mirror_php/moodle
1
0
Fork 0
mirror of https://github.com/moodle/moodle.git synced 2025-01-29 19:50:14 +01:00
Code Issues Projects Releases Wiki Activity

MDL-31968 Make NTLM REMOTE_USER format configurable by the admin

Browse Source 
Signed-off-by: Iñaki Arenaza <iarenaza@mondragon.edu>
This commit is contained in:
Iñaki Arenaza 2012-04-27 00:23:42 +02:00
parent 5d6285c220
commit 34b10e26c6
3 changed files with 96 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

79
auth/ldap/auth.php
View File

@ -41,6 +41,18 @@ if (!defined('AUTH_GID_NOGROUP')) {
define('AUTH_GID_NOGROUP', -2);
}
// Regular expressions for a valid NTLM username and domain name.
if (!defined('AUTH_NTLM_VALID_USERNAME')) {
define('AUTH_NTLM_VALID_USERNAME', '[^/\\\\\\\\\[\]:;|=,+*?<>@"]+');
}
if (!defined('AUTH_NTLM_VALID_DOMAINNAME')) {
define('AUTH_NTLM_VALID_DOMAINNAME', '[^\\\\\\\\\/:*?"<>|]+');
}
// Default format for remote users if using NTLM SSO
if (!defined('AUTH_NTLM_DEFAULT_FORMAT')) {
define('AUTH_NTLM_DEFAULT_FORMAT', '%domain%\\%username%');
}
require_once($CFG->libdir.'/authlib.php');
require_once($CFG->libdir.'/ldaplib.php');
@ -1570,8 +1582,11 @@ class auth_plugin_ldap extends auth_plugin_base {
switch ($this->config->ntlmsso_type) {
case 'ntlm':
// Format is DOMAIN\username
$username = substr(strrchr($username, '\\'), 1);
// The format is now configurable, so try to extract the username
$username = $this->get_ntlm_remote_user($username);
if (empty($username)) {
return false;
}
break;
case 'kerberos':
// Format is username@DOMAIN
@ -1779,6 +1794,9 @@ class auth_plugin_ldap extends auth_plugin_base {
if (!isset($config->ntlmsso_type)) {
$config->ntlmsso_type = 'ntlm';
}
if (!isset($config->ntlmsso_remoteuserformat)) {
$config->ntlmsso_remoteuserformat = '';
}
// Try to remove duplicates before storing the contexts (to avoid problems in sync_users()).
$config->contexts = explode(';', $config->contexts);
@ -1818,6 +1836,7 @@ class auth_plugin_ldap extends auth_plugin_base {
set_config('ntlmsso_subnet', trim($config->ntlmsso_subnet), $this->pluginconfig);
set_config('ntlmsso_ie_fastpath', (int)$config->ntlmsso_ie_fastpath, $this->pluginconfig);
set_config('ntlmsso_type', $config->ntlmsso_type, 'auth/ldap');
set_config('ntlmsso_remoteuserformat', trim($config->ntlmsso_remoteuserformat), 'auth/ldap');
return true;
}
@ -2018,4 +2037,60 @@ class auth_plugin_ldap extends auth_plugin_base {
$this->config->user_attribute, $this->config->search_sub);
}
/**
* A chance to validate form data, and last chance to do stuff
* before it is inserted in config_plugin
*
* @param object object with submitted configuration settings (without system magic quotes)
* @param array $err array of error messages (passed by reference)
*/
function validate_form($form, &$err) {
if ($form->ntlmsso_type == 'ntlm') {
$format = trim($form->ntlmsso_remoteuserformat);
if (!empty($format) && !preg_match('/%username%/i', $format)) {
$err['ntlmsso_remoteuserformat'] = get_string('auth_ntlmsso_missing_username', 'auth_ldap');
}
}
}
/**
* When using NTLM SSO, the format of the remote username we get in
* $_SERVER['REMOTE_USER'] may vary, depending on where from and how the web
* server gets the data. So we let the admin configure the format using two
* place holders (%domain% and %username%). This function tries to extract
* the username (stripping the domain part and any separators if they are
* present) from the value present in $_SERVER['REMOTE_USER'], using the
* configured format.
*
* @param string $remoteuser The value from $_SERVER['REMOTE_USER'] (converted to UTF-8)
*
* @return string The remote username (without domain part or
* separators). Empty string if we can't extract the username.
*/
protected function get_ntlm_remote_user($remoteuser) {
if (empty($this->config->ntlmsso_remoteuserformat)) {
$format = AUTH_NTLM_DEFAULT_FORMAT;
} else {
$format = $this->config->ntlmsso_remoteuserformat;
}
$format = preg_quote($format);
$formatregex = preg_replace(array('#%domain%#', '#%username%#'),
array('('.AUTH_NTLM_VALID_DOMAINNAME.')', '('.AUTH_NTLM_VALID_USERNAME.')'),
$format);
if (preg_match('#^'.$formatregex.'$#', $remoteuser, $matches)) {
$user = end($matches);
return $user;
}
/* We are unable to extract the username with the configured format. Probably
* the format specified is wrong, so log a warning for the admin and return
* an empty username.
*/
error_log($this->errorlogtag.get_string ('auth_ntlmsso_maybeinvalidformat', 'auth_ldap'));
return '';
}
} // End of the class

15
auth/ldap/config.html
View File

@ -94,6 +94,9 @@ if (!isset($config->ntlmsso_ie_fastpath)) {
if (!isset($config->ntlmsso_type)) {
$config->ntlmsso_type = 'ntlm';
}
if (!isset($config->ntlmsso_remoteuserformat)) {
$config->ntlmsso_remoteuserformat = '';
}
$yesno = array(get_string('no'), get_string('yes'));
@ -539,6 +542,18 @@ $yesno = array(get_string('no'), get_string('yes'));
<?php print_string('auth_ntlmsso_type','auth_ldap') ?>
</td>
</tr>
<tr valign="top">
<td align="right">
<label for="ntlmsso_remoteuserformat"><?php print_string('auth_ntlmsso_remoteuserformat_key', 'auth_ldap') ?></label>
</td>
<td>
<input name="ntlmsso_remoteuserformat" id="ntlmsso_remoteuserformat" type="text" size="30" value="<?php echo $config->ntlmsso_remoteuserformat?>" />
<?php if (isset($err['ntlmsso_remoteuserformat'])) { echo $OUTPUT->error_text($err['ntlmsso_remoteuserformat']); } ?>
</td>
<td>
<?php print_string('auth_ntlmsso_remoteuserformat', 'auth_ldap') ?>
</td>
</tr>
<?php
$help = get_string('auth_ldapextrafields', 'auth_ldap');
$help .= get_string('auth_updatelocal_expl', 'auth');

4
auth/ldap/lang/en/auth_ldap.php
View File

@ -101,6 +101,10 @@ $string['auth_ntlmsso_enabled'] = 'Set to yes to attempt Single Sign On with the
$string['auth_ntlmsso_enabled_key'] = 'Enable';
$string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
$string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
$string['auth_ntlmsso_maybeinvalidformat'] = 'Unable to extract the username from the REMOTE_USER header. Is the configured format right?';
$string['auth_ntlmsso_missing_username'] = 'You need to specify at least %username% in the remote username format';
$string['auth_ntlmsso_remoteuserformat_key'] = 'Remote username format';
$string['auth_ntlmsso_remoteuserformat'] = 'If you have chosen \'NTLM\' in \'Authentication type\', you can specify the remote username format here. If you leave this empty, the default DOMAIN\\username format will be used. You can use the optional <b>%domain%</b> placeholder to specify where the domain name appears, and the mandatory <b>%username%</b> placeholder to specify where the username appears. <br /><br />Some widely used formats are <tt>%domain%\\%username%</tt> (MS Windows default), <tt>%domain%/%username%</tt>, <tt>%domain%+%username%</tt> and just <tt>%username%</tt> (if there is no domain part).';
$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask. Separate multiple subnets with \',\' (comma).';
$string['auth_ntlmsso_subnet_key'] = 'Subnet';
$string['auth_ntlmsso_type_key'] = 'Authentication type';