auth/cas/auth.php

   1 <?php
   2 // This file is part of Moodle - http://moodle.org/
   3 //
   4 // Moodle is free software: you can redistribute it and/or modify
   5 // it under the terms of the GNU General Public License as published by
   6 // the Free Software Foundation, either version 3 of the License, or
   7 // (at your option) any later version.
   8 //
   9 // Moodle is distributed in the hope that it will be useful,
  10 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 // GNU General Public License for more details.
  13 //
  14 // You should have received a copy of the GNU General Public License
  15 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  16
  17 /**
  18  * Authentication Plugin: CAS Authentication
  19  *
  20  * Authentication using CAS (Central Authentication Server).
  21  *
  22  * @author Martin Dougiamas
  23  * @author Jerome GUTIERREZ
  24  * @author Iñaki Arenaza
  25  * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
  26  * @package auth_cas
  27  */
  28
  29 defined('MOODLE_INTERNAL') || die();
  30
  31 require_once($CFG->dirroot.'/auth/ldap/auth.php');
  32 require_once($CFG->dirroot.'/auth/cas/CAS/CAS.php');
  33
  34 /**
  35  * CAS authentication plugin.
  36  */
  37 class auth_plugin_cas extends auth_plugin_ldap {
  38
  39     /**
  40      * Constructor.
  41      */
  42     function auth_plugin_cas() {
  43         $this->authtype = 'cas';
  44         $this->roleauth = 'auth_cas';
  45         $this->errorlogtag = '[AUTH CAS] ';
  46         $this->init_plugin($this->authtype);
  47     }
  48
  49     function prevent_local_passwords() {
  50         return true;
  51     }
  52
  53     /**
  54      * Authenticates user against CAS
  55      * Returns true if the username and password work and false if they are
  56      * wrong or don't exist.
  57      *
  58      * @param string $username The username (with system magic quotes)
  59      * @param string $password The password (with system magic quotes)
  60      * @return bool Authentication success or failure.
  61      */
  62     function user_login ($username, $password) {
  63         $this->connectCAS();
  64         return phpCAS::isAuthenticated() && (trim(core_text::strtolower(phpCAS::getUser())) == $username);
  65     }
  66
  67     /**
  68      * Returns true if this authentication plugin is 'internal'.
  69      *
  70      * @return bool
  71      */
  72     function is_internal() {
  73         return false;
  74     }
  75
  76     /**
  77      * Returns true if this authentication plugin can change the user's
  78      * password.
  79      *
  80      * @return bool
  81      */
  82     function can_change_password() {
  83         return false;
  84     }
  85
  86     /**
  87      * Authentication choice (CAS or other)
  88      * Redirection to the CAS form or to login/index.php
  89      * for other authentication
  90      */
  91     function loginpage_hook() {
  92         global $frm;
  93         global $CFG;
  94         global $SESSION, $OUTPUT, $PAGE;
  95
  96         $site = get_site();
  97         $CASform = get_string('CASform', 'auth_cas');
  98         $username = optional_param('username', '', PARAM_RAW);
  99         $courseid = optional_param('courseid', 0, PARAM_INT);
 100
 101         if (!empty($username)) {
 102             if (isset($SESSION->wantsurl) && (strstr($SESSION->wantsurl, 'ticket') ||
 103                                               strstr($SESSION->wantsurl, 'NOCAS'))) {
 104                 unset($SESSION->wantsurl);
 105             }
 106             return;
 107         }
 108
 109         // Return if CAS enabled and settings not specified yet
 110         if (empty($this->config->hostname)) {
 111             return;
 112         }
 113
 114         // If the multi-authentication setting is used, check for the param before connecting to CAS.
 115         if ($this->config->multiauth) {
 116             $authCAS = optional_param('authCAS', '', PARAM_RAW);
 117             if ($authCAS == 'NOCAS') {
 118                 return;
 119             }
 120             // Show authentication form for multi-authentication.
 121             // Test pgtIou parameter for proxy mode (https connection in background from CAS server to the php server).
 122             if ($authCAS != 'CAS' && !isset($_GET['pgtIou'])) {
 123                 $PAGE->set_url('/login/index.php');
 124                 $PAGE->navbar->add($CASform);
 125                 $PAGE->set_title("$site->fullname: $CASform");
 126                 $PAGE->set_heading($site->fullname);
 127                 echo $OUTPUT->header();
 128                 include($CFG->dirroot.'/auth/cas/cas_form.html');
 129                 echo $OUTPUT->footer();
 130                 exit();
 131             }
 132         }
 133
 134         // Connection to CAS server
 135         $this->connectCAS();
 136
 137         if (phpCAS::checkAuthentication()) {
 138             $frm = new stdClass();
 139             $frm->username = phpCAS::getUser();
 140             $frm->password = 'passwdCas';
 141
 142             // Redirect to a course if multi-auth is activated, authCAS is set to CAS and the courseid is specified.
 143             if ($this->config->multiauth && !empty($courseid)) {
 144                 redirect(new moodle_url('/course/view.php', array('id'=>$courseid)));
 145             }
 146
 147             return;
 148         }
 149
 150         if (isset($_GET['loginguest']) && ($_GET['loginguest'] == true)) {
 151             $frm = new stdClass();
 152             $frm->username = 'guest';
 153             $frm->password = 'guest';
 154             return;
 155         }
 156
 157         // Force CAS authentication (if needed).
 158         if (!phpCAS::isAuthenticated()) {
 159             phpCAS::setLang($this->config->language);
 160             phpCAS::forceAuthentication();
 161         }
 162     }
 163
 164
 165     /**
 166      * Connect to the CAS (clientcas connection or proxycas connection)
 167      *
 168      */
 169     function connectCAS() {
 170         global $CFG;
 171         static $connected = false;
 172
 173         if (!$connected) {
 174             // Make sure phpCAS doesn't try to start a new PHP session when connecting to the CAS server.
 175             if ($this->config->proxycas) {
 176                 phpCAS::proxy($this->config->casversion, $this->config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 177             } else {
 178                 phpCAS::client($this->config->casversion, $this->config->hostname, (int) $this->config->port, $this->config->baseuri, false);
 179             }
 180             $connected = true;
 181         }
 182
 183         // If Moodle is configured to use a proxy, phpCAS needs some curl options set.
 184         if (!empty($CFG->proxyhost) && !is_proxybypass($this->config->hostname)) {
 185             phpCAS::setExtraCurlOption(CURLOPT_PROXY, $CFG->proxyhost);
 186             if (!empty($CFG->proxyport)) {
 187                 phpCAS::setExtraCurlOption(CURLOPT_PROXYPORT, $CFG->proxyport);
 188             }
 189             if (!empty($CFG->proxytype)) {
 190                 // Only set CURLOPT_PROXYTYPE if it's something other than the curl-default http
 191                 if ($CFG->proxytype == 'SOCKS5') {
 192                     phpCAS::setExtraCurlOption(CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
 193                 }
 194             }
 195             if (!empty($CFG->proxyuser) and !empty($CFG->proxypassword)) {
 196                 phpCAS::setExtraCurlOption(CURLOPT_PROXYUSERPWD, $CFG->proxyuser.':'.$CFG->proxypassword);
 197                 if (defined('CURLOPT_PROXYAUTH')) {
 198                     // any proxy authentication if PHP 5.1
 199                     phpCAS::setExtraCurlOption(CURLOPT_PROXYAUTH, CURLAUTH_BASIC | CURLAUTH_NTLM);
 200                 }
 201             }
 202         }
 203
 204         if ($this->config->certificate_check && $this->config->certificate_path){
 205             phpCAS::setCasServerCACert($this->config->certificate_path);
 206         } else {
 207             // Don't try to validate the server SSL credentials
 208             phpCAS::setNoCasServerValidation();
 209         }
 210     }
 211
 212     /**
 213      * Prints a form for configuring this authentication plugin.
 214      *
 215      * This function is called from admin/auth.php, and outputs a full page with
 216      * a form for configuring this plugin.
 217      *
 218      * @param array $page An object containing all the data for this page.
 219      */
 220     function config_form($config, $err, $user_fields) {
 221         global $CFG, $OUTPUT;
 222
 223         if (!function_exists('ldap_connect')) { // Is php-ldap really there?
 224             echo $OUTPUT->notification(get_string('auth_ldap_noextension', 'auth_ldap'));
 225
 226             // Don't return here, like we do in auth/ldap. We cas use CAS without LDAP.
 227             // So just warn the user (done above) and define the LDAP constants we use
 228             // in config.html, to silence the warnings.
 229             if (!defined('LDAP_DEREF_NEVER')) {
 230                 define ('LDAP_DEREF_NEVER', 0);
 231             }
 232             if (!defined('LDAP_DEREF_ALWAYS')) {
 233                 define ('LDAP_DEREF_ALWAYS', 3);
 234             }
 235         }
 236
 237         include($CFG->dirroot.'/auth/cas/config.html');
 238     }
 239
 240     /**
 241      * A chance to validate form data, and last chance to
 242      * do stuff before it is inserted in config_plugin
 243      * @param object object with submitted configuration settings (without system magic quotes)
 244      * @param array $err array of error messages
 245      */
 246     function validate_form($form, &$err) {
 247         $certificate_path = trim($form->certificate_path);
 248         if ($form->certificate_check && empty($certificate_path)) {
 249             $err['certificate_path'] = get_string('auth_cas_certificate_path_empty', 'auth_cas');
 250         }
 251     }
 252
 253     /**
 254      * Returns the URL for changing the user's pw, or empty if the default can
 255      * be used.
 256      *
 257      * @return moodle_url
 258      */
 259     function change_password_url() {
 260         return null;
 261     }
 262
 263     /**
 264      * Processes and stores configuration data for this authentication plugin.
 265      */
 266     function process_config($config) {
 267
 268         // CAS settings
 269         if (!isset($config->hostname)) {
 270             $config->hostname = '';
 271         }
 272         if (!isset($config->port)) {
 273             $config->port = '';
 274         }
 275         if (!isset($config->casversion)) {
 276             $config->casversion = '';
 277         }
 278         if (!isset($config->baseuri)) {
 279             $config->baseuri = '';
 280         }
 281         if (!isset($config->language)) {
 282             $config->language = '';
 283         }
 284         if (!isset($config->proxycas)) {
 285             $config->proxycas = '';
 286         }
 287         if (!isset($config->logoutcas)) {
 288             $config->logoutcas = '';
 289         }
 290         if (!isset($config->multiauth)) {
 291             $config->multiauth = '';
 292         }
 293         if (!isset($config->certificate_check)) {
 294             $config->certificate_check = '';
 295         }
 296         if (!isset($config->certificate_path)) {
 297             $config->certificate_path = '';
 298         }
 299         if (!isset($config->logout_return_url)) {
 300             $config->logout_return_url = '';
 301         }
 302
 303         // LDAP settings
 304         if (!isset($config->host_url)) {
 305             $config->host_url = '';
 306         }
 307         if (!isset($config->start_tls)) {
 308              $config->start_tls = false;
 309         }
 310         if (empty($config->ldapencoding)) {
 311             $config->ldapencoding = 'utf-8';
 312         }
 313         if (!isset($config->pagesize)) {
 314             $config->pagesize = LDAP_DEFAULT_PAGESIZE;
 315         }
 316         if (!isset($config->contexts)) {
 317             $config->contexts = '';
 318         }
 319         if (!isset($config->user_type)) {
 320             $config->user_type = 'default';
 321         }
 322         if (!isset($config->user_attribute)) {
 323             $config->user_attribute = '';
 324         }
 325         if (!isset($config->search_sub)) {
 326             $config->search_sub = '';
 327         }
 328         if (!isset($config->opt_deref)) {
 329             $config->opt_deref = LDAP_DEREF_NEVER;
 330         }
 331         if (!isset($config->bind_dn)) {
 332             $config->bind_dn = '';
 333         }
 334         if (!isset($config->bind_pw)) {
 335             $config->bind_pw = '';
 336         }
 337         if (!isset($config->ldap_version)) {
 338             $config->ldap_version = '3';
 339         }
 340         if (!isset($config->objectclass)) {
 341             $config->objectclass = '';
 342         }
 343         if (!isset($config->memberattribute)) {
 344             $config->memberattribute = '';
 345         }
 346
 347         if (!isset($config->memberattribute_isdn)) {
 348             $config->memberattribute_isdn = '';
 349         }
 350         if (!isset($config->attrcreators)) {
 351             $config->attrcreators = '';
 352         }
 353         if (!isset($config->groupecreators)) {
 354             $config->groupecreators = '';
 355         }
 356         if (!isset($config->removeuser)) {
 357             $config->removeuser = AUTH_REMOVEUSER_KEEP;
 358         }
 359
 360         // save CAS settings
 361         set_config('hostname', trim($config->hostname), $this->pluginconfig);
 362         set_config('port', trim($config->port), $this->pluginconfig);
 363         set_config('casversion', $config->casversion, $this->pluginconfig);
 364         set_config('baseuri', trim($config->baseuri), $this->pluginconfig);
 365         set_config('language', $config->language, $this->pluginconfig);
 366         set_config('proxycas', $config->proxycas, $this->pluginconfig);
 367         set_config('logoutcas', $config->logoutcas, $this->pluginconfig);
 368         set_config('multiauth', $config->multiauth, $this->pluginconfig);
 369         set_config('certificate_check', $config->certificate_check, $this->pluginconfig);
 370         set_config('certificate_path', $config->certificate_path, $this->pluginconfig);
 371         set_config('logout_return_url', $config->logout_return_url, $this->pluginconfig);
 372
 373         // save LDAP settings
 374         set_config('host_url', trim($config->host_url), $this->pluginconfig);
 375         set_config('start_tls', $config->start_tls, $this->pluginconfig);
 376         set_config('ldapencoding', trim($config->ldapencoding), $this->pluginconfig);
 377         set_config('pagesize', (int)trim($config->pagesize), $this->pluginconfig);
 378         set_config('contexts', trim($config->contexts), $this->pluginconfig);
 379         set_config('user_type', core_text::strtolower(trim($config->user_type)), $this->pluginconfig);
 380         set_config('user_attribute', core_text::strtolower(trim($config->user_attribute)), $this->pluginconfig);
 381         set_config('search_sub', $config->search_sub, $this->pluginconfig);
 382         set_config('opt_deref', $config->opt_deref, $this->pluginconfig);
 383         set_config('bind_dn', trim($config->bind_dn), $this->pluginconfig);
 384         set_config('bind_pw', $config->bind_pw, $this->pluginconfig);
 385         set_config('ldap_version', $config->ldap_version, $this->pluginconfig);
 386         set_config('objectclass', trim($config->objectclass), $this->pluginconfig);
 387         set_config('memberattribute', core_text::strtolower(trim($config->memberattribute)), $this->pluginconfig);
 388         set_config('memberattribute_isdn', $config->memberattribute_isdn, $this->pluginconfig);
 389         set_config('attrcreators', trim($config->attrcreators), $this->pluginconfig);
 390         set_config('groupecreators', trim($config->groupecreators), $this->pluginconfig);
 391         set_config('removeuser', $config->removeuser, $this->pluginconfig);
 392
 393         return true;
 394     }
 395
 396     /**
 397      * Returns true if user should be coursecreator.
 398      *
 399      * @param mixed $username    username (without system magic quotes)
 400      * @return boolean result
 401      */
 402     function iscreator($username) {
 403         if (empty($this->config->host_url) or (empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
 404             return false;
 405         }
 406
 407         $extusername = core_text::convert($username, 'utf-8', $this->config->ldapencoding);
 408
 409         // Test for group creator
 410         if (!empty($this->config->groupecreators)) {
 411             $ldapconnection = $this->ldap_connect();
 412             if ($this->config->memberattribute_isdn) {
 413                 if(!($userid = $this->ldap_find_userdn($ldapconnection, $extusername))) {
 414                     return false;
 415                 }
 416             } else {
 417                 $userid = $extusername;
 418             }
 419
 420             $group_dns = explode(';', $this->config->groupecreators);
 421             if (ldap_isgroupmember($ldapconnection, $userid, $group_dns, $this->config->memberattribute)) {
 422                 return true;
 423             }
 424         }
 425
 426         // Build filter for attrcreator
 427         if (!empty($this->config->attrcreators)) {
 428             $attrs = explode(';', $this->config->attrcreators);
 429             $filter = '(& ('.$this->config->user_attribute."=$username)(|";
 430             foreach ($attrs as $attr){
 431                 if(strpos($attr, '=')) {
 432                     $filter .= "($attr)";
 433                 } else {
 434                     $filter .= '('.$this->config->memberattribute."=$attr)";
 435                 }
 436             }
 437             $filter .= '))';
 438
 439             // Search
 440             $result = $this->ldap_get_userlist($filter);
 441             if (count($result) != 0) {
 442                 return true;
 443             }
 444         }
 445
 446         return false;
 447     }
 448
 449     /**
 450      * Reads user information from LDAP and returns it as array()
 451      *
 452      * If no LDAP servers are configured, user information has to be
 453      * provided via other methods (CSV file, manually, etc.). Return
 454      * an empty array so existing user info is not lost. Otherwise,
 455      * calls parent class method to get user info.
 456      *
 457      * @param string $username username
 458      * @return mixed array with no magic quotes or false on error
 459      */
 460     function get_userinfo($username) {
 461         if (empty($this->config->host_url)) {
 462             return array();
 463         }
 464         return parent::get_userinfo($username);
 465     }
 466
 467     /**
 468      * Syncronizes users from LDAP server to moodle user table.
 469      *
 470      * If no LDAP servers are configured, simply return. Otherwise,
 471      * call parent class method to do the work.
 472      *
 473      * @param bool $do_updates will do pull in data updates from LDAP if relevant
 474      * @return nothing
 475      */
 476     function sync_users($do_updates=true) {
 477         if (empty($this->config->host_url)) {
 478             error_log('[AUTH CAS] '.get_string('noldapserver', 'auth_cas'));
 479             return;
 480         }
 481         parent::sync_users($do_updates);
 482     }
 483
 484     /**
 485     * Hook for logout page
 486     */
 487     function logoutpage_hook() {
 488         global $USER, $redirect;
 489
 490         // Only do this if the user is actually logged in via CAS
 491         if ($USER->auth === $this->authtype) {
 492             // Check if there is an alternative logout return url defined
 493             if (isset($this->config->logout_return_url) && !empty($this->config->logout_return_url)) {
 494                 // Set redirect to alternative return url
 495                 $redirect = $this->config->logout_return_url;
 496             }
 497         }
 498     }
 499
 500     /**
 501      * Post logout hook.
 502      *
 503      * Note: this method replace the prelogout_hook method to avoid redirect to CAS logout
 504      * before the event userlogout being triggered.
 505      *
 506      * @param stdClass $user clone of USER object object before the user session was terminated
 507      */
 508     public function postlogout_hook($user) {
 509         global $CFG;
 510         // Only redirect to CAS logout if the user is logged as a CAS user.
 511         if (!empty($this->config->logoutcas) && $user->auth == $this->authtype) {
 512             $backurl = !empty($this->config->logout_return_url) ? $this->config->logout_return_url : $CFG->wwwroot;
 513             $this->connectCAS();
 514             phpCAS::logoutWithRedirectService($backurl);
 515         }
 516     }
 517 }