Several tidyups:
- use moodle_strtolower() for utf-8 correctness
- use sesskey as the key instead of IP addr to support
proxied users
- clean the sesskey after success!
- pull timeout out to a constant: AUTH_NTLMTIMEOUT
From Iñaki Arenaza...
Right now, if someone logs in via NTLM magic, we don't check if that
user is inside the contexts specified in the LDAP settings. I mean,
if I want to restrict my Moodle site to those users inside a given OU
or subtree of my LDAP directory, with the current code any valid user
in my whole AD domain (and if we are using a GC as the LDAP server,
the whole forest) can log in. We should check that the user is inside
one of the configured contexts before allowing his/her to log in.
Something along the lines of the attached patch could do it.
As Iñaki points out, ntlmsso_finish() needs to do all the setup that
login/index.php would do for a user once auth succeeds. With this
patch, the session setup is complete so the logon is usable.
Use $nomoodlecookie global to avoid session troubles. Also
* Ensure we load the appropriate config.php, even if we are executing
under a strange environment (ie: with a user's credentials!)
* Test we have a spacer gif to open before we open it
These pages control the process of attempting an NTLM SSO login
safely. This is very draft and needs real-world testing and polish.
And string localisation too ;-)
* If NTLM SSO is enabled, and the user's IP addr is in the right
subnet, the loginpage_hook() of auth/ldap redirects to
ntlmsso_attempt.php
* ntlmsso_attempt.php will display a "redirect" msg with an img tag
pointing to ntlmsso_magic.php, a 3s wait, and a redirect to
ntlmsso_finish.php
* ntlmsso_magic.php should be configured to have "Integrated
Windows Authentication". If it does, it will serve a spacer gif
and call ntlmsso_magic()
* ntlmsso_finish.php calls ntlmsso_finish() to complete the SSO
and handles failures.
Flesh out the functions that get the job done. These will be triggered
by PHP files sitting under auth/ldap/ ...
ntlmsso_magic() - here is where the magic happens. Call it serving
something harmless, like a space GIF, from a URL that is blessed with
Integrated Windows Authentication. If the IWA is successful, it will
set a special session cookie in config_plugins table.
It won't complete the job because when we are under IWA magic we
cannot change (even read!) the session data, as the execution happens
under the OS privileges of the actual user acct being logged in (!!!)
ntlmsso_finish() - if it finds the session set by ntlmsso_magic() and
it hasn't expired, it will finish the job of logging in the user, by
calling authenticate_user_login() and exercising the whole auth
machinery.
user_login() - when called by authenticate_user_login() it will check
to see if there's a session setup by ntlmsso_magic() and OK the login
without really asking the AD backend to proof a password we don't have
anyway.
A work in progress -- initial loginpage_hook() and headers for the
remaining functions. One thing to consider here is that this won't
work if there's a proxy in the middle.
Does NTLM auth thingy support proxies?
Most of this code should be replaced with complete_user_login() but it
does a few odd things, so we'll play it safe for now, specially since
I don't have a Shib setup to test...
There are multiple issues with Moodle files containing empty or blank lines
(lines consisting of white spaces or tabs only) and/or white space before or
after the PHP open and close tags, notably with config.php and theme files.
changelog follows
[MNET-manual] added version.php, install.xml and upgrade.php patches
Route remote users back to their home server without going through jump.php and land.php
Display app-specific strings in the user view
Display the application icon in the Remote Host block
Hide the 'logs' tab if the application under review is not Moodle
Hide the 'logs' tab if the application under review is not Moodle
Update user record to note that picture == 1 once a picture has been
transferred.
Change 2 to uri - is this fluid?
Add application paramter to bootstrap function
Find the application
Workaround for PHP5.2.2 bug: http://bugs.php.net/bug.php?id=41293
$HTTP_RAW_POST_DATA was not being populated
Ensure we get an application for our Peer
Update the URI to use for MNET
The default 'wantsurl' should be empty
Use the appropriate 'land' url for the remote application
Add hidden form elements for 'application'
Add awareness of new Application concept
Add awareness of new Application concept
Add awareness of new Application concept
Add awareness of new Application concept
Add awareness of new Application concept
Add awareness of new Application concept
Add awareness of new Application concept
