class.ilAuthContainerApache.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2014 ILIAS open source, Extended GPL, see docs/LICENSE */

require_once 'Auth/Container/MDB2.php';

class ilAuthContainerApache extends Auth_Container
{
        public static $force_creation = false;

        public function __construct()
        {
                parent::__construct();
        }

        public static function forceCreation($value)
        {
                self::$force_creation = $value;
        }

        function fetchData($a_username, $password, $isChallengeResponse = false)
        {
                ilLoggerFactory::getLogger('auth')->debug('Starting apache auth');
                
                global $ilDB, $ilSetting , $rbacadmin;

                $settings = new ilSetting('apache_auth');

                if(!$settings->get('apache_enable_auth'))
                {
                        ilLoggerFactory::getLogger('auth')->debug('Apache auth disabled');
                        return false;
                }
                if(!$settings->get('apache_auth_indicator_name') || !$settings->get('apache_auth_indicator_value'))
                {
                        ilLoggerFactory::getLogger('auth')->debug('Apache auth indicator match failed');
                        return false;
                }
                if(!ilUtil::isLogin($a_username))
                {
                        ilLoggerFactory::getLogger('auth')->debug('Apache auth wrong login');
                        return false;
                }

                if($a_username == 'anonymous' && $password == 'anonymous')
                {
                        $query   = 'SELECT * FROM usr_data WHERE login = %s';
                        $qres    = $ilDB->queryF($query, array('text'), array($a_username));
                        $userRow = $ilDB->fetchAssoc($qres);

                        if(is_array($userRow) && $userRow['usr_id'])
                        {
                                // user as a local account...
                                // fetch logindata
                                $this->activeUser = $userRow['login'];
                                foreach($userRow as $key => $value)
                                {
                                        if($key == $this->options['passwordcol'] || $key == $this->options['usernamecol'])
                                        {
                                                continue;
                                        }
                                        // Use reference to the auth object if exists
                                        // This is because the auth session variable can change so a static call to setAuthData does not make sense
                                        $this->_auth_obj->setAuthData($key, $value);
                                }
                                ilLoggerFactory::getLogger('auth')->debug('Apache local auth successful.');
                                $this->_auth_obj->setAuth($userRow['login']);
                                return true;
                        }
                        ilLoggerFactory::getLogger('auth')->debug('Apache local auth unsuccessful.');
                        return false;
                }

                if(
                        !$_SESSION['login_invalid'] &&
                        in_array(
                                $_SERVER[$settings->get('apache_auth_indicator_name')],
                                array_filter(array_map('trim', str_getcsv($settings->get('apache_auth_indicator_value'))))
                        )
                )
                {
                        // we have a valid apache auth
                        $list = array(
                                $ilSetting->get('auth_mode')
                        );

                        // Respect the auth method sequence
                        include_once('./Services/Authentication/classes/class.ilAuthModeDetermination.php');
                        $det = ilAuthModeDetermination::_getInstance();
                        if(!$det->isManualSelection() && $det->getCountActiveAuthModes() > 1)
                        {
                                $list = array();
                                foreach(ilAuthModeDetermination::_getInstance()->getAuthModeSequence() as $auth_mode)
                                {
                                        $list[] = $auth_mode;
                                }
                        }
                        
                        // Apache with ldap as data source
                        include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                        if($settings->get('apache_enable_ldap'))
                        {
                                return $this->handleLDAPDataSource($this->_auth_obj,$a_username, $settings);
                        }


                        foreach($list as $auth_mode)
                        {
                                ilLoggerFactory::getLogger('auth')->debug('Current auth mode: ' . $auth_mode);
                                
                                if(AUTH_LDAP == $auth_mode)
                                {
                                        ilLoggerFactory::getLogger('auth')->debug('Trying ldap synchronisation');
                                        // if no local user has been found AND ldap lookup is enabled
                                        if($settings->get('apache_enable_ldap'))
                                        {
                                                include_once 'Services/LDAP/classes/class.ilLDAPServer.php';
                                                $this->server = new ilLDAPServer($settings->get('apache_ldap_sid'));
                                                $this->server->doConnectionCheck();

                                                $config = $this->server->toPearAuthArray();

                                                $query = new ilLDAPQuery($this->server);
                                                $query->bind();
                                                $ldapUser = $query->fetchUser($a_username);

                                                if($ldapUser && $ldapUser[$a_username] && $ldapUser[$a_username][$config['userattr']] == $a_username)
                                                {
                                                        $ldapUser[$a_username]['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username);
                                                        $user_data                                  = $ldapUser[$a_username]; //array_change_key_case($a_auth->getAuthData(),CASE_LOWER);
                                                        if($this->server->enabledSyncOnLogin())
                                                        {
                                                                if(!$user_data['ilInternalAccount'] && $this->server->isAccountMigrationEnabled() && !self::$force_creation)
                                                                {
                                                                        $this->_auth_obj->logout();
                                                                        $_SESSION['tmp_auth_mode']        = 'apache';
                                                                        $_SESSION['tmp_auth_mode_type'] = 'apache';
                                                                        $_SESSION['tmp_external_account'] = $a_username;
                                                                        $_SESSION['tmp_pass']             = $_POST['password'];

                                                                        include_once('./Services/LDAP/classes/class.ilLDAPRoleAssignmentRules.php');
                                                                        $roles = ilLDAPRoleAssignmentRules::getAssignmentsForCreation(
                                                                                $this->server->getServerId(),
                                                                                $a_username,
                                                                                $user_data);
                                                                        $_SESSION['tmp_roles'] = array();
                                                                        foreach($roles as $info)
                                                                        {
                                                                                if($info['action'] == ilLDAPRoleAssignmentRules::ROLE_ACTION_ASSIGN)
                                                                                {
                                                                                        $_SESSION['tmp_roles'][] = $info['id'];
                                                                                }
                                                                        }

                                                                        ilUtil::redirect('ilias.php?baseClass=ilStartUpGUI&cmdClass=ilstartupgui&cmd=showAccountMigration');
                                                                }

                                                                if($this->updateRequired($a_username))
                                                                {
                                                                        $this->initLDAPAttributeToUser();
                                                                        $this->ldap_attr_to_user->setUserData($ldapUser);
                                                                        $this->ldap_attr_to_user->refresh();
                                                                        $user_data['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username);
                                                                }
                                                                else
                                                                {
                                                                        // User exists and no update required
                                                                        $user_data['ilInternalAccount'] = ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username);
                                                                }
                                                        }
                                                        if($user_data['ilInternalAccount'])
                                                        {
                                                                $this->_auth_obj->setAuth($user_data['ilInternalAccount']);
                                                                $this->_auth_obj->username = $user_data['ilInternalAccount'];
                                                                return true;
                                                        }
                                                }
                                        }
                                }
                                else if(AUTH_APACHE != $auth_mode && $settings->get('apache_enable_local'))
                                {
                                        $condition = '';
                                        if($ilSetting->get("auth_mode") && $ilSetting->get("auth_mode") == 'ldap')
                                        {
                                                $condition = " AND auth_mode != " . $ilDB->quote('default', 'text') . " ";
                                        }
                                        $query   = "SELECT * FROM usr_data WHERE login = %s AND auth_mode != %s $condition";
                                        $qres    = $ilDB->queryF($query, array('text', 'text'), array($a_username, 'ldap'));
                                        $userRow = $ilDB->fetchAssoc($qres);

                                        if(is_array($userRow) && $userRow['usr_id'])
                                        {
                                                // user as a local account...
                                                // fetch logindata
                                                $this->activeUser = $userRow['login'];
                                                foreach($userRow as $key => $value)
                                                {
                                                        if($key == $this->options['passwordcol'] || $key == $this->options['usernamecol'])
                                                        {
                                                                continue;
                                                        }
                                                        // Use reference to the auth object if exists
                                                        // This is because the auth session variable can change so a static call to setAuthData does not make sense
                                                        $this->_auth_obj->setAuthData($key, $value);
                                                }
                                                $this->_auth_obj->setAuth($userRow['login']);
                                                return true;
                                        }
                                }
                        }

                        if($settings->get('apache_enable_local') && $settings->get('apache_local_autocreate'))
                        {
                                if($_GET['r'])
                                {
                                        $_SESSION['profile_complete_redirect'] = $_GET['r'];
                                }

                                $user = new ilObjUser();
                                $user->setLogin($a_username);
                                $user->setExternalAccount($a_username);
                                $user->setProfileIncomplete(true);
                                $user->create();
                                $user->setAuthMode('apache');
                                // set a timestamp for last_password_change
                                // this ts is needed by ilSecuritySettings
                                $user->setLastPasswordChangeTS(time());
                                $user->setTimeLimitUnlimited(1);

                                $user->setActive(1);
                                //insert user data in table user_data
                                $user->saveAsNew();
                                $user->writePrefs();
                                $rbacadmin->assignUser($settings->get('apache_default_role', 4), $user->getId(), true);
                                return true;
                        }
                }
                else if(defined('IL_CERT_SSO') && IL_CERT_SSO)
                {
                        define('APACHE_ERRORCODE', AUTH_APACHE_FAILED);
                }

                return false;
        }

        protected function updateRequired($a_username)
        {
                if(!ilObjUser::_checkExternalAuthAccount("ldap_".$this->server->getServerId(), $a_username))
                {
                        return true;
                }
                // Check attribute mapping on login
                include_once './Services/LDAP/classes/class.ilLDAPAttributeMapping.php';
                if(ilLDAPAttributeMapping::hasRulesForUpdate($this->server->getServerId()))
                {
                        return true;
                }
                include_once './Services/LDAP/classes/class.ilLDAPRoleAssignmentRule.php';
                if(ilLDAPRoleAssignmentRule::hasRulesForUpdate())
                {
                        return true;
                }
                return false;
        }

        private function initLDAPAttributeToUser()
        {
                include_once('Services/LDAP/classes/class.ilLDAPAttributeToUser.php');
                $this->ldap_attr_to_user = new ilLDAPAttributeToUser($this->server);
        }
        
        
        protected function handleLDAPDataSource($a_auth,$ext_account, $settings)
        {
                include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                $server = ilLDAPServer::getInstanceByServerId(
                        $settings->get('apache_ldap_sid')
                );

                ilLoggerFactory::getLogger('auth')->debug('Using ldap data source with server configuration: ' . $server->getName());

                include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
                $sync = new ilLDAPUserSynchronisation('ldap_'.$server->getServerId(), $server->getServerId());
                $sync->setExternalAccount($ext_account);
                $sync->setUserData(array());
                $sync->forceCreation(self::$force_creation);
                $sync->forceReadLdapData(true);

                try {
                        $internal_account = $sync->sync();
                }
                catch(UnexpectedValueException $e) {
                        ilLoggerFactory::getLogger('auth')->info('Login failed with message: ' . $e->getMessage());
                        $a_auth->status = AUTH_WRONG_LOGIN;
                        $a_auth->logout();
                        return false;
                }
                catch(ilLDAPSynchronisationForbiddenException $e) {
                        // No syncronisation allowed => create Error
                        ilLoggerFactory::getLogger('auth')->info('Login failed with message: ' . $e->getMessage());
                        $a_auth->status = AUTH_RADIUS_NO_ILIAS_USER;
                        $a_auth->logout();
                        return false;
                }
                catch(ilLDAPAccountMigrationRequiredException $e) {
                        ilLoggerFactory::getLogger('auth')->debug('Starting account migration');
                        $a_auth->logout();
                        ilUtil::redirect('ilias.php?baseClass=ilStartUpGUI&cmdClass=ilstartupgui&cmd=showAccountMigration');
                }

                $a_auth->setAuth($internal_account);
                return true;
        }
        
}