ILIAS  release_5-1 Revision 5.0.0-5477-g43f3e3fab5f
class.ilAuthContainerApache.php
Go to the documentation of this file.
1<?php
2/* Copyright (c) 1998-2014 ILIAS open source, Extended GPL, see docs/LICENSE */
3
4require_once 'Auth/Container/MDB2.php';
5
13{
17 public static $force_creation = false;
18
22 public function __construct()
23 {
24 parent::__construct();
25 }
26
30 public static function forceCreation($value)
31 {
32 self::$force_creation = $value;
33 }
34
42 function fetchData($a_username, $password, $isChallengeResponse = false)
43 {
44 ilLoggerFactory::getLogger('auth')->debug('Starting apache auth');
45
51 global $ilDB, $ilSetting , $rbacadmin;
52
53 $settings = new ilSetting('apache_auth');
54
55 if(!$settings->get('apache_enable_auth'))
56 {
57 ilLoggerFactory::getLogger('auth')->debug('Apache auth disabled');
58 return false;
59 }
60 if(!$settings->get('apache_auth_indicator_name') || !$settings->get('apache_auth_indicator_value'))
61 {
62 ilLoggerFactory::getLogger('auth')->debug('Apache auth indicator match failed');
63 return false;
64 }
65 if(!ilUtil::isLogin($a_username))
66 {
67 ilLoggerFactory::getLogger('auth')->debug('Apache auth wrong login');
68 return false;
69 }
70
71 if($a_username == 'anonymous' && $password == 'anonymous')
72 {
73 $query = 'SELECT * FROM usr_data WHERE login = %s';
74 $qres = $ilDB->queryF($query, array('text'), array($a_username));
75 $userRow = $ilDB->fetchAssoc($qres);
76
77 if(is_array($userRow) && $userRow['usr_id'])
78 {
79 // user as a local account...
80 // fetch logindata
81 $this->activeUser = $userRow['login'];
82 foreach($userRow as $key => $value)
83 {
84 if($key == $this->options['passwordcol'] || $key == $this->options['usernamecol'])
85 {
86 continue;
87 }
88 // Use reference to the auth object if exists
89 // This is because the auth session variable can change so a static call to setAuthData does not make sense
90 $this->_auth_obj->setAuthData($key, $value);
91 }
92 ilLoggerFactory::getLogger('auth')->debug('Apache local auth successful.');
93 $this->_auth_obj->setAuth($userRow['login']);
94 return true;
95 }
96 ilLoggerFactory::getLogger('auth')->debug('Apache local auth unsuccessful.');
97 return false;
98 }
99
100 if(
101 !$_SESSION['login_invalid'] &&
102 in_array(
103 $_SERVER[$settings->get('apache_auth_indicator_name')],
104 array_filter(array_map('trim', str_getcsv($settings->get('apache_auth_indicator_value'))))
105 )
106 )
107 {
108 // we have a valid apache auth
109 $list = array(
110 $ilSetting->get('auth_mode')
111 );
112
113 // Respect the auth method sequence
114 include_once('./Services/Authentication/classes/class.ilAuthModeDetermination.php');
116 if(!$det->isManualSelection() && $det->getCountActiveAuthModes() > 1)
117 {
118 $list = array();
119 foreach(ilAuthModeDetermination::_getInstance()->getAuthModeSequence() as $auth_mode)
120 {
121 $list[] = $auth_mode;
122 }
123 }
124
125 // Apache with ldap as data source
126 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
127 if($settings->get('apache_enable_ldap'))
128 {
129 return $this->handleLDAPDataSource($this->_auth_obj,$a_username, $settings);
130 }
131
132
133 foreach($list as $auth_mode)
134 {
135 ilLoggerFactory::getLogger('auth')->debug('Current auth mode: ' . $auth_mode);
136
137 if(AUTH_LDAP == $auth_mode)
138 {
139 ilLoggerFactory::getLogger('auth')->debug('Trying ldap synchronisation');
140 // if no local user has been found AND ldap lookup is enabled
141 if($settings->get('apache_enable_ldap'))
142 {
143 include_once 'Services/LDAP/classes/class.ilLDAPServer.php';
144 $this->server = new ilLDAPServer($settings->get('apache_ldap_sid'));
145 $this->server->doConnectionCheck();
146
147 $config = $this->server->toPearAuthArray();
148
149 $query = new ilLDAPQuery($this->server);
150 $query->bind();
151 $ldapUser = $query->fetchUser($a_username);
152
153 if($ldapUser && $ldapUser[$a_username] && $ldapUser[$a_username][$config['userattr']] == $a_username)
154 {
155 $ldapUser[$a_username]['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username);
156 $user_data = $ldapUser[$a_username]; //array_change_key_case($a_auth->getAuthData(),CASE_LOWER);
157 if($this->server->enabledSyncOnLogin())
158 {
159 if(!$user_data['ilInternalAccount'] && $this->server->isAccountMigrationEnabled() && !self::$force_creation)
160 {
161 $this->_auth_obj->logout();
162 $_SESSION['tmp_auth_mode'] = 'apache';
163 $_SESSION['tmp_auth_mode_type'] = 'apache';
164 $_SESSION['tmp_external_account'] = $a_username;
165 $_SESSION['tmp_pass'] = $_POST['password'];
166
167 include_once('./Services/LDAP/classes/class.ilLDAPRoleAssignmentRules.php');
169 $this->server->getServerId(),
170 $a_username,
171 $user_data);
172 $_SESSION['tmp_roles'] = array();
173 foreach($roles as $info)
174 {
176 {
177 $_SESSION['tmp_roles'][] = $info['id'];
178 }
179 }
180
181 ilUtil::redirect('ilias.php?baseClass=ilStartUpGUI&cmdClass=ilstartupgui&cmd=showAccountMigration');
182 }
183
184 if($this->updateRequired($a_username))
185 {
187 $this->ldap_attr_to_user->setUserData($ldapUser);
188 $this->ldap_attr_to_user->refresh();
189 $user_data['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username);
190 }
191 else
192 {
193 // User exists and no update required
194 $user_data['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username);
195 }
196 }
197 if($user_data['ilInternalAccount'])
198 {
199 $this->_auth_obj->setAuth($user_data['ilInternalAccount']);
200 $this->_auth_obj->username = $user_data['ilInternalAccount'];
201 return true;
202 }
203 }
204 }
205 }
206 else if(AUTH_APACHE != $auth_mode && $settings->get('apache_enable_local'))
207 {
208 $condition = '';
209 if($ilSetting->get("auth_mode") && $ilSetting->get("auth_mode") == 'ldap')
210 {
211 $condition = " AND auth_mode != " . $ilDB->quote('default', 'text') . " ";
212 }
213 $query = "SELECT * FROM usr_data WHERE login = %s AND auth_mode != %s $condition";
214 $qres = $ilDB->queryF($query, array('text', 'text'), array($a_username, 'ldap'));
215 $userRow = $ilDB->fetchAssoc($qres);
216
217 if(is_array($userRow) && $userRow['usr_id'])
218 {
219 // user as a local account...
220 // fetch logindata
221 $this->activeUser = $userRow['login'];
222 foreach($userRow as $key => $value)
223 {
224 if($key == $this->options['passwordcol'] || $key == $this->options['usernamecol'])
225 {
226 continue;
227 }
228 // Use reference to the auth object if exists
229 // This is because the auth session variable can change so a static call to setAuthData does not make sense
230 $this->_auth_obj->setAuthData($key, $value);
231 }
232 $this->_auth_obj->setAuth($userRow['login']);
233 return true;
234 }
235 }
236 }
237
238 if($settings->get('apache_enable_local') && $settings->get('apache_local_autocreate'))
239 {
240 if($_GET['r'])
241 {
242 $_SESSION['profile_complete_redirect'] = $_GET['r'];
243 }
244
245 $user = new ilObjUser();
246 $user->setLogin($a_username);
247 $user->setExternalAccount($a_username);
248 $user->setProfileIncomplete(true);
249 $user->create();
250 $user->setAuthMode('apache');
251 // set a timestamp for last_password_change
252 // this ts is needed by ilSecuritySettings
253 $user->setLastPasswordChangeTS(time());
254 $user->setTimeLimitUnlimited(1);
255
256 $user->setActive(1);
257 //insert user data in table user_data
258 $user->saveAsNew();
259 $user->writePrefs();
260 $rbacadmin->assignUser($settings->get('apache_default_role', 4), $user->getId(), true);
261 return true;
262 }
263 }
264 else if(defined('IL_CERT_SSO') && IL_CERT_SSO)
265 {
266 define('APACHE_ERRORCODE', AUTH_APACHE_FAILED);
267 }
268
269 return false;
270 }
271
277 protected function updateRequired($a_username)
278 {
279 if(!ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username))
280 {
281 return true;
282 }
283 // Check attribute mapping on login
284 include_once './Services/LDAP/classes/class.ilLDAPAttributeMapping.php';
285 if(ilLDAPAttributeMapping::hasRulesForUpdate($this->server->getServerId()))
286 {
287 return true;
288 }
289 include_once './Services/LDAP/classes/class.ilLDAPRoleAssignmentRule.php';
291 {
292 return true;
293 }
294 return false;
295 }
296
301 private function initLDAPAttributeToUser()
302 {
303 include_once('Services/LDAP/classes/class.ilLDAPAttributeToUser.php');
304 $this->ldap_attr_to_user = new ilLDAPAttributeToUser($this->server);
305 }
306
307
313 protected function handleLDAPDataSource($a_auth,$ext_account, $settings)
314 {
315 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
317 $settings->get('apache_ldap_sid')
318 );
319
320 ilLoggerFactory::getLogger('auth')->debug('Using ldap data source with server configuration: ' . $server->getName());
321
322 include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
323 $sync = new ilLDAPUserSynchronisation('ldap_'.$server->getServerId(), $server->getServerId());
324 $sync->setExternalAccount($ext_account);
325 $sync->setUserData(array());
326 $sync->forceCreation(self::$force_creation);
327 $sync->forceReadLdapData(true);
328
329 try {
330 $internal_account = $sync->sync();
331 }
332 catch(UnexpectedValueException $e) {
333 ilLoggerFactory::getLogger('auth')->info('Login failed with message: ' . $e->getMessage());
334 $a_auth->status = AUTH_WRONG_LOGIN;
335 $a_auth->logout();
336 return false;
337 }
339 // No syncronisation allowed => create Error
340 ilLoggerFactory::getLogger('auth')->info('Login failed with message: ' . $e->getMessage());
341 $a_auth->status = AUTH_RADIUS_NO_ILIAS_USER;
342 $a_auth->logout();
343 return false;
344 }
346 ilLoggerFactory::getLogger('auth')->debug('Starting account migration');
347 $a_auth->logout();
348 ilUtil::redirect('ilias.php?baseClass=ilStartUpGUI&cmdClass=ilstartupgui&cmd=showAccountMigration');
349 }
350
351 $a_auth->setAuth($internal_account);
352 return true;
353 }
354
355}
const AUTH_WRONG_LOGIN
Returned if container is unable to authenticate user/password pair.
Definition: Auth.php:38
$_GET["client_id"]
$_SESSION["AccountId"]
fetchData($username, $password, $isChallengeResponse=false)
Fetch data from storage container.
Definition: Container.php:82
const AUTH_APACHE
const AUTH_APACHE_FAILED
const AUTH_LDAP
const AUTH_RADIUS_NO_ILIAS_USER
Authentication against ILIAS database.
initLDAPAttributeToUser()
Init LDAP attribute mapping @access private.
updateRequired($a_username)
Check if an update is required.
handleLDAPDataSource($a_auth, $ext_account, $settings)
Handle ldap as data source.
Description of ilLDAPAccountMigrationRequiredException.
static hasRulesForUpdate($a_server_id)
Check if there is ldap attribute -> user data mapping which which is updated on login.
Update/create ILIAS user account by given LDAP attributes according to user attribute mapping setting...
static hasRulesForUpdate()
Check if there any rule for updates.
static getAssignmentsForCreation($a_server_id, $a_usr_name, $a_usr_data)
static getInstanceByServerId($a_server_id)
Get instance by server id.
Synchronization of user accounts used in auth container ldap, radius , cas,...
static getLogger($a_component_id)
Get component logger.
static _checkExternalAuthAccount($a_auth, $a_account)
check whether external account and authentication method matches with a user
ILIAS Setting Class.
isLogin($a_login)
static redirect($a_script)
http redirect to other script
$_POST['username']
Definition: cron.php:12
$server
$info
Definition: example_052.php:80
global $ilSetting
Definition: privfeed.php:40
const IL_CERT_SSO
Definition: index.php:5
global $ilDB
if((!isset($_SERVER['DOCUMENT_ROOT'])) OR(empty($_SERVER['DOCUMENT_ROOT']))) $_SERVER['DOCUMENT_ROOT']