sso.class.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231
  1. <?php
  2. use \ChamiloSession as Session;
  3. /* For licensing terms, see /license.txt */
  4. /**
  5. * This file contains the necessary elements to implement a Single Sign On
  6. * mechanism with an arbitrary external web application (given some light
  7. * development there) and is based on the Drupal-Chamilo module implementation.
  8. * To develop a new authentication mechanism, please extend this class and
  9. * overwrite its method, then modify the corresponding calling code in
  10. * main/inc/local.inc.php
  11. * @package chamilo.auth.sso
  12. */
  13. /**
  14. * The SSO class allows for management or remote Single Sign On resources
  15. */
  16. class sso {
  17. public $protocol; // 'http://',
  18. public $domain; // 'localhost/project/drupal5',
  19. public $auth_uri; // '/?q=user',
  20. public $deauth_uri; // '/?q=logout',
  21. public $referer; // http://my.chamilo.com/main/auth/profile.php
  22. /**
  23. * Instanciates the object, initializing all relevant URL strings
  24. */
  25. public function __construct() {
  26. $this->protocol = api_get_setting('sso_authentication_protocol');
  27. // There can be multiple domains, so make sure to take only the first
  28. // This might be later extended with a decision process
  29. $domains = split(',',api_get_setting('sso_authentication_domain'));
  30. $this->domain = trim($domains[0]);
  31. $this->auth_uri = api_get_setting('sso_authentication_auth_uri');
  32. $this->deauth_uri = api_get_setting('sso_authentication_unauth_uri');
  33. //cut the string to avoid recursive URL construction in case of failure
  34. $this->referer = $this->protocol.$_SERVER['HTTP_HOST'].substr($_SERVER['REQUEST_URI'],0,strpos($_SERVER['REQUEST_URI'],'sso'));
  35. $this->deauth_url = $this->protocol.$this->domain.$this->deauth_uri;
  36. $this->master_url = $this->protocol.$this->domain.$this->auth_uri;
  37. $this->target = api_get_path(WEB_PATH);
  38. }
  39. /**
  40. * Unlogs the user from the remote server
  41. */
  42. public function logout() {
  43. header('Location: '.$this->deauth_url);
  44. exit;
  45. }
  46. /**
  47. * Sends the user to the master URL for a check of active connection
  48. */
  49. public function ask_master() {
  50. header('Location: '.$this->master_url.'&sso_referer='.urlencode($this->referer).'&sso_target='.urlencode($this->target));
  51. exit;
  52. }
  53. /**
  54. * Validates the received active connection data with the database
  55. * @return bool Return the loginFailed variable value to local.inc.php
  56. */
  57. public function check_user() {
  58. global $_user, $_configuration;
  59. $loginFailed = false;
  60. //change the way we recover the cookie depending on how it is formed
  61. $sso = $this->decode_cookie($_GET['sso_cookie']);
  62. //error_log('check_user');
  63. //error_log('sso decode cookie: '.print_r($sso,1));
  64. //lookup the user in the main database
  65. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  66. $sql = "SELECT user_id, username, password, auth_source, active, expiration_date
  67. FROM $user_table
  68. WHERE username = '".trim(Database::escape_string($sso['username']))."'";
  69. $result = Database::query($sql);
  70. if (Database::num_rows($result) > 0) {
  71. //error_log('user exists');
  72. $uData = Database::fetch_array($result);
  73. //Check the user's password
  74. if ($uData['auth_source'] == PLATFORM_AUTH_SOURCE) {
  75. //the authentification of this user is managed by Chamilo itself
  76. // check the user's password
  77. // password hash comes already parsed in sha1, md5 or none
  78. /*
  79. error_log($sso['secret']);
  80. error_log($uData['password']);
  81. error_log($sso['username']);
  82. error_log($uData['username']);
  83. */
  84. if ($sso['secret'] === sha1($uData['password'])
  85. && ($sso['username'] == $uData['username'])) {
  86. error_log('user n password are ok');
  87. //Check if the account is active (not locked)
  88. if ($uData['active']=='1') {
  89. // check if the expiration date has not been reached
  90. if ($uData['expiration_date'] > date('Y-m-d H:i:s')
  91. OR $uData['expiration_date']=='0000-00-00 00:00:00') {
  92. //If Multiple URL is enabled
  93. if (api_get_multiple_access_url()) {
  94. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  95. //Check if user is an admin
  96. $sql = "SELECT user_id FROM $admin_table
  97. WHERE user_id = '".intval($uData['user_id'])."' LIMIT 1";
  98. $result = Database::query($sql);
  99. $my_user_is_admin = false;
  100. if (Database::num_rows($result) > 0) {
  101. $my_user_is_admin = true;
  102. }
  103. //Check the access_url configuration setting if
  104. // the user is registered in the
  105. // access_url_rel_user table
  106. //Getting the current access_url_id
  107. // of the platform
  108. $current_access_url_id = api_get_current_access_url_id();
  109. // my user is subscribed in these
  110. //sites: $my_url_list
  111. $my_url_list = api_get_access_url_from_user($uData['user_id']);
  112. if ($my_user_is_admin === false) {
  113. if (is_array($my_url_list) && count($my_url_list)>0 ) {
  114. if (in_array($current_access_url_id, $my_url_list)) {
  115. // the user has permission to enter at this site
  116. $_user['user_id'] = $uData['user_id'];
  117. Session::write('_user',$_user);
  118. event_login();
  119. // Redirect to homepage
  120. $sso_target = isset($sso['target']) ? $sso['target'] : api_get_path(WEB_PATH) .'.index.php';
  121. header('Location: '. $sso_target);
  122. exit;
  123. } else {
  124. // user does not have permission for this site
  125. $loginFailed = true;
  126. Session::erase('_uid');
  127. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  128. exit;
  129. }
  130. } else {
  131. // there is no URL in the multiple
  132. // urls list for this user
  133. $loginFailed = true;
  134. Session::erase('_uid');
  135. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  136. exit;
  137. }
  138. } else {
  139. //Only admins of the "main" (first) Chamilo
  140. // portal can login wherever they want
  141. if (in_array(1, $my_url_list)) {
  142. //Check if this admin is admin on the
  143. // principal portal
  144. $_user['user_id'] = $uData['user_id'];
  145. Session::write('_user',$_user);
  146. event_login();
  147. } else {
  148. //Secondary URL admin wants to login
  149. // so we check as a normal user
  150. if (in_array($current_access_url_id, $my_url_list)) {
  151. $_user['user_id'] = $uData['user_id'];
  152. Session::write('_user',$_user);
  153. event_login();
  154. } else {
  155. $loginFailed = true;
  156. Session::erase('_uid');
  157. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=access_url_inactive');
  158. exit;
  159. }
  160. }
  161. }
  162. } else {
  163. //Single URL access (Only 1 portal)
  164. $_user['user_id'] = $uData['user_id'];
  165. Session::write('_user',$_user);
  166. event_login();
  167. // Redirect to homepage
  168. /* Login was successfull, stay on Chamilo
  169. $protocol = api_get_setting('sso_authentication_protocol');
  170. $master_url = api_get_setting('sso_authentication_domain');
  171. $target = $protocol.$master_url;
  172. $sso_target = isset($target) ? $target : api_get_path(WEB_PATH) .'.index.php';
  173. header('Location: '. $sso_target);
  174. exit;
  175. */
  176. }
  177. } else {
  178. // user account expired
  179. $loginFailed = true;
  180. Session::erase('_uid');
  181. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_expired');
  182. exit;
  183. }
  184. } else {
  185. //User not active
  186. $loginFailed = true;
  187. Session::erase('_uid');
  188. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=account_inactive');
  189. exit;
  190. }
  191. } else {
  192. //SHA1 of password is wrong
  193. $loginFailed = true;
  194. Session::erase('_uid');
  195. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=wrong_password');
  196. exit;
  197. }
  198. } else {
  199. //Auth_source is wrong
  200. $loginFailed = true;
  201. Session::erase('_uid');
  202. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=wrong_authentication_source');
  203. exit;
  204. }
  205. } else {
  206. //No user by that login
  207. $loginFailed = true;
  208. Session::erase('_uid');
  209. header('Location: '.api_get_path(WEB_PATH).'index.php?loginFailed=1&error=user_not_found');
  210. exit;
  211. }
  212. return $loginFailed;
  213. }
  214. /**
  215. * Decode the cookie (this function may vary depending on the
  216. * Single Sign On implementation
  217. * @param string Encoded cookie
  218. * @return array Parsed and unencoded cookie
  219. */
  220. private function decode_cookie($cookie) {
  221. return unserialize(base64_decode($cookie));
  222. }
  223. }