sso.class.php 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213
  1. <?php
  2. /**
  3. * This file contains the necessary elements to implement a Single Sign On
  4. * mechanism with an arbitrary external web application (given some light
  5. * development there) and is based on the Drupal-Chamilo module implementation.
  6. * To develop a new authentication mechanism, please extend this class and
  7. * overwrite its method, then modify the corresponding calling code in
  8. * main/inc/local.inc.php
  9. */
  10. /**
  11. * The SSO class allows for management or remote Single Sign On resources
  12. */
  13. class sso {
  14. public $protocol; // 'http://',
  15. public $domain; // 'localhost/project/drupal5',
  16. public $auth_uri; // '/?q=user',
  17. public $deauth_uri; // '/?q=logout',
  18. public $referer; // http://my.chamilo.com/main/auth/profile.php
  19. /**
  20. * Instanciates the object, initializing all relevant URL strings
  21. */
  22. public function __construct() {
  23. $this->protocol = api_get_setting('sso_authentication_protocol');
  24. $this->domain = api_get_setting('sso_authentication_domain');
  25. $this->auth_uri = api_get_setting('sso_authentication_auth_uri');
  26. $this->deauth_uri = api_get_setting('sso_authentication_unauth_uri');
  27. //cut the string to avoid recursive URL construction in case of failure
  28. $this->referer = $this->protocol.$_SERVER['HTTP_HOST'].substr($_SERVER['REQUEST_URI'],0,strpos($_SERVER['REQUEST_URI'],'sso'));
  29. $this->deauth_url = $this->protocol.$this->domain.$this->deauth_uri;
  30. $this->master_url = $this->protocol.$this->domain.$this->auth_uri;
  31. $this->target = api_get_path(WEB_PATH);
  32. }
  33. /**
  34. * Unlogs the user from the remote server
  35. */
  36. public function logout() {
  37. header('Location: '.$this->deauth_url);
  38. exit;
  39. }
  40. /**
  41. * Sends the user to the master URL for a check of active connection
  42. */
  43. public function ask_master() {
  44. header('Location: '.$this->master_url.'&sso_referer='.urlencode($this->referer).'&sso_target='.urlencode($this->target));
  45. exit;
  46. }
  47. /**
  48. * Validates the received active connection data with the database
  49. * @return bool Return the loginFailed variable value to local.inc.php
  50. */
  51. public function check_user() {
  52. global $_user, $userPasswordCrypted, $_configuration;
  53. $loginFailed = false;
  54. //change the way we recover the cookie depending on how it is formed
  55. $sso = $this->decode_cookie($_GET['sso_cookie']);
  56. //lookup the user in the main database
  57. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  58. $sql = "SELECT user_id, username, password,
  59. auth_source, active, expiration_date
  60. FROM $user_table
  61. WHERE username = '".trim(addslashes($sso['username']))."'";
  62. $result = Database::query($sql);
  63. if (Database::num_rows($result) > 0) {
  64. $uData = Database::fetch_array($result);
  65. //Check the user's password
  66. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  67. // Make sure password is encrypted with md5
  68. if (!$userPasswordCrypted) {
  69. $uData['password'] = md5($uData['password']);
  70. }
  71. //the authentification of this user is managed by Chamilo itself
  72. // check the user's password
  73. // password hash comes into a sha1
  74. if ($sso['secret'] === sha1($uData['password'])
  75. && ($sso['username'] == $uData['username'])) {
  76. //Check if the account is active (not locked)
  77. if ($uData['active']=='1') {
  78. // check if the expiration date has not been reached
  79. if ($uData['expiration_date'] > date('Y-m-d H:i:s')
  80. OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  81. //If Multiple URL is enabled
  82. if ($_configuration['multiple_access_urls']) {
  83. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  84. //Check if user is an admin
  85. $sql = "SELECT user_id FROM $admin_table
  86. WHERE user_id = '".trim(addslashes($uData['user_id']))."' LIMIT 1";
  87. $result = Database::query($sql);
  88. $my_user_is_admin = false;
  89. if (Database::num_rows($result) > 0) {
  90. $my_user_is_admin = true;
  91. }
  92. //Check the access_url configuration setting if
  93. // the user is registered in the
  94. // access_url_rel_user table
  95. //Getting the current access_url_id
  96. // of the platform
  97. $current_access_url_id = api_get_current_access_url_id();
  98. // my user is subscribed in these
  99. //sites: $my_url_list
  100. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  101. if ($my_user_is_admin === false) {
  102. if (is_array($my_url_list) && count($my_url_list)>0 ) {
  103. if (in_array($current_access_url_id, $my_url_list)) {
  104. // the user has permission to enter at this site
  105. $_user['user_id'] = $uData['user_id'];
  106. api_session_register('_user');
  107. event_login();
  108. // Redirect to homepage
  109. $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
  110. header('Location: '. $sso_target);
  111. exit;
  112. } else {
  113. // user does not have permission for this site
  114. $loginFailed = true;
  115. api_session_unregister('_uid');
  116. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  117. exit;
  118. }
  119. } else {
  120. // there is no URL in the multiple
  121. // urls list for this user
  122. $loginFailed = true;
  123. api_session_unregister('_uid');
  124. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  125. exit;
  126. }
  127. } else {
  128. //Only admins of the "main" (first) Chamilo
  129. // portal can login wherever they want
  130. if (in_array(1, $my_url_list)) {
  131. //Check if this admin is admin on the
  132. // principal portal
  133. $_user['user_id'] = $uData['user_id'];
  134. api_session_register('_user');
  135. event_login();
  136. } else {
  137. //Secondary URL admin wants to login
  138. // so we check as a normal user
  139. if (in_array($current_access_url_id, $my_url_list)) {
  140. $_user['user_id'] = $uData['user_id'];
  141. api_session_register('_user');
  142. event_login();
  143. } else {
  144. $loginFailed = true;
  145. api_session_unregister('_uid');
  146. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  147. exit;
  148. }
  149. }
  150. }
  151. } else {
  152. //Single URL access (Only 1 portal)
  153. $_user['user_id'] = $uData['user_id'];
  154. api_session_register('_user');
  155. event_login();
  156. // Redirect to homepage
  157. /* Login was successfull, stay on Chamilo
  158. $protocol = api_get_setting('sso_authentication_protocol');
  159. $master_url = api_get_setting('sso_authentication_domain');
  160. $target = $protocol.$master_url;
  161. $sso_target = isset($target) ? $target : api_get_path(WEB_PATH) .'.index.php';
  162. header('Location: '. $sso_target);
  163. exit;
  164. */
  165. }
  166. } else {
  167. // user account expired
  168. $loginFailed = true;
  169. api_session_unregister('_uid');
  170. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  171. exit;
  172. }
  173. } else {
  174. //User not active
  175. $loginFailed = true;
  176. api_session_unregister('_uid');
  177. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  178. exit;
  179. }
  180. } else {
  181. //SHA1 of password is wrong
  182. $loginFailed = true;
  183. api_session_unregister('_uid');
  184. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=wrong_password');
  185. exit;
  186. }
  187. } else {
  188. //Auth_source is wrong
  189. $loginFailed = true;
  190. api_session_unregister('_uid');
  191. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=wrong_authentication_source');
  192. exit;
  193. }
  194. } else {
  195. //No user by that login
  196. $loginFailed = true;
  197. api_session_unregister('_uid');
  198. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_not_found');
  199. exit;
  200. }
  201. return $loginFailed;
  202. }
  203. /**
  204. * Decode the cookie (this function may vary depending on the
  205. * Single Sign On implementation
  206. * @param string Encoded cookie
  207. * @result array Parsed and unencoded cookie
  208. */
  209. private function decode_cookie($cookie) {
  210. return unserialize(base64_decode($cookie));
  211. }
  212. }