adfs.module

<?php

/**
 * @version     $Id: adfs.module $
 * @copyright   Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
 * @license     http://www.gnu.org/licenses/gpl-2.0.html
 * @package     Drupal
 * @subpackage  ADFS
 * @since 7.x
 */

  require_once(dirname(__FILE__) . "/adfsbridge.php");
  require_once(dirname(__FILE__) . "/adfsuserdetails.php");
  require_once(dirname(__FILE__) . "/adfsconf.php"); 

/**
 * Implements hook_help().
 */
function adfs_help($path, $arg) {
  switch ($path) {
    case 'user/%/adfs':
      $output = '<p>' . t('This site supports <a href="#">Active Directory</a>, a secure way to log in to websites using an existing Active Directory Account.') . '</p>';
      return $output;
    case 'admin/help#adfs':
      $output = '';
      $output .= '<h3>' . t('About') . '</h3>';
      $output .= '<p>' . t('The ADFS module allows users to log in using an existing Active Directory account.') . '</p>';
      $output .= '<h3>' . t('Uses') . '</h3>';
      $output .= '<dl>';
      $output .= '<dt>' . t('Logging in with Active Directory') . '</dt>';
      $output .= '<dd>' . t("To log in using Active Directory, a user must already have an Active Directory account on the IdP server configured in ADFS Settings. Users can then create site accounts using their Active Directory identity, assign an Active Directory identity to an existing account, and log in using an Active Directory account. This lowers the barrier to registration, which helps increase the user base, and offers convenience and security to the users.") . '</dd>';
      $output .= '</dl>';
      return $output;
  }
}

/**
 * Implement hook_perm()
 */
function adfs_permission() {
  return array('administer adfs' => array(
          'title' => t('Administer ADFS'),
          'description' => t('Perform administration tasks for ADFS')
  ));
}

/**
 * Implements hook_menu().
 */
function adfs_menu() {
  /*
   * Provides access to settings required for the ADFS protocol
   */
  $items['admin/config/system/adfs'] = array(
      'title' => 'ADFS Settings',
      'page callback' => 'drupal_get_form',
      'page arguments' => array('adfs_settings_page'),
      'access arguments' => array('administer adfs'),
      'type' => MENU_NORMAL_ITEM,
      'file' => 'adfs.admin.inc',
  );

  /*
   * Authentication method which handles verification of authenticated user,
   * processing of and redirection to the appropriate page
   */
  $items['adfs/authenticate'] = array(
      'title' => 'Active Directory Login',
      'page callback' => 'adfs_authenticate',
      'access callback' => TRUE,     //'any_user',
      'type' => MENU_CALLBACK,
      'file' => 'adfs.module',
  );
  $items['user/%user/adfs'] = array(
      'title' => 'Active Directory Identity',
      'page callback' => 'adfs_user_identities',
      'page arguments' => array(1),
      'access callback' => 'user_edit_access',
      'access arguments' => array(1),
      'type' => MENU_LOCAL_TASK,
      'file' => 'adfs.pages.inc',
  );
  $items['user/%user/adfs/delete'] = array(
      'title' => 'Delete Active Directory Association',
      'page callback' => 'drupal_get_form',
      'page arguments' => array('adfs_user_delete_form', 1),
      'access callback' => 'user_edit_access',
      'access arguments' => array(1),
      'file' => 'adfs.pages.inc',
  );
  $items['adfs/prp'] = array(
      'title' => 'ADFS Response',
      'page callback' => 'adfs_prp',
      'access callback' => TRUE, //'any_user',
      'type' => MENU_CALLBACK,
      'file' => 'adfs.module',
  );
  return $items;
}

// --------------------------------------------------------------------------
// Public Interface for ADFS Module

/**
 * Determine if the ADFS configuration is validated (see 'adfs_settings_page')
 */
function adfs_validated() {
  // TODO: adfs_validated is getting set to TRUE despite no form post, investigate
  // to see if unsuccessful posts still set value
  $a = variable_get('adfs_idp_sso_target_url');
  $b = variable_get('adfs_sp_identity');

  variable_set('adfs_validated', ($a && $b));

  return variable_get('adfs_validated', FALSE);
}

/**
 * Determine if the Active Directory login link is accessible.
 *
 * This is a menu access callback.
 */
function adfs_login_accessible() {
  return adfs_validated() && user_is_anonymous();
}

// --------------------------------------------------------------------------
// User Management

/**
 * Implements hook_user_insert().
 */
function adfs_user_insert(&$edit, $account, $category) {
  if (!empty($edit['adfs_claimed_id'])) {
    // The user has registered after trying to log in via adfs.
    if (variable_get('user_email_verification', TRUE)) {
      drupal_set_message(t('Once you have verified your e-mail address, you may log in via adfs.'));
    }
    user_set_authmaps($account, array('authname_adfs' => $edit['adfs_claimed_id']));

    // Done with user setup, discard session data
    unset($_SESSION['adfs']);
    unset($edit['adfs_claimed_id']);
  }
}

/**
 * Implements hook_user_login().
 *
 * Save adfs_identifier to visitor cookie.
 */
function adfs_user_login(&$edit, $account) {
  if (isset($_SESSION['adfs'])) {
    // The user has logged in via adfs.
    user_cookie_save(array_intersect_key($_SESSION['adfs'], array_flip(array('adfs_identifier'))));

    // Done with user setup, discard session data
    unset($_SESSION['adfs']);
  }
}

/**
 * Implements hook_user_logout().
 *
 * Delete any adfs_identifier in visitor cookie.
 *
 * @param drupal_user $account
 */
function adfs_user_logout($account) {
  if (isset($_COOKIE['Drupal_visitor_adfs_identifier'])) {
    user_cookie_delete('adfs_identifier');
  }
  // We have the option here of forcing a logout with the ADFS IdP, but that may
  // be a bit presumptuous of us.  Drupal will allow user back in only by making
  // a full loop back to the ADFS IdP to verify authenticated status.
}

// --------------------------------------------------------------------------
// User Management: hooks for customized Login forms

/**
 * Implements hook_form_FORM_ID_alter().
 */
function adfs_form_user_login_block_alter(&$form, &$form_state) {
  _adfs_user_login_form_alter($form, $form_state);
}

/**
 * Implements hook_form_FORM_ID_alter().
 */
function adfs_form_user_login_alter(&$form, &$form_state) {
  _adfs_user_login_form_alter($form, $form_state);
}

function _adfs_user_login_form_alter(&$form, &$form_state) {
  // If administrator has not configured the module then do not modify login form
  if (!adfs_login_accessible()) {
    return;
  }

  $form['#attached']['css'][] = drupal_get_path('module', 'adfs') . '/adfs.css';

//    $form['adfs_link'] = array(
//        '#markup' => l(t('Log in using Active Directory'), 'adfs/validate').'<br>',
//        '#weight' => 10);

  $items = array();
  $items[] = array(
      'data' => l(t('Log in using Active Directory'), 'adfs/authenticate'),
      'class' => array('adfs-link'),
  );

  $form['adfs_links'] = array(
      '#theme' => 'item_list',
      '#items' => $items,
      '#attributes' => array('class' => array('adfs-links')),
      '#weight' => 1,
  );

  $form['adfs.return_to'] = array('#type' => 'hidden', '#value' => url('/', array('absolute' => TRUE, 'query' => user_login_destination())));
}

/**
 * Implements hook_form_FORM_ID_alter().
 *
 * Prefills the login form with values acquired via adfs.
 */

/**
 * Implements hook_form_FORM_ID_alter().
 *
 * Prefills the login form with values acquired via adfs.
 *
 * @param array $form  an array of objects which compose the various parts of a page
 * @param array $form_state 
 */
function adfs_form_user_register_form_alter(&$form, &$form_state) {
  $form['#attached']['css'][] = drupal_get_path('module', 'adfs') . '/adfs.css';
  
    //module_load_include('inc', 'adfs');
  


  //drupal_set_title(format_username($account));
  //drupal_add_css(drupal_get_path('module', 'adfs') . '/adfs.css');

  // Check to see if we got a response
  
  if (isset($_SESSION['adfs_response'])) {
    $response = new AdfsUserDetails();
    $adfs_response = $_SESSION['adfs_response'];
    $response = unserialize($adfs_response);
  //}
  
  //if (isset($_SESSION['adfs']['response'])) {
    module_load_include('inc', 'adfs');

    //$response = $_SESSION['adfs']['response'];    
    
    //if (isset($_SESSION['adfs_response'])) {
    //$adfs_response = $_SESSION['adfs_response'];
    //$response = unserialize($adfs_response);
    //}

    //if (!empty($response['uid'])) {
    if (!empty($response->nameIdentifier)) {
      // Use the nickname returned by Simple Registration if available.
      //$form['account']['name']['#default_value'] = $response['uid'];
        $form['account']['name']['#default_value'] = $response->nameIdentifier;
    } else {
      $form['account']['name']['#default_value'] = '';
    }

    // If user_email_verification is off, hide the password field and just fill
    // with random password to avoid confusion.
    if (!variable_get('user_email_verification', TRUE)) {
      $form['account']['pass']['#type'] = 'hidden';
      $form['account']['pass']['#value'] = user_password();
    }

    $form['adfs_claimed_id'] = array(
        '#type' => 'value',
        //'#default_value' => $response['uid'],
        '#default_value' => $response->nameIdentifier,
    );
    $form['adfs_display'] = array(
        '#type' => 'item',
        '#title' => t('Your ADFS'),
        '#description' => t('This Active Directory identity will be attached to your account after registration.'),
        //'#markup' => check_plain($response['uid']),
        '#markup' => check_plain($response->nameIdentifier),
    );
  }
}



// --------------------------------------------------------------------------
// Session Management: process ADFS page requests

/**
 *
 * @global drupal_user $user
 * @global array $adfs_session
 */
function adfs_authenticate() {
  global $user;
  global $adfs_session;
  
  // If there is an Authenticated user then log them out before we redirect
  if ($user->uid) {
    unset($_SESSION['adfs']);
    user_logout();
  }
  
  module_load_include('inc', 'adfs');
  adfs_sso_redirect();
}

function adfs_prp() {
  //require(dirname(__FILE__) . "/adfsbridge.php");
  //require(dirname(__FILE__) . "/adfsuserdetails.php");
  //require(dirname(__FILE__) . "/adfsconf.php");  
  global $user;

  module_load_include('inc', 'adfs');

  //$response = adfs_process_prp();
  //$_SESSION['adfs']['response'] = $response;
  
  // This message is sent by the authentication server to inform the site to
  // clean up its session data.
  if (!empty($_GET['wa']) and ($_GET['wa'] == 'wsignoutcleanup1.0')) {
    print 'Logged Out';
    user_logout();
    drupal_exit();
  }
  
  $adfsConf = AdfsConf::getInstance();
  $adfsConf->adfsUrl = variable_get('adfs_idp_sso_target_url');
  $adfsConf->spIdentifier = variable_get('adfs_sp_identity');
  $adfsConf->encryptionCertPath = variable_get('adfs_private_certificate_path');
  $adfsConf->encryptionCertPassword = variable_get('adfs_private_certificate_password');
  try {
      $adfs = new AdfsBridge();
      $wctx = (!empty($_REQUEST['wctx']) ? $_REQUEST['wctx'] : NULL);

      $response = $adfs->getAdfsSignInResponse(
                                $adfsConf,
                                $_REQUEST['wa'],
                                $_REQUEST['wresult'],
                                $wctx);
      
      $_SESSION['adfs_response'] = serialize($response);
      $_SESSION['adfs_authenticated'] = TRUE;
      $return_url = $wctx;
      
      // Check if the user is logged in.
      if ($user->uid == 0) {
        return adfs_authentication($response, $return_url);
      } else {
        drupal_goto($return_url);
      }  
  } catch (Exception $e) {
      drupal_set_message(t('Active Directory login failed. ('. $e->getMessage(). ')'), 'error');
  }
  drupal_goto();
}

/**
 * Authenticate a user or attempt registration.
 *
 * @param $response Response values from the ADFS Provider.
 */
function adfs_authentication($response, $return_url) {
  global $user;
  $identity = $response->nameIdentifier;

  $account = user_external_load($identity);
  if (isset($account->uid)) {
    if (!variable_get('user_email_verification', TRUE) || $account->login) {
      // Check if user is blocked.
      $state['values']['name'] = $account->name;
      user_login_name_validate(array(), $state);
      if (!form_get_errors()) {
        // Load global $user and perform final login tasks.
        $form_state['uid'] = $account->uid;
        user_login_submit(array(), $form_state);
        // Let other modules act on Active Directory login
        module_invoke_all('adfs_response', $response, $account);
      }
    } else {
      drupal_set_message(t('You must validate your email address for this account before logging in via Active Directory.'));
    }
  } elseif (variable_get('user_register', USER_REGISTER_VISITORS_ADMINISTRATIVE_APPROVAL)) {
    // Register new user.
    // Save response for use in adfs_form_user_register_form_alter().
    $_SESSION['adfs']['response'] = $response;

    $form_state['values'] = array();
    $form_state['values']['op'] = t('Create new account');
    drupal_form_submit('user_register_form', $form_state);

    if (!empty($form_state['user'])) {
      module_invoke_all('adfs_response', $response, $form_state['user']);
      drupal_goto();
    }

    $messages = drupal_get_messages('error');
    if (empty($form_state['values']['name']) || empty($form_state['values']['mail'])) {
      // If the ADFS provider did not provide both a user name and an email
      // address, ask the user to complete the registration manually instead of
      // showing the error messages about the missing values generated by FAPI.
      drupal_set_message(t('Complete the registration by filling out the form below. If you already have an account, you can <a href="@login">log in</a> now and add your Active Directory identity under "My account".', array('@login' => url('user/login'))), 'warning');
    } else {
      drupal_set_message(t('Account registration using the information provided by your ADFS provider failed due to the reasons listed below. Complete the registration by filling out the form below. If you already have an account, you can <a href="@login">log in</a> now and add your Active Directory identity under "My account".', array('@login' => url('user/login'))), 'warning');
      // Append form validation errors below the above warning.
      foreach ($messages['error'] as $message) {
        drupal_set_message($message, 'error');
      }
    }

    // We were unable to register a valid new user. Redirect to the normal
    // registration page and prefill with the values we received.
    if ($return_url) {
      drupal_goto('user/register', array('query' => $return_url));
    } else {
      drupal_goto('user/register');
    }
  } else {
    drupal_set_message(t('Only site administrators can create new user accounts.'), 'error');
  }
  drupal_goto($return_url);
}

?>