occured on host $mnethostid\nNo log ID was received.");
                    continue;
                }
            } else {
                debugging("Server side error has occured on host $mnethostid: " . 
                          join("\n", $mnet_request->error));
            }

            $query = "SELECT
                          l.id as remoteid,
                          l.time,
                          l.userid,
                          l.ip,
                          l.course,
                          l.module,
                          l.cmid,
                          l.action,
                          l.url,
                          l.info,
                          c.fullname as coursename,
                          c.modinfo as modinfo,
                          u.username
                      FROM
                          {$CFG->prefix}user u,
                          {$CFG->prefix}log l,
                          {$CFG->prefix}course c
                      WHERE
                          l.userid = u.id AND
                          u.mnethostid = '$mnethostid' AND
                          l.id > '".$mnet_request->response['last log id']."' AND
                          c.id = l.course
                      ORDER BY
                          remoteid ASC";

            $results = get_records_sql($query);

            if (false == $results) continue;

            $param = array();

            foreach($results as $result) {
                if (!empty($result->modinfo) && !empty($result->cmid)) {
                    $modinfo = unserialize($result->modinfo);
                    unset($result->modinfo);
                    $modulearray = array();
                    foreach($modinfo as $module) {
                        $modulearray[$module->cm] = urldecode($module->name);
                    }
                    $result->resource_name = $modulearray[$result->cmid];
                } else {
                    $result->resource_name = '';
                }

                $param[] = array (
                                    'remoteid'      => $result->remoteid,
                                    'time'          => $result->time,
                                    'userid'        => $result->userid,
                                    'ip'            => $result->ip,
                                    'course'        => $result->course,
                                    'coursename'    => $result->coursename,
                                    'module'        => $result->module,
                                    'cmid'          => $result->cmid,
                                    'action'        => $result->action,
                                    'url'           => $result->url,
                                    'info'          => $result->info,
                                    'resource_name' => $result->resource_name,
                                    'username'      => $result->username
                                 );
            }

            unset($result);

            $mnet_request = new mnet_xmlrpc_client();
            $mnet_request->set_method('auth/mnet/auth.php/refresh_log');

            // set $token and $useragent parameters
            $mnet_request->add_param($param);

            if ($mnet_request->send($mnet_peer) === true) {
                if ($mnet_request->response['code'] > 0) {
                    debugging($mnet_request->response['message']);
                }
            } else {
                debugging("Server side error has occured on host $mnet_peer->ip: " .join("\n", $mnet_request->error));
            }
        }
    }

    /**
     * Receives an array of log entries from an SP and adds them to the mnet_log
     * table
     *
     * @param   array   $array      An array of usernames
     * @return  string              "All ok" or an error message
     */
    function refresh_log($array) {
        global $CFG, $MNET_REMOTE_CLIENT;

        // We don't want to output anything to the client machine
        $start = ob_start();

        $returnString = '';
        begin_sql();
        $useridarray = array();

        foreach($array as $logEntry) {
            $logEntryObj = (object)$logEntry;
            $logEntryObj->hostid = $MNET_REMOTE_CLIENT->id;

            if (isset($useridarray[$logEntryObj->username])) {
                $logEntryObj->userid = $useridarray[$logEntryObj->username];
            } else {
                $logEntryObj->userid = get_field('user','id','username',$logEntryObj->username);
                if ($logEntryObj->userid == false) {
                    $logEntryObj->userid = 0;
                }
                $useridarray[$logEntryObj->username] = $logEntryObj->userid;
            }

            unset($logEntryObj->username);

            $insertok = insert_record('mnet_log', $logEntryObj, false);

            if ($insertok) {
                $MNET_REMOTE_CLIENT->last_log_id = $logEntryObj->remoteid;
            } else {
                $returnString .= 'Record with id '.$logEntryObj->remoteid." failed to insert.\n";
            }
        }
        $MNET_REMOTE_CLIENT->commit();
        commit_sql();

        $end = ob_end_clean();

        if (empty($returnString)) return array('code' => 0, 'message' => 'All ok');
        return array('code' => 1, 'message' => $returnString);
    }

    /**
     * Receives an array of usernames from a remote machine and prods their
     * sessions to keep them alive
     *
     * @param   array   $array      An array of usernames
     * @return  string              "All ok" or an error message
     */
    function keepalive_server($array) {
        global $MNET_REMOTE_CLIENT, $CFG;

        $CFG->usesid = true;
        // Addslashes to all usernames, so we can build the query string real
        // simply with 'implode'
        $array = array_map('addslashes', $array);

        // We don't want to output anything to the client machine
        $start = ob_start();

        // We'll get session records in batches of 30
        $superArray = array_chunk($array, 30);

        $returnString = '';

        foreach($superArray as $subArray) {
            $subArray = array_values($subArray);
            $instring = "('".implode("', '",$subArray)."')";
            $query = "select id, session_id, username from {$CFG->prefix}mnet_session where username in $instring";
            $results = get_records_sql($query);

            if ($results == false) {
                // We seem to have a username that breaks our query:
                // TODO: Handle this error appropriately
                $returnString .= "We failed to refresh the session for the following usernames: \n".implode("\n", $subArray)."\n\n";
            } else {
                // TODO: This process of killing and re-starting the session
                // will cause PHP to forget any custom session_set_save_handler
                // stuff. Subsequent attempts to prod existing sessions will
                // fail, because PHP will look in wherever the default place
                // may be (files?) and probably create a new session with the
                // right session ID in that location. If it doesn't have write-
                // access to that location, then it will fail... not sure how
                // apparent that will be.
                // There is no way to capture what the custom session handler
                // is and then reset it on each pass - I checked that out
                // already.
                $sesscache = clone($_SESSION);
                $sessidcache = session_id();
                session_write_close();
                unset($_SESSION);

                $uc = ini_get('session.use_cookies');
                ini_set('session.use_cookies', false);
                foreach($results as $emigrant) {

                    unset($_SESSION);
                    session_name('MoodleSession'.$CFG->sessioncookie);
                    session_id($emigrant->session_id);
                    session_start();
                    session_write_close();
                }

                ini_set('session.use_cookies', $uc);
                session_name('MoodleSession'.$CFG->sessioncookie);
                session_id($sessidcache);
                session_start();
                $_SESSION = clone($sesscache);
                session_write_close();
            }
        }

        $end = ob_end_clean();

        if (empty($returnString)) return array('code' => 0, 'message' => 'All ok', 'last log id' => $MNET_REMOTE_CLIENT->last_log_id);
        return array('code' => 1, 'message' => $returnString, 'last log id' => $MNET_REMOTE_CLIENT->last_log_id);
    }

    /**
     * Cron function will be called automatically by cron.php every 5 minutes
     *
     * @return void
     */
    function cron() {
        $this->keepalive_client();
    }

    /**
     * Cleanup any remote mnet_sessions, kill the local mnet_session data
     *
     * This is called by require_logout in moodlelib
     *
     * @return   void
     */
    function logout() {
        global $MNET, $CFG, $USER;
        require_once $CFG->dirroot.'/mnet/xmlrpc/client.php';

        // If the user is local to this Moodle:
        if ($USER->mnethostid == $MNET->id) {
            $this->kill_children($USER->username, sha1($_SERVER['HTTP_USER_AGENT']));

        // Else the user has hit 'logout' at a Service Provider Moodle:
        } else {
            $this->kill_parent($USER->username, sha1($_SERVER['HTTP_USER_AGENT']));

        }
    }

    /**
     * The SP uses this function to kill the session on the parent IdP
     *
     * @param   string  $username       Username for session to kill
     * @param   string  $useragent      SHA1 hash of user agent to look for
     * @return  string                  A plaintext report of what has happened
     */
    function kill_parent($username, $useragent) {
        global $CFG, $USER;
        require_once $CFG->dirroot.'/mnet/xmlrpc/client.php';
        $sql = "
            select
                *
            from
                {$CFG->prefix}mnet_session s
            where
                s.username   = '$username' AND
                s.useragent  = '$useragent' AND
                s.mnethostid = '{$USER->mnethostid}'";

        $mnetsessions = get_records_sql($sql);

        $ignore = delete_records('mnet_session', 'username', $username, 'useragent', $useragent, 'mnethostid', $USER->mnethostid);

        if (false != $mnetsessions) {
            $mnet_peer = new mnet_peer();
            $mnet_peer->set_id($USER->mnethostid);

            $mnet_request = new mnet_xmlrpc_client();
            $mnet_request->set_method('auth/mnet/auth.php/kill_children');

            // set $token and $useragent parameters
            $mnet_request->add_param($username);
            $mnet_request->add_param($useragent);
            if ($mnet_request->send($mnet_peer) === false) {
                debugging(join("\n", $mnet_request->error));
                return false; 
            }
        }

        $_SESSION = array();
        return true;
    }

    /**
     * The IdP uses this function to kill child sessions on other hosts
     *
     * @param   string  $username       Username for session to kill
     * @param   string  $useragent      SHA1 hash of user agent to look for
     * @return  string                  A plaintext report of what has happened
     */
    function kill_children($username, $useragent) {
        global $CFG, $USER, $MNET_REMOTE_CLIENT;
        require_once $CFG->dirroot.'/mnet/xmlrpc/client.php';

        $userid = get_field('user', 'id', 'mnethostid', $CFG->mnet_localhost_id, 'username', $username);

        $returnstring = '';
        $sql = "
            select
                *
            from
                {$CFG->prefix}mnet_session s
            where
                s.userid     = '{$userid}' AND
                s.useragent  = '{$useragent}'";

        // If we are being executed from a remote machine (client) we don't have
        // to kill the moodle session on that machine.
        if (isset($MNET_REMOTE_CLIENT) && isset($MNET_REMOTE_CLIENT->id)) {
            $excludeid = $MNET_REMOTE_CLIENT->id;
        } else {
            $excludeid = -1;
        }

        $mnetsessions = get_records_sql($sql);

        if (false == $mnetsessions) {
            $returnstring .= "Could find no remote sessions\n$sql\n";
            $mnetsessions = array();
        }

        foreach($mnetsessions as $mnetsession) {
            $returnstring .=  "Deleting session\n";

            if ($mnetsession->mnethostid == $excludeid) continue;

            $mnet_peer = new mnet_peer();
            $mnet_peer->set_id($mnetsession->mnethostid);

            $mnet_request = new mnet_xmlrpc_client();
            $mnet_request->set_method('auth/mnet/auth.php/kill_child');

            // set $token and $useragent parameters
            $mnet_request->add_param($username);
            $mnet_request->add_param($useragent);
            if ($mnet_request->send($mnet_peer) === false) {
                debugging("Server side error has occured on host $mnethostid: " . 
                          join("\n", $mnet_request->error));
            }
        }

        $ignore = delete_records('mnet_session', 'useragent', $useragent, 'userid', $userid);

        if (isset($MNET_REMOTE_CLIENT) && isset($MNET_REMOTE_CLIENT->id)) {
            $start = ob_start();

            $uc = ini_get('session.use_cookies');
            ini_set('session.use_cookies', false);
            $sesscache = clone($_SESSION);
            $sessidcache = session_id();
            session_write_close();
            unset($_SESSION);


            session_id($mnetsession->session_id);
            session_start();
            session_unregister("USER");
            session_unregister("SESSION");
            unset($_SESSION);
            $_SESSION = array();
            session_write_close();


            ini_set('session.use_cookies', $uc);
            session_name('MoodleSession'.$CFG->sessioncookie);
            session_id($sessidcache);
            session_start();
            $_SESSION = clone($sesscache);
            session_write_close();

            $end = ob_end_clean();
        } else {
            $_SESSION = array();
        }
        return $returnstring;
    }

    /**
     * TODO:Untested When the IdP requests that child sessions are terminated,
     * this function will be called on each of the child hosts. The machine that
     * calls the function (over xmlrpc) provides us with the mnethostid we need.
     *
     * @param   string  $username       Username for session to kill
     * @param   string  $useragent      SHA1 hash of user agent to look for
     * @return  bool                    True on success
     */
    function kill_child($username, $useragent) {
        global $CFG, $MNET_REMOTE_CLIENT;
        $session = get_record('mnet_session', 'username', $username, 'mnethostid', $MNET_REMOTE_CLIENT->id, 'useragent', $useragent);
        if (false != $session) {
            $start = ob_start();

            $uc = ini_get('session.use_cookies');
            ini_set('session.use_cookies', false);
            $sesscache = clone($_SESSION);
            $sessidcache = session_id();
            session_write_close();
            unset($_SESSION);


            session_id($session->session_id);
            session_start();
            session_unregister("USER");
            session_unregister("SESSION");
            unset($_SESSION);
            $_SESSION = array();
            session_write_close();


            ini_set('session.use_cookies', $uc);
            session_name('MoodleSession'.$CFG->sessioncookie);
            session_id($sessidcache);
            session_start();
            $_SESSION = clone($sesscache);
            session_write_close();

            $end = ob_end_clean();
            return true;
        }
        return false;
    }

    /**
     * To delete a host, we must delete all current sessions that users from
     * that host are currently engaged in.
     *
     * @param   string  $sessionidarray   An array of session hashes
     * @return  bool                      True on success
     */
    function end_local_sessions(&$sessionArray) {
        global $CFG;
        if (is_array($sessionArray)) {
            $start = ob_start();

            $uc = ini_get('session.use_cookies');
            ini_set('session.use_cookies', false);
            $sesscache = clone($_SESSION);
            $sessidcache = session_id();
            session_write_close();
            unset($_SESSION);

            while($session = array_pop($sessionArray)) {
                session_id($session->session_id);
                session_start();
                session_unregister("USER");
                session_unregister("SESSION");
                unset($_SESSION);
                $_SESSION = array();
                session_write_close();
            }

            ini_set('session.use_cookies', $uc);
            session_name('MoodleSession'.$CFG->sessioncookie);
            session_id($sessidcache);
            session_start();
            $_SESSION = clone($sesscache);

            $end = ob_end_clean();
            return true;
        }
        return false;
    }

    /**
     * Returns the user's image as a base64 encoded string.
     *
     * @param int $userid The id of the user
     * @return string     The encoded image
     */
    function fetch_user_image($username) {
        global $CFG;

        if ($user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id)) {
            $filename1 = "{$CFG->dataroot}/users/{$user->id}/f1.jpg";
            $filename2 = "{$CFG->dataroot}/users/{$user->id}/f2.jpg";
            $return = array();
            if (file_exists($filename1)) {
                $return['f1'] = base64_encode(file_get_contents($filename1));
            }
            if (file_exists($filename2)) {
                $return['f2'] = base64_encode(file_get_contents($filename2));
            }
            return $return;
        }
        return false;
    }

    /**
     * Returns the theme information and logo url as strings.
     *
     * @return string     The theme info
     */
    function fetch_theme_info() {
        global $CFG;

        $themename = "$CFG->theme";
        $logourl   = "$CFG->wwwroot/theme/$CFG->theme/images/logo.jpg";

        $return['themename'] = $themename;
        $return['logourl'] = $logourl;
        return $return;
    }

    /**
     * Determines if an MNET host is providing the nominated service.
     *
     * @param int    $mnethostid   The id of the remote host
     * @param string $servicename  The name of the service
     * @return bool                Whether the service is available on the remote host
     */
    function has_service($mnethostid, $servicename) {
        global $CFG;

        $sql = "
            SELECT
                svc.id as serviceid,
                svc.name,
                svc.description,
                svc.offer,
                svc.apiversion,
                h2s.id as h2s_id
            FROM
                {$CFG->prefix}mnet_service svc,
                {$CFG->prefix}mnet_host2service h2s
            WHERE
                h2s.hostid = '$mnethostid' AND
                h2s.serviceid = svc.id AND
                svc.name = '$servicename' AND
                h2s.subscribe = '1'";

        return get_records_sql($sql);
    }

    /**
     * Checks the MNET access control table to see if the username/mnethost
     * is permitted to login to this moodle.
     *
     * @param string $username   The username
     * @param int    $mnethostid The id of the remote mnethost
     * @return bool              Whether the user can login from the remote host
     */
    function can_login_remotely($username, $mnethostid) {
        $access = 'allow';
        $aclrecord = get_record('mnet_sso_access_control', 'username', $username, 'mnet_host_id', $mnethostid);
        if (!empty($aclrecord)) {
            $access = $aclrecord->access;
        }
        return $access == 'allow';
    }
}

?>