[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * @author Martin Dougiamas
   4   * @authro Jerome GUTIERREZ
   5   * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
   6   * @package moodle multiauth
   7   *
   8   * Authentication Plugin: CAS Authentication
   9   *
  10   * Authentication using CAS (Central Authentication Server).
  11   *
  12   * 2006-08-28  File created.
  13   */
  14  if (!defined('MOODLE_INTERNAL')) {
  15      die('Direct access to this script is forbidden.');    ///  It must be included from a Moodle page
  16  }
  17  require_once($CFG->libdir.'/authlib.php');
  18  require_once($CFG->dirroot.'/auth/cas/CAS/CAS.php');
  19  /**
  20   * CAS authentication plugin.
  21   */
  22  class auth_plugin_cas extends auth_plugin_base {
  23      /**
  24       * Constructor.
  25       */
  26      function auth_plugin_cas() {
  27          $this->authtype = 'cas';
  28          $this->config = get_config('auth/cas');
  29          if (empty($this->config->ldapencoding)) {
  30              $this->config->ldapencoding = 'utf-8';
  31          }
  32          if (empty($this->config->user_type)) {
  33              $this->config->user_type = 'default';
  34          }
  35          $default = $this->ldap_getdefaults();
  36          //use defaults if values not given
  37          foreach ($default as $key => $value) {
  38              // watch out - 0, false are correct values too
  39              if (!isset($this->config->{$key}) or $this->config->{$key} == '') {
  40                  $this->config->{$key} = $value[$this->config->user_type];
  41              }
  42          }
  43          //hack prefix to objectclass
  44          if (empty($this->config->objectclass)) {        // Can't send empty filter
  45              $this->config->objectclass='objectClass=*';
  46          } else if (strpos($this->config->objectclass, 'objectClass=') !== 0) {
  47              $this->config->objectclass = 'objectClass='.$this->config->objectclass;
  48          }
  49      }
  50      /**
  51       * Authenticates user againt CAS
  52       * Returns true if the username and password work and false if they are
  53       * wrong or don't exist.
  54       *
  55       * @param string $username The username
  56       * @param string $password The password
  57       * @return bool Authentication success or failure.
  58       */
  59      function user_login ($username, $password) {
  60          $this->connectCAS();    
  61          return phpCAS::isAuthenticated();
  62      }
  63      /**
  64       * Returns true if this authentication plugin is 'internal'.
  65       *
  66       * @return bool
  67       */
  68      function is_internal() {
  69          return false;
  70      }
  71      /**
  72       * Returns true if this authentication plugin can change the user's
  73       * password.
  74       *
  75       * @return bool
  76       */
  77      function can_change_password() {
  78          return false;
  79      }
  80      /**
  81       * authentication choice (CAS or other)
  82       * redirection to the CAS form or to login/index.php
  83       * for other authentication
  84       */
  85      function loginpage_hook() {
  86        global $frm;
  87        global $CFG;
  88        global $SESSION;
  89  
  90        $site = get_site();
  91        $CASform = get_string("CASform","auth");
  92        $username = optional_param("username");
  93  
  94        if (!empty($username)) {
  95            if (strstr($SESSION->wantsurl,'ticket') || strstr($SESSION->wantsurl,'NOCAS'))
  96                unset($SESSION->wantsurl);
  97            return;        
  98          }
  99  
 100  
 101          
 102          // Test si cas activ� et param�tres non remplis
 103        if (empty($this->config->hostname)) {
 104            return;
 105            }
 106  
 107  // Connection to CAS server
 108       $this->connectCAS();
 109  
 110        // Gestion de la connection CAS si acc�s direct d'un ent ou autre    
 111       if (phpCAS::checkAuthentication()) {
 112          $frm->username=phpCAS::getUser();
 113  //        if (phpCAS::getUser()=='esup9992')
 114  //            $frm->username='erhar0062';
 115          $frm->password="passwdCas";        
 116          return;
 117       }         
 118  
 119        if ($_GET["loginguest"]== true) {
 120              $frm->username="guest";
 121              $frm->password="guest";
 122              return;
 123        }        
 124       
 125       if ($this->config->multiauth) {
 126            $authCAS = optional_param("authCAS");
 127            if ($authCAS=="NOCAS")
 128              return;
 129  
 130  // choice authentication form for multi-authentication
 131  // test pgtIou parameter for proxy mode (https connection
 132  // in background from CAS server to the php server)
 133        if ($authCAS!="CAS" && !isset($_GET["pgtIou"])) {
 134              $navlinks = array();
 135              $navlinks[] = array('name' => $CASform, 'link' => null, 'type' => 'misc');
 136              $navigation = build_navigation($navlinks);
 137  
 138              print_header("$site->fullname: $CASform", $site->fullname, $navigation);
 139              include($CFG->dirroot."/auth/cas/cas_form.html");
 140              print_footer();
 141              exit();
 142           }
 143       }
 144  // CAS authentication
 145       if (!phpCAS::isAuthenticated())
 146          {phpCAS::forceAuthentication();}
 147  }
 148      /**
 149       * logout from the cas
 150       *
 151       * This function is called from admin/auth.php
 152       *
 153       */
 154      function prelogout_hook() {
 155          global $CFG;
 156        if ($this->config->logoutcas ) {
 157              $backurl = $CFG->wwwroot;
 158            $this->connectCAS();
 159              phpCAS::logout($backurl);
 160           }
 161      }
 162      /**
 163       * Connect to the cas (clientcas connection or proxycas connection
 164       *
 165       * This function is called from admin/auth.php
 166       *
 167       */
 168      function connectCAS() {
 169      
 170      global $PHPCAS_CLIENT;
 171  // mode proxy CAS
 172  if ( !is_object($PHPCAS_CLIENT) ) {
 173      if  ($this->config->proxycas) {
 174          phpCAS::proxy($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
 175      }
 176  // mode client CAS
 177      else {
 178          phpCAS::client($this->config->casversion, $this-> config->hostname, (int) $this->config->port, $this->config->baseuri);
 179      }
 180      }
 181      
 182      }
 183      /**
 184       * Prints a form for configuring this authentication plugin.
 185       *
 186       * This function is called from admin/auth.php, and outputs a full page with
 187       * a form for configuring this plugin.
 188       *
 189       * @param array $page An object containing all the data for this page.
 190       */
 191      function config_form($config, $err, $user_fields) {
 192          include  'config.html';
 193      }
 194      /**
 195       * Returns the URL for changing the user's pw, or empty if the default can
 196       * be used.
 197       *
 198       * @return string
 199       */
 200      function change_password_url() {
 201          return "";
 202      }
 203      /**
 204       * returns predefined usertypes
 205       *
 206       * @return array of predefined usertypes
 207       */
 208      function ldap_suppported_usertypes() {
 209          $types = array();
 210          $types['edir']='Novell Edirectory';
 211          $types['rfc2307']='posixAccount (rfc2307)';
 212          $types['rfc2307bis']='posixAccount (rfc2307bis)';
 213          $types['samba']='sambaSamAccount (v.3.0.7)';
 214          $types['ad']='MS ActiveDirectory';
 215          $types['default']=get_string('default');
 216          return $types;
 217      }
 218      /**
 219       * Processes and stores configuration data for this authentication plugin.
 220       */
 221      function process_config($config) {
 222          // set to defaults if undefined
 223          // CAS settings
 224          if (!isset ($config->hostname))
 225              $config->hostname = '';
 226          if (!isset ($config->port))
 227              $config->port = '';
 228          if (!isset ($config->casversion))
 229              $config->casversion = '';
 230          if (!isset ($config->baseuri))
 231              $config->baseuri = '';
 232          if (!isset ($config->language))
 233              $config->language = '';
 234          if (!isset ($config->proxycas))
 235              $config->proxycas = '';
 236          if (!isset ($config->logoutcas))
 237              $config->logoutcas = '';
 238          if (!isset ($config->multiauth))
 239              $config->multiauth = '';
 240          // LDAP settings
 241          if (!isset($config->host_url))
 242              { $config->host_url = ''; }
 243          if (empty($config->ldapencoding))
 244              { $config->ldapencoding = 'utf-8'; }
 245          if (!isset($config->contexts))
 246              { $config->contexts = ''; }
 247          if (!isset($config->user_type))
 248              { $config->user_type = 'default'; }
 249          if (!isset($config->user_attribute))
 250              { $config->user_attribute = ''; }
 251          if (!isset($config->search_sub))
 252              { $config->search_sub = ''; }
 253          if (!isset($config->opt_deref))
 254              { $config->opt_deref = ''; }
 255          if (!isset($config->bind_dn))
 256              {$config->bind_dn = ''; }
 257          if (!isset($config->bind_pw))
 258              {$config->bind_pw = ''; }
 259          if (!isset($config->version))
 260              {$config->version = '2'; }
 261          if (!isset($config->objectclass))
 262              {$config->objectclass = ''; }
 263          if (!isset($config->memberattribute))
 264              {$config->memberattribute = ''; }
 265          if (!isset($config->memberattribute_isdn))
 266              {$config->memberattribute_isdn = ''; }
 267          if (!isset($config->attrcreators))
 268              {$config->attrcreators = ''; }
 269          if (!isset($config->groupecreators))
 270              {$config->groupecreators = ''; }
 271          if (!isset($config->removeuser))
 272              {$config->removeuser = 0; }
 273          // save CAS settings
 274          set_config('hostname',    $config->hostname,    'auth/cas');
 275          set_config('port',        $config->port,        'auth/cas');
 276          set_config('casversion',     $config->casversion,     'auth/cas');
 277          set_config('baseuri',     $config->baseuri,     'auth/cas');
 278          set_config('language',    $config->language,    'auth/cas');
 279          set_config('proxycas',     $config->proxycas,     'auth/cas');
 280          set_config('logoutcas',     $config->logoutcas,     'auth/cas');
 281          set_config('multiauth',     $config->multiauth,     'auth/cas');
 282          // save LDAP settings
 283          set_config('host_url', $config->host_url, 'auth/cas');
 284          set_config('ldapencoding', $config->ldapencoding, 'auth/cas');
 285          set_config('host_url', $config->host_url, 'auth/cas');
 286          set_config('contexts', $config->contexts, 'auth/cas');
 287          set_config('user_type', $config->user_type, 'auth/cas');
 288          set_config('user_attribute', $config->user_attribute, 'auth/cas');
 289          set_config('search_sub', $config->search_sub, 'auth/cas');
 290          set_config('opt_deref', $config->opt_deref, 'auth/cas');
 291          set_config('bind_dn', $config->bind_dn, 'auth/cas');
 292          set_config('bind_pw', $config->bind_pw, 'auth/cas');
 293          set_config('version', $config->version, 'auth/cas');
 294          set_config('objectclass', $config->objectclass, 'auth/cas');
 295          set_config('memberattribute', $config->memberattribute, 'auth/cas');
 296          set_config('memberattribute_isdn', $config->memberattribute_isdn, 'auth/cas');
 297          set_config('attrcreators', $config->attrcreators, 'auth/cas');
 298          set_config('groupecreators', $config->groupecreators, 'auth/cas');
 299          set_config('removeuser', $config->removeuser, 'auth/cas');
 300          return true;
 301      }
 302      /**
 303       * Initializes needed ldap variables for cas-module
 304       *
 305       * Uses names defined in ldap_supported_usertypes.
 306       * $default is first defined as:
 307       * $default['pseudoname'] = array(
 308       *                      'typename1' => 'value',
 309       *                      'typename2' => 'value'
 310       *                      ....
 311       *                      );
 312       *
 313       * @return array of default values
 314       */
 315      function ldap_getdefaults() {
 316          $default['objectclass'] = array(
 317                              'edir' => 'User',
 318                              'rfc2307' => 'posixAccount',
 319                              'rfc2307bis' => 'posixAccount',
 320                              'samba' => 'sambaSamAccount',
 321                              'ad' => 'user',
 322                              'default' => '*'
 323                              );
 324          $default['user_attribute'] = array(
 325                              'edir' => 'cn',
 326                              'rfc2307' => 'uid',
 327                              'rfc2307bis' => 'uid',
 328                              'samba' => 'uid',
 329                              'ad' => 'cn',
 330                              'default' => 'cn'
 331                              );
 332          $default['memberattribute'] = array(
 333                              'edir' => 'member',
 334                              'rfc2307' => 'member',
 335                              'rfc2307bis' => 'member',
 336                              'samba' => 'member',
 337                              'ad' => 'member',
 338                              'default' => 'member'
 339                              );
 340          $default['memberattribute_isdn'] = array(
 341                              'edir' => '1',
 342                              'rfc2307' => '0',
 343                              'rfc2307bis' => '1',
 344                              'samba' => '0', //is this right?
 345                              'ad' => '1',
 346                              'default' => '0'
 347                              );
 348          return $default;
 349      }
 350      /**
 351       * reads userinformation from ldap and return it in array()
 352       *
 353       * Read user information from external database and returns it as array().
 354       * Function should return all information available. If you are saving
 355       * this information to moodle user-table you should honor syncronization flags
 356       *
 357       * @param string $username username (with system magic quotes)
 358       *
 359       * @return mixed array with no magic quotes or false on error
 360       */
 361      function get_userinfo($username) {
 362          $textlib = textlib_get_instance();
 363          $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);
 364          $ldapconnection = $this->ldap_connect();
 365          $attrmap = $this->ldap_attributes();
 366          $result = array();
 367          $search_attribs = array();
 368          foreach ($attrmap as $key=>$values) {
 369              if (!is_array($values)) {
 370                  $values = array($values);
 371              }
 372              foreach ($values as $value) {
 373                  if (!in_array($value, $search_attribs)) {
 374                      array_push($search_attribs, $value);
 375                  }
 376              }
 377          }
 378          $user_dn = $this->ldap_find_userdn($ldapconnection, $extusername);
 379          if (!$user_info_result = ldap_read($ldapconnection, $user_dn, $this->config->objectclass, $search_attribs)) {
 380              return false; // error!
 381          }
 382          $user_entry = $this->ldap_get_entries($ldapconnection, $user_info_result);
 383          if (empty($user_entry)) {
 384              return false; // entry not found
 385          }
 386          foreach ($attrmap as $key=>$values) {
 387              if (!is_array($values)) {
 388                  $values = array($values);
 389              }
 390              $ldapval = NULL;
 391             foreach ($values as $value) {
 392                  if ($value == 'dn') {
 393                      $result[$key] = $user_dn;
 394                  }
 395                  if (!array_key_exists(strtolower($value), $user_entry[0])) {
 396                      continue; // wrong data mapping!
 397                  }
 398                  if (is_array($user_entry[0][strtolower($value)])) {
 399                      $newval = $textlib->convert($user_entry[0][strtolower($value)][0], $this->config->ldapencoding, 'utf-8');
 400                  } else {
 401                      $newval = $textlib->convert($user_entry[0][strtolower($value)], $this->config->ldapencoding, 'utf-8');
 402                  }
 403  
 404                  if (!empty($newval)) { // favour ldap entries that are set
 405                      $ldapval = $newval;
 406                  }
 407              }
 408              if (!is_null($ldapval)) {
 409                  $result[$key] = $ldapval;
 410              }
 411          }
 412          @ldap_close($ldapconnection);
 413          return $result;
 414      }
 415      /**
 416       * reads userinformation from ldap and return it in an object
 417       *
 418       * @param string $username username (with system magic quotes)
 419       * @return mixed object or false on error
 420       */
 421      function get_userinfo_asobj($username) {
 422          $user_array = $this->get_userinfo($username);
 423          if ($user_array == false) {
 424              return false; //error or not found
 425          }
 426          $user_array = truncate_userinfo($user_array);
 427          $user = new object();
 428          foreach ($user_array as $key=>$value) {
 429              $user->{$key} = $value;
 430          }
 431          return $user;
 432      }
 433      /**
 434       * connects to ldap server
 435       *
 436       * Tries connect to specified ldap servers.
 437       * Returns connection result or error.
 438       *
 439       * @return connection result
 440       */
 441      function ldap_connect($binddn='',$bindpwd='') {
 442          //Select bind password, With empty values use
 443          //ldap_bind_* variables or anonymous bind if ldap_bind_* are empty
 444          if ($binddn == '' and $bindpwd == '') {
 445              if (!empty($this->config->bind_dn)) {
 446                 $binddn = $this->config->bind_dn;
 447              }
 448              if (!empty($this->config->bind_pw)) {
 449                 $bindpwd = $this->config->bind_pw;
 450              }
 451          }
 452          $urls = explode(";",$this->config->host_url);
 453          foreach ($urls as $server) {
 454              $server = trim($server);
 455              if (empty($server)) {
 456                  continue;
 457              }
 458              $connresult = ldap_connect($server);
 459              //ldap_connect returns ALWAYS true
 460              if (!empty($this->config->version)) {
 461                  ldap_set_option($connresult, LDAP_OPT_PROTOCOL_VERSION, $this->config->version);
 462              }
 463              if (!empty($binddn)) {
 464                  //bind with search-user
 465                  //$debuginfo .= 'Using bind user'.$binddn.'and password:'.$bindpwd;
 466                  $bindresult=ldap_bind($connresult, $binddn,$bindpwd);
 467              }
 468              else {
 469                  //bind anonymously
 470                  $bindresult=@ldap_bind($connresult);
 471              }
 472              if (!empty($this->config->opt_deref)) {
 473                  ldap_set_option($connresult, LDAP_OPT_DEREF, $this->config->opt_deref);
 474              }
 475              if ($bindresult) {
 476                  return $connresult;
 477              }
 478              $debuginfo .= "<br/>Server: '$server' <br/> Connection: '$connresult'<br/> Bind result: '$bindresult'</br>";
 479          }
 480          //If any of servers are alive we have already returned connection
 481          print_error('auth_ldap_noconnect_all','auth',$this->config->user_type);
 482          return false;
 483      }
 484      /**
 485       * retuns user attribute mappings between moodle and ldap
 486       *
 487       * @return array
 488       */
 489      function ldap_attributes () {
 490          $moodleattributes = array();
 491          foreach ($this->userfields as $field) {
 492              if (!empty($this->config->{"field_map_$field"})) {
 493                  $moodleattributes[$field] = $this->config->{"field_map_$field"};
 494                  if (preg_match('/,/',$moodleattributes[$field])) {
 495                      $moodleattributes[$field] = explode(',', $moodleattributes[$field]); // split ?
 496                  }
 497              }
 498          }
 499          $moodleattributes['username'] = $this->config->user_attribute;
 500          return $moodleattributes;
 501      }
 502      /**
 503       * retuns dn of username
 504       *
 505       * Search specified contexts for username and return user dn
 506       * like: cn=username,ou=suborg,o=org
 507       *
 508       * @param mixed $ldapconnection  $ldapconnection result
 509       * @param mixed $username username (external encoding no slashes)
 510       *
 511       */
 512      function ldap_find_userdn ($ldapconnection, $extusername) {
 513          //default return value
 514          $ldap_user_dn = FALSE;
 515          //get all contexts and look for first matching user
 516          $ldap_contexts = explode(";",$this->config->contexts);
 517          if (!empty($this->config->create_context)) {
 518            array_push($ldap_contexts, $this->config->create_context);
 519          }
 520          foreach ($ldap_contexts as $context) {
 521              $context = trim($context);
 522              if (empty($context)) {
 523                  continue;
 524              }
 525              if ($this->config->search_sub) {
 526                  //use ldap_search to find first user from subtree
 527                  $ldap_result = ldap_search($ldapconnection, $context, "(".$this->config->user_attribute."=".$this->filter_addslashes($extusername).")",array($this->config->user_attribute));
 528              }
 529              else {
 530                  //search only in this context
 531                  $ldap_result = ldap_list($ldapconnection, $context, "(".$this->config->user_attribute."=".$this->filter_addslashes($extusername).")",array($this->config->user_attribute));
 532              }
 533              $entry = ldap_first_entry($ldapconnection,$ldap_result);
 534              if ($entry) {
 535                  $ldap_user_dn = ldap_get_dn($ldapconnection, $entry);
 536                  break ;
 537              }
 538          }
 539          return $ldap_user_dn;
 540      }
 541      /**
 542       * Quote control characters in quoted "texts" used in ldap
 543       *
 544       * @param string
 545       */
 546      function ldap_addslashes($text) {
 547          $text = str_replace('\\', '\\\\', $text);
 548          $text = str_replace(array('"',   "\0"),
 549                              array('\\"', '\\00'), $text);
 550          return $text;
 551      }
 552      /**
 553       * returns all usernames from external database
 554       *
 555       * get_userlist returns all usernames from external database
 556       *
 557       * @return array
 558       */
 559      function get_userlist() {
 560          return $this->ldap_get_userlist("({$this->config->user_attribute}=*)");
 561      }
 562      /**
 563       * checks if user exists on external db
 564       *
 565       * @param string $username (with system magic quotes)
 566       */
 567      function user_exists($username) {
 568          $textlib = textlib_get_instance();
 569          $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->ldapencoding);
 570          //returns true if given username exist on ldap
 571          $users = $this->ldap_get_userlist("({$this->config->user_attribute}=".$this->filter_addslashes($extusername).")");
 572          return count($users);
 573      }
 574      /**
 575       * syncronizes user fron external db to moodle user table
 576       *
 577       * Sync is now using username attribute.
 578       *
 579       * Syncing users removes or suspends users that dont exists anymore in external db.
 580       * Creates new users and updates coursecreator status of users.
 581       *
 582       * @param int $bulk_insert_records will insert $bulkinsert_records per insert statement
 583       *                         valid only with $unsafe. increase to a couple thousand for
 584       *                         blinding fast inserts -- but test it: you may hit mysqld's
 585       *                         max_allowed_packet limit.
 586       * @param bool $do_updates will do pull in data updates from ldap if relevant
 587       */
 588      function sync_users ($bulk_insert_records = 1000, $do_updates = true) {
 589          global $CFG;
 590          $textlib = textlib_get_instance();
 591          $droptablesql = array(); /// sql commands to drop the table (because session scope could be a problem for
 592                                   /// some persistent drivers like ODBTP (mssql) or if this function is invoked
 593                                   /// from within a PHP application using persistent connections
 594          // configure a temp table
 595          print "Configuring temp table\n";
 596          switch (strtolower($CFG->dbfamily)) {
 597              case 'mysql':
 598                  $temptable = $CFG->prefix . 'extuser';
 599                  $droptablesql[] = 'DROP TEMPORARY TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
 600                  execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
 601                  echo "Creating temp table $temptable\n";
 602                  execute_sql('CREATE TEMPORARY TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username)) TYPE=MyISAM', false);
 603                  break;
 604              case 'postgres':
 605                  $temptable = $CFG->prefix . 'extuser';
 606                  $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
 607                  execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
 608                  echo "Creating temp table $temptable\n";
 609                  $bulk_insert_records = 1; // no support for multiple sets of values
 610                  execute_sql('CREATE TEMPORARY TABLE '. $temptable . ' (username VARCHAR(64), PRIMARY KEY (username))', false);
 611                  break;
 612              case 'mssql':
 613                  $temptable = '#'.$CFG->prefix . 'extuser'; /// MSSQL temp tables begin with #
 614                  $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
 615                  execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
 616                  echo "Creating temp table $temptable\n";
 617                  $bulk_insert_records = 1; // no support for multiple sets of values
 618                  execute_sql('CREATE TABLE ' . $temptable . ' (username VARCHAR(64), PRIMARY KEY (username))', false);
 619                  break;
 620              case 'oracle':
 621                  $temptable = $CFG->prefix . 'extuser';
 622                  $droptablesql[] = 'TRUNCATE TABLE ' . $temptable; // oracle requires truncate before being able to drop a temp table
 623                  $droptablesql[] = 'DROP TABLE ' . $temptable; // sql command to drop the table (because session scope could be a problem)
 624                  execute_sql_arr($droptablesql, true, false); /// Drop temp table to avoid persistence problems later
 625                  echo "Creating temp table $temptable\n";
 626                  $bulk_insert_records = 1; // no support for multiple sets of values
 627                  execute_sql('CREATE GLOBAL TEMPORARY TABLE '.$temptable.' (username VARCHAR(64), PRIMARY KEY (username)) ON COMMIT PRESERVE ROWS', false);
 628                  break;
 629          }
 630          print "Connecting to ldap...\n";
 631          $ldapconnection = $this->ldap_connect();
 632          if (!$ldapconnection) {
 633              @ldap_close($ldapconnection);
 634              print get_string('auth_ldap_noconnect','auth',$this->config->host_url);
 635              exit;
 636          }
 637          ////
 638          //// get user's list from ldap to sql in a scalable fashion
 639          ////
 640          // prepare some data we'll need
 641          $filter = "(&(".$this->config->user_attribute."=*)(".$this->config->objectclass."))";
 642          $contexts = explode(";",$this->config->contexts);
 643          if (!empty($this->config->create_context)) {
 644                array_push($contexts, $this->config->create_context);
 645          }
 646          $fresult = array();
 647          foreach ($contexts as $context) {
 648              $context = trim($context);
 649              if (empty($context)) {
 650                  continue;
 651              }
 652              begin_sql();
 653              if ($this->config->search_sub) {
 654                  //use ldap_search to find first user from subtree
 655                  $ldap_result = ldap_search($ldapconnection, $context,
 656                                             $filter,
 657                                             array($this->config->user_attribute));
 658              } else {
 659                  //search only in this context
 660                  $ldap_result = ldap_list($ldapconnection, $context,
 661                                           $filter,
 662                                           array($this->config->user_attribute));
 663              }
 664              if ($entry = ldap_first_entry($ldapconnection, $ldap_result)) {
 665                  do {
 666                      $value = ldap_get_values_len($ldapconnection, $entry, $this->config->user_attribute);
 667                      $value = $textlib->convert($value[0], $this->config->ldapencoding, 'utf-8');
 668                      array_push($fresult, $value);
 669                      if (count($fresult) >= $bulk_insert_records) {
 670                          $this->ldap_bulk_insert($fresult, $temptable);
 671                          $fresult = array();
 672                      }
 673                  } while ($entry = ldap_next_entry($ldapconnection, $entry));
 674              }
 675              unset($ldap_result); // free mem
 676              // insert any remaining users and release mem
 677              if (count($fresult)) {
 678                  $this->ldap_bulk_insert($fresult, $temptable);
 679                  $fresult = array();
 680              }
 681              commit_sql();
 682          }
 683          /// preserve our user database
 684          /// if the temp table is empty, it probably means that something went wrong, exit
 685          /// so as to avoid mass deletion of users; which is hard to undo
 686          $count = get_record_sql('SELECT COUNT(username) AS count, 1 FROM ' . $temptable);
 687          $count = $count->{'count'};
 688          if ($count < 1) {
 689              print "Did not get any users from LDAP -- error? -- exiting\n";
 690              exit;
 691          } else {
 692              print "Got $count records from LDAP\n\n";
 693          }
 694  /// User removal
 695          // find users in DB that aren't in ldap -- to be removed!
 696          // this is still not as scalable (but how often do we mass delete?)
 697          if (!empty($this->config->removeuser)) {
 698              $sql = "SELECT u.id, u.username, u.email, u.auth
 699                      FROM {$CFG->prefix}user u
 700                          LEFT JOIN $temptable e ON u.username = e.username
 701                      WHERE u.auth='cas'
 702                          AND u.deleted=0
 703                          AND e.username IS NULL";
 704              $remove_users = get_records_sql($sql);
 705              if (!empty($remove_users)) {
 706                  print "User entries to remove: ". count($remove_users) . "\n";
 707                  foreach ($remove_users as $user) {
 708                      if ($this->config->removeuser == 2) {
 709                          if (delete_user($user)) {
 710                              echo "\t"; print_string('auth_dbdeleteuser', 'auth', array($user->username, $user->id)); echo "\n";
 711                          } else {
 712                              echo "\t"; print_string('auth_dbdeleteusererror', 'auth', $user->username); echo "\n";
 713                          }
 714                      } else if ($this->config->removeuser == 1) {
 715                          $updateuser = new object();
 716                          $updateuser->id = $user->id;
 717                          $updateuser->auth = 'nologin';
 718                          if (update_record('user', $updateuser)) {
 719                              echo "\t"; print_string('auth_dbsuspenduser', 'auth', array($user->username, $user->id)); echo "\n";
 720                          } else {
 721                              echo "\t"; print_string('auth_dbsuspendusererror', 'auth', $user->username); echo "\n";
 722                          }
 723                      }
 724                  }
 725              } else {
 726                  print "No user entries to be removed\n";
 727              }
 728              unset($remove_users); // free mem!
 729          }
 730  /// Revive suspended users
 731          if (!empty($this->config->removeuser) and $this->config->removeuser == 1) {
 732              $sql = "SELECT u.id, u.username
 733                      FROM $temptable e, {$CFG->prefix}user u
 734                      WHERE e.username=u.username
 735                          AND u.auth='nologin'";
 736              $revive_users = get_records_sql($sql);
 737              if (!empty($revive_users)) {
 738                  print "User entries to be revived: ". count($revive_users) . "\n";
 739                  begin_sql();
 740                  foreach ($revive_users as $user) {
 741                      $updateuser = new object();
 742                      $updateuser->id = $user->id;
 743                      $updateuser->auth = 'cas';
 744                      if (update_record('user', $updateuser)) {
 745                          echo "\t"; print_string('auth_dbreviveser', 'auth', array($user->username, $user->id)); echo "\n";
 746                      } else {
 747                          echo "\t"; print_string('auth_dbreviveusererror', 'auth', $user->username); echo "\n";
 748                      }
 749                  }
 750                  commit_sql();
 751              } else {
 752                  print "No user entries to be revived\n";
 753              }
 754              unset($revive_users);
 755          }
 756  /// User Updates - time-consuming (optional)
 757          if ($do_updates) {
 758              // narrow down what fields we need to update
 759              $all_keys = array_keys(get_object_vars($this->config));
 760              $updatekeys = array();
 761              foreach ($all_keys as $key) {
 762                  if (preg_match('/^field_updatelocal_(.+)$/',$key, $match)) {
 763                      // if we have a field to update it from
 764                      // and it must be updated 'onlogin' we
 765                      // update it on cron
 766                      if ( !empty($this->config->{'field_map_'.$match[1]})
 767                           and $this->config->{$match[0]} === 'onlogin') {
 768                          array_push($updatekeys, $match[1]); // the actual key name
 769                      }
 770                  }
 771              }
 772              // print_r($all_keys); print_r($updatekeys);
 773              unset($all_keys); unset($key);
 774          } else {
 775              print "No updates to be done\n";
 776          }
 777          if ( $do_updates and !empty($updatekeys) ) { // run updates only if relevant
 778              $users = get_records_sql("SELECT u.username, u.id
 779                                        FROM {$CFG->prefix}user u
 780                                        WHERE u.deleted=0 AND u.auth='cas'");
 781              if (!empty($users)) {
 782                  print "User entries to update: ". count($users). "\n";
 783                  $sitecontext = get_context_instance(CONTEXT_SYSTEM);
 784                  if (!empty($this->config->creators) and !empty($this->config->memberattribute)
 785                    and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {
 786                      $creatorrole = array_shift($roles);      // We can only use one, let's use the first one
 787                  } else {
 788                      $creatorrole = false;
 789                  }
 790                  begin_sql();
 791                  $xcount = 0;
 792                  $maxxcount = 100;
 793                  foreach ($users as $user) {
 794                      echo "\t"; print_string('auth_dbupdatinguser', 'auth', array($user->username, $user->id));
 795                      if (!$this->update_user_record(addslashes($user->username), $updatekeys)) {
 796                          echo " - ".get_string('skipped');
 797                      }
 798                      echo "\n";
 799                      $xcount++;
 800                      // update course creators if needed
 801                      if ($creatorrole !== false) {
 802                          if ($this->iscreator($user->username)) {
 803                              role_assign($creatorrole->id, $user->id, 0, $sitecontext->id, 0, 0, 0, 'cas');
 804                          } else {
 805                              role_unassign($creatorrole->id, $user->id, 0, $sitecontext->id, 'cas');
 806                          }
 807                      }
 808                      if ($xcount++ > $maxxcount) {
 809                          commit_sql();
 810                          begin_sql();
 811                          $xcount = 0;
 812                      }
 813                  }
 814                  commit_sql();
 815                  unset($users); // free mem
 816              }
 817          } else { // end do updates
 818              print "No updates to be done\n";
 819          }
 820  /// User Additions
 821          // find users missing in DB that are in LDAP
 822          // note that get_records_sql wants at least 2 fields returned,
 823          // and gives me a nifty object I don't want.
 824          // note: we do not care about deleted accounts anymore, this feature was replaced by suspending to nologin auth plugin
 825          $sql = "SELECT e.username, e.username
 826                  FROM $temptable e LEFT JOIN {$CFG->prefix}user u ON e.username = u.username
 827                  WHERE u.id IS NULL";
 828          $add_users = get_records_sql($sql); // get rid of the fat
 829          if (!empty($add_users)) {
 830              print "User entries to add: ". count($add_users). "\n";
 831              $sitecontext = get_context_instance(CONTEXT_SYSTEM);
 832              if (!empty($this->config->creators) and !empty($this->config->memberattribute)
 833                and $roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {
 834                  $creatorrole = array_shift($roles);      // We can only use one, let's use the first one
 835              } else {
 836                  $creatorrole = false;
 837              }
 838              begin_sql();
 839              foreach ($add_users as $user) {
 840                  $user = $this->get_userinfo_asobj(addslashes($user->username));
 841                  // prep a few params
 842                  $user->modified   = time();
 843                  $user->confirmed  = 1;
 844                  $user->auth       = 'cas';
 845                  $user->mnethostid = $CFG->mnet_localhost_id;
 846                  if (empty($user->lang)) {
 847                      $user->lang = $CFG->lang;
 848                  }
 849                  $user = addslashes_recursive($user);
 850                  if ($id = insert_record('user',$user)) {
 851                      echo "\t"; print_string('auth_dbinsertuser', 'auth', array(stripslashes($user->username), $id)); echo "\n";
 852                      $userobj = $this->update_user_record($user->username);
 853                      if (!empty($this->config->forcechangepassword)) {
 854                          set_user_preference('auth_forcepasswordchange', 1, $userobj->id);
 855                      }
 856                  } else {
 857                      echo "\t"; print_string('auth_dbinsertusererror', 'auth', $user->username); echo "\n";
 858                  }
 859                  // add course creators if needed
 860                  if ($creatorrole !== false and $this->iscreator(stripslashes($user->username))) {
 861                      role_assign($creatorrole->id, $user->id, 0, $sitecontext->id, 0, 0, 0, 'cas');
 862                  }
 863              }
 864              commit_sql();
 865              unset($add_users); // free mem
 866          } else {
 867              print "No users to be added\n";
 868          }
 869          return true;
 870      }
 871      /**
 872       * Update a local user record from an external source.
 873       * This is a lighter version of the one in moodlelib -- won't do
 874       * expensive ops such as enrolment.
 875       *
 876       * If you don't pass $updatekeys, there is a performance hit and
 877       * values removed from LDAP won't be removed from moodle.
 878       *
 879       * @param string $username username (with system magic quotes)
 880       */
 881      function update_user_record($username, $updatekeys = false) {
 882          global $CFG;
 883          //just in case check text case
 884          $username = trim(moodle_strtolower($username));
 885          // get the current user record
 886          $user = get_record('user', 'username', $username, 'mnethostid', $CFG->mnet_localhost_id);
 887          if (empty($user)) { // trouble
 888              error_log("Cannot update non-existent user: ".stripslashes($username));
 889              print_error('auth_dbusernotexist','auth',$username);
 890              die;
 891          }
 892          // Protect the userid from being overwritten
 893          $userid = $user->id;
 894          if ($newinfo = $this->get_userinfo($username)) {
 895              $newinfo = truncate_userinfo($newinfo);
 896              if (empty($updatekeys)) { // all keys? this does not support removing values
 897                  $updatekeys = array_keys($newinfo);
 898              }
 899              foreach ($updatekeys as $key) {
 900                  if (isset($newinfo[$key])) {
 901                      $value = $newinfo[$key];
 902                  } else {
 903                      $value = '';
 904                  }
 905                  if (!empty($this->config->{'field_updatelocal_' . $key})) {
 906                      if ($user->{$key} != $value) { // only update if it's changed
 907                          set_field('user', $key, addslashes($value), 'id', $userid);
 908                      }
 909                  }
 910              }
 911          } else {
 912              return false;
 913          }
 914          return get_record_select('user', "id = $userid AND deleted = 0");
 915      }
 916      /**
 917       * Bulk insert in SQL's temp table
 918       * @param array $users is an array of usernames
 919       */
 920      function ldap_bulk_insert($users, $temptable) {
 921          // bulk insert -- superfast with $bulk_insert_records
 922          $sql = 'INSERT INTO ' . $temptable . ' (username) VALUES ';
 923          // make those values safe
 924          $users = addslashes_recursive($users);
 925          // join and quote the whole lot
 926          $sql = $sql . "('" . implode("'),('", $users) . "')";
 927          print "\t+ " . count($users) . " users\n";
 928          execute_sql($sql, false);
 929      }
 930      /**
 931       * Returns true if user should be coursecreator.
 932       *
 933       * @param mixed $username    username (without system magic quotes)
 934       * @return boolean result
 935       */
 936      function iscreator($username) {
 937          if ((empty($this->config->attrcreators) && empty($this->config->groupecreators)) or empty($this->config->memberattribute)) {
 938              return null;
 939          }
 940          $textlib = textlib_get_instance();
 941          $extusername = $textlib->convert($username, 'utf-8', $this->config->ldapencoding);
 942  //test for groupe creator
 943  if (!empty($this->config->groupecreators))
 944     if ((boolean)$this->ldap_isgroupmember($extusername, $this->config->groupecreators))
 945          return true;
 946  //build filter for attrcreator
 947  if (!empty($this->config->attrcreators)) {
 948      $attrs = explode(";",$this->config->attrcreators);
 949      $filter = "(& (".$this->config->user_attribute."=$username)(|";
 950      foreach ($attrs as $attr){
 951          if(strpos($attr, "="))
 952              $filter .= "($attr)";
 953          else
 954              $filter .= "(".$this->config->memberattribute."=$attr)";
 955      }
 956      $filter .= "))";
 957      //search
 958      $result = $this->ldap_get_userlist($filter);
 959      if (count($result)!=0)
 960          return true;
 961       }
 962  
 963      return false;
 964      }
 965     /**
 966       * checks if user belong to specific group(s)
 967       *
 968       * Returns true if user belongs group in grupdns string.
 969       *
 970       * @param mixed $username    username
 971       * @param mixed $groupdns    string of group dn separated by ;
 972       *
 973       */
 974      function ldap_isgroupmember($extusername='', $groupdns='') {
 975      // Takes username and groupdn(s) , separated by ;
 976      // Returns true if user is member of any given groups
 977          $ldapconnection = $this->ldap_connect();
 978          if (empty($extusername) or empty($groupdns)) {
 979              return false;
 980              }
 981          if ($this->config->memberattribute_isdn) {
 982              $memberuser = $this->ldap_find_userdn($ldapconnection, $extusername);
 983          } else {
 984              $memberuser = $extusername;
 985          }
 986          if (empty($memberuser)) {
 987              return false;
 988          }
 989          $groups = explode(";",$groupdns);
 990          $result = false;
 991          foreach ($groups as $group) {
 992              $group = trim($group);
 993              if (empty($group)) {
 994                  continue;
 995              }
 996              //echo "Checking group $group for member $username\n";
 997              $search = ldap_read($ldapconnection, $group,  '('.$this->config->memberattribute.'='.$this->filter_addslashes($memberuser).')', array($this->config->memberattribute));
 998              if (!empty($search) and ldap_count_entries($ldapconnection, $search)) {
 999                  $info = $this->ldap_get_entries($ldapconnection, $search);
1000                  if (count($info) > 0 ) {
1001                      // user is member of group
1002                      $result = true;
1003                      break;
1004                  }
1005            }
1006          }
1007          return $result;
1008      }
1009     /**
1010       * return all usernames from ldap
1011       *
1012       * @return array
1013       */
1014      function ldap_get_userlist($filter="*") {
1015      /// returns all users from ldap servers
1016          $fresult = array();
1017          $ldapconnection = $this->ldap_connect();
1018          if ($filter=="*") {
1019             $filter = "(&(".$this->config->user_attribute."=*)(".$this->config->objectclass."))";
1020          }
1021          $contexts = explode(";",$this->config->contexts);
1022          if (!empty($this->config->create_context)) {
1023                array_push($contexts, $this->config->create_context);
1024          }
1025          foreach ($contexts as $context) {
1026              $context = trim($context);
1027              if (empty($context)) {
1028                  continue;
1029              }
1030              if ($this->config->search_sub) {
1031                  //use ldap_search to find first user from subtree
1032                  $ldap_result = ldap_search($ldapconnection, $context,$filter,array($this->config->user_attribute));
1033              }
1034              else {
1035                  //search only in this context
1036                  $ldap_result = ldap_list($ldapconnection, $context,
1037                                           $filter,
1038                                           array($this->config->user_attribute));
1039              }
1040              $users = $this->ldap_get_entries($ldapconnection, $ldap_result);
1041              //add found users to list
1042              for ($i=0;$i<count($users);$i++) {
1043                  array_push($fresult, ($users[$i][$this->config->user_attribute][0]) );
1044              }
1045          }
1046          return $fresult;
1047      }
1048      /**
1049       * return entries from ldap
1050       *
1051       * Returns values like ldap_get_entries but is
1052       * binary compatible and return all attributes as array
1053       *
1054       * @return array ldap-entries
1055       */
1056      function ldap_get_entries($conn, $searchresult) {
1057      //Returns values like ldap_get_entries but is
1058      //binary compatible
1059          $i=0;
1060          $fresult=array();
1061          $entry = ldap_first_entry($conn, $searchresult);
1062          do {
1063              $attributes = @ldap_get_attributes($conn, $entry);
1064              for ($j=0; $j<$attributes['count']; $j++) {
1065                  $values = ldap_get_values_len($conn, $entry,$attributes[$j]);                
1066  
1067                  if (is_array($values)) {
1068                  $fresult[$i][strtolower($attributes[$j])] = $values;
1069                  }
1070                  else {
1071                      $fresult[$i][strtolower($attributes[$j])] = array($values);
1072                  }
1073              }
1074              $i++;
1075          }
1076          while ($entry = @ldap_next_entry($conn, $entry));
1077          //were done
1078  
1079          return ($fresult);
1080      }
1081      /**
1082       * Sync roles for this user
1083       *
1084       * @param $user object user object (without system magic quotes)
1085       */
1086      function sync_roles($user) {
1087          $iscreator = $this->iscreator($user->username);
1088          if ($iscreator === null) {
1089              return; //nothing to sync - creators not configured
1090          }
1091          if ($roles = get_roles_with_capability('moodle/legacy:coursecreator', CAP_ALLOW)) {
1092              $creatorrole = array_shift($roles);      // We can only use one, let's use the first one
1093              $systemcontext = get_context_instance(CONTEXT_SYSTEM);
1094              if ($iscreator) { // Following calls will not create duplicates
1095                  role_assign($creatorrole->id, $user->id, 0, $systemcontext->id, 0, 0, 0, 'cas');
1096              } else {
1097                  //unassign only if previously assigned by this plugin!
1098                  role_unassign($creatorrole->id, $user->id, 0, $systemcontext->id, 'cas');
1099              }
1100          }
1101      }
1102     /**
1103       * Quote control characters in texts used in ldap filters - see rfc2254.txt
1104       *
1105       * @param string
1106       */
1107      function filter_addslashes($text) {
1108          $text = str_replace('\\', '\\5c', $text);
1109          $text = str_replace(array('*',    '(',    ')',    "\0"),
1110                              array('\\2a', '\\28', '\\29', '\\00'), $text);
1111          return $text;
1112      }
1113  }
1114  ?>