UserPassBase.php

Go to the documentation of this file.

<?php

abstract class sspmod_core_Auth_UserPassBase extends SimpleSAML_Auth_Source {


        const STAGEID = 'sspmod_core_Auth_UserPassBase.state';


        const AUTHID = 'sspmod_core_Auth_UserPassBase.AuthId';


        private $forcedUsername;

        protected $loginLinks;

        protected $rememberUsernameEnabled = FALSE;

        protected $rememberUsernameChecked = FALSE;

    protected $rememberMeEnabled = FALSE;

    protected $rememberMeChecked = FALSE;

        public function __construct($info, &$config) {
                assert(is_array($info));
                assert(is_array($config));
                
                if (isset($config['core:loginpage_links'])) {
                        $this->loginLinks = $config['core:loginpage_links'];
                }

                // Call the parent constructor first, as required by the interface
                parent::__construct($info, $config);

                // Get the remember username config options
                if (isset($config['remember.username.enabled'])) {
                        $this->rememberUsernameEnabled = (bool) $config['remember.username.enabled'];
                        unset($config['remember.username.enabled']);
                }
                if (isset($config['remember.username.checked'])) {
                        $this->rememberUsernameChecked = (bool) $config['remember.username.checked'];
                        unset($config['remember.username.checked']);
                }

        // get the "remember me" config options
        $sspcnf = SimpleSAML_Configuration::getInstance();
        $this->rememberMeEnabled = $sspcnf->getBoolean('session.rememberme.enable', FALSE);
        $this->rememberMeChecked = $sspcnf->getBoolean('session.rememberme.checked', FALSE);
        }


        public function setForcedUsername($forcedUsername) {
                assert(is_string($forcedUsername) || $forcedUsername === null);
                $this->forcedUsername = $forcedUsername;
        }

        public function getLoginLinks() {
                return $this->loginLinks;
        }

        public function getRememberUsernameEnabled() {
                return $this->rememberUsernameEnabled;
        }

        public function getRememberUsernameChecked() {
                return $this->rememberUsernameChecked;
        }

    public function isRememberMeEnabled() {
        return $this->rememberMeEnabled;
    }

    public function isRememberMeChecked() {
        return $this->rememberMeChecked;
    }

        public function authenticate(&$state) {
                assert(is_array($state));

                /*
                 * Save the identifier of this authentication source, so that we can
                 * retrieve it later. This allows us to call the login()-function on
                 * the current object.
                 */
                $state[self::AUTHID] = $this->authId;

                // What username we should force, if any
                if ($this->forcedUsername !== NULL) {
                        /*
                         * This is accessed by the login form, to determine if the user
                         * is allowed to change the username.
                         */
                        $state['forcedUsername'] = $this->forcedUsername;
            }

          // ECP requests supply authentication credentials with the AUthnRequest
          // so we validate them now rather than redirecting
          if (isset($state['core:auth:username']) && isset($state['core:auth:password'])) {
              $username = $state['core:auth:username'];
              $password = $state['core:auth:password'];

              if (isset($state['forcedUsername'])) {
                  $username = $state['forcedUsername'];
              }

              $attributes = $this->login($username, $password);
              assert(is_array($attributes));
              $state['Attributes'] = $attributes;

              return;
          }

                /* Save the $state-array, so that we can restore it after a redirect. */
                $id = SimpleSAML_Auth_State::saveState($state, self::STAGEID);

                /*
                 * Redirect to the login form. We include the identifier of the saved
                 * state array as a parameter to the login form.
                 */
                $url = SimpleSAML\Module::getModuleURL('core/loginuserpass.php');
                $params = array('AuthState' => $id);
                \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, $params);

                /* The previous function never returns, so this code is never executed. */
                assert(false);
        }


        abstract protected function login($username, $password);


        public static function handleLogin($authStateId, $username, $password) {
                assert(is_string($authStateId));
                assert(is_string($username));
                assert(is_string($password));

                /* Here we retrieve the state array we saved in the authenticate-function. */
                $state = SimpleSAML_Auth_State::loadState($authStateId, self::STAGEID);

                /* Retrieve the authentication source we are executing. */
                assert(array_key_exists(self::AUTHID, $state));
                $source = SimpleSAML_Auth_Source::getById($state[self::AUTHID]);
                if ($source === NULL) {
                        throw new Exception('Could not find authentication source with id ' . $state[self::AUTHID]);
                }

                /*
                 * $source now contains the authentication source on which authenticate()
                 * was called. We should call login() on the same authentication source.
                 */

                /* Attempt to log in. */
                try {
                        $attributes = $source->login($username, $password);
                } catch (Exception $e) {
                        SimpleSAML\Logger::stats('Unsuccessful login attempt from '.$_SERVER['REMOTE_ADDR'].'.');
                        throw $e;
                }

                SimpleSAML\Logger::stats('User \''.$username.'\' successfully authenticated from '.$_SERVER['REMOTE_ADDR']);

                /* Save the attributes we received from the login-function in the $state-array. */
                assert(is_array($attributes));
                $state['Attributes'] = $attributes;

                /* Return control to SimpleSAMLphp after successful authentication. */
                SimpleSAML_Auth_Source::completeAuth($state);
        }

}