class.ilSamlSettingsGUI.php

Go to the documentation of this file.

<?php
/* Copyright (c) 1998-2016 ILIAS open source, Extended GPL, see docs/LICENSE */
 
require_once 'Services/Saml/classes/class.ilSamlSettings.php';
require_once 'Services/Saml/classes/class.ilSamlIdp.php';
 
class ilSamlSettingsGUI
{
    const VIEW_MODE_GLOBAL = 1;
    const VIEW_MODE_SINGLE = 2;
 
    const DEFAULT_CMD = 'listIdps';
 
    protected static $globalCommands = array(
        'showAddIdpForm', self::DEFAULT_CMD, 'showSettings', 'saveSettings', 'showNewIdpForm', 'saveNewIdp'
    );
 
    protected static $globalEntityCommands = array(
        'deactivateIdp', 'activateIdp', 'confirmDeleteIdp', 'deleteIdp'
    );
 
    protected static $ignoredUserFields = array(
        'mail_incoming_mail', 'preferences', 'hide_own_online_status',
        'show_users_online', 'hits_per_page',
        'roles', 'upload', 'password',
        'username', 'language', 'skin_style',
        'interests_general', 'interests_help_offered', 'interests_help_looking',
        'bs_allow_to_contact_me', 'chat_osc_accept_msg'
    );
 
    protected $ref_id;
 
    protected $ctrl;
 
    protected $lng;
 
    protected $tpl;
 
    protected $access;
 
    protected $error_handler;
 
    protected $tabs;
 
    protected $rbacreview;
 
    protected $toolbar;
 
    protected $help;
 
    protected $mapping;
 
    protected $idp;
 
    protected $samlAuth;
 
    public function __construct($ref_id)
    {
        global $DIC;
 
        $this->ctrl = $DIC->ctrl();
        $this->tpl = $DIC->ui()->mainTemplate();
        $this->lng = $DIC->language();
        $this->access = $DIC->access();
        $this->error_handler = $DIC['ilErr'];
        $this->tabs = $DIC->tabs();
        $this->rbacreview = $DIC->rbac()->review();
        $this->toolbar = $DIC['ilToolbar'];
        $this->help = $DIC['ilHelp'];
 
        $this->lng->loadLanguageModule('auth');
        $this->ref_id = $ref_id;
    }
 
    protected function ensureAccess($operation)
    {
        if (!$this->access->checkAccess($operation, '', $this->getRefId())) {
            $this->error_handler->raiseError($this->lng->txt('msg_no_perm_read'), $this->error_handler->WARNING);
        }
    }
 
    protected function ensureWriteAccess()
    {
        $this->ensureAccess('write');
    }
 
    protected function ensureReadAccess()
    {
        $this->ensureAccess('read');
    }
 
    public function getRefId()
    {
        return $this->ref_id;
    }
 
    public function setRefId($ref_id)
    {
        $this->ref_id = $ref_id;
    }
 
    protected function initIdp()
    {
        try {
            $this->idp = ilSamlIdp::getInstanceByIdpId((int) $_REQUEST['saml_idp_id']);
        } catch (\Exception $e) {
            ilUtil::sendFailure($this->lng->txt('auth_saml_unknow_idp'), true);
            $this->ctrl->setParameter($this, 'saml_idp_id', null);
            $this->ctrl->redirect($this, self::DEFAULT_CMD);
        }
    }
 
    public function executeCommand()
    {
        $this->ensureReadAccess();
 
        try {
            $factory = new ilSamlAuthFactory();
            $this->samlAuth = $factory->auth();
        } catch (\Throwable $e) {
            \ilUtil::sendFailure($e->getMessage());
        } catch (\Exception $e) {
            \ilUtil::sendFailure($e->getMessage());
        }
 
        $this->help->setScreenIdComponent('auth');
 
        switch ($this->ctrl->getNextClass()) {
            default:
                $cmd = $this->ctrl->getCmd();
                if (!strlen($cmd) || !method_exists($this, $cmd)) {
                    $cmd = self::DEFAULT_CMD;
                }
 
                if (isset($_REQUEST['saml_idp_id'])) {
                    $this->ctrl->saveParameter($this, 'saml_idp_id');
                }
 
                if (!in_array(strtolower($cmd), array_map('strtolower', self::$globalCommands))) {
                    if (!isset($_REQUEST['saml_idp_id'])) {
                        $this->ctrl->redirect($this, self::DEFAULT_CMD);
                    }
 
                    $this->initIdp();
                    $this->initUserAttributeMapping();
                }
 
                if (
                    in_array(strtolower($cmd), array_map('strtolower', self::$globalCommands)) ||
                    in_array(strtolower($cmd), array_map('strtolower', self::$globalEntityCommands))
                ) {
                    $this->setSubTabs(self::VIEW_MODE_GLOBAL);
                } else {
                    $this->setSubTabs(self::VIEW_MODE_SINGLE);
                }
 
                $this->$cmd();
                break;
        }
    }
 
    protected function listIdps()
    {
        if ($this->samlAuth) {
            $addIdpButton = ilLinkButton::getInstance();
            $addIdpButton->setCaption('auth_saml_add_idp_btn');
            $addIdpButton->setUrl($this->ctrl->getLinkTarget($this, 'showNewIdpForm'));
            $this->toolbar->addStickyItem($addIdpButton);
        }
 
        require_once 'Services/Saml/classes/class.ilSamlIdpTableGUI.php';
        $table = new ilSamlIdpTableGUI($this, self::DEFAULT_CMD, $this->samlAuth);
        $this->tpl->setContent($table->getHTML());
        return;
    }
 
    protected function deactivateIdp()
    {
        $this->ensureWriteAccess();
 
        $this->idp->setActive(0);
        $this->idp->persist();
 
        ilUtil::sendSuccess($this->lng->txt('saved_successfully'));
        $this->listIdps();
    }
 
    protected function activateIdp()
    {
        $this->ensureWriteAccess();
 
        $this->idp->setActive(1);
        $this->idp->persist();
 
        ilUtil::sendSuccess($this->lng->txt('saved_successfully'));
        $this->listIdps();
    }
 
    protected function setSubTabs($a_view_mode)
    {
        switch ($a_view_mode) {
            case self::VIEW_MODE_GLOBAL:
                $this->tabs->addSubTabTarget(
                    'auth_saml_idps',
                    $this->ctrl->getLinkTarget($this, self::DEFAULT_CMD),
                    array_merge(self::$globalEntityCommands, array(self::DEFAULT_CMD, 'showNewIdpForm', 'saveNewIdp')),
                    get_class($this)
                );
 
                $this->tabs->addSubTabTarget(
                    'settings',
                    $this->ctrl->getLinkTarget($this, 'showSettings'),
                    array('showSettings', 'saveSettings'),
                    get_class($this)
                );
                break;
 
            case self::VIEW_MODE_SINGLE:
                $this->tabs->clearTargets();
                $this->tabs->setBackTarget($this->lng->txt('back'), $this->ctrl->getLinkTarget($this, self::DEFAULT_CMD));
 
                $this->tabs->addSubTabTarget(
                    'auth_saml_idp_settings',
                    $this->ctrl->getLinkTarget($this, 'showIdpSettings'),
                    array('showIdpSettings', 'saveIdpSettings'),
                    get_class($this)
                );
 
                $this->tabs->addSubTabTarget(
                    'auth_saml_user_mapping',
                    $this->ctrl->getLinkTarget($this, 'showUserAttributeMappingForm'),
                    array('showUserAttributeMappingForm', 'saveUserAttributeMapping'),
                    get_class($this)
                );
                break;
        }
    }
 
    private function initUserAttributeMapping()
    {
        require_once 'Services/Authentication/classes/External/UserAttributeMapping/class.ilExternalAuthUserAttributeMapping.php';
        $this->mapping = new ilExternalAuthUserAttributeMapping('saml', $this->idp->getIdpId());
    }
 
    protected function getUserAttributeMappingForm()
    {
        require_once 'Services/Form/classes/class.ilPropertyFormGUI.php';
        $form = new ilPropertyFormGUI();
        $form->setFormAction($this->ctrl->getFormAction($this, 'saveUserAttributeMapping'));
        $form->setTitle($this->lng->txt('auth_saml_user_mapping'));
 
        require_once 'Services/User/classes/class.ilUserProfile.php';
        $usr_profile = new ilUserProfile();
        foreach ($usr_profile->getStandardFields() as $id => $definition) {
            if (in_array($id, self::$ignoredUserFields)) {
                continue;
            }
 
            $this->addAttributeRuleFieldToForm($form, $this->lng->txt($id), $id);
        }
 
        require_once 'Services/User/classes/class.ilUserDefinedFields.php';
        foreach (ilUserDefinedFields::_getInstance()->getDefinitions() as $definition) {
            $this->addAttributeRuleFieldToForm($form, $definition['field_name'], 'udf_' . $definition['field_id']);
        }
 
        if (!$this->access->checkAccess('write', '', $this->getRefId())) {
            foreach ($form->getItems() as $item) {
                $item->setDisabled(true);
            }
        } else {
            $form->addCommandButton('saveUserAttributeMapping', $this->lng->txt('save'));
        }
 
        return $form;
    }
 
    protected function addAttributeRuleFieldToForm($form, $field_label, $field_name)
    {
        $field = new ilTextInputGUI($field_label, $field_name);
        $form->addItem($field);
 
        $update_automatically = new ilCheckboxInputGUI('', $field_name . '_update');
        $update_automatically->setOptionTitle($this->lng->txt('auth_saml_update_field_info'));
        $update_automatically->setValue(1);
        $form->addItem($update_automatically);
    }
 
    protected function saveUserAttributeMapping()
    {
        $this->ensureWriteAccess();
 
        $form = $this->getUserAttributeMappingForm();
        if ($form->checkInput()) {
            $this->mapping->delete();
 
            require_once 'Services/User/classes/class.ilUserProfile.php';
            $usr_profile = new ilUserProfile();
            foreach ($usr_profile->getStandardFields() as $id => $definition) {
                if (in_array($id, self::$ignoredUserFields)) {
                    continue;
                }
 
                $rule = $this->mapping->getEmptyRule();
                $rule->setAttribute($id);
                $rule->setExternalAttribute($form->getInput($rule->getAttribute()));
                $rule->updateAutomatically((bool) $form->getInput($rule->getAttribute() . '_update'));
                $this->mapping[$rule->getAttribute()] = $rule;
            }
 
            require_once 'Services/User/classes/class.ilUserDefinedFields.php';
            foreach (ilUserDefinedFields::_getInstance()->getDefinitions() as $definition) {
                $rule = $this->mapping->getEmptyRule();
                $rule->setAttribute('udf_' . $definition['field_id']);
                $rule->setExternalAttribute($form->getInput($rule->getAttribute()));
                $rule->updateAutomatically((bool) $form->getInput($rule->getAttribute() . '_update'));
                $this->mapping[$rule->getAttribute()] = $rule;
            }
 
            $this->mapping->save();
 
            ilUtil::sendSuccess($this->lng->txt('saved_successfully'));
        }
 
        $form->setValuesByPost();
 
        $this->showUserAttributeMappingForm($form);
    }
 
    protected function showUserAttributeMappingForm(ilPropertyFormGUI $form = null)
    {
        $this->tabs->setSubTabActive('auth_saml_user_mapping');
 
        if (!($form instanceof ilPropertyFormGUI)) {
            $form = $this->getUserAttributeMappingForm();
            $data = array();
            foreach ($this->mapping as $rule) {
                $data[$rule->getAttribute()] = $rule->getExternalAttribute();
                $data[$rule->getAttribute() . '_update'] = (bool) $rule->isAutomaticallyUpdated();
            }
            $form->setValuesByArray($data);
        }
 
        $this->tpl->setContent($form->getHTML());
    }
 
    protected function getSettingsForm()
    {
        require_once 'Services/Form/classes/class.ilPropertyFormGUI.php';
        $form = new ilPropertyFormGUI();
        $form->setFormAction($this->ctrl->getFormAction($this, 'saveSettings'));
        $form->setTitle($this->lng->txt('auth_saml_configure'));
 
        $show_login_form = new ilCheckboxInputGUI($this->lng->txt('auth_saml_login_form'), 'login_form');
        $show_login_form->setInfo($this->lng->txt('auth_saml_login_form_info'));
        $show_login_form->setValue(1);
        $form->addItem($show_login_form);
 
        if (!$this->access->checkAccess('write', '', $this->getRefId())) {
            foreach ($form->getItems() as $item) {
                $item->setDisabled(true);
            }
        } else {
            $form->addCommandButton('saveSettings', $this->lng->txt('save'));
        }
 
        return $form;
    }
 
    protected function prepareRoleSelection()
    {
        $global_roles = ilUtil::_sortIds(
            $this->rbacreview->getGlobalRoles(),
            'object_data',
            'title',
            'obj_id'
        );
 
        $select[0] = $this->lng->txt('links_select_one');
        foreach ($global_roles as $role_id) {
            $select[$role_id] = ilObject::_lookupTitle($role_id);
        }
 
        return $select;
    }
 
    protected function saveSettings()
    {
        $this->ensureWriteAccess();
 
        $form = $this->getSettingsForm();
        if ($form->checkInput()) {
            ilSamlSettings::getInstance()->setLoginFormStatus((bool) $form->getInput('login_form'));
            ilUtil::sendSuccess($this->lng->txt('saved_successfully'));
        }
 
        $form->setValuesByPost();
 
        $this->showSettings($form);
    }
 
    protected function showSettings(ilPropertyFormGUI $form = null)
    {
        if (!($form instanceof ilPropertyFormGUI)) {
            $form = $this->getSettingsForm();
            $form->setValuesByArray(array(
                'login_form' => ilSamlSettings::getInstance()->isDisplayedOnLoginPage()
            ));
        }
 
        $this->tpl->setContent($form->getHTML());
    }
 
    protected function getIdpSettingsForm()
    {
        require_once 'Services/Form/classes/class.ilPropertyFormGUI.php';
        $form = new ilPropertyFormGUI();
        $form->setFormAction($this->ctrl->getFormAction($this, 'saveIdpSettings'));
        $form->setTitle(sprintf($this->lng->txt('auth_saml_configure_idp'), $this->idp->getEntityId()));
 
        $idp = new ilTextInputGUI($this->lng->txt('auth_saml_idp'), 'entity_id');
        $idp->setDisabled(true);
        $form->addItem($idp);
 
        $this->addMetadataElement($form);
 
        $local = new ilCheckboxInputGUI($this->lng->txt('auth_allow_local'), 'allow_local_auth');
        $local->setValue(1);
        $local->setInfo($this->lng->txt('auth_allow_local_info'));
        $form->addItem($local);
 
        $uid_claim = new ilTextInputGUI($this->lng->txt('auth_saml_uid_claim'), 'uid_claim');
        $uid_claim->setInfo($this->lng->txt('auth_saml_uid_claim_info'));
        $uid_claim->setRequired(true);
        $form->addItem($uid_claim);
 
        $sync = new ilCheckboxInputGUI($this->lng->txt('auth_saml_sync'), 'sync_status');
        $sync->setInfo($this->lng->txt('auth_saml_sync_info'));
        $sync->setValue(1);
 
        $username_claim = new ilTextInputGUI($this->lng->txt('auth_saml_username_claim'), 'login_claim');
        $username_claim->setInfo($this->lng->txt('auth_saml_username_claim_info'));
        $username_claim->setRequired(true);
        $sync->addSubItem($username_claim);
 
        $role = new ilSelectInputGUI($this->lng->txt('auth_saml_role_select'), 'default_role_id');
        $role->setOptions($this->prepareRoleSelection());
        $role->setRequired(true);
        $sync->addSubItem($role);
 
        $migr = new ilCheckboxInputGUI($this->lng->txt('auth_saml_migration'), 'account_migr_status');
        $migr->setInfo($this->lng->txt('auth_saml_migration_info'));
        $migr->setValue(1);
        $sync->addSubItem($migr);
        $form->addItem($sync);
 
        if (!$this->access->checkAccess('write', '', $this->getRefId())) {
            foreach ($form->getItems() as $item) {
                $item->setDisabled(true);
            }
        } else {
            $form->addCommandButton('saveIdpSettings', $this->lng->txt('save'));
        }
        $form->addCommandButton(self::DEFAULT_CMD, $this->lng->txt('cancel'));
 
        return $form;
    }
 
    protected function showIdpSettings(ilPropertyFormGUI $form = null)
    {
        $this->tabs->setSubTabActive('auth_saml_idp_settings');
 
        if (null === $form) {
            $form = $this->getIdpSettingsForm();
            $data = $this->idp->toArray();
            $this->populateWithMetadata($this->idp, $data);
            $form->setValuesByArray($data);
        } else {
            $form->setValuesByPost();
        }
 
        $this->help->setSubScreenId('edit_idp');
 
        $this->tpl->setContent($form->getHTML());
    }
 
    protected function saveIdpSettings()
    {
        $this->ensureWriteAccess();
 
        $form = $this->getIdpSettingsForm();
        if ($form->checkInput()) {
            $this->idp->bindForm($form);
            $this->idp->persist();
            ilUtil::sendSuccess($this->lng->txt('saved_successfully'));
 
            $this->storeMetadata($this->idp, $form->getInput('metadata'));
        }
 
        $this->showIdpSettings($form);
    }
 
    protected function getIdpForm()
    {
        $form = new \ilPropertyFormGUI();
        $form->setFormAction($this->ctrl->getFormAction($this, 'saveNewIdp'));
        $form->setTitle($this->lng->txt('auth_saml_add_idp_btn'));
 
        $this->addMetadataElement($form);
 
        $form->addCommandButton('saveNewIdp', $this->lng->txt('save'));
        $form->addCommandButton('listIdps', $this->lng->txt('cancel'));
 
        return $form;
    }
 
    protected function saveNewIdp()
    {
        $this->ensureWriteAccess();
 
        $form = $this->getIdpForm();
        if ($form->checkInput()) {
            $idp = new ilSamlIdp();
            $idp->bindForm($form);
            $idp->persist();
 
            $this->storeMetadata($idp, $form->getInput('metadata'));
 
            ilUtil::sendSuccess($this->lng->txt('saved_successfully'), true);
            $this->ctrl->setParameter($this, 'saml_idp_id', $idp->getIdpId());
            $this->ctrl->redirect($this, 'showIdpSettings');
        }
 
        $this->showNewIdpForm($form);
    }
 
    protected function showNewIdpForm(\ilPropertyFormGUI $form = null)
    {
        $this->ensureWriteAccess();
 
        if (null === $form) {
            $form = $this->getIdpForm();
        } else {
            $form->setValuesByPost();
        }
 
        $this->help->setSubScreenId('create_idp');
 
        $this->tpl->setContent($form->getHTML());
    }
 
    protected function addMetadataElement(\ilPropertyFormGUI $form)
    {
        require_once 'Services/Saml/classes/form/class.ilSamlIdpMetadataInputGUI.php';
        require_once 'Services/Saml/classes/form/class.ilSamlIdpMetadataPurifier.php';
        require_once 'Services/Saml/classes/class.ilSamlIdpXmlMetadataParser.php';
        require_once 'Services/Html/classes/class.ilHtmlPurifierComposite.php';
 
        $metadata = new \ilSamlIdpMetadataInputGUI(
            $this->lng->txt('auth_saml_add_idp_md_label'),
            'metadata',
            new ilSamlIdpXmlMetadataParser()
        );
        $metadata->setInfo($this->lng->txt('auth_saml_add_idp_md_info'));
        $metadata->setRows(20);
        $metadata->setRequired(true);
 
        $purifier = new ilHtmlPurifierComposite();
        $purifier->addPurifier(new ilSamlIdpMetadataPurifier());
 
        $metadata->setPurifier($purifier);
        $metadata->usePurifier(true);
        $form->addItem($metadata);
    }
 
    protected function populateWithMetadata(\ilSamlIdp $idp, &$data)
    {
        $idpDisco = $this->samlAuth->getIdpDiscovery();
 
        $data['metadata'] = $idpDisco->fetchIdpMetadata($idp->getIdpId());
    }
 
    protected function storeMetadata(\ilSamlIdp $idp, $metadata)
    {
        $idpDisco = $this->samlAuth->getIdpDiscovery();
        $idpDisco->storeIdpMetadata($idp->getIdpId(), $metadata);
    }
 
    protected function confirmDeleteIdp()
    {
        $this->ensureWriteAccess();
 
        require_once 'Services/Utilities/classes/class.ilConfirmationGUI.php';
        $confirmation = new \ilConfirmationGUI();
        $confirmation->setFormAction($this->ctrl->getFormAction($this, 'deleteIdp'));
        $confirmation->setConfirm($this->lng->txt('confirm'), 'deleteIdp');
        $confirmation->setCancel($this->lng->txt('cancel'), self::DEFAULT_CMD);
        $confirmation->setHeaderText($this->lng->txt('auth_saml_sure_delete_idp'));
        $confirmation->addItem('saml_idp_ids', $this->idp->getIdpId(), $this->idp->getEntityId());
 
        $this->tpl->setContent($confirmation->getHTML());
    }
 
    protected function deleteIdp()
    {
        $this->ensureWriteAccess();
 
        $idpDisco = $this->samlAuth->getIdpDiscovery();
        $idpDisco->deleteIdpMetadata($this->idp->getIdpId());
 
        $this->idp->delete();
 
        ilUtil::sendSuccess($this->lng->txt('auth_saml_deleted_idp'), true);
 
        $this->ctrl->setParameter($this, 'saml_idp_id', null);
        $this->ctrl->redirect($this, self::DEFAULT_CMD);
    }
}