Compare revisions

vagrant/dev/.vagrant

data

tmp

[submodule "elgg"]

	path = elgg

	url = https://github.com/Elgg/Elgg.git

# Contributing

This project follows the normal github workflow.

## Working on a feature or issue

* Please make a fork of the repository if you do not already have one.

* Create a branch for the feature/issue with a name like `feature-x` or `issue-#`.

* Commit your changes to that branch.

* Create a pull request with your changes.

# Planet Red

Planet Red is UNL's implementation of elgg

## Directory Structure

* elgg - the elgg directory.  Currently a submodule, checked out at 1.8.19

* vagrant - various vagrant boxes for development/testing.  Use vagrant/dev/ for development

* plugins - Our custom plugins such as auth and themes that need to be symlinked.  Keeping the plugins out of the elgg directory makes for easy upgrades.

## Setup

1. Initialize submodules by running `git submodule init` and then `gitsubmodule update`

## Using Vagrant

For now, use the dev vagrant box at vagrant/dev/

1. `cd vagrant/dev/`

2. `vagrant up`

3. go to http://localhost:8005 to view the project 

## Using Elgg Clean theme

1. `vagrant ssh`

2. `ln -s /var/www/html/plugins/unl_theme /var/www/html/elgg/mod`

3. `ln -s /var/www/html/plugins/cas_auth_unl /var/www/html/elgg/mod`

## TODO

* implement the UNLedu Framework 4.0 theme at plugins/unl_theme

* implement UNL auth at plugins/cas_auth_unl

* make sure profile image routes still work

 No newline at end of file

Subproject commit 83a56e7201288ccbfb036d8251df992f8446da3e

{

	"folders":

	[

		{

			"path": "."

		}

	]

}

vendor

migration.lock

 No newline at end of file

<?php

cas_auth_unl_logout_page_handler();

 No newline at end of file

<?php

require_once __DIR__ . '/../../elgg/vendor/autoload.php';

if (!isset($argv[1])) {

    echo "usage: php add_user.php username" . PHP_EOL;

    exit();

}

\Elgg\Application::start();

$uid = $argv[1];

$info = array();

if (!$json = @file_get_contents(UnlCAS::DIRECTORY_URL . '?uid=' . $uid . '&format=json')) {

    echo 'unable to get that ID' . PHP_EOL;

    exit();

}

if (!$json = json_decode($json, true)) {

    echo 'error decoding data' . PHP_EOL;

    exit();

}

$map = array(

    'givenName' => 'first_name',

    'sn' => 'last_name',

    'mail' => 'email'

);

foreach ($map as $from => $to) {

    if (isset($json[$from][0])) {

        $info[$to] = $json[$from][0];

    }

}

$info['name'] = $info['first_name'] . ' ' . $info['last_name'];

if (!isset($info['email'])) {

    echo 'no email is available' . PHP_EOL;

    exit();

}

$password = generate_random_cleartext_password();

$elgg_uid = str_replace('-', '_', $uid);

$elgg_uid = 'unl_' . $elgg_uid;

try {

    $user_guid = register_user($elgg_uid, $password, $info['name'], $info['email'], false);

} catch (RegistrationException $e) {

    //Looks like we had an invalid email address... ask for it again.

    echo 'Unable to register, probably due to invalid email address or the user already exists' . PHP_EOL;

    exit();

}

if (!$user_guid) {

    echo 'Unable to register' . PHP_EOL;

    exit();

}

echo 'User added: ' . $elgg_uid . PHP_EOL;

{

  "require": {

    "jasig/phpcas": "1.3.x-dev",

    "tedivm/stash": "~0.13"

  }

}

{

    "_readme": [

        "This file locks the dependencies of your project to a known state",

        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",

        "This file is @generated automatically"

    ],

    "content-hash": "3c159cf3bf5c282651e8fefe10c17c8e",

    "packages": [

        {

            "name": "jasig/phpcas",

            "version": "dev-master",

            "source": {

                "type": "git",

                "url": "https://github.com/apereo/phpCAS.git",

                "reference": "7a949dee79aaadc16161d7d4863b5c0871546222"

            },

            "dist": {

                "type": "zip",

                "url": "https://api.github.com/repos/apereo/phpCAS/zipball/7a949dee79aaadc16161d7d4863b5c0871546222",

                "reference": "7a949dee79aaadc16161d7d4863b5c0871546222",

                "shasum": ""

            },

            "require": {

                "ext-curl": "*",

                "php": ">=5.4.0"

            },

            "require-dev": {

                "phpunit/phpunit": "~3.7.10"

            },

            "type": "library",

            "extra": {

                "branch-alias": {

                    "dev-master": "1.3.x-dev"

                }

            },

            "autoload": {

                "classmap": [

                    "source/"

                ]

            },

            "notification-url": "https://packagist.org/downloads/",

            "license": [

                "Apache-2.0"

            ],

            "authors": [

                {

                    "name": "Joachim Fritschi",

                    "homepage": "https://wiki.jasig.org/display/~fritschi"

                },

                {

                    "name": "Adam Franco",

                    "homepage": "https://wiki.jasig.org/display/~adamfranco"

                }

            ],

            "description": "Provides a simple API for authenticating users against a CAS server",

            "homepage": "https://wiki.jasig.org/display/CASC/phpCAS",

            "keywords": [

                "apereo",

                "cas",

                "jasig"

            ],

            "time": "2018-03-15T13:17:25+00:00"

        },

        {

            "name": "tedivm/stash",

            "version": "v0.13.2",

            "source": {

                "type": "git",

                "url": "https://github.com/tedious/Stash.git",

                "reference": "3489b13bad93c81a898fcb1054ae954575e1a7b6"

            },

            "dist": {

                "type": "zip",

                "url": "https://api.github.com/repos/tedious/Stash/zipball/3489b13bad93c81a898fcb1054ae954575e1a7b6",

                "reference": "3489b13bad93c81a898fcb1054ae954575e1a7b6",

                "shasum": ""

            },

            "require": {

                "php": "^5.4|^7.0"

            },

            "require-dev": {

                "fabpot/php-cs-fixer": "^1.9",

                "phpunit/phpunit": "4.7.*",

                "satooshi/php-coveralls": "1.0.*"

            },

            "type": "library",

            "autoload": {

                "psr-4": {

                    "Stash\\": "src/Stash/"

                }

            },

            "notification-url": "https://packagist.org/downloads/",

            "license": [

                "BSD-3-Clause"

            ],

            "authors": [

                {

                    "name": "Robert Hafner",

                    "email": "tedivm@tedivm.com"

                },

                {

                    "name": "Josh Hall-Bachner",

                    "email": "charlequin@gmail.com"

                }

            ],

            "description": "The place to keep your cache.",

            "homepage": "http://github.com/tedious/Stash",

            "keywords": [

                "apc",

                "cache",

                "caching",

                "memcached",

                "redis",

                "sessions"

            ],

            "time": "2015-12-29T00:07:05+00:00"

        }

    ],

    "packages-dev": [],

    "aliases": [],

    "minimum-stability": "stable",

    "stability-flags": {

        "jasig/phpcas": 20

    },

    "prefer-stable": false,

    "prefer-lowest": false,

    "platform": [],

    "platform-dev": []

}

<?xml version="1.0" encoding="UTF-8" ?>

<plugin_manifest xmlns="http://www.elgg.org/plugin_manifest/1.8">

        <name>CAS Auth UNL</name>

        <author>UNL</author>

        <version>1.0</version>

        <description>CAS Authetication.  Modified from the original LDAP plugin for use at UNL.</description>

        <requires>

                <type>elgg_release</type>

                <version>1.9</version>

        </requires>

</plugin_manifest>

<?php

require_once __DIR__ . '/../../elgg/vendor/autoload.php';

\Elgg\Application::start();

$lock_file = __DIR__ . '/migration.lock';

$lock = @file_get_contents($lock_file);

$lock_data = json_decode($lock, true);

if (!$lock) {

    $lock_data = array(

        'last_guid' => 0,

        'icontime' => 0

    );

}

if (!$users = @file_get_contents('https://planetred.unl.edu/sync.php?start='.$lock_data['last_guid'] . '&icontime='.$lock_data['icontime'])) {

    echo 'FAILED TO CONNECT' . PHP_EOL;

    exit();

}

$users = json_decode($users, true);

if (!$users) {

    echo 'FAILED TO DECODE' . PHP_EOL;

    exit();

}

//Copy over avatar stuffs

$context = stream_context_create(

    array(

        'http' => array(

            'follow_location' => false

        )

    )

);

$icon_sizes = array('master', 'large', 'medium', 'small', 'tiny', 'topbar');

foreach ($users as $source_user) {

    if (0 !== stripos($source_user['username'], 'unl_')) {

        //Not a UNL authenticated user

        continue;

    }

    $target_user = get_user_by_username($source_user['username']);

    if (!$target_user) {

        //create user

        echo 'creating user: ' . $source_user['username'] . PHP_EOL;

        $password = generate_random_cleartext_password();

        try {

            $target_guid = register_user($source_user['username'], $password, $source_user['name'], $source_user['email'], false);

        } catch (RegistrationException $e) {

            echo "\t Unable to create user: " . $e->getMessage() . PHP_EOL;

            continue;

        }

        if (!$target_guid) {

            continue;

        }

        $target_user = get_user($target_guid);

    }

    foreach ($icon_sizes as $size) {

        if (!$icon = @file_get_contents('http://planetred.unl.edu/pg/icon/'.$source_user['username'].'/'.$size, false, $context)) {

            //No icon was found, skip.

            echo 'SKIP' . PHP_EOL;

            continue;

        }

        echo 'Creating ' . $size . ' icon for ' . $source_user['username'] . PHP_EOL;

        $file = new ElggFile();

        $file->owner_guid = $target_user->guid;

        $file->setFilename("profile/{$target_user->guid}{$size}.jpg");

        $file->open('write');

        $file->write($icon);

        $file->close();

        //Don't overload the server

        usleep(500000);

    }

    // reset crop coordinates

    $target_user->x1 = 0;

    $target_user->x2 = 0;

    $target_user->y1 = 0;

    $target_user->y2 = 0;

    $target_user->icontime = time();

    //Update the lock file

    $lock_data = array(

        'last_guid' => $source_user['guid'],

        'icontime' => time()

    );

    file_put_contents($lock_file, json_encode($lock_data));

}

# CAS AUTH UNL

This plugin implements SSO (single sign on) via CAS for UNL. It overrides the default login and logout actions, as well as implements auto-login via the presen of the UNL sso cookie.

Users who do not have an email address that is publicly available will be asked to provide one upon first login.

## Install

1. symlink to the elgg/mod directory

2. run composer install

3. Activate in the elgg admin interface

<?php

    /**

     * Elgg UNL CAS authentication

     * 

     * @package cas_auth_unl

     * @license BSD http://www1.unl.edu/wdn/wiki/Software_License

     * @author University of Nebraska-Lincoln

     * @copyright 2010 Regents of the University of Nebraska 

     * @link http://www.unl.edu/

     */

    global $CONFIG;

    require_once __DIR__ . '/vendor/autoload.php';

    function cas_auth_unl_init() {

        global $CONFIG;

        $auth = new UnlCAS();

        $auth->autoLogin();

        $auth->singleLogOut();

        // Set up login page, this creates the url /login to be used as our login page

        elgg_register_page_handler('login', 'cas_auth_unl_login_page_handler');

        elgg_register_page_handler('logout', 'cas_auth_unl_logout_page_handler');

        elgg_register_page_handler('register', 'cas_auth_unl_registration_page_handler');

        /* set up getemail page */

        elgg_register_page_handler('getemail', 'cas_auth_unl_getemail_page_handler');

        elgg_register_action('getemail', $CONFIG->pluginspath . 'cas_auth_unl/actions/getemail.php', 'public');

        elgg_register_action('logout', $CONFIG->pluginspath . 'cas_auth_unl/actions/logout.php', 'public');

    }

    // Fire up the plugin initialization using the elgg handler

    elgg_register_event_handler('init','system','cas_auth_unl_init');

    function cas_auth_unl_login_page_handler($page = NULL) {

        // If we're not logged in, display the login page

        if (!elgg_is_logged_in()) {

            $auth = new UnlCAS();

            $auth->forceLogin();

        }

        // Otherwise, forward to the index page

        forward();

    }

    function cas_auth_unl_logout_page_handler($page = NULL) {

        if (elgg_is_logged_in()) {

            // If we're not logged in, display the login page

            $auth = new UnlCAS();

            $auth->forceLogout();

        }

        // Otherwise, forward to the index page

        forward();

    }

    function cas_auth_unl_registration_page_handler($page = NULL) {

        if (elgg_is_logged_in()) {

            // Otherwise, forward to the index page

            forward();

        }

        if (!isset($_SESSION['cas_auth_unl']['register']['uid'])) {

            //They are not already in the registration process

            forward();

        }

        if (!isset($_POST['email'])) {

            forward();

        }

        // If we're not logged in, display the login page

        $auth = new UnlCAS();

        $unl_uid = $_SESSION['cas_auth_unl']['register']['uid'];

        $auth->register($unl_uid, $_POST['email']);

        $auth->login($unl_uid);

        forward();

    }

    function cas_auth_unl_getemail_page_handler($page = NULL) {

        if (!elgg_get_logged_in_user_entity()) {

            echo elgg_view_page(elgg_echo('Your Email'), elgg_view("account/forms/getemail")); 

        } else {

            forward();

        }

    }

class UnlCAS {

    var $client;  

    var $casInitialized = false;

    const DIRECTORY_URL = 'https://directory.unl.edu/';

    public static $cert_path = '/etc/pki/tls/cert.pem';

    function __construct() {

        if (!\phpCAS::isInitialized()) {

            \phpCAS::client(CAS_VERSION_2_0, 'shib.unl.edu', 443, 'idp/profile/cas');

            \phpCAS::setCasServerCACert(self::$cert_path);

            \phpCAS::setPostAuthenticateCallback(function($logoutTicket) {

                $auth = new UnlCAS();

                $auth->loginOrRegister(\phpCAS::getUser());

                $session = elgg_get_session();

                $pool = $auth->getSessionMapPool();

                $item = $pool->getItem($logoutTicket);

                $item->set(array(

                    'session_id' => $session->getId(),

                    'date_created' => time()

                ));

            });

            \phpCAS::setSingleSignoutCallback(function ($logoutTicket) {

                $auth = new UnlCAS();

                $pool = $auth->getSessionMapPool();

                $item = $pool->getItem($logoutTicket);

                if ($item->isMiss()) {

                    return null;

                }

                $data = $item->get();

                $handler = new Elgg\Http\DatabaseSessionHandler(_elgg_services()->db);

                if (!$handler->destroy($data['session_id'])) {

                    throw new \Exception('unable to destroy session on single sign out');

                }

                //Remove the cached item

                $item->clear();

            });

        }

    }

    public function getSessionMapPool()

    {

        // Setting a custom path is done by passing an options array to the constructor.

        $options = array('path' => __DIR__ .'/../../tmp/elgg_session_map');

        $driver = new Stash\Driver\FileSystem($options);

        $pool = new Stash\Pool($driver);

        return $pool;

    }

    public function singleLogOut()

    {

        \phpCAS::handleLogoutRequests(false);

    }

    public function autoLogin()

    {

        if ('pg' == elgg_get_context() && false !== strpos($_SERVER['REQUEST_URI'], '/pg/icon/')) {

            //Don't auto-login on profile icon view

            return;

        }

        if (false !== strpos($_SERVER['REQUEST_URI'], '/mod/profile/icondirect.php')) {

            //prevent auto-login for the icondirect.php endpoint too

            return;

        }

        if (!array_key_exists('unl_sso', $_COOKIE)) {

            //No unl_sso cookie was found, no need to auto-login.

            return;

        }

        if (elgg_get_logged_in_user_entity()) {

            //We are already logged in, no need to auto-login

            return;

        }

        //Everything looks good.  Log in!

        $result = \phpCAS::checkAuthentication();

        if ($result) {

            //Make sure we are still authenticated with CAS

            //setPostAuthenticateCallback() will actually do the work

            \phpCAS::renewAuthentication();

        }

    }

    protected function loginOrRegister($unl_uid)

    {

        $elgg_uid = $this->toElggUID($unl_uid);

        $user = get_user_by_username($elgg_uid);

        if (!$user) {

            $this->register($unl_uid);

            $this->login($unl_uid);

        } else {

            $this->login($unl_uid);

        }

    }

    public function login($unl_uid)

    {

        $user = get_user_by_username($this->toElggUID($unl_uid));

        //Log the user into elgg

        login($user);

    }

    public function register($unl_uid, $student_email = false)

    {

        $elgg_uid = $this->toElggUID($unl_uid);

        $directory_info = $this->getDirectoryInfo($unl_uid);

        $name = 'unknown';

        $email = false;

        if ($student_email) {

            $email = $student_email;

        }

        if (isset($directory_info['name'])) {

            $name = $directory_info['name'];

        }

        if (isset($directory_info['email'])) {

            //Override the student email with the one from the directory

            $email = $directory_info['email'];

        }

        if (false === $email) {

            $_SESSION['cas_auth_unl']['register']['uid'] = $unl_uid;