/
auth.php
289 lines (247 loc) · 10.3 KB
/
auth.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
<?php
/*******************************************************************************
Copyright (C) 2009 Microsoft Corporation. All rights reserved.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2 as
published by the Free Software Foundation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*******************************************************************************/
if( !defined( 'MOODLE_INTERNAL' ) )
{
die( 'Direct access to this script is forbidden.' ); /// It must be included from a Moodle page
}
require_once( $CFG->dirroot . '/auth/azuread/utils.php' );
require_once( $CFG->dirroot . '/auth/azuread/graph.php' );
require_once( $CFG->libdir . '/authlib.php' );
require_once ($CFG->libdir . '/moodlelib.php');
/**
* The auth_plugin_azuread class extends auth_plugin_base and provides azureAD authentication
*/
if (!isset($_AzureADSecret)){
/* Generate a random number for the key and covert to string*/
$keyno = rand(1000000,PHP_INT_MAX);
$_AzureADSecret = (string) $keyno;
}
class auth_plugin_azuread extends auth_plugin_base
{
/**
* class constructor
*/
function auth_plugin_azuread()
{
$this->authtype = 'azuread';
$this->config = get_config( 'auth/azuread' );
$pluginconfig = $this->config;
foreach ($this->userfields as $field) {
// Define some vars we'll work with
if (!isset($pluginconfig->{"field_map_$field"})) {
$this->config->{"field_map_$field"} = '';
}
if (!isset($pluginconfig->{"field_updatelocal_$field"})) {
$this->config->{"field_updatelocal_$field"} = 'onlogin';
}
if (!isset($pluginconfig->{"field_updateremote_$field"})) {
$this->config->{"field_updateremote_$field"} = '';
}
if (!isset($pluginconfig->{"field_lock_$field"})) {
$this->config->{"field_lock_$field"} = 'unlockedifempty';
}
}
}
function config_form($config, $err, $user_fields) {
include 'config.html';
}
/**
* Processes and stores configuration data for this authentication plugin.
*
* @param array $config
* @return void
*/
function process_config($config) {
return true;
}
/* Should passwords be stored in Moodle */
function prevent_local_passwords() {
return true;
}
/**
* Returns true if the username and password work and false if they are
* wrong or don't exist.
* @global <array> $CFG - the global configuration array
* @param <string> $userName - the user name of the current user
* @param <string> $password - the password of the current user
* @return <bool> (success/failure)
*/
function user_login( $userName, $password )
{
global $_AzureADSecret;
/* The only time we should successfully log is when the user is logged in thru the logincallback.php
which will pass AzureADSecurt as the password*/
if (isset($_AzureADSecret) && ($password == $_AzureADSecret))
return true;
else
return false;
}
/**
* Provides cron services for the Azure AD Plug-in for Moodle block
* @global <array> $CFG - the global configuration array
*/
function sync_users()
{
global $disallowsync;
if (!isset($disallowsync))
{
$disallowsync = get_config('block_azuread','azureadNotDoSync');
}
if ($disallowsync)
return;
/* First get the sync-token so that we get incremental chanegs only*/
$skipToken = null;
$azureadSyncToken = get_config('block_azuread','azureadSyncToken');
if( $azureadSyncToken == "")
$azureadSyncToken = null;
$tok = getAccessToken();
$done = false;
do
{
$res = getUserChanges($tok,$azureadSyncToken);
if (!isset($res))
return;
/* Okay we have some changes. Note that the changes may already have been perfomed by us and so we have to make sure that they
are performed in an idempotent fashion*/
foreach ($res['value'] as $change)
{
$type = $change['odata.type'];
if (strtolower($type) == strtolower("Microsoft.WindowsAzure.ActiveDirectory.User")){
/* We only care about user objects*/
if (strtolower($change['objectType']) != strtolower('User'))
continue;
$upn = $change['objectId'];
$user = get_complete_user_data('username',$upn);
if (isset($change['aad.isDeleted']))
$del = $change['aad.isDeleted'];
if (!isset($del) || ($del==false)){
/* Eiter create or update */
if ($user != false){
$user = update_user_record($upn);
if (!isset($user))
mtrace("AzureAD Sync: Error,Could not update user ".$upn);
}else{
$user = create_user_record($upn,"",'azuread');
if (!isset($user))
mtrace("AzureAD Sync: Error,Could not create user ".$upn);
}
}else{
/* Delete this sucker if he exists*/
if ($user == false){
mtrace("AzureADSync : Warning,Tried to delete already deleted user".$upn);
continue;
}
delete_user($user);
}
}
}
if (isset($res['aad.nextLink']))
$azureadSyncToken = $res['aad.nextLink'];
else
$azureadSyncToken = null;
if (!isset($azureadSyncToken) || empty($azureadSyncToken))
{
$skipToken = $res['aad.deltaLink'];
$skipToken = substr($skipToken,strpos($skipToken,"deltaLink=")+strlen("deltaLink="));
$done = true;
}
else{
$done = false;
}
} while ($done == false);
/* We reached here. If there is a skiptoken commit it*/
if (isset($skipToken) && !empty($skipToken))
{
set_config('azureadSyncToken',$skipToken,'block_azuread');
}
return;
}
function cron(){
$this->sync_users();
}
/* This function syncs up the users in Moodle DB to users in AzureAD*/
function get_userinfo($userName)
{
$res = getUserInfo($userName);
if (!isset($res))
return array();
$info = array();
/* Walk thru all the foelds set in the config for AzureAD and push them into info*/
$info['firstname'] = $res['givenName'];
$info['lastname'] = $res['surname'];
$info['email'] = $res['userPrincipalName'];
$info['city'] = $res['city'];
$info['country'] = $res['country'];
$info['description'] = $res['displayName'];
$info['department'] = $res['department'];
$info['phone1'] = $res['telephoneNumber'];
$info['phone2'] = $res['mobile'];
$info['address'] = $res['streetAddress']." ".$res['city']." ".$res['state']." ".$res['postalCode'];
return $info;
}
/**
* We are not implementing the ability to update the password. Password updates
* are controlled by Windows Live
* @return <bool> - always false
*/
function user_update_password( $user, $newpassword )
{
return false;
}
/**
* Returns true if this authentication plugin is 'internal', false if 'external'
* Since Windows Live is external, we return false.
* @return <bool> - always false
*/
function is_internal()
{
return false;
}
/**
* eturns true if this authentication plugin can change the user's password.
* @return <bool> - always false
*/
function can_change_password()
{
return false;
}
/**
* Returns the URL for changing the user's pw, or empty if the default can be used.
* @return <string> - always empty
*/
function change_password_url()
{
return '';
}
/**
* Returns true if plugin allows resetting of internal password.
* @return <bool> - always false
*/
function can_reset_password()
{
return false;
}
/**
* function that is called before logging out of Moodle
* redirect to liveid logout if the webauthtoken is not empty
* @global <array> $CFG - the global configuration array
*/
function prelogout_hook()
{
global $USER;
unset($USER->aaduser);
}
}
?>