static utility functions used to manage authentication modes More...

Collaboration diagram for ilAuthUtils:

Public Member Functions
	_initAuth ()
	initialises $ilAuth More...

	_getAuthModeOfUser ($a_username, $a_password, $a_db_handler='')

	_getAuthMode ($a_auth_mode, $a_db_handler='')

	_getActiveAuthModes ()

	_getAllAuthModes ()

	_generateLogin ($a_login)
	generate free login by starting with a default string and adding postfix numbers More...

Static Public Member Functions
static	_getAuthModeName ($a_auth_key)

static	_hasMultipleAuthenticationMethods ()

static	_getMultipleAuthModeOptions ($lng)

static	_isExternalAccountEnabled ()
	Check if an external account name is required. More...

static	_allowPasswordModificationByAuthMode ($a_auth_mode)
	Allow password modification. More...

static	_needsExternalAccountByAuthMode ($a_auth_mode)
	Check if chosen auth mode needs an external account entry. More...

static	isPasswordModificationEnabled ($a_authmode)
	Check if password modification is enabled. More...

static	supportsLocalPasswordValidation ($a_authmode)
	Check if local password validation is supported. More...

static	getAuthPlugins ()
	Get active enabled auth plugins. More...

static	getAuthModeTranslation ($a_auth_key)

Data Fields
const	LOCAL_PWV_FULL = 1

const	LOCAL_PWV_NO = 2

const	LOCAL_PWV_USER = 3

Detailed Description

static utility functions used to manage authentication modes

Author: Sascha Hofmann sasch.nosp@m.ahof.nosp@m.mann@.nosp@m.gmx..nosp@m.de

Version: $Id$

Definition at line 64 of file class.ilAuthUtils.php.

Member Function Documentation

◆ _allowPasswordModificationByAuthMode()

static ilAuthUtils::_allowPasswordModificationByAuthMode ( $a_auth_mode )

static

Allow password modification.

public

Parameters

int auth_mode

Definition at line 768 of file class.ilAuthUtils.php.

References AUTH_ECS, AUTH_LDAP, AUTH_OPENID, and AUTH_RADIUS.

Referenced by ilPasswordInputGUI\checkInput(), ilObjUserGUI\updateObject(), and ilObjUserGUI\updateObjectOld().

         {
                 // begin-patch ldap_multiple
                 // cast to int
                 switch((int) $a_auth_mode)
                 {
                         case AUTH_LDAP:
                         case AUTH_RADIUS:
                         case AUTH_ECS:
                         case AUTH_OPENID:
                                 return false;
                         default:
                                 return true;
                 }
         }

Here is the caller graph for this function:

◆ _generateLogin()

ilAuthUtils::_generateLogin ( $a_login )

generate free login by starting with a default string and adding postfix numbers

Definition at line 567 of file class.ilAuthUtils.php.

References $ilDB, and $r.

Referenced by ilOpenIdAttributeToUser\create(), ilRadiusAttributeToUser\create(), ilAuthContainerECS\createUser(), ilCASAuth\login(), ilAuthContainerCAS\loginObserver(), ilAuthContainerSOAP\loginObserver(), and ilLDAPAttributeToUser\usersToXML().

         {
                 global $ilDB;
                 
                 // Check if username already exists
                 $found = false;
                 $postfix = 0;
                 $c_login = $a_login;
                 while(!$found)
                 {
                         $r = $ilDB->query("SELECT login FROM usr_data WHERE login = ".
                                 $ilDB->quote($c_login));
                         if ($r->numRows() > 0)
                         {
                                 $postfix++;
                                 $c_login = $a_login.$postfix;
                         }
                         else
                         {
                                 $found = true;
                         }
                 }
                 
                 return $c_login;
         }

Here is the caller graph for this function:

◆ _getActiveAuthModes()

ilAuthUtils::_getActiveAuthModes ( )

Definition at line 483 of file class.ilAuthUtils.php.

References $ilSetting, ilLDAPServer\_getActiveServerList(), AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_LDAP, AUTH_LOCAL, AUTH_OPENID, AUTH_RADIUS, AUTH_SCRIPT, AUTH_SHIBBOLETH, AUTH_SOAP, ilOpenIdSettings\getInstance(), and ilECSServerSettings\getInstance().

Referenced by ilSoapInstallationInfoXMLWriter\__buildClient(), ilObjAuthSettingsGUI\authSettingsObject(), ilSoapAdministration\getNIC(), and ilObjUserGUI\initForm().

         {
                 global $ilias,$ilSetting;
                 
                 $modes = array(
                                                 'default'       => $ilSetting->get("auth_mode"),
                                                 'local'         => AUTH_LOCAL
                                                 );
                 include_once('Services/LDAP/classes/class.ilLDAPServer.php');
                 // begin-patch ldap_multiple
                 foreach(ilLDAPServer::_getActiveServerList() as $sid)
                 {
                         $modes['ldap_'.$sid] = (AUTH_LDAP.'_'.$sid);
                 }
                 // end-patch ldap_multiple
                 if ($ilSetting->get("radius_active")) $modes['radius'] = AUTH_RADIUS;
                 if ($ilSetting->get("shib_active")) $modes['shibboleth'] = AUTH_SHIBBOLETH;
                 if ($ilSetting->get("script_active")) $modes['script'] = AUTH_SCRIPT;
                 if ($ilSetting->get("cas_active")) $modes['cas'] = AUTH_CAS;
                 if ($ilSetting->get("soap_auth_active")) $modes['soap'] = AUTH_SOAP;
                 if ($ilSetting->get("apache_active")) $modes['apache'] = AUTH_APACHE;
                 
                 include_once './Services/WebServices/ECS/classes/class.ilECSServerSettings.php';
                 if(ilECSServerSettings::getInstance()->activeServerExists())
                 {
                         $modes['ecs'] = AUTH_ECS;
                 }
 
                 include_once './Services/OpenId/classes/class.ilOpenIdSettings.php';
                 if(ilOpenIdSettings::getInstance()->isActive())
                 {
                         $modes['openid'] = AUTH_OPENID;
                 }
                 
                 // begin-path auth_plugin
                 foreach(self::getAuthPlugins() as $pl)
                 {
                         foreach($pl->getAuthIds() as $auth_id)
                         {
                                 if($pl->isAuthActive($auth_id))
                                 {
                                         $modes[$pl->getAuthName($auth_id)] = $auth_id;
                                 }
                         }
                 }
                 // end-path auth_plugin
                 return $modes;
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _getAllAuthModes()

ilAuthUtils::_getAllAuthModes ( )

Definition at line 532 of file class.ilAuthUtils.php.

References $ret, _getAuthModeName(), ilLDAPServer\_getServerList(), AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_LDAP, AUTH_LOCAL, AUTH_OPENID, AUTH_RADIUS, AUTH_SHIBBOLETH, and AUTH_SOAP.

Referenced by ilObjAuthSettingsGUI\authSettingsObject().

         {
                 $modes = array(
                         AUTH_LOCAL,
                         AUTH_LDAP,
                         AUTH_SHIBBOLETH,
                         AUTH_CAS,
                         AUTH_SOAP,
                         AUTH_RADIUS,
                         AUTH_ECS,
                         AUTH_OPENID,
                         AUTH_APACHE
                 );
                 $ret = array();
                 foreach($modes as $mode)
                 {
                         // multi ldap implementation
                         if($mode == AUTH_LDAP)
                         {
                                 foreach(ilLDAPServer::_getServerList() as $ldap_id)
                                 {
                                         $id = AUTH_LDAP . '_' . $ldap_id;
                                         $ret[$id] = ilAuthUtils::_getAuthModeName($id);
                                 }
                                 continue;
                         }
                         $ret[$mode] =  ilAuthUtils::_getAuthModeName($mode);
                 }
                 return $ret;
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _getAuthMode()

ilAuthUtils::_getAuthMode	(	$a_auth_mode,
		$a_db_handler = `''`
	)

Definition at line 363 of file class.ilAuthUtils.php.

References $ilDB, $ilSetting, AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_LOCAL, AUTH_OPENID, AUTH_RADIUS, AUTH_SCRIPT, AUTH_SHIBBOLETH, AUTH_SOAP, and ilLDAPServer\getKeyByAuthMode().

Referenced by ilSoapUserAdministration\__validateUserData(), ilPasswordInputGUI\checkInput(), ilAuthContainerMDB2\fetchData(), ilObjUser\getAuthMode(), ilObjUserGUI\updateObject(), and ilObjUserGUI\updateObjectOld().

         {
                 global $ilDB, $ilSetting;
 
                 $db =& $ilDB;
                 
                 if ($a_db_handler != '')
                 {
                         $db =& $a_db_handler;
                 }
 
                 // begin-patch ldap_multiple
                 if(strpos($a_auth_mode, '_') !== FALSE)
                 {
                         $auth_arr = explode('_',$a_auth_mode);
                         $auth_switch = $auth_arr[0];
                 }
                 else
                 {
                         $auth_switch = $a_auth_mode;
                 }
                 switch ($auth_switch)
                 {
                         case "local":
                                 return AUTH_LOCAL;
                                 break;
                                 
                         case "ldap":
                                 // begin-patch ldap_multiple
                                 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                                 return ilLDAPServer::getKeyByAuthMode($a_auth_mode);
                                 // end-patch ldap_multiple
                                 
                         case "radius":
                                 return AUTH_RADIUS;
                                 break;
                                 
                         case "script":
                                 return AUTH_SCRIPT;
                                 break;
                                 
                         case "shibboleth":
                                 return AUTH_SHIBBOLETH;
                                 break;
 
                         case "cas":
                                 return AUTH_CAS;
                                 break;
 
                         case "soap":
                                 return AUTH_SOAP;
                                 break;
                                 
                         case 'ecs':
                                 return AUTH_ECS;
                                 
                         case 'openid':
                                 return AUTH_OPENID;
 
                         case 'apache':
                                 return AUTH_APACHE;
 
                         default:
                                 return $ilSetting->get("auth_mode");
                                 break;  
                 }
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _getAuthModeName()

static ilAuthUtils::_getAuthModeName ( $a_auth_key )

static

Definition at line 431 of file class.ilAuthUtils.php.

References AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_LDAP, AUTH_LOCAL, AUTH_OPENID, AUTH_RADIUS, AUTH_SCRIPT, AUTH_SHIBBOLETH, AUTH_SOAP, and ilLDAPServer\getAuthModeByKey().

Referenced by ilSoapInstallationInfoXMLWriter\__buildClient(), ilObjUser\_checkExternalAuthAccount(), _getAllAuthModes(), ilObjUser\_getExternalAccountsByAuthMode(), ilObjAuthSettingsGUI\authSettingsObject(), ilLDAPServer\getAuthenticationMappingKey(), ilSoapAdministration\getNIC(), ilUserImportParser\importEndTag(), ilObjUserGUI\initForm(), and ilUserImportParser\verifyEndTag().

         {
                 global $ilias;
 
                 // begin-patch ldap_multiple
                 switch ((int) $a_auth_key)
                 {
                         case AUTH_LOCAL:
                                 return "local";
                                 break;
                                 
                         case AUTH_LDAP:
                                 // begin-patch ldap_multiple
                                 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                                 return ilLDAPServer::getAuthModeByKey($a_auth_key);
                                 // end-patch ldap_multiple
                                 
                         case AUTH_RADIUS:
                                 return "radius";
                                 break;
 
                         case AUTH_CAS:
                                 return "cas";
                                 break;
 
                         case AUTH_SCRIPT:
                                 return "script";
                                 break;
                                 
                         case AUTH_SHIBBOLETH:
                                 return "shibboleth";
                                 break;
 
                         case AUTH_SOAP:
                                 return "soap";
                                 break;
                                 
                         case AUTH_ECS:
                                 return 'ecs';
 
                         case AUTH_APACHE:
                                 return 'apache';
 
                         case AUTH_OPENID:
                                 return 'open_id';
                                 
                         default:
                                 return "default";
                                 break;  
                 }
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _getAuthModeOfUser()

ilAuthUtils::_getAuthModeOfUser	(	$a_username,
		$a_password,
		$a_db_handler = `''`
	)

Definition at line 308 of file class.ilAuthUtils.php.

References $_GET, $_POST, $ilDB, $r, $row, ilAuthModeDetermination\_getInstance(), AUTH_ECS, AUTH_INACTIVE, AUTH_MULTIPLE, AUTH_OPENID, ilAuthFactory\CONTEXT_ECS, ilAuthFactory\CONTEXT_OPENID, DB_FETCHMODE_OBJECT, ilLoggerFactory\getLogger(), and ilAuthFactory\setContext().

Referenced by _initAuth().

         {
                 global $ilDB;
                 
                 if(isset($_GET['ecs_hash']) or isset($_GET['ecs_hash_url']))
                 {
                         ilAuthFactory::setContext(ilAuthFactory::CONTEXT_ECS);
                         return AUTH_ECS;
                 }
                 if(isset($_POST['auth_mode']))
                 {
                         // begin-patch ldap_multiple
                         return $_POST['auth_mode'];
                         // end-patch ldap_multiple
                 }
                 if(isset($_POST['oid_username']) or $_GET['oid_check_status'])
                 {
                         ilAuthFactory::setContext(ilAuthFactory::CONTEXT_OPENID);
                         return AUTH_OPENID;
                 }
 
                 include_once('./Services/Authentication/classes/class.ilAuthModeDetermination.php');
                 $det = ilAuthModeDetermination::_getInstance();
                 
                 if(!$det->isManualSelection() and $det->getCountActiveAuthModes() > 1)
                 {
                         ilLoggerFactory::getLogger('auth')->debug('Using AUTH_MULTIPLE');
                         return AUTH_MULTIPLE;
                 }
 
 
                 $db =& $ilDB;
                 
                 if ($a_db_handler != '')
                 {
                         $db =& $a_db_handler;
                 }
                 
                 // Is it really necessary to check the auth mode with password ?
                 // Changed: smeyer
                 $q = "SELECT auth_mode FROM usr_data WHERE ".
                          "login = ".$ilDB->quote($a_username);
                          //"passwd = ".$ilDB->quote(md5($a_password))."";
                                                          
                          
                 $r = $db->query($q);
                 $row = $r->fetchRow(DB_FETCHMODE_OBJECT);
 //echo "+".$row->auth_mode."+";
 
                 
                 $auth_mode =  self::_getAuthMode($row->auth_mode,$db);
                 
                 return in_array($auth_mode,self::_getActiveAuthModes()) ? $auth_mode : AUTH_INACTIVE;
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _getMultipleAuthModeOptions()

static ilAuthUtils::_getMultipleAuthModeOptions ( $lng )

static

Definition at line 630 of file class.ilAuthUtils.php.

References $_REQUEST, $ilSetting, $lng, $options, $server, ilLDAPServer\_getActiveServerList(), ilRadiusSettings\_getInstance(), AUTH_APACHE, AUTH_LDAP, AUTH_LOCAL, AUTH_RADIUS, getAuthPlugins(), and ilLDAPServer\getInstanceByServerId().

Referenced by ilStartUpGUI\showLoginForm().

         {
                 global $ilSetting;
                 
                 // in the moment only ldap is activated as additional authentication method
                 include_once('Services/LDAP/classes/class.ilLDAPServer.php');
                 
                 $options[AUTH_LOCAL]['txt'] = $lng->txt('authenticate_ilias');
 
                 
                 // begin-patch ldap_multiple
                 foreach(ilLDAPServer::_getActiveServerList() as $sid)
                 {
                         $server = ilLDAPServer::getInstanceByServerId($sid);
                         $options[AUTH_LDAP.'_'.$sid]['txt'] = $server->getName();
                 }
                 // end-patch ldap_multiple
                 
                 include_once('Services/Radius/classes/class.ilRadiusSettings.php');
                 $rad_settings = ilRadiusSettings::_getInstance();
                 if($rad_settings->isActive())
                 {
                         $options[AUTH_RADIUS]['txt'] = $rad_settings->getName();
                 }
 
                 if ($ilSetting->get('apache_active'))
                 {
                         global $lng;
                         $apache_settings = new ilSetting('apache_auth');
                         $options[AUTH_APACHE]['txt'] = $apache_settings->get('name', $lng->txt('apache_auth'));
                         $options[AUTH_APACHE]['hide_in_ui'] = true;
                 }
 
                 if($ilSetting->get('auth_mode',AUTH_LOCAL) == AUTH_LDAP)
                 {
                         $default = AUTH_LDAP;
                 }
                 elseif($ilSetting->get('auth_mode',AUTH_LOCAL) == AUTH_RADIUS)
                 {
                         $default = AUTH_RADIUS;
                 }
                 else
                 {
                         $default = AUTH_LOCAL;
                 }
                 
                 $default = $ilSetting->get('default_auth_mode',$default);
                 $default = (int) $_REQUEST['auth_mode'] ? (int) $_REQUEST['auth_mode'] : $default;
                 
                 
                 // begin-patch auth_plugin
                 $pls = ilAuthUtils::getAuthPlugins();
                 foreach($pls as $pl)
                 {
                         $auths = $pl->getAuthIds();
                         foreach($auths as $auth_id)
                         {
                                 $pl_auth_option = $pl->getMultipleAuthModeOptions($auth_id);
                                 if($pl_auth_option)
                                 {
                                         $options = $options + $pl_auth_option;
                                 }
                         }
                 }
                 // end-patch auth_plugins
 
                 if(array_key_exists($default, $options))
                 {
                         $options[$default]['checked'] = true;
                 }
 
                 return $options ? $options : array();
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _hasMultipleAuthenticationMethods()

static ilAuthUtils::_hasMultipleAuthenticationMethods ( )

static

Definition at line 593 of file class.ilAuthUtils.php.

References $ilSetting, ilLDAPServer\_getActiveServerList(), ilRadiusSettings\_getInstance(), and getAuthPlugins().

Referenced by ilStartUpGUI\showLoginForm().

         {
                 include_once('Services/Radius/classes/class.ilRadiusSettings.php');
                 
                 $rad_settings = ilRadiusSettings::_getInstance();
                 if($rad_settings->isActive())
                 {
                         return true;
                 }
                 include_once('Services/LDAP/classes/class.ilLDAPServer.php');
 
                 if (count(ilLDAPServer::_getActiveServerList()))
                         return true;
 
                 global $ilSetting;
 
                 if ($ilSetting->get('apache_active')) {
                         return true;
                 }
                 
                 // begin-patch auth_plugin
                 foreach(ilAuthUtils::getAuthPlugins() as $pl)
                 {
                         foreach($pl->getAuthIds() as $auth_id)
                         {
                                 if($pl->getMultipleAuthModeOptions($auth_id))
                                 {
                                         return true;
                                 }
                         }
                 }
                 // end-patch auth_plugin
                 
                 
                 return false;
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _initAuth()

ilAuthUtils::_initAuth ( )

initialises $ilAuth

Definition at line 74 of file class.ilAuthUtils.php.

References $_GET, $_POST, $_SERVER, $_SESSION, $GLOBALS, $ilBench, $ilDB, $ilLog, $ilSetting, _getAuthModeOfUser(), AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_INACTIVE, AUTH_LDAP, AUTH_LOCAL, AUTH_MODE_INACTIVE, AUTH_MULTIPLE, AUTH_OPENID, AUTH_RADIUS, AUTH_SHIBBOLETH, AUTH_SOAP, ilSessionControl\checkExpiredSession(), ilAuthFactory\CONTEXT_APACHE, ilAuthFactory\CONTEXT_CAS, ilAuthFactory\factory(), ilSession\getIdleValue(), ilLoggerFactory\getLogger(), ilLDAPServer\getServerIdByAuthMode(), ilAuthFactory\setContext(), and WebDAV_Authentication.

Referenced by ilInitialisation\goToPublicSection(), and ilInitialisation\initUser().

         {
                 global $ilAuth, $ilSetting, $ilDB, $ilClientIniFile,$ilBench;
 
                 $user_auth_mode = false;
                 $ilBench->start('Auth','initAuth');
 
 
                 // get default auth mode 
                 //$default_auth_mode = $this->getSetting("auth_mode");
                 define ("AUTH_DEFAULT", $ilSetting->get("auth_mode") ? $ilSetting->get("auth_mode") : AUTH_LOCAL);
                 
                 // determine authentication method if no session is found and username & password is posted
                 // does this if statement make any sense? we enter this block nearly everytime. 
                 
         if (empty($_SESSION) ||
             (!isset($_SESSION['_authsession']['registered']) ||
              $_SESSION['_authsession']['registered'] !== true))
         {
                         // no sesssion found
                         if (isset($_POST['username']) and $_POST['username'] != '' and $_POST['password'] != '' or isset($_GET['ecs_hash']) or isset($_GET['ecs_hash_url']) or isset($_POST['oid_username']) or isset($_GET['oid_check_status']))
                         {
                                 $user_auth_mode = ilAuthUtils::_getAuthModeOfUser($_POST['username'], $_POST['password'], $ilDB);
                                 ilLoggerFactory::getLogger('auth')->debug('Authmode is '. $user_auth_mode);
 
                                 if ($user_auth_mode == AUTH_CAS && $ilSetting->get("cas_allow_local"))
                                 {
                                         $user_auth_mode = AUTH_LOCAL;
                                 }
                                 if ($user_auth_mode == AUTH_SOAP && $ilSetting->get("soap_auth_allow_local"))
                                 {
                                         $user_auth_mode = AUTH_LOCAL;
                                 }
                                 if ($user_auth_mode == AUTH_SHIBBOLETH && $ilSetting->get("shib_auth_allow_local"))
                                 {
                                         $user_auth_mode = AUTH_LOCAL;
                                 }
                         }
                         else if ($_POST['auth_mode'] == AUTH_APACHE)
                         {
                                 $user_auth_mode = AUTH_APACHE;
                         }
         }
         
                 // to do: other solution?
                 if (!$ilSetting->get("soap_auth_active") && $user_auth_mode == AUTH_SOAP)
                 {
                         $user_auth_mode = AUTH_LOCAL;
                 }
                 
                 if($ilSetting->get("cas_active") && $_GET['forceCASLogin'])
                 {
                         ilAuthFactory::setContext(ilAuthFactory::CONTEXT_CAS);
                         $user_auth_mode = AUTH_CAS;
                 }
 
                 if($ilSetting->get("apache_active") && $user_auth_mode == AUTH_APACHE)
                 {
                         ilAuthFactory::setContext(ilAuthFactory::CONTEXT_APACHE);
                         $user_auth_mode = AUTH_APACHE;
                 }
 
                 // BEGIN WebDAV: Share session between browser and WebDAV client.
                 // The realm is needed to support a common session between Auth_HTTP and Auth.
                 // It also helps us to distinguish between parallel sessions run on different clients.
                 // Common session only works if we use a common session name starting with "_authhttp".
                 // We must use the "_authttp" prefix, because it is hardcoded in the session name of
                 // class Auth_HTTP.
                 // Whenever we use Auth_HTTP, we need to explicitly switch off "sessionSharing", because
                 // it interfers with the session mechanism of the other Auth modules. If we would
                 // keep this switched on, then users could steal each others session, which would cause
                 // a major security breach.
                 // Note: The realm and sessionName used here, must be the same as in 
                 //       class ilBaseAuthentication. Otherwise, Soap clients won't be able to log
                 //       in to ILIAS.
                 $realm = CLIENT_ID;
                 //$this->writelog('ilias.php realm='.$realm);
                 // END WebDAV: Share session between browser and WebDAV client.
 
 //var_dump($_SESSION);
 //echo "1-".$ilSetting->get("soap_auth_active")."-";
                 // if soap authentication activated and soap credentials given
                 if (($ilSetting->get("soap_auth_active") && !empty($_GET["ext_uid"])
                         && !empty($_GET["soap_pw"])) || $user_auth_mode == AUTH_SOAP)
                 {
                         
                         define('AUTH_CURRENT',AUTH_SOAP);
                 }
                 // if Shibboleth is active and the user is authenticated
                 // we set auth_mode to Shibboleth
                 else if (       $ilSetting->get("shib_active")
                                 && $_SERVER[$ilSetting->get("shib_login")])
                 {
                         define ("AUTH_CURRENT", AUTH_SHIBBOLETH);
                 }
                 else
                 {
                         define ("AUTH_CURRENT", $user_auth_mode);
                 }
 //var_dump($_SESSION);
 
                 // Determine the authentication method to use
                 if (defined("WebDAV_Authentication") && WebDAV_Authentication == 'HTTP') {
                         // Since WebDAV clients create the login form by 
                         // themselves, we can not provide buttons on the form for 
                         // choosing an authentication method. 
                         // If the user is already logged in, we continue using
                         // the current authentication method. If the user is
                         // not logged in yet, we use the "multiple authentication"
                         // method using a predefined sequence of authentication methods.
                         $authmode = AUTH_CURRENT ? AUTH_CURRENT : AUTH_MULTIPLE;
                 } 
                 else 
                 {
                         $authmode = AUTH_CURRENT;
                 }
 //var_dump($authmode);
         // if no auth mode selected AND default mode is AUTH_APACHE then use it...
                 if ($authmode == null && AUTH_DEFAULT == AUTH_APACHE)
                         $authmode = AUTH_APACHE;
 
                 // begin-patch ldap_multiple
                 // we cast to int => AUTH_LDAP_1 matches AUTH_LDAP
                 switch ((int) $authmode)
                 {
                         case AUTH_LDAP:
                         
                                 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                                 $sid = ilLDAPServer::getServerIdByAuthMode($authmode);
                                 include_once './Services/LDAP/classes/class.ilAuthContainerLDAP.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerLDAP($sid));
                                 break;
                                 
                         case AUTH_RADIUS:
 
                                 include_once './Services/Radius/classes/class.ilAuthContainerRadius.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerRadius());
                                 break;
 
                         case AUTH_SHIBBOLETH:
                                 // build option string for SHIB::Auth
                                 $auth_params = array();
                                 $auth_params['sessionName'] = "_authhttp".md5($realm);
                                 $ilAuth = new ShibAuth($auth_params,true);
                                 break;
                                 
                         case AUTH_CAS:
 
                                 include_once './Services/CAS/classes/class.ilAuthContainerCAS.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerCAS());
                                 break;
 
                         case AUTH_SOAP:
 
                                 include_once './Services/SOAPAuth/classes/class.ilAuthContainerSOAP.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerSOAP());
                                 break;
                                 
                         case AUTH_MULTIPLE:
 
                                 include_once './Services/Authentication/classes/class.ilAuthContainerMultiple.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerMultiple());
                                 break;
 
                         case AUTH_ECS:
                                 include_once './Services/WebServices/ECS/classes/class.ilAuthContainerECS.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerECS());
                                 break;
                                 
                         case AUTH_OPENID:
                                 
                                 include_once './Services/OpenId/classes/class.ilAuthContainerOpenId.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerOpenId());
                                 break;
 
                         case AUTH_INACTIVE:
                                 require_once('./Services/Authentication/classes/class.ilAuthInactive.php');
                                 $ilAuth = new ilAuthInactive(AUTH_MODE_INACTIVE);
                                 break;
 
                         case AUTH_APACHE:
                                 include_once './Services/AuthApache/classes/class.ilAuthContainerApache.php';
                                 ilAuthFactory::setContext(ilAuthFactory::CONTEXT_APACHE);
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerApache());
                                 break;
 
                         // begin-patch auth_plugin
                         case AUTH_LOCAL:
                                 global $ilLog;
                                 include_once './Services/Database/classes/class.ilAuthContainerMDB2.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerMDB2());
                                 break;
 
                         default:
                                 // check for plugin
                                 if($authmode)
                                 {
                                         foreach(self::getAuthPlugins() as $pl)
                                         {
                                                 $container = $pl->getContainer($authmode);
                                                 if($container instanceof Auth_Container)
                                                 {
                                                         ilLoggerFactory::getLogger('auth')->info('Using plugin authentication with auth mode ' . $authmode);
                                                         $ilAuth = ilAuthFactory::factory($container);
                                                         break 2;
                                                 }
                                         }
                                 }
                                 #$GLOBALS['ilLog']->write(__METHOD__.' Using default authentication');
                                 // default for logged in users
                                 include_once './Services/Database/classes/class.ilAuthContainerMDB2.php';
                                 $ilAuth = ilAuthFactory::factory(new ilAuthContainerMDB2());
                                 break;
                         // end-patch auth_plugin
                 }
                 
                 // Due to a bug in Pear Auth_HTTP, we can't use idle time 
                 // with WebDAV clients. If we used it, users could never log
                 // back into ILIAS once their session idled out. :(
                 if (!defined("WebDAV_Authentication") || WebDAV_Authentication != 'HTTP')
                 {                       
                         $ilAuth->setIdle(ilSession::getIdleValue(), false);                     
                 }
                 $ilAuth->setExpire(0);
 
                 ini_set("session.cookie_lifetime", "0");
 //echo "-".get_class($ilAuth)."-";
                 $GLOBALS['ilAuth'] =& $ilAuth;
 
                 ilSessionControl::checkExpiredSession();
 
                 $ilBench->stop('Auth','initAuth');
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _isExternalAccountEnabled()

static ilAuthUtils::_isExternalAccountEnabled ( )

static

Check if an external account name is required.

That's the case if Radius,LDAP, CAS or SOAP is active

public

Parameters

Definition at line 713 of file class.ilAuthUtils.php.

References $ilSetting, ilLDAPServer\_getActiveServerList(), and ilOpenIdSettings\getInstance().

Referenced by ilObjUserGUI\initForm(), and ilObjUserGUI\saveObject().

         {
                 global $ilSetting;
                 
                 if($ilSetting->get("cas_active"))
                 {
                         return true;
                 } 
                 if($ilSetting->get("soap_auth_active"))
                 {
                         return true;
                 }
                 if($ilSetting->get("shib_active"))
                 {
                         return true;
                 }
                 if($ilSetting->get('radius_active'))
                 {
                         return true;
                 }
                 include_once('Services/LDAP/classes/class.ilLDAPServer.php');
                 if(count(ilLDAPServer::_getActiveServerList()))
                 {
                         return true;
                 }
                 include_once './Services/OpenId/classes/class.ilOpenIdSettings.php';
                 if(ilOpenIdSettings::getInstance()->isActive())
                 {
                         return true;
                 }
                 
                 // begin-path auth_plugin
                 foreach(self::getAuthPlugins() as $pl)
                 {
                         foreach($pl->getAuthIds() as $auth_id)
                         {
                                 if($pl->isAuthActive($auth_id) and $pl->isExternalAccountNameRequired($auth_id))
                                 {
                                         return true;
                                 }
                         }
                 }
                 // end-path auth_plugin
                 
                 return false;
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ _needsExternalAccountByAuthMode()

static ilAuthUtils::_needsExternalAccountByAuthMode ( $a_auth_mode )

static

Check if chosen auth mode needs an external account entry.

public

Parameters

int auth_mode

Definition at line 792 of file class.ilAuthUtils.php.

References $ilSetting, AUTH_APACHE, and AUTH_LOCAL.

Referenced by ilSoapUserAdministration\__validateUserData(), ilObjUser\isPasswordChangeDemanded(), and ilObjUserGUI\updateObjectOld().

         {
                 switch($a_auth_mode)
                 {
                         case AUTH_LOCAL:
                         case AUTH_APACHE:
                                 return false;
                         default:
                                 return true;
                 }
         }

Here is the caller graph for this function:

◆ getAuthModeTranslation()

static ilAuthUtils::getAuthModeTranslation ( $a_auth_key )

static

Parameters

string $a_authmode

Definition at line 923 of file class.ilAuthUtils.php.

References $lng, $server, AUTH_LDAP, ilLDAPServer\getInstanceByServerId(), and ilLDAPServer\getServerIdByAuthMode().

Referenced by ilObjUserGUI\initForm().

         {
                 global $lng;
                 
                 switch((int) $a_auth_key)
                 {
                         case AUTH_LDAP:
                                 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                                 $sid = ilLDAPServer::getServerIdByAuthMode($a_auth_key);
                                 $server = ilLDAPServer::getInstanceByServerId($sid);
                                 return $server->getName();
                                 
                         default:
                                 return $lng->txt('auth_'.self::_getAuthModeName($a_auth_key));
                 }
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ getAuthPlugins()

static ilAuthUtils::getAuthPlugins ( )

static

Get active enabled auth plugins.

Returns: ilAuthDefinition

Definition at line 898 of file class.ilAuthUtils.php.

References $GLOBALS, and IL_COMP_SERVICE.

Referenced by _getMultipleAuthModeOptions(), _hasMultipleAuthenticationMethods(), ilAuthContainerMultiple\fetchData(), ilObjAuthSettingsGUI\initAuthModeDetermination(), and ilAuthModeDetermination\read().

         {
                 $pls = $GLOBALS['ilPluginAdmin']->getActivePluginsForSlot(
                                 IL_COMP_SERVICE,
                                 'Authentication',
                                 'authhk'
                 );
                 $pl_objs = array();
                 foreach($pls as $pl)
                 {
                         $pl_objs[] = $GLOBALS['ilPluginAdmin']->getPluginObject(
                                         IL_COMP_SERVICE,
                                         'Authentication',
                                         'authhk',
                                         $pl
                         );
                 }
                 return $pl_objs;
         }

Here is the caller graph for this function:

◆ isPasswordModificationEnabled()

static ilAuthUtils::isPasswordModificationEnabled ( $a_authmode )

static

Check if password modification is enabled.

Parameters

object $a_authmode

Returns: bool

Definition at line 824 of file class.ilAuthUtils.php.

References $ilSetting, AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_LDAP, AUTH_LOCAL, AUTH_OPENID, AUTH_RADIUS, AUTH_SCRIPT, AUTH_SHIBBOLETH, and AUTH_SOAP.

Referenced by ilPersonalSettingsGUI\allowPasswordChange(), ilAuthContainerMDB2\fetchData(), and supportsLocalPasswordValidation().

         {
                 global $ilSetting;
 
                 if (self::isPasswordModificationHidden()) {
                         return false;
                 }
                 
                 // begin-patch ldap_multiple
                 // cast to int
                 switch((int) $a_authmode)
                 {
                         // No local passwords for these auth modes
                         case AUTH_LDAP:
                         case AUTH_RADIUS:
                         case AUTH_ECS:
                         case AUTH_SCRIPT:
                                 return false;
                         
                         // Always for openid and local
                         case AUTH_LOCAL:
                         case AUTH_OPENID:
                         case AUTH_APACHE:
                                 return true;
 
                         // Read setting:
                         case AUTH_SHIBBOLETH:
                                 return $ilSetting->get("shib_auth_allow_local");
                         case AUTH_SOAP:
                                 return $ilSetting->get("soap_auth_allow_local");
                         case AUTH_CAS:
                                 return $ilSetting->get("cas_allow_local");
                 }
         }

Here is the caller graph for this function:

◆ supportsLocalPasswordValidation()

static ilAuthUtils::supportsLocalPasswordValidation ( $a_authmode )

static

Check if local password validation is supported.

Parameters

object $a_authmode

Returns

Definition at line 864 of file class.ilAuthUtils.php.

References AUTH_APACHE, AUTH_CAS, AUTH_ECS, AUTH_LDAP, AUTH_LOCAL, AUTH_OPENID, AUTH_RADIUS, AUTH_SCRIPT, AUTH_SHIBBOLETH, AUTH_SOAP, isPasswordModificationEnabled(), LOCAL_PWV_FULL, LOCAL_PWV_NO, and LOCAL_PWV_USER.

Referenced by ilDAVUtils\isLocalPasswordInstructionRequired().

         {
                 // begin-patch ldap_multiple
                 // cast to int
                 switch((int) $a_authmode)
                 {
                         case AUTH_LDAP:
                         case AUTH_LOCAL:
                         case AUTH_RADIUS:
                                 return ilAuthUtils::LOCAL_PWV_FULL;
                         
                         case AUTH_SHIBBOLETH:
                         case AUTH_SOAP:
                         case AUTH_CAS:
                                 if(!ilAuthUtils::isPasswordModificationEnabled($a_authmode))
                                 {
                                         return ilAuthUtils::LOCAL_PWV_NO;
                                 }
                                 return ilAuthUtils::LOCAL_PWV_USER;
                                 
                         case AUTH_ECS:
                         case AUTH_OPENID:
                         case AUTH_SCRIPT:
                         case AUTH_APACHE:
                         default:
                                 return ilAuthUtils::LOCAL_PWV_USER;
                 }
         } 

Here is the call graph for this function:

Here is the caller graph for this function:

Field Documentation

◆ LOCAL_PWV_FULL

const ilAuthUtils::LOCAL_PWV_FULL = 1

Definition at line 66 of file class.ilAuthUtils.php.

Referenced by supportsLocalPasswordValidation().

◆ LOCAL_PWV_NO

const ilAuthUtils::LOCAL_PWV_NO = 2

Definition at line 67 of file class.ilAuthUtils.php.

Referenced by supportsLocalPasswordValidation().

◆ LOCAL_PWV_USER

const ilAuthUtils::LOCAL_PWV_USER = 3

Definition at line 68 of file class.ilAuthUtils.php.

Referenced by ilDAVUtils\isLocalPasswordInstructionRequired(), and supportsLocalPasswordValidation().

The documentation for this class was generated from the following file:

Services/Authentication/classes/class.ilAuthUtils.php

Public Member Functions

Static Public Member Functions

Data Fields

Detailed Description

Member Function Documentation

◆ _allowPasswordModificationByAuthMode()

◆ _generateLogin()

◆ _getActiveAuthModes()

◆ _getAllAuthModes()

◆ _getAuthMode()

◆ _getAuthModeName()

◆ _getAuthModeOfUser()

◆ _getMultipleAuthModeOptions()

◆ _hasMultipleAuthenticationMethods()

◆ _initAuth()

◆ _isExternalAccountEnabled()

◆ _needsExternalAccountByAuthMode()

◆ getAuthModeTranslation()

◆ getAuthPlugins()

◆ isPasswordModificationEnabled()

◆ supportsLocalPasswordValidation()

Field Documentation

◆ LOCAL_PWV_FULL

◆ LOCAL_PWV_NO

◆ LOCAL_PWV_USER