ilAuthProviderSaml Class Reference

Class ilAuthProviderSaml. More...

Inheritance diagram for ilAuthProviderSaml:

Collaboration diagram for ilAuthProviderSaml:

Public Member Functions
	__construct (\ilAuthFrontendCredentials $credentials, $a_idp_id=null)
	ilAuthProviderSaml constructor. More...
	doAuthentication (\ilAuthStatus $status)
	Do authentication. Parameters \ilAuthStatus $status Authentication status Returns bool More...
	handleSamlAuth (\ilAuthStatus $status)
	migrateAccount (ilAuthStatus $status)
	Create new account. Parameters ilAuthStatus More...
	createNewAccount (\ilAuthStatus $status)
	setExternalAccountName ($a_name)
	Set external account name. More...
	getExternalAccountName ()
	Get external account name. Returns string More...
	getTriggerAuthMode ()
	Get auth mode which triggered the account migration 2_1 for ldap account migration with server id 1 11 for apache auth. See also ilAuthUtils Returns string More...
	getUserAuthModeName ()
	Get user auth mode name ldap_1 for ldap account migration with server id 1 apache for apache auth. More...
	importUser ($a_internal_login, $a_external_account, $a_user_data=array())
Public Member Functions inherited from ilAuthProvider
	__construct (ilAuthCredentials $credentials)
	Constructor. More...
	getLogger ()
	Get logger. More...
	getCredentials ()
	doAuthentication (\ilAuthStatus $status)
	Do authentication. More...
Public Member Functions inherited from ilAuthProviderAccountMigrationInterface
	getTriggerAuthMode ()
	Get auth mode which triggered the account migration 2_1 for ldap account migration with server id 1 11 for apache auth. More...
	getUserAuthModeName ()
	Get user auth mode name ldap_1 for ldap account migration with server id 1 apache for apache auth. More...
	getExternalAccountName ()
	Get external account name. More...
	migrateAccount (ilAuthStatus $status)
	Create new account. More...
	createNewAccount (ilAuthStatus $status)
	Create new ILIAS account for external_account. More...

Protected Member Functions
	buildUserAttributeXml (\ilXmlWriter $xml_writer, \ilExternalAuthUserAttributeMappingRule $rule, $value)
Protected Member Functions inherited from ilAuthProvider
	handleAuthenticationFail (ilAuthStatus $status, $a_reason)
	Handle failed authentication. More...

Protected Attributes
	$uid = ''
	$attributes = array()
	$return_to = ''
	$idp
	$force_new_account = false
	$migration_account = ''

Private Member Functions
	determineUidFromAttributes ()

Additional Inherited Members
Data Fields inherited from ilAuthProvider
const	STATUS_UNDEFINED = 0
const	STATUS_AUTHENTICATION_SUCCESS = 1
const	STATUS_AUTHENTICATION_FAILED = 2
const	STATUS_MIGRATION = 3

Detailed Description

Class ilAuthProviderSaml.

Definition at line 7 of file class.ilAuthProviderSaml.php.

Constructor & Destructor Documentation

__construct()

ilAuthProviderSaml::__construct	(	\ilAuthFrontendCredentials	$credentials,
			$a_idp_id = null
	)

ilAuthProviderSaml constructor.

Parameters

\ilAuthFrontendCredentials | \ilAuthFrontendCredentialsSaml	$credentials
null	$a_idp_id

Definition at line 44 of file class.ilAuthProviderSaml.php.

    {
        parent::__construct($credentials);
 
        if (null === $a_idp_id) {
            $this->idp = ilSamlIdp::getFirstActiveIdp();
        } else {
            $this->idp = ilSamlIdp::getInstanceByIdpId($a_idp_id);
        }
 
        if ($credentials instanceof \ilAuthFrontendCredentialsSaml) {
            $this->attributes = $credentials->getAttributes();
            $this->return_to  = $credentials->getReturnTo();
        }
    }

References ilAuthProvider\$credentials, ilSamlIdp\getFirstActiveIdp(), and ilSamlIdp\getInstanceByIdpId().

Here is the call graph for this function:

Member Function Documentation

buildUserAttributeXml()

ilAuthProviderSaml::buildUserAttributeXml ( \ilXmlWriter  $xml_writer, \ilExternalAuthUserAttributeMappingRule  $rule,   $value  )

protected

Parameters

\ilXmlWriter	$xml_writer
\ilExternalAuthUserAttributeMappingRule	$rule
	$value

Definition at line 348 of file class.ilAuthProviderSaml.php.

    {
        switch (strtolower($rule->getAttribute())) {
            case 'gender':
                switch (strtolower($value)) {
                    case 'n':
                    case 'neutral':
                        $xml_writer->xmlElement('Gender', array(), 'n');
                        break;
 
                    case 'm':
                    case 'male':
                        $xml_writer->xmlElement('Gender', array(), 'm');
                        break;
 
                    case 'f':
                    case 'female':
                    default:
                        $xml_writer->xmlElement('Gender', array(), 'f');
                        break;
                }
                break;
 
            case 'firstname':
                $xml_writer->xmlElement('Firstname', array(), $value);
                break;
 
            case 'lastname':
                $xml_writer->xmlElement('Lastname', array(), $value);
                break;
 
            case 'email':
                $xml_writer->xmlElement('Email', array(), $value);
                break;
 
            case 'institution':
                $xml_writer->xmlElement('Institution', array(), $value);
                break;
 
            case 'department':
                $xml_writer->xmlElement('Department', array(), $value);
                break;
 
            case 'hobby':
                $xml_writer->xmlElement('Hobby', array(), $value);
                break;
 
            case 'title':
                $xml_writer->xmlElement('Title', array(), $value);
                break;
 
            case 'street':
                $xml_writer->xmlElement('Street', array(), $value);
                break;
 
            case 'city':
                $xml_writer->xmlElement('City', array(), $value);
                break;
 
            case 'zipcode':
                $xml_writer->xmlElement('PostalCode', array(), $value);
                break;
 
            case 'country':
                $xml_writer->xmlElement('Country', array(), $value);
                break;
 
            case 'phone_office':
                $xml_writer->xmlElement('PhoneOffice', array(), $value);
                break;
 
            case 'phone_home':
                $xml_writer->xmlElement('PhoneHome', array(), $value);
                break;
 
            case 'phone_mobile':
                $xml_writer->xmlElement('PhoneMobile', array(), $value);
                break;
 
            case 'fax':
                $xml_writer->xmlElement('Fax', array(), $value);
                break;
 
            case 'referral_comment':
                $xml_writer->xmlElement('Comment', array(), $value);
                break;
 
            case 'matriculation':
                $xml_writer->xmlElement('Matriculation', array(), $value);
                break;
 
            case 'birthday':
                $xml_writer->xmlElement('Birthday', array(), $value);
                break;
 
            default:
                if (substr($rule->getAttribute(), 0, 4) != 'udf_') {
                    break;
                }
 
                $udf_data = explode('_', $rule->getAttribute());
                if (!isset($udf_data[1])) {
                    break;
                }
 
                $definition = ilUserDefinedFields::_getInstance()->getDefinition($udf_data[1]);
                $xml_writer->xmlElement(
                    'UserDefinedField',
                    array('Id' => $definition['il_id'], 'Name' => $definition['field_name']),
                    $value
                );
                break;
        }
    }

References $rule, ilUserDefinedFields\_getInstance(), and ilXmlWriter\xmlElement().

Referenced by importUser().

Here is the call graph for this function:

Here is the caller graph for this function:

createNewAccount()

ilAuthProviderSaml::createNewAccount

(

\ilAuthStatus

$status

)

Definition at line 213 of file class.ilAuthProviderSaml.php.

    {
        if (
            0 === strlen($this->getCredentials()->getUsername()) ||
            !is_array(ilSession::get('tmp_attributes')) ||
            0 === count(ilSession::get('tmp_attributes'))
        ) {
            $this->getLogger()->warning('Cannot find user id for external account: ' . $this->getCredentials()->getUsername());
            $this->handleAuthenticationFail($status, 'err_wrong_login');
            return false;
        }
 
        $this->uid        = $this->getCredentials()->getUsername();
        $this->attributes = ilSession::get('tmp_attributes');
        $this->return_to  = ilSession::get('tmp_return_to');
 
        $this->force_new_account = true;
        return $this->handleSamlAuth($status);
    }

References ilSession\get(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), ilAuthProvider\handleAuthenticationFail(), and handleSamlAuth().

Here is the call graph for this function:

determineUidFromAttributes()

ilAuthProviderSaml::determineUidFromAttributes ( )

private

Exceptions

ilException

Definition at line 63 of file class.ilAuthProviderSaml.php.

    {
        if (
            !array_key_exists($this->idp->getUidClaim(), $this->attributes) ||
            !is_array($this->attributes[$this->idp->getUidClaim()]) ||
            !array_key_exists(0, $this->attributes[$this->idp->getUidClaim()]) ||
            0 === strlen($this->attributes[$this->idp->getUidClaim()][0])
        ) {
            throw new \ilException(sprintf(
                'Could not find unique SAML attribute for the configured identifier: %s',
                var_export($this->idp->getUidClaim(), 1)
            ));
        }
 
        $this->uid = $this->attributes[$this->idp->getUidClaim()][0];
    }

References sprintf.

Referenced by doAuthentication().

Here is the caller graph for this function:

doAuthentication()

ilAuthProviderSaml::doAuthentication

(

\ilAuthStatus

$status

)

Do authentication.

Parameters

\ilAuthStatus

$status

Authentication status

Returns

bool

Implements ilAuthProviderInterface.

Definition at line 83 of file class.ilAuthProviderSaml.php.

    {
        if (!is_array($this->attributes) || 0 === count($this->attributes)) {
            $this->getLogger()->warning('Could not parse any attributes from SAML response.');
            $this->handleAuthenticationFail($status, 'err_wrong_login');
            return false;
        }
 
        try {
            $this->determineUidFromAttributes();
 
            return $this->handleSamlAuth($status);
        } catch (\ilException $e) {
            $this->getLogger()->warning($e->getMessage());
            $this->handleAuthenticationFail($status, 'err_wrong_login');
            return false;
        }
    }

References determineUidFromAttributes(), ilAuthProvider\getLogger(), ilAuthProvider\handleAuthenticationFail(), and handleSamlAuth().

Here is the call graph for this function:

getExternalAccountName()

ilAuthProviderSaml::getExternalAccountName

(

)

Get external account name.

Returns

string

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 245 of file class.ilAuthProviderSaml.php.

    {
        return $this->migration_account;
    }

References $migration_account.

getTriggerAuthMode()

ilAuthProviderSaml::getTriggerAuthMode

(

)

Get auth mode which triggered the account migration 2_1 for ldap account migration with server id 1 11 for apache auth.

See also

ilAuthUtils

Returns

string

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 253 of file class.ilAuthProviderSaml.php.

    {
        return AUTH_SAML . '_' . $this->idp->getIdpId();
    }

References AUTH_SAML.

Referenced by handleSamlAuth().

Here is the caller graph for this function:

getUserAuthModeName()

ilAuthProviderSaml::getUserAuthModeName

(

)

Get user auth mode name ldap_1 for ldap account migration with server id 1 apache for apache auth.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 261 of file class.ilAuthProviderSaml.php.

    {
        return 'saml_' . $this->idp->getIdpId();
    }

Referenced by handleSamlAuth(), and importUser().

Here is the caller graph for this function:

handleSamlAuth()

ilAuthProviderSaml::handleSamlAuth

(

\ilAuthStatus

$status

)

Parameters

ilAuthStatus

$status

Returns

bool

Definition at line 106 of file class.ilAuthProviderSaml.php.

    {
        $update_auth_mode = false;
 
        ilLoggerFactory::getLogger('auth')->debug(sprintf('Login observer called for SAML authentication request of ext_account "%s" and auth_mode "%s".', $this->uid, $this->getUserAuthModeName()));
        ilLoggerFactory::getLogger('auth')->debug(sprintf('Target set to: %s', var_export($this->return_to, 1)));
        ilLoggerFactory::getLogger('auth')->debug(sprintf('Trying to find ext_account "%s" for auth_mode "%s".', $this->uid, $this->getUserAuthModeName()));
 
        $internal_account = ilObjUser::_checkExternalAuthAccount(
            $this->getUserAuthModeName(),
            $this->uid,
            false
        );
 
        if (strlen($internal_account) == 0) {
            $update_auth_mode = true;
 
            ilLoggerFactory::getLogger('auth')->debug(sprintf('Could not find ext_account "%s" for auth_mode "%s".', $this->uid, $this->getUserAuthModeName()));
 
            $fallback_auth_mode = 'local';
            ilLoggerFactory::getLogger('auth')->debug(sprintf('Trying to find ext_account "%s" for auth_mode "%s".', $this->uid, $fallback_auth_mode));
            $internal_account = ilObjUser::_checkExternalAuthAccount($fallback_auth_mode, $this->uid, false);
 
            if (!defined('AUTH_DEFAULT')) {
                define('AUTH_DEFAULT', $GLOBALS['DIC']['ilSetting']->get('auth_mode') ? $GLOBALS['DIC']['ilSetting']->get('auth_mode') : AUTH_LOCAL);
            }
 
            if (strlen($internal_account) == 0 && (AUTH_DEFAULT == AUTH_LOCAL || AUTH_DEFAULT == $this->getTriggerAuthMode())) {
                ilLoggerFactory::getLogger('auth')->debug(sprintf('Could not find ext_account "%s" for auth_mode "%s".', $this->uid, $fallback_auth_mode));
 
                $fallback_auth_mode = 'default';
                ilLoggerFactory::getLogger('auth')->debug(sprintf('Trying to find ext_account "%s" for auth_mode "%s".', $this->uid, $fallback_auth_mode));
                $internal_account = ilObjUser::_checkExternalAuthAccount($fallback_auth_mode, $this->uid, false);
            }
        }
 
        if (strlen($internal_account) > 0) {
            ilLoggerFactory::getLogger('auth')->debug(sprintf('Found user "%s" for ext_account "%s" in ILIAS database.', $internal_account, $this->uid));
 
            if ($this->idp->isSynchronizationEnabled()) {
                ilLoggerFactory::getLogger('auth')->debug(sprintf('SAML user synchronisation is enabled, so update existing user "%s" with ext_account "%s".', $internal_account, $this->uid));
                $internal_account = $this->importUser($internal_account, $this->uid, $this->attributes);
            }
 
            if ($update_auth_mode) {
                $usr_id = ilObjUser::_loginExists($internal_account);
                if ($usr_id > 0) {
                    ilObjUser::_writeAuthMode($usr_id, $this->getUserAuthModeName());
                    ilLoggerFactory::getLogger('auth')->debug(sprintf('SAML Switched auth_mode of user with login "%s" and ext_account "%s" to "%s".', $internal_account, $this->uid, $this->getUserAuthModeName()));
                } else {
                    ilLoggerFactory::getLogger('auth')->debug(sprintf('SAML Could not switch auth_mode of user with login "%s" and ext_account "%s" to "%s".', $internal_account, $this->uid, $this->getUserAuthModeName()));
                }
            }
 
            ilLoggerFactory::getLogger('auth')->debug(sprintf('Authentication succeeded: Found internal login "%s for ext_account "%s" and auth_mode "%s".', $internal_account, $this->uid, $this->getUserAuthModeName()));
 
            $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
            $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
            ilSession::set('used_external_auth', true);
            return true;
        } else {
            ilLoggerFactory::getLogger('auth')->debug(sprintf('Could not find an existing user for ext_account "%s" for any relevant auth_mode.', $this->uid));
            if ($this->idp->isSynchronizationEnabled()) {
                ilLoggerFactory::getLogger('auth')->debug(sprintf('SAML user synchronisation is enabled, so determine action for ext_account "%s" and auth_mode "%s".', $this->uid, $this->getUserAuthModeName()));
                if ($this->idp->isAccountMigrationEnabled() && !$this->force_new_account) {
                    ilSession::set('tmp_attributes', $this->attributes);
                    ilSession::set('tmp_return_to', $this->return_to);
 
                    ilLoggerFactory::getLogger('auth')->debug(sprintf('Account migration is enabled, so redirecting ext_account "%s" to account migration screen.', $this->uid));
 
                    $this->setExternalAccountName($this->uid);
                    $status->setStatus(ilAuthStatus::STATUS_ACCOUNT_MIGRATION_REQUIRED);
                    return false;
                }
 
                $new_name = $this->importUser(null, $this->uid, $this->attributes);
                ilLoggerFactory::getLogger('auth')->debug(sprintf('Created new user account with login "%s" and ext_account "%s".', $new_name, $this->uid));
 
                ilSession::set('tmp_attributes', null);
                ilSession::set('tmp_return_to', null);
                ilSession::set('used_external_auth', true);
 
                if (strlen($this->return_to)) {
                    $_GET['target'] = $this->return_to;
                }
 
                $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
                $status->setAuthenticatedUserId(ilObjUser::_lookupId($new_name));
                return true;
            } else {
                ilLoggerFactory::getLogger('auth')->debug("SAML user synchronisation is not enabled, auth failed.");
                $this->handleAuthenticationFail($status, 'err_auth_saml_no_ilias_user');
                return false;
            }
        }
    }

References $_GET, $GLOBALS, $return_to, ilAuthProvider\$status, ilObjUser\_checkExternalAuthAccount(), ilObjUser\_loginExists(), ilObjUser\_lookupId(), ilObjUser\_writeAuthMode(), AUTH_LOCAL, defined, ilLoggerFactory\getLogger(), getTriggerAuthMode(), getUserAuthModeName(), ilAuthProvider\handleAuthenticationFail(), importUser(), ilSession\set(), setExternalAccountName(), ilAuthStatus\setStatus(), sprintf, ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED, and ilAuthStatus\STATUS_AUTHENTICATED.

Referenced by createNewAccount(), and doAuthentication().

Here is the call graph for this function:

Here is the caller graph for this function:

importUser()

ilAuthProviderSaml::importUser	(		$a_internal_login,
			$a_external_account,
			$a_user_data = array()
	)

Parameters

string | null	$a_internal_login
string	$a_external_account
array	$a_user_data

Returns

string

Definition at line 272 of file class.ilAuthProviderSaml.php.

    {
        $mapping = new ilExternalAuthUserAttributeMapping('saml', $this->idp->getIdpId());
 
        $xml_writer = new ilXmlWriter();
        $xml_writer->xmlStartTag('Users');
        if (null === $a_internal_login) {
            $login = $a_user_data[$this->idp->getLoginClaim()][0];
            $login = ilAuthUtils::_generateLogin($login);
 
            $xml_writer->xmlStartTag('User', array('Action' => 'Insert'));
            $xml_writer->xmlElement('Login', array(), $login);
 
            $xml_writer->xmlElement('Role', array(
                'Id'     => $this->idp->getDefaultRoleId(),
                'Type'   => 'Global',
                'Action' => 'Assign'
            ));
 
            $xml_writer->xmlElement('Active', array(), "true");
            $xml_writer->xmlElement('TimeLimitOwner', array(), USER_FOLDER_ID);
            $xml_writer->xmlElement('TimeLimitUnlimited', array(), 1);
            $xml_writer->xmlElement('TimeLimitFrom', array(), time());
            $xml_writer->xmlElement('TimeLimitUntil', array(), time());
            $xml_writer->xmlElement('AuthMode', array('type' => $this->getUserAuthModeName()), $this->getUserAuthModeName());
            $xml_writer->xmlElement('ExternalAccount', array(), $a_external_account);
 
            $mapping = new ilExternalAuthUserCreationAttributeMappingFilter($mapping);
        } else {
            $login  = $a_internal_login;
            $usr_id = ilObjUser::_lookupId($a_internal_login);
 
            $xml_writer->xmlStartTag('User', array('Action' => 'Update', 'Id' => $usr_id));
 
            $loginClaim = $a_user_data[$this->idp->getLoginClaim()][0];
            if ($login != $loginClaim) {
                $login = ilAuthUtils::_generateLogin($loginClaim);
                $xml_writer->xmlElement('Login', array(), $login);
            }
 
            $mapping = new ilExternalAuthUserUpdateAttributeMappingFilter($mapping);
        }
 
        foreach ($mapping as $rule) {
            try {
                $attributeValueParser = new ilSamlMappedUserAttributeValueParser($rule, $a_user_data);
                $value = $attributeValueParser->parse();
                $this->buildUserAttributeXml($xml_writer, $rule, $value);
            } catch (\ilSamlException $e) {
                $this->getLogger()->warning($e->getMessage());
                continue;
            }
        }
 
        $xml_writer->xmlEndTag('User');
        $xml_writer->xmlEndTag('Users');
 
        ilLoggerFactory::getLogger('auth')->debug(sprintf('Started import of user "%s" with ext_account "%s" and auth_mode "%s".', $login, $a_external_account, $this->getUserAuthModeName()));
        include_once './Services/User/classes/class.ilUserImportParser.php';
        $importParser = new ilUserImportParser();
        $importParser->setXMLContent($xml_writer->xmlDumpMem(false));
        $importParser->setRoleAssignment(array(
            $this->idp->getDefaultRoleId() => $this->idp->getDefaultRoleId()
        ));
        $importParser->setFolderId(USER_FOLDER_ID);
        $importParser->setUserMappingMode(IL_USER_MAPPING_ID);
        $importParser->startParsing();
 
        return $login;
    }

References $rule, ilAuthUtils\_generateLogin(), ilObjUser\_lookupId(), buildUserAttributeXml(), ilLoggerFactory\getLogger(), ilAuthProvider\getLogger(), getUserAuthModeName(), IL_USER_MAPPING_ID, sprintf, and USER_FOLDER_ID.

Referenced by handleSamlAuth().

Here is the call graph for this function:

Here is the caller graph for this function:

migrateAccount()

ilAuthProviderSaml::migrateAccount

(

ilAuthStatus

$status

)

Create new account.

Parameters

ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 206 of file class.ilAuthProviderSaml.php.

    {
    }

setExternalAccountName()

ilAuthProviderSaml::setExternalAccountName

(

$a_name

)

Set external account name.

Parameters

string

$a_name

Definition at line 237 of file class.ilAuthProviderSaml.php.

    {
        $this->migration_account = $a_name;
    }

Referenced by handleSamlAuth().

Here is the caller graph for this function:

Field Documentation

$attributes

ilAuthProviderSaml::$attributes = array()

protected

Definition at line 17 of file class.ilAuthProviderSaml.php.

$force_new_account

ilAuthProviderSaml::$force_new_account = false

protected

Definition at line 32 of file class.ilAuthProviderSaml.php.

$idp

ilAuthProviderSaml::$idp

protected

Definition at line 27 of file class.ilAuthProviderSaml.php.

$migration_account

ilAuthProviderSaml::$migration_account = ''

protected

Definition at line 37 of file class.ilAuthProviderSaml.php.

Referenced by getExternalAccountName().

$return_to

ilAuthProviderSaml::$return_to = ''

protected

Definition at line 22 of file class.ilAuthProviderSaml.php.

Referenced by handleSamlAuth().

$uid

ilAuthProviderSaml::$uid = ''

protected

Definition at line 12 of file class.ilAuthProviderSaml.php.

---

The documentation for this class was generated from the following file:

• Services/Saml/classes/class.ilAuthProviderSaml.php