Log In with ' . htmlspecialchars($auth_label) . '
' . "\n"; + } + + /* + * Generate a password for the user. This plugin does not require the + * administrator to enter this value, but we need to set it so that user + * creation and editing works. + */ + function generate_password($username, $password1, $password2) { + if (! $this->allow_wp_auth()) { + $password1 = $password2 = wp_generate_password(); + } + } + + /* + * Logout the user by redirecting them to the logout URI. + */ + function logout() { + $logout_uri = $this->_generate_uri($this->options['logout_uri'], home_url()); + + wp_redirect($logout_uri); + exit(); + } + + /* + * Remove the reauth=1 parameter from the login URL, if applicable. This allows + * us to transparently bypass the mucking about with cookies that happens in + * wp-login.php immediately after wp_signon when a user e.g. navigates directly + * to wp-admin. + */ + function bypass_reauth($login_url) { + $login_url = remove_query_arg('reauth', $login_url); + + return $login_url; + } + + /* + * Can we fallback to built-in WordPress authentication? + */ + function allow_wp_auth() { + return (bool) $this->options['allow_wp_auth']; + } + + /* + * Authenticate the user, first using the external authentication source. + * If allowed, fall back to WordPress password authentication. + */ + function authenticate($user, $username, $password) { + $user = $this->check_remote_user(); + + if (! is_wp_error($user)) { + // User was authenticated via REMOTE_USER + $user = new WP_User($user->ID); + } + else { + // REMOTE_USER is invalid; now what? + + if (! $this->allow_wp_auth()) { + // Bail with the WP_Error when not falling back to WordPress authentication + wp_die($user); + } + + // Fallback to built-in hooks (see wp-includes/user.php) + } + + return $user; + } + + /* + * If the REMOTE_USER or REDIRECT_REMOTE_USER evironment variable is set, use it + * as the username. This assumes that you have externally authenticated the user. + */ + function check_remote_user() { + $username = ''; + + $server_keys = $this->_get_server_keys(); + foreach ($server_keys as $server_key) { + if (! empty($_SERVER[$server_key])) { + $username = $_SERVER[$server_key]; + } + } + + if (! $username) { + return new WP_Error('empty_username', 'ERROR: No user found in server variables.'); + } + + // Create new users automatically, if configured + $user = get_user_by('login', $username); + if (! $user) { + if ((bool) $this->options['auto_create_user']) { + $user = $this->_create_user($username); + } + else { + // Bail out to avoid showing the login form + $user = new WP_Error('authentication_failed', __('ERROR: Invalid username or incorrect password.')); + } + } + + return $user; + } + + /* + * Return the list of $_SERVER keys that we will check for a username. By + * default, these are REMOTE_USER and REDIRECT_REMOTE_USER. Additional keys + * can be configured from the options page. + */ + function _get_server_keys() { + $server_keys = array('REMOTE_USER', 'REDIRECT_REMOTE_USER'); + + $additional_server_keys = $this->options['additional_server_keys']; + if (! empty($additional_server_keys)) { + $keys = preg_split('/,\s*/', $additional_server_keys); + $server_keys = array_merge($server_keys, $keys); + } + + return $server_keys; + } + + /* + * Create a new WordPress account for the specified username. + */ + function _create_user($username) { + $password = wp_generate_password(); + $email_domain = $this->options['auto_create_email_domain']; + + $user_id = wp_create_user($username, $password, $username . ($email_domain ? '@' . $email_domain : '')); + $user = get_user_by('id', $user_id); + + return $user; + } + + /* + * Fill the specified URI with the site URI and the specified return location. + */ + function _generate_uri($uri, $redirect_to) { + // Support tags for staged deployments + $base = $this->_get_base_url(); + + $tags = array( + 'host' => $_SERVER['HTTP_HOST'], + 'base' => $base, + 'site' => home_url(), + 'redirect' => $redirect_to, + ); + + foreach ($tags as $tag => $value) { + $uri = str_replace('%' . $tag . '%', $value, $uri); + $uri = str_replace('%' . $tag . '_encoded%', urlencode($value), $uri); + } + + // Support previous versions with only the %s tag + if (strstr($uri, '%s') !== false) { + $uri = sprintf($uri, urlencode($redirect_to)); + } + + return $uri; + } + + /* + * Return the base domain URL based on the WordPress home URL. + */ + function _get_base_url() { + $home = parse_url(home_url()); + + $base = home_url(); + foreach (array('path', 'query', 'fragment') as $key) { + if (! isset($home[$key])) continue; + $base = str_replace($home[$key], '', $base); + } + + return $base; + } +} + +// Load the plugin hooks, etc. +$http_authentication_plugin = new HTTPAuthenticationPlugin(); +?> diff --git a/sources/wp-content/plugins/http-authentication/options-page.php b/sources/wp-content/plugins/http-authentication/options-page.php new file mode 100644 index 0000000..f670ee2 --- /dev/null +++ b/sources/wp-content/plugins/http-authentication/options-page.php @@ -0,0 +1,195 @@ +plugin = $plugin; + $this->group = $group; + $this->page = $page; + $this->options = $options; + $this->title = $title; + + add_action('admin_init', array($this, 'register_options')); + add_action('admin_menu', array($this, 'add_options_page')); + } + + /* + * Register the options for this plugin so they can be displayed and updated below. + */ + function register_options() { + register_setting($this->group, $this->group, array($this, 'sanitize_settings')); + + $section = 'http_authentication_main'; + add_settings_section($section, 'Main Options', array($this, '_display_options_section'), $this->page); + add_settings_field('http_authentication_allow_wp_auth', 'Allow WordPress authentication?', array($this, '_display_option_allow_wp_auth'), $this->page, $section, array('label_for' => 'http_authentication_allow_wp_auth')); + add_settings_field('http_authentication_auth_label', 'Authentication label', array($this, '_display_option_auth_label'), $this->page, $section, array('label_for' => 'http_authentication_auth_label')); + add_settings_field('http_authentication_login_uri', 'Login URI', array($this, '_display_option_login_uri'), $this->page, $section, array('label_for' => 'http_authentication_login_uri')); + add_settings_field('http_authentication_logout_uri', 'Logout URI', array($this, '_display_option_logout_uri'), $this->page, $section, array('label_for' => 'http_authentication_logout_uri')); + add_settings_field('http_authentication_additional_server_keys', '$_SERVER variables', array($this, '_display_option_additional_server_keys'), $this->page, $section, array('label_for' => 'http_authentication_additional_server_keys')); + add_settings_field('http_authentication_auto_create_user', 'Automatically create accounts?', array($this, '_display_option_auto_create_user'), $this->page, $section, array('label_for' => 'http_authentication_auto_create_user')); + add_settings_field('http_authentication_auto_create_email_domain', 'Email address domain', array($this, '_display_option_auto_create_email_domain'), $this->page, $section, array('label_for' => 'http_authentication_auto_create_email_domain')); + } + + /* + * Set the database version on saving the options. + */ + function sanitize_settings($input) { + $output = $input; + $output['db_version'] = $this->plugin->db_version; + $output['allow_wp_auth'] = isset($input['allow_wp_auth']) ? (bool) $input['allow_wp_auth'] : false; + $output['auto_create_user'] = isset($input['auto_create_user']) ? (bool) $input['auto_create_user'] : false; + + return $output; + } + + /* + * Add an options page for this plugin. + */ + function add_options_page() { + add_options_page($this->title, $this->title, 'manage_options', $this->page, array($this, '_display_options_page')); + } + + /* + * Display the options for this plugin. + */ + function _display_options_page() { + if (! current_user_can('manage_options')) { + wp_die(__('You do not have sufficient permissions to access this page.')); + } +?> +For the Login URI and Logout URI options, you can use the following variables to support your installation:
+%host% - The current value of $_SERVER['HTTP_HOST']%base% - The base domain URL (everything before the path)%site% - The WordPress home URI%redirect% - The return URI provided by WordPressYou can also use %host_encoded%, %site_encoded%, and %redirect_encoded% for URL-encoded values.
HTTP authentication; override to use the name of your single sign-on system.
+options['login_uri'];
+ $this->_display_input_text_field('login_uri', $login_uri);
+?>
+Default is %base%/Shibboleth.sso/Login?target=%redirect_encoded%
+options['logout_uri'];
+ $this->_display_input_text_field('logout_uri', $logout_uri);
+?>
+Default is %base%/Shibboleth.sso/Logout?return=%redirect_encoded%
+options['additional_server_keys'];
+ $this->_display_input_text_field('additional_server_keys', $additional_server_keys);
+?>
+$_SERVER variables in addition to REMOTE_USER and REDIRECT_REMOTE_USER to check for the username value, separated by a comma. Use this to e.g. support personal X.509 certificates for authentication.SSL_CLIENT_S_DN_CN
+options['auto_create_user'];
+ $this->_display_checkbox_field('auto_create_user', $auto_create_user);
+?>
+Should a new user be created automatically if not already in the WordPress database?