Description of class class. More...

Inheritance diagram for ilAuthProviderLDAP:

Collaboration diagram for ilAuthProviderLDAP:

Public Member Functions

__construct (\ilAuthCredentials $credentials, $a_server_id=0)

Constructor. More...

getServer ()

Get server. More...

doAuthentication (\ilAuthStatus $status)

Do authentication. More...

createNewAccount (ilAuthStatus $status)

Create new ILIAS account for external_account.

Parameters

ilAuthStatus

More...

migrateAccount (ilAuthStatus $status)

Create new account.

Parameters

ilAuthStatus

More...

getTriggerAuthMode ()

Get trigger auth mode. More...

getUserAuthModeName ()

Get user auth mode name. More...

getExternalAccountName ()

Get external account name. More...

setExternalAccountName ($a_name)

Set external account name. More...

Public Member Functions inherited from ilAuthProvider

__construct (ilAuthCredentials $credentials)

Constructor. More...

getLogger ()

Get logger. More...

getCredentials ()

Protected Member Functions
	updateAccount (ilAuthStatus $status, array $user)
	Update Account. More...

	initServer ($a_server_id)
	Init Server. More...

	changeKeyCase ($a_string)
	Change case similar to array_change_key_case, to avoid further encoding problems. More...

Protected Member Functions inherited from ilAuthProvider
	handleAuthenticationFail (ilAuthStatus $status, $a_reason)
	Handle failed authentication. More...

Private Attributes
	$server = null

	$migration_account = ''

	$force_new_account = false

Additional Inherited Members
Data Fields inherited from ilAuthProvider
const	STATUS_UNDEFINED = 0

const	STATUS_AUTHENTICATION_SUCCESS = 1

const	STATUS_AUTHENTICATION_FAILED = 2

const	STATUS_MIGRATION = 3

Detailed Description

Description of class class.

Author: Stefan Meyer smeye.nosp@m.r.il.nosp@m.ias@g.nosp@m.mx.d.nosp@m.e

Definition at line 15 of file class.ilAuthProviderLDAP.php.

Constructor & Destructor Documentation

◆ __construct()

ilAuthProviderLDAP::__construct	(	\ilAuthCredentials	$credentials,
			$a_server_id = `0`
	)

Constructor.

Parameters

\ilAuthCredentials $credentials

Definition at line 25 of file class.ilAuthProviderLDAP.php.

References initServer().

     {
         parent::__construct($credentials);
         $this->initServer($a_server_id);
     }

Here is the call graph for this function:

Member Function Documentation

◆ changeKeyCase()

ilAuthProviderLDAP::changeKeyCase ( $a_string )

protected

Change case similar to array_change_key_case, to avoid further encoding problems.

Parameters

string $a_string

Returns: string

Definition at line 257 of file class.ilAuthProviderLDAP.php.

References $key.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

     {
         $as_array = array_change_key_case(array($a_string => $a_string));
         foreach ($as_array as $key => $string) {
             return $key;
         }
     }

Here is the caller graph for this function:

◆ createNewAccount()

ilAuthProviderLDAP::createNewAccount ( ilAuthStatus $status )

Create new ILIAS account for external_account.

Parameters

ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 158 of file class.ilAuthProviderLDAP.php.

References $query, $users, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

     {
         $this->force_new_account = true;
         
         try {
             include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
             $query = new ilLDAPQuery($this->getServer());
             $query->bind(IL_LDAP_BIND_DEFAULT);
         } catch (ilLDAPQueryException $e) {
             $this->getLogger()->error('Cannot bind to LDAP server... ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
             return false;
         }
         try {
             // fetch user
             $users = $query->fetchUser(
                 $this->getCredentials()->getUsername()
             );
             if (!$users) {
                 $this->handleAuthenticationFail($status, 'err_wrong_login');
                 return false;
             }
             if (!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users)) {
                 $this->handleAuthenticationFail($status, 'err_wrong_login');
                 return false;
             }
         } catch (ilLDAPQueryException $e) {
             $this->getLogger()->error('Cannot fetch LDAP user data... ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
             return false;
         }
 
         // authentication success update profile
         $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
     }

Here is the call graph for this function:

◆ doAuthentication()

ilAuthProviderLDAP::doAuthentication ( \ilAuthStatus $status )

Do authentication.

Parameters

\ilAuthStatus $status

Implements ilAuthProviderInterface.

Definition at line 45 of file class.ilAuthProviderLDAP.php.

References $query, $users, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_AUTH, IL_LDAP_BIND_DEFAULT, and updateAccount().

     {
         try {
             // bind
             include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
             $query = new ilLDAPQuery($this->getServer());
             $query->bind(IL_LDAP_BIND_DEFAULT);
         } catch (ilLDAPQueryException $e) {
             $this->getLogger()->error('Cannot bind to LDAP server... ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
             return false;
         }
         try {
             // Read user data, which does ensure a sucessful authentication.
             $users = $query->fetchUser(
                 $this->getCredentials()->getUsername()
             );
             
             if (!$users) {
                 $this->handleAuthenticationFail($status, 'err_wrong_login');
                 return false;
             }
             if (!trim($this->getCredentials()->getPassword())) {
                 $this->handleAuthenticationFail($status, 'err_wrong_login');
                 return false;
             }
             if (!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users)) {
                 $this->getLogger()->warning('Cannot find user: ' . $this->changeKeyCase($this->getCredentials()->getUsername()));
                 $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
                 return false;
             }
             
             // check group membership
             if (!$query->checkGroupMembership(
                 $this->getCredentials()->getUsername(),
                 $users[$this->changeKeyCase($this->getCredentials()->getUsername())]
             )) {
                 $this->handleAuthenticationFail($status, 'err_wrong_login');
                 return false;
             }
         } catch (ilLDAPQueryException $e) {
             $this->getLogger()->error('Cannot fetch LDAP user data... ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
             return false;
         }
         try {
             // now bind with login credentials
             $query->bind(IL_LDAP_BIND_AUTH, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]['dn'], $this->getCredentials()->getPassword());
         } catch (ilLDAPQueryException $e) {
             $this->handleAuthenticationFail($status, 'err_wrong_login');
             return false;
         }
         
         // authentication success update profile
         return $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
     }

Here is the call graph for this function:

◆ getExternalAccountName()

ilAuthProviderLDAP::getExternalAccountName ( )

Get external account name.

Returns: string

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 238 of file class.ilAuthProviderLDAP.php.

References $migration_account.

     {
         return $this->migration_account;
     }

◆ getServer()

ilAuthProviderLDAP::getServer ( )

Get server.

Returns

Definition at line 35 of file class.ilAuthProviderLDAP.php.

References $server.

Referenced by createNewAccount(), doAuthentication(), getTriggerAuthMode(), getUserAuthModeName(), migrateAccount(), and updateAccount().

     {
         return $this->server;
     }

Here is the caller graph for this function:

◆ getTriggerAuthMode()

ilAuthProviderLDAP::getTriggerAuthMode ( )

Get trigger auth mode.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 221 of file class.ilAuthProviderLDAP.php.

References AUTH_LDAP, and getServer().

     {
         return AUTH_LDAP . '_' . $this->getServer()->getServerId();
     }

Here is the call graph for this function:

◆ getUserAuthModeName()

ilAuthProviderLDAP::getUserAuthModeName ( )

Get user auth mode name.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 229 of file class.ilAuthProviderLDAP.php.

References getServer().

     {
         return 'ldap_' . $this->getServer()->getServerId();
     }

Here is the call graph for this function:

◆ initServer()

ilAuthProviderLDAP::initServer ( $a_server_id )

protected

Init Server.

Definition at line 147 of file class.ilAuthProviderLDAP.php.

Referenced by __construct().

     {
         include_once './Services/LDAP/classes/class.ilLDAPServer.php';
         $this->server = new ilLDAPServer($a_server_id);
     }

Here is the caller graph for this function:

◆ migrateAccount()

ilAuthProviderLDAP::migrateAccount ( ilAuthStatus $status )

Create new account.

Parameters

ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 199 of file class.ilAuthProviderLDAP.php.

References $query, $users, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

     {
         $this->force_new_account = true;
         
         try {
             include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
             $query = new ilLDAPQuery($this->getServer());
             $query->bind(IL_LDAP_BIND_DEFAULT);
         } catch (ilLDAPQueryException $e) {
             $this->getLogger()->error('Cannot bind to LDAP server... ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
             return false;
         }
         
         $users = $query->fetchUser($this->getCredentials()->getUsername());
         $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
         return true;
     }

Here is the call graph for this function:

◆ setExternalAccountName()

ilAuthProviderLDAP::setExternalAccountName ( $a_name )

Set external account name.

Parameters

string $a_name

Definition at line 247 of file class.ilAuthProviderLDAP.php.

Referenced by updateAccount().

     {
         $this->migration_account = $a_name;
     }

Here is the caller graph for this function:

◆ updateAccount()

ilAuthProviderLDAP::updateAccount	(	ilAuthStatus	$status,
		array	$user
	)

protected

Update Account.

Parameters

array $user

Returns: bool

Definition at line 107 of file class.ilAuthProviderLDAP.php.

References $sync, ilObjUser\_lookupId(), ilLogLevel\DEBUG, ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), ilAuthStatus\setAuthenticatedUserId(), setExternalAccountName(), ilAuthStatus\setStatus(), ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED, and ilAuthStatus\STATUS_AUTHENTICATED.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

     {
         $user = array_change_key_case($user, CASE_LOWER);
         $this->getLogger()->dump($user, ilLogLevel::DEBUG);
         
         include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
         $sync = new ilLDAPUserSynchronisation('ldap_' . $this->getServer()->getServerId(), $this->getServer()->getServerId());
         $sync->setExternalAccount($this->getCredentials()->getUsername());
         $sync->setUserData($user);
         $sync->forceCreation($this->force_new_account);
 
         try {
             $internal_account = $sync->sync();
             $this->getLogger()->debug('Internal account: ' . $internal_account);
         } catch (UnexpectedValueException $e) {
             $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'err_wrong_login');
             return false;
         } catch (ilLDAPSynchronisationForbiddenException $e) {
             // No syncronisation allowed => create Error
             $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
             $this->handleAuthenticationFail($status, 'err_auth_ldap_no_ilias_user');
             return false;
         } catch (ilLDAPAccountMigrationRequiredException $e) {
             // Account migration required
             $this->setExternalAccountName($this->getCredentials()->getUsername());
             $this->getLogger()->info('Authentication failed: account migration required for external account: ' . $this->getCredentials()->getUsername());
             $status->setStatus(ilAuthStatus::STATUS_ACCOUNT_MIGRATION_REQUIRED);
             return false;
         }
         $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
         $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
         return true;
     }