diff --git a/README.txt b/README.txt index 63c0129..f874b6d 100644 --- a/README.txt +++ b/README.txt @@ -1,19 +1,25 @@ -- SUMMARY -- -The simplesamlphp_auth module makes it possible for Drupal to support SAML for authentication of users. The module will auto-provision user accounts into Drupal if you want it to. It can also dynamically assign Drupal roles based on identity attribute values. +The simplesamlphp_auth module makes it possible for Drupal to support SAML for +authentication of users. The module will auto-provision user accounts into +Drupal if you want it to. It can also dynamically assign Drupal roles based on +identity attribute values. -- PREREQUISITES -- -1) You must have SimpleSAMLphp installed and configured as a working service point (SP) as the module uses your local SimpleSAMLphp SP for the SAML support. +1) You must have SimpleSAMLphp installed and configured as a working service + point (SP) as the module uses your local SimpleSAMLphp SP for the SAML + support. For more information on installing and configuring SimpleSAMLphp as + an SP visit: http://www.simplesamlphp.org. - For more information on installing and configuring SimpleSAMLphp as an SP visit: http://www.simplesamlphp.org - - IMPORTANT: Your SP must be configured to use memcache for session storage (in config/config.php set store.type => 'memcache') + IMPORTANT: Your SP must be configured to use memcache for session storage + (in config/config.php set store.type => 'memcache'). -2) You must have memcached installed on your server and PHP must have the memcache extension. - - For more information on installing the memcache extension for PHP visit: http://www.php.net/manual/en/memcache.installation.php +2) You must have memcached installed on your server and PHP must have the + memcache extension. For more information on installing the memcache + extension for PHP visit: + http://www.php.net/manual/en/memcache.installation.php -- INSTALLATION -- @@ -30,12 +36,15 @@ Assuming the prerequisites have been met, installation of this module is just li -- CONFIGURATION -- -The configuration of the module is fairly straight forward. You will need to know the names of the attributes that your SP will be making available to the module in order to map them into Drupal. +The configuration of the module is fairly straight forward. You will need to +know the names of the attributes that your SP will be making available to the +module in order to map them into Drupal. -- TROUBLESHOOTING -- -The most common reason for things not working is the SP session storage type not being set to memcache. +The most common reason for things not working is the SP session storage type +not being set to memcache. -- CONTACT -- diff --git a/simplesamlphp_auth.info b/simplesamlphp_auth.info index aef2b5e..e7320ae 100644 --- a/simplesamlphp_auth.info +++ b/simplesamlphp_auth.info @@ -1,6 +1,5 @@ -name = "simpleSAMLphp authentication" -description = "Allows users to authenticate to a remote SAML identity provider (IdP) via a locally configured SimpleSAMLphp service point (SP)." +name = simpleSAMLphp authentication +description = Allows users to authenticate to a remote SAML identity provider (IdP) via a locally configured SimpleSAMLphp service point (SP). php = 5.1 core = 7.x -files[] = simplesamlphp_auth.module configure = admin/config/people/simplesamlphp_auth diff --git a/simplesamlphp_auth.install b/simplesamlphp_auth.install index 659869a..5f9ce9d 100644 --- a/simplesamlphp_auth.install +++ b/simplesamlphp_auth.install @@ -6,68 +6,64 @@ */ /** - * Implementation of hook_install(). + * Implements hook_install(). */ function simplesamlphp_auth_install() { $abc = 'test'; - // Necessary userprotect settings + // Necessary userprotect settings. $query1 = db_result(db_query('SELECT perm FROM {permission} WHERE rid = 2')); - + if ($query1) { - $new_perms = str_replace(", change own password", "", $query1); - $new_perms = str_replace("change own password", "", $new_perms); - $query2 = db_query("UPDATE {permission} SET perm = '" . $new_perms . "' WHERE rid = 2"); + $new_perms = str_replace(', change own password', '', $query1); + $new_perms = str_replace('change own password', '', $new_perms); + $query2 = db_query('UPDATE {permission} SET perm = "' . $new_perms . '" WHERE rid = 2'); } - - //Disable the open registration to the site and store the original setting. - $original = variable_get("user_register", "1"); - variable_set("user_register", "0"); - variable_set("simplesamlphp_auth_user_register_original", $original); - + + // Disable the open registration to the site and store the original setting. + $original = variable_get('user_register', 1); + variable_set('user_register', 0); + variable_set('simplesamlphp_auth_user_register_original', $original); + if ($query1) { drupal_set_message(st('The simpleSAMLphp authentication module was installed successfully.')); } else { drupal_set_message(st('There was an error installing the simpleSAMLphp authentication database tables.'), 'error'); } - } /** - * Implementation of hook_uninstall(). + * Implements hook_uninstall(). */ function simplesamlphp_auth_uninstall() { + // Show Login block by default. + $query1 = db_query('UPDATE {blocks} SET status="1" WHERE module="user" AND delta="0"'); + + // Restore the original user registration directive. + $original = variable_get('simplesamlphp_auth_user_register_original', 1); + variable_set('user_register', $original); + variable_del('simplesamlphp_auth_user_register_original'); + + // Remove the created system variables. + variable_del('simplesamlphp_auth_installdir'); + variable_del('simplesamlphp_auth_logout_page'); + variable_del('simplesamlphp_auth_mailattr'); + variable_del('simplesamlphp_auth_unique_id'); + variable_del('simplesamlphp_auth_user_name'); + variable_del('simplesamlphp_auth_authsource'); + variable_del('simplesamlphp_auth_rolepopulation'); + variable_del('simplesamlphp_auth_roleevaleverytime'); + variable_del('simplesamlphp_auth_forcehttps'); + variable_del('simplesamlphp_auth_registerusers'); + variable_del('simplesamlphp_auth_allowdefaultlogin'); + variable_del('simplesamlphp_auth_allowdefaultloginusers'); - //Show Login block by default - $query1 = db_query("UPDATE {blocks} SET status='1' WHERE module='user' AND delta='0'"); - - //Restore the original user registration directive - $original = variable_get("simplesamlphp_auth_user_register_original", "1"); - variable_set("user_register", $original); - variable_del("simplesamlphp_auth_user_register_original"); - - //Remove the created system variables - variable_del("simplesamlphp_auth_installdir"); - variable_del("simplesamlphp_auth_logout_page"); - variable_del("simplesamlphp_auth_mailattr"); - variable_del("simplesamlphp_auth_unique_id"); - variable_del("simplesamlphp_auth_user_name"); - variable_del("simplesamlphp_auth_authsource"); - variable_del("simplesamlphp_auth_rolepopulation"); - variable_del("simplesamlphp_auth_roleevaleverytime"); - variable_del("simplesamlphp_auth_forcehttps"); - variable_del("simplesamlphp_auth_registerusers"); - variable_del("simplesamlphp_auth_allowdefaultlogin"); - variable_del("simplesamlphp_auth_allowdefaultloginusers"); - - if ($query1) { drupal_set_message(st('The simpleSAMLphp authentication module was uninstalled successfully.')); } else { drupal_set_message(st('There was an error removing the simpleSAMLphp authentication database tables.'), 'error'); } - } diff --git a/simplesamlphp_auth.module b/simplesamlphp_auth.module index 66ac00c..0f1f990 100644 --- a/simplesamlphp_auth.module +++ b/simplesamlphp_auth.module @@ -4,100 +4,90 @@ * @file * simpleSAMLphp authentication module for Drupal. * - * This authentication module is based on the shibboleth authentication module, with changes - * to adopt to use simpleSAMLphp. + * This authentication module is based on the shibboleth authentication module, + * with changes to adopt to use simpleSAMLphp. * * ISSUES and TODOs: - * ISSUE: User is always dropped on user page after login, instead of where they were when they clicked "Federated Log In" - * Because of this, deep linking to access controlled content does not work. - * Usability would be considerably increased if this were resolved. - * FYI: Drupal now requires knowledge of the local user password in order to change e-mail address, etc. - * This could be an issue for users of accounts that are autoprovisioned by this module, though Drupal does give - * users the ability to reset their password to something they know via the Request new password feature - * KLUDGE: Drupal does not kill the session on logout, even with drupal_session_destroy_uid(), so I had to use session_destroy() - * @todo rework the default login limitation logic to use a drupal permission rather - * than a list of UIDs. - * @todo when denying access because the administrator has chosen not to allow the module - * to register/create accounts, the user is told to contact the administrator; the - * message should provide the contact information - * ISSUE: until Drupal issue #754560 is resolved users will not see logout notices + * ISSUE: User is always dropped on user page after login, instead of where + * they were when they clicked "Federated Log In". Because of this, deep + * linking to access controlled content does not work. Usability would + * be considerably increased if this were resolved. + * FYI: Drupal now requires knowledge of the local user password in order to + * change e-mail address, etc. This could be an issue for users of + * accounts that are autoprovisioned by this module, though Drupal does + * give users the ability to reset their password to something they know + * via the Request new password feature. + * KLUDGE: Drupal does not kill the session on logout, even with + * drupal_session_destroy_uid(), so I had to use session_destroy(). + * @todo Rework the default login limitation logic to use a drupal permission + * rather than a list of UIDs. + * @todo When denying access because the administrator has chosen not to allow + * the module to register/create accounts, the user is told to contact + * the administrator; the message should provide the contact information. + * ISSUE: Until Drupal issue #754560 is resolved users will not see logout + * notices. */ - - /** * Implements hook_menu(). */ function simplesamlphp_auth_menu() { + $items = array(); + + $items['admin/config/people/simplesamlphp_auth'] = array( + 'title' => 'simpleSAMLphp authentication module settings', + 'description' => 'Control the various settings of the simpleSAMLphp authentication module', + 'page callback' => 'drupal_get_form', + 'page arguments' => array('simplesamlphp_auth_settings'), + 'access arguments' => array('administer simpleSAMLphp authentication'), + 'type' => MENU_LOCAL_TASK | MENU_NORMAL_ITEM, + ); + $items['saml_login'] = array( + 'title' => 'Logon to the site', + 'description' => 'Provides a site login page', + 'page callback' => 'simplesamlphp_auth_loginpage', + 'access callback' => TRUE, + 'type' => MENU_CALLBACK, + ); - $items = array(); - - $items['admin/config/people/simplesamlphp_auth'] = array( - 'title' => 'simpleSAMLphp authentication module settings', - 'description' => 'Control the various settings of the simpleSAMLphp authentication module', - 'page callback' => 'drupal_get_form', - 'page arguments' => array('simplesamlphp_auth_settings'), - 'access arguments' => array('administer simpleSAMLphp authentication'), - 'type' => MENU_LOCAL_TASK | MENU_NORMAL_ITEM, - ); - - $items['saml_login'] = array( - 'title' => 'Logon to the site', - 'description' => 'Provides a site login page', - 'page callback' => 'simplesamlphp_auth_loginpage', - 'access callback' => TRUE, - 'type' => MENU_CALLBACK, - ); - - return $items; + return $items; } - - /** * Implements hook_admin_paths(). */ function simplesamlphp_auth_admin_paths() { - - $paths = array('admin/config/people/simplesamlphp_auth' => TRUE); - return $paths; + return array('admin/config/people/simplesamlphp_auth' => TRUE); } - - /** * Implements hook_help(). */ function simplesamlphp_auth_help($path, $arg) { - switch ($path) { case 'admin/config/people/simplesamlphp_auth': - $output = t('

This module integrates Drupal with a SimpleSAMLphp Service Point (SP), effectively federating Drupal.

'); - $output .= t('

'); - - return $output; + $output = t('

This module integrates Drupal with a SimpleSAMLphp Service Point (SP), effectively federating Drupal.

'); + $output .= t('

'); + return $output; } } - - /** * Implements hook_permission(). */ function simplesamlphp_auth_permission() { - return array( - 'administer simpleSAMLphp authentication' => array('title' => t('Administer simpleSAMLphp authentication')) + 'administer simpleSAMLphp authentication' => array( + 'title' => t('Administer simpleSAMLphp authentication'), + //'description' => t('@TODO'), + ), ); } - - /** * Represents the Drupal page (saml_login), which triggers user authentication against the SimpleSAMLphp service provider. */ function simplesamlphp_auth_loginpage() { - global $user; global $_simplesamlphp_auth_as; global $_simplesamlphp_auth_saml_attributes; @@ -125,18 +115,18 @@ function simplesamlphp_auth_loginpage() { if ($fail) { drupal_set_message(t('We\'re sorry. There was a problem. The issue has been logged for the administrator.')); drupal_goto('/'); - } if ($user->uid == 0 ) { if ($user->uid == 0) { - // Require the user to be authentcated. + // Require the user to be authenticated. $_simplesamlphp_auth_as->requireAuth(); - } - else { - $output .= t('Looks like you\'re already logged in.'); - $output .= t('Perhaps you logged into Drupal using a local account?'); - } + } + else { + // @TODO This code is never reached. + $output .= t('Looks like you\'re already logged in.'); + $output .= t('Perhaps you logged into Drupal using a local account?'); + } } else { drupal_goto('user/' . $user->uid); @@ -145,8 +135,6 @@ function simplesamlphp_auth_loginpage() { return $output; } - - /** * Implements hook_init(). */ @@ -179,17 +167,14 @@ function simplesamlphp_auth_init() { $_simplesamlphp_auth_saml_config = SimpleSAML_Configuration::getInstance(); $_simplesamlphp_auth_saml_version = $_simplesamlphp_auth_saml_config->getVersion(); - // Load simpleSAMLphp, configuration and metadata. $_simplesamlphp_auth_as = new SimpleSAML_Auth_Simple(variable_get('simplesamlphp_auth_authsource', 'default-sp')); $_simplesamlphp_auth_saml_attributes = $_simplesamlphp_auth_as->getAttributes(); if ($user->uid == 0) { - // User is not logged in to Drupal. if ($_simplesamlphp_auth_as->isAuthenticated()) { // User is logged in - SimpleSAMLphp (but not Drupal). - // Get unique identifier from saml attributes. $authname = _simplesamlphp_auth_get_authname(); @@ -204,7 +189,6 @@ function simplesamlphp_auth_init() { $ext_user = user_external_load($authname); if (!$ext_user) { - // First we check the admin settings for simpleSAMLphp and find out if we are allowed to register users. if (variable_get('simplesamlphp_auth_registerusers', TRUE)) { @@ -224,14 +208,12 @@ function simplesamlphp_auth_init() { } else { - // We are not allowed to register new users on the site through simpleSAML. // We let the user know about this and redirect to the user/login page. $msg = t("We are sorry. While you have successfully authenticated, you are not yet entitled to access this site. Please ask the site administrator to provision access for you."); drupal_set_message($msg); $_simplesamlphp_auth_as->logout('/?msg=' . $msg); } - } else { // If successfully logged into Drupal. @@ -247,7 +229,6 @@ function simplesamlphp_auth_init() { // Save the updated roles and populate the user object. $user = user_save($ext_user, $userinfo); - } else { // No need to evaluate roles, populate the user object. @@ -256,49 +237,36 @@ function simplesamlphp_auth_init() { $msg = t("Welcome back."); drupal_set_message($msg, 'status'); - } // Finalizing the login, calls hook_user op login. $edit = array(); user_login_finalize($edit); - } // End if !empty authname. - } // End if isset saml_session. - } else { - // the user is already logged into Drupal - - // if we forbid users from loggin in using local accounts + // The user is already logged into Drupal. + // If we forbid users from logging in using local accounts. if (false == variable_get('simplesamlphp_auth_allowdefaultlogin', '')) { - // If the user has NOT been authenticated via simpleSAML... if (!$_simplesamlphp_auth_as->isAuthenticated()) { - // :FYI: Until Drupal issue #754560 is corrected this message will never be seen by the user. drupal_set_message(t("We are sorry, users are not permitted to log in using local accounts.")); - // Destroy the user's session (log them out). _simplesamlphp_auth_destroy_drupal_session(); } - } else { // If we are allowing users to log in with local accounts. - // If the user has NOT been authenticated via simpleSAML. if (!$_simplesamlphp_auth_as->isAuthenticated()) { - // See if we limit this privilege to specified users $strAllwDefLogUsers = variable_get('simplesamlphp_auth_allowdefaultloginusers', ''); $arrAllwDefLogUsers = array(); // If user IDs are specified, we let them in, but everyone else gets logged out. if (drupal_strlen($strAllwDefLogUsers)) { - // @todo Perform a test to make sure that only numbers, spaces, or commas are in the string. - // Convert the string into an array. $arrAllwDefLogUsers = explode(',', $strAllwDefLogUsers); @@ -315,282 +283,236 @@ function simplesamlphp_auth_init() { _simplesamlphp_auth_destroy_drupal_session(); } } - } // Test for specified users. - } // End if $_simplesamlphp_auth_as->isAuthenticated(). - } // End test to see if we allow default logins. - } // End if user->uid. - } - - /** * Implements hook_user_insert(). */ function simplesamlphp_auth_user_insert(&$edit, $account, $category = NULL) { + global $_simplesamlphp_auth_as; + global $_simplesamlphp_auth_saml_attributes; - global $_simplesamlphp_auth_as; - global $_simplesamlphp_auth_saml_attributes; - - if ($category = 'account') { - // If user registration has a valid session... - - if ($_simplesamlphp_auth_as->isAuthenticated()) { - // Get name from default attributes. - - try { - _simplesaml_auth_debug(t('Registering user [%acctname]', array('%acctname' => $account->name))); - $account->name = _simplesamlphp_auth_get_default_name($account->uid); - } catch (Exception $e) { - $message = t('Username is missing.' . $e->getMessage()); - drupal_set_message($message, "error"); - watchdog('simplesamlphp', $message, WATCHDOG_CRITICAL); - } - - db_update('users') - ->fields(array('name' => $account->name)) - ->condition('uid', $account->uid) - ->execute(); - - _simplesaml_auth_debug(t('Updating username [%acctname]', array('%acctname' => $account->name))); + if ($category = 'account') { + // If user registration has a valid session... + if ($_simplesamlphp_auth_as->isAuthenticated()) { + // Get name from default attributes. + try { + _simplesaml_auth_debug(t('Registering user [%acctname]', array('%acctname' => $account->name))); + $account->name = _simplesamlphp_auth_get_default_name($account->uid); + } + catch (Exception $e) { + $message = t('Username is missing.' . $e->getMessage()); + drupal_set_message($message, "error"); + watchdog('simplesamlphp', $message, WATCHDOG_CRITICAL); + } - // Get mail from default attribute. - try { - $mail_address = _simplesamlphp_auth_get_mail(); - } catch (Exception $e) { - $message = t('Email is missing.' . $e->getMessage()); - drupal_set_message($message, "error"); - watchdog('simplesamlphp', $message, WATCHDOG_CRITICAL); - } + db_update('users') + ->fields(array('name' => $account->name)) + ->condition('uid', $account->uid) + ->execute(); - if (!empty($mail_address)) { - db_update('users') - ->fields(array('mail' => $mail_address)) - ->condition('uid', $account->uid) - ->execute(); - } + _simplesaml_auth_debug(t('Updating username [%acctname]', array('%acctname' => $account->name))); - _simplesaml_auth_debug(t('Updating mail [%mailaddr]', array('%mailaddr' => $mail_address))); + // Get mail from default attribute. + try { + $mail_address = _simplesamlphp_auth_get_mail(); + } + catch (Exception $e) { + $message = t('Email is missing.' . $e->getMessage()); + drupal_set_message($message, "error"); + watchdog('simplesamlphp', $message, WATCHDOG_CRITICAL); + } + if (!empty($mail_address)) { + db_update('users') + ->fields(array('mail' => $mail_address)) + ->condition('uid', $account->uid) + ->execute(); } + _simplesaml_auth_debug(t('Updating mail [%mailaddr]', array('%mailaddr' => $mail_address))); } + } } - - /** * Implements hook_user_logout(). */ function simplesamlphp_auth_user_logout($account) { + global $user; + global $_simplesamlphp_auth_as; + global $_simplesamlphp_auth_saml_attributes; - global $user; - global $_simplesamlphp_auth_as; - global $_simplesamlphp_auth_saml_attributes; - - if (!empty($_simplesamlphp_auth_saml_attributes)) { - - $config = SimpleSAML_Configuration::getInstance(); - $msg = 'with_slo'; - - try { - $slo = $config->getString('SingleLogoutService'); - } catch (Exception $e) { - $msg = "no_slo"; - } - - // :KLUDGE: for some reason Drupal is not killing the session, even if I were to call drupal_session_destroy_uid() here. - session_destroy(); + if (!empty($_simplesamlphp_auth_saml_attributes)) { - $_simplesamlphp_auth_as->logout('/?msg=' . $msg); + $config = SimpleSAML_Configuration::getInstance(); + $msg = 'with_slo'; + try { + $slo = $config->getString('SingleLogoutService'); + } + catch (Exception $e) { + $msg = "no_slo"; } -} - + // :KLUDGE: for some reason Drupal is not killing the session, even if I were to call drupal_session_destroy_uid() here. + session_destroy(); + $_simplesamlphp_auth_as->logout('/?msg=' . $msg); + } +} /** * Implements hook_user_delete(). */ function simplesamlphp_auth_user_delete($account) { - - db_delete('authmap') - ->condition('uid', $account->uid) - ->condition('authname', $account->name) - ->execute(); + db_delete('authmap') + ->condition('uid', $account->uid) + ->condition('authname', $account->name) + ->execute(); } - - /** * Implements settings for the module. */ function simplesamlphp_auth_settings() { + global $_simplesamlphp_auth_saml_version; - global $_simplesamlphp_auth_saml_version; - - if (!empty($_simplesamlphp_auth_saml_version )) { - $ver = explode('.', $_simplesamlphp_auth_saml_version); - if ($ver[0] >= 1 && $ver[1] >= 5) { - // Present nothing - } - else { - drupal_set_message(t("Please upgrade SimpleSAMLphp. You are using %ssp_version", array('%ssp_version' => $_simplesamlphp_auth_saml_version)), 'warning'); - } + if (!empty($_simplesamlphp_auth_saml_version )) { + $ver = explode('.', $_simplesamlphp_auth_saml_version); + if ($ver[0] >= 1 && $ver[1] >= 5) { + // Present nothing; @TODO restructure this conditional to not be empty and have no else + } + else { + drupal_set_message(t("Please upgrade SimpleSAMLphp. You are using %ssp_version", array('%ssp_version' => $_simplesamlphp_auth_saml_version)), 'warning'); } + } - $form = array( - - 'simplesamlphp_auth_installdir' => array( - '#type' => 'textfield', - '#title' => t('Installation directory (default: /var/simplesamlphp)'), - '#default_value' => variable_get('simplesamlphp_auth_installdir', '/var/simplesamlphp'), - '#description' => t('The base directory of simpleSAMLphp. Absolute path with no trailing slash.'), - ), - - 'simplesamlphp_auth_authsource' => array( - '#type' => 'textfield', - '#title' => t('Autenticaton source for this SP (default: default-sp)'), - '#default_value' => variable_get('simplesamlphp_auth_authsource', 'default-sp'), - '#description' => t('The name of the source to use from /var/simplesamlphp/config/authsources.php'), - ), - - 'simplesamlphp_auth_user_name' => array( - '#type' => 'textfield', - '#title' => t('Which attribute from simpleSAMLphp should be used as user\'s name'), - '#default_value' => variable_get('simplesamlphp_auth_user_name', 'eduPersonPrincipalName'), - '#description' => t('Example: eduPersonPrincipalName or displayName
If the attribute is multivalued, the first value will be used.'), - '#required' => TRUE, - ), - - 'simplesamlphp_auth_unique_id' => array( - '#type' => 'textfield', - '#title' => t('Which attribute from simpleSAMLphp should be used as unique identifier for the user'), - '#default_value' => variable_get('simplesamlphp_auth_unique_id', 'eduPersonPrincipalName'), - '#description' => t('Example: eduPersonPrincipalName or eduPersonTargetedID
If the attribute is multivalued, the first value will be used.'), - '#required' => TRUE, - ), - - 'simplesamlphp_auth_mailattr' => array( - '#type' => 'textfield', - '#title' => t('Which attribute from simpleSAMLphp should be used as user mail address'), - '#default_value' => variable_get('simplesamlphp_auth_mailattr', 'mail'), - '#description' => t('Example: mail
If the user attribute is multivalued, the first value will be used.'), - ), - - 'simplesamlphp_auth_rolepopulation' => array( - '#type' => 'textarea', - '#title' => t('Automatic role population from simpleSAMLphp attributes'), - '#default_value' => variable_get('simplesamlphp_auth_rolepopulation', ''), - '#description' => t('A pipe separated list of rules.
Example: roleid1:condition1|roleid2:contition2...
For instance: 1:eduPersonPrincipalName,@=,uninett.no;affiliation,=,employee|2:mail,=,andreas@uninett.no'), - ), - - 'simplesamlphp_auth_roleevaleverytime' => array( - '#type' => 'checkbox', - '#title' => t('Reevaluate roles every time the user logs in.'), - '#default_value' => variable_get('simplesamlphp_auth_roleevaleverytime', 0), - '#description' => t('NOTE: This means users could loose any roles that have been assigned manually in Drupal.'), - ), - - 'simplesamlphp_auth_forcehttps' => array( - '#type' => 'checkbox', - '#title' => t('Force https for login links'), - '#default_value' => variable_get('simplesamlphp_auth_forcehttps', TRUE), - '#description' => t('Should be enabled on production sites.'), - ), - - 'simplesamlphp_auth_registerusers' => array( - '#type' => 'checkbox', - '#title' => t('Register users'), - '#default_value' => variable_get('simplesamlphp_auth_registerusers', TRUE), - '#description' => t('Decides wether or not the module should create/register new users upon authentication.
NOTE: If unchecked each user must already have been provisioned a Drupal account before logging in. Otherwise they will receive a notice and be denied access.'), - ), - - 'simplesamlphp_auth_allowdefaultlogin' => array( - '#type' => 'checkbox', - '#title' => t('Allow authentication with local Drupal accounts'), - '#default_value' => variable_get('simplesamlphp_auth_allowdefaultlogin', TRUE), - '#description' => t('Check this box if you want to let people log in with local Drupal accounts (without using simpleSAMLphp). If you want to restrict this privilege to certain users you can enter the Drupal user IDs in the next field.'), - ), - - 'simplesamlphp_auth_allowdefaultloginusers' => array( - '#type' => 'textfield', - '#title' => t('Which users should be allowed to login with local accounts?'), - '#default_value' => variable_get('simplesamlphp_auth_allowdefaultloginusers', ''), - '#description' => t('Example: 1,2,3
A comma-separated list of user IDs that should be allowed to login without simpleSAMLphp.'), - ), - ); - - return system_settings_form($form); + $form = array( + 'simplesamlphp_auth_installdir' => array( + '#type' => 'textfield', + '#title' => t('Installation directory (default: /var/simplesamlphp)'), + '#default_value' => variable_get('simplesamlphp_auth_installdir', '/var/simplesamlphp'), + '#description' => t('The base directory of simpleSAMLphp. Absolute path with no trailing slash.'), + ), + 'simplesamlphp_auth_authsource' => array( + '#type' => 'textfield', + '#title' => t('Autenticaton source for this SP (default: default-sp)'), + '#default_value' => variable_get('simplesamlphp_auth_authsource', 'default-sp'), + '#description' => t('The name of the source to use from /var/simplesamlphp/config/authsources.php'), + ), + 'simplesamlphp_auth_user_name' => array( + '#type' => 'textfield', + '#title' => t('Which attribute from simpleSAMLphp should be used as user\'s name'), + '#default_value' => variable_get('simplesamlphp_auth_user_name', 'eduPersonPrincipalName'), + '#description' => t('Example: eduPersonPrincipalName or displayName
If the attribute is multivalued, the first value will be used.'), + '#required' => TRUE, + ), + 'simplesamlphp_auth_unique_id' => array( + '#type' => 'textfield', + '#title' => t('Which attribute from simpleSAMLphp should be used as unique identifier for the user'), + '#default_value' => variable_get('simplesamlphp_auth_unique_id', 'eduPersonPrincipalName'), + '#description' => t('Example: eduPersonPrincipalName or eduPersonTargetedID
If the attribute is multivalued, the first value will be used.'), + '#required' => TRUE, + ), + 'simplesamlphp_auth_mailattr' => array( + '#type' => 'textfield', + '#title' => t('Which attribute from simpleSAMLphp should be used as user mail address'), + '#default_value' => variable_get('simplesamlphp_auth_mailattr', 'mail'), + '#description' => t('Example: mail
If the user attribute is multivalued, the first value will be used.'), + ), + 'simplesamlphp_auth_rolepopulation' => array( + '#type' => 'textarea', + '#title' => t('Automatic role population from simpleSAMLphp attributes'), + '#default_value' => variable_get('simplesamlphp_auth_rolepopulation', ''), + '#description' => t('A pipe separated list of rules.
Example: roleid1:condition1|roleid2:contition2...
For instance: 1:eduPersonPrincipalName,@=,uninett.no;affiliation,=,employee|2:mail,=,andreas@uninett.no'), + ), + 'simplesamlphp_auth_roleevaleverytime' => array( + '#type' => 'checkbox', + '#title' => t('Reevaluate roles every time the user logs in.'), + '#default_value' => variable_get('simplesamlphp_auth_roleevaleverytime', 0), + '#description' => t('NOTE: This means users could loose any roles that have been assigned manually in Drupal.'), + ), + 'simplesamlphp_auth_forcehttps' => array( + '#type' => 'checkbox', + '#title' => t('Force https for login links'), + '#default_value' => variable_get('simplesamlphp_auth_forcehttps', TRUE), + '#description' => t('Should be enabled on production sites.'), + ), + 'simplesamlphp_auth_registerusers' => array( + '#type' => 'checkbox', + '#title' => t('Register users'), + '#default_value' => variable_get('simplesamlphp_auth_registerusers', TRUE), + '#description' => t('Decides wether or not the module should create/register new users upon authentication.
NOTE: If unchecked each user must already have been provisioned a Drupal account before logging in. Otherwise they will receive a notice and be denied access.'), + ), + 'simplesamlphp_auth_allowdefaultlogin' => array( + '#type' => 'checkbox', + '#title' => t('Allow authentication with local Drupal accounts'), + '#default_value' => variable_get('simplesamlphp_auth_allowdefaultlogin', TRUE), + '#description' => t('Check this box if you want to let people log in with local Drupal accounts (without using simpleSAMLphp). If you want to restrict this privilege to certain users you can enter the Drupal user IDs in the next field.'), + ), + 'simplesamlphp_auth_allowdefaultloginusers' => array( + '#type' => 'textfield', + '#title' => t('Which users should be allowed to login with local accounts?'), + '#default_value' => variable_get('simplesamlphp_auth_allowdefaultloginusers', ''), + '#description' => t('Example: 1,2,3
A comma-separated list of user IDs that should be allowed to login without simpleSAMLphp.'), + ), + ); + return system_settings_form($form); } - - /** * Implements hook_form_alter(). */ function simplesamlphp_auth_form_alter(&$form, $form_state, $form_id) { + if ($form_id == 'user_login_block') { + $link = l('Federated Log In', 'saml_login'); + $links = $form['links']['#markup']; + $links = str_replace('', '
  • ' . $link . '
    • ', $links); + $form['links']['#markup'] = $links; + } - if ($form_id == 'user_login_block') { - $link = l('Federated Log In', 'saml_login'); - $links = $form['links']['#markup']; - $links = str_replace('', '
  • ' . $link . '
    • ', $links); - $form['links']['#markup'] = $links; - } - - - if ($form_id == 'user_account_form') { - $link = l('Federated Log In', 'saml_login'); - $links = $form['links']['#markup']; - $links = str_replace('', '
  • ' . $link . '
    • ', $links); - $form['links']['#markup'] = $links; - } + if ($form_id == 'user_account_form') { + $link = l('Federated Log In', 'saml_login'); + $links = $form['links']['#markup']; + $links = str_replace('', '
  • ' . $link . '
    • ', $links); + $form['links']['#markup'] = $links; + } } - - /** * Implements hook_block_view(). */ function simplesamlphp_auth_block_view($delta = '') { - - switch ($delta) { - case 0: - $block = array('subject' => t('simpleSAMLphp login'), - 'content' => _simplesamlphp_auth_generate_block_text()); - break; - } - return $block; + switch ($delta) { + case 0: + $block = array('subject' => t('simpleSAMLphp login'), + 'content' => _simplesamlphp_auth_generate_block_text()); + break; + } + return $block; } - - /** * Implements hook_block_info(). */ function simplesamlphp_auth_block_info() { - - $block = array( - array( - 'info' => t('simpleSAMLphp authentication'), - 'cache' => DRUPAL_NO_CACHE, - ) - ); - return $block; + $block = array( + array( + 'info' => t('simpleSAMLphp authentication'), + 'cache' => DRUPAL_NO_CACHE, + ) + ); + return $block; } - - // Helper functions -------------------------------------- - - /** * Gets the authname attribute from the SAML assertion. * @@ -598,26 +520,23 @@ function simplesamlphp_auth_block_info() { * The authname attribute. */ function _simplesamlphp_auth_get_authname() { + global $_simplesamlphp_auth_saml_attributes; - global $_simplesamlphp_auth_saml_attributes; - - $authname = ''; + $authname = ''; - // Check if valid local session exists.. - if (isset($_simplesamlphp_auth_saml_attributes)) { - _simplesaml_auth_debug(t('_simplesamlphp_auth_get_authname: Valid local session exist')); - if (isset($_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')])) { - $authname = $_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')][0]; - } - else { - throw new Exception(t('error in simplesamlphp_auth.module: no valid unique id attribute set')); - } + // Check if valid local session exists.. + if (isset($_simplesamlphp_auth_saml_attributes)) { + _simplesaml_auth_debug(t('_simplesamlphp_auth_get_authname: Valid local session exist')); + if (isset($_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')])) { + $authname = $_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')][0]; } - return $authname; + else { + throw new Exception(t('error in simplesamlphp_auth.module: no valid unique id attribute set')); + } + } + return $authname; } - - /** * Gets the default name attribute from the SAML assertion. * @@ -625,28 +544,22 @@ function _simplesamlphp_auth_get_authname() { * The name attribute. */ function _simplesamlphp_auth_get_default_name($account) { - global $_simplesamlphp_auth_as; global $_simplesamlphp_auth_saml_attributes; - $default_name = ''; - - // Check if valid local session exists.. - if ($_simplesamlphp_auth_as->isAuthenticated() ) { - - $auth_user_name_attr = variable_get('simplesamlphp_auth_user_name', 'eduPersonPrincipalName'); - if (!isset($_simplesamlphp_auth_saml_attributes[$auth_user_name_attr]) || !isset($_simplesamlphp_auth_saml_attributes[$auth_user_name_attr][0])) { - throw new Exception(t('There was no attribute named %auth_user_name_attr set for your user.', array('%auth_user_name_attr' => $auth_user_name_attr))); - } - - $default_name = $_simplesamlphp_auth_saml_attributes[$auth_user_name_attr][0]; + $default_name = ''; + // Check if valid local session exists.. + if ($_simplesamlphp_auth_as->isAuthenticated() ) { + $auth_user_name_attr = variable_get('simplesamlphp_auth_user_name', 'eduPersonPrincipalName'); + if (!isset($_simplesamlphp_auth_saml_attributes[$auth_user_name_attr]) || !isset($_simplesamlphp_auth_saml_attributes[$auth_user_name_attr][0])) { + throw new Exception(t('There was no attribute named %auth_user_name_attr set for your user.', array('%auth_user_name_attr' => $auth_user_name_attr))); } - return $default_name; + $default_name = $_simplesamlphp_auth_saml_attributes[$auth_user_name_attr][0]; + } + return $default_name; } - - /** * Gets the mail attribute. * @@ -654,68 +567,58 @@ function _simplesamlphp_auth_get_default_name($account) { * The mail attribute. */ function _simplesamlphp_auth_get_mail() { - - global $_simplesamlphp_auth_as; - global $_simplesamlphp_auth_saml_attributes; - $mail_address = ''; - // Check if valid local session exists.. - if ($_simplesamlphp_auth_as->isAuthenticated()) { - if (isset($_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_mailattr', 'mail')])) { - $mail_address = $_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_mailattr', 'mail')][0]; - } - else { - throw new Exception(t('error in simplesamlphp_auth.module: no valid mail attribute set')); - } + global $_simplesamlphp_auth_as; + global $_simplesamlphp_auth_saml_attributes; + $mail_address = ''; + // Check if valid local session exists.. + if ($_simplesamlphp_auth_as->isAuthenticated()) { + if (isset($_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_mailattr', 'mail')])) { + $mail_address = $_simplesamlphp_auth_saml_attributes[variable_get('simplesamlphp_auth_mailattr', 'mail')][0]; + } + else { + throw new Exception(t('error in simplesamlphp_auth.module: no valid mail attribute set')); } + } - return $mail_address; + return $mail_address; } - - /** * Forces HTTPS connections. */ function _simplesamlphp_auth_forcehttps_rewrite($url) { + if (variable_get('simplesamlphp_auth_forcehttps', TRUE)) { + $url = str_replace('http://', 'https://', $url); + _simplesaml_auth_debug('forcehttps rewrite: ' . $url); + } - if (variable_get('simplesamlphp_auth_forcehttps', TRUE)) { - $url = str_replace('http://', 'https://', $url); - _simplesaml_auth_debug('forcehttps rewrite: ' . $url); - } - - return $url; + return $url; } - - /** * Generates the text for the log in block. */ function _simplesamlphp_auth_generate_block_text() { + global $_simplesamlphp_auth_as; + $block_content = ''; + global $user; - global $_simplesamlphp_auth_as; - $block_content = ''; - global $user; - - // Check if valid local session exists.. - if ($_simplesamlphp_auth_as->isAuthenticated()) { - $block_content .= '

    Logged in as: ' . $user->name . '
    ' . l('Log Out', 'user/logout') . '

    '; - } - else { - $block_content .= '

    ' . l('Federated Log In', 'saml_login') . '

    '; - } + // Check if valid local session exists.. + if ($_simplesamlphp_auth_as->isAuthenticated()) { + $block_content .= '

    Logged in as: ' . $user->name . '
    ' . l('Log Out', 'user/logout') . '

    '; + } + else { + $block_content .= '

    ' . l('Federated Log In', 'saml_login') . '

    '; + } - return $block_content; + return $block_content; } - - /** * Evaluates a role rule. * * @param $roleruleevaluation * An array containing the role rule to evaluate. - * * @param $attributes * An array containing the identity attributes. * @@ -723,27 +626,28 @@ function _simplesamlphp_auth_generate_block_text() { * An array containing role value and the attribute, or FALSE. */ function _simplesamlphp_auth_evaulaterolerule($roleruleevaluation, $attributes) { + _simplesaml_auth_debug(t('Evaluate rule (key=%key,operator=%op,value=%val)', array('%key' => $roleruleevaluation[0], '%op' => $roleruleevaluation[1], '%val' => $roleruleevaluation[2]))); - _simplesaml_auth_debug(t('Evaluate rule (key=%key,operator=%op,value=%val)', array('%key' => $roleruleevaluation[0], '%op' => $roleruleevaluation[1], '%val' => $roleruleevaluation[2]))); - - if (!array_key_exists($roleruleevaluation[0], $attributes)) return FALSE; - $attribute = $attributes[$roleruleevaluation[0]]; + if (!array_key_exists($roleruleevaluation[0], $attributes)) { + return FALSE; + } + $attribute = $attributes[$roleruleevaluation[0]]; - switch ($roleruleevaluation[1]) { - case '=' : - return in_array($roleruleevaluation[2], $attribute); + switch ($roleruleevaluation[1]) { + case '=' : + return in_array($roleruleevaluation[2], $attribute); - case '@=' : - $dc = explode('@', $attribute[0]); - if (count($dc) != 2) return FALSE; - return ($dc[1] == $roleruleevaluation[2]); - } + case '@=' : + $dc = explode('@', $attribute[0]); + if (count($dc) != 2) { + return FALSE; + } + return ($dc[1] == $roleruleevaluation[2]); + } - return FALSE; + return FALSE; } - - /** * Performs role population. * @@ -754,78 +658,73 @@ function _simplesamlphp_auth_evaulaterolerule($roleruleevaluation, $attributes) * An array containing user's roles. */ function _simplesamlphp_auth_rolepopulation($rolemap) { + global $_simplesamlphp_auth_as; + global $_simplesamlphp_auth_saml_attributes; + $roles = array(); - global $_simplesamlphp_auth_as; - global $_simplesamlphp_auth_saml_attributes; - $roles = array(); - - _simplesaml_auth_debug(t('Rolemap: %rolemap', array('%rolemap' => $rolemap))); - - // Check if valid local session exists.. - if ($_simplesamlphp_auth_as->isAuthenticated()) { - $attributes = $_simplesamlphp_auth_saml_attributes; - - if (empty($rolemap)) return $roles; + _simplesaml_auth_debug(t('Rolemap: %rolemap', array('%rolemap' => $rolemap))); - _simplesaml_auth_debug(t('Evaluate rolemap: %rolemap', array('%rolemap' => $rolemap))); + // Check if valid local session exists.. + if ($_simplesamlphp_auth_as->isAuthenticated()) { + $attributes = $_simplesamlphp_auth_saml_attributes; - $rolerules = explode('|', $rolemap); + if (empty($rolemap)) return $roles; - foreach ($rolerules AS $rolerule) { + _simplesaml_auth_debug(t('Evaluate rolemap: %rolemap', array('%rolemap' => $rolemap))); - _simplesaml_auth_debug(t('Evaluate role rule: %rolerule', array('%rolerule' => $rolerule))); + $rolerules = explode('|', $rolemap); - $roleruledecompose = explode(':', $rolerule); + foreach ($rolerules AS $rolerule) { + _simplesaml_auth_debug(t('Evaluate role rule: %rolerule', array('%rolerule' => $rolerule))); - $roleid = $roleruledecompose[0]; - $roleruleevaluations = explode(';', $roleruledecompose[1]); + $roleruledecompose = explode(':', $rolerule); - $addnew = TRUE; - foreach ($roleruleevaluations AS $roleruleevaluation) { + $roleid = $roleruledecompose[0]; + $roleruleevaluations = explode(';', $roleruledecompose[1]); - _simplesaml_auth_debug(t('Evaluate role evaulation: %roleruleeval', array('%roleruleeval' => $roleruleevaluation))); + $addnew = TRUE; + foreach ($roleruleevaluations AS $roleruleevaluation) { - $roleruleevaluationdc = explode(',', $roleruleevaluation); - if (!_simplesamlphp_auth_evaulaterolerule($roleruleevaluationdc, $attributes)) $addnew = FALSE; - } - if ($addnew) { - $roles[$roleid] = $roleid; - _simplesaml_auth_debug(t('Add new role: %roleid', array('%roleid' => $roleid))); - } + _simplesaml_auth_debug(t('Evaluate role evaulation: %roleruleeval', array('%roleruleeval' => $roleruleevaluation))); + $roleruleevaluationdc = explode(',', $roleruleevaluation); + if (!_simplesamlphp_auth_evaulaterolerule($roleruleevaluationdc, $attributes)) { + $addnew = FALSE; } + } + if ($addnew) { + $roles[$roleid] = $roleid; + _simplesaml_auth_debug(t('Add new role: %roleid', array('%roleid' => $roleid))); + } + } - return $roles; + } + return $roles; } - - /** * This helper function is used by developers to debug the form API workflow in this module. */ function _simplesaml_auth_debug($message) { - watchdog('simplesamlphp', $message, NULL, WATCHDOG_DEBUG); } - - /** * Helper function for logging out a user that is has a active session in Drupal but not with simpleSAML. */ function _simplesamlphp_auth_destroy_drupal_session() { - global $user; + global $user; - watchdog('user', 'Session closed for %name.', array('%name' => $user->name)); + watchdog('user', 'Session closed for %name.', array('%name' => $user->name)); - // Destroy the current session: - session_destroy(); - // Only variables can be passed by reference workaround. - $NULL = NULL; - user_module_invoke('logout', $NULL, $user); + // Destroy the current session: + session_destroy(); + // Only variables can be passed by reference workaround. + $NULL = NULL; + user_module_invoke('logout', $NULL, $user); - // Load the anonymous user - $user = drupal_anonymous_user(); + // Load the anonymous user. + $user = drupal_anonymous_user(); - drupal_goto(); + drupal_goto(); }