ILIAS  release_5-4 Revision v5.4.26-12-gabc799a52e6
authpage.php
Go to the documentation of this file.
1 <?php
2 
12 if (!isset($_REQUEST['ReturnTo'])) {
13  die('Missing ReturnTo parameter.');
14 }
15 
16 $returnTo = \SimpleSAML\Utils\HTTP::checkURLAllowed($_REQUEST['ReturnTo']);
17 
18 
19 /*
20  * The following piece of code would never be found in a real authentication page. Its
21  * purpose in this example is to make this example safer in the case where the
22  * administrator of * the IdP leaves the exampleauth-module enabled in a production
23  * environment.
24  *
25  * What we do here is to extract the $state-array identifier, and check that it belongs to
26  * the exampleauth:External process.
27  */
28 
29 if (!preg_match('@State=(.*)@', $returnTo, $matches)) {
30  die('Invalid ReturnTo URL for this example.');
31 }
32 SimpleSAML_Auth_State::loadState(urldecode($matches[1]), 'exampleauth:External');
33 
34 /*
35  * The loadState-function will not return if the second parameter does not
36  * match the parameter passed to saveState, so by now we know that we arrived here
37  * through the exampleauth:External authentication page.
38  */
39 
40 
41 /*
42  * Our list of users.
43  */
44 $users = array(
45  'student' => array(
46  'password' => 'student',
47  'uid' => 'student',
48  'name' => 'Student Name',
49  'mail' => 'somestudent@example.org',
50  'type' => 'student',
51  ),
52  'admin' => array(
53  'password' => 'admin',
54  'uid' => 'admin',
55  'name' => 'Admin Name',
56  'mail' => 'someadmin@example.org',
57  'type' => 'employee',
58  ),
59 );
60 
61 
62 /*
63  * Time to handle login responses.
64  * Since this is a dummy example, we accept any data.
65  */
66 
67 $badUserPass = FALSE;
68 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
69  $username = (string)$_REQUEST['username'];
70  $password = (string)$_REQUEST['password'];
71 
72  if (!isset($users[$username]) || $users[$username]['password'] !== $password) {
73  $badUserPass = TRUE;
74  } else {
75 
76  $user = $users[$username];
77 
78  if (!session_id()) {
79  // session_start not called before. Do it here.
80  session_start();
81  }
82 
83  $_SESSION['uid'] = $user['uid'];
84  $_SESSION['name'] = $user['name'];
85  $_SESSION['mail'] = $user['mail'];
86  $_SESSION['type'] = $user['type'];
87 
88  \SimpleSAML\Utils\HTTP::redirectTrustedURL($returnTo);
89  }
90 }
91 
92 
93 /*
94  * If we get this far, we need to show the login page to the user.
95  */
96 ?><!DOCTYPE html>
97 <html>
98 <head>
99 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
100 <title>exampleauth login page</title>
101 </head>
102 <body>
103 <h1>exampleauth login page</h1>
104 <p>In this example you can log in with two accounts: <code>student</code> and <code>admin</code>. In both cases, the password is the same as the username.</p>
105 <?php if ($badUserPass) { ?>
106 <p>Bad username or password.</p>
107 <?php } ?>
108 <form method="post" action="?">
109 <p>
110 Username:
111 <input type="text" name="username">
112 </p>
113 <p>
114 Password:
115 <input type="text" name="password">
116 </p>
117 <input type="hidden" name="ReturnTo" value="<?php echo htmlspecialchars($returnTo); ?>">
118 <p><input type="submit" value="Log in"></p>
119 </form>
120 </body>
121 </html>
$returnTo
if(!isset($_REQUEST['ReturnTo'])) $returnTo
Definition: authpage.php:16
$_SERVER
if((!isset($_SERVER['DOCUMENT_ROOT'])) OR(empty($_SERVER['DOCUMENT_ROOT']))) $_SERVER['DOCUMENT_ROOT']
Definition: tcpdf_autoconfig.php:54
SimpleSAML\Utils\HTTP\checkURLAllowed
static checkURLAllowed($url, array $trustedSites=null)
Check if a URL is valid and is in our list of allowed URLs.
Definition: HTTP.php:321
$_SESSION
$_SESSION["AccountId"]
Definition: cfg.phpunit.template.php:10
$badUserPass
$badUserPass
Definition: authpage.php:67
SimpleSAML\Utils\HTTP\redirectTrustedURL
static redirectTrustedURL($url, $parameters=array())
This function redirects to the specified URL without performing any security checks.
Definition: HTTP.php:959
ILIAS\FileDelivery\http
static http()
Fetches the global http state from ILIAS.
Definition: HttpServiceAware.php:36
input
input
Definition: langcheck.php:166
SimpleSAML_Auth_State\loadState
static loadState($id, $stage, $allowMissing=false)
Retrieve saved state.
Definition: State.php:259
$user
$user
Definition: migrateto20.php:57
$users
$users
Definition: authpage.php:44
$password
$password
Definition: cron.php:14
html
html()
Definition: IntegrationTest.php:14