<?php
// $Id: webserver_auth.module,v 1.22.2.1 2008/08/07 16:38:49 weitzman Exp $

/**
 * Implementation of hook_menu().
 */

function webserver_auth_menu () 
{
  $items = array ();
  $items ['admin/config/people/webserver_auth'] = array
  (
    'title' => t ('Webserver authentication'),
    'description' => t ('Configure a domain for generating email addresses. Optional.'),
    'page callback' => 'drupal_get_form',
    'page arguments' => array ('webserver_auth_settings'),
    'access arguments' => array ('administer site configuration'),
  );
  return $items;
}

/**
 * Implementation of hook_init().
 */

function webserver_auth_init () 
{
  global $user;
  $authname = '';
  if (isset ($_SERVER ['REDIRECT_REMOTE_USER'])) $authname = $_SERVER ['REDIRECT_REMOTE_USER'];
  elseif (isset ($_SERVER ['REMOTE_USER'])) $authname = $_SERVER ['REMOTE_USER'];
  else
  {
    $cookie_name = variable_get ('webserver_auth_cookie', '');
    if (($cookie_name) && (isset ($_COOKIE [$cookie_name])))
    {
      $values = explode (';', $_COOKIE [$cookie_name]);
      foreach ($values as $value)
      {
        $value = explode ('=', $value);
        if ($value [0] == 'uid')
        {
          $authname = $value [1];
          break;
        }
      }
    }
  }
  unset ($_SERVER['PHP_AUTH_USER'], $_SERVER['PHP_AUTH_PW']);
  if (! empty ($authname))  
  {
    $exists = FALSE;
    $uid = db_query ('SELECT uid FROM {authmap} WHERE authname = :authname AND module = :module', array (':authname' => $authname, ':module' => 'webserver_auth')) -> fetchField ();
    if (! $uid) 
    {
      $uid = db_query ('SELECT uid FROM {users} WHERE name = :name', array (':name' => $authname)) -> fetchField ();
      if ($uid) $exists = TRUE;
    }
    if ((isset ($user)) && ($user -> uid === $uid)) 
    {
    }
    else 
    {
      if (! empty ($authname)) 
      {
        if (! $exists) $user = user_external_load ($authname);
        else $user = user_load ($uid);
        if (! $user) user_external_login_register ($authname, 'webserver_auth');
      }
    }
  }
}

function webserver_auth_user_presave (&$edit, $account, $category)
{
  global $user;
  if (! isset ($account -> name)) 
  {
    $account -> name = $edit ['name'];
    if (variable_get ('webserver_auth_strip_prefix', TRUE)) 
    {
      $fields = explode ("\\", $account -> name);
      $account -> name = $fields [count ($fields) - 1];
    }
    if (variable_get ('webserver_auth_strip_domain', TRUE)) {
      $fields = explode ('@', $account->name);
      $account -> name = $fields [0];
    }
    $edit ['name'] = $account -> name;
  }
  if (! isset ($account -> mail)) 
  {
    if (! isset ($edit ['mail'])) 
    {
      if ($domain = variable_get ('webserver_auth_email_domain', '')) $edit ['mail'] = $edit ['init'] = sprintf ('%s@%s', $edit ['name'], $domain);
    }
    $account -> mail = $edit ['mail'];
  }
  if (! isset ($user)) 
  {
    $uid = db_query ('SELECT uid FROM {users} WHERE name = :name', array (':name' => 'anonymous')) -> fetchField ();
//    $user = user_load ($uid);
  }
}  

function webserver_auth_user_insert (&$edit, $account, $category) 
{
  if ($code = variable_get ('webserver_auth_insert', '')) eval ('?>'. $code);
}

function webserver_auth_user_logout ($account) 
{
  global $base_url;
  $base_url = str_replace ('https://', 'http://', $base_url);
}

function webserver_auth_settings () 
{
  $form = array ();
  $form ['webserver_auth_email_domain'] = array
  (
    '#type' => 'textfield',
    '#title' => t ('Email domain'),
    '#default_value' => variable_get ('webserver_auth_email_domain', ''),
    '#size' => 30,
    '#maxlength' => 55,
    '#description' => t ('Append this domain name to each new user in order generate his email address.'),
  );
  $form ['advanced'] = array(
    '#type' => 'fieldset',
    '#title' => t ('Advanced settings'),
    '#collapsible' => TRUE,
    '#collapsed' => TRUE,
    'webserver_auth_cookie' => array
    (
      '#type' => 'textfield',
      '#title' => t ('Auth Cookie'),
      '#default_value' => variable_get ('webserver_auth_cookie', ''),
      '#description' => t ("Name of the TKT auth cookie"),
    ),
    'webserver_auth_strip_prefix' => array
    (
      '#type' => 'checkbox',
      '#title' => t ('Strip prefix'),
      '#default_value' => variable_get ('webserver_auth_strip_prefix', TRUE),
      '#description' => t ("Strip NTLM-style prefixes (e.g. 'foo1\foo2') from the login name ('foo1\foo2\bar') to generate the username ('bar')."),
    ),
    'webserver_auth_strip_domain' => array
    (
      '#type' => 'checkbox',
      '#title' => t ('Strip domain'),
      '#default_value' => variable_get ('webserver_auth_strip_domain', TRUE),
      '#description' => t ("Strip a domain name (e.g. '@EXAMPLE.COM') from the login name ('newuser@EXAMPLE.COM') to generate the username ('newuser')."),
    ),
    'webserver_auth_disallow_pw_change' => array
    (
      '#type' => 'checkbox',
      '#title' => t ('Remove option to change password'),
      '#default_value' => variable_get ('webserver_auth_disallow_pw', TRUE),
      '#description' => t ("Remove the option for users to change their password.  This is most useful when the web server is already authenticating against an external database.  This also removes the password validation requirement to change email addresses."),
    ),
    'webserver_auth_disallow_username_change' => array
    (
      '#type' => 'checkbox',
      '#title' => t ('Disable option to change username'),
      '#default_value' => variable_get ('webserver_auth_disallow_username', TRUE),
      '#description' => t ("Disable the option for users to change their username.  This is most useful when the web server is already authenticating against an external database."),
    ),
    'webserver_auth_insert' => array
    (
      '#type' => 'textarea',
      '#title' => 'User account modification',
      '#default_value' => variable_get ('webserver_auth_insert', ''),
      '#description' => t ("Modify user accounts at the time of creation. Use PHP code (enclosed in <code>&lt;?php</code> and <code>?&gt;</code>). The variable <code>\$account</code> is available as in <a href=\"http://api.drupal.org/api/function/hook_user/7\">hook_user('insert',...)</a>. Changes to the user object must be explicitly saved to the database to be made permanent."),
    ),
  );
  return system_settings_form ($form);
}

/**
  * Implementation of hook form_FORM_ID_alter
  * FORM_ID = user_profile_form
  * We are going to disable the ability to change passwords and usernames!
  */
function webserver_auth_form_user_profile_form_alter(&$form, &$form_state, $form_id) {

  //disable option to change username and give reason why
  if (variable_get('webserver_auth_disallow_username_change', FALSE)) {
    $form['account']['name']['#disabled'] = TRUE;
    $form['account']['name']['#description'] = t('This value has been set by default from the browser login and cannot be changed.');
  }

  //disable password fields and checking on user account edits
  if (variable_get('webserver_auth_disallow_pw_change', FALSE)) {
    unset($form['account']['pass']);
    unset($form['account']['current_pass']);
    unset($form['account']['current_pass_required_values']);
    $form['#validate'] = array_diff($form['#validate'], array('user_validate_current_pass'));
  }
}