| 1 |
<?php |
| 2 |
/** |
| 3 |
* Authorizer |
| 4 |
* |
| 5 |
* @license GPL-2.0+ |
| 6 |
* @link https://github.com/uhm-coe/authorizer |
| 7 |
* @package authorizer |
| 8 |
*/ |
| 9 |
|
| 10 |
namespace Authorizer\Options\External; |
| 11 |
|
| 12 |
use Authorizer\Helper; |
| 13 |
use Authorizer\Options; |
| 14 |
|
| 15 |
/** |
| 16 |
* Contains functions for rendering the CAS options in the External Service |
| 17 |
* tab in Authorizer Settings. |
| 18 |
*/ |
| 19 |
class Cas extends \Authorizer\Singleton { |
| 20 |
|
| 21 |
/** |
| 22 |
* Settings print callback. |
| 23 |
* |
| 24 |
* @param string $args Args (e.g., multisite admin mode). |
| 25 |
* @return void |
| 26 |
*/ |
| 27 |
public function print_checkbox_auth_external_cas( $args = '' ) { |
| 28 |
// Get plugin option. |
| 29 |
$options = Options::get_instance(); |
| 30 |
$option = 'cas'; |
| 31 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 32 |
|
| 33 |
// Make sure php5-curl extension is installed on server. |
| 34 |
$curl_installed_message = ! function_exists( 'curl_init' ) ? __( '<a href="http://www.php.net//manual/en/curl.installation.php" target="_blank" style="color: #dc3232;">PHP CURL extension</a> is not installed', 'authorizer' ) : ''; |
| 35 |
|
| 36 |
// Make sure php_openssl extension is installed on server. |
| 37 |
$openssl_installed_message = ! extension_loaded( 'openssl' ) ? __( '<a href="http://stackoverflow.com/questions/23424459/enable-php-openssl-not-working" target="_blank" style="color: #dc3232;">PHP openssl extension</a> is not installed', 'authorizer' ) : ''; |
| 38 |
|
| 39 |
// Build error message string. |
| 40 |
$error_message = ''; |
| 41 |
if ( strlen( $curl_installed_message ) > 0 || strlen( $openssl_installed_message ) > 0 ) { |
| 42 |
$error_message = '<span style="color: #dc3232;">(' . |
| 43 |
__( 'Warning', 'authorizer' ) . ': ' . |
| 44 |
$curl_installed_message . |
| 45 |
( strlen( $curl_installed_message ) > 0 && strlen( $openssl_installed_message ) > 0 ? '; ' : '' ) . |
| 46 |
$openssl_installed_message . |
| 47 |
')</span>'; |
| 48 |
} |
| 49 |
|
| 50 |
// Print option elements. |
| 51 |
?> |
| 52 |
<input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable CAS Logins', 'authorizer' ); ?></label> <?php echo wp_kses( $error_message, Helper::$allowed_html ); ?> |
| 53 |
<?php |
| 54 |
} |
| 55 |
|
| 56 |
|
| 57 |
/** |
| 58 |
* Settings print callback. |
| 59 |
* |
| 60 |
* @param string $args Args (e.g., multisite admin mode). |
| 61 |
* @return void |
| 62 |
*/ |
| 63 |
public function print_text_cas_custom_label( $args = '' ) { |
| 64 |
// Get plugin option. |
| 65 |
$options = Options::get_instance(); |
| 66 |
$option = 'cas_custom_label'; |
| 67 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 68 |
|
| 69 |
// Print option elements. |
| 70 |
esc_html_e( 'The button on the login page will read:', 'authorizer' ); |
| 71 |
?> |
| 72 |
<p><a class="button button-primary button-large button-external button-cas"><span class="dashicons dashicons-lock"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="CAS" /></a></p> |
| 73 |
<?php |
| 74 |
} |
| 75 |
|
| 76 |
|
| 77 |
/** |
| 78 |
* Settings print callback. |
| 79 |
* |
| 80 |
* @param string $args Args (e.g., multisite admin mode). |
| 81 |
* @return void |
| 82 |
*/ |
| 83 |
public function print_text_cas_host( $args = '' ) { |
| 84 |
// Get plugin option. |
| 85 |
$options = Options::get_instance(); |
| 86 |
$option = 'cas_host'; |
| 87 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 88 |
|
| 89 |
// Print option elements. |
| 90 |
?> |
| 91 |
<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" /> |
| 92 |
<p class="description"><?php esc_html_e( 'Example: authn.example.edu', 'authorizer' ); ?></p> |
| 93 |
<?php |
| 94 |
} |
| 95 |
|
| 96 |
|
| 97 |
/** |
| 98 |
* Settings print callback. |
| 99 |
* |
| 100 |
* @param string $args Args (e.g., multisite admin mode). |
| 101 |
* @return void |
| 102 |
*/ |
| 103 |
public function print_text_cas_port( $args = '' ) { |
| 104 |
// Get plugin option. |
| 105 |
$options = Options::get_instance(); |
| 106 |
$option = 'cas_port'; |
| 107 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 108 |
|
| 109 |
// Print option elements. |
| 110 |
?> |
| 111 |
<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:50px;" /> |
| 112 |
<p class="description"><?php esc_html_e( 'Example: 443', 'authorizer' ); ?></p> |
| 113 |
<?php |
| 114 |
} |
| 115 |
|
| 116 |
|
| 117 |
/** |
| 118 |
* Settings print callback. |
| 119 |
* |
| 120 |
* @param string $args Args (e.g., multisite admin mode). |
| 121 |
* @return void |
| 122 |
*/ |
| 123 |
public function print_text_cas_path( $args = '' ) { |
| 124 |
// Get plugin option. |
| 125 |
$options = Options::get_instance(); |
| 126 |
$option = 'cas_path'; |
| 127 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 128 |
|
| 129 |
// Print option elements. |
| 130 |
?> |
| 131 |
<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" /> |
| 132 |
<p class="description"><?php esc_html_e( 'Example: /cas', 'authorizer' ); ?></p> |
| 133 |
<?php |
| 134 |
} |
| 135 |
|
| 136 |
|
| 137 |
/** |
| 138 |
* Settings print callback. |
| 139 |
* |
| 140 |
* @param string $args Args (e.g., multisite admin mode). |
| 141 |
* @return void |
| 142 |
*/ |
| 143 |
public function print_select_cas_method( $args = '' ) { |
| 144 |
// Get plugin option. |
| 145 |
$options = Options::get_instance(); |
| 146 |
$option = 'cas_method'; |
| 147 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 148 |
$auth_settings_option = $this->sanitize_cas_method( $auth_settings_option ); |
| 149 |
$select_options = array( |
| 150 |
'CLIENT' => 'Client', |
| 151 |
'PROXY' => 'Proxy', |
| 152 |
); |
| 153 |
|
| 154 |
// Print option elements. |
| 155 |
?> |
| 156 |
<select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]"> |
| 157 |
<?php foreach ( $select_options as $method => $label ) : ?> |
| 158 |
<option value="<?php echo esc_attr( $method ); ?>" <?php selected( $auth_settings_option, $method ); ?>><?php echo esc_html( $label ); ?></option> |
| 159 |
<?php endforeach; ?> |
| 160 |
</select> |
| 161 |
<p class="description"><small><?php esc_html_e( '"Client" is the most common, but use "Proxy" if your CAS server is behind a proxy server.', 'authorizer' ); ?></small></p> |
| 162 |
<?php |
| 163 |
} |
| 164 |
|
| 165 |
|
| 166 |
/** |
| 167 |
* Settings print callback. |
| 168 |
* |
| 169 |
* @param string $args Args (e.g., multisite admin mode). |
| 170 |
* @return void |
| 171 |
*/ |
| 172 |
public function print_select_cas_version( $args = '' ) { |
| 173 |
// Get plugin option. |
| 174 |
$options = Options::get_instance(); |
| 175 |
$option = 'cas_version'; |
| 176 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 177 |
$auth_settings_option = $this->sanitize_cas_version( $auth_settings_option ); |
| 178 |
|
| 179 |
// Print option elements. |
| 180 |
?> |
| 181 |
<select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]"> |
| 182 |
<?php foreach ( array_reverse( \phpCAS::getSupportedProtocols() ) as $version => $label ) : ?> |
| 183 |
<option value="<?php echo esc_attr( $version ); ?>" <?php selected( $auth_settings_option, $version ); ?>><?php echo esc_html( $label ); ?></option> |
| 184 |
<?php endforeach; ?> |
| 185 |
</select> |
| 186 |
<?php |
| 187 |
} |
| 188 |
|
| 189 |
|
| 190 |
/** |
| 191 |
* Validate supplied CAS method. |
| 192 |
* |
| 193 |
* @param string $cas_method CAS method string. |
| 194 |
* |
| 195 |
* @return string CAS method string 'PROXY' or 'CLIENT' (default). |
| 196 |
*/ |
| 197 |
public function sanitize_cas_method( $cas_method = '' ) { |
| 198 |
$cas_methods = array( 'PROXY', 'CLIENT' ); |
| 199 |
if ( empty( $cas_method ) || ! in_array( $cas_method, $cas_methods, true ) ) { |
| 200 |
$cas_method = array_pop( $cas_methods ); // Default to 'CLIENT'. |
| 201 |
} |
| 202 |
|
| 203 |
return $cas_method; |
| 204 |
} |
| 205 |
|
| 206 |
|
| 207 |
/** |
| 208 |
* Validate supplied CAS version against phpCAS. Older versions of Authorizer |
| 209 |
* stored custom protocol version strings, so we handle converting those here. |
| 210 |
* |
| 211 |
* @param string $cas_version CAS protocol string. |
| 212 |
* |
| 213 |
* @return string CAS protocol string supported by phpCAS::client(). |
| 214 |
*/ |
| 215 |
public function sanitize_cas_version( $cas_version = '' ) { |
| 216 |
if ( ! class_exists( 'phpCAS' ) ) { |
| 217 |
return ''; |
| 218 |
} |
| 219 |
|
| 220 |
$cas_versions = \phpCAS::getSupportedProtocols(); |
| 221 |
if ( empty( $cas_version ) ) { |
| 222 |
$cas_version = array_key_last( $cas_versions ); // Should be SAML 1.1. |
| 223 |
} elseif ( ! in_array( $cas_version, array_keys( $cas_versions ), true ) ) { |
| 224 |
// Backwards compatibility with constant strings from Authorizer < 3.0.11. |
| 225 |
if ( 'SAML_VERSION_1_1' === $cas_version ) { |
| 226 |
$cas_version = 'S1'; |
| 227 |
} elseif ( 'CAS_VERSION_3_0' === $cas_version ) { |
| 228 |
$cas_version = '3.0'; |
| 229 |
} elseif ( 'CAS_VERSION_2_0' === $cas_version ) { |
| 230 |
$cas_version = '2.0'; |
| 231 |
} elseif ( 'CAS_VERSION_1_0' === $cas_version ) { |
| 232 |
$cas_version = '1.0'; |
| 233 |
} else { |
| 234 |
$cas_version = array_key_last( $cas_versions ); |
| 235 |
} |
| 236 |
} |
| 237 |
|
| 238 |
return $cas_version; |
| 239 |
} |
| 240 |
|
| 241 |
|
| 242 |
/** |
| 243 |
* phpCAS 1.6.0 asserts that the service URL provided by the user logging in |
| 244 |
* matches the URL specified here (to prevent nefarious clients from modifying |
| 245 |
* the http headers with their own values). Note: here we handle common |
| 246 |
* port/protocol variants in case get_option( 'siteurl' ) doesn't match the |
| 247 |
* actual protocol. |
| 248 |
* |
| 249 |
* @return array protocol://domain:port of current WordPress site (both http and https). |
| 250 |
*/ |
| 251 |
public function get_valid_cas_service_urls() { |
| 252 |
$valid_base_url_parts = parse_url( site_url( '', 'login' ) ); |
| 253 |
$valid_base_url = ! empty( $valid_base_url_parts['host'] ) ? $valid_base_url_parts['host'] : ''; |
| 254 |
$valid_base_url .= ! empty( $valid_base_url_parts['port'] ) ? ':' . $valid_base_url_parts['port'] : ''; |
| 255 |
$valid_base_urls = array( |
| 256 |
'http://' . $valid_base_url, |
| 257 |
'https://' . $valid_base_url, |
| 258 |
); |
| 259 |
|
| 260 |
return $valid_base_urls; |
| 261 |
} |
| 262 |
|
| 263 |
|
| 264 |
/** |
| 265 |
* Settings print callback. |
| 266 |
* |
| 267 |
* @param string $args Args (e.g., multisite admin mode). |
| 268 |
* @return void |
| 269 |
*/ |
| 270 |
public function print_text_cas_attr_email( $args = '' ) { |
| 271 |
// Get plugin option. |
| 272 |
$options = Options::get_instance(); |
| 273 |
$option = 'cas_attr_email'; |
| 274 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 275 |
|
| 276 |
// Print option elements. |
| 277 |
?> |
| 278 |
<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" /> |
| 279 |
<p class="description"> |
| 280 |
<?php esc_html_e( 'Example: mail', 'authorizer' ); ?> |
| 281 |
<br> |
| 282 |
<small><?php echo wp_kses( __( "Note: If your CAS server doesn't return an attribute containing an email, you can specify the @domain portion of the email address here, and the email address will be constructed from it and the username. For example, if user 'bob' logs in and his email address should be bob@example.edu, then enter <strong>@example.edu</strong> in this field.", 'authorizer' ), Helper::$allowed_html ); ?></small> |
| 283 |
</p> |
| 284 |
<?php |
| 285 |
} |
| 286 |
|
| 287 |
|
| 288 |
/** |
| 289 |
* Settings print callback. |
| 290 |
* |
| 291 |
* @param string $args Args (e.g., multisite admin mode). |
| 292 |
* @return void |
| 293 |
*/ |
| 294 |
public function print_text_cas_attr_first_name( $args = '' ) { |
| 295 |
// Get plugin option. |
| 296 |
$options = Options::get_instance(); |
| 297 |
$option = 'cas_attr_first_name'; |
| 298 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 299 |
|
| 300 |
// Print option elements. |
| 301 |
?> |
| 302 |
<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" /> |
| 303 |
<p class="description"><?php esc_html_e( 'Example: givenName', 'authorizer' ); ?></p> |
| 304 |
<?php |
| 305 |
} |
| 306 |
|
| 307 |
|
| 308 |
/** |
| 309 |
* Settings print callback. |
| 310 |
* |
| 311 |
* @param string $args Args (e.g., multisite admin mode). |
| 312 |
* @return void |
| 313 |
*/ |
| 314 |
public function print_text_cas_attr_last_name( $args = '' ) { |
| 315 |
// Get plugin option. |
| 316 |
$options = Options::get_instance(); |
| 317 |
$option = 'cas_attr_last_name'; |
| 318 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 319 |
|
| 320 |
// Print option elements. |
| 321 |
?> |
| 322 |
<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" /> |
| 323 |
<p class="description"><?php esc_html_e( 'Example: sn', 'authorizer' ); ?></p> |
| 324 |
<?php |
| 325 |
} |
| 326 |
|
| 327 |
|
| 328 |
/** |
| 329 |
* Settings print callback. |
| 330 |
* |
| 331 |
* @param string $args Args (e.g., multisite admin mode). |
| 332 |
* @return void |
| 333 |
*/ |
| 334 |
public function print_select_cas_attr_update_on_login( $args = '' ) { |
| 335 |
// Get plugin option. |
| 336 |
$options = Options::get_instance(); |
| 337 |
$option = 'cas_attr_update_on_login'; |
| 338 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 339 |
$values = array( |
| 340 |
'' => __( 'Do not update first and last name fields on login', 'authorizer' ), |
| 341 |
'1' => __( 'Update first and last name fields on login', 'authorizer' ), |
| 342 |
'update-if-empty' => __( 'Update first and last name fields on login only if they are empty', 'authorizer' ), |
| 343 |
); |
| 344 |
|
| 345 |
// Print option elements. |
| 346 |
?> |
| 347 |
<select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]"> |
| 348 |
<?php foreach ( $values as $value => $label ) : ?> |
| 349 |
<option value="<?php echo esc_attr( $value ); ?>" <?php selected( $auth_settings_option, $value ); ?>><?php echo esc_html( $label ); ?></option> |
| 350 |
<?php endforeach; ?> |
| 351 |
</select> |
| 352 |
<?php |
| 353 |
} |
| 354 |
|
| 355 |
|
| 356 |
/** |
| 357 |
* Settings print callback. |
| 358 |
* |
| 359 |
* @param string $args Args (e.g., multisite admin mode). |
| 360 |
* @return void |
| 361 |
*/ |
| 362 |
public function print_checkbox_cas_auto_login( $args = '' ) { |
| 363 |
// Get plugin option. |
| 364 |
$options = Options::get_instance(); |
| 365 |
$option = 'cas_auto_login'; |
| 366 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 367 |
|
| 368 |
// Print option elements. |
| 369 |
?> |
| 370 |
<input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to CAS login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label> |
| 371 |
<p class="description"><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if CAS is the only enabled service (i.e., no Google or LDAP). If you have enabled CAS Single Sign-On (SSO), and a user has already logged into CAS elsewhere, enabling this feature will allow automatic logins without any user interaction.', 'authorizer' ); ?></p> |
| 372 |
<?php |
| 373 |
} |
| 374 |
|
| 375 |
|
| 376 |
/** |
| 377 |
* Settings print callback. |
| 378 |
* |
| 379 |
* @param string $args Args (e.g., multisite admin mode). |
| 380 |
* @return void |
| 381 |
*/ |
| 382 |
public function print_checkbox_cas_link_on_username( $args = '' ) { |
| 383 |
// Get plugin option. |
| 384 |
$options = Options::get_instance(); |
| 385 |
$option = 'cas_link_on_username'; |
| 386 |
$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' ); |
| 387 |
|
| 388 |
// Print option elements. |
| 389 |
?> |
| 390 |
<input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Link CAS accounts to WordPress accounts by their username (leave this off to link by email address)', 'authorizer' ); ?></label> |
| 391 |
<p class="description"><?php esc_html_e( "Note: The default (and most secure) behavior is to associate WordPress accounts with CAS accounts by the email they have in common. However, some uncommon CAS server configurations don't contain email addresses for users. Enable this option if your CAS server doesn't have an attribute containing an email, or if you have WordPress accounts that don't have emails.", 'authorizer' ); ?></p> |
| 392 |
<?php |
| 393 |
} |
| 394 |
|
| 395 |
} |
| 396 |
|
