ilAuthProviderLDAP Class Reference

Description of class class. More...

Inheritance diagram for ilAuthProviderLDAP:

Collaboration diagram for ilAuthProviderLDAP:

Public Member Functions
	__construct (\ilAuthCredentials $credentials, $a_server_id=0)
	Constructor. More...
	getServer ()
	Get server. More...
	doAuthentication (\ilAuthStatus $status)
	Do authentication. More...
	createNewAccount (ilAuthStatus $status)
	Create new ILIAS account for external_account. Parameters ilAuthStatus More...
	migrateAccount (ilAuthStatus $status)
	Create new account. Parameters ilAuthStatus More...
	getTriggerAuthMode ()
	Get trigger auth mode. More...
	getUserAuthModeName ()
	Get user auth mode name. More...
	getExternalAccountName ()
	Get external account name. More...
	setExternalAccountName ($a_name)
	Set external account name. More...
Public Member Functions inherited from ilAuthProvider
	__construct (ilAuthCredentials $credentials)
	Constructor. More...
	getLogger ()
	Get logger. More...
	getCredentials ()

Protected Member Functions
	updateAccount (ilAuthStatus $status, array $user)
	Update Account. More...
	initServer ($a_server_id)
	Init Server. More...
	changeKeyCase ($a_string)
	Change case similar to array_change_key_case, to avoid further encoding problems. More...
Protected Member Functions inherited from ilAuthProvider
	handleAuthenticationFail (ilAuthStatus $status, $a_reason)
	Handle failed authentication. More...

Private Attributes
	$server = null
	$migration_account = ''
	$force_new_account = false

Additional Inherited Members
Data Fields inherited from ilAuthProvider
const	STATUS_UNDEFINED = 0
const	STATUS_AUTHENTICATION_SUCCESS = 1
const	STATUS_AUTHENTICATION_FAILED = 2
const	STATUS_MIGRATION = 3

Detailed Description

Description of class class.

Author

Stefan Meyer smeye.nosp@m.r.il.nosp@m.ias@g.nosp@m.mx.d.nosp@m.e

Definition at line 15 of file class.ilAuthProviderLDAP.php.

Constructor & Destructor Documentation

__construct()

ilAuthProviderLDAP::__construct	(	\ilAuthCredentials	$credentials,
			$a_server_id = 0
	)

Constructor.

Parameters

\ilAuthCredentials

$credentials

Definition at line 25 of file class.ilAuthProviderLDAP.php.

References ILIAS\GlobalScreen\Provider\__construct(), and initServer().

    {
        parent::__construct($credentials);
        $this->initServer($a_server_id);
    }

Here is the call graph for this function:

Member Function Documentation

changeKeyCase()

ilAuthProviderLDAP::changeKeyCase (   $a_string )

protected

Change case similar to array_change_key_case, to avoid further encoding problems.

Parameters

string

$a_string

Returns

string

Definition at line 260 of file class.ilAuthProviderLDAP.php.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

    {
        $as_array = array_change_key_case(array($a_string => $a_string));
        foreach ($as_array as $key => $string) {
            return $key;
        }
    }

Here is the caller graph for this function:

createNewAccount()

ilAuthProviderLDAP::createNewAccount

(

ilAuthStatus

$status

)

Create new ILIAS account for external_account.

Parameters

ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 161 of file class.ilAuthProviderLDAP.php.

References Vendor\Package\$e, $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

    {
        $this->force_new_account = true;
        
        try {
            include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
            $query = new ilLDAPQuery($this->getServer());
            $query->bind(IL_LDAP_BIND_DEFAULT);
        } catch (ilLDAPQueryException $e) {
            $this->getLogger()->error('Cannot bind to LDAP server... ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
            return false;
        }
        try {
            // fetch user
            $users = $query->fetchUser(
                $this->getCredentials()->getUsername()
            );
            if (!$users) {
                $this->handleAuthenticationFail($status, 'err_wrong_login');
                return false;
            }
            if (!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users)) {
                $this->handleAuthenticationFail($status, 'err_wrong_login');
                return false;
            }
        } catch (ilLDAPQueryException $e) {
            $this->getLogger()->error('Cannot fetch LDAP user data... ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
            return false;
        }

        // authentication success update profile
        $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
    }

Here is the call graph for this function:

doAuthentication()

ilAuthProviderLDAP::doAuthentication

(

\ilAuthStatus

$status

)

Do authentication.

Parameters

\ilAuthStatus

$status

Implements ilAuthProviderInterface.

Definition at line 45 of file class.ilAuthProviderLDAP.php.

References Vendor\Package\$e, $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_AUTH, IL_LDAP_BIND_DEFAULT, and updateAccount().

    {
        try {
            // bind
            include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
            $query = new ilLDAPQuery($this->getServer());
            $query->bind(IL_LDAP_BIND_DEFAULT);
        } catch (ilLDAPQueryException $e) {
            $this->getLogger()->error('Cannot bind to LDAP server... ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
            return false;
        }
        try {
            // Read user data, which does ensure a sucessful authentication.
            $users = $query->fetchUser(
                $this->getCredentials()->getUsername()
            );
            
            if (!$users) {
                $this->handleAuthenticationFail($status, 'err_wrong_login');
                return false;
            }
            if (!trim($this->getCredentials()->getPassword())) {
                $this->handleAuthenticationFail($status, 'err_wrong_login');
                return false;
            }
            if (!array_key_exists($this->changeKeyCase($this->getCredentials()->getUsername()), $users)) {
                $this->getLogger()->warning('Cannot find user: ' . $this->changeKeyCase($this->getCredentials()->getUsername()));
                $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
                return false;
            }
            
            // check group membership
            if (!$query->checkGroupMembership(
                $this->getCredentials()->getUsername(),
                $users[$this->changeKeyCase($this->getCredentials()->getUsername())]
            )) {
                $this->handleAuthenticationFail($status, 'err_wrong_login');
                return false;
            }
        } catch (ilLDAPQueryException $e) {
            $this->getLogger()->error('Cannot fetch LDAP user data... ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
            return false;
        }
        try {
            // now bind with login credentials
            $query->bind(IL_LDAP_BIND_AUTH, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]['dn'], $this->getCredentials()->getPassword());
        } catch (ilLDAPQueryException $e) {
            $this->handleAuthenticationFail($status, 'err_wrong_login');
            return false;
        }
        
        // authentication success update profile
        return $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
    }

Here is the call graph for this function:

getExternalAccountName()

ilAuthProviderLDAP::getExternalAccountName

(

)

Get external account name.

Returns

string

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 241 of file class.ilAuthProviderLDAP.php.

References $migration_account.

    {
        return $this->migration_account;
    }

getServer()

ilAuthProviderLDAP::getServer

(

)

Get server.

Returns

Definition at line 35 of file class.ilAuthProviderLDAP.php.

References $server.

Referenced by createNewAccount(), doAuthentication(), getTriggerAuthMode(), getUserAuthModeName(), migrateAccount(), and updateAccount().

    {
        return $this->server;
    }

Here is the caller graph for this function:

getTriggerAuthMode()

ilAuthProviderLDAP::getTriggerAuthMode

(

)

Get trigger auth mode.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 224 of file class.ilAuthProviderLDAP.php.

References AUTH_LDAP, and getServer().

    {
        return AUTH_LDAP . '_' . $this->getServer()->getServerId();
    }

Here is the call graph for this function:

getUserAuthModeName()

ilAuthProviderLDAP::getUserAuthModeName

(

)

Get user auth mode name.

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 232 of file class.ilAuthProviderLDAP.php.

References getServer().

    {
        return 'ldap_' . $this->getServer()->getServerId();
    }

Here is the call graph for this function:

initServer()

ilAuthProviderLDAP::initServer (   $a_server_id )

protected

Init Server.

Definition at line 150 of file class.ilAuthProviderLDAP.php.

Referenced by __construct().

    {
        include_once './Services/LDAP/classes/class.ilLDAPServer.php';
        $this->server = new ilLDAPServer($a_server_id);
    }

Here is the caller graph for this function:

migrateAccount()

ilAuthProviderLDAP::migrateAccount

(

ilAuthStatus

$status

)

Create new account.

Parameters

ilAuthStatus

Implements ilAuthProviderAccountMigrationInterface.

Definition at line 202 of file class.ilAuthProviderLDAP.php.

References Vendor\Package\$e, $query, changeKeyCase(), ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), IL_LDAP_BIND_DEFAULT, and updateAccount().

    {
        $this->force_new_account = true;
        
        try {
            include_once './Services/LDAP/classes/class.ilLDAPQuery.php';
            $query = new ilLDAPQuery($this->getServer());
            $query->bind(IL_LDAP_BIND_DEFAULT);
        } catch (ilLDAPQueryException $e) {
            $this->getLogger()->error('Cannot bind to LDAP server... ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'auth_err_ldap_exception');
            return false;
        }
        
        $users = $query->fetchUser($this->getCredentials()->getUsername());
        $this->updateAccount($status, $users[$this->changeKeyCase($this->getCredentials()->getUsername())]);
        return true;
    }

Here is the call graph for this function:

setExternalAccountName()

ilAuthProviderLDAP::setExternalAccountName

(

$a_name

)

Set external account name.

Parameters

string

$a_name

Definition at line 250 of file class.ilAuthProviderLDAP.php.

Referenced by updateAccount().

    {
        $this->migration_account = $a_name;
    }

Here is the caller graph for this function:

updateAccount()

ilAuthProviderLDAP::updateAccount ( ilAuthStatus  $status, array  $user  )

protected

Update Account.

Parameters

array

$user

Returns

bool

Definition at line 107 of file class.ilAuthProviderLDAP.php.

References Vendor\Package\$e, ilObjUser\_lookupId(), ilLogLevel\DEBUG, ilAuthProvider\getCredentials(), ilAuthProvider\getLogger(), getServer(), ilAuthProvider\handleAuthenticationFail(), ilAuthStatus\setAuthenticatedUserId(), setExternalAccountName(), ilAuthStatus\setStatus(), ilAuthStatus\STATUS_ACCOUNT_MIGRATION_REQUIRED, and ilAuthStatus\STATUS_AUTHENTICATED.

Referenced by createNewAccount(), doAuthentication(), and migrateAccount().

    {
        $user = array_change_key_case($user, CASE_LOWER);
        $this->getLogger()->dump($user, ilLogLevel::DEBUG);
        
        include_once './Services/LDAP/classes/class.ilLDAPUserSynchronisation.php';
        $sync = new ilLDAPUserSynchronisation('ldap_' . $this->getServer()->getServerId(), $this->getServer()->getServerId());
        $sync->setExternalAccount($this->getCredentials()->getUsername());
        $sync->setUserData($user);
        $sync->forceCreation($this->force_new_account);

        try {
            $internal_account = $sync->sync();
            $this->getLogger()->debug('Internal account: ' . $internal_account);
        } catch (UnexpectedValueException $e) {
            $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'err_wrong_login');
            return false;
        } catch (ilLDAPSynchronisationFailedException $e) {
            $this->handleAuthenticationFail($status, 'err_auth_ldap_failed');
            return false;
        } catch (ilLDAPSynchronisationForbiddenException $e) {
            // No syncronisation allowed => create Error
            $this->getLogger()->info('Login failed with message: ' . $e->getMessage());
            $this->handleAuthenticationFail($status, 'err_auth_ldap_no_ilias_user');
            return false;
        } catch (ilLDAPAccountMigrationRequiredException $e) {
            // Account migration required
            $this->setExternalAccountName($this->getCredentials()->getUsername());
            $this->getLogger()->info('Authentication failed: account migration required for external account: ' . $this->getCredentials()->getUsername());
            $status->setStatus(ilAuthStatus::STATUS_ACCOUNT_MIGRATION_REQUIRED);
            return false;
        }
        $status->setStatus(ilAuthStatus::STATUS_AUTHENTICATED);
        $status->setAuthenticatedUserId(ilObjUser::_lookupId($internal_account));
        return true;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

Field Documentation

$force_new_account

ilAuthProviderLDAP::$force_new_account = false

private

Definition at line 19 of file class.ilAuthProviderLDAP.php.

$migration_account

ilAuthProviderLDAP::$migration_account = ''

private

Definition at line 18 of file class.ilAuthProviderLDAP.php.

Referenced by getExternalAccountName().

$server

ilAuthProviderLDAP::$server = null

private

Definition at line 17 of file class.ilAuthProviderLDAP.php.

Referenced by getServer().

---

The documentation for this class was generated from the following file:

• Services/LDAP/classes/class.ilAuthProviderLDAP.php