12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774 |
- <?php
- include_once __DIR__.'/languages/languages.php';
- include_once __DIR__.'/PGTStorage/pgt-main.php';
- class CASClient
- {
-
-
-
-
-
-
-
-
-
-
- function HTMLFilterOutput($str)
- {
- $str = str_replace('__CAS_VERSION__', $this->getServerVersion(), $str);
- $str = str_replace('__PHPCAS_VERSION__', phpCAS::getVersion(), $str);
- $str = str_replace('__SERVER_BASE_URL__', $this->getServerBaseURL(), $str);
- echo $str;
- }
-
- var $_output_header = '';
-
- function printHTMLHeader($title)
- {
- $this->HTMLFilterOutput(str_replace('__TITLE__',
- $title,
- (empty($this->_output_header)
- ? '<html><head><title>__TITLE__</title></head><body><h1>__TITLE__</h1>'
- : $this->_output_header)
- )
- );
- }
-
- var $_output_footer = '';
-
- function printHTMLFooter()
- {
- $this->HTMLFilterOutput(empty($this->_output_footer)
- ? ('<hr><address>phpCAS __PHPCAS_VERSION__ ' . $this->getString(CAS_STR_USING_SERVER) . ' <a href="__SERVER_BASE_URL__">__SERVER_BASE_URL__</a> (CAS __CAS_VERSION__)</a></address></body></html>')
- : $this->_output_footer);
- }
-
- function setHTMLHeader($header)
- {
- $this->_output_header = $header;
- }
-
- function setHTMLFooter($footer)
- {
- $this->_output_footer = $footer;
- }
-
-
-
-
-
-
- var $_lang = '';
-
- function getLang()
- {
- if (empty($this->_lang)) {
- $this->setLang(PHPCAS_LANG_DEFAULT);
- }
- return $this->_lang;
- }
-
- var $_strings;
-
- function getString($str)
- {
-
- $this->getLang();
- if (!isset($this->_strings[$str])) {
- trigger_error('string `' . $str . '\' not defined for language `' . $this->getLang() . '\'', E_USER_ERROR);
- }
- return $this->_strings[$str];
- }
-
- function setLang($lang)
- {
-
- include_once __DIR__.'/languages/'.$lang.'.php';
- if (!is_array($this->_strings)) {
- trigger_error('language `'.$lang.'\' is not implemented', E_USER_ERROR);
- }
- $this->_lang = $lang;
- }
-
-
-
-
-
-
- var $_server = array(
- 'version' => -1,
- 'hostname' => 'none',
- 'port' => -1,
- 'uri' => 'none'
- );
-
- function getServerVersion()
- {
- return $this->_server['version'];
- }
-
- function getServerHostname()
- {
- return $this->_server['hostname'];
- }
-
- function getServerPort()
- {
- return $this->_server['port'];
- }
-
- function getServerURI()
- {
- return $this->_server['uri'];
- }
-
- function getServerBaseURL()
- {
-
- if (empty($this->_server['base_url'])) {
- $this->_server['base_url'] = 'https://'
- . $this->getServerHostname()
- . ':'
- . $this->getServerPort()
- . $this->getServerURI();
- }
- return $this->_server['base_url'];
- }
-
- function getServerLoginURL($gateway = false, $renew = false)
- {
- phpCAS::traceBegin();
-
- if (empty($this->_server['login_url'])) {
- $this->_server['login_url'] = $this->getServerBaseURL();
- $this->_server['login_url'] .= 'login?service=';
-
- $this->_server['login_url'] .= urlencode($this->getURL());
- if ($renew) {
-
- $this->_server['login_url'] .= '&renew=true';
- } elseif ($gateway) {
-
- $this->_server['login_url'] .= '&gateway=true';
- }
- }
- phpCAS::traceEnd($this->_server['login_url']);
- return $this->_server['login_url'];
- }
-
- function setServerLoginURL($url)
- {
- return $this->_server['login_url'] = $url;
- }
-
- function setServerServiceValidateURL($url)
- {
- return $this->_server['service_validate_url'] = $url;
- }
-
- function setServerProxyValidateURL($url)
- {
- return $this->_server['proxy_validate_url'] = $url;
- }
-
- function setServerSamlValidateURL($url)
- {
- return $this->_server['saml_validate_url'] = $url;
- }
-
- function getServerServiceValidateURL()
- {
-
- if (empty($this->_server['service_validate_url'])) {
- switch ($this->getServerVersion()) {
- case CAS_VERSION_1_0:
- $this->_server['service_validate_url'] = $this->getServerBaseURL() . 'validate';
- break;
- case CAS_VERSION_2_0:
- $this->_server['service_validate_url'] = $this->getServerBaseURL() . 'serviceValidate';
- break;
- }
- }
-
- return $this->_server['service_validate_url'] . '?service=' . urlencode($this->getURL());
- }
-
- function getServerSamlValidateURL()
- {
- phpCAS::traceBegin();
-
- if (empty($this->_server['saml_validate_url'])) {
- switch ($this->getServerVersion()) {
- case SAML_VERSION_1_1:
- $this->_server['saml_validate_url'] = $this->getServerBaseURL() . 'samlValidate';
- break;
- }
- }
- phpCAS::traceEnd($this->_server['saml_validate_url'] . '?TARGET=' . urlencode($this->getURL()));
- return $this->_server['saml_validate_url'] . '?TARGET=' . urlencode($this->getURL());
- }
-
- function getServerProxyValidateURL()
- {
-
- if (empty($this->_server['proxy_validate_url'])) {
- switch ($this->getServerVersion()) {
- case CAS_VERSION_1_0:
- $this->_server['proxy_validate_url'] = '';
- break;
- case CAS_VERSION_2_0:
- $this->_server['proxy_validate_url'] = $this->getServerBaseURL() . 'proxyValidate';
- break;
- }
- }
-
- return $this->_server['proxy_validate_url'] . '?service=' . urlencode($this->getURL());
- }
-
- function getServerProxyURL()
- {
-
- if (empty($this->_server['proxy_url'])) {
- switch ($this->getServerVersion()) {
- case CAS_VERSION_1_0:
- $this->_server['proxy_url'] = '';
- break;
- case CAS_VERSION_2_0:
- $this->_server['proxy_url'] = $this->getServerBaseURL() . 'proxy';
- break;
- }
- }
- return $this->_server['proxy_url'];
- }
-
- function getServerLogoutURL()
- {
-
- if (empty($this->_server['logout_url'])) {
- $this->_server['logout_url'] = $this->getServerBaseURL() . 'logout';
- }
- return $this->_server['logout_url'];
- }
-
- function setServerLogoutURL($url)
- {
- return $this->_server['logout_url'] = $url;
- }
-
- var $_curl_options = array();
-
- function setExtraCurlOption($key, $value)
- {
- $this->_curl_options[$key] = $value;
- }
-
- function isHttps()
- {
-
-
- if (isset($_SERVER['HTTPS']) && !empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
- return true;
- } else {
- return false;
- }
- }
-
-
-
-
- function CASClient(
- $server_version,
- $proxy,
- $server_hostname,
- $server_port,
- $server_uri,
- $start_session = true
- ) {
- phpCAS::traceBegin();
-
- if (version_compare(PHP_VERSION, '5', '>=') && ini_get('zend.ze1_compatibility_mode')) {
- phpCAS::error('phpCAS cannot support zend.ze1_compatibility_mode. Sorry.');
- }
-
- if ($start_session && !$this->isLogoutRequest()) {
- phpCAS::trace("Starting session handling");
-
- if (empty($_GET['ticket'])) {
- phpCAS::trace("No ticket found");
-
- if (!session_id()) {
- phpCAS::trace("No session found, creating new session");
- session_start();
- }
- } else {
- phpCAS::trace("Ticket found");
-
- if (session_id()) {
- phpCAS::trace("Old active session found, saving old data and destroying session");
- $old_session = $_SESSION;
- session_destroy();
- } else {
- session_start();
- phpCAS::trace("Starting possible old session to copy variables");
- $old_session = $_SESSION;
- session_destroy();
- }
-
- $session_id = preg_replace('/[^\w]/', '', $_GET['ticket']);
- phpCAS::LOG("Session ID: " . $session_id);
- session_id($session_id);
- session_start();
-
- if (isset($old_session)) {
- phpCAS::trace("Restoring old session vars");
- $_SESSION = $old_session;
- }
- }
- } else {
- phpCAS::trace("Skipping session creation");
- }
-
- $this->_proxy = $proxy;
-
- switch ($server_version) {
- case CAS_VERSION_1_0:
- if ($this->isProxy()) {
- phpCAS::error('CAS proxies are not supported in CAS '
- . $server_version);
- }
- break;
- case CAS_VERSION_2_0:
- break;
- case SAML_VERSION_1_1:
- break;
- default:
- phpCAS::error('this version of CAS (`'
- . $server_version
- . '\') is not supported by phpCAS '
- . phpCAS::getVersion());
- }
- $this->_server['version'] = $server_version;
-
- if (empty($server_hostname)
- || !preg_match('/[\.\d\-abcdefghijklmnopqrstuvwxyz]*/', $server_hostname)
- ) {
- phpCAS::error('bad CAS server hostname (`' . $server_hostname . '\')');
- }
- $this->_server['hostname'] = $server_hostname;
-
- if ($server_port == 0
- || !is_int($server_port)
- ) {
- phpCAS::error('bad CAS server port (`' . $server_hostname . '\')');
- }
- $this->_server['port'] = $server_port;
-
- if (!preg_match('/[\.\d\-_abcdefghijklmnopqrstuvwxyz\/]*/', $server_uri)) {
- phpCAS::error('bad CAS server URI (`' . $server_uri . '\')');
- }
-
- $server_uri = preg_replace('/\/\//', '/', '/' . $server_uri . '/');
- $this->_server['uri'] = $server_uri;
-
- if ($this->isProxy()) {
- $this->setCallbackMode(!empty($_GET['pgtIou']) && !empty($_GET['pgtId']));
- }
- if ($this->isCallbackMode()) {
-
- if (!$this->isHttps()) {
- phpCAS::error('CAS proxies must be secured to use phpCAS; PGT\'s will not be received from the CAS server');
- }
- } else {
-
- $ticket = (isset($_GET['ticket']) ? $_GET['ticket'] : null);
- switch ($this->getServerVersion()) {
- case CAS_VERSION_1_0:
- if (preg_match('/^ST-/', $ticket)) {
- phpCAS::trace('ST \'' . $ticket . '\' found');
-
- $this->setST($ticket);
-
- unset($_GET['ticket']);
- } else {
- if (!empty($ticket)) {
-
- phpCAS::error('ill-formed ticket found in the URL (ticket=`' . htmlentities($ticket) . '\')');
- }
- }
- break;
- case CAS_VERSION_2_0:
- if (preg_match('/^[SP]T-/', $ticket)) {
- phpCAS::trace('ST or PT \'' . $ticket . '\' found');
- $this->setPT($ticket);
- unset($_GET['ticket']);
- } else {
- if (!empty($ticket)) {
-
- phpCAS::error('ill-formed ticket found in the URL (ticket=`' . htmlentities($ticket) . '\')');
- }
- }
- break;
- case SAML_VERSION_1_1:
- if (preg_match('/^[SP]T-/', $ticket)) {
- phpCAS::trace('SA \'' . $ticket . '\' found');
- $this->setSA($ticket);
- unset($_GET['ticket']);
- } else {
- if (!empty($ticket)) {
-
- phpCAS::error('ill-formed ticket found in the URL (ticket=`' . htmlentities($ticket) . '\')');
- }
- }
- break;
- }
- }
- phpCAS::traceEnd();
- }
-
-
-
-
-
-
-
-
- var $_user = '';
-
- function setUser($user)
- {
- $this->_user = $user;
- }
-
- function getUser()
- {
- if (empty($this->_user)) {
- phpCAS::error('this method should be used only after ' . __CLASS__ . '::forceAuthentication() or ' . __CLASS__ . '::isAuthenticated()');
- }
- return $this->_user;
- }
-
-
- var $_attributes = array();
- function setAttributes($attributes)
- {
- $this->_attributes = $attributes;
- }
- function getAttributes()
- {
- if (empty($this->_user)) {
- phpCAS::error('this method should be used only after ' . __CLASS__ . '::forceAuthentication() or ' . __CLASS__ . '::isAuthenticated()');
- }
- return $this->_attributes;
- }
- function hasAttributes()
- {
- return !empty($this->_attributes);
- }
- function hasAttribute($key)
- {
- return (is_array($this->_attributes) && array_key_exists($key, $this->_attributes));
- }
- function getAttribute($key)
- {
- if ($this->hasAttribute($key)) {
- return $this->_attributes[$key];
- }
- }
-
- function renewAuthentication()
- {
- phpCAS::traceBegin();
-
- if (isset($_SESSION['phpCAS']['auth_checked'])) {
- unset($_SESSION['phpCAS']['auth_checked']);
- }
- if ($this->isAuthenticated()) {
- phpCAS::trace('user already authenticated; renew');
- $this->redirectToCas(false, true);
- } else {
- $this->redirectToCas();
- }
- phpCAS::traceEnd();
- }
-
- function forceAuthentication()
- {
- phpCAS::traceBegin();
- if ($this->isAuthenticated()) {
-
- phpCAS::trace('no need to authenticate');
- $res = true;
- } else {
-
- if (isset($_SESSION['phpCAS']['auth_checked'])) {
- unset($_SESSION['phpCAS']['auth_checked']);
- }
- $this->redirectToCas(false);
-
- $res = false;
- }
- phpCAS::traceEnd($res);
- return $res;
- }
-
- var $_cache_times_for_auth_recheck = 0;
-
- function setCacheTimesForAuthRecheck($n)
- {
- $this->_cache_times_for_auth_recheck = $n;
- }
-
- function checkAuthentication()
- {
- phpCAS::traceBegin();
- if ($this->isAuthenticated()) {
- phpCAS::trace('user is authenticated');
- $res = true;
- } else {
- if (isset($_SESSION['phpCAS']['auth_checked'])) {
-
-
- $res = false;
- } else {
-
-
-
-
- if (!isset($_SESSION['phpCAS']['unauth_count'])) {
- $_SESSION['phpCAS']['unauth_count'] = -2;
- }
- if (($_SESSION['phpCAS']['unauth_count'] != -2 && $this->_cache_times_for_auth_recheck == -1)
- || ($_SESSION['phpCAS']['unauth_count'] >= 0 && $_SESSION['phpCAS']['unauth_count'] < $this->_cache_times_for_auth_recheck)
- ) {
- $res = false;
- if ($this->_cache_times_for_auth_recheck != -1) {
- $_SESSION['phpCAS']['unauth_count']++;
- phpCAS::trace('user is not authenticated (cached for ' . $_SESSION['phpCAS']['unauth_count'] . ' times of ' . $this->_cache_times_for_auth_recheck . ')');
- } else {
- phpCAS::trace('user is not authenticated (cached for until login pressed)');
- }
- } else {
- $_SESSION['phpCAS']['unauth_count'] = 0;
- $_SESSION['phpCAS']['auth_checked'] = true;
- phpCAS::trace('user is not authenticated (cache reset)');
-
-
- $res = false;
- }
- }
- }
- phpCAS::traceEnd($res);
- return $res;
- }
-
- function isAuthenticated()
- {
- phpCAS::traceBegin();
- $res = false;
- $validate_url = '';
- if ($this->wasPreviouslyAuthenticated()) {
-
-
- phpCAS::trace('user was already authenticated, no need to look for tickets');
- $res = true;
- } else {
- if ($this->hasST()) {
-
- phpCAS::trace('ST `' . $this->getST() . '\' is present');
- $this->validateST($validate_url, $text_response, $tree_response);
- phpCAS::trace('ST `' . $this->getST() . '\' was validated');
- if ($this->isProxy()) {
- $this->validatePGT($validate_url, $text_response, $tree_response);
- phpCAS::trace('PGT `' . $this->getPGT() . '\' was validated');
- $_SESSION['phpCAS']['pgt'] = $this->getPGT();
- }
- $_SESSION['phpCAS']['user'] = $this->getUser();
- $res = true;
- } elseif ($this->hasPT()) {
-
- phpCAS::trace('PT `' . $this->getPT() . '\' is present');
- $this->validatePT($validate_url, $text_response, $tree_response);
- phpCAS::trace('PT `' . $this->getPT() . '\' was validated');
- if ($this->isProxy()) {
- $this->validatePGT($validate_url, $text_response, $tree_response);
- phpCAS::trace('PGT `' . $this->getPGT() . '\' was validated');
- $_SESSION['phpCAS']['pgt'] = $this->getPGT();
- }
- $_SESSION['phpCAS']['user'] = $this->getUser();
- $res = true;
- } elseif ($this->hasSA()) {
-
- phpCAS::trace('SA `' . $this->getSA() . '\' is present');
- $this->validateSA($validate_url, $text_response, $tree_response);
- phpCAS::trace('SA `' . $this->getSA() . '\' was validated');
- $_SESSION['phpCAS']['user'] = $this->getUser();
- $_SESSION['phpCAS']['attributes'] = $this->getAttributes();
- $res = true;
- } else {
-
- phpCAS::trace('no ticket found');
- }
- if ($res) {
-
-
- header('Location: ' . $this->getURL());
- phpCAS::log("Prepare redirect to : " . $this->getURL());
- }
- }
- phpCAS::traceEnd($res);
- return $res;
- }
-
- function isSessionAuthenticated()
- {
- return !empty($_SESSION['phpCAS']['user']);
- }
-
- function wasPreviouslyAuthenticated()
- {
- phpCAS::traceBegin();
- if ($this->isCallbackMode()) {
- $this->callback();
- }
- $auth = false;
- if ($this->isProxy()) {
-
- if ($this->isSessionAuthenticated() && !empty($_SESSION['phpCAS']['pgt'])) {
-
- $this->setUser($_SESSION['phpCAS']['user']);
- $this->setPGT($_SESSION['phpCAS']['pgt']);
- phpCAS::trace('user = `' . $_SESSION['phpCAS']['user'] . '\', PGT = `' . $_SESSION['phpCAS']['pgt'] . '\'');
- $auth = true;
- } elseif ($this->isSessionAuthenticated() && empty($_SESSION['phpCAS']['pgt'])) {
-
- phpCAS::trace('username found (`' . $_SESSION['phpCAS']['user'] . '\') but PGT is empty');
-
- unset($_SESSION['phpCAS']);
- $this->setST('');
- $this->setPT('');
- } elseif (!$this->isSessionAuthenticated() && !empty($_SESSION['phpCAS']['pgt'])) {
-
- phpCAS::trace('PGT found (`' . $_SESSION['phpCAS']['pgt'] . '\') but username is empty');
-
- unset($_SESSION['phpCAS']);
- $this->setST('');
- $this->setPT('');
- } else {
- phpCAS::trace('neither user not PGT found');
- }
- } else {
-
- if ($this->isSessionAuthenticated()) {
-
- $this->setUser($_SESSION['phpCAS']['user']);
- if (isset($_SESSION['phpCAS']['attributes'])) {
- $this->setAttributes($_SESSION['phpCAS']['attributes']);
- }
- phpCAS::trace('user = `' . $_SESSION['phpCAS']['user'] . '\'');
- $auth = true;
- } else {
- phpCAS::trace('no user found');
- }
- }
- phpCAS::traceEnd($auth);
- return $auth;
- }
-
- function redirectToCas($gateway = false, $renew = false)
- {
- phpCAS::traceBegin();
- $cas_url = $this->getServerLoginURL($gateway, $renew);
- header('Location: ' . $cas_url);
- phpCAS::log("Redirect to : " . $cas_url);
- $this->printHTMLHeader($this->getString(CAS_STR_AUTHENTICATION_WANTED));
- printf('<p>' . $this->getString(CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED) . '</p>', $cas_url);
- $this->printHTMLFooter();
- phpCAS::traceExit();
- exit();
- }
-
- function logout($params)
- {
- phpCAS::traceBegin();
- $cas_url = $this->getServerLogoutURL();
- $paramSeparator = '?';
- if (isset($params['url'])) {
- $cas_url = $cas_url . $paramSeparator . "url=" . urlencode($params['url']);
- $paramSeparator = '&';
- }
- if (isset($params['service'])) {
- $cas_url = $cas_url . $paramSeparator . "service=" . urlencode($params['service']);
- }
- header('Location: ' . $cas_url);
- phpCAS::log("Prepare redirect to : " . $cas_url);
- session_unset();
- session_destroy();
- $this->printHTMLHeader($this->getString(CAS_STR_LOGOUT));
- printf('<p>' . $this->getString(CAS_STR_SHOULD_HAVE_BEEN_REDIRECTED) . '</p>', $cas_url);
- $this->printHTMLFooter();
- phpCAS::traceExit();
- exit();
- }
-
- function isLogoutRequest()
- {
- return !empty($_POST['logoutRequest']);
- }
-
- function isLogoutRequestAllowed()
- {
- }
-
- function handleLogoutRequests($check_client = true, $allowed_clients = false)
- {
- phpCAS::traceBegin();
- if (!$this->isLogoutRequest()) {
- phpCAS::log("Not a logout request");
- phpCAS::traceEnd();
- return;
- }
- phpCAS::log("Logout requested");
- phpCAS::log("SAML REQUEST: " . $_POST['logoutRequest']);
- if ($check_client) {
- if (!$allowed_clients) {
- $allowed_clients = array($this->getServerHostname());
- }
- $client_ip = $_SERVER['REMOTE_ADDR'];
- $client = gethostbyaddr($client_ip);
- phpCAS::log("Client: " . $client . "/" . $client_ip);
- $allowed = false;
- foreach ($allowed_clients as $allowed_client) {
- if (($client == $allowed_client) or ($client_ip == $allowed_client)) {
- phpCAS::log("Allowed client '" . $allowed_client . "' matches, logout request is allowed");
- $allowed = true;
- break;
- } else {
- phpCAS::log("Allowed client '" . $allowed_client . "' does not match");
- }
- }
- if (!$allowed) {
- phpCAS::error("Unauthorized logout request from client '" . $client . "'");
- printf("Unauthorized!");
- phpCAS::traceExit();
- exit();
- }
- } else {
- phpCAS::log("No access control set");
- }
-
- preg_match("|<samlp:SessionIndex>(.*)</samlp:SessionIndex>|", $_POST['logoutRequest'], $tick,
- PREG_OFFSET_CAPTURE, 3);
- $wrappedSamlSessionIndex = preg_replace('|<samlp:SessionIndex>|', '', $tick[0][0]);
- $ticket2logout = preg_replace('|</samlp:SessionIndex>|', '', $wrappedSamlSessionIndex);
- phpCAS::log("Ticket to logout: " . $ticket2logout);
- $session_id = preg_replace('/[^\w]/', '', $ticket2logout);
- phpCAS::log("Session id: " . $session_id);
-
- if (session_id()) {
- session_unset();
- session_destroy();
- }
-
- session_id($session_id);
- $_COOKIE[session_name()] = $session_id;
- $_GET[session_name()] = $session_id;
-
- session_start();
- session_unset();
- session_destroy();
- printf("Disconnected!");
- phpCAS::traceExit();
- exit();
- }
-
-
-
-
-
-
-
-
-
-
-
- var $_st = '';
-
- function getST()
- {
- return $this->_st;
- }
-
- function setST($st)
- {
- $this->_st = $st;
- }
-
- function hasST()
- {
- return !empty($this->_st);
- }
-
-
-
-
-
-
- var $_cas_server_cert = '';
-
- var $_cas_server_ca_cert = '';
-
- var $_no_cas_server_validation = false;
-
- function setCasServerCert($cert)
- {
- $this->_cas_server_cert = $cert;
- }
-
- function setCasServerCACert($cert)
- {
- $this->_cas_server_ca_cert = $cert;
- }
-
- function setNoCasServerValidation()
- {
- $this->_no_cas_server_validation = true;
- }
-
- function validateST($validate_url, &$text_response, &$tree_response)
- {
- phpCAS::traceBegin();
-
- $validate_url = $this->getServerServiceValidateURL() . '&ticket=' . $this->getST();
- if ($this->isProxy()) {
-
- $validate_url .= '&pgtUrl=' . $this->getCallbackURL();
- }
-
- if (!$this->readURL($validate_url, '', $headers, $text_response, $err_msg)) {
- phpCAS::trace('could not open URL \'' . $validate_url . '\' to validate (' . $err_msg . ')');
- $this->authError('ST not validated',
- $validate_url,
- true);
- }
-
- switch ($this->getServerVersion()) {
- case CAS_VERSION_1_0:
- if (preg_match('/^no\n/', $text_response)) {
- phpCAS::trace('ST has not been validated');
- $this->authError('ST not validated',
- $validate_url,
- false,
- false,
- $text_response);
- }
- if (!preg_match('/^yes\n/', $text_response)) {
- phpCAS::trace('ill-formed response');
- $this->authError('ST not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- $arr = preg_split('/\n/', $text_response);
- $this->setUser(trim($arr[1]));
- break;
- case CAS_VERSION_2_0:
-
- if (!($dom = domxml_open_mem($text_response))) {
- phpCAS::trace('domxml_open_mem() failed');
- $this->authError('ST not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if (!($tree_response = $dom->document_element())) {
- phpCAS::trace('document_element() failed');
- $this->authError('ST not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if ($tree_response->node_name() != 'serviceResponse') {
- phpCAS::trace('bad XML root node (should be `serviceResponse\' instead of `' . $tree_response->node_name() . '\'');
- $this->authError('ST not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- if (sizeof($success_elements = $tree_response->get_elements_by_tagname("authenticationSuccess")) != 0) {
-
- if (sizeof($user_elements = $success_elements[0]->get_elements_by_tagname("user")) == 0) {
- phpCAS::trace('<authenticationSuccess> found, but no <user>');
- $this->authError('ST not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- $user = trim($user_elements[0]->get_content());
- phpCAS::trace('user = `' . $user);
- $this->setUser($user);
- } else {
- if (sizeof($failure_elements = $tree_response->get_elements_by_tagname("authenticationFailure")) != 0) {
- phpCAS::trace('<authenticationFailure> found');
-
- $this->authError('ST not validated',
- $validate_url,
- false,
- false,
- $text_response,
- $failure_elements[0]->get_attribute('code'),
- trim($failure_elements[0]->get_content()));
- } else {
- phpCAS::trace('neither <authenticationSuccess> nor <authenticationFailure> found');
- $this->authError('ST not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- }
- break;
- }
-
- phpCAS::traceEnd(true);
- return true;
- }
-
-
-
-
-
- function validateSA($validate_url, &$text_response, &$tree_response)
- {
- phpCAS::traceBegin();
-
- $validate_url = $this->getServerSamlValidateURL();
-
- if (!$this->readURL($validate_url, '', $headers, $text_response, $err_msg)) {
- phpCAS::trace('could not open URL \'' . $validate_url . '\' to validate (' . $err_msg . ')');
- $this->authError('SA not validated', $validate_url, true);
- }
- phpCAS::trace('server version: ' . $this->getServerVersion());
-
- switch ($this->getServerVersion()) {
- case SAML_VERSION_1_1:
-
- if (!($dom = domxml_open_mem($text_response))) {
- phpCAS::trace('domxml_open_mem() failed');
- $this->authError('SA not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if (!($tree_response = $dom->document_element())) {
- phpCAS::trace('document_element() failed');
- $this->authError('SA not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if ($tree_response->node_name() != 'Envelope') {
- phpCAS::trace('bad XML root node (should be `Envelope\' instead of `' . $tree_response->node_name() . '\'');
- $this->authError('SA not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if (sizeof($success_elements = $tree_response->get_elements_by_tagname("NameIdentifier")) != 0) {
- phpCAS::trace('NameIdentifier found');
- $user = trim($success_elements[0]->get_content());
- phpCAS::trace('user = `' . $user . '`');
- $this->setUser($user);
- $this->setSessionAttributes($text_response);
- } else {
- phpCAS::trace('no <NameIdentifier> tag found in SAML payload');
- $this->authError('SA not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- break;
- }
-
- phpCAS::traceEnd(true);
- return true;
- }
-
- function setSessionAttributes($text_response)
- {
- phpCAS::traceBegin();
- $result = false;
- if (isset($_SESSION[SAML_ATTRIBUTES])) {
- phpCAS::trace("session attrs already set.");
- }
- $attr_array = array();
- if (($dom = domxml_open_mem($text_response))) {
- $xPath = $dom->xpath_new_context();
- $xPath->xpath_register_ns('samlp', 'urn:oasis:names:tc:SAML:1.0:protocol');
- $xPath->xpath_register_ns('saml', 'urn:oasis:names:tc:SAML:1.0:assertion');
- $nodelist = $xPath->xpath_eval("//saml:Attribute");
- $attrs = $nodelist->nodeset;
- phpCAS::trace($text_response);
- foreach ($attrs as $attr) {
- $xres = $xPath->xpath_eval("saml:AttributeValue", $attr);
- $name = $attr->get_attribute("AttributeName");
- $value_array = array();
- foreach ($xres->nodeset as $node) {
- $value_array[] = $node->get_content();
- }
- phpCAS::trace("* " . $name . "=" . $value_array);
- $attr_array[$name] = $value_array;
- }
- $_SESSION[SAML_ATTRIBUTES] = $attr_array;
-
- foreach ($attr_array as $attr_key => $attr_value) {
- if (count($attr_value) > 1) {
- $this->_attributes[$attr_key] = $attr_value;
- } else {
- $this->_attributes[$attr_key] = $attr_value[0];
- }
- }
- $result = true;
- }
- phpCAS::traceEnd($result);
- return $result;
- }
-
-
-
-
-
-
-
-
-
-
-
- var $_proxy;
-
- function isProxy()
- {
- return $this->_proxy;
- }
-
-
-
-
-
-
- var $_pgt = '';
-
- function getPGT()
- {
- return $this->_pgt;
- }
-
- function setPGT($pgt)
- {
- $this->_pgt = $pgt;
- }
-
- function hasPGT()
- {
- return !empty($this->_pgt);
- }
-
-
-
-
-
-
-
- var $_callback_mode = false;
-
- function setCallbackMode($callback_mode)
- {
- $this->_callback_mode = $callback_mode;
- }
-
- function isCallbackMode()
- {
- return $this->_callback_mode;
- }
-
- var $_callback_url = '';
-
- function getCallbackURL()
- {
-
- if (empty($this->_callback_url)) {
- $final_uri = '';
-
- $final_uri = 'https://';
-
- if (empty($_SERVER['HTTP_X_FORWARDED_SERVER'])) {
-
- if (empty($_SERVER['SERVER_NAME'])) {
- $final_uri .= $_SERVER['HTTP_HOST'];
- } else {
- $final_uri .= $_SERVER['SERVER_NAME'];
- }
- } else {
- $final_uri .= $_SERVER['HTTP_X_FORWARDED_SERVER'];
- }
- if (($this->isHttps() && $_SERVER['SERVER_PORT'] != 443)
- || (!$this->isHttps() && $_SERVER['SERVER_PORT'] != 80)
- ) {
- $final_uri .= ':';
- $final_uri .= $_SERVER['SERVER_PORT'];
- }
- $request_uri = $_SERVER['REQUEST_URI'];
- $request_uri = preg_replace('/\?.*$/', '', $request_uri);
- $final_uri .= $request_uri;
- $this->setCallbackURL($final_uri);
- }
- return $this->_callback_url;
- }
-
- function setCallbackURL($url)
- {
- return $this->_callback_url = $url;
- }
-
- function callback()
- {
- phpCAS::traceBegin();
- $this->printHTMLHeader('phpCAS callback');
- $pgt_iou = $_GET['pgtIou'];
- $pgt = $_GET['pgtId'];
- phpCAS::trace('Storing PGT `' . $pgt . '\' (id=`' . $pgt_iou . '\')');
- echo '<p>Storing PGT `' . $pgt . '\' (id=`' . $pgt_iou . '\').</p>';
- $this->storePGT($pgt, $pgt_iou);
- $this->printHTMLFooter();
- phpCAS::traceExit();
- exit();
- }
-
-
-
-
-
-
- var $_pgt_storage = null;
-
- function initPGTStorage()
- {
-
- if (!is_object($this->_pgt_storage)) {
- $this->setPGTStorageFile();
- }
-
- $this->_pgt_storage->init();
- }
-
- function storePGT($pgt, $pgt_iou)
- {
-
- $this->initPGTStorage();
-
- $this->_pgt_storage->write($pgt, $pgt_iou);
- }
-
- function loadPGT($pgt_iou)
- {
-
- $this->initPGTStorage();
-
- return $this->_pgt_storage->read($pgt_iou);
- }
-
- function setPGTStorageFile(
- $format = '',
- $path = ''
- ) {
-
- if (is_object($this->_pgt_storage)) {
- phpCAS::error('PGT storage already defined');
- }
-
- $this->_pgt_storage = new PGTStorageFile($this, $format, $path);
- }
-
- function setPGTStorageDB(
- $user,
- $password,
- $database_type,
- $hostname,
- $port,
- $database,
- $table
- ) {
-
- if (is_object($this->_pgt_storage)) {
- phpCAS::error('PGT storage already defined');
- }
-
- trigger_error('PGT storage into database is an experimental feature, use at your own risk', E_USER_WARNING);
-
- $this->_pgt_storage = new PGTStorageDB($this, $user, $password, $database_type, $hostname, $port, $database,
- $table);
- }
-
-
-
-
- function validatePGT(&$validate_url, $text_response, $tree_response)
- {
-
- phpCAS::log('start validatePGT()');
- if (sizeof($arr = $tree_response->get_elements_by_tagname("proxyGrantingTicket")) == 0) {
- phpCAS::trace('<proxyGrantingTicket> not found');
-
- $this->authError('Ticket validated but no PGT Iou transmitted',
- $validate_url,
- false,
- false,
- $text_response);
- } else {
-
- $pgt_iou = trim($arr[0]->get_content());
- $pgt = $this->loadPGT($pgt_iou);
- if ($pgt == false) {
- phpCAS::trace('could not load PGT');
- $this->authError('PGT Iou was transmitted but PGT could not be retrieved',
- $validate_url,
- false,
- false,
- $text_response);
- }
- $this->setPGT($pgt);
- }
-
- phpCAS::log('end validatePGT()');
- return true;
- }
-
-
-
-
- function retrievePT($target_service, &$err_code, &$err_msg)
- {
- phpCAS::traceBegin();
-
-
-
-
- $err_msg = '';
-
-
- $cas_url = $this->getServerProxyURL() . '?targetService=' . urlencode($target_service) . '&pgt=' . $this->getPGT();
-
- if (!$this->readURL($cas_url, '', $headers, $cas_response, $err_msg)) {
- phpCAS::trace('could not open URL \'' . $cas_url . '\' to validate (' . $err_msg . ')');
- $err_code = PHPCAS_SERVICE_PT_NO_SERVER_RESPONSE;
- $err_msg = 'could not retrieve PT (no response from the CAS server)';
- phpCAS::traceEnd(false);
- return false;
- }
- $bad_response = false;
- if (!$bad_response) {
-
- if (!($dom = @domxml_open_mem($cas_response))) {
- phpCAS::trace('domxml_open_mem() failed');
-
- $bad_response = true;
- }
- }
- if (!$bad_response) {
-
- if (!($root = $dom->document_element())) {
- phpCAS::trace('document_element() failed');
-
- $bad_response = true;
- }
- }
- if (!$bad_response) {
-
- if ($root->node_name() != 'serviceResponse') {
- phpCAS::trace('node_name() failed');
-
- $bad_response = true;
- }
- }
- if (!$bad_response) {
-
- if (sizeof($arr = $root->get_elements_by_tagname("proxySuccess")) != 0) {
-
- if (sizeof($arr = $root->get_elements_by_tagname("proxyTicket")) != 0) {
- $err_code = PHPCAS_SERVICE_OK;
- $err_msg = '';
- phpCAS::trace('original PT: ' . trim($arr[0]->get_content()));
- $pt = trim($arr[0]->get_content());
- phpCAS::traceEnd($pt);
- return $pt;
- } else {
- phpCAS::trace('<proxySuccess> was found, but not <proxyTicket>');
- }
- }
- else {
- if (sizeof($arr = $root->get_elements_by_tagname("proxyFailure")) != 0) {
-
- $err_code = PHPCAS_SERVICE_PT_FAILURE;
- $err_msg = 'PT retrieving failed (code=`'
- . $arr[0]->get_attribute('code')
- . '\', message=`'
- . trim($arr[0]->get_content())
- . '\')';
- phpCAS::traceEnd(false);
- return false;
- } else {
- phpCAS::trace('neither <proxySuccess> nor <proxyFailure> found');
- }
- }
- }
-
- $err_code = PHPCAS_SERVICE_PT_BAD_SERVER_RESPONSE;
- $err_msg = 'Invalid response from the CAS server (response=`' . $cas_response . '\')';
- phpCAS::traceEnd(false);
- return false;
- }
-
-
-
-
- function readURL($url, $cookies, &$headers, &$body, &$err_msg)
- {
- phpCAS::traceBegin();
- $headers = '';
- $body = '';
- $err_msg = '';
- $res = true;
-
- $ch = curl_init($url);
- if (version_compare(PHP_VERSION, '5.1.3', '>=')) {
-
- curl_setopt_array($ch, $this->_curl_options);
- } else {
- foreach ($this->_curl_options as $key => $value) {
- curl_setopt($ch, $key, $value);
- }
- }
- if ($this->_cas_server_cert == '' && $this->_cas_server_ca_cert == '' && !$this->_no_cas_server_validation) {
- phpCAS::error('one of the methods phpCAS::setCasServerCert(), phpCAS::setCasServerCACert() or phpCAS::setNoCasServerValidation() must be called.');
- }
- if ($this->_cas_server_cert != '' && $this->_cas_server_ca_cert != '') {
-
- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
- curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 1);
- curl_setopt($ch, CURLOPT_SSLCERT, $this->_cas_server_cert);
- curl_setopt($ch, CURLOPT_CAINFO, $this->_cas_server_ca_cert);
- curl_setopt($ch, CURLOPT_VERBOSE, '1');
- phpCAS::trace('CURL: Set all required opts for mutual authentication ------');
- } else {
- if ($this->_cas_server_cert != '') {
- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
- curl_setopt($ch, CURLOPT_SSLCERT, $this->_cas_server_cert);
- } else {
- if ($this->_cas_server_ca_cert != '') {
- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 1);
- curl_setopt($ch, CURLOPT_CAINFO, $this->_cas_server_ca_cert);
- } else {
- curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 1);
- curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
- }
- }
- }
-
- curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
-
- $this->_curl_headers = array();
- curl_setopt($ch, CURLOPT_HEADERFUNCTION, array($this, '_curl_read_headers'));
-
- if (is_array($cookies)) {
- curl_setopt($ch, CURLOPT_COOKIE, implode(';', $cookies));
- }
-
- if ($this->hasSA()) {
- $more_headers = array(
- "soapaction: http://www.oasis-open.org/committees/security",
- "cache-control: no-cache",
- "pragma: no-cache",
- "accept: text/xml",
- "connection: keep-alive",
- "content-type: text/xml"
- );
- curl_setopt($ch, CURLOPT_HTTPHEADER, $more_headers);
- curl_setopt($ch, CURLOPT_POST, 1);
- $data = $this->buildSAMLPayload();
-
- curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
- }
-
- $buf = curl_exec($ch);
-
- if ($buf === false) {
- phpCAS::trace('curl_exec() failed');
- $err_msg = 'CURL error #' . curl_errno($ch) . ': ' . curl_error($ch);
-
-
- curl_close($ch);
- $res = false;
- } else {
-
- curl_close($ch);
- $headers = $this->_curl_headers;
- $body = $buf;
- }
- phpCAS::traceEnd($res);
- return $res;
- }
-
- function buildSAMLPayload()
- {
- phpCAS::traceBegin();
-
- $sa = $this->getSA();
-
- $body = SAML_SOAP_ENV . SAML_SOAP_BODY . SAMLP_REQUEST . SAML_ASSERTION_ARTIFACT . $sa . SAML_ASSERTION_ARTIFACT_CLOSE . SAMLP_REQUEST_CLOSE . SAML_SOAP_BODY_CLOSE . SAML_SOAP_ENV_CLOSE;
- phpCAS::traceEnd($body);
- return ($body);
- }
-
- var $_curl_headers = array();
- function _curl_read_headers($ch, $header)
- {
- $this->_curl_headers[] = $header;
- return strlen($header);
- }
-
- function serviceWeb($url, &$err_code, &$output)
- {
- phpCAS::traceBegin();
-
- $pt = $this->retrievePT($url, $err_code, $output);
- $res = true;
-
- if (!$pt) {
-
- phpCAS::trace('PT was not retrieved correctly');
- $res = false;
- } else {
-
- if (is_array($_SESSION['phpCAS']['services'][$url]['cookies'])) {
- foreach ($_SESSION['phpCAS']['services'][$url]['cookies'] as $name => $val) {
- $cookies[] = $name . '=' . $val;
- }
- }
-
- if (strstr($url, '?') === false) {
- $service_url = $url . '?ticket=' . $pt;
- } else {
- $service_url = $url . '&ticket=' . $pt;
- }
- phpCAS::trace('reading URL`' . $service_url . '\'');
- if (!$this->readURL($service_url, $cookies, $headers, $output, $err_msg)) {
- phpCAS::trace('could not read URL`' . $service_url . '\'');
- $err_code = PHPCAS_SERVICE_NOT_AVAILABLE;
-
- $output = sprintf($this->getString(CAS_STR_SERVICE_UNAVAILABLE),
- $service_url,
- $err_msg);
- $res = false;
- } else {
-
- phpCAS::trace('URL`' . $service_url . '\' has been read, storing cookies:');
- foreach ($headers as $header) {
-
- if (preg_match('/^Set-Cookie:/', $header)) {
-
- $header_val = preg_replace('/^Set-Cookie: */', '', $header);
-
- $name_val = strtok($header_val, '; ');
-
- $cookie_name = strtok($name_val, '=');
- $cookie_val = strtok('=');
-
- $_SESSION['phpCAS']['services'][$url]['cookies'][$cookie_name] = $cookie_val;
- phpCAS::trace($cookie_name . ' -> ' . $cookie_val);
- }
- }
- }
- }
- phpCAS::traceEnd($res);
- return $res;
- }
-
- function serviceMail($url, $service, $flags, &$err_code, &$err_msg, &$pt)
- {
- phpCAS::traceBegin();
-
- $pt = $this->retrievePT($service, $err_code, $output);
- $stream = false;
-
- if (!$pt) {
-
- phpCAS::trace('PT was not retrieved correctly');
- } else {
- phpCAS::trace('opening IMAP URL `' . $url . '\'...');
- $stream = @imap_open($url, $this->getUser(), $pt, $flags);
- if (!$stream) {
- phpCAS::trace('could not open URL');
- $err_code = PHPCAS_SERVICE_NOT_AVAILABLE;
-
- $err_msg = sprintf($this->getString(CAS_STR_SERVICE_UNAVAILABLE),
- $service_url,
- var_export(imap_errors(), true));
- $pt = false;
- $stream = false;
- } else {
- phpCAS::trace('ok');
- }
- }
- phpCAS::traceEnd($stream);
- return $stream;
- }
-
-
-
-
-
-
-
-
-
-
-
- var $_pt = '';
-
- function getPT()
- {
-
- return $this->_pt;
- }
-
- function setPT($pt)
- {
- $this->_pt = $pt;
- }
-
- function hasPT()
- {
- return !empty($this->_pt);
- }
-
- function getSA()
- {
- return 'ST' . substr($this->_sa, 2);
- }
-
- function setSA($sa)
- {
- $this->_sa = $sa;
- }
-
- function hasSA()
- {
- return !empty($this->_sa);
- }
-
-
-
-
-
-
- function validatePT(&$validate_url, &$text_response, &$tree_response)
- {
- phpCAS::traceBegin();
-
- $validate_url = $this->getServerProxyValidateURL() . '&ticket=' . $this->getPT();
- if ($this->isProxy()) {
-
- $validate_url .= '&pgtUrl=' . $this->getCallbackURL();
- }
-
- if (!$this->readURL($validate_url, '', $headers, $text_response, $err_msg)) {
- phpCAS::trace('could not open URL \'' . $validate_url . '\' to validate (' . $err_msg . ')');
- $this->authError('PT not validated',
- $validate_url,
- true);
- }
-
- if (!($dom = domxml_open_mem($text_response))) {
-
- $this->authError('PT not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if (!($tree_response = $dom->document_element())) {
-
- $this->authError('PT not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
-
- if ($tree_response->node_name() != 'serviceResponse') {
-
- $this->authError('PT not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- if (sizeof($arr = $tree_response->get_elements_by_tagname("authenticationSuccess")) != 0) {
-
- if (sizeof($arr = $tree_response->get_elements_by_tagname("user")) == 0) {
-
- $this->authError('PT not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- $this->setUser(trim($arr[0]->get_content()));
- } else {
- if (sizeof($arr = $tree_response->get_elements_by_tagname("authenticationFailure")) != 0) {
-
- $this->authError('PT not validated',
- $validate_url,
- false,
- false,
- $text_response,
- $arr[0]->get_attribute('code'),
- trim($arr[0]->get_content()));
- } else {
- $this->authError('PT not validated',
- $validate_url,
- false,
- true,
- $text_response);
- }
- }
-
- phpCAS::traceEnd(true);
- return true;
- }
-
-
-
-
-
-
-
-
-
-
-
- var $_url = '';
-
- function getURL()
- {
- phpCAS::traceBegin();
-
- if (empty($this->_url)) {
- $final_uri = '';
-
- $final_uri = ($this->isHttps()) ? 'https' : 'http';
- $final_uri .= '://';
-
- if (empty($_SERVER['HTTP_X_FORWARDED_SERVER'])) {
-
- if (empty($_SERVER['SERVER_NAME'])) {
- $server_name = $_SERVER['HTTP_HOST'];
- } else {
- $server_name = $_SERVER['SERVER_NAME'];
- }
- } else {
- $server_name = $_SERVER['HTTP_X_FORWARDED_SERVER'];
- }
- $final_uri .= $server_name;
- if (!strpos($server_name, ':')) {
- if (($this->isHttps() && $_SERVER['SERVER_PORT'] != 443)
- || (!$this->isHttps() && $_SERVER['SERVER_PORT'] != 80)
- ) {
- $final_uri .= ':';
- $final_uri .= $_SERVER['SERVER_PORT'];
- }
- }
- $request_uri = explode('?', $_SERVER['REQUEST_URI'], 2);
- $final_uri .= $request_uri[0];
- if (isset($request_uri[1]) && $request_uri[1]) {
- $query_string = $this->removeParameterFromQueryString('ticket', $request_uri[1]);
-
- if ($query_string !== '') {
- $final_uri .= "?$query_string";
- }
- }
- phpCAS::trace("Final URI: $final_uri");
- $this->setURL($final_uri);
- }
- phpCAS::traceEnd($this->_url);
- return $this->_url;
- }
-
- function removeParameterFromQueryString($parameterName, $queryString)
- {
- $parameterName = preg_quote($parameterName);
- return preg_replace("/&$parameterName(=[^&]*)?|^$parameterName(=[^&]*)?&?/", '', $queryString);
- }
-
- function setURL($url)
- {
- $this->_url = $url;
- }
-
-
-
-
- function authError(
- $failure,
- $cas_url,
- $no_response,
- $bad_response = '',
- $cas_response = '',
- $err_code = '',
- $err_msg = ''
- ) {
- phpCAS::traceBegin();
- $this->printHTMLHeader($this->getString(CAS_STR_AUTHENTICATION_FAILED));
- printf($this->getString(CAS_STR_YOU_WERE_NOT_AUTHENTICATED), htmlentities($this->getURL()),
- $_SERVER['SERVER_ADMIN']);
- phpCAS::trace('CAS URL: ' . $cas_url);
- phpCAS::trace('Authentication failure: ' . $failure);
- if ($no_response) {
- phpCAS::trace('Reason: no response from the CAS server');
- } else {
- if ($bad_response) {
- phpCAS::trace('Reason: bad response from the CAS server');
- } else {
- switch ($this->getServerVersion()) {
- case CAS_VERSION_1_0:
- phpCAS::trace('Reason: CAS error');
- break;
- case CAS_VERSION_2_0:
- if (empty($err_code)) {
- phpCAS::trace('Reason: no CAS error');
- } else {
- phpCAS::trace('Reason: [' . $err_code . '] CAS error: ' . $err_msg);
- }
- break;
- }
- }
- phpCAS::trace('CAS response: ' . $cas_response);
- }
- $this->printHTMLFooter();
- phpCAS::traceExit();
- exit();
- }
-
- }
|