ILIAS  release_5-2 Revision v5.2.25-18-g3f80b828510
Public Member Functions | Protected Member Functions | Private Attributes
ilAuthProviderLDAP Class Reference

Description of class class. More...

+ Inheritance diagram for ilAuthProviderLDAP:
+ Collaboration diagram for ilAuthProviderLDAP:

Public Member Functions

 __construct (\ilAuthCredentials $credentials, $a_server_id=0)
 Constructor. More...
 
 getServer ()
 Get server. More...
 
 doAuthentication (\ilAuthStatus $status)
 Do authentication. More...
 
 createNewAccount (ilAuthStatus $status)
 Create new ILIAS account for external_account.
Parameters
ilAuthStatus
More...
 
 migrateAccount (ilAuthStatus $status)
 Create new account.
Parameters
ilAuthStatus
More...
 
 getTriggerAuthMode ()
 Get trigger auth mode. More...
 
 getUserAuthModeName ()
 Get user auth mode name. More...
 
 getExternalAccountName ()
 Get external account name. More...
 
 setExternalAccountName ($a_name)
 Set external account name. More...
 
- Public Member Functions inherited from ilAuthProvider
 __construct (ilAuthCredentials $credentials)
 Constructor. More...
 
 getLogger ()
 Get logger. More...
 
 getCredentials ()
 

Protected Member Functions

 updateAccount (ilAuthStatus $status, array $user)
 Update Account. More...
 
 initServer ($a_server_id)
 Init Server. More...
 
 changeKeyCase ($a_string)
 Change case similar to array_change_key_case, to avoid further encoding problems. More...
 
- Protected Member Functions inherited from ilAuthProvider
 handleAuthenticationFail (ilAuthStatus $status, $a_reason)
 Handle failed authentication. More...
 

Private Attributes

 $server = null
 
 $migration_account = ''
 
 $force_new_account = false
 

Additional Inherited Members

- Data Fields inherited from ilAuthProvider
const STATUS_UNDEFINED = 0
 
const STATUS_AUTHENTICATION_SUCCESS = 1
 
const STATUS_AUTHENTICATION_FAILED = 2
 
const STATUS_MIGRATION = 3
 

Detailed Description

Description of class class.

Author
Stefan Meyer smeye.nosp@m.r.il.nosp@m.ias@g.nosp@m.mx.d.nosp@m.e

Definition at line 15 of file class.ilAuthProviderLDAP.php.

Constructor & Destructor Documentation

◆ __construct()

ilAuthProviderLDAP::__construct ( \ilAuthCredentials  $credentials,
  $a_server_id = 0 
)

Constructor.

Parameters
\ilAuthCredentials$credentials

Definition at line 25 of file class.ilAuthProviderLDAP.php.

References initServer().

26  {
27  parent::__construct($credentials);
28  $this->initServer($a_server_id);
29  }
ilAuthProviderLDAP\initServer
initServer($a_server_id)
Init Server.
Definition: class.ilAuthProviderLDAP.php:162
+ Here is the call graph for this function:

Member Function Documentation

◆ changeKeyCase()

ilAuthProviderLDAP::changeKeyCase (   $a_string)
protected

Change case similar to array_change_key_case, to avoid further encoding problems.

Parameters
string$a_string
Returns
string

Definition at line 282 of file class.ilAuthProviderLDAP.php.

References array.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

283  {
284  $as_array = array_change_key_case(array($a_string => $a_string));
285  foreach($as_array as $key => $string)
286  {
287  return $key;
288  }
289  }
array
Create styles array
The data for the language used.
Definition: 40duplicateStyle.php:19
+ Here is the caller graph for this function:

◆ createNewAccount()

ilAuthProviderLDAP::createNewAccount ( ilAuthStatus  $status)

Create new ILIAS account for external_account.

Parameters
ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 173 of file class.ilAuthProviderLDAP.php.

References $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

174  {
175  $this->force_new_account = true;
176 
177  try
178  {
179  include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
180  $query = new ilLDAPQuery($this->getServer());
181  $query->bind(IL_LDAP_BIND_DEFAULT);
182  }
183  catch(ilLDAPQueryException $e)
184  {
185  $this->getLogger()->error('Cannot bind to LDAP server... '. $e->getMessage());
186  $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
187  return false;
188  }
189  try
190  {
191  // fetch user
192  $users = $query->fetchUser(
193  $this->getCredentials()->getUsername()
194  );
195  if(!$users)
196  {
197  $this->handleAuthenticationFail($status, 'err_wrong_login');
198  return false;
199  }
200  if(!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users))
201  {
202  $this->handleAuthenticationFail($status, 'err_wrong_login');
203  return false;
204  }
205  }
206  catch (ilLDAPQueryException $e) {
207  $this->getLogger()->error('Cannot fetch LDAP user data... '. $e->getMessage());
208  $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
209  return false;
210  }
211 
212  // authentication success update profile
213  $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
214  }
ilAuthProviderLDAP\updateAccount
updateAccount(ilAuthStatus $status, array $user)
Update Account.
Definition: class.ilAuthProviderLDAP.php:118
IL_LDAP_BIND_DEFAULT
const IL_LDAP_BIND_DEFAULT
Definition: class.ilLDAPQuery.php:24
ilAuthProvider\getLogger
getLogger()
Get logger.
Definition: class.ilAuthProvider.php:38
ilAuthProvider\handleAuthenticationFail
handleAuthenticationFail(ilAuthStatus $status, $a_reason)
Handle failed authentication.
Definition: class.ilAuthProvider.php:55
ilAuthProviderLDAP\changeKeyCase
changeKeyCase($a_string)
Change case similar to array_change_key_case, to avoid further encoding problems. ...
Definition: class.ilAuthProviderLDAP.php:282
+ Here is the call graph for this function:

◆ doAuthentication()

ilAuthProviderLDAP::doAuthentication ( \ilAuthStatus  $status)

Do authentication.

Parameters
\ilAuthStatus$status

Implements ilAuthProviderInterface.

Definition at line 45 of file class.ilAuthProviderLDAP.php.

References $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_AUTH, IL_LDAP_BIND_DEFAULT, and updateAccount().

46  {
47  try
48  {
49  // bind
50  include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
51  $query = new ilLDAPQuery($this->getServer());
52  $query->bind(IL_LDAP_BIND_DEFAULT);
53  }
54  catch(ilLDAPQueryException $e)
55  {
56  $this->getLogger()->error('Cannot bind to LDAP server... '. $e->getMessage());
57  $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
58  return false;
59  }
60  try
61  {
62  // Read user data, which does ensure a sucessful authentication.
63  $users = $query->fetchUser(
64  $this->getCredentials()->getUsername()
65  );
66 
67  if(!$users)
68  {
69  $this->handleAuthenticationFail($status, 'err_wrong_login');
70  return false;
71  }
72  if(!trim($this->getCredentials()->getPassword()))
73  {
74  $this->handleAuthenticationFail($status, 'err_wrong_login');
75  return false;
76  }
77  if(!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users))
78  {
79  $this->getLogger()->warning('Cannot find user: '. $this->changeKeyCase($this->getCredentials()->getUsername()));
80  $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
81  return false;
82  }
83 
84  // check group membership
85  if(!$query->checkGroupMembership(
86  $this->getCredentials()->getUsername(),
87  $users[$this->changeKeyCase($this->getCredentials()->getUsername())]
88  ))
89  {
90  $this->handleAuthenticationFail($status, 'err_wrong_login');
91  return false;
92  }
93  }
94  catch (ilLDAPQueryException $e) {
95  $this->getLogger()->error('Cannot fetch LDAP user data... '. $e->getMessage());
96  $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
97  return false;
98  }
99  try
100  {
101  // now bind with login credentials
102  $query->bind(IL_LDAP_BIND_AUTH, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]['dn'], $this->getCredentials()->getPassword());
103  }
104  catch (ilLDAPQueryException $e) {
105  $this->handleAuthenticationFail($status, 'err_wrong_login');
106  return false;
107  }
108 
109  // authentication success update profile
110  return $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
111  }
ilAuthProviderLDAP\updateAccount
updateAccount(ilAuthStatus $status, array $user)
Update Account.
Definition: class.ilAuthProviderLDAP.php:118
IL_LDAP_BIND_AUTH
const IL_LDAP_BIND_AUTH
Definition: class.ilLDAPQuery.php:27
IL_LDAP_BIND_DEFAULT
const IL_LDAP_BIND_DEFAULT
Definition: class.ilLDAPQuery.php:24
ilAuthProvider\getLogger
getLogger()
Get logger.
Definition: class.ilAuthProvider.php:38
ilAuthProvider\handleAuthenticationFail
handleAuthenticationFail(ilAuthStatus $status, $a_reason)
Handle failed authentication.
Definition: class.ilAuthProvider.php:55
ilAuthProviderLDAP\changeKeyCase
changeKeyCase($a_string)
Change case similar to array_change_key_case, to avoid further encoding problems. ...
Definition: class.ilAuthProviderLDAP.php:282
+ Here is the call graph for this function:

◆ getExternalAccountName()

ilAuthProviderLDAP::getExternalAccountName ( )

Get external account name.

Returns
string

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 263 of file class.ilAuthProviderLDAP.php.

References $migration_account.

264  {
265  return $this->migration_account;
266  }

◆ getServer()

ilAuthProviderLDAP::getServer ( )

Get server.

Returns

Definition at line 35 of file class.ilAuthProviderLDAP.php.

References $server.

Referenced by createNewAccount(), doAuthentication(), getTriggerAuthMode(), migrateAccount(), and updateAccount().

36  {
37  return $this->server;
38  }
+ Here is the caller graph for this function:

◆ getTriggerAuthMode()

ilAuthProviderLDAP::getTriggerAuthMode ( )

Get trigger auth mode.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 246 of file class.ilAuthProviderLDAP.php.

References AUTH_LDAP, and getServer().

247  {
248  return AUTH_LDAP.'_'.$this->getServer()->getServerId();
249  }
AUTH_LDAP
const AUTH_LDAP
Definition: class.ilAuthUtils.php:8
+ Here is the call graph for this function:

◆ getUserAuthModeName()

ilAuthProviderLDAP::getUserAuthModeName ( )

Get user auth mode name.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 254 of file class.ilAuthProviderLDAP.php.

255  {
256  return 'ldap_'.$this->getServer()->getServerId();
257  }

◆ initServer()

ilAuthProviderLDAP::initServer (   $a_server_id)
protected

Init Server.

Definition at line 162 of file class.ilAuthProviderLDAP.php.

Referenced by __construct().

163  {
164  include_once './Services/LDAP/classes/class.ilLDAPServer.php';
165  $this->server = new ilLDAPServer($a_server_id);
166  }
+ Here is the caller graph for this function:

◆ migrateAccount()

ilAuthProviderLDAP::migrateAccount ( ilAuthStatus  $status)

Create new account.

Parameters
ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 221 of file class.ilAuthProviderLDAP.php.

References $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

222  {
223  $this->force_new_account = true;
224 
225  try
226  {
227  include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
228  $query = new ilLDAPQuery($this->getServer());
229  $query->bind(IL_LDAP_BIND_DEFAULT);
230  }
231  catch(ilLDAPQueryException $e)
232  {
233  $this->getLogger()->error('Cannot bind to LDAP server... '. $e->getMessage());
234  $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
235  return false;
236  }
237 
238  $users = $query->fetchUser($this->getCredentials()->getUsername());
239  $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
240  return true;
241  }
ilAuthProviderLDAP\updateAccount
updateAccount(ilAuthStatus $status, array $user)
Update Account.
Definition: class.ilAuthProviderLDAP.php:118
IL_LDAP_BIND_DEFAULT
const IL_LDAP_BIND_DEFAULT
Definition: class.ilLDAPQuery.php:24
ilAuthProvider\getLogger
getLogger()
Get logger.
Definition: class.ilAuthProvider.php:38
ilAuthProvider\handleAuthenticationFail
handleAuthenticationFail(ilAuthStatus $status, $a_reason)
Handle failed authentication.
Definition: class.ilAuthProvider.php:55
ilAuthProviderLDAP\changeKeyCase
changeKeyCase($a_string)
Change case similar to array_change_key_case, to avoid further encoding problems. ...
Definition: class.ilAuthProviderLDAP.php:282
+ Here is the call graph for this function:

◆ setExternalAccountName()

ilAuthProviderLDAP::setExternalAccountName (   $a_name)

Set external account name.

Parameters
string$a_name

Definition at line 272 of file class.ilAuthProviderLDAP.php.

Referenced by updateAccount().

273  {
274  $this->migration_account = $a_name;
275  }
+ Here is the caller graph for this function:

◆ updateAccount()

ilAuthProviderLDAP::updateAccount ( ilAuthStatus  $status,
array  $user 
)
protected

Update Account.

Parameters
array$user
Returns
bool

Definition at line 118 of file class.ilAuthProviderLDAP.php.

References ilObjUser\_lookupId(), ilLogLevel\DEBUG, ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), ilAuthStatus\setAuthenticatedUserId(), setExternalAccountName(), ilAuthStatus\setStatus(), ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED, and ilAuthStatus\STATUS_AUTHENTICATED.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

119  {
120  $user = array_change_key_case($user,CASE_LOWER);
121  $this->getLogger()->dump($user, ilLogLevel::DEBUG);
122 
123  include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
124  $sync = new ilLDAPUserSynchronisation('ldap_'.$this->getServer()->getServerId(), $this->getServer()->getServerId());
125  $sync->setExternalAccount($this->getCredentials()->getUsername());
126  $sync->setUserData($user);
127  $sync->forceCreation($this->force_new_account);
128 
129  try {
130  $internal_account = $sync->sync();
131  $this->getLogger()->debug('Internal account: ' . $internal_account);
132  }
133  catch(UnexpectedValueException $e) {
134  $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
135  $this->handleAuthenticationFail($status, 'err_wrong_login');
136  return false;
137  }
138  catch(ilLDAPSynchronisationForbiddenException $e) {
139  // No syncronisation allowed => create Error
140  $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
141  $this->handleAuthenticationFail($status, 'err_auth_ldap_no_ilias_user');
142  return false;
143  }
144  catch(ilLDAPAccountMigrationRequiredException $e) {
145  // Account migration required
146  $this->setExternalAccountName($this->getCredentials()->getUsername());
147  $this->getLogger()->info('Authentication failed: account migration required for external account: ' . $this->getCredentials()->getUsername());
148  $status->setStatus(ilAuthStatus::STATUS_ACCOUNT_MIGRATION_REQUIRED);
149  return false;
150  }
151  $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
152  $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
153  return true;
154 
155  }
ilLDAPUserSynchronisation
Synchronization of user accounts used in auth container ldap, radius , cas,...
Definition: class.ilLDAPUserSynchronisation.php:14
ilObjUser\_lookupId
static _lookupId($a_user_str)
Lookup id by login.
Definition: class.ilObjUser.php:787
ilLDAPAccountMigrationRequiredException
Description of ilLDAPAccountMigrationRequiredException.
Definition: class.ilLDAPAccountMigrationRequiredException.php:12
ilAuthStatus\setAuthenticatedUserId
setAuthenticatedUserId($a_id)
Definition: class.ilAuthStatus.php:118
ilAuthStatus\setStatus
setStatus($a_status)
Set auth status.
Definition: class.ilAuthStatus.php:64
ilAuthProviderLDAP\setExternalAccountName
setExternalAccountName($a_name)
Set external account name.
Definition: class.ilAuthProviderLDAP.php:272
ilAuthProvider\getLogger
getLogger()
Get logger.
Definition: class.ilAuthProvider.php:38
ilAuthProvider\handleAuthenticationFail
handleAuthenticationFail(ilAuthStatus $status, $a_reason)
Handle failed authentication.
Definition: class.ilAuthProvider.php:55
ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED
const STATUS_ACCOUNT_MIGRATION_REQUIRED
Definition: class.ilAuthStatus.php:20
+ Here is the call graph for this function:
+ Here is the caller graph for this function:

Field Documentation

◆ $force_new_account

ilAuthProviderLDAP::$force_new_account = false
private

Definition at line 19 of file class.ilAuthProviderLDAP.php.

◆ $migration_account

ilAuthProviderLDAP::$migration_account = ''
private

Definition at line 18 of file class.ilAuthProviderLDAP.php.

Referenced by getExternalAccountName().

◆ $server

ilAuthProviderLDAP::$server = null
private

Definition at line 17 of file class.ilAuthProviderLDAP.php.

Referenced by getServer().

The documentation for this class was generated from the following file: