authorizer / src / authorizer / options / external / class-oauth2.php

class-oauth2.php in Authorizer 3.9.0, at src/authorizer/options/external/class-oauth2.php

379 lines 14.7 KB

Raw Download Zip

1	<?php
2	/**
3	* Authorizer
4	*
5	* @license GPL-2.0+
6	* @link https://github.com/uhm-coe/authorizer
7	* @package authorizer
8	*/
9
10	namespace Authorizer\Options\External;
11
12	use Authorizer\Helper;
13	use Authorizer\Options;
14
15	/**
16	* Contains functions for rendering the OAuth2 options in the External Service
17	* tab in Authorizer Settings.
18	*/
19	class OAuth2 extends \Authorizer\Singleton {
20
21	/**
22	* List of supported oauth2 providers and their details.
23	*
24	* @var array
25	*/
26	private $providers = array(
27	/**
28	* 'amazon' => array(
29	* 'name' => 'Amazon',
30	* 'composer' => '"luchianenco/oauth2-amazon": "^1.1"',
31	* 'instructions_url' => 'https://aws.amazon.com/blogs/security/how-to-add-authentication-single-page-web-application-with-amazon-cognito-oauth2-implementation/',
32	* ),
33	*/
34	'azure' => array(
35	'name' => 'Microsoft Azure',
36	'instructions_url' => 'https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app',
37	),
38	'github' => array(
39	'name' => 'GitHub',
40	'instructions_url' => 'https://github.com/settings/applications/new',
41	),
42	'generic' => array(
43	'name' => 'Other (generic OAuth2 provider)',
44	'instructions_url' => 'https://github.com/thephpleague/oauth2-client#authorization-code-grant',
45	),
46	);
47
48	/**
49	* Settings print callback.
50	*
51	* @param string $args Args (e.g., multisite admin mode).
52	* @return void
53	*/
54	public function print_checkbox_auth_external_oauth2( $args = '' ) {
55	// Get plugin option.
56	$options = Options::get_instance();
57	$option = 'oauth2';
58	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
59
60	// Print option elements.
61	?>
62	<input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( 'Enable OAuth2 Logins', 'authorizer' ); ?></label>
63	<?php
64	}
65
66
67	/**
68	* Settings print callback.
69	*
70	* @param string $args Args (e.g., multisite admin mode).
71	* @return void
72	*/
73	public function print_select_oauth2_provider( $args = '' ) {
74	// Get plugin option.
75	$options = Options::get_instance();
76	$option = 'oauth2_provider';
77	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
78
79	// Print option elements.
80	?>
81	<select id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]">
82	<option value=""<?php selected( '' === $auth_settings_option ); ?>><?php esc_html_e( '-- None --', 'authorizer' ); ?></option>
83	<?php foreach ( $this->providers as $provider => $provider_data ) : ?>
84	<option value="<?php echo esc_attr( $provider ); ?>"<?php selected( $provider, $auth_settings_option ); ?>><?php echo esc_html( $provider_data['name'] ); ?></option>
85	<?php endforeach; ?>
86	</select>
87	<?php
88	}
89
90
91	/**
92	* Settings print callback.
93	*
94	* @param string $args Args (e.g., multisite admin mode).
95	* @return void
96	*/
97	public function print_text_oauth2_custom_label( $args = '' ) {
98	// Get plugin option.
99	$options = Options::get_instance();
100	$option = 'oauth2_custom_label';
101	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
102
103	// Print option elements.
104	esc_html_e( 'The button on the login page will read:', 'authorizer' );
105	?>
106	<p><a class="button button-primary button-large button-external"><span class="dashicons dashicons-lock"></span> <strong><?php esc_html_e( 'Sign in with', 'authorizer' ); ?> </strong><input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="OAuth2" /></a></p>
107	<?php
108	}
109
110
111	/**
112	* Settings print callback.
113	*
114	* @param string $args Args (e.g., multisite admin mode).
115	* @return void
116	*/
117	public function print_text_oauth2_clientid( $args = '' ) {
118	// Get plugin option.
119	$options = Options::get_instance();
120	$option = 'oauth2_clientid';
121	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
122
123	// Print option elements.
124	$site_url_parts = wp_parse_url( get_site_url() );
125	$site_url_host = $site_url_parts['scheme'] . '://' . $site_url_parts['host'] . '/';
126	?>
127	<p>
128	<?php esc_html_e( 'Generate your Client ID and Secret for your selected provider by following their specific instructions.', 'authorizer' ); ?>
129	<?php esc_html_e( 'If asked for a redirect or callback URL, use:' ); ?>
130	<strong><?php echo esc_html( site_url( '/wp-login.php?external=oauth2' ) ); ?></strong>
131	</p>
132	<p>
133	<?php esc_html_e( 'If using Microsoft Azure, omit the querystring; use:' ); ?>
134	<strong><?php echo esc_html( site_url( '/wp-login.php' ) ); ?></strong>
135	</p>
136	<ol>
137	<?php foreach ( $this->providers as $provider => $provider_data ) : ?>
138	<li><a href="<?php echo esc_attr( $provider_data['instructions_url'] ); ?>" target="_blank"><?php echo esc_html( $provider_data['name'] ); ?></a></li>
139	<?php endforeach; ?>
140	</ol>
141	<?php
142	// If ID is overridden by filter or constant, don't expose the value;
143	// just print an informational message.
144	if ( has_filter( 'authorizer_oauth2_client_id' ) ) {
145	?>
146	<input type="hidden" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="" />
147	<p class="description">
148	<?php
149	echo wp_kses_post(
150	sprintf(
151	/* TRANSLATORS: %s: authorizer_oauth2_client_id (filter name) */
152	__( 'This setting is not editable since it has been defined in the %s filter.', 'authorizer' ),
153	'<code>authorizer_oauth2_client_id</code>'
154	)
155	);
156	?>
157	</p>
158	<?php
159	return;
160	} elseif ( defined( 'AUTHORIZER_OAUTH2_CLIENT_ID' ) ) {
161	?>
162	<input type="hidden" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="" />
163	<p class="description">
164	<?php
165	echo wp_kses_post(
166	sprintf(
167	/* TRANSLATORS: %s: AUTHORIZER_OAUTH2_CLIENT_ID (defined constant name) */
168	__( 'This setting is not editable since it has been defined in wp-config.php via %s', 'authorizer' ),
169	"<code>define( 'AUTHORIZER_OAUTH2_CLIENT_ID', '...' );</code>"
170	)
171	);
172	?>
173	</p>
174	<?php
175	return;
176	}
177
178	?>
179	<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
180	<p class="description"><?php esc_html_e( 'Example: 0123456789abcdef0123', 'authorizer' ); ?></p>
181	<?php
182	}
183
184
185	/**
186	* Settings print callback.
187	*
188	* @param string $args Args (e.g., multisite admin mode).
189	* @return void
190	*/
191	public function print_text_oauth2_clientsecret( $args = '' ) {
192	// Get plugin option.
193	$options = Options::get_instance();
194	$option = 'oauth2_clientsecret';
195	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
196
197	// If secret is overridden by filter or constant, don't expose the value;
198	// just print an informational message.
199	if ( has_filter( 'authorizer_oauth2_client_secret' ) ) {
200	?>
201	<input type="hidden" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="" />
202	<p class="description">
203	<?php
204	echo wp_kses_post(
205	sprintf(
206	/* TRANSLATORS: %s: authorizer_oauth2_client_secret (filter name) */
207	__( 'This setting is not editable since it has been defined in the %s filter.', 'authorizer' ),
208	'<code>authorizer_oauth2_client_secret</code>'
209	)
210	);
211	?>
212	</p>
213	<?php
214	return;
215	} elseif ( defined( 'AUTHORIZER_OAUTH2_CLIENT_SECRET' ) ) {
216	?>
217	<input type="hidden" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="" />
218	<p class="description">
219	<?php
220	echo wp_kses_post(
221	sprintf(
222	/* TRANSLATORS: %s: AUTHORIZER_OAUTH2_CLIENT_SECRET (defined constant name) */
223	__( 'This setting is not editable since it has been defined in wp-config.php via %s', 'authorizer' ),
224	"<code>define( 'AUTHORIZER_OAUTH2_CLIENT_SECRET', '...' );</code>"
225	)
226	);
227	?>
228	</p>
229	<?php
230	return;
231	}
232
233	// Print option elements.
234	?>
235	<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" style="width:220px;" />
236	<p class="description"><?php esc_html_e( 'Example: 0123456789abcdef0123456789abcdef', 'authorizer' ); ?></p>
237	<?php
238	}
239
240
241	/**
242	* Settings print callback.
243	*
244	* @param string $args Args (e.g., multisite admin mode).
245	* @return void
246	*/
247	public function print_text_oauth2_hosteddomain( $args = '' ) {
248	// Get plugin option.
249	$options = Options::get_instance();
250	$option = 'oauth2_hosteddomain';
251	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
252
253	// Print option elements.
254	?>
255	<textarea id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" placeholder="" style="width:220px;"><?php echo esc_html( $auth_settings_option ); ?></textarea>
256	<p class="description"><?php esc_html_e( 'Restrict OAuth2 logins to a specific domain (for example, mycollege.edu). Leave blank to allow all valid sign-ins.', 'authorizer' ); ?> <?php esc_html_e( 'If restricting to multiple domains, add one domain per line.', 'authorizer' ); ?></p>
257	<?php
258	}
259
260
261	/**
262	* Settings print callback.
263	*
264	* @param string $args Args (e.g., multisite admin mode).
265	* @return void
266	*/
267	public function print_text_oauth2_tenant_id( $args = '' ) {
268	// Get plugin option.
269	$options = Options::get_instance();
270	$option = 'oauth2_tenant_id';
271	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
272
273	// Print option elements.
274	?>
275	<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="common" />
276	<p class="description"><?php esc_html_e( 'Example: "common", or a specific Azure Directory Tenant ID', 'authorizer' ); ?></p>
277	<?php
278	}
279
280
281	/**
282	* Settings print callback.
283	*
284	* @param string $args Args (e.g., multisite admin mode).
285	* @return void
286	*/
287	public function print_text_oauth2_url_authorize( $args = '' ) {
288	// Get plugin option.
289	$options = Options::get_instance();
290	$option = 'oauth2_url_authorize';
291	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
292
293	// Print option elements.
294	?>
295	<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
296	<p class="description"><?php esc_html_e( 'Example: https://example.edu/login/oauth/authorize', 'authorizer' ); ?></p>
297	<?php
298	}
299
300
301	/**
302	* Settings print callback.
303	*
304	* @param string $args Args (e.g., multisite admin mode).
305	* @return void
306	*/
307	public function print_text_oauth2_url_token( $args = '' ) {
308	// Get plugin option.
309	$options = Options::get_instance();
310	$option = 'oauth2_url_token';
311	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
312
313	// Print option elements.
314	?>
315	<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
316	<p class="description"><?php esc_html_e( 'Example: https://example.edu/login/oauth/access_token', 'authorizer' ); ?></p>
317	<?php
318	}
319
320
321	/**
322	* Settings print callback.
323	*
324	* @param string $args Args (e.g., multisite admin mode).
325	* @return void
326	*/
327	public function print_text_oauth2_url_resource( $args = '' ) {
328	// Get plugin option.
329	$options = Options::get_instance();
330	$option = 'oauth2_url_resource';
331	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
332
333	// Print option elements.
334	?>
335	<input type="text" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="<?php echo esc_attr( $auth_settings_option ); ?>" placeholder="" />
336	<p class="description"><?php esc_html_e( 'Example: https://api.example.edu/user', 'authorizer' ); ?></p>
337	<?php
338	}
339
340
341	/**
342	* Settings print callback.
343	*
344	* @param string $args Args (e.g., multisite admin mode).
345	* @return void
346	*/
347	public function print_checkbox_oauth2_auto_login( $args = '' ) {
348	// Get plugin option.
349	$options = Options::get_instance();
350	$option = 'oauth2_auto_login';
351	$auth_settings_option = $options->get( $option, Helper::get_context( $args ), 'allow override', 'print overlay' );
352
353	// Print option elements.
354	?>
355	<input type="checkbox" id="auth_settings_<?php echo esc_attr( $option ); ?>" name="auth_settings[<?php echo esc_attr( $option ); ?>]" value="1"<?php checked( 1 === intval( $auth_settings_option ) ); ?> /><label for="auth_settings_<?php echo esc_attr( $option ); ?>"><?php esc_html_e( "Immediately redirect to OAuth2 login form if it's the only enabled external service and WordPress logins are hidden", 'authorizer' ); ?></label>
356	<p class="description"><?php esc_html_e( 'Note: This feature will only work if you have checked "Hide WordPress Logins" in Advanced settings, and if OAuth2 is the only enabled service (i.e., no Google, LDAP, or CAS).', 'authorizer' ); ?></p>
357	<?php
358	}
359
360
361	/**
362	* Restore any redirect_to value saved during an Azure login (in the
363	* `authenticate` hook). This is needed since the Azure portal needs an
364	* approved URI to visit after logging in, and cannot have a variable
365	* redirect_to param in it like the normal WordPress redirect flow.
366	*
367	* @hook login_redirect
368	*
369	* @param string $redirect_to Destination URL.
370	*/
371	public function maybe_redirect_after_azure_login( $redirect_to ) {
372	if ( ! empty( $_SESSION['azure_redirect_to'] ) ) {
373	$redirect_to = sanitize_url( $_SESSION['azure_redirect_to'] );
374	}
375
376	return $redirect_to;
377	}
378	}
379