CAS authentication More...

Inheritance diagram for ilAuthContainerCAS:

Collaboration diagram for ilAuthContainerCAS:

Public Member Functions
	__construct ()

	forceAuthentication ($username, $status, $auth)
	Force CAS authentication. More...

	loginObserver ($a_username, $a_auth)

	fetchData ($a_username, $a_password, $isChallengeResponse=false)

Protected Member Functions
	handleLDAPDataSource ($a_auth, $ext_account)
	Handle ldap as data source. More...

	initCAS ()

Protected Attributes
	$server_version = null

	$server_hostname = null

	$server_port = null

	$server_uri = null

Detailed Description

CAS authentication

Author: Stefan Meyer meyer.nosp@m.@lei.nosp@m.fos.c.nosp@m.om

Version: $Id$

Definition at line 14 of file class.ilAuthContainerCAS.php.

Constructor & Destructor Documentation

◆ __construct()

ilAuthContainerCAS::__construct ( )

Definition at line 26 of file class.ilAuthContainerCAS.php.

References initCAS().

         {
                 parent::__construct();
                 $this->initCAS();
     }   

Here is the call graph for this function:

Member Function Documentation

◆ fetchData()

ilAuthContainerCAS::fetchData	(	$a_username,
		$a_password,
		$isChallengeResponse = `false`
	)

Returns: bool

Parameters

string	$a_username
string	$a_password
bool	$isChallengeResponse,[optional]

Definition at line 208 of file class.ilAuthContainerCAS.php.

References $ilLog.

         {
                 global $PHPCAS_CLIENT,$ilLog;
                 
                 $ilLog->write(__METHOD__.': Fetch Data called');
                 return $PHPCAS_CLIENT->isAuthenticated();
         }

◆ forceAuthentication()

ilAuthContainerCAS::forceAuthentication	(	$username,
		$status,
		$auth
	)

Force CAS authentication.

Returns

Parameters

object	$username
object	$status
object	$auth

Definition at line 39 of file class.ilAuthContainerCAS.php.

References $ilLog.

         {
                 global $PHPCAS_CLIENT,$ilLog;
                 
                 if(!$PHPCAS_CLIENT->isAuthenticated())
                 {
                         $PHPCAS_CLIENT->forceAuthentication();
                 }
         }

◆ handleLDAPDataSource()

ilAuthContainerCAS::handleLDAPDataSource	(	$a_auth,
		$ext_account
	)

protected

Handle ldap as data source.

Parameters

Auth	$auth
string	$ext_account

Definition at line 157 of file class.ilAuthContainerCAS.php.

References $GLOBALS, $server, array, AUTH_CAS, AUTH_CAS_NO_ILIAS_USER, ilLDAPServer\getDataSource(), ilLDAPServer\getInstanceByServerId(), ilUtil\redirect(), and ilLDAPUserSynchronisation\setExternalAccount().

Referenced by loginObserver().

         {
                 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                 $server = ilLDAPServer::getInstanceByServerId(
                         ilLDAPServer::getDataSource(AUTH_CAS)
                 );
 
                 $GLOBALS['ilLog']->write(__METHOD__.' Using ldap data source for user: '.$ext_account);
 
                 include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
                 $sync = new ilLDAPUserSynchronisation('cas', $server->getServerId());
                 $sync->setExternalAccount($ext_account);
                 $sync->setUserData(array());
                 #$sync->forceCreation($this->force_creation);
                 // TODO: Check this
                 $sync->forceCreation(true);
 
                 try {
                         $internal_account = $sync->sync();
                 }
                 catch(UnexpectedValueException $e) {
                         $GLOBALS['ilLog']->write(__METHOD__.': Login failed with message: '. $e->getMessage());
                         $a_auth->status = AUTH_WRONG_LOGIN;
                         $a_auth->logout();
                         return false;
                 }
                 catch(ilLDAPSynchronisationForbiddenException $e) {
                         // No syncronisation allowed => create Error
                         $GLOBALS['ilLog']->write(__METHOD__.': Login failed with message: '. $e->getMessage());
                         $a_auth->status = AUTH_CAS_NO_ILIAS_USER;
                         $a_auth->logout();
                         return false;
                 }
                 catch(ilLDAPAccountMigrationRequiredException $e) {
                         $GLOBALS['ilLog']->write(__METHOD__.': Starting account migration.');
                         $a_auth->logout();
                         ilUtil::redirect('ilias.php?baseClass=ilStartUpGUI&cmdClass=ilstartupgui&cmd=showAccountMigration');
                 }
                 $a_auth->setAuth($internal_account);
                 return true;
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ initCAS()

ilAuthContainerCAS::initCAS ( )

protected

Definition at line 216 of file class.ilAuthContainerCAS.php.

References $ilSetting, CAS_VERSION_2_0, phpCAS\client(), phpCAS\setDebug(), phpCAS\setNoCasServerValidation(), and string.

Referenced by __construct().

         {
                 global $ilSetting;
                 
                 include_once("./Services/CAS/lib/CAS.php");
 
                 $this->server_version = CAS_VERSION_2_0;
                 $this->server_hostname = $ilSetting->get('cas_server');
                 $this->server_port = (int) $ilSetting->get('cas_port');
                 $this->server_uri = (string) $ilSetting->get('cas_uri');
                 
                 phpCAS::setDebug();
                 phpCAS::client(
                         $this->server_version,
                         $this->server_hostname,
                         $this->server_port,
                         $this->server_uri
                 );
                 phpCAS::setNoCasServerValidation();
         }

Here is the call graph for this function:

Here is the caller graph for this function:

◆ loginObserver()

ilAuthContainerCAS::loginObserver	(	$a_username,
		$a_auth
	)

See also: ilAuthContainerBase::loginObserver()

Definition at line 52 of file class.ilAuthContainerCAS.php.

References $ilLog, $ilSetting, ilObjUser\_checkExternalAuthAccount(), ilAuthUtils\_generateLogin(), AUTH_CAS, AUTH_CAS_NO_ILIAS_USER, handleLDAPDataSource(), IL_PASSWD_CRYPTED, ilLDAPServer\isDataSourceActive(), and time.

     {
                 global $ilias, $rbacadmin, $ilSetting,$ilLog,$PHPCAS_CLIENT;
                 
                 $ilLog->write(__METHOD__.': Successful CAS login.');
 
                 // Radius with ldap as data source
                 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                 if(ilLDAPServer::isDataSourceActive(AUTH_CAS))
                 {
                         return $this->handleLDAPDataSource($a_auth,$a_username);
                 }
                 
                 include_once("./Services/CAS/lib/CAS.php");
                 if ($PHPCAS_CLIENT->getUser() != "")
                 {
                         $username = $PHPCAS_CLIENT->getUser();
                         $ilLog->write(__METHOD__.': Username: '.$username);
 
                         // Authorize this user
                         include_once('./Services/User/classes/class.ilObjUser.php');
                         $local_user = ilObjUser::_checkExternalAuthAccount("cas", $username);
 
                         if ($local_user != "")
                         {
                                 $a_auth->setAuth($local_user);
                         }
                         else
                         {
                                 if (!$ilSetting->get("cas_create_users"))
                                 {
                                         $a_auth->status = AUTH_CAS_NO_ILIAS_USER;
                                         $a_auth->logout();
                                         return false;
                                 }
                                 
                                 $userObj = new ilObjUser();
                                 
                                 $local_user = ilAuthUtils::_generateLogin($username);
                                 
                                 $newUser["firstname"] = $local_user;
                                 $newUser["lastname"] = "";
                                 
                                 $newUser["login"] = $local_user;
                                 
                                 // set "plain md5" password (= no valid password)
                                 $newUser["passwd"] = ""; 
                                 $newUser["passwd_type"] = IL_PASSWD_CRYPTED;
                                                                 
                                 //$newUser["gender"] = "m";
                                 $newUser["auth_mode"] = "cas";
                                 $newUser["ext_account"] = $username;
                                 $newUser["profile_incomplete"] = 1;
                                 
                                 // system data
                                 $userObj->assignData($newUser);
                                 $userObj->setTitle($userObj->getFullname());
                                 $userObj->setDescription($userObj->getEmail());
                         
                                 // set user language to system language
                                 $userObj->setLanguage($ilSetting->get("language"));
                                 
                                 // Time limit
                                 $userObj->setTimeLimitOwner(7);
                                 $userObj->setTimeLimitUnlimited(1);
                                 $userObj->setTimeLimitFrom(time());
                                 $userObj->setTimeLimitUntil(time());
                                                                 
                                 // Create user in DB
                                 $userObj->setOwner(0);
                                 $userObj->create();
                                 $userObj->setActive(1);
                                 
                                 $userObj->updateOwner();
                                 
                                 //insert user data in table user_data
                                 $userObj->saveAsNew();
                                 
                                 // setup user preferences
                                 $userObj->writePrefs();
                                 
                                 // to do: test this
                                 $rbacadmin->assignUser($ilSetting->get('cas_user_default_role'), $userObj->getId(),true);
                                 unset($userObj);
                                 
                                 $a_auth->setAuth($local_user);
                                 return true;
                         }
                 }
                 else
                 {
                         $ilLog->write(__METHOD__.': Login failed.');
 
                         // This should never occur unless CAS is not configured properly
                         $a_auth->status = AUTH_WRONG_LOGIN;
                         return false;
                 }
                 return false;
     }