[Summary view] [Print] [Text view]

   1  <?php
   2  // This file is part of Moodle - http://moodle.org/
   3  //
   4  // Moodle is free software: you can redistribute it and/or modify
   5  // it under the terms of the GNU General Public License as published by
   6  // the Free Software Foundation, either version 3 of the License, or
   7  // (at your option) any later version.
   8  //
   9  // Moodle is distributed in the hope that it will be useful,
  10  // but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  // GNU General Public License for more details.
  13  //
  14  // You should have received a copy of the GNU General Public License
  15  // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  16  
  17  /**
  18   * Authentication Plugin: RADIUS Authentication
  19   *
  20   * Authenticates against a RADIUS server.
  21   * Contributed by Clive Gould <[email protected]>
  22   * CHAP support contributed by Stanislav Tsymbalov http://www.tsymbalov.net/
  23   *
  24   * @package auth_radius
  25   * @author Martin Dougiamas
  26   * @license http://www.gnu.org/copyleft/gpl.html GNU Public License
  27   */
  28  
  29  defined('MOODLE_INTERNAL') || die();
  30  
  31  require_once($CFG->libdir.'/authlib.php');
  32  
  33  /**
  34   * RADIUS authentication plugin.
  35   */
  36  class auth_plugin_radius extends auth_plugin_base {
  37  
  38      /**
  39       * Constructor.
  40       */
  41      function auth_plugin_radius() {
  42          $this->authtype = 'radius';
  43          $this->config = get_config('auth/radius');
  44      }
  45  
  46      /**
  47       * Returns true if the username and password work and false if they are
  48       * wrong or don't exist.
  49       *
  50       * @param string $username The username
  51       * @param string $password The password
  52       * @return bool Authentication success or failure.
  53       */
  54      function user_login ($username, $password) {
  55          require_once 'Auth/RADIUS.php';
  56          require_once 'Crypt/CHAP.php';
  57  
  58          // Added by Clive on 7th May for test purposes
  59          // printf("Username: $username <br/>");
  60          // printf("Password: $password <br/>");
  61          // printf("host: $this->config->host <br/>");
  62          // printf("nasport: $this->config->nasport <br/>");
  63          // printf("secret: $this->config->secret <br/>");
  64  
  65          // Added by Stanislav Tsymbalov on 12th March 2008 only for test purposes
  66          //$type = 'PAP';
  67          //$type = 'CHAP_MD5';
  68          //$type = 'MSCHAPv1';
  69          //$type = 'MSCHAPv2';
  70          $type = $this->config->radiustype;
  71          if (empty($type)) {
  72              $type = 'PAP';
  73          }
  74  
  75          $classname = 'Auth_RADIUS_' . $type;
  76          $rauth = new $classname($username, $password);
  77          $rauth->addServer($this->config->host, $this->config->nasport, $this->config->secret);
  78  
  79          $rauth->username = $username;
  80  
  81          switch($type) {
  82          case 'CHAP_MD5':
  83          case 'MSCHAPv1':
  84              $classname = $type == 'MSCHAPv1' ? 'Crypt_CHAP_MSv1' : 'Crypt_CHAP_MD5';
  85              $crpt = new $classname;
  86              $crpt->password = $password;
  87              $rauth->challenge = $crpt->challenge;
  88              $rauth->chapid = $crpt->chapid;
  89              $rauth->response = $crpt->challengeResponse();
  90              $rauth->flags = 1;
  91              // If you must use deprecated and weak LAN-Manager-Responses use this:
  92              // $rauth->lmResponse = $crpt->lmChallengeResponse();
  93              // $rauth->flags = 0;
  94              break;
  95  
  96          case 'MSCHAPv2':
  97              $crpt = new Crypt_CHAP_MSv2;
  98              $crpt->username = $username;
  99              $crpt->password = $password;
 100              $rauth->challenge = $crpt->authChallenge;
 101              $rauth->peerChallenge = $crpt->peerChallenge;
 102              $rauth->chapid = $crpt->chapid;
 103              $rauth->response = $crpt->challengeResponse();
 104              break;
 105  
 106          default:
 107              $rauth->password = $password;
 108              break;
 109          }
 110  
 111          if (!$rauth->start()) {
 112              printf("Radius start: %s<br/>\n", $rauth->getError());
 113              exit;
 114          }
 115  
 116          $result = $rauth->send();
 117          if ($rauth->isError($result)) {
 118              printf("Radius send failed: %s<br/>\n", $result->getMessage());
 119              exit;
 120          } else if ($result === true) {
 121              // printf("Radius Auth succeeded<br/>\n");
 122              return true;
 123          } else {
 124              // printf("Radius Auth rejected<br/>\n");
 125              return false;
 126          }
 127  
 128          // get attributes, even if auth failed
 129          if (!$rauth->getAttributes()) {
 130              printf("Radius getAttributes: %s<br/>\n", $rauth->getError());
 131          } else {
 132              $rauth->dumpAttributes();
 133          }
 134  
 135          $rauth->close();
 136      }
 137  
 138      function prevent_local_passwords() {
 139          return true;
 140      }
 141  
 142      /**
 143       * Returns true if this authentication plugin is 'internal'.
 144       *
 145       * @return bool
 146       */
 147      function is_internal() {
 148          return false;
 149      }
 150  
 151      /**
 152       * Returns true if this authentication plugin can change the user's
 153       * password.
 154       *
 155       * @return bool
 156       */
 157      function can_change_password() {
 158          return false;
 159      }
 160  
 161      /**
 162       * Prints a form for configuring this authentication plugin.
 163       *
 164       * This function is called from admin/auth.php, and outputs a full page with
 165       * a form for configuring this plugin.
 166       *
 167       * @param array $page An object containing all the data for this page.
 168       */
 169      function config_form($config, $err, $user_fields) {
 170          global $OUTPUT;
 171  
 172          include  "config.html";
 173      }
 174  
 175      /**
 176       * Processes and stores configuration data for this authentication plugin.
 177       */
 178      function process_config($config) {
 179          // set to defaults if undefined
 180          if (!isset ($config->host)) {
 181              $config->host = '127.0.0.1';
 182          }
 183          if (!isset ($config->nasport)) {
 184              $config->nasport = '1812';
 185          }
 186          if (!isset($config->radiustype)) {
 187              $config->radiustype = 'PAP';
 188          }
 189          if (!isset ($config->secret)) {
 190              $config->secret = '';
 191          }
 192          if (!isset($config->changepasswordurl)) {
 193              $config->changepasswordurl = '';
 194          }
 195  
 196          // save settings
 197          set_config('host',    $config->host,    'auth/radius');
 198          set_config('nasport', $config->nasport, 'auth/radius');
 199          set_config('secret',  $config->secret,  'auth/radius');
 200          set_config('changepasswordurl', $config->changepasswordurl, 'auth/radius');
 201          set_config('radiustype', $config->radiustype, 'auth/radius');
 202  
 203          return true;
 204      }
 205  
 206  }
 207  
 208