class.ilAuthProviderCAS.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2010 ILIAS open source, Extended GPL, see docs/LICENSE */

include_once './Services/Authentication/classes/Provider/class.ilAuthProvider.php';
include_once './Services/Authentication/interfaces/interface.ilAuthProviderInterface.php';

class ilAuthProviderCAS extends ilAuthProvider implements ilAuthProviderInterface
{
        private $settings = null;

        public function __construct(ilAuthCredentials $credentials)
        {
                global $DIC;

                parent::__construct($credentials);
                include_once './Services/CAS/classes/class.ilCASSettings.php';
                $this->settings = ilCASSettings::getInstance();
        }

        protected function getSettings()
        {
                return $this->settings;
        }

        public function doAuthentication(\ilAuthStatus $status)
        {
                include_once './Services/CAS/lib/CAS.php';
                global $phpCAS;

                $this->getLogger()->debug('Starting cas authentication attempt... ');

                try {
                        phpCAS::setDebug(false);
                        phpCAS::setVerbose(true);
                        phpCAS::client(
                                CAS_VERSION_2_0,
                                $this->getSettings()->getServer(),
                                (int) $this->getSettings()->getPort(),
                                $this->getSettings()->getUri()
                        );

                        phpCAS::setNoCasServerValidation();
                        phpCAS::forceAuthentication();
                }
                catch(Exception $e) {
                        $this->getLogger()->error('Cas authentication failed with message: ' . $e->getMessage());
                        $this->handleAuthenticationFail($status, 'err_wrong_login');
                        return false;
                }

                if(!strlen(phpCAS::getUser()))
                {
                        return $this->handleAuthenticationFail($status, 'err_wrong_login');
                }
                $this->getCredentials()->setUsername(phpCAS::getUser());

                // check and handle ldap data sources
                include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                if(ilLDAPServer::isDataSourceActive(AUTH_CAS))
                {
                        return $this->handleLDAPDataSource($status);
                }

                // Check account available
                $local_user = ilObjUser::_checkExternalAuthAccount("cas", $this->getCredentials()->getUsername());
                if(strlen($local_user))
                {
                        $this->getLogger()->debug('CAS authentication successful.');
                        $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
                        $status->setAuthenticatedUserId(ilObjUser::_lookupId($local_user));
                        return true;
                }

                if(!$this->getSettings()->isUserCreationEnabled())
                {
                        $this->getLogger()->debug('User creation disabled. No valid local account found');
                        $this->handleAuthenticationFail($status, 'err_auth_cas_no_ilias_user');
                        return false;
                }


                include_once './Services/CAS/classes/class.ilCASAttributeToUser.php';
                $importer = new ilCASAttributeToUser($this->getSettings());
                $new_name = $importer->create($this->getCredentials()->getUsername());

                if(!strlen($new_name))
                {
                        $this->getLogger()->debug('User creation failed.');
                        $this->handleAuthenticationFail($status, 'err_auth_cas_no_ilias_user');
                        return false;
                }

                $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
                $status->setAuthenticatedUserId(ilObjUser::_lookupId($new_name));
                return true;
        }

        protected function handleLDAPDataSource(\ilAuthStatus $status)
        {
                include_once './Services/LDAP/classes/class.ilLDAPServer.php';
                $server = ilLDAPServer::getInstanceByServerId(
                        ilLDAPServer::getDataSource(AUTH_CAS)
                );

                $this->getLogger()->debug('Using ldap data source for user: ' . $this->getCredentials()->getUsername());

                include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
                $sync = new ilLDAPUserSynchronisation('cas', $server->getServerId());
                $sync->setExternalAccount($this->getCredentials()->getUsername());
                $sync->setUserData(array());
                $sync->forceCreation(true);

                try {
                        $internal_account = $sync->sync();
                }
                catch(UnexpectedValueException $e) {
                        $this->getLogger()->warning('Authentication failed with mesage: ' . $e->getMessage());
                        $this->handleAuthenticationFail($status, 'err_wrong_login');
                        return false;
                }
                catch(ilLDAPSynchronisationForbiddenException $e) {

                        // No syncronisation allowed => create Error
                        $this->getLogger()->warning('User creation disabled. No valid local account found');
                        $this->handleAuthenticationFail($status, 'err_auth_cas_no_ilias_user');
                        return false;
                }
                catch(ilLDAPAccountMigrationRequiredException $e) {

                        // No syncronisation allowed => create Error
                        $this->getLogger()->warning('User creation disabled. No valid local account found');
                        $this->handleAuthenticationFail($status, 'err_auth_cas_no_ilias_user');
                        return false;
                }
                $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
                $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
                return true;
        }

}