Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Revert "MDL-31968 Make NTLM REMOTE_USER format configurable by the ad…

…min"

This reverts commit af861e1.

Note that MDL-31968 will be in charge of backporting this to stables
if everything goes well under master (once MDL-31968 is tested and closed)
  • Loading branch information...
commit 8d800a1b8e31aa6f57f33f42cce9cb51c8bd7fd1 1 parent f2c33d0
@stronk7 stronk7 authored
View
79 auth/ldap/auth.php
@@ -41,18 +41,6 @@
define('AUTH_GID_NOGROUP', -2);
}
-// Regular expressions for a valid NTLM username and domain name.
-if (!defined('AUTH_NTLM_VALID_USERNAME')) {
- define('AUTH_NTLM_VALID_USERNAME', '[^/\\\\\\\\\[\]:;|=,+*?<>@"]+');
-}
-if (!defined('AUTH_NTLM_VALID_DOMAINNAME')) {
- define('AUTH_NTLM_VALID_DOMAINNAME', '[^\\\\\\\\\/:*?"<>|]+');
-}
-// Default format for remote users if using NTLM SSO
-if (!defined('AUTH_NTLM_DEFAULT_FORMAT')) {
- define('AUTH_NTLM_DEFAULT_FORMAT', '%domain%\\%username%');
-}
-
require_once($CFG->libdir.'/authlib.php');
require_once($CFG->libdir.'/ldaplib.php');
@@ -1582,11 +1570,8 @@ function ntlmsso_magic($sesskey) {
switch ($this->config->ntlmsso_type) {
case 'ntlm':
- // The format is now configurable, so try to extract the username
- $username = $this->get_ntlm_remote_user($username);
- if (empty($username)) {
- return false;
- }
+ // Format is DOMAIN\username
+ $username = substr(strrchr($username, '\\'), 1);
break;
case 'kerberos':
// Format is username@DOMAIN
@@ -1794,9 +1779,6 @@ function process_config($config) {
if (!isset($config->ntlmsso_type)) {
$config->ntlmsso_type = 'ntlm';
}
- if (!isset($config->ntlmsso_remoteuserformat)) {
- $config->ntlmsso_remoteuserformat = '';
- }
// Try to remove duplicates before storing the contexts (to avoid problems in sync_users()).
$config->contexts = explode(';', $config->contexts);
@@ -1836,7 +1818,6 @@ function process_config($config) {
set_config('ntlmsso_subnet', trim($config->ntlmsso_subnet), $this->pluginconfig);
set_config('ntlmsso_ie_fastpath', (int)$config->ntlmsso_ie_fastpath, $this->pluginconfig);
set_config('ntlmsso_type', $config->ntlmsso_type, 'auth/ldap');
- set_config('ntlmsso_remoteuserformat', trim($config->ntlmsso_remoteuserformat), 'auth/ldap');
return true;
}
@@ -2037,60 +2018,4 @@ function ldap_find_userdn($ldapconnection, $extusername) {
$this->config->user_attribute, $this->config->search_sub);
}
-
- /**
- * A chance to validate form data, and last chance to do stuff
- * before it is inserted in config_plugin
- *
- * @param object object with submitted configuration settings (without system magic quotes)
- * @param array $err array of error messages (passed by reference)
- */
- function validate_form($form, &$err) {
- if ($form->ntlmsso_type == 'ntlm') {
- $format = trim($form->ntlmsso_remoteuserformat);
- if (!empty($format) && !preg_match('/%username%/i', $format)) {
- $err['ntlmsso_remoteuserformat'] = get_string('auth_ntlmsso_missing_username', 'auth_ldap');
- }
- }
- }
-
-
- /**
- * When using NTLM SSO, the format of the remote username we get in
- * $_SERVER['REMOTE_USER'] may vary, depending on where from and how the web
- * server gets the data. So we let the admin configure the format using two
- * place holders (%domain% and %username%). This function tries to extract
- * the username (stripping the domain part and any separators if they are
- * present) from the value present in $_SERVER['REMOTE_USER'], using the
- * configured format.
- *
- * @param string $remoteuser The value from $_SERVER['REMOTE_USER'] (converted to UTF-8)
- *
- * @return string The remote username (without domain part or
- * separators). Empty string if we can't extract the username.
- */
- protected function get_ntlm_remote_user($remoteuser) {
- if (empty($this->config->ntlmsso_remoteuserformat)) {
- $format = AUTH_NTLM_DEFAULT_FORMAT;
- } else {
- $format = $this->config->ntlmsso_remoteuserformat;
- }
-
- $format = preg_quote($format);
- $formatregex = preg_replace(array('#%domain%#', '#%username%#'),
- array('('.AUTH_NTLM_VALID_DOMAINNAME.')', '('.AUTH_NTLM_VALID_USERNAME.')'),
- $format);
- if (preg_match('#^'.$formatregex.'$#', $remoteuser, $matches)) {
- $user = end($matches);
- return $user;
- }
-
- /* We are unable to extract the username with the configured format. Probably
- * the format specified is wrong, so log a warning for the admin and return
- * an empty username.
- */
- error_log($this->errorlogtag.get_string ('auth_ntlmsso_maybeinvalidformat', 'auth_ldap'));
- return '';
- }
-
} // End of the class
View
15 auth/ldap/config.html
@@ -94,9 +94,6 @@
if (!isset($config->ntlmsso_type)) {
$config->ntlmsso_type = 'ntlm';
}
-if (!isset($config->ntlmsso_remoteuserformat)) {
- $config->ntlmsso_remoteuserformat = '';
-}
$yesno = array(get_string('no'), get_string('yes'));
@@ -542,18 +539,6 @@
<?php print_string('auth_ntlmsso_type','auth_ldap') ?>
</td>
</tr>
-<tr valign="top">
- <td align="right">
- <label for="ntlmsso_remoteuserformat"><?php print_string('auth_ntlmsso_remoteuserformat_key', 'auth_ldap') ?></label>
- </td>
- <td>
- <input name="ntlmsso_remoteuserformat" id="ntlmsso_remoteuserformat" type="text" size="30" value="<?php echo $config->ntlmsso_remoteuserformat?>" />
- <?php if (isset($err['ntlmsso_remoteuserformat'])) { echo $OUTPUT->error_text($err['ntlmsso_remoteuserformat']); } ?>
- </td>
- <td>
- <?php print_string('auth_ntlmsso_remoteuserformat', 'auth_ldap') ?>
- </td>
-</tr>
<?php
$help = get_string('auth_ldapextrafields', 'auth_ldap');
$help .= get_string('auth_updatelocal_expl', 'auth');
View
4 auth/ldap/lang/en/auth_ldap.php
@@ -101,10 +101,6 @@
$string['auth_ntlmsso_enabled_key'] = 'Enable';
$string['auth_ntlmsso_ie_fastpath'] = 'Set to yes to enable the NTLM SSO fast path (bypasses certain steps and only works if the client\'s browser is MS Internet Explorer).';
$string['auth_ntlmsso_ie_fastpath_key'] = 'MS IE fast path?';
-$string['auth_ntlmsso_maybeinvalidformat'] = 'Unable to extract the username from the REMOTE_USER header. Is the configured format right?';
-$string['auth_ntlmsso_missing_username'] = 'You need to specify at least %username% in the remote username format';
-$string['auth_ntlmsso_remoteuserformat_key'] = 'Remote username format';
-$string['auth_ntlmsso_remoteuserformat'] = 'If you have chosen \'NTLM\' in \'Authentication type\', you can specify the remote username format here. If you leave this empty, the default DOMAIN\\username format will be used. You can use the optional <b>%domain%</b> placeholder to specify where the domain name appears, and the mandatory <b>%username%</b> placeholder to specify where the username appears. <br /><br />Some widely used formats are <tt>%domain%\\%username%</tt> (MS Windows default), <tt>%domain%/%username%</tt>, <tt>%domain%+%username%</tt> and just <tt>%username%</tt> (if there is no domain part).';
$string['auth_ntlmsso_subnet'] = 'If set, it will only attempt SSO with clients in this subnet. Format: xxx.xxx.xxx.xxx/bitmask. Separate multiple subnets with \',\' (comma).';
$string['auth_ntlmsso_subnet_key'] = 'Subnet';
$string['auth_ntlmsso_type_key'] = 'Authentication type';
Please sign in to comment.
Something went wrong with that request. Please try again.