ILIAS  release_5-2 Revision v5.2.25-18-g3f80b828510
ilAuthProviderLDAP Class Reference

Description of class class. More...

+ Inheritance diagram for ilAuthProviderLDAP:
+ Collaboration diagram for ilAuthProviderLDAP:

Public Member Functions

 __construct (\ilAuthCredentials $credentials, $a_server_id=0)
 Constructor. More...
 
 getServer ()
 Get server. More...
 
 doAuthentication (\ilAuthStatus $status)
 Do authentication. More...
 
 createNewAccount (ilAuthStatus $status)
 Create new ILIAS account for external_account.
Parameters
ilAuthStatus
More...
 
 migrateAccount (ilAuthStatus $status)
 Create new account.
Parameters
ilAuthStatus
More...
 
 getTriggerAuthMode ()
 Get trigger auth mode. More...
 
 getUserAuthModeName ()
 Get user auth mode name. More...
 
 getExternalAccountName ()
 Get external account name. More...
 
 setExternalAccountName ($a_name)
 Set external account name. More...
 
- Public Member Functions inherited from ilAuthProvider
 __construct (ilAuthCredentials $credentials)
 Constructor. More...
 
 getLogger ()
 Get logger. More...
 
 getCredentials ()
 
 doAuthentication (\ilAuthStatus $status)
 Do authentication. More...
 
 getTriggerAuthMode ()
 Get auth mode which triggered the account migration 2_1 for ldap account migration with server id 1 11 for apache auth. More...
 
 getUserAuthModeName ()
 Get user auth mode name ldap_1 for ldap account migration with server id 1 apache for apache auth. More...
 
 getExternalAccountName ()
 Get external account name. More...
 
 migrateAccount (ilAuthStatus $status)
 Create new account. More...
 
 createNewAccount (ilAuthStatus $status)
 Create new ILIAS account for external_account. More...
 

Protected Member Functions

 updateAccount (ilAuthStatus $status, array $user)
 Update Account. More...
 
 initServer ($a_server_id)
 Init Server. More...
 
 changeKeyCase ($a_string)
 Change case similar to array_change_key_case, to avoid further encoding problems. More...
 
- Protected Member Functions inherited from ilAuthProvider
 handleAuthenticationFail (ilAuthStatus $status, $a_reason)
 Handle failed authentication. More...
 

Private Attributes

 $server = null
 
 $migration_account = ''
 
 $force_new_account = false
 

Additional Inherited Members

- Data Fields inherited from ilAuthProvider
const STATUS_UNDEFINED = 0
 
const STATUS_AUTHENTICATION_SUCCESS = 1
 
const STATUS_AUTHENTICATION_FAILED = 2
 
const STATUS_MIGRATION = 3
 

Detailed Description

Description of class class.

Author
Stefan Meyer smeye.nosp@m.r.il.nosp@m.ias@g.nosp@m.mx.d.nosp@m.e

Definition at line 15 of file class.ilAuthProviderLDAP.php.

Constructor & Destructor Documentation

◆ __construct()

ilAuthProviderLDAP::__construct ( \ilAuthCredentials  $credentials,
  $a_server_id = 0 
)

Constructor.

Parameters
\ilAuthCredentials$credentials

Definition at line 25 of file class.ilAuthProviderLDAP.php.

26 {
27 parent::__construct($credentials);
28 $this->initServer($a_server_id);
29 }
initServer($a_server_id)
Init Server.

References ilAuthProvider\$credentials, and initServer().

+ Here is the call graph for this function:

Member Function Documentation

◆ changeKeyCase()

ilAuthProviderLDAP::changeKeyCase (   $a_string)
protected

Change case similar to array_change_key_case, to avoid further encoding problems.

Parameters
string$a_string
Returns
string

Definition at line 282 of file class.ilAuthProviderLDAP.php.

283 {
284 $as_array = array_change_key_case(array($a_string => $a_string));
285 foreach($as_array as $key => $string)
286 {
287 return $key;
288 }
289 }

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

+ Here is the caller graph for this function:

◆ createNewAccount()

ilAuthProviderLDAP::createNewAccount ( ilAuthStatus  $status)

Create new ILIAS account for external_account.

Parameters
ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 173 of file class.ilAuthProviderLDAP.php.

174 {
175 $this->force_new_account = true;
176
177 try
178 {
179 include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
180 $query = new ilLDAPQuery($this->getServer());
182 }
183 catch(ilLDAPQueryException $e)
184 {
185 $this->getLogger()->error('Cannot bind to LDAP server... '. $e->getMessage());
186 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
187 return false;
188 }
189 try
190 {
191 // fetch user
192 $users = $query->fetchUser(
193 $this->getCredentials()->getUsername()
194 );
195 if(!$users)
196 {
197 $this->handleAuthenticationFail($status, 'err_wrong_login');
198 return false;
199 }
200 if(!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users))
201 {
202 $this->handleAuthenticationFail($status, 'err_wrong_login');
203 return false;
204 }
205 }
206 catch (ilLDAPQueryException $e) {
207 $this->getLogger()->error('Cannot fetch LDAP user data... '. $e->getMessage());
208 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
209 return false;
210 }
211
212 // authentication success update profile
213 $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
214 }
const IL_LDAP_BIND_DEFAULT
updateAccount(ilAuthStatus $status, array $user)
Update Account.
changeKeyCase($a_string)
Change case similar to array_change_key_case, to avoid further encoding problems.
getLogger()
Get logger.
handleAuthenticationFail(ilAuthStatus $status, $a_reason)
Handle failed authentication.

References $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

+ Here is the call graph for this function:

◆ doAuthentication()

ilAuthProviderLDAP::doAuthentication ( \ilAuthStatus  $status)

Do authentication.

Parameters
\ilAuthStatus$status

Implements ilAuthProviderInterface.

Definition at line 45 of file class.ilAuthProviderLDAP.php.

46 {
47 try
48 {
49 // bind
50 include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
51 $query = new ilLDAPQuery($this->getServer());
53 }
54 catch(ilLDAPQueryException $e)
55 {
56 $this->getLogger()->error('Cannot bind to LDAP server... '. $e->getMessage());
57 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
58 return false;
59 }
60 try
61 {
62 // Read user data, which does ensure a sucessful authentication.
63 $users = $query->fetchUser(
64 $this->getCredentials()->getUsername()
65 );
66
67 if(!$users)
68 {
69 $this->handleAuthenticationFail($status, 'err_wrong_login');
70 return false;
71 }
72 if(!trim($this->getCredentials()->getPassword()))
73 {
74 $this->handleAuthenticationFail($status, 'err_wrong_login');
75 return false;
76 }
77 if(!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users))
78 {
79 $this->getLogger()->warning('Cannot find user: '. $this->changeKeyCase($this->getCredentials()->getUsername()));
80 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
81 return false;
82 }
83
84 // check group membership
85 if(!$query->checkGroupMembership(
86 $this->getCredentials()->getUsername(),
87 $users[$this->changeKeyCase($this->getCredentials()->getUsername())]
88 ))
89 {
90 $this->handleAuthenticationFail($status, 'err_wrong_login');
91 return false;
92 }
93 }
94 catch (ilLDAPQueryException $e) {
95 $this->getLogger()->error('Cannot fetch LDAP user data... '. $e->getMessage());
96 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
97 return false;
98 }
99 try
100 {
101 // now bind with login credentials
102 $query->bind(IL_LDAP_BIND_AUTH, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]['dn'], $this->getCredentials()->getPassword());
103 }
104 catch (ilLDAPQueryException $e) {
105 $this->handleAuthenticationFail($status, 'err_wrong_login');
106 return false;
107 }
108
109 // authentication success update profile
110 return $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
111 }
const IL_LDAP_BIND_AUTH

References $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_AUTH, IL_LDAP_BIND_DEFAULT, and updateAccount().

+ Here is the call graph for this function:

◆ getExternalAccountName()

ilAuthProviderLDAP::getExternalAccountName ( )

Get external account name.

Returns
string

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 263 of file class.ilAuthProviderLDAP.php.

References $migration_account.

◆ getServer()

ilAuthProviderLDAP::getServer ( )

Get server.

Returns
\ilLDAPServer

Definition at line 35 of file class.ilAuthProviderLDAP.php.

References $server.

Referenced by createNewAccount(), doAuthentication(), getTriggerAuthMode(), migrateAccount(), and updateAccount().

+ Here is the caller graph for this function:

◆ getTriggerAuthMode()

ilAuthProviderLDAP::getTriggerAuthMode ( )

Get trigger auth mode.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 246 of file class.ilAuthProviderLDAP.php.

247 {
248 return AUTH_LDAP.'_'.$this->getServer()->getServerId();
249 }
const AUTH_LDAP

References AUTH_LDAP, and getServer().

+ Here is the call graph for this function:

◆ getUserAuthModeName()

ilAuthProviderLDAP::getUserAuthModeName ( )

Get user auth mode name.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 254 of file class.ilAuthProviderLDAP.php.

255 {
256 return 'ldap_'.$this->getServer()->getServerId();
257 }

◆ initServer()

ilAuthProviderLDAP::initServer (   $a_server_id)
protected

Init Server.

Definition at line 162 of file class.ilAuthProviderLDAP.php.

163 {
164 include_once './Services/LDAP/classes/class.ilLDAPServer.php';
165 $this->server = new ilLDAPServer($a_server_id);
166 }

Referenced by __construct().

+ Here is the caller graph for this function:

◆ migrateAccount()

ilAuthProviderLDAP::migrateAccount ( ilAuthStatus  $status)

Create new account.

Parameters
ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 221 of file class.ilAuthProviderLDAP.php.

222 {
223 $this->force_new_account = true;
224
225 try
226 {
227 include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
228 $query = new ilLDAPQuery($this->getServer());
230 }
231 catch(ilLDAPQueryException $e)
232 {
233 $this->getLogger()->error('Cannot bind to LDAP server... '. $e->getMessage());
234 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
235 return false;
236 }
237
238 $users = $query->fetchUser($this->getCredentials()->getUsername());
239 $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
240 return true;
241 }

References $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

+ Here is the call graph for this function:

◆ setExternalAccountName()

ilAuthProviderLDAP::setExternalAccountName (   $a_name)

Set external account name.

Parameters
string$a_name

Definition at line 272 of file class.ilAuthProviderLDAP.php.

273 {
274 $this->migration_account = $a_name;
275 }

Referenced by updateAccount().

+ Here is the caller graph for this function:

◆ updateAccount()

ilAuthProviderLDAP::updateAccount ( ilAuthStatus  $status,
array  $user 
)
protected

Update Account.

Parameters
array$user
Returns
bool

Definition at line 118 of file class.ilAuthProviderLDAP.php.

119 {
120 $user = array_change_key_case($user,CASE_LOWER);
121 $this->getLogger()->dump($user, ilLogLevel::DEBUG);
122
123 include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
124 $sync = new ilLDAPUserSynchronisation('ldap_'.$this->getServer()->getServerId(), $this->getServer()->getServerId());
125 $sync->setExternalAccount($this->getCredentials()->getUsername());
126 $sync->setUserData($user);
127 $sync->forceCreation($this->force_new_account);
128
129 try {
130 $internal_account = $sync->sync();
131 $this->getLogger()->debug('Internal account: ' . $internal_account);
132 }
133 catch(UnexpectedValueException $e) {
134 $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
135 $this->handleAuthenticationFail($status, 'err_wrong_login');
136 return false;
137 }
139 // No syncronisation allowed => create Error
140 $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
141 $this->handleAuthenticationFail($status, 'err_auth_ldap_no_ilias_user');
142 return false;
143 }
145 // Account migration required
146 $this->setExternalAccountName($this->getCredentials()->getUsername());
147 $this->getLogger()->info('Authentication failed: account migration required for external account: ' . $this->getCredentials()->getUsername());
149 return false;
150 }
152 $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
153 return true;
154
155 }
setExternalAccountName($a_name)
Set external account name.
const STATUS_ACCOUNT_MIGRATION_REQUIRED
Description of ilLDAPAccountMigrationRequiredException.
Synchronization of user accounts used in auth container ldap, radius , cas,...
static _lookupId($a_user_str)
Lookup id by login.

References ilAuthProvider\$status, ilObjUser\_lookupId(), ilLogLevel\DEBUG, ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), setExternalAccountName(), ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED, and ilAuthStatus\STATUS_AUTHENTICATED.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

+ Here is the call graph for this function:
+ Here is the caller graph for this function:

Field Documentation

◆ $force_new_account

ilAuthProviderLDAP::$force_new_account = false
private

Definition at line 19 of file class.ilAuthProviderLDAP.php.

◆ $migration_account

ilAuthProviderLDAP::$migration_account = ''
private

Definition at line 18 of file class.ilAuthProviderLDAP.php.

Referenced by getExternalAccountName().

◆ $server

ilAuthProviderLDAP::$server = null
private

Definition at line 17 of file class.ilAuthProviderLDAP.php.

Referenced by getServer().


The documentation for this class was generated from the following file: