class.ilAuthContainerCAS.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2009 ILIAS open source, Extended GPL, see docs/LICENSE */

include_once 'Auth/Container.php';


class ilAuthContainerCAS extends Auth_Container
{
    protected $server_version = null;
    protected $server_hostname = null;
    protected $server_port = null;
    protected $server_uri = null;


    public function __construct()
    {
        parent::__construct();
        $this->initCAS();
    }

    public function forceAuthentication($username, $status, $auth)
    {
        global $PHPCAS_CLIENT,$ilLog;
        
        if (!$PHPCAS_CLIENT->isAuthenticated()) {
            $PHPCAS_CLIENT->forceAuthentication();
        }
    }
    
    public function loginObserver($a_username, $a_auth)
    {
        global $ilias, $rbacadmin, $ilSetting,$ilLog,$PHPCAS_CLIENT;
        
        $ilLog->write(__METHOD__ . ': Successful CAS login.');

        // Radius with ldap as data source
        include_once './Services/LDAP/classes/class.ilLDAPServer.php';
        if (ilLDAPServer::isDataSourceActive(AUTH_CAS)) {
            return $this->handleLDAPDataSource($a_auth, $a_username);
        }
        
        include_once("./Services/CAS/lib/CAS.php");
        if ($PHPCAS_CLIENT->getUser() != "") {
            $username = $PHPCAS_CLIENT->getUser();
            $ilLog->write(__METHOD__ . ': Username: ' . $username);

            // Authorize this user
            include_once('./Services/User/classes/class.ilObjUser.php');
            $local_user = ilObjUser::_checkExternalAuthAccount("cas", $username);

            if ($local_user != "") {
                $a_auth->setAuth($local_user);
            } else {
                if (!$ilSetting->get("cas_create_users")) {
                    $a_auth->status = AUTH_CAS_NO_ILIAS_USER;
                    $a_auth->logout();
                    return false;
                }
                
                $userObj = new ilObjUser();
                
                $local_user = ilAuthUtils::_generateLogin($username);
                
                $newUser["firstname"] = $local_user;
                $newUser["lastname"] = "";
                
                $newUser["login"] = $local_user;
                
                // set "plain md5" password (= no valid password)
                $newUser["passwd"] = "";
                $newUser["passwd_type"] = IL_PASSWD_CRYPTED;
                                
                //$newUser["gender"] = "m";
                $newUser["auth_mode"] = "cas";
                $newUser["ext_account"] = $username;
                $newUser["profile_incomplete"] = 1;
                
                // system data
                $userObj->assignData($newUser);
                $userObj->setTitle($userObj->getFullname());
                $userObj->setDescription($userObj->getEmail());
            
                // set user language to system language
                $userObj->setLanguage($ilSetting->get("language"));
                
                // Time limit
                $userObj->setTimeLimitOwner(7);
                $userObj->setTimeLimitUnlimited(1);
                $userObj->setTimeLimitFrom(time());
                $userObj->setTimeLimitUntil(time());
                                
                // Create user in DB
                $userObj->setOwner(0);
                $userObj->create();
                $userObj->setActive(1);
                
                $userObj->updateOwner();
                
                //insert user data in table user_data
                $userObj->saveAsNew();
                
                // setup user preferences
                $userObj->writePrefs();
                
                // to do: test this
                $rbacadmin->assignUser($ilSetting->get('cas_user_default_role'), $userObj->getId(), true);
                unset($userObj);
                
                $a_auth->setAuth($local_user);
                return true;
            }
        } else {
            $ilLog->write(__METHOD__ . ': Login failed.');

            // This should never occur unless CAS is not configured properly
            $a_auth->status = AUTH_WRONG_LOGIN;
            return false;
        }
        return false;
    }

    protected function handleLDAPDataSource($a_auth, $ext_account)
    {
        include_once './Services/LDAP/classes/class.ilLDAPServer.php';
        $server = ilLDAPServer::getInstanceByServerId(
            ilLDAPServer::getDataSource(AUTH_CAS)
        );

        $GLOBALS['ilLog']->write(__METHOD__ . ' Using ldap data source for user: ' . $ext_account);

        include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
        $sync = new ilLDAPUserSynchronisation('cas', $server->getServerId());
        $sync->setExternalAccount($ext_account);
        $sync->setUserData(array());
        #$sync->forceCreation($this->force_creation);
        // TODO: Check this
        $sync->forceCreation(true);

        try {
            $internal_account = $sync->sync();
        } catch (UnexpectedValueException $e) {
            $GLOBALS['ilLog']->write(__METHOD__ . ': Login failed with message: ' . $e->getMessage());
            $a_auth->status = AUTH_WRONG_LOGIN;
            $a_auth->logout();
            return false;
        } catch (ilLDAPSynchronisationForbiddenException $e) {
            // No syncronisation allowed => create Error
            $GLOBALS['ilLog']->write(__METHOD__ . ': Login failed with message: ' . $e->getMessage());
            $a_auth->status = AUTH_CAS_NO_ILIAS_USER;
            $a_auth->logout();
            return false;
        } catch (ilLDAPAccountMigrationRequiredException $e) {
            $GLOBALS['ilLog']->write(__METHOD__ . ': Starting account migration.');
            $a_auth->logout();
            ilUtil::redirect('ilias.php?baseClass=ilStartUpGUI&cmdClass=ilstartupgui&cmd=showAccountMigration');
        }
        $a_auth->setAuth($internal_account);
        return true;
    }

    
    
    public function fetchData($a_username, $a_password, $isChallengeResponse = false)
    {
        global $PHPCAS_CLIENT,$ilLog;
        
        $ilLog->write(__METHOD__ . ': Fetch Data called');
        return $PHPCAS_CLIENT->isAuthenticated();
    }
    
    protected function initCAS()
    {
        global $ilSetting;
        
        include_once("./Services/CAS/lib/CAS.php");

        $this->server_version = CAS_VERSION_2_0;
        $this->server_hostname = $ilSetting->get('cas_server');
        $this->server_port = (int) $ilSetting->get('cas_port');
        $this->server_uri = (string) $ilSetting->get('cas_uri');
        
        phpCAS::setDebug();
        phpCAS::client(
            $this->server_version,
            $this->server_hostname,
            $this->server_port,
            $this->server_uri
        );
        phpCAS::setNoCasServerValidation();
    }
}