AuthFrontendCredentialsApache.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
namespace ILIAS\AuthApache;
 
use Psr\Http\Message\ServerRequestInterface;
use ilAuthFrontendCredentials;
use ilUtil;
use ilSetting;
use ilContext;
use ilLogLevel;
use ilCtrlInterface;
use ILIAS\ApacheAuth\UsernameProvider\CollectUsernameProvidersObjective;
use ILIAS\ApacheAuth\UsernameProvider\UsernameProviderFactory;
use ILIAS\ApacheAuth\UsernameProvider\UsernameResolver;
 
class AuthFrontendCredentialsApache extends ilAuthFrontendCredentials
{
    private ServerRequestInterface $http_request;
    private ilCtrlInterface $ctrl;
    private ilSetting $settings;
 
    public function __construct(ServerRequestInterface $http_request, ilCtrlInterface $ctrl)
    {
        $this->http_request = $http_request;
        $this->ctrl = $ctrl;
        $this->settings = new ilSetting('apache_auth');
        parent::__construct();
    }
 
    public function tryAuthenticationOnLoginPage(): void
    {
        $cmd = (string) ($this->http_request->getQueryParams()['cmd'] ?? '');
        if ($cmd === '') {
            $cmd = (string) ($this->http_request->getParsedBody()['cmd'] ?? '');
        }
 
        if ($cmd === 'force_login') {
            return;
        }
 
        if (!$this->getSettings()->get('apache_enable_auth', '0')) {
            return;
        }
 
        if (!$this->getSettings()->get('apache_auth_authenticate_on_login_page', '0')) {
            return;
        }
 
        if ((\defined('IL_CERT_SSO') && \IL_CERT_SSO === true) ||
            !ilContext::supportsRedirects() ||
            isset($this->http_request->getQueryParams()['passed_sso'])) {
            return;
        }
 
        $path = (string) ($this->http_request->getServerParams()['REQUEST_URI'] ?? '');
        if (str_starts_with($path, '/')) {
            $path = substr($path, 1);
        }
 
        if (!str_starts_with($path, 'http')) {
            $parts = parse_url(ILIAS_HTTP_PATH);
            $path = $parts['scheme'] . '://' . $parts['host'] . '/' . $path;
        }
 
        $this->ctrl->redirectToURL(
            ilUtil::getHtmlPath(
                './sso/index.php?' . http_build_query([
                    'force_mode_apache' => 1,
                    'r' => $path,
                    'cookie_path' => IL_COOKIE_PATH,
                    'ilias_path' => ILIAS_HTTP_PATH,
                ])
            )
        );
    }
 
    protected function getSettings(): ilSetting
    {
        return $this->settings;
    }
 
    public function initFromRequest(): void
    {
        $mapping_field_name = $this->getSettings()->get('apache_auth_username_direct_mapping_fieldname', '');
 
        $this->logger->dump($this->http_request->getServerParams(), ilLogLevel::DEBUG);
        $this->logger->debug($mapping_field_name);
 
        switch ($this->getSettings()->get('apache_auth_username_config_type')) {
            case AuthProviderApache::APACHE_AUTH_TYPE_DIRECT_MAPPING:
                if (isset($this->http_request->getServerParams()[$mapping_field_name])) {
                    $this->setUsername($this->http_request->getServerParams()[$mapping_field_name]);
                }
                break;
 
            case AuthProviderApache::APACHE_AUTH_TYPE_BY_FUNCTION:
                $factory = new UsernameProviderFactory();
                $resolver = new UsernameResolver($factory->fromClassNames(
                    require CollectUsernameProvidersObjective::PATH()
                ), $this->logger);
 
                $this->setUsername($resolver->resolve($this->http_request)->asString());
                break;
        }
    }
 
    public function hasValidTargetUrl(): bool
    {
        $target_url = trim((string) ($this->http_request->getQueryParams()['r'] ?? ''));
        if ($target_url === '') {
            return false;
        }
 
        $valid_hosts = [];
        $path = ILIAS_DATA_DIR . '/' . CLIENT_ID . '/apache_auth_allowed_domains.txt';
        if (file_exists($path) && is_readable($path)) {
            foreach (file($path) as $line) {
                if (trim($line)) {
                    $valid_hosts[] = trim($line);
                }
            }
        }
 
        return (new WhiteListUrlValidator($target_url, $valid_hosts))->isValid();
    }
 
    public function getTargetUrl(): string
    {
        return ilUtil::appendUrlParameterString(trim($this->http_request->getQueryParams()['r']), 'passed_sso=1');
    }
}