public function get_login()
{
Logger::debug('main', 'AuthMethod_SAML2::get_login()');
$my_settings = $this->prefs->get('AuthMethod', 'SAML2');
$saml_node = $this->user_node_request->getElementsByTagname('saml_ticket')->item(0);
if (is_null($saml_node)) {
Logger::error('main', 'Authentication SAML2: No incoming SAML ticket');
return NULL;
}
$saml_response_ticket = NULL;
for ($child = $saml_node->firstChild; $child != NULL; $child = $child->nextSibling) {
if ($child->nodeType != XML_TEXT_NODE) {
Logger::error('main', 'Authentication SAML2: node is not text');
continue;
}
$saml_response_ticket = $child->wholeText;
}
if (is_null($saml_response_ticket)) {
Logger::error('main', 'Authentication SAML2: No incoming SAML ticket (bad protocol)');
return NULL;
}
$settings = $this->build_saml_settings($my_settings['idp_url'], $my_settings['idp_fingerprint'], $my_settings['idp_cert']);
try {
$response = new OneLogin_Saml2_Response($settings, $saml_response_ticket);
ob_start();
// Catch debug messages
if (!$response->isValid()) {
Logger::error('main', 'Authentication SAML2: the SAML response is not valid ' . ob_get_contents());
ob_end_clean();
return NULL;
}
ob_end_clean();
$sessionExpiration = $response->getSessionNotOnOrAfter();
if (!empty($sessionExpiration) && $sessionExpiration <= time() || !$response->validateTimestamps()) {
Logger::error('main', 'Authentication SAML2: Session expired');
return NULL;
}
} catch (Exception $e) {
Logger::error('main', 'Authentication SAML2: ' . $e->getMessage());
return NULL;
}
$attributes = $response->getAttributes();
$user = $this->userDB->import($response->getNameId());
if ($user == NULL) {
Logger::error('main', 'Authentication SAML2: user not found');
throw new Exception();
}
$login = $user->getAttribute('login');
// we recognize following attributes:
// * ovd.group_member: for user group matching
// * ovd.setting.*: for settings
if (array_key_exists("ovd.group_member", $attributes) && is_array($attributes["ovd.group_member"])) {
$userGroupDB = UserGroupDB::getInstance();
$to_delete = array();
$current_groups = array_keys(Abstract_Liaison::loadGroups('UsersGroup', $login));
foreach ($attributes["ovd.group_member"] as $group_name) {
$found = false;
list($groups, $sizelimit_exceeded) = $userGroupDB->getGroupsContains($group_name, array('name'));
foreach ($groups as $group) {
if ($group->name == $group_name) {
$found = True;
if (!in_array($group->getUniqueID(), $current_groups)) {
Logger::info('main', 'Authentication SAML2: Add user "' . $login . '" to group "' . $group->name . '"');
$ret = Abstract_Liaison::save('UsersGroup', $login, $group->getUniqueID());
if ($ret !== true) {
Logger::error('main', 'Authentication SAML2: Unable to add user "' . $login . '" to group "' . $group->name . '"');
throw new Exception();
}
} else {
unset($current_groups[array_search($group->getUniqueID(), $current_groups)]);
}
}
}
if (!$found) {
Logger::error('main', 'Authentication SAML2: group "' . $group_name . '" not found');
throw new Exception();
}
}
foreach ($current_groups as $group) {
Logger::info('main', 'Authentication SAML2: remove group "' . $group . '" from ' . $login);
Abstract_Liaison::delete('UsersGroup', $login, $group);
}
}
$prefs = Preferences::getInstance();
foreach ($attributes as $attribute => $value) {
if (is_array($value) && count($value) == 1) {
$value = $value[0];
}
if (substr($attribute, 0, 12) == 'ovd.setting.') {
$attribute = explode('.', $attribute);
if (count($attribute) != 4) {
Logger::error('main', 'Authentication SAML2: incorrect setting : "' . implode('.', $attribute) . '"');
throw new Exception();
}
$container = $attribute[2];
$setting = $attribute[3];
$session_settings_defaults = $prefs->getElements('general', $container);
if (!array_key_exists($setting, $session_settings_defaults)) {
Logger::error('main', 'Authentication SAML2: setting "' . implode('.', $attribute) . '" does not exists');
throw new Exception();
}
$config_element = clone $session_settings_defaults[$setting];
$ugp = new User_Preferences($login, 'general', $container, $setting, $config_element->content);
Logger::info('main', 'Authentication SAML2: set setting "' . implode('.', $attribute) . '" to ' . str_replace("\n", "", print_r($value, true)));
$ugp->value = $value;
Abstract_User_Preferences::delete($login, 'general', $container, $setting);
$ret = Abstract_User_Preferences::save($ugp);
if (!$ret) {
Logger::error('main', 'Authentication SAML2: impossible to save setting "' . implode('.', $attribute) . '"');
throw new Exception();
}
}
}
// return true or false.. No redirection to any IdP. We must have a valid ticket at this point. No artifact method
return $response->getNameId();
}
public function user_settings_set($user_id_, $container_, $setting_, $value_)
{
$this->check_authorized('manageUsers');
$userDB = UserDB::getInstance();
$user = $userDB->import($user_id_);
if (!is_object($user)) {
return false;
}
$prefs = Preferences::getInstance();
$session_settings_defaults = $prefs->getElements('general', $container_);
if (!array_key_exists($setting_, $session_settings_defaults)) {
return false;
}
$config_element = clone $session_settings_defaults[$setting_];
$ugp = new User_Preferences($user->getAttribute('login'), 'general', $container_, $setting_, $config_element->content);
if (!is_null($value_)) {
$ugp->value = $value_;
}
Abstract_User_Preferences::delete($user->getAttribute('login'), 'general', $container_, $setting_);
$ret = Abstract_User_Preferences::save($ugp);
if (!$ret) {
return false;
}
$this->log_action('user_settings_set', array('login' => $user->getAttribute('login'), $container_ . '_' . $setting_ => array('old' => $session_settings_defaults[$setting_]->content, 'new' => $config_element->content)));
return true;
}