mirror of
https://github.com/moodle/moodle.git
synced 2025-03-28 11:32:42 +01:00
9cf92be84d
Since phpCAS v1.6.0, a required base service URL parameterneeds to be passed to phpCAS::client(). This is basically the protocol, hostname, and port number (optional) of the site connecting to the CAS server in order for it to perform service URL discovery.
401 lines
14 KiB
PHP
401 lines
14 KiB
PHP
<?php
|
|
// This file is part of Moodle - http://moodle.org/
|
|
//
|
|
// Moodle is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// Moodle is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
/**
|
|
* Authentication Plugin: CAS Authentication
|
|
*
|
|
* Authentication using CAS (Central Authentication Server).
|
|
*
|
|
* @author Martin Dougiamas
|
|
* @author Jerome GUTIERREZ
|
|
* @author Iñaki Arenaza
|
|
* @license http://www.gnu.org/copyleft/gpl.html GNU Public License
|
|
* @package auth_cas
|
|
*/
|
|
|
|
defined('MOODLE_INTERNAL') || die();
|
|
|
|
require_once($CFG->dirroot.'/auth/ldap/auth.php');
|
|
require_once($CFG->dirroot.'/auth/cas/CAS/vendor/autoload.php');
|
|
require_once($CFG->dirroot.'/auth/cas/CAS/vendor/apereo/phpcas/source/CAS.php');
|
|
|
|
/**
|
|
* CAS authentication plugin.
|
|
*/
|
|
class auth_plugin_cas extends auth_plugin_ldap {
|
|
|
|
/**
|
|
* Constructor.
|
|
*/
|
|
public function __construct() {
|
|
$this->authtype = 'cas';
|
|
$this->roleauth = 'auth_cas';
|
|
$this->errorlogtag = '[AUTH CAS] ';
|
|
$this->init_plugin($this->authtype);
|
|
}
|
|
|
|
/**
|
|
* Old syntax of class constructor. Deprecated in PHP7.
|
|
*
|
|
* @deprecated since Moodle 3.1
|
|
*/
|
|
public function auth_plugin_cas() {
|
|
debugging('Use of class name as constructor is deprecated', DEBUG_DEVELOPER);
|
|
self::__construct();
|
|
}
|
|
|
|
function prevent_local_passwords() {
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Authenticates user against CAS
|
|
* Returns true if the username and password work and false if they are
|
|
* wrong or don't exist.
|
|
*
|
|
* @param string $username The username (with system magic quotes)
|
|
* @param string $password The password (with system magic quotes)
|
|
* @return bool Authentication success or failure.
|
|
*/
|
|
function user_login ($username, $password) {
|
|
$this->connectCAS();
|
|
return phpCAS::isAuthenticated() && (trim(core_text::strtolower(phpCAS::getUser())) == $username);
|
|
}
|
|
|
|
/**
|
|
* Returns true if this authentication plugin is 'internal'.
|
|
*
|
|
* @return bool
|
|
*/
|
|
function is_internal() {
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Returns true if this authentication plugin can change the user's
|
|
* password.
|
|
*
|
|
* @return bool
|
|
*/
|
|
function can_change_password() {
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Authentication choice (CAS or other)
|
|
* Redirection to the CAS form or to login/index.php
|
|
* for other authentication
|
|
*/
|
|
function loginpage_hook() {
|
|
global $frm;
|
|
global $CFG;
|
|
global $SESSION, $OUTPUT, $PAGE;
|
|
|
|
$site = get_site();
|
|
$CASform = get_string('CASform', 'auth_cas');
|
|
$username = optional_param('username', '', PARAM_RAW);
|
|
$courseid = optional_param('courseid', 0, PARAM_INT);
|
|
|
|
if (!empty($username)) {
|
|
if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
|
|
strstr($SESSION->wantsurl, 'NOCAS'))) {
|
|
unset($SESSION->wantsurl);
|
|
}
|
|
return;
|
|
}
|
|
|
|
// Return if CAS enabled and settings not specified yet
|
|
if (empty($this->config->hostname)) {
|
|
return;
|
|
}
|
|
|
|
// If the multi-authentication setting is used, check for the param before connecting to CAS.
|
|
if ($this->config->multiauth) {
|
|
|
|
// If there is an authentication error, stay on the default authentication page.
|
|
if (!empty($SESSION->loginerrormsg)) {
|
|
return;
|
|
}
|
|
|
|
$authCAS = optional_param('authCAS', '', PARAM_RAW);
|
|
if ($authCAS != 'CAS') {
|
|
return;
|
|
}
|
|
|
|
}
|
|
|
|
// Connection to CAS server
|
|
$this->connectCAS();
|
|
|
|
if (phpCAS::checkAuthentication()) {
|
|
$frm = new stdClass();
|
|
$frm->username = phpCAS::getUser();
|
|
$frm->password = 'passwdCas';
|
|
$frm->logintoken = \core\session\manager::get_login_token();
|
|
|
|
// Redirect to a course if multi-auth is activated, authCAS is set to CAS and the courseid is specified.
|
|
if ($this->config->multiauth && !empty($courseid)) {
|
|
redirect(new moodle_url('/course/view.php', array('id'=>$courseid)));
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
if (isset($_GET['loginguest']) && ($_GET['loginguest'] == true)) {
|
|
$frm = new stdClass();
|
|
$frm->username = 'guest';
|
|
$frm->password = 'guest';
|
|
$frm->logintoken = \core\session\manager::get_login_token();
|
|
return;
|
|
}
|
|
|
|
// Force CAS authentication (if needed).
|
|
if (!phpCAS::isAuthenticated()) {
|
|
phpCAS::setLang($this->config->language);
|
|
phpCAS::forceAuthentication();
|
|
}
|
|
}
|
|
|
|
|
|
/**
|
|
* Connect to the CAS (clientcas connection or proxycas connection)
|
|
*
|
|
*/
|
|
function connectCAS() {
|
|
global $CFG;
|
|
static $connected = false;
|
|
|
|
if (!$connected) {
|
|
// Form the base URL of the server with just the protocol and hostname.
|
|
$serverurl = new moodle_url("/");
|
|
$servicebaseurl = $serverurl->get_scheme() ? $serverurl->get_scheme() . "://" : '';
|
|
$servicebaseurl .= $serverurl->get_host();
|
|
// Add the port if set.
|
|
$servicebaseurl .= $serverurl->get_port() ? ':' . $serverurl->get_port() : '';
|
|
|
|
// Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
|
|
if ($this->config->proxycas) {
|
|
phpCAS::proxy($this->config->casversion, $this->config->hostname, (int) $this->config->port, $this->config->baseuri,
|
|
$servicebaseurl, false);
|
|
} else {
|
|
phpCAS::client($this->config->casversion, $this->config->hostname, (int) $this->config->port,
|
|
$this->config->baseuri, $servicebaseurl, false);
|
|
}
|
|
// Some CAS installs require SSLv3 that should be explicitly set.
|
|
if (!empty($this->config->curl_ssl_version)) {
|
|
phpCAS::setExtraCurlOption(CURLOPT_SSLVERSION, $this->config->curl_ssl_version);
|
|
}
|
|
|
|
$connected = true;
|
|
}
|
|
|
|
// If Moodle is configured to use a proxy, phpCAS needs some curl options set.
|
|
if (!empty($CFG->proxyhost) && !is_proxybypass(phpCAS::getServerLoginURL())) {
|
|
phpCAS::setExtraCurlOption(CURLOPT_PROXY, $CFG->proxyhost);
|
|
if (!empty($CFG->proxyport)) {
|
|
phpCAS::setExtraCurlOption(CURLOPT_PROXYPORT, $CFG->proxyport);
|
|
}
|
|
if (!empty($CFG->proxytype)) {
|
|
// Only set CURLOPT_PROXYTYPE if it's something other than the curl-default http
|
|
if ($CFG->proxytype == 'SOCKS5') {
|
|
phpCAS::setExtraCurlOption(CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
|
|
}
|
|
}
|
|
if (!empty($CFG->proxyuser) and !empty($CFG->proxypassword)) {
|
|
phpCAS::setExtraCurlOption(CURLOPT_PROXYUSERPWD, $CFG->proxyuser.':'.$CFG->proxypassword);
|
|
if (defined('CURLOPT_PROXYAUTH')) {
|
|
// any proxy authentication if PHP 5.1
|
|
phpCAS::setExtraCurlOption(CURLOPT_PROXYAUTH, CURLAUTH_BASIC | CURLAUTH_NTLM);
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($this->config->certificate_check && $this->config->certificate_path){
|
|
phpCAS::setCasServerCACert($this->config->certificate_path);
|
|
} else {
|
|
// Don't try to validate the server SSL credentials
|
|
phpCAS::setNoCasServerValidation();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Returns the URL for changing the user's pw, or empty if the default can
|
|
* be used.
|
|
*
|
|
* @return moodle_url
|
|
*/
|
|
function change_password_url() {
|
|
return null;
|
|
}
|
|
|
|
/**
|
|
* Returns true if user should be coursecreator.
|
|
*
|
|
* @param mixed $username username (without system magic quotes)
|
|
* @return boolean result
|
|
*/
|
|
function iscreator($username) {
|
|
if (empty($this->config->host_url) or (empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
|
|
return false;
|
|
}
|
|
|
|
$extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
|
|
|
|
// Test for group creator
|
|
if (!empty($this->config->groupecreators)) {
|
|
$ldapconnection = $this->ldap_connect();
|
|
if ($this->config->memberattribute_isdn) {
|
|
if(!($userid = $this->ldap_find_userdn($ldapconnection, $extusername))) {
|
|
return false;
|
|
}
|
|
} else {
|
|
$userid = $extusername;
|
|
}
|
|
|
|
$group_dns = explode(';', $this->config->groupecreators);
|
|
if (ldap_isgroupmember($ldapconnection, $userid, $group_dns, $this->config->memberattribute)) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
// Build filter for attrcreator
|
|
if (!empty($this->config->attrcreators)) {
|
|
$attrs = explode(';', $this->config->attrcreators);
|
|
$filter = '(& ('.$this->config->user_attribute."=$username)(|";
|
|
foreach ($attrs as $attr){
|
|
if(strpos($attr, '=')) {
|
|
$filter .= "($attr)";
|
|
} else {
|
|
$filter .= '('.$this->config->memberattribute."=$attr)";
|
|
}
|
|
}
|
|
$filter .= '))';
|
|
|
|
// Search
|
|
$result = $this->ldap_get_userlist($filter);
|
|
if (count($result) != 0) {
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Reads user information from LDAP and returns it as array()
|
|
*
|
|
* If no LDAP servers are configured, user information has to be
|
|
* provided via other methods (CSV file, manually, etc.). Return
|
|
* an empty array so existing user info is not lost. Otherwise,
|
|
* calls parent class method to get user info.
|
|
*
|
|
* @param string $username username
|
|
* @return mixed array with no magic quotes or false on error
|
|
*/
|
|
function get_userinfo($username) {
|
|
if (empty($this->config->host_url)) {
|
|
return array();
|
|
}
|
|
return parent::get_userinfo($username);
|
|
}
|
|
|
|
/**
|
|
* Syncronizes users from LDAP server to moodle user table.
|
|
*
|
|
* If no LDAP servers are configured, simply return. Otherwise,
|
|
* call parent class method to do the work.
|
|
*
|
|
* @param bool $do_updates will do pull in data updates from LDAP if relevant
|
|
* @return nothing
|
|
*/
|
|
function sync_users($do_updates=true) {
|
|
if (empty($this->config->host_url)) {
|
|
error_log('[AUTH CAS] '.get_string('noldapserver', 'auth_cas'));
|
|
return;
|
|
}
|
|
parent::sync_users($do_updates);
|
|
}
|
|
|
|
/**
|
|
* Hook for logout page
|
|
*/
|
|
function logoutpage_hook() {
|
|
global $USER, $redirect;
|
|
|
|
// Only do this if the user is actually logged in via CAS
|
|
if ($USER->auth === $this->authtype) {
|
|
// Check if there is an alternative logout return url defined
|
|
if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
|
|
// Set redirect to alternative return url
|
|
$redirect = $this->config->logout_return_url;
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Post logout hook.
|
|
*
|
|
* Note: this method replace the prelogout_hook method to avoid redirect to CAS logout
|
|
* before the event userlogout being triggered.
|
|
*
|
|
* @param stdClass $user clone of USER object object before the user session was terminated
|
|
*/
|
|
public function postlogout_hook($user) {
|
|
global $CFG;
|
|
// Only redirect to CAS logout if the user is logged as a CAS user.
|
|
if (!empty($this->config->logoutcas) && $user->auth == $this->authtype) {
|
|
$backurl = !empty($this->config->logout_return_url) ? $this->config->logout_return_url : $CFG->wwwroot;
|
|
$this->connectCAS();
|
|
phpCAS::logoutWithRedirectService($backurl);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Return a list of identity providers to display on the login page.
|
|
*
|
|
* @param string|moodle_url $wantsurl The requested URL.
|
|
* @return array List of arrays with keys url, iconurl and name.
|
|
*/
|
|
public function loginpage_idp_list($wantsurl) {
|
|
if (empty($this->config->hostname)) {
|
|
// CAS is not configured.
|
|
return [];
|
|
}
|
|
|
|
if ($this->config->auth_logo) {
|
|
$iconurl = moodle_url::make_pluginfile_url(
|
|
context_system::instance()->id,
|
|
'auth_cas',
|
|
'logo',
|
|
null,
|
|
null,
|
|
$this->config->auth_logo);
|
|
} else {
|
|
$iconurl = null;
|
|
}
|
|
|
|
return [
|
|
[
|
|
'url' => new moodle_url(get_login_url(), [
|
|
'authCAS' => 'CAS',
|
|
]),
|
|
'iconurl' => $iconurl,
|
|
'name' => format_string($this->config->auth_name),
|
|
],
|
|
];
|
|
}
|
|
}
|