ilAuthProviderApache Class Reference

Apache auth provider. More...

Inheritance diagram for ilAuthProviderApache:

Collaboration diagram for ilAuthProviderApache:

Public Member Functions
	__construct (ilAuthCredentials $credentials)
	doAuthentication (ilAuthStatus $status)
	migrateAccount (ilAuthStatus $status)
	Create new account. More...
	createNewAccount (ilAuthStatus $status)
	Create new ILIAS account for external_account. More...
	getExternalAccountName ()
	Get external account name. More...
	setExternalAccountName (string $name)
	getTriggerAuthMode ()
	Get auth mode which triggered the account migration 2_1 for ldap account migration with server id 1 11 for apache auth. More...
	getUserAuthModeName ()
	Get user auth mode name ldap_1 for ldap account migration with server id 1 apache for apache auth. More...
Public Member Functions inherited from ilAuthProvider
	__construct (ilAuthCredentials $credentials)
	Constructor. More...
	getLogger ()
	Get logger. More...
	getCredentials ()
Public Member Functions inherited from ilAuthProviderInterface
	doAuthentication (\ilAuthStatus $status)
	Do authentication. More...

Data Fields
const	APACHE_AUTH_TYPE_DIRECT_MAPPING = 1
const	APACHE_AUTH_TYPE_EXTENDED_MAPPING = 2
const	APACHE_AUTH_TYPE_BY_FUNCTION = 3

Private Member Functions
	handleLDAPDataSource (ilAuthStatus $status)

Private Attributes
const	ENV_APACHE_AUTH_INDICATOR_NAME = 'apache_auth_indicator_name'
const	ERR_WRONG_LOGIN = 'err_wrong_login'
const	APACHE_ENABLE_LDAP = 'apache_enable_ldap'
const	APACHE_LDAP_SID = 'apache_ldap_sid'
readonly ilSetting	$settings
string	$migration_account = ''
bool	$force_new_account = false

Additional Inherited Members
Protected Member Functions inherited from ilAuthProvider
	handleAuthenticationFail (ilAuthStatus $status, string $a_reason)
	Handle failed authentication. More...

Detailed Description

Apache auth provider.

Author

Stefan Meyer smeye.nosp@m.r.il.nosp@m.ias@g.nosp@m.mx.d.nosp@m.e

Michael Jansen mjans.nosp@m.en@d.nosp@m.ataba.nosp@m.y.de

Definition at line 26 of file class.ilAuthProviderApache.php.

Constructor & Destructor Documentation

__construct()

ilAuthProviderApache::__construct

(

ilAuthCredentials

$credentials

)

Definition at line 43 of file class.ilAuthProviderApache.php.

References ILIAS\GlobalScreen\Provider\__construct(), and ILIAS\Repository\settings().

    {
        parent::__construct($credentials);
        $this->settings = new ilSetting('apache_auth');
    }

Here is the call graph for this function:

Member Function Documentation

createNewAccount()

ilAuthProviderApache::createNewAccount

(

ilAuthStatus

$status

)

Create new ILIAS account for external_account.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 118 of file class.ilAuthProviderApache.php.

References handleLDAPDataSource(), and ILIAS\Repository\settings().

                                                          : void
    {
        $this->force_new_account = true;
        if ($this->settings->get(self::APACHE_ENABLE_LDAP, '0')) {
            $this->handleLDAPDataSource($status);
        }
    }

Here is the call graph for this function:

doAuthentication()

ilAuthProviderApache::doAuthentication

(

ilAuthStatus

$status

)

Definition at line 49 of file class.ilAuthProviderApache.php.

References $_SERVER, ilObjUser\_checkExternalAuthAccount(), ilObjUser\_lookupId(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), ilAuthProvider\handleAuthenticationFail(), handleLDAPDataSource(), ilUtil\isLogin(), ilAuthStatus\setAuthenticatedUserId(), ilAuthStatus\setStatus(), ILIAS\Repository\settings(), and ilAuthStatus\STATUS_AUTHENTICATED.

                                                          : bool
    {
        if (!$this->settings->get('apache_enable_auth', '0')) {
            $this->getLogger()->info('Apache auth disabled.');
            $this->handleAuthenticationFail($status, 'apache_auth_err_disabled');
            return false;
        }

        if (
            !$this->settings->get(self::ENV_APACHE_AUTH_INDICATOR_NAME, '') ||
            !$this->settings->get('apache_auth_indicator_value', '')
        ) {
            $this->getLogger()->warning('Apache auth indicator match failure.');
            $this->handleAuthenticationFail($status, 'apache_auth_err_indicator_match_failure');
            return false;
        }

        $validIndicatorValues = array_filter(array_map(
            'trim',
            str_getcsv($this->settings->get('apache_auth_indicator_value', ''))
        ));
        //TODO PHP8-REVIEW: $DIC->http()->request()->getServerParams()['apache_auth_indicator_name']
        if (
            !isset($_SERVER[$this->settings->get(self::ENV_APACHE_AUTH_INDICATOR_NAME, '')]) ||
            !in_array($_SERVER[$this->settings->get(self::ENV_APACHE_AUTH_INDICATOR_NAME, '')], $validIndicatorValues, true)
        ) {
            $this->getLogger()->warning('Apache authentication failed (indicator name <-> value');
            $this->handleAuthenticationFail($status, self::ERR_WRONG_LOGIN);
            return false;
        }

        if (!ilUtil::isLogin($this->getCredentials()->getUsername())) {
            $this->getLogger()->warning('Invalid login name given: ' . $this->getCredentials()->getUsername());
            $this->handleAuthenticationFail($status, 'apache_auth_err_invalid_login');
            return false;
        }

        if ($this->getCredentials()->getUsername() === '') {
            $this->getLogger()->info('No username given');
            $this->handleAuthenticationFail($status, self::ERR_WRONG_LOGIN);
            return false;
        }

        // Apache with ldap as data source
        if ($this->settings->get(self::APACHE_ENABLE_LDAP, '0')) {
            return $this->handleLDAPDataSource($status);
        }

        $login = ilObjUser::_checkExternalAuthAccount('apache', $this->getCredentials()->getUsername());
        $usr_id = ilObjUser::_lookupId($login);
        if (!$usr_id) {
            $this->getLogger()->info('Cannot find user id for external account: ' . $this->getCredentials()->getUsername());
            $this->handleAuthenticationFail($status, self::ERR_WRONG_LOGIN);
            return false;
        }

        $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
        $status->setAuthenticatedUserId($usr_id);
        return true;
    }

Here is the call graph for this function:

getExternalAccountName()

ilAuthProviderApache::getExternalAccountName

(

)

Get external account name.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 126 of file class.ilAuthProviderApache.php.

References $migration_account.

                                            : string
    {
        return $this->migration_account;
    }

getTriggerAuthMode()

ilAuthProviderApache::getTriggerAuthMode

(

)

Get auth mode which triggered the account migration 2_1 for ldap account migration with server id 1 11 for apache auth.

See also

ilAuthUtils

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 136 of file class.ilAuthProviderApache.php.

References ilAuthUtils\AUTH_APACHE.

                                        : string
    {
        return (string) ilAuthUtils::AUTH_APACHE;
    }

getUserAuthModeName()

ilAuthProviderApache::getUserAuthModeName

(

)

Get user auth mode name ldap_1 for ldap account migration with server id 1 apache for apache auth.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 141 of file class.ilAuthProviderApache.php.

References ILIAS\Repository\settings().

                                         : string
    {
        if ($this->settings->get(self::APACHE_LDAP_SID, '0')) {
            return 'ldap_' . $this->settings->get(self::APACHE_LDAP_SID, '');
        }

        return 'apache';
    }

Here is the call graph for this function:

handleLDAPDataSource()

ilAuthProviderApache::handleLDAPDataSource ( ilAuthStatus  $status )

private

Definition at line 150 of file class.ilAuthProviderApache.php.

References Vendor\Package\$e, $server, ilObjUser\_lookupId(), ilAuthProvider\getCredentials(), ilLDAPServer\getInstanceByServerId(), ilAuthProvider\getLogger(), ilAuthProvider\handleAuthenticationFail(), ilAuthStatus\setAuthenticatedUserId(), ilLDAPUserSynchronisation\setExternalAccount(), setExternalAccountName(), ilAuthStatus\setStatus(), ILIAS\Repository\settings(), ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED, and ilAuthStatus\STATUS_AUTHENTICATED.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

                                                               : bool
    {
        $server = ilLDAPServer::getInstanceByServerId(
            (int) $this->settings->get(self::APACHE_LDAP_SID, '0')
        );

        $this->getLogger()->debug('Using ldap data source with server configuration: ' . $server->getName());

        $sync = new ilLDAPUserSynchronisation('ldap_' . $server->getServerId(), $server->getServerId());
        $sync->setExternalAccount($this->getCredentials()->getUsername());
        $sync->setUserData([]);
        $sync->forceCreation($this->force_new_account);
        $sync->forceReadLdapData(true);

        try {
            $internal_account = $sync->sync();
            $this->getLogger()->debug('Internal account: ' . $internal_account);
        } catch (UnexpectedValueException $e) {
            $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
            $this->handleAuthenticationFail($status, self::ERR_WRONG_LOGIN);
            return false;
        } catch (ilLDAPSynchronisationFailedException) {
            $this->handleAuthenticationFail($status, 'err_auth_ldap_failed');
            return false;
        } catch (ilLDAPSynchronisationForbiddenException $e) {
            $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'err_auth_ldap_no_ilias_user');
            return false;
        } catch (ilLDAPAccountMigrationRequiredException) {
            $this->setExternalAccountName($this->getCredentials()->getUsername());
            $this->getLogger()->info('Authentication failed: account migration required for external account: ' . $this->getCredentials()->getUsername());
            $status->setStatus(ilAuthStatus::STATUS_ACCOUNT_MIGRATION_REQUIRED);
            return false;
        }

        $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
        $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

migrateAccount()

ilAuthProviderApache::migrateAccount

(

ilAuthStatus

$status

)

Create new account.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 110 of file class.ilAuthProviderApache.php.

References handleLDAPDataSource(), and ILIAS\Repository\settings().

                                                        : void
    {
        $this->force_new_account = true;
        if ($this->settings->get(self::APACHE_ENABLE_LDAP, '0')) {
            $this->handleLDAPDataSource($status);
        }
    }

Here is the call graph for this function:

setExternalAccountName()

ilAuthProviderApache::setExternalAccountName

(

string

$name

)

Definition at line 131 of file class.ilAuthProviderApache.php.

Referenced by handleLDAPDataSource().

                                                        : void
    {
        $this->migration_account = $name;
    }

Here is the caller graph for this function:

Field Documentation

$force_new_account

bool ilAuthProviderApache::$force_new_account = false

private

Definition at line 41 of file class.ilAuthProviderApache.php.

$migration_account

string ilAuthProviderApache::$migration_account = ''

private

Definition at line 40 of file class.ilAuthProviderApache.php.

Referenced by getExternalAccountName().

$settings

readonly ilSetting ilAuthProviderApache::$settings

private

Definition at line 39 of file class.ilAuthProviderApache.php.

APACHE_AUTH_TYPE_BY_FUNCTION

const ilAuthProviderApache::APACHE_AUTH_TYPE_BY_FUNCTION = 3

Definition at line 30 of file class.ilAuthProviderApache.php.

Referenced by ilAuthFrontendCredentialsApache\initFromRequest().

APACHE_AUTH_TYPE_DIRECT_MAPPING

const ilAuthProviderApache::APACHE_AUTH_TYPE_DIRECT_MAPPING = 1

Definition at line 28 of file class.ilAuthProviderApache.php.

Referenced by ilAuthFrontendCredentialsApache\initFromRequest().

APACHE_AUTH_TYPE_EXTENDED_MAPPING

const ilAuthProviderApache::APACHE_AUTH_TYPE_EXTENDED_MAPPING = 2

Definition at line 29 of file class.ilAuthProviderApache.php.

APACHE_ENABLE_LDAP

const ilAuthProviderApache::APACHE_ENABLE_LDAP = 'apache_enable_ldap'

private

Definition at line 36 of file class.ilAuthProviderApache.php.

APACHE_LDAP_SID

const ilAuthProviderApache::APACHE_LDAP_SID = 'apache_ldap_sid'

private

Definition at line 37 of file class.ilAuthProviderApache.php.

ENV_APACHE_AUTH_INDICATOR_NAME

const ilAuthProviderApache::ENV_APACHE_AUTH_INDICATOR_NAME = 'apache_auth_indicator_name'

private

Definition at line 32 of file class.ilAuthProviderApache.php.

ERR_WRONG_LOGIN

const ilAuthProviderApache::ERR_WRONG_LOGIN = 'err_wrong_login'

private

Definition at line 34 of file class.ilAuthProviderApache.php.

---

The documentation for this class was generated from the following file:

• components/ILIAS/AuthApache/classes/class.ilAuthProviderApache.php