init ninedocker
This commit is contained in:
commit
0a7777d6e8
|
|
@ -0,0 +1,18 @@
|
|||
.env.local
|
||||
/env/*.local
|
||||
/tmp
|
||||
|
||||
/volume/mariadb/mysql
|
||||
|
||||
/volume/nextcloud/data
|
||||
/volume/nextcloud/html
|
||||
/volume/nextcloud/app
|
||||
|
||||
/volume/ninegate/data
|
||||
/volume/ninegate/data
|
||||
|
||||
/volume/nineboard/data
|
||||
|
||||
/volume/openldap/data
|
||||
|
||||
/volume/wordpress/data
|
||||
|
|
@ -0,0 +1,172 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
mariadb:
|
||||
image: docker.io/library/mariadb
|
||||
container_name: nine-mariadb
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: /nine/check.sh
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.mariadb
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- "3306:3306"
|
||||
volumes:
|
||||
- ./volume/mariadb/mysql:/var/lib/mysql
|
||||
- ./volume/mariadb/nine:/nine
|
||||
|
||||
openldap:
|
||||
image: docker.io/bitnami/openldap:2
|
||||
container_name: nine-openldap
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: /nine/check.sh
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.openldap
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- '1389:1389'
|
||||
- '1636:1636'
|
||||
#entrypoint: /nine/debug/debug.sh
|
||||
#command: sleep 1d
|
||||
volumes:
|
||||
- './volume/openldap/data:/bitnami/openldap'
|
||||
- './volume/openldap/nine:/nine'
|
||||
|
||||
keycloak:
|
||||
image: reg.cadoles.com/envole/keycloak:24.0.5
|
||||
container_name: nine-keycloak
|
||||
restart: always
|
||||
#entrypoint: /bin/bash # Spécifiez le point d'entrée souhaité (dans cet exemple, /bin/bash)
|
||||
#command:
|
||||
#tty: true
|
||||
#stdin_open: true
|
||||
|
||||
healthcheck:
|
||||
test: curl --fail http://127.0.0.1:9990 || exit 1
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.keycloak
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- 8999:8999
|
||||
- 8443:8443
|
||||
volumes:
|
||||
- './volume/keycloak/nine:/nine'
|
||||
command:
|
||||
- start-dev
|
||||
- --import-realm
|
||||
|
||||
ninegate:
|
||||
image: reg.cadoles.com/envole/ninegate
|
||||
container_name: nine-ninegate
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: curl --fail http://localhost/ninegate || exit 1
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.ninegate
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- "9000:80"
|
||||
volumes:
|
||||
- ./volume/ninegate/data/private:/app/uploads
|
||||
- ./volume/ninegate/data/public:/app/public/uploads
|
||||
|
||||
nextcloud:
|
||||
image: reg.cadoles.com/envole/nextcloud
|
||||
container_name: nine-nextcloud
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: curl --fail http://localhost || exit 1
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.nextcloud
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- 9001:80
|
||||
volumes:
|
||||
- ./volume/nextcloud/html:/var/www/html
|
||||
- ./volume/nextcloud/app:/var/www/html/custom_apps
|
||||
- ./volume/nextcloud/data:/var/www/html/data
|
||||
- ./volume/nextcloud/nine:/nine
|
||||
- ./volume/nextcloud/prestart:/docker-entrypoint-hooks.d/before-starting
|
||||
|
||||
nineboard:
|
||||
image: reg.cadoles.com/envole/nineboard
|
||||
container_name: nine-nineboard
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: curl --fail http://localhost/nineboard || exit 1
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.nineboard
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- "9002:80"
|
||||
volumes:
|
||||
- ./volume/nineboard/data/private:/app/uploads
|
||||
- ./volume/nineboard/data/public:/app/public/uploads
|
||||
|
||||
wordpress:
|
||||
image: reg.cadoles.com/envole/wordpress
|
||||
container_name: nine-wordpress
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: curl --fail http://localhost/wordpress || exit 1
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.wordpress
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- "9003:80"
|
||||
volumes:
|
||||
- ./volume/wordpress/data:/app/public/wp-content
|
||||
|
||||
adminer:
|
||||
image: docker.io/library/adminer
|
||||
container_name: nine-adminer
|
||||
restart: always
|
||||
env_file: ./tmp/.env.adminer
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- 9100:8080
|
||||
|
||||
phpldapadmin:
|
||||
image: docker.io/osixia/phpldapadmin:latest
|
||||
container_name: nine-phpldapadmin
|
||||
restart: always
|
||||
env_file: ./tmp/.env.phpldapadmin
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- "9101:80"
|
||||
|
||||
nineapache:
|
||||
image: reg.cadoles.com/envole/nineapache:7.4
|
||||
container_name: nine-nineapache
|
||||
restart: always
|
||||
healthcheck:
|
||||
test: curl --fail http://localhost || exit 1
|
||||
interval: 1s
|
||||
timeout: 60s
|
||||
env_file: ./tmp/.env.nineapache
|
||||
networks:
|
||||
- nine-network
|
||||
ports:
|
||||
- "9102:80"
|
||||
|
||||
networks:
|
||||
nine-network:
|
||||
name: nine-network
|
||||
|
|
@ -0,0 +1,124 @@
|
|||
# == GLOBAL ===============================================================================================================================
|
||||
|
||||
# ATTENTION
|
||||
# si vous souhaiter faire tourner nine sur localhost vous devez ajouter dans votre host = 127.0.0.0 nine.local
|
||||
# votre localhost devra aussi disposer d'un certificat
|
||||
# si vous changer le web_url penser à modifier nine.local par votre web_url dans volume/keycloak/nine/realm-export.json
|
||||
# sinon il vous faudra vous connecter à keycloak pour changer l'url du client nine
|
||||
|
||||
# RELEASE SYSTEM = linux ou eole si eole le réseau du compose sera supprimé et regénéré à chaque UP
|
||||
RELEASE_SYSTEM=linux
|
||||
|
||||
# GLOBAL
|
||||
APP_ENV=PROD
|
||||
WEB_URL=nine.local
|
||||
PROTOCOLE=https
|
||||
|
||||
# ADMIN USER
|
||||
ADMIN_USER=admin
|
||||
ADMIN_PASSWORD=changeme
|
||||
|
||||
# MASTERIDENTITY
|
||||
# SQL or SSO or (to do LDAP)
|
||||
MASTERIDENTITY=SQL
|
||||
|
||||
# AUTHENTIFICATION
|
||||
# SQL or CAS (todo LDAP or OPENID)
|
||||
MODE_AUTH=CAS
|
||||
|
||||
# MARIADB
|
||||
MARIADB_SERVICE_NAME=mariadb
|
||||
MARIADB_ACTIVATE=1
|
||||
MARIADB_LOCAL=1
|
||||
MARIADB_ROOT_PASSWORD=${ADMIN_PASSWORD}
|
||||
MARIADB_USER=user
|
||||
MARIADB_PASSWORD=${ADMIN_PASSWORD}
|
||||
|
||||
# LDAP
|
||||
# LDAP_SYNC Si MASTERIDENTITY = SQL permet la synchronisation des utilisateurs SQL vers LDAP
|
||||
OPENLDAP_SERVICE_NAME=openldap
|
||||
LDAP_ACTIVATE=1
|
||||
LDAP_LOCAL=1
|
||||
LDAP_TYPE=LDAP
|
||||
LDAP_HOST=${OPENLDAP_SERVICE_NAME}
|
||||
LDAP_PORT=1389
|
||||
LDAP_TLS=0
|
||||
LDAP_BASEDN=dc=nine,dc=org
|
||||
LDAP_ADMIN_USERNAME=${ADMIN_USER}
|
||||
LDAP_USER=cn=${LDAP_ADMIN_USERNAME},${LDAP_BASEDN}
|
||||
LDAP_PASSWORD=${ADMIN_PASSWORD}
|
||||
LDAP_BASEUSER=ou=users,ou=ninegate,${LDAP_BASEDN}
|
||||
LDAP_BASENIVEAU01=ou=niveau01,ou=ninegate,${LDAP_BASEDN}
|
||||
LDAP_BASENIVEAU02=ou=niveau02,ou=ninegate,${LDAP_BASEDN}
|
||||
LDAP_BASEGROUP=ou=groups,ou=ninegate,${LDAP_BASEDN}
|
||||
LDAP_SYNC=1
|
||||
LDAP_TEMPLATE=open
|
||||
LDAP_USERNAME=uid
|
||||
LDAP_FIRSTNAME=givenname
|
||||
LDAP_LASTNAME=sn
|
||||
LDAP_DISPLAYNAME=displayName
|
||||
LDAP_EMAIL=mail
|
||||
LDAP_MEMBER=memberUid
|
||||
LDAP_USER_FILTER="(&(${LDAP_USERNAME}=*)(objectClass=person)(!(description=Computer)))"
|
||||
LDAP_LOGIN_FILTER="(&(${LDAP_USERNAME}=%uid)(objectClass=person)(!(description=Computer)))"
|
||||
LDAP_GROUP_FILTER="(&(objectClass=posixGroup))"
|
||||
SCRIBE_GROUP=1
|
||||
SCRIBE_MASTER=1
|
||||
OPENLDAPREQNIVEAU01="(&(uid=*)(objectclass=inetOrgPerson)(!(description=Computer)))"
|
||||
OPENLDAPSYNCHROGROUP=0
|
||||
OPENLDAPREQGROUP=
|
||||
|
||||
# CAS
|
||||
KEYCLOAK_SERVICE_NAME=keycloak
|
||||
CAS_ACTIVATE=1
|
||||
CAS_LOCAL=1
|
||||
CAS_USER=${ADMIN_USER}-keycloak
|
||||
CAS_PASSWORD=${ADMIN_PASSWORD}-keycloak
|
||||
CAS_HOST=${WEB_URL}
|
||||
CAS_PORT=443
|
||||
CAS_PATH=/auth/realms/nine/protocol/cas
|
||||
CAS_URL=${PROTOCOLE}://${CAS_HOST}:${CAS_PORT}
|
||||
|
||||
# NINEGATE
|
||||
NINEGATE_SERVICE_NAME=ninegate
|
||||
NINEGATE_ACTIVATE=1
|
||||
NINEGATE_LOCAL=1
|
||||
NINEGATE_URL=${PROTOCOLE}://${WEB_URL}/ninegate
|
||||
|
||||
# NEXTCLOUD
|
||||
NEXTCLOUD_SERVICE_NAME=nextcloud
|
||||
NEXTCLOUD_ACTIVATE=0
|
||||
NEXTCLOUD_LOCAL=1
|
||||
NEXTCLOUD_URL=${PROTOCOLE}://${WEB_URL}/nextcloud
|
||||
NEXTCLOUD_SAMBA=0
|
||||
|
||||
# NINEBOARD
|
||||
NINEBOARD_SERVICE_NAME=nineboard
|
||||
NINEBOARD_ACTIVATE=1
|
||||
NINEBOARD_LOCAL=1
|
||||
NINEBOARD_URL=${PROTOCOLE}://${WEB_URL}/nineboard
|
||||
|
||||
# WORDPRESS
|
||||
WORDPRESS_SERVICE_NAME=wordpress
|
||||
WORDPRESS_ACTIVATE=1
|
||||
WORDPRESS_LOCAL=1
|
||||
WORDPRESS_URL=${PROTOCOLE}://${WEB_URL}/wordpress
|
||||
|
||||
# ADMINER
|
||||
ADMINER_SERVICE_NAME=adminer
|
||||
ADMINER_ACTIVATE=0
|
||||
ADMINER_LOCAL=1
|
||||
ADMINER_URL=${PROTOCOLE}://${WEB_URL}/adminer/?server=${MARIADB_SERVICE_NAME}&username=${MARIADB_USER}
|
||||
|
||||
# PHPLDAPADMIN
|
||||
PHPLDAPADMIN_SERVICE_NAME=phpldapadmin
|
||||
PHPLDAPADMIN_ACTIVATE=0
|
||||
PHPLDAPADMIN_LOCAL=1
|
||||
PHPLDAPADMIN_URL=${PROTOCOLE}://${WEB_URL}/phpldapadmin
|
||||
|
||||
# NINEAPACHE
|
||||
NINEAPACHE_SERVICE_NAME=nineapache
|
||||
NINEAPACHE_ACTIVATE=0
|
||||
NINEAPACHE_LOCAL=1
|
||||
NINEAPACHE_URL=${PROTOCOLE}://${WEB_URL}:9102
|
||||
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
|
||||
# == KEYCLOAK =============================================================================================================================
|
||||
|
||||
KEYCLOAK_ADMIN=${CAS_USER}
|
||||
KEYCLOAK_ADMIN_PASSWORD=${CAS_PASSWORD}
|
||||
|
||||
KC_DB=mariadb
|
||||
KC_DB_URL=jdbc:mariadb://${MARIADB_SERVICE_NAME}:3306/keycloak
|
||||
KC_DB_USERNAME=${MARIADB_USER}
|
||||
KC_DB_PASSWORD=${MARIADB_PASSWORD}
|
||||
|
||||
KC_HTTPS_CERTIFICATE_FILE=/nine/server.crt.pem
|
||||
KC_HTTPS_CERTIFICATE_KEY_FILE=/nine/server.key.pem
|
||||
KC_HOSTNAME_PATH=/auth
|
||||
KC_HTTP_PORT=8999
|
||||
KC_HOSTNAME=nine.local
|
||||
KC_HOSTNAME_STRICT=false
|
||||
KC_PROXY_ADDRESS_FORWARDING=true
|
||||
KC_PROXY_HEADERS=xforwarded
|
||||
KC_HTTP_ENABLED=true
|
||||
|
||||
KC_IMPORT=/nine/realm-export.json
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
|
||||
# == MARIADB ==============================================================================================================================
|
||||
|
||||
MYSQL_ROOT_PASSWORD=$MARIADB_ROOT_PASSWORD
|
||||
MYSQL_USER=$MARIADB_USER
|
||||
MYSQL_PASSWORD=$MARIADB_PASSWORD
|
||||
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
|
||||
# == NEXTCLOUD ============================================================================================================================
|
||||
|
||||
MYSQL_HOST=mariadb
|
||||
MYSQL_DATABASE=nextcloud
|
||||
MYSQL_USER=${MARIADB_USER}
|
||||
MYSQL_PASSWORD=${MARIADB_PASSWORD}
|
||||
NEXTCLOUD_ADMIN_USER=${ADMIN_USER}
|
||||
NEXTCLOUD_ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
NEXTCLOUD_ALIAS=
|
||||
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
|
||||
# == NINEBOARD ============================================================================================================================
|
||||
|
||||
APP_AUTH=${MODE_AUTH}
|
||||
APP_ALIAS=nineboard
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
|
||||
# == NINEGATE =============================================================================================================================
|
||||
|
||||
# Activation Widget
|
||||
ACTIVATE_WIDADMINER=${ADMINER_ACTIVATE}
|
||||
WIDADMINER_URL="${ADMINER_URL}"
|
||||
|
||||
ACTIVATE_WIDPHPLDAPADMIN=${PHPLDAPADMIN_ACTIVATE}
|
||||
WIDPHPLDAPADMIN_URL=${PHPLDAPADMIN_URL}
|
||||
|
||||
ACTIVATE_WIDNEXTCLOUD=${NEXTCLOUD_ACTIVATE}
|
||||
WIDNEXTCLOUD_URL=${NEXTCLOUD_URL}
|
||||
|
||||
ACTIVATE_WIDNINEBOARD=${NINEBOARD_ACTIVATE}
|
||||
WIDNINEBOARD_URL=${NINEBOARD_URL}
|
||||
|
||||
ACTIVATE_WIDWORDPRESS=${WORDPRESS_ACTIVATE}
|
||||
WIDWORDPRESS_URL=${WORDPRESS_URL}
|
||||
|
||||
ACTIVATE_WIDGENCONFIG=${GENCONFIG_ACTIVATE}
|
||||
WIDGENCONFIG_URL=${GENCONFIG_URL}
|
||||
|
||||
INITPWDADMIN=${ADMIN_PASSWORD}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
|
||||
# == OPENLDAP =============================================================================================================================
|
||||
|
||||
LDAP_ROOT=${LDAP_BASEDN}
|
||||
LDAP_ADMIN_PASSWORD=${LDAP_PASSWORD}
|
||||
LDAP_ADMIN_DN=${LDAP_USER}
|
||||
LDAP_USERS="dockernouser"
|
||||
LDAP_PASSWORDS="dockernouser"
|
||||
LDAP_CUSTOM_SCHEMA_FILE=/nine/schema/cadoles.ldif
|
||||
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
|
||||
# == PHPLDAPADMIN =========================================================================================================================
|
||||
|
||||
PHPLDAPADMIN_LDAP_HOSTS=ldap://${LDAP_HOST}:${LDAP_PORT}
|
||||
PHPLDAPADMIN_HTTPS="false"
|
||||
PHPLDAPADMIN_SERVER_PATH=
|
||||
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
|
||||
# == WORDPRESS ============================================================================================================================
|
||||
|
||||
WORDPRESS_DB_HOST=mariadb
|
||||
WORDPRESS_DB_NAME=wordpress
|
||||
WORDPRESS_DB_USER=${MARIADB_USER}
|
||||
WORDPRESS_DB_PASSWORD=${MARIADB_PASSWORD}
|
||||
WORDPRESS_TITLE=wordpress
|
||||
WORDPRESS_USER=${ADMIN_USER}
|
||||
WORDPRESS_PASSWORD=${ADMIN_PASSWORD}
|
||||
WORDPRESS_EMAIL=${ADMIN_USER}@noreply.fr
|
||||
WORDPRESS_PROTOCOL=${PROTOCOLE}
|
||||
WORDPRESS_DOMAINE=${WEB_URL}
|
||||
WORDPRESS_ALIAS=/wordpress/
|
||||
|
|
@ -0,0 +1,186 @@
|
|||
#!/bin/bash
|
||||
|
||||
TPUT=/usr/bin/tput
|
||||
#test si TPUT est utilisable
|
||||
if [ ! "$TERM" = "" ] && $TPUT hpa 60 >/dev/null 2>&1 && $TPUT setaf 1 >/dev/null 2>&1; then
|
||||
FANCYTTY=1
|
||||
else
|
||||
FANCYTTY=0
|
||||
fi
|
||||
|
||||
Pause() {
|
||||
if [ "$ModeTxt" == "yes" ];then
|
||||
echo
|
||||
elif [ "$ModeEad" == "yes" ];then
|
||||
echo "<br>"
|
||||
else
|
||||
[ $FANCYTTY = 1 ] && $TPUT setaf 6
|
||||
echo " Appuyez sur Entrée pour continuer ..."
|
||||
[ $FANCYTTY = 1 ] && $TPUT sgr0
|
||||
read BiDon
|
||||
fi
|
||||
}
|
||||
|
||||
Echo() {
|
||||
if [ "$ModeEad" != "yes" ];
|
||||
then
|
||||
echo "$1"
|
||||
else
|
||||
echo "$1<br>"
|
||||
fi
|
||||
}
|
||||
|
||||
EchoColor() {
|
||||
if [ "$ModeTxt" = "yes" ];then
|
||||
echo "$1"
|
||||
elif [ "$ModeEad" = "yes" ];then
|
||||
echo "<FONT color=\"$3\"> $1 </FONT><br>"
|
||||
else
|
||||
[ "$FANCYTTY" = 1 ] && $TPUT setaf $2
|
||||
echo "$1"
|
||||
[ "$FANCYTTY" = 1 ] && $TPUT sgr0
|
||||
fi
|
||||
}
|
||||
|
||||
EchoRouge() {
|
||||
EchoColor "$1" "1" "red"
|
||||
}
|
||||
|
||||
EchoVert() {
|
||||
EchoColor "$1" "2" "green"
|
||||
}
|
||||
|
||||
EchoOrange() {
|
||||
EchoColor "$1" "3" "orange"
|
||||
}
|
||||
|
||||
EchoBleu() {
|
||||
EchoColor "$1" "4" "blue"
|
||||
}
|
||||
|
||||
EchoMagenta() {
|
||||
EchoColor "$1" "5" "magenta"
|
||||
}
|
||||
|
||||
EchoCyan() {
|
||||
EchoColor "$1" "6" "cyan"
|
||||
}
|
||||
|
||||
EchoBlanc() {
|
||||
EchoColor "$1" "7" "white"
|
||||
}
|
||||
|
||||
EchoGras() {
|
||||
if [ "$ModeTxt" == "yes" ];then
|
||||
echo "$1"
|
||||
elif [ "$ModeEad" == "yes" ];then
|
||||
echo "<b> $1 </b><br>"
|
||||
else
|
||||
[ $FANCYTTY = 1 ] && $TPUT bold
|
||||
echo "$1"
|
||||
[ $FANCYTTY = 1 ] && $TPUT sgr0
|
||||
fi
|
||||
}
|
||||
|
||||
Clear() {
|
||||
if [ "$ModeEad" != "yes" -a "$ModeTxt" != "yes" ];then
|
||||
clear
|
||||
fi
|
||||
}
|
||||
|
||||
Question_ouinon() {
|
||||
#attention, il faut synchroniser les modifications avec /usr/share/pyshared/pyeole/ihm.py
|
||||
question=$1
|
||||
[ "$2" = "" ] && interactive='True' || interactive=$2
|
||||
[ "$3" = "" ] && default="non" || default=$3
|
||||
[ "$4" = "" ] && level="info" || level=$4
|
||||
[ "$5" = "" ] && default_uninteractive=$default || default_uninteractive=$5
|
||||
[ ! "$interactive" = "True" ] && [ ! "$interactive" = "False" ] && echo "Question_ouinon : interactive doit être True ou False" && exit 1
|
||||
[ ! "$default" = "oui" ] && [ ! "$default" = "non" ] && echo "Question_ouinon : default doit etre oui ou non" && exit 1
|
||||
[ ! "$default_uninteractive" = "oui" ] && [ ! "$default_uninteractive" = "non" ] && echo "Question_ouinon : default_uninteractive doit etre oui ou non" && exit 1
|
||||
[ ! "$level" = "info" ] && [ ! "$level" = "warn" ] && [ ! "$level" = "err" ] && echo "Question_ouinon : level doit etre info, warn ou err" && exit 1
|
||||
#non interactive
|
||||
if [ "$interactive" = "False" ]; then
|
||||
Rep=default_uninteractive
|
||||
else
|
||||
question="$question [oui/non]"
|
||||
if [ $level = "info" ]; then
|
||||
echo "$question"
|
||||
elif [ $level = "warn" ]; then
|
||||
EchoOrange "$question"
|
||||
else
|
||||
EchoRouge "$question"
|
||||
fi
|
||||
echo -n "[$default] : "
|
||||
read Rep
|
||||
#passe en minuscule
|
||||
Rep=`echo $Rep | tr A-Z a-z`
|
||||
fi
|
||||
if [ "$default" = "non" ]; then
|
||||
if [ "$Rep" = "oui" -o "$Rep" = "o" -o "$Rep" = "yes" -o "$Rep" = "y" ];then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
if [ "$Rep" = "non" -o "$Rep" = "n" -o "$Rep" = "no" ];then
|
||||
return 1
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
EchoStart() {
|
||||
for i in $(eval echo "{1..30}")
|
||||
do
|
||||
ligne+="="
|
||||
done
|
||||
clear
|
||||
}
|
||||
|
||||
BigTitle(){
|
||||
size=`tput cols`
|
||||
nb=${#1}
|
||||
nbchar=$(($size - $nb - 4))
|
||||
|
||||
ligne=""
|
||||
for i in $(eval echo "{1..$size}")
|
||||
do
|
||||
ligne+="="
|
||||
done
|
||||
|
||||
finligne=""
|
||||
for i in $(eval echo "{1..$nbchar}")
|
||||
do
|
||||
finligne+="="
|
||||
done
|
||||
|
||||
echo
|
||||
EchoVert $ligne
|
||||
EchoVert "== $1 $finligne"
|
||||
EchoVert $ligne
|
||||
echo
|
||||
}
|
||||
|
||||
Title(){
|
||||
size=`tput cols`
|
||||
nb=${#1}
|
||||
nbchar=$(($size - $nb - 4))
|
||||
|
||||
ligne=""
|
||||
for i in $(eval echo "{1..$size}")
|
||||
do
|
||||
ligne+="="
|
||||
done
|
||||
|
||||
finligne=""
|
||||
for i in $(eval echo "{1..$nbchar}")
|
||||
do
|
||||
finligne+="="
|
||||
done
|
||||
|
||||
echo
|
||||
EchoCyan "== $1 $finligne"
|
||||
echo
|
||||
}
|
||||
|
|
@ -0,0 +1,22 @@
|
|||
ProxyPass /auth http://nine.local:8080/auth retry=0 keepalive=On
|
||||
ProxyPassReverse /auth http://nine.local:8080/auth retry=0
|
||||
|
||||
ProxyPass /ninegate http://nine.local:9000/ninegate retry=0 keepalive=On
|
||||
ProxyPassReverse /ninegate http://nine.local:9000/ninegate retry=0
|
||||
ProxyPass /wssninegate ws://nine.local:9000/wssninegate retry=0 keepalive=On
|
||||
ProxyPassReverse /wssninegate ws://nine.local:9000/wssninegate retry=0
|
||||
|
||||
ProxyPass /nextcloud http://nine.local:9001 retry=0 keepalive=On
|
||||
ProxyPassReverse /nextcloud http://nine.local:9001 retry=0
|
||||
|
||||
ProxyPass /adminer http://nine.local:9100 retry=0 keepalive=On
|
||||
ProxyPassReverse /adminer http://nine.local:9100 retry=0
|
||||
|
||||
ProxyPass /phpldapadmin http://nine.local:9101/phpldapadmin retry=0 keepalive=On
|
||||
ProxyPassReverse /phpldapadmin http://nine.local:9101/phpldapadmin retry=0
|
||||
|
||||
ProxyPass /nineapache http://nine.local:9102 retry=0 keepalive=On
|
||||
ProxyPassReverse /nineapache http://nine.local:9102 retry=0
|
||||
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
FROM quay.io/keycloak/keycloak:24.0.5
|
||||
|
||||
COPY keycloak-protocol-cas-24.0.5.jar /opt/keycloak/providers/keycloak-protocol-cas.jar
|
||||
|
||||
USER keycloak
|
||||
Binary file not shown.
|
|
@ -0,0 +1,12 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
keycloak:
|
||||
build:
|
||||
context: ./containers/keycloak
|
||||
image: reg.cadoles.com/envole/keycloak:24.0.5
|
||||
container_name: keycloak
|
||||
ports:
|
||||
- "9000:8080"
|
||||
command:
|
||||
- start-dev
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
FROM nextcloud:apache
|
||||
|
||||
RUN apt-get update && apt-get install -y procps smbclient && rm -rf /var/lib/apt/lists/*
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
nextcloud:
|
||||
build:
|
||||
context: ./containers/nextcloud
|
||||
image: reg.cadoles.com/envole/nextcloud
|
||||
container_name: nextcloud
|
||||
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
FROM alpine:3.15
|
||||
|
||||
RUN apk add --no-cache \
|
||||
bash \
|
||||
sed \
|
||||
vim \
|
||||
ca-certificates \
|
||||
openldap-clients \
|
||||
wget \
|
||||
npm \
|
||||
git \
|
||||
curl \
|
||||
unzip \
|
||||
zip \
|
||||
openssl
|
||||
|
||||
RUN apk add --no-cache \
|
||||
apache2 \
|
||||
apache2-proxy \
|
||||
apache2-ssl
|
||||
|
||||
RUN apk add --no-cache \
|
||||
php7 \
|
||||
php7-apache2 \
|
||||
php7-gd \
|
||||
php7-zip \
|
||||
php7-xml \
|
||||
php7-ctype \
|
||||
php7-simplexml \
|
||||
php7-tokenizer \
|
||||
php7-sodium \
|
||||
php7-dom \
|
||||
php7-pdo \
|
||||
php7-pdo_pgsql \
|
||||
php7-pdo_mysql \
|
||||
php7-curl \
|
||||
php7-ldap \
|
||||
php7-pecl-igbinary \
|
||||
php7-session \
|
||||
php7-pecl-redis \
|
||||
php7-fileinfo \
|
||||
php7-xmlwriter \
|
||||
php7-openssl \
|
||||
php7-phar \
|
||||
php7-iconv \
|
||||
php7-mbstring \
|
||||
php7-fpm \
|
||||
php7-sockets \
|
||||
php7-opcache \
|
||||
php7-intl \
|
||||
php7-bcmath \
|
||||
php7-pecl-ssh2
|
||||
|
||||
RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash
|
||||
RUN curl -sS https://getcomposer.org/installer | php -- --1 --install-dir=/usr/local/bin --filename=composer
|
||||
|
||||
RUN npm install -g n
|
||||
RUN npm install -g yarn
|
||||
|
||||
COPY apache2.sh /etc/apache2/apache2.sh
|
||||
RUN chmod +x /etc/apache2/apache2.sh
|
||||
COPY php.local.ini /etc/php7/conf.d/
|
||||
COPY apache.conf /etc/apache2/conf.d/zapp.conf
|
||||
COPY ssl.conf /etc/apache2/conf.d/ssl.conf
|
||||
COPY index.php /app/public/index.php
|
||||
|
||||
CMD /etc/apache2/apache2.sh
|
||||
|
|
@ -0,0 +1,19 @@
|
|||
|
||||
LoadModule rewrite_module modules/mod_rewrite.so
|
||||
ServerName nineapache.local
|
||||
DocumentRoot "/app/public"
|
||||
<Directory "/app/public">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
|
||||
RewriteEngine On
|
||||
RewriteCond %{REQUEST_URI}::$0 ^(/.+)/(.*)::\2$
|
||||
RewriteRule .* - [E=BASE:%1]
|
||||
RewriteCond %{HTTP:Authorization} .+
|
||||
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%0]
|
||||
RewriteCond %{ENV:REDIRECT_STATUS} =""
|
||||
RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
|
||||
RewriteCond %{REQUEST_FILENAME} !-f
|
||||
RewriteRule ^ %{ENV:BASE}/index.php [L]
|
||||
</Directory>
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
#!/bin/bash
|
||||
|
||||
envfile=/etc/apache2/conf.d/env.conf
|
||||
haveenv=/etc/apache2/haveenv.txt
|
||||
|
||||
rm -rf $envfile
|
||||
rm -rf $haveenv
|
||||
|
||||
echo "GENERATION DES VARIABLES D'ENVIRONNEMENT"
|
||||
printf "\n# Expose environment variables to scripts.\nPassEnv" >> $envfile
|
||||
compgen -e | while read name ; do
|
||||
if [[ "$name" != "TERM" && "$name" != "HOME" && "$name" != "HOSTNAME" && "$name" != "PATH" && "$name" != "PWD" && "$name" != "SHLVL" ]]
|
||||
then
|
||||
touch $haveenv
|
||||
printf " $name" >> $envfile
|
||||
fi
|
||||
done
|
||||
printf "\n" >> $envfile
|
||||
|
||||
if [[ ! -f $haveenv ]]
|
||||
then
|
||||
rm -rf $envfile
|
||||
fi
|
||||
rm -rf $haveenv
|
||||
|
||||
echo "START HTTPD"
|
||||
httpd -DFOREGROUND
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
<?php
|
||||
echo "<html><head><title>Nineapache 7</title></head><body>";
|
||||
echo "<h1><center>NINEAPACHE 7</center></h1>";
|
||||
|
||||
echo phpinfo();
|
||||
echo "</body></html>";
|
||||
?>
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
memory_limit = 512M
|
||||
upload_max_filesize = 512M
|
||||
post_max_size = 512M
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
LoadModule ssl_module modules/mod_ssl.so
|
||||
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
|
||||
|
||||
SSLRandomSeed startup file:/dev/urandom 512
|
||||
SSLRandomSeed connect builtin
|
||||
|
||||
Listen 443
|
||||
|
||||
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!ADH
|
||||
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!ADH
|
||||
SSLHonorCipherOrder on
|
||||
SSLProtocol all -SSLv3
|
||||
SSLProxyProtocol all -SSLv3
|
||||
SSLPassPhraseDialog builtin
|
||||
SSLSessionCache "shmcb:/var/cache/mod_ssl/scache(512000)"
|
||||
SSLSessionCacheTimeout 300
|
||||
|
||||
<VirtualHost _default_:443>
|
||||
DocumentRoot "/app/public"
|
||||
ServerName www.example.com:443
|
||||
ServerAdmin you@example.com
|
||||
ErrorLog logs/ssl_error.log
|
||||
TransferLog logs/ssl_access.log
|
||||
|
||||
SSLEngine on
|
||||
|
||||
SSLCertificateFile /etc/ssl/apache2/server.pem
|
||||
SSLCertificateKeyFile /etc/ssl/apache2/server.key
|
||||
|
||||
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
||||
SSLOptions +StdEnvVars
|
||||
</FilesMatch>
|
||||
<Directory "/app/public/cgi-bin">
|
||||
SSLOptions +StdEnvVars
|
||||
</Directory>
|
||||
|
||||
BrowserMatch "MSIE [2-5]" \
|
||||
nokeepalive ssl-unclean-shutdown \
|
||||
downgrade-1.0 force-response-1.0
|
||||
|
||||
CustomLog logs/ssl_request.log \
|
||||
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
||||
</VirtualHost>
|
||||
|
|
@ -0,0 +1,11 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
nineapache:
|
||||
build:
|
||||
context: ./containers/nineapache
|
||||
image: reg.cadoles.com/envole/nineapache:7.4
|
||||
container_name: nineapache7
|
||||
ports:
|
||||
- 8080:80
|
||||
|
||||
|
|
@ -0,0 +1,68 @@
|
|||
FROM alpine:3.18
|
||||
|
||||
RUN apk add --no-cache \
|
||||
bash \
|
||||
sed \
|
||||
vim \
|
||||
ca-certificates \
|
||||
openldap-clients \
|
||||
wget \
|
||||
npm \
|
||||
git \
|
||||
curl \
|
||||
unzip \
|
||||
zip \
|
||||
openssl
|
||||
|
||||
RUN apk add --no-cache \
|
||||
apache2 \
|
||||
apache2-proxy \
|
||||
apache2-ssl
|
||||
|
||||
RUN apk add --no-cache \
|
||||
php81 \
|
||||
php81-apache2 \
|
||||
php81-gd \
|
||||
php81-zip \
|
||||
php81-xml \
|
||||
php81-ctype \
|
||||
php81-simplexml \
|
||||
php81-tokenizer \
|
||||
php81-sodium \
|
||||
php81-dom \
|
||||
php81-pdo \
|
||||
php81-pdo_pgsql \
|
||||
php81-pdo_mysql \
|
||||
php81-curl \
|
||||
php81-ldap \
|
||||
php81-pecl-igbinary \
|
||||
php81-session \
|
||||
php81-pecl-redis \
|
||||
php81-fileinfo \
|
||||
php81-xmlwriter \
|
||||
php81-openssl \
|
||||
php81-phar \
|
||||
php81-iconv \
|
||||
php81-mbstring \
|
||||
php81-fpm \
|
||||
php81-sockets \
|
||||
php81-opcache \
|
||||
php81-intl \
|
||||
php81-bcmath \
|
||||
php81-pecl-ssh2
|
||||
|
||||
RUN curl -k https://forge.cadoles.com/Cadoles/Jenkins/raw/branch/master/resources/com/cadoles/common/add-letsencrypt-ca.sh | bash
|
||||
|
||||
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
|
||||
|
||||
RUN npm install -g n
|
||||
RUN npm install -g yarn
|
||||
|
||||
COPY apache2.sh /etc/apache2/apache2.sh
|
||||
RUN chmod +x /etc/apache2/apache2.sh
|
||||
COPY php.local.ini /etc/php81/conf.d/
|
||||
COPY apache.conf /etc/apache2/conf.d/zapp.conf
|
||||
COPY ssl.conf /etc/apache2/conf.d/ssl.conf
|
||||
COPY index.php /app/public/index.php
|
||||
|
||||
CMD /etc/apache2/apache2.sh
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
|
||||
LoadModule rewrite_module modules/mod_rewrite.so
|
||||
ServerName nineapache.local
|
||||
DocumentRoot "/app/public"
|
||||
<Directory "/app/public">
|
||||
Options Indexes FollowSymLinks
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
|
||||
RewriteEngine On
|
||||
RewriteCond %{REQUEST_URI}::$0 ^(/.+)/(.*)::\2$
|
||||
RewriteRule .* - [E=BASE:%1]
|
||||
RewriteCond %{HTTP:Authorization} .+
|
||||
RewriteRule ^ - [E=HTTP_AUTHORIZATION:%0]
|
||||
RewriteCond %{ENV:REDIRECT_STATUS} =""
|
||||
RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
|
||||
RewriteCond %{REQUEST_FILENAME} !-f
|
||||
RewriteRule ^ %{ENV:BASE}/index.php [L]
|
||||
</Directory>
|
||||
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
#!/bin/bash
|
||||
|
||||
envfile=/etc/apache2/conf.d/env.conf
|
||||
haveenv=/etc/apache2/haveenv.txt
|
||||
|
||||
rm -rf $envfile
|
||||
rm -rf $haveenv
|
||||
|
||||
echo "GENERATION DES VARIABLES D'ENVIRONNEMENT"
|
||||
printf "\n# Expose environment variables to scripts.\nPassEnv" >> $envfile
|
||||
compgen -e | while read name ; do
|
||||
if [[ "$name" != "TERM" && "$name" != "HOME" && "$name" != "HOSTNAME" && "$name" != "PATH" && "$name" != "PWD" && "$name" != "SHLVL" ]]
|
||||
then
|
||||
touch $haveenv
|
||||
printf " $name" >> $envfile
|
||||
fi
|
||||
done
|
||||
printf "\n" >> $envfile
|
||||
|
||||
if [[ ! -f $haveenv ]]
|
||||
then
|
||||
rm -rf $envfile
|
||||
fi
|
||||
rm -rf $haveenv
|
||||
|
||||
echo "START HTTPD"
|
||||
httpd -DFOREGROUND
|
||||
|
|
@ -0,0 +1,9 @@
|
|||
<?php
|
||||
echo "<html><head><title>Nineapache 8</title></head><body>";
|
||||
echo "<h1><center>NINEAPACHE 8</center></h1>";
|
||||
|
||||
echo phpinfo();
|
||||
echo "</body></html>";
|
||||
?>
|
||||
|
||||
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
memory_limit = 512M
|
||||
upload_max_filesize = 512M
|
||||
post_max_size = 512M
|
||||
|
|
@ -0,0 +1,43 @@
|
|||
LoadModule ssl_module modules/mod_ssl.so
|
||||
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
|
||||
|
||||
SSLRandomSeed startup file:/dev/urandom 512
|
||||
SSLRandomSeed connect builtin
|
||||
|
||||
Listen 443
|
||||
|
||||
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!ADH
|
||||
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES:!ADH
|
||||
SSLHonorCipherOrder on
|
||||
SSLProtocol all -SSLv3
|
||||
SSLProxyProtocol all -SSLv3
|
||||
SSLPassPhraseDialog builtin
|
||||
SSLSessionCache "shmcb:/var/cache/mod_ssl/scache(512000)"
|
||||
SSLSessionCacheTimeout 300
|
||||
|
||||
<VirtualHost _default_:443>
|
||||
DocumentRoot "/app/public"
|
||||
ServerName www.example.com:443
|
||||
ServerAdmin you@example.com
|
||||
ErrorLog logs/ssl_error.log
|
||||
TransferLog logs/ssl_access.log
|
||||
|
||||
SSLEngine on
|
||||
|
||||
SSLCertificateFile /etc/ssl/apache2/server.pem
|
||||
SSLCertificateKeyFile /etc/ssl/apache2/server.key
|
||||
|
||||
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
||||
SSLOptions +StdEnvVars
|
||||
</FilesMatch>
|
||||
<Directory "/app/public/cgi-bin">
|
||||
SSLOptions +StdEnvVars
|
||||
</Directory>
|
||||
|
||||
BrowserMatch "MSIE [2-5]" \
|
||||
nokeepalive ssl-unclean-shutdown \
|
||||
downgrade-1.0 force-response-1.0
|
||||
|
||||
CustomLog logs/ssl_request.log \
|
||||
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
||||
</VirtualHost>
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
nineapache:
|
||||
build:
|
||||
context: ./containers/nineapache
|
||||
image: reg.cadoles.com/envole/nineapache:8.1
|
||||
container_name: nineapache8
|
||||
ports:
|
||||
- 8080:443
|
||||
|
|
@ -0,0 +1,67 @@
|
|||
#!/bin/bash
|
||||
set -eo pipefail
|
||||
|
||||
cd /app/public
|
||||
|
||||
|
||||
if [[ ! -f /app/public/wp-config.php ]]
|
||||
then
|
||||
wp config create \
|
||||
--allow-root \
|
||||
--dbhost="${WORDPRESS_DB_HOST}" \
|
||||
--dbname="${WORDPRESS_DB_NAME}" \
|
||||
--dbuser="${WORDPRESS_DB_USER}" \
|
||||
--dbpass="${WORDPRESS_DB_PASSWORD}" \
|
||||
--dbcharset="utf8mb4" \
|
||||
--locale="fr_FR"
|
||||
fi
|
||||
|
||||
wp core multisite-install \
|
||||
--allow-root \
|
||||
--url="${WORDPRESS_PROTOCOL}://${WORDPRESS_DOMAINE}" \
|
||||
--title="${WORDPRESS_TITLE}" \
|
||||
--admin_user="${WORDPRESS_USER}" \
|
||||
--admin_password="${WORDPRESS_PASSWORD}" \
|
||||
--admin_email="${WORDPRESS_EMAIL}" \
|
||||
--skip-email
|
||||
|
||||
wp config set --allow-root DB_HOST ${WORDPRESS_DB_HOST}
|
||||
wp config set --allow-root DB_NAME ${WORDPRESS_DB_NAME}
|
||||
wp config set --allow-root DB_USER ${WORDPRESS_DB_USER}
|
||||
wp config set --allow-root DB_PASSWORD ${WORDPRESS_DB_PASSWORD}
|
||||
|
||||
wp config set --allow-root WP_HOME ${WORDPRESS_PROTOCOL}://${WORDPRESS_DOMAINE}${WORDPRESS_ALIAS}
|
||||
wp config set --allow-root WP_SITEURL ${WORDPRESS_PROTOCOL}://${WORDPRESS_DOMAINE}${WORDPRESS_ALIAS}
|
||||
|
||||
wp config set --allow-root WP_ALLOW_MULTISITE true
|
||||
wp config set --allow-root MULTISITE true
|
||||
wp config set --allow-root SUBDOMAIN_INSTALL false
|
||||
wp config set --allow-root DOMAIN_CURRENT_SITE ${WORDPRESS_DOMAINE}
|
||||
wp config set --allow-root PATH_CURRENT_SITE ${WORDPRESS_ALIAS}
|
||||
wp config set --allow-root FORCE_ADMIN_SSL false
|
||||
wp config set --allow-root SITE_ID_CURRENT_SITE 1
|
||||
wp config set --allow-root BLOG_ID_CURRENT_SITE 1
|
||||
|
||||
# On fait croire à WP qu'il est en https
|
||||
if grep -qF "_SERVER['HTTPS']='on'" "wp-config.php"; then
|
||||
if [[ "${WORDPRESS_PROTOCOL}" == "https" ]]
|
||||
then
|
||||
echo "FORCE HTTPS already set"
|
||||
fi
|
||||
else
|
||||
if [[ "${WORDPRESS_PROTOCOL}" == "https" ]]
|
||||
then
|
||||
echo "FORCE HTTPS set"
|
||||
head -n 1 "wp-config.php" > "wp-config.tmp"
|
||||
echo "\$_SERVER['HTTPS']='on';" >> "wp-config.tmp"
|
||||
tail -n +2 "wp-config.php" >> "wp-config.tmp"
|
||||
mv "wp-config.tmp" "wp-config.php"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Mise à jour theme / plugin / network
|
||||
wp theme update --allow-root --all
|
||||
wp plugin update --allow-root --all
|
||||
wp core update-db --network
|
||||
|
||||
exec $@
|
||||
|
|
@ -0,0 +1,25 @@
|
|||
FROM reg.cadoles.com/envole/nineapache:8.1
|
||||
|
||||
# Paquet necessaire pour wordpress
|
||||
RUN apk add php81-mysqli
|
||||
|
||||
# Installation de wp-cli
|
||||
COPY wp-cli.phar /usr/local/bin/wp
|
||||
RUN chmod +x /usr/local/bin/wp
|
||||
|
||||
# Configuration apache
|
||||
RUN cd /app/public
|
||||
COPY apache.conf /etc/apache2/conf.d/zapp.conf
|
||||
|
||||
# Installation des sources wordpress
|
||||
RUN wp core download --path=/app/public --locale=fr_FR
|
||||
RUN chown -R apache:apache /app/public
|
||||
RUN find /app/public -type d -exec chmod 755 {} +
|
||||
RUN find /app/public -type f -exec chmod 644 {} +
|
||||
|
||||
RUN mkdir /docker
|
||||
COPY entrypoint.sh /docker/entrypoint.sh
|
||||
RUN chmod +x /docker/entrypoint.sh
|
||||
|
||||
# CMD
|
||||
CMD /docker/entrypoint.sh && /etc/apache2/apache2.sh
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
LoadModule rewrite_module modules/mod_rewrite.so
|
||||
ServerName nineapache.local
|
||||
DocumentRoot "/app/public"
|
||||
Alias /wordpress /app/public
|
||||
<Directory "/app/public">
|
||||
Options FollowSymLinks
|
||||
AllowOverride Limit Options FileInfo
|
||||
DirectoryIndex index.php
|
||||
Require all granted
|
||||
|
||||
RewriteEngine On
|
||||
RewriteBase /wordpress/
|
||||
|
||||
RewriteRule ^index\.php$ - [L]
|
||||
|
||||
# add a trailing slash to /wp-admin
|
||||
RewriteRule ^([_0-9a-zA-Z-]+/)?wp-admin$ $1wp-admin/ [R=301,L]
|
||||
RewriteCond %{REQUEST_FILENAME} -f [OR]
|
||||
RewriteCond %{REQUEST_FILENAME} -d
|
||||
RewriteRule ^ - [L]
|
||||
RewriteRule ^([_0-9a-zA-Z-]+/)?(wp-(content|admin|includes).*) $2 [L]
|
||||
RewriteRule ^([_0-9a-zA-Z-]+/)?(.*\.php)$ $2 [L]
|
||||
RewriteRule . index.php [L]
|
||||
</Directory>
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
#!/bin/bash
|
||||
set -eo pipefail
|
||||
|
||||
cd /app/public
|
||||
|
||||
|
||||
if [[ ! -f /app/public/wp-config.php ]]
|
||||
then
|
||||
wp config create \
|
||||
--allow-root \
|
||||
--dbhost="${WORDPRESS_DB_HOST}" \
|
||||
--dbname="${WORDPRESS_DB_NAME}" \
|
||||
--dbuser="${WORDPRESS_DB_USER}" \
|
||||
--dbpass="${WORDPRESS_DB_PASSWORD}" \
|
||||
--dbcharset="utf8mb4" \
|
||||
--locale="fr_FR"
|
||||
fi
|
||||
|
||||
|
||||
wp config set --allow-root DB_HOST ${WORDPRESS_DB_HOST}
|
||||
wp config set --allow-root DB_NAME ${WORDPRESS_DB_NAME}
|
||||
wp config set --allow-root DB_USER ${WORDPRESS_DB_USER}
|
||||
wp config set --allow-root DB_PASSWORD ${WORDPRESS_DB_PASSWORD}
|
||||
|
||||
wp config set --allow-root WP_HOME ${WORDPRESS_PROTOCOL}://${WORDPRESS_DOMAINE}${WORDPRESS_ALIAS}
|
||||
wp config set --allow-root WP_SITEURL ${WORDPRESS_PROTOCOL}://${WORDPRESS_DOMAINE}${WORDPRESS_ALIAS}
|
||||
|
||||
wp config set --allow-root WP_ALLOW_MULTISITE true
|
||||
wp config set --allow-root MULTISITE true
|
||||
wp config set --allow-root SUBDOMAIN_INSTALL false
|
||||
wp config set --allow-root DOMAIN_CURRENT_SITE ${WORDPRESS_DOMAINE}
|
||||
wp config set --allow-root PATH_CURRENT_SITE ${WORDPRESS_ALIAS}
|
||||
wp config set --allow-root FORCE_ADMIN_SSL false
|
||||
wp config set --allow-root SITE_ID_CURRENT_SITE 1
|
||||
wp config set --allow-root BLOG_ID_CURRENT_SITE 1
|
||||
|
||||
# On fait croire à WP qu'il est en https
|
||||
if grep -qF "_SERVER['HTTPS']='on'" "wp-config.php"; then
|
||||
if [[ "${WORDPRESS_PROTOCOL}" == "https" ]]
|
||||
then
|
||||
echo "FORCE HTTPS already set"
|
||||
fi
|
||||
else
|
||||
if [[ "${WORDPRESS_PROTOCOL}" == "https" ]]
|
||||
then
|
||||
echo "FORCE HTTPS set"
|
||||
head -n 1 "wp-config.php" > "wp-config.tmp"
|
||||
echo "\$_SERVER['HTTPS']='on';" >> "wp-config.tmp"
|
||||
tail -n +2 "wp-config.php" >> "wp-config.tmp"
|
||||
mv "wp-config.tmp" "wp-config.php"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Install multisite
|
||||
wp core multisite-install \
|
||||
--allow-root \
|
||||
--url="${WORDPRESS_PROTOCOL}://${WORDPRESS_DOMAINE}" \
|
||||
--title="${WORDPRESS_TITLE}" \
|
||||
--admin_user="${WORDPRESS_USER}" \
|
||||
--admin_password="${WORDPRESS_PASSWORD}" \
|
||||
--admin_email="${WORDPRESS_EMAIL}" \
|
||||
--skip-email
|
||||
|
||||
# Switch language
|
||||
echo "== Switch languange"
|
||||
wp language core install fr_FR
|
||||
wp site switch-language fr_FR
|
||||
|
||||
# Install plugin
|
||||
#if [[ "${MODE_AUTH}" == "CAS" && "${CAS_ACTIVATE}" == "1" ]]
|
||||
#then
|
||||
# wp plugin install wp-cassify
|
||||
# wp plugin activate wp-cassify --network
|
||||
#else
|
||||
# wp plugin delete wp-cassify
|
||||
#fi
|
||||
|
||||
# Mise à jour theme / plugin / network
|
||||
wp theme install twentytwentyfour --allow-root
|
||||
wp theme update --allow-root --all
|
||||
wp plugin update --allow-root --all
|
||||
wp language core update
|
||||
wp language theme update --all
|
||||
wp language plugin update --all
|
||||
|
||||
# Mise à jour du network
|
||||
wp core update-db --network
|
||||
|
||||
exec $@
|
||||
Binary file not shown.
|
|
@ -0,0 +1,52 @@
|
|||
version: '3'
|
||||
|
||||
services:
|
||||
mariadb:
|
||||
image: mariadb
|
||||
container_name: wordpress-mariadb
|
||||
restart: always
|
||||
ports:
|
||||
- "3306:3306"
|
||||
environment:
|
||||
MYSQL_ROOT_PASSWORD: changeme
|
||||
MYSQL_DATABASE: wordpress
|
||||
MYSQL_USER: user
|
||||
MYSQL_PASSWORD: changeme
|
||||
volumes:
|
||||
- mariadb-data:/var/lib/mysql
|
||||
|
||||
wordpress:
|
||||
build:
|
||||
context: ./containers/wordpress
|
||||
image: reg.cadoles.com/envole/wordpress
|
||||
container_name: wordpress-app
|
||||
restart: always
|
||||
depends_on:
|
||||
- mariadb
|
||||
ports:
|
||||
- "9003:80"
|
||||
environment:
|
||||
- WORDPRESS_DB_HOST=mariadb
|
||||
- WORDPRESS_DB_NAME=wordpress
|
||||
- WORDPRESS_DB_USER=user
|
||||
- WORDPRESS_DB_PASSWORD=changeme
|
||||
- WORDPRESS_TITLE=wordpress
|
||||
- WORDPRESS_USER=admin
|
||||
- WORDPRESS_PASSWORD=changeme
|
||||
- WORDPRESS_EMAIL=admin@noreply.fr
|
||||
- WORDPRESS_PROTOCOL=https
|
||||
- WORDPRESS_DOMAINE=eolebase.ac-test.fr
|
||||
- WORDPRESS_ALIAS=/wordpress/
|
||||
|
||||
#volumes:
|
||||
# - ./containers/data:/app/public/wp-content/plugins/wp-cas
|
||||
|
||||
adminer:
|
||||
image: docker.io/library/adminer
|
||||
container_name: wordpress-adminer
|
||||
restart: always
|
||||
ports:
|
||||
- 9100:8080
|
||||
|
||||
volumes:
|
||||
mariadb-data:
|
||||
|
|
@ -0,0 +1,186 @@
|
|||
#!/bin/bash
|
||||
|
||||
TPUT=/usr/bin/tput
|
||||
#test si TPUT est utilisable
|
||||
if [ ! "$TERM" = "" ] && $TPUT hpa 60 >/dev/null 2>&1 && $TPUT setaf 1 >/dev/null 2>&1; then
|
||||
FANCYTTY=1
|
||||
else
|
||||
FANCYTTY=0
|
||||
fi
|
||||
|
||||
Pause() {
|
||||
if [ "$ModeTxt" == "yes" ];then
|
||||
echo
|
||||
elif [ "$ModeEad" == "yes" ];then
|
||||
echo "<br>"
|
||||
else
|
||||
[ $FANCYTTY = 1 ] && $TPUT setaf 6
|
||||
echo " Appuyez sur Entrée pour continuer ..."
|
||||
[ $FANCYTTY = 1 ] && $TPUT sgr0
|
||||
read BiDon
|
||||
fi
|
||||
}
|
||||
|
||||
Echo() {
|
||||
if [ "$ModeEad" != "yes" ];
|
||||
then
|
||||
echo "$1"
|
||||
else
|
||||
echo "$1<br>"
|
||||
fi
|
||||
}
|
||||
|
||||
EchoColor() {
|
||||
if [ "$ModeTxt" = "yes" ];then
|
||||
echo "$1"
|
||||
elif [ "$ModeEad" = "yes" ];then
|
||||
echo "<FONT color=\"$3\"> $1 </FONT><br>"
|
||||
else
|
||||
[ "$FANCYTTY" = 1 ] && $TPUT setaf $2
|
||||
echo "$1"
|
||||
[ "$FANCYTTY" = 1 ] && $TPUT sgr0
|
||||
fi
|
||||
}
|
||||
|
||||
EchoRouge() {
|
||||
EchoColor "$1" "1" "red"
|
||||
}
|
||||
|
||||
EchoVert() {
|
||||
EchoColor "$1" "2" "green"
|
||||
}
|
||||
|
||||
EchoOrange() {
|
||||
EchoColor "$1" "3" "orange"
|
||||
}
|
||||
|
||||
EchoBleu() {
|
||||
EchoColor "$1" "4" "blue"
|
||||
}
|
||||
|
||||
EchoMagenta() {
|
||||
EchoColor "$1" "5" "magenta"
|
||||
}
|
||||
|
||||
EchoCyan() {
|
||||
EchoColor "$1" "6" "cyan"
|
||||
}
|
||||
|
||||
EchoBlanc() {
|
||||
EchoColor "$1" "7" "white"
|
||||
}
|
||||
|
||||
EchoGras() {
|
||||
if [ "$ModeTxt" == "yes" ];then
|
||||
echo "$1"
|
||||
elif [ "$ModeEad" == "yes" ];then
|
||||
echo "<b> $1 </b><br>"
|
||||
else
|
||||
[ $FANCYTTY = 1 ] && $TPUT bold
|
||||
echo "$1"
|
||||
[ $FANCYTTY = 1 ] && $TPUT sgr0
|
||||
fi
|
||||
}
|
||||
|
||||
Clear() {
|
||||
if [ "$ModeEad" != "yes" -a "$ModeTxt" != "yes" ];then
|
||||
clear
|
||||
fi
|
||||
}
|
||||
|
||||
Question_ouinon() {
|
||||
#attention, il faut synchroniser les modifications avec /usr/share/pyshared/pyeole/ihm.py
|
||||
question=$1
|
||||
[ "$2" = "" ] && interactive='True' || interactive=$2
|
||||
[ "$3" = "" ] && default="non" || default=$3
|
||||
[ "$4" = "" ] && level="info" || level=$4
|
||||
[ "$5" = "" ] && default_uninteractive=$default || default_uninteractive=$5
|
||||
[ ! "$interactive" = "True" ] && [ ! "$interactive" = "False" ] && echo "Question_ouinon : interactive doit être True ou False" && exit 1
|
||||
[ ! "$default" = "oui" ] && [ ! "$default" = "non" ] && echo "Question_ouinon : default doit etre oui ou non" && exit 1
|
||||
[ ! "$default_uninteractive" = "oui" ] && [ ! "$default_uninteractive" = "non" ] && echo "Question_ouinon : default_uninteractive doit etre oui ou non" && exit 1
|
||||
[ ! "$level" = "info" ] && [ ! "$level" = "warn" ] && [ ! "$level" = "err" ] && echo "Question_ouinon : level doit etre info, warn ou err" && exit 1
|
||||
#non interactive
|
||||
if [ "$interactive" = "False" ]; then
|
||||
Rep=default_uninteractive
|
||||
else
|
||||
question="$question [oui/non]"
|
||||
if [ $level = "info" ]; then
|
||||
echo "$question"
|
||||
elif [ $level = "warn" ]; then
|
||||
EchoOrange "$question"
|
||||
else
|
||||
EchoRouge "$question"
|
||||
fi
|
||||
echo -n "[$default] : "
|
||||
read Rep
|
||||
#passe en minuscule
|
||||
Rep=`echo $Rep | tr A-Z a-z`
|
||||
fi
|
||||
if [ "$default" = "non" ]; then
|
||||
if [ "$Rep" = "oui" -o "$Rep" = "o" -o "$Rep" = "yes" -o "$Rep" = "y" ];then
|
||||
return 0
|
||||
else
|
||||
return 1
|
||||
fi
|
||||
else
|
||||
if [ "$Rep" = "non" -o "$Rep" = "n" -o "$Rep" = "no" ];then
|
||||
return 1
|
||||
else
|
||||
return 0
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
EchoStart() {
|
||||
for i in $(eval echo "{1..30}")
|
||||
do
|
||||
ligne+="="
|
||||
done
|
||||
clear
|
||||
}
|
||||
|
||||
BigTitle(){
|
||||
size=`tput cols`
|
||||
nb=${#1}
|
||||
nbchar=$(($size - $nb - 4))
|
||||
|
||||
ligne=""
|
||||
for i in $(eval echo "{1..$size}")
|
||||
do
|
||||
ligne+="="
|
||||
done
|
||||
|
||||
finligne=""
|
||||
for i in $(eval echo "{1..$nbchar}")
|
||||
do
|
||||
finligne+="="
|
||||
done
|
||||
|
||||
echo
|
||||
EchoVert $ligne
|
||||
EchoVert "== $1 $finligne"
|
||||
EchoVert $ligne
|
||||
echo
|
||||
}
|
||||
|
||||
Title(){
|
||||
size=`tput cols`
|
||||
nb=${#1}
|
||||
nbchar=$(($size - $nb - 4))
|
||||
|
||||
ligne=""
|
||||
for i in $(eval echo "{1..$size}")
|
||||
do
|
||||
ligne+="="
|
||||
done
|
||||
|
||||
finligne=""
|
||||
for i in $(eval echo "{1..$nbchar}")
|
||||
do
|
||||
finligne+="="
|
||||
done
|
||||
|
||||
echo
|
||||
EchoCyan "== $1 $finligne"
|
||||
echo
|
||||
}
|
||||
|
|
@ -0,0 +1,563 @@
|
|||
#!/bin/bash
|
||||
|
||||
#1 : action = default up
|
||||
#2 : service = optionnel
|
||||
|
||||
# Fusionner l'ensemble des fichier .env en un seul
|
||||
rm -f ./.env.local
|
||||
cat ./env/.env* >> ./.env.local
|
||||
. ./misc/e-ihm.sh
|
||||
. .env
|
||||
. ./env/.env
|
||||
. ./env/.env.local
|
||||
|
||||
# Start script
|
||||
BigTitle "NINE"
|
||||
|
||||
# on remplace les valeur reprise dans les autres .env car podman interprète mal
|
||||
if [[ "$PODCOMPOSEBIN" == "podman-compose" ]]
|
||||
then
|
||||
sed -i 's#${WEB_URL}#'${WEB_URL}'#g' ./.env.local
|
||||
sed -i 's#${WEB_PROTOCOL}#'${WEB_PROTOCOL}'#g' ./.env.local
|
||||
. ./.env.local
|
||||
|
||||
sed -i 's#${ADMIN_PASSWORD}#'${ADMIN_PASSWORD}'#g' ./.env.local
|
||||
sed -i 's#${ADMIN_USER}#'${ADMIN_USER}'#g' ./.env.local
|
||||
|
||||
sed -i 's#${CAS_HOST}#'${CAS_HOST}'#g' ./.env.local
|
||||
sed -i 's#${CAS_PORT}#'${CAS_PORT}'#g' ./.env.local
|
||||
sed -i 's#${CAS_USER}#'${CAS_USER}'#g' ./.env.local
|
||||
sed -i 's#${CAS_PASSWORD}#'${CAS_PASSWORD}'#g' ./.env.local
|
||||
|
||||
sed -i 's#${OPENLDAP_SERVICE_NAME}#'${OPENLDAP_SERVICE_NAME}'#g' ./.env.local
|
||||
sed -i 's#${LDAP_ADMIN_USERNAME}#'${LDAP_ADMIN_USERNAME}'#g' ./.env.local
|
||||
sed -i 's#${LDAP_BASEDN}#'${LDAP_BASEDN}'#g' ./.env.local
|
||||
sed -i 's#${LDAP_PASSWORD}#'${LDAP_PASSWORD}'#g' ./.env.local
|
||||
sed -i 's#${LDAP_USER}#'${LDAP_USER}'#g' ./.env.local
|
||||
sed -i 's#${LDAP_PORT}#'${LDAP_PORT}'#g' ./.env.local
|
||||
|
||||
sed -i 's#${MARIADB_SERVICE_NAME}#'${MARIADB_SERVICE_NAME}'#g' ./.env.local
|
||||
sed -i 's#${MARIADB_USER}#'${MARIADB_USER}'#g' ./.env.local
|
||||
sed -i 's#${MARIADB_PASSWORD}#'${MARIADB_PASSWORD}'#g' ./.env.local
|
||||
|
||||
sed -i 's#${ADMINER_ACTIVATE}#'${ADMINER_ACTIVATE}'#g' ./.env.local
|
||||
sed -i 's#${ADMINER_URL}#'${ADMINER_URL}'#g' ./.env.local
|
||||
|
||||
sed -i 's#${PHPLDAPADMIN_ACTIVATE}#'${PHPLDAPADMIN_ACTIVATE}'#g' ./.env.local
|
||||
sed -i 's#${PHPLDAPADMIN_URL}#'${PHPLDAPADMIN_URL}'#g' ./.env.local
|
||||
|
||||
sed -i 's#${NEXTCLOUD_ACTIVATE}#'${NEXTCLOUD_ACTIVATE}'#g' ./.env.local
|
||||
sed -i 's#${NEXTCLOUD_URL}#'${NEXTCLOUD_URL}'#g' ./.env.local
|
||||
fi
|
||||
|
||||
# Include
|
||||
. ./.env.local
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== ENV ====================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
#1 = service to stop if null all service
|
||||
|
||||
destroyall(){
|
||||
Question_ouinon "Souhaitez-vous supprimer l'ensemble des containers : Attention cela supprimera vraiment tout ?"
|
||||
if [[ "$?" = 0 ]]
|
||||
then
|
||||
destroy $MARIADB_SERVICE_NAME 1
|
||||
destroy $OPENLDAP_SERVICE_NAME 1
|
||||
destroy $KEYCLOAK_SERVICE_NAME 1
|
||||
destroy $NINEGATE_SERVICE_NAME 1
|
||||
destroy $NINEBOARD_SERVICE_NAME 1
|
||||
destroy $NEXTCLOUD_SERVICE_NAME 1
|
||||
destroy $WORDPRESS_SERVICE_NAME 1
|
||||
destroy $ADMINER_SERVICE_NAME 1
|
||||
destroy $PHPLDAPADMIN_SERVICE_NAME 1
|
||||
destroy $NINEAPACHE_SERVICE_NAME 1
|
||||
fi
|
||||
}
|
||||
|
||||
env() {
|
||||
rm -rf ./tmp/.env.$1
|
||||
mkdir -p ./tmp
|
||||
|
||||
cat ./env/.env >> ./tmp/.env.$1
|
||||
if [[ -f ./env/.env.local ]]; then cat ./env/.env.local >> ./tmp/.env.$1; fi
|
||||
if [[ -f ./env/.env.zapp.$1 ]]; then cat ./env/.env.zapp.$1 >> ./tmp/.env.$1; fi
|
||||
if [[ -f ./env/.env.zapp.$1.local ]]; then cat ./env/.env.zapp.$1.local >> ./tmp/.env.$1; fi
|
||||
};
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== ENVALL =================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
|
||||
envall(){
|
||||
env $MARIADB_SERVICE_NAME
|
||||
env $OPENLDAP_SERVICE_NAME
|
||||
env $KEYCLOAK_SERVICE_NAME
|
||||
env $NINEGATE_SERVICE_NAME
|
||||
env $NINEBOARD_SERVICE_NAME
|
||||
env $NEXTCLOUD_SERVICE_NAME
|
||||
env $WORDPRESS_SERVICE_NAME
|
||||
env $ADMINER_SERVICE_NAME
|
||||
env $PHPLDAPADMIN_SERVICE_NAME
|
||||
env $NINEAPACHE_SERVICE_NAME
|
||||
}
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== STOP ===================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
#1 = service to stop if null all service
|
||||
#2 = stopper par destroyall
|
||||
|
||||
stop() {
|
||||
if [[ "$2" != 1 ]]; then Title "STOP"; fi
|
||||
|
||||
$PODCOMPOSEBIN stop $1
|
||||
if [[ "$PODCOMPOSEBIN" == "podman-compose" ]]
|
||||
then
|
||||
if [[ "$1" == "" ]]
|
||||
then
|
||||
CONTAINER_NAMES=$($PODCOMPOSEBIN -f docker-compose.yml ps | awk 'NR > 1 {print $1}')
|
||||
for CONTAINER_NAME in $CONTAINER_NAMES; do
|
||||
$PODBIN rm -f $CONTAINER_NAME
|
||||
done
|
||||
else
|
||||
$PODBIN rm "nine-"$1
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== UPSERVICE ==============================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
#1 = service to up
|
||||
|
||||
wait_for_container() {
|
||||
container_id="nine-$1"
|
||||
container_name="$($PODBIN inspect "${container_id}" --format '{{ .Name }}')"
|
||||
waiting_done="false"
|
||||
|
||||
while [[ "${waiting_done}" != "true" ]]; do
|
||||
container_state="$($PODBIN inspect "${container_id}" --format '{{ .State.Status }}')"
|
||||
if [[ "${container_state}" == "running" ]]; then
|
||||
health_status="$($PODBIN inspect "${container_id}" --format '{{ .State.Health.Status }}')"
|
||||
if [[ ${health_status} == "healthy" ]]; then
|
||||
waiting_done="true"
|
||||
fi
|
||||
else
|
||||
waiting_done="true"
|
||||
fi
|
||||
sleep 1;
|
||||
done;
|
||||
}
|
||||
|
||||
upservice(){
|
||||
$PODCOMPOSEBIN up -d $1
|
||||
if [[ $2 == "wait" ]]
|
||||
then
|
||||
wait_for_container $1
|
||||
fi
|
||||
}
|
||||
|
||||
function upmariadb {
|
||||
if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
Title "MARIADB"
|
||||
EchoVert "CONTAINER"
|
||||
upservice $MARIADB_SERVICE_NAME wait
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upopenldap {
|
||||
if [[ $LDAP_ACTIVATE == 1 && $LDAP_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${OPENLDAP_SERVICE_NAME^^}
|
||||
EchoVert "CONTAINER"
|
||||
|
||||
mkdir -p ./volume/openldap/data
|
||||
chmod a+wr ./volume/openldap/data
|
||||
|
||||
upservice $OPENLDAP_SERVICE_NAME wait
|
||||
$PODCOMPOSEBIN exec $OPENLDAP_SERVICE_NAME /nine/init.sh
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upkeycloak {
|
||||
if [[ $CAS_ACTIVATE == 1 && $CAS_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${KEYCLOAK_SERVICE_NAME^^}
|
||||
|
||||
# CREATE BDD
|
||||
if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
EchoVert "DATABASE"
|
||||
Echo ${KEYCLOAK_SERVICE_NAME^^}
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/init.sh $KEYCLOAK_SERVICE_NAME
|
||||
Echo
|
||||
fi
|
||||
|
||||
EchoVert "CONTAINER"
|
||||
upservice $KEYCLOAK_SERVICE_NAME
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upninegate {
|
||||
if [[ $NINEGATE_ACTIVATE == 1 && $NINEGATE_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${NINEGATE_SERVICE_NAME^^}
|
||||
|
||||
if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
EchoVert "DATABASE"
|
||||
Echo ${NINEGATE_SERVICE_NAME^^}
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/init.sh $NINEGATE_SERVICE_NAME
|
||||
Echo
|
||||
fi
|
||||
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${NINEGATE_SERVICE_NAME}
|
||||
chmod -R a+wr ./volume/ninegate/data
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upnineboard {
|
||||
if [[ $NINEBOARD_ACTIVATE == 1 && $NINEBOARD_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${NINEBOARD_SERVICE_NAME^^}
|
||||
|
||||
if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
EchoVert "DATABASE"
|
||||
Echo ${NINEBOARD_SERVICE_NAME^^}
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/init.sh $NINEBOARD_SERVICE_NAME
|
||||
Echo
|
||||
fi
|
||||
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${NINEBOARD_SERVICE_NAME}
|
||||
chmod -R a+wr ./volume/nineboard/data
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upnextcloud {
|
||||
if [[ $NEXTCLOUD_ACTIVATE == 1 && $NEXTCLOUD_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${NEXTCLOUD_SERVICE_NAME^^}
|
||||
|
||||
if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
EchoVert "DATABASE"
|
||||
Echo ${NEXTCLOUD_SERVICE_NAME^^}
|
||||
Echo
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/init.sh $NEXTCLOUD_SERVICE_NAME
|
||||
fi
|
||||
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${NEXTCLOUD_SERVICE_NAME}
|
||||
Echo
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
function upwordpress {
|
||||
if [[ $WORDPRESS_ACTIVATE == 1 && $WORDPRESS_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${WORDPRESS_SERVICE_NAME^^}
|
||||
|
||||
if [[ $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
EchoVert "DATABASE"
|
||||
Echo ${WORDPRESS_SERVICE_NAME^^}
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/init.sh $WORDPRESS_SERVICE_NAME
|
||||
Echo
|
||||
fi
|
||||
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${WORDPRESS_SERVICE_NAME}
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upadminer {
|
||||
if [[ $ADMINER_ACTIVATE == 1 && $ADMINER_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${ADMINER_SERVICE_NAME^^}
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${ADMINER_SERVICE_NAME}
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upphpldapadmin {
|
||||
if [[ $PHPLDAPADMIN_ACTIVATE == 1 && $PHPLDAPADMIN_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${PHPLDAPADMIN_SERVICE_NAME^^}
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${PHPLDAPADMIN_SERVICE_NAME}
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
function upnineapache {
|
||||
if [[ $NINEAPACHE_ACTIVATE == 1 && $NINEAPACHE_LOCAL == 1 ]]
|
||||
then
|
||||
Title ${NINEAPACHE_SERVICE_NAME^^}
|
||||
EchoVert "CONTAINER"
|
||||
upservice ${WORDPRESS_SERVICE_NAME}
|
||||
Echo
|
||||
fi
|
||||
}
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== UP =====================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
#1 = service to up if null all service
|
||||
|
||||
up(){
|
||||
# Stop du ou des services
|
||||
stop $1
|
||||
|
||||
# SERVICES
|
||||
if [[ -z "$1" ]]
|
||||
then
|
||||
# NETWORK
|
||||
if [[ "$RELEASE_SYSTEM" == "eole" ]]
|
||||
then
|
||||
Title "NETWORK"
|
||||
EchoRouge "ATTENTION SOLUTION DE CONTOURNEMENT POUR LE POC"
|
||||
EchoRouge "A résoudre si l'on souhaite mettre en production"
|
||||
|
||||
# On réinstall docker-ce car le reconf détruit le reseau docker, la reinstall de docker-ce rétablit le reseau
|
||||
apt-get install docker-ce --reinstall
|
||||
|
||||
# ATTENTION A REVOIR car ouvre complétement le firewall
|
||||
iptables -P INPUT ACCEPT
|
||||
fi
|
||||
|
||||
# MARIADB
|
||||
upmariadb
|
||||
|
||||
# OPENLDAP
|
||||
upopenldap
|
||||
|
||||
# KEYCLOAK
|
||||
upkeycloak
|
||||
|
||||
# NINEGATE
|
||||
upninegate
|
||||
|
||||
# NINEBOARD
|
||||
upnineboard
|
||||
|
||||
# NEXTCLOUD
|
||||
upnextcloud
|
||||
|
||||
# WORDPRESS
|
||||
upwordpress
|
||||
|
||||
# ADMINER
|
||||
upadminer
|
||||
|
||||
# PHPLDAPADMIN
|
||||
upphpldapadmin
|
||||
|
||||
# NINEAPACHE
|
||||
upnineapache
|
||||
else
|
||||
env ${1}
|
||||
up${1}
|
||||
fi
|
||||
}
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== DESTROY ================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
|
||||
destroyall(){
|
||||
Question_ouinon "Souhaitez-vous supprimer l'ensemble des containers : Attention cela supprimera vraiment tout ?"
|
||||
if [[ "$?" = 0 ]]
|
||||
then
|
||||
destroy $MARIADB_SERVICE_NAME 1
|
||||
destroy $OPENLDAP_SERVICE_NAME 1
|
||||
destroy $KEYCLOAK_SERVICE_NAME 1
|
||||
destroy $NINEGATE_SERVICE_NAME 1
|
||||
destroy $NINEBOARD_SERVICE_NAME 1
|
||||
destroy $NEXTCLOUD_SERVICE_NAME 1
|
||||
destroy $WORDPRESS_SERVICE_NAME 1
|
||||
destroy $ADMINER_SERVICE_NAME 1
|
||||
destroy $PHPLDAPADMIN_SERVICE_NAME 1
|
||||
destroy $NINEAPACHE_SERVICE_NAME 1
|
||||
fi
|
||||
}
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== DESTROY ================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
#1 = service to destroy
|
||||
#2 = ne pas poser de questions
|
||||
|
||||
destroy(){
|
||||
Title "DESTROY "${1^^}
|
||||
|
||||
stop $1 1
|
||||
|
||||
if [[ "$PODCOMPOSEBIN" == "docker-compose" ]]
|
||||
then
|
||||
$PODCOMPOSEBIN rm -s -v -f "$1"
|
||||
fi
|
||||
|
||||
|
||||
if [[ "$1" == "$MARIADB_SERVICE_NAME" && $MARIADB_ACTIVATE == 1 && $MARIADB_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer l'ensemble des bases ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
sudo rm -rf volume/mariadb/mysql
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$1" == "$OPENLDAP_SERVICE_NAME" && $LDAP_ACTIVATE == 1 && $LDAP_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer l'annuaire associé à $1 ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
sudo rm -rf volume/openldap/data
|
||||
mkdir volume/openldap/data
|
||||
chmod a+w volume/openldap/data -R
|
||||
chmod a+r volume/openldap/data -R
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$1" == "$KEYCLOAK_SERVICE_NAME" && $CAS_ACTIVATE == 1 && $CAS_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer la BDD associé à $1 ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/delete.sh $KEYCLOAK_SERVICE_NAME
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$1" == "$NINEGATE_SERVICE_NAME" && $NINEGATE_ACTIVATE == 1 && $NINEGATE_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer la BDD associé à $1 ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/delete.sh $NINEGATE_SERVICE_NAME
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$1" == "$NINEBOARD_SERVICE_NAME" && $NINEBOARD_ACTIVATE == 1 && $NINEBOARD_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer la BDD associé à $1 ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/delete.sh $NINEBOARD_SERVICE_NAME
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$1" == "$NEXTCLOUD_SERVICE_NAME" && $NEXTCLOUD_ACTIVATE == 1 && $NEXTCLOUD_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer la BDD associé à $1 ainsi que les fichiers utilisateurs ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/delete.sh $NEXTCLOUD_SERVICE_NAME
|
||||
sudo rm -rf volume/nextcloud/data
|
||||
sudo rm -rf volume/nextcloud/html
|
||||
sudo rm -rf volume/nextcloud/app
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ "$1" == "$WORDPRESS_SERVICE_NAME" && $WORDPRESS_ACTIVATE == 1 && $WORDPRESS_LOCAL == 1 ]]
|
||||
then
|
||||
if [[ -z $2 ]]; then Question_ouinon "Souhaitez-vous supprimer la BDD associé à $1 ?";fi
|
||||
if [[ "$?" = 0 || -z $2 ]]
|
||||
then
|
||||
$PODCOMPOSEBIN exec $MARIADB_SERVICE_NAME /nine/delete.sh $WORDPRESS_SERVICE_NAME
|
||||
sudo rm -rf volume/wordpress/data
|
||||
fi
|
||||
fi
|
||||
}
|
||||
|
||||
#===========================================================================================================================================
|
||||
#== MAIN ===================================================================================================================================
|
||||
#===========================================================================================================================================
|
||||
|
||||
envall
|
||||
|
||||
if [[ $1 == "up" || $1 == "" ]]
|
||||
then
|
||||
up $2
|
||||
elif [[ $1 == "stop" ]]
|
||||
then
|
||||
stop $2
|
||||
elif [[ $1 == "bash" ]]
|
||||
then
|
||||
if [[ -z $2 ]]
|
||||
then
|
||||
EchoRouge "Vous devez precisez un service"
|
||||
EchoRouge "nine.sh bash monservice"
|
||||
else
|
||||
$PODCOMPOSEBIN exec $2 "/bin/bash"
|
||||
fi
|
||||
elif [[ $1 == "destroyall" ]]
|
||||
then
|
||||
destroyall
|
||||
elif [[ $1 == "destroy" ]]
|
||||
then
|
||||
if [[ -z $2 ]]
|
||||
then
|
||||
EchoRouge "Vous devez precisez un service"
|
||||
EchoRouge "nine.sh destroy monservice"
|
||||
else
|
||||
destroy $2
|
||||
fi
|
||||
elif [[ $1 == "logs" ]]
|
||||
then
|
||||
$PODCOMPOSEBIN logs -f $2
|
||||
elif [[ $1 == "iswait" ]]
|
||||
then
|
||||
wait_for_container $2
|
||||
elif [[ $1 == "env" ]]
|
||||
then
|
||||
if [[ -z $2 ]]
|
||||
then
|
||||
EchoRouge "Vous devez precisez un service"
|
||||
EchoRouge "nine.sh env monservice"
|
||||
else
|
||||
env $2
|
||||
EchoVert "Fichier tmp/.env.$1 regénéré"
|
||||
fi
|
||||
elif [[ $1 == "regen" ]]
|
||||
then
|
||||
if [[ -z $2 ]]
|
||||
then
|
||||
destroyall
|
||||
up
|
||||
else
|
||||
destroy $2
|
||||
up $2
|
||||
fi
|
||||
else
|
||||
EchoRouge "Action possible ="
|
||||
EchoRouge "nine.sh > UP de l'ensemble des services actifs"
|
||||
EchoRouge "nine.sh up > UP de l'ensemble des services actifs"
|
||||
EchoRouge "nine.sh up monservice> UP de monservice"
|
||||
EchoRouge "nine.sh stop > STOP de l'ensemble des services"
|
||||
EchoRouge "nine.sh stop monservice> STOP de monservice"
|
||||
EchoRouge "nine.sh bash monservice> lance un terminel dans le conteneur de monservice"
|
||||
EchoRouge "nine.sh destroyall> détruit l'ensemble des services avec l'ensemble des BDD et des volumes persistant"
|
||||
EchoRouge "nine.sh destroy monservice> détruit monservices et si souhaitez sa BDD et ses volumes persistant"
|
||||
EchoRouge "nine.sh logs > LOGS de l'ensemble des services"
|
||||
EchoRouge "nine.sh logs monservice > LOGS de monservice"
|
||||
EchoRouge "nine.sh iswait monservice > monservice est-il en cours de construction"
|
||||
EchoRouge "nine.sh env monservice > regeneration du fichier d'environnement de monservice"
|
||||
EchoRouge "nine.sh regen > lance destroyall puis up sur l'ensemble des service"
|
||||
EchoRouge "nine.sh regen monservice > lance destroy monservice puis up monservice"
|
||||
|
||||
fi
|
||||
echo
|
||||
echo
|
||||
|
|
@ -0,0 +1,206 @@
|
|||
# Installation de nine
|
||||
|
||||
## Cloner le dépot
|
||||
|
||||
git clone
|
||||
|
||||
## Comment personnaliser
|
||||
|
||||
Pour personnaliser la configuration de base
|
||||
|
||||
- créer un fichier /env/.env.local
|
||||
- et faite varier les variables d'environnement WEB_URL et PROTOCOLE
|
||||
|
||||
### Host
|
||||
|
||||
De base ninedocker est configuré pour fonctionner sur nine.local en https
|
||||
|
||||
Exemple de faire fonctionner le docker en local et en http
|
||||
|
||||
```
|
||||
WEB_URL=localhost
|
||||
PROTOCOLE=http
|
||||
```
|
||||
|
||||
### Ports & Services associés
|
||||
|
||||
Les services suivants sont à l'écoute des ports
|
||||
|
||||
- 3306 = mariadb
|
||||
- 9000 = ninegate
|
||||
- 1389/1636 = openldap
|
||||
- 8999/8443 = keycloak
|
||||
- 9001 = nextcloud
|
||||
- 9002 = nineboard
|
||||
- 9003 = wordpress
|
||||
- 9100 = adminer
|
||||
- 9101 = phpldapadmin
|
||||
- 9102 = nineapache
|
||||
|
||||
Si vous souhaitez ne pas attaquer vos services via leurs ports, vous devrez mettre en place un reverse proxy apache ou ngnix
|
||||
|
||||
exemple apache
|
||||
|
||||
```
|
||||
ProxyPass /auth http://0.0.0.0:8080/auth retry=0 keepalive=On
|
||||
ProxyPassReverse /auth http://0.0.0.0:8080/auth retry=0
|
||||
|
||||
ProxyPass /ninegate http://0.0.0.0:9000/ninegate retry=0 keepalive=On
|
||||
ProxyPassReverse /ninegate http://0.0.0.0:9000/ninegate retry=0
|
||||
ProxyPass /wssninegate ws://0.0.0.0:9000/wssninegate retry=0 keepalive=On
|
||||
ProxyPassReverse /wssninegate ws://0.0.0.0:9000/wssninegate retry=0
|
||||
|
||||
ProxyPass /nextcloud http://0.0.0.0:9001 retry=0 keepalive=On
|
||||
ProxyPassReverse /nextcloud http://0.0.0.0:9001 retry=0
|
||||
|
||||
ProxyPass /nineboard http://0.0.0.0:9002/nineboard retry=0 keepalive=On
|
||||
ProxyPassReverse /nineboard http://0.0.0.0:9002/nineboard retry=0
|
||||
ProxyPass /wssnineboard ws://0.0.0.0:9002/wssnineboard retry=0 keepalive=On
|
||||
ProxyPassReverse /wssnineboard ws://0.0.0.0:9002/wssnineboard retry=0
|
||||
|
||||
ProxyPass /wordpress http://0.0.0.0:9003/wordpress retry=0 keepalive=On
|
||||
ProxyPassReverse /wordpress http://0.0.0.0:9003/wordpress retry=0
|
||||
|
||||
ProxyPass /adminer http://0.0.0.0:9100 retry=0 keepalive=On
|
||||
ProxyPassReverse /adminer http://0.0.0.0:9100 retry=0
|
||||
|
||||
ProxyPass /phpldapadmin http://0.0.0.0:9101/phpldapadmin retry=0 keepalive=On
|
||||
ProxyPassReverse /phpldapadmin http://0.0.0.0:9101/phpldapadmin retry=0
|
||||
|
||||
ProxyPass /nineapache http://0.0.0.0:9102 retry=0 keepalive=On
|
||||
ProxyPassReverse /nineapache http://0.0.0.0:9102 retry=0
|
||||
```
|
||||
|
||||
### Activer / Désactiver les services
|
||||
|
||||
Dans votre ./env/.env.local vous pouvez activer / désactiver des services via les variables suivante
|
||||
|
||||
```
|
||||
MARIADB_ACTIVATE=
|
||||
LDAP_ACTIVATE=
|
||||
CAS_ACTIVATE=
|
||||
NINEGATE_ACTIVATE=
|
||||
NEXTCLOUD_ACTIVATE=
|
||||
NINEBOARD_ACTIVATE=
|
||||
WORDPRESS_ACTIVATE=
|
||||
ADMINER_ACTIVATE=
|
||||
PHPLDAPADMIN_ACTIVATE=
|
||||
NINEAPACHE_ACTIVATE=
|
||||
```
|
||||
|
||||
### Déporter des services
|
||||
|
||||
Certains services peuvent t'être distant et non géré par le docker nine. Pour cela garder le service actif mais indiquer lui qu'il n'est pas local via les variables suivantes
|
||||
|
||||
```
|
||||
LDAP_LOCAL
|
||||
CAS_LOCAL
|
||||
NINEGATE_LOCAL
|
||||
NEXTCLOUD_LOCAL
|
||||
NINEBOARD_LOCAL
|
||||
WORDPRESS_LOCAL
|
||||
ADMINER_LOCAL
|
||||
PHPLDAPADMIN_LOCAL
|
||||
NINEAPACHE_LOCAL
|
||||
```
|
||||
|
||||
S'il ne sont pas local en fonction du service vous devrez ajouter les variables nécessaire dans votre .env.local pour indiquer où se situe le service.
|
||||
|
||||
**LDAP**
|
||||
|
||||
```
|
||||
LDAP_HOST # Host de votre annuaire
|
||||
LDAP_PORT # Port de votre annuaire
|
||||
LDAP_TLS # Use TLS 1/0
|
||||
LDAP_BASEDN # Basedn de votre annuaire
|
||||
LDAP_ADMIN_USERNAME # UID du compte writer ou reader de votre annuaire. Writer obligatoire si vous synchroniser ninegate dans votre openldap
|
||||
LDAP_USER # DN du compte writer ou reader de votre annuaire. Writer obligatoire si vous synchroniser ninegate dans votre openldap
|
||||
LDAP_PASSWORD # Password du compte writer ou reader de votre annuaire. Writer obligatoire si vous synchroniser ninegate dans votre openldap
|
||||
LDAP_USERNAME=uid # Attribut de l'uid d'un utilisateur
|
||||
LDAP_FIRSTNAME=givenname # Attribut prénom d'un utilisateur
|
||||
LDAP_LASTNAME=sn # Attribut nom d'un utilisateur
|
||||
LDAP_DISPLAYNAME=displayName # Attribut displayname d'un utilisateur
|
||||
LDAP_EMAIL=mail # Attribut mail d'un utilisateur
|
||||
LDAP_MEMBER=memberUid # Liste des uid utilisateur dans un groupe
|
||||
```
|
||||
|
||||
### Personnaliser Ninegate
|
||||
|
||||
#### MASTERIDENTITY
|
||||
|
||||
Ce variable va vous permettre de déterminer qui est le maître de l'identité
|
||||
|
||||
**SQL**
|
||||
|
||||
- C'est ninegate le maître vous pouvez via l'interface de gestion de ninagate créer/modifier/supprimer des niveaux/groups/utilisateurs
|
||||
- Vous pourrez activer l'auto inscription des utilisateurs
|
||||
- Les utilisateurs pourront bénéficier d'un "Mot de passe oublié"
|
||||
- Si vous avez activer le service LDAP, les utilisateurs pourront alors être synchroniser
|
||||
|
||||
**LDAP**
|
||||
|
||||
- C'est l'annuaire le maître vous ne plus créer/modifier/supprimer des utilisateurs dans l'interface de ninegate, ni bénéficier de l'auto inscription des utilisateurs ni de la fonctionnalité "Mot de passe oublié"
|
||||
- Cela sera à vous de créer directement dans l'annuaire vos utilisateurs
|
||||
- Vous pourrez créer des niveaux et des groupes
|
||||
- Les niveau01s et les groupes pourront etre associé à une requete LDAP indiquant à Ninegate comment les récupérer et les synchroniser dans sa base
|
||||
|
||||
### MODE_AUTH
|
||||
|
||||
Quel protocole d'authentification sera utilisé par les différents service
|
||||
|
||||
- SQL = sa propre mire d'authentification
|
||||
- CAS = CAS le serveur CAS local ou externe
|
||||
- LDAP = l'annuaire local ou externe dans ce cas la variable LDAP_LOGIN_FILTER est nécessaire
|
||||
|
||||
#### Synchronisation
|
||||
|
||||
Pour activer la synchronisation des comptes il est nessaire d'activer cette variable
|
||||
|
||||
```
|
||||
LDAP_SYNC
|
||||
```
|
||||
|
||||
En fonction de votre MASTERIDENTITY vous pouvez synchroniser les utilisateurs
|
||||
|
||||
**Si masteridentity est à SQL = où sont synchronisées les datas dans l'annuaire**
|
||||
|
||||
Attention dans ce cas ninegate attend une structure d'annuaire bien précise. Vous pouvez retrouver cette structure si vous souhaitez déporter votre annuaire à ces emplacements :
|
||||
|
||||
- schema = ./volume/openldap/nine/schema/cadoles.ldif
|
||||
- ldif = ./volume/openldap/nine/ldif/cadoles.ldif
|
||||
|
||||
Voici les variables qui indiquera à ninegate où aller synchroniser son organisation
|
||||
|
||||
```
|
||||
LDAP_BASEUSER="ou=users,ou=ninegate,o=gouv,c=fr"
|
||||
LDAP_BASENIVEAU01="ou=niveau01,ou=ninegate,o=gouv,c=fr"
|
||||
LDAP_BASENIVEAU02="ou=niveau02,ou=ninegate,o=gouv,c=fr"
|
||||
LDAP_BASEGROUP="ou=groups,ou=ninegate,o=gouv,c=fr"
|
||||
```
|
||||
|
||||
**Si masteridentity est à LDAP**
|
||||
|
||||
Dans l'interface de ninegate sur les niveaux vous devrait lui indiquer comment créer les utilisateurs de ce niveau via un filtre LDAP
|
||||
|
||||
Exemple
|
||||
|
||||
```
|
||||
(&(uid=*)(objectclass=inetOrgPerson)(!(description=Computer)))
|
||||
```
|
||||
|
||||
Dans ce cas à l'initialisation de ninegate un premier niveau sera généré est lié à la requete annuaire déclarée via
|
||||
|
||||
```
|
||||
OPENLDAPREQNIVEAU01
|
||||
```
|
||||
|
||||
Vous pouvez aussi synchroniser vos groupes annuaires dans ninegate en activant et en précisant la requête LDAP permettrant de les récupérer
|
||||
|
||||
```
|
||||
OPENLDAPSYNCHROGROUP
|
||||
OPENLDAPREQGROUP
|
||||
```
|
||||
|
||||
**Si masteridentity est à SSO**
|
||||
|
||||
Il n'y a pas de synchronisation, la création / modification des utilisateurs se fait à la connexion de ce dernier.
|
||||
|
|
@ -0,0 +1,2422 @@
|
|||
{
|
||||
"id": "nine",
|
||||
"realm": "nine",
|
||||
"displayName": "Keycloak",
|
||||
"displayNameHtml": "<div class=\"kc-logo-text\"><span>Nine</span></div>",
|
||||
"notBefore": 0,
|
||||
"defaultSignatureAlgorithm": "RS256",
|
||||
"revokeRefreshToken": false,
|
||||
"refreshTokenMaxReuse": 0,
|
||||
"accessTokenLifespan": 60,
|
||||
"accessTokenLifespanForImplicitFlow": 900,
|
||||
"ssoSessionIdleTimeout": 1800,
|
||||
"ssoSessionMaxLifespan": 36000,
|
||||
"ssoSessionIdleTimeoutRememberMe": 0,
|
||||
"ssoSessionMaxLifespanRememberMe": 0,
|
||||
"offlineSessionIdleTimeout": 2592000,
|
||||
"offlineSessionMaxLifespanEnabled": false,
|
||||
"offlineSessionMaxLifespan": 5184000,
|
||||
"clientSessionIdleTimeout": 0,
|
||||
"clientSessionMaxLifespan": 0,
|
||||
"clientOfflineSessionIdleTimeout": 0,
|
||||
"clientOfflineSessionMaxLifespan": 0,
|
||||
"accessCodeLifespan": 60,
|
||||
"accessCodeLifespanUserAction": 300,
|
||||
"accessCodeLifespanLogin": 1800,
|
||||
"actionTokenGeneratedByAdminLifespan": 43200,
|
||||
"actionTokenGeneratedByUserLifespan": 300,
|
||||
"oauth2DeviceCodeLifespan": 600,
|
||||
"oauth2DevicePollingInterval": 600,
|
||||
"enabled": true,
|
||||
"sslRequired": "external",
|
||||
"registrationAllowed": false,
|
||||
"registrationEmailAsUsername": false,
|
||||
"rememberMe": false,
|
||||
"verifyEmail": false,
|
||||
"loginWithEmailAllowed": true,
|
||||
"duplicateEmailsAllowed": false,
|
||||
"resetPasswordAllowed": false,
|
||||
"editUsernameAllowed": false,
|
||||
"bruteForceProtected": false,
|
||||
"permanentLockout": false,
|
||||
"maxFailureWaitSeconds": 900,
|
||||
"minimumQuickLoginWaitSeconds": 60,
|
||||
"waitIncrementSeconds": 60,
|
||||
"quickLoginCheckMilliSeconds": 1000,
|
||||
"maxDeltaTimeSeconds": 43200,
|
||||
"failureFactor": 30,
|
||||
"defaultRole": {
|
||||
"id": "778a9da1-89ea-4523-9537-0dc533265465",
|
||||
"name": "default-roles-master",
|
||||
"description": "${role_default-roles}",
|
||||
"composite": true,
|
||||
"clientRole": false,
|
||||
"containerId": "nine"
|
||||
},
|
||||
"requiredCredentials": [
|
||||
"password"
|
||||
],
|
||||
"otpPolicyType": "totp",
|
||||
"otpPolicyAlgorithm": "HmacSHA1",
|
||||
"otpPolicyInitialCounter": 0,
|
||||
"otpPolicyDigits": 6,
|
||||
"otpPolicyLookAheadWindow": 1,
|
||||
"otpPolicyPeriod": 30,
|
||||
"otpSupportedApplications": [
|
||||
"FreeOTP",
|
||||
"Google Authenticator"
|
||||
],
|
||||
"webAuthnPolicyRpEntityName": "keycloak",
|
||||
"webAuthnPolicySignatureAlgorithms": [
|
||||
"ES256"
|
||||
],
|
||||
"webAuthnPolicyRpId": "",
|
||||
"webAuthnPolicyAttestationConveyancePreference": "not specified",
|
||||
"webAuthnPolicyAuthenticatorAttachment": "not specified",
|
||||
"webAuthnPolicyRequireResidentKey": "not specified",
|
||||
"webAuthnPolicyUserVerificationRequirement": "not specified",
|
||||
"webAuthnPolicyCreateTimeout": 0,
|
||||
"webAuthnPolicyAvoidSameAuthenticatorRegister": false,
|
||||
"webAuthnPolicyAcceptableAaguids": [],
|
||||
"webAuthnPolicyPasswordlessRpEntityName": "keycloak",
|
||||
"webAuthnPolicyPasswordlessSignatureAlgorithms": [
|
||||
"ES256"
|
||||
],
|
||||
"webAuthnPolicyPasswordlessRpId": "",
|
||||
"webAuthnPolicyPasswordlessAttestationConveyancePreference": "not specified",
|
||||
"webAuthnPolicyPasswordlessAuthenticatorAttachment": "not specified",
|
||||
"webAuthnPolicyPasswordlessRequireResidentKey": "not specified",
|
||||
"webAuthnPolicyPasswordlessUserVerificationRequirement": "not specified",
|
||||
"webAuthnPolicyPasswordlessCreateTimeout": 0,
|
||||
"webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister": false,
|
||||
"webAuthnPolicyPasswordlessAcceptableAaguids": [],
|
||||
"scopeMappings": [
|
||||
{
|
||||
"clientScope": "offline_access",
|
||||
"roles": [
|
||||
"offline_access"
|
||||
]
|
||||
}
|
||||
],
|
||||
"clientScopeMappings": {
|
||||
"account": [
|
||||
{
|
||||
"client": "account-console",
|
||||
"roles": [
|
||||
"manage-account"
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"clients": [
|
||||
{
|
||||
"id": "87270d83-7d5e-4dbe-a2d5-33d0cf465ac8",
|
||||
"clientId": "account",
|
||||
"name": "${client_account}",
|
||||
"rootUrl": "${authBaseUrl}",
|
||||
"baseUrl": "/realms/nine/account/",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"/realms/nine/account/*"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": false,
|
||||
"nodeReRegistrationTimeout": 0,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "7158adbd-5fbc-4452-87ec-f0d566a34f45",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "f5914a8b-94fc-48d4-998e-ef199b0b0882",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "86ebd837-9e65-4081-a1cb-8836f310445e",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "e6a441b6-524f-407c-a516-127da17b95b7",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [],
|
||||
"optionalClientScopes": []
|
||||
},
|
||||
{
|
||||
"id": "3b851809-0f59-4b0d-9f85-bce72dfe250e",
|
||||
"clientId": "account-console",
|
||||
"name": "${client_account-console}",
|
||||
"rootUrl": "${authBaseUrl}",
|
||||
"baseUrl": "/realms/nine/account/",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"/realms/nine/account/*"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"pkce.code.challenge.method": "S256"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": false,
|
||||
"nodeReRegistrationTimeout": 0,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "a255ef19-0537-4a44-84a8-c0b1ff4313b9",
|
||||
"name": "audience resolve",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-audience-resolve-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"id": "6b88ea94-98d6-47dd-b656-82933d77ae18",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "512a8304-56af-49e5-90b5-c9c05b70033c",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "624dd437-2e33-4369-8c7e-a2de1c239f5f",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "75e0b103-fbc5-4cc7-9cc4-a68b7d3fdbfd",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [],
|
||||
"optionalClientScopes": []
|
||||
},
|
||||
{
|
||||
"id": "d239802f-534d-4c4f-9a8c-95fe57a928ed",
|
||||
"clientId": "admin-cli",
|
||||
"name": "${client_admin-cli}",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": false,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": true,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": false,
|
||||
"nodeReRegistrationTimeout": 0,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "5ad3b564-2e34-4f06-9ae8-833633ece218",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "8eca5774-5f4b-4519-a1b1-227978cf8183",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "6a0101c8-2972-4acd-aac6-72149b803555",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "620a7c64-22d1-4c33-bda2-d86ff7c702ce",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [],
|
||||
"optionalClientScopes": []
|
||||
},
|
||||
{
|
||||
"id": "7671be05-b84f-481f-b6f8-6254c939268d",
|
||||
"clientId": "broker",
|
||||
"name": "${client_broker}",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": true,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": false,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": false,
|
||||
"nodeReRegistrationTimeout": 0,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "ed454920-baa4-4815-bef6-6f20787d249e",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "aa39dee5-5ccb-4461-a79a-0384af9d44ad",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "e008d88c-8028-431b-8671-f900635f35fc",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "1ff4922e-5c6e-4498-82cc-6766b20c8c1e",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [],
|
||||
"optionalClientScopes": []
|
||||
},
|
||||
{
|
||||
"id": "133d3397-41e7-4ec1-aaf0-a0939da72f58",
|
||||
"clientId": "nine",
|
||||
"name": "nine",
|
||||
"rootUrl": "https://nine.local",
|
||||
"baseUrl": "https://nine.local",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "**********",
|
||||
"redirectUris": [
|
||||
"http://nine.local*",
|
||||
"https://nine.local*"
|
||||
],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": false,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "cas",
|
||||
"attributes": {
|
||||
"id.token.as.detached.signature": "false",
|
||||
"saml.assertion.signature": "false",
|
||||
"saml.force.post.binding": "false",
|
||||
"saml.multivalued.roles": "false",
|
||||
"saml.encrypt": "false",
|
||||
"login_theme": "keycloak",
|
||||
"oauth2.device.authorization.grant.enabled": "false",
|
||||
"backchannel.logout.revoke.offline.tokens": "false",
|
||||
"saml.server.signature": "false",
|
||||
"saml.server.signature.keyinfo.ext": "false",
|
||||
"use.refresh.tokens": "true",
|
||||
"exclude.session.state.from.auth.response": "false",
|
||||
"oidc.ciba.grant.enabled": "false",
|
||||
"saml.artifact.binding": "false",
|
||||
"backchannel.logout.session.required": "false",
|
||||
"client_credentials.use_refresh_token": "false",
|
||||
"saml_force_name_id_format": "false",
|
||||
"require.pushed.authorization.requests": "false",
|
||||
"saml.client.signature": "false",
|
||||
"tls.client.certificate.bound.access.tokens": "false",
|
||||
"saml.authnstatement": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"saml.onetimeuse.condition": "false"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": true,
|
||||
"nodeReRegistrationTimeout": -1,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "4e60ce83-fc4e-4f13-addc-ded389802592",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "5ebc6595-9386-4834-9f1c-5df10d8a68aa",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "5ca43923-49cb-47f2-8c5f-d646808f665c",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "e99e05dc-e158-4232-a1a0-a972e9397782",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [
|
||||
"nine"
|
||||
],
|
||||
"optionalClientScopes": []
|
||||
},
|
||||
{
|
||||
"id": "d5474573-906e-4f00-914a-a436049f5ac0",
|
||||
"clientId": "realm-management",
|
||||
"name": "${client_realm-management}",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [],
|
||||
"webOrigins": [],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": true,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": false,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": false,
|
||||
"nodeReRegistrationTimeout": 0,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "eb04593d-ec09-4a65-8b8e-b177bf23b8bc",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "9434f197-308e-4266-93e6-1d162a52c6d5",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "5195c729-1853-4b2f-a239-16e439265873",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "565cf014-8114-47ca-861f-1710035a7023",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [],
|
||||
"optionalClientScopes": []
|
||||
},
|
||||
{
|
||||
"id": "e4c15b58-2e15-4ff3-8e16-ecbd02551978",
|
||||
"clientId": "security-admin-console",
|
||||
"name": "${client_security-admin-console}",
|
||||
"rootUrl": "${authAdminUrl}",
|
||||
"baseUrl": "/admin/nine/console/",
|
||||
"surrogateAuthRequired": false,
|
||||
"enabled": true,
|
||||
"alwaysDisplayInConsole": false,
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"redirectUris": [
|
||||
"/admin/nine/console/*"
|
||||
],
|
||||
"webOrigins": [
|
||||
"+"
|
||||
],
|
||||
"notBefore": 0,
|
||||
"bearerOnly": false,
|
||||
"consentRequired": false,
|
||||
"standardFlowEnabled": true,
|
||||
"implicitFlowEnabled": false,
|
||||
"directAccessGrantsEnabled": false,
|
||||
"serviceAccountsEnabled": false,
|
||||
"publicClient": true,
|
||||
"frontchannelLogout": false,
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"pkce.code.challenge.method": "S256"
|
||||
},
|
||||
"authenticationFlowBindingOverrides": {},
|
||||
"fullScopeAllowed": false,
|
||||
"nodeReRegistrationTimeout": 0,
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "26bfca71-394c-4ca2-8e74-865a7b9b4182",
|
||||
"name": "email",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "email",
|
||||
"claim.name": "mail",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "31a8e7ec-b19b-4195-bcb7-1e8d57f525f6",
|
||||
"name": "full name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"claim.name": "cn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "f8257533-9a9a-4ac2-85dc-50921351f67b",
|
||||
"name": "given name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "firstName",
|
||||
"claim.name": "givenName",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "58da24e2-5491-452c-8a9f-c13e27c01b4f",
|
||||
"name": "locale",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "locale",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "locale",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "b34ad4e4-ed15-485a-9d7c-8b8ca89386b3",
|
||||
"name": "family name",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "lastName",
|
||||
"claim.name": "sn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultClientScopes": [],
|
||||
"optionalClientScopes": []
|
||||
}
|
||||
],
|
||||
"clientScopes": [
|
||||
{
|
||||
"id": "e5bab9e6-0003-405a-bc2a-d96d1c2f7046",
|
||||
"name": "email",
|
||||
"description": "OpenID Connect built-in scope: email",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "true",
|
||||
"consent.screen.text": "${emailScopeConsentText}"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "2cf129d5-5a52-4522-94d3-aeefe5074af1",
|
||||
"name": "email",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "email",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "email",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "d07c04b4-0c9b-4168-9a87-0d1f8db41c01",
|
||||
"name": "email verified",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "emailVerified",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "email_verified",
|
||||
"jsonType.label": "boolean"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "bd3e8ff5-e456-49bb-8fc5-a4b10bdb161e",
|
||||
"name": "role_list",
|
||||
"description": "SAML role list",
|
||||
"protocol": "saml",
|
||||
"attributes": {
|
||||
"consent.screen.text": "${samlRoleListScopeConsentText}",
|
||||
"display.on.consent.screen": "true"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "2f00f403-1835-4a67-a05d-31bb0264c0bf",
|
||||
"name": "role list",
|
||||
"protocol": "saml",
|
||||
"protocolMapper": "saml-role-list-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"single": "false",
|
||||
"attribute.nameformat": "Basic",
|
||||
"attribute.name": "Role"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "df9cfc10-8f39-43fc-a5b3-99e6014dffea",
|
||||
"name": "profile",
|
||||
"description": "OpenID Connect built-in scope: profile",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "true",
|
||||
"consent.screen.text": "${profileScopeConsentText}"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "10b45997-ab67-448b-9396-0adb49948e4c",
|
||||
"name": "nickname",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "nickname",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "nickname",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "0f172771-2ce4-42e3-926a-ff2f1075af6f",
|
||||
"name": "locale",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "locale",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "locale",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "3dcf78c2-cd43-4101-a02b-007260a9b612",
|
||||
"name": "picture",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "picture",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "picture",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "e9ea9414-335f-4c79-8ada-a8cd960100d1",
|
||||
"name": "website",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "website",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "website",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "2fac0274-ece3-4a89-9818-14adda3a67bc",
|
||||
"name": "gender",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "gender",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "gender",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "b0f98586-8113-4552-a3fb-fd507c829128",
|
||||
"name": "zoneinfo",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "zoneinfo",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "zoneinfo",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "6968296c-04b8-45dc-9540-d1f0f3f60221",
|
||||
"name": "middle name",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "middleName",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "middle_name",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "0d0ad251-5054-4827-be19-44d289ba213d",
|
||||
"name": "profile",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "profile",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "profile",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "16cdcafc-e1d2-401c-aa06-5bbb865dc216",
|
||||
"name": "username",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "username",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "preferred_username",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "f367af39-837f-4ebf-b899-515b85bebf74",
|
||||
"name": "given name",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "firstName",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "given_name",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "c98e8531-fe14-4836-afff-453573504cb5",
|
||||
"name": "birthdate",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "birthdate",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "birthdate",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "d2a55e94-0e99-4b65-a9dd-2994f41d5f0c",
|
||||
"name": "updated at",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "updatedAt",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "updated_at",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "cf433524-2dcc-49ef-8493-bf9d92b88101",
|
||||
"name": "full name",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-full-name-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"userinfo.token.claim": "true"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "90a63c1f-a529-47fb-8412-a37bc511d8f7",
|
||||
"name": "family name",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "lastName",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "family_name",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "6aa23421-70a4-4e86-88f6-9f0660a61c9b",
|
||||
"name": "web-origins",
|
||||
"description": "OpenID Connect scope for add allowed web origins to the access token",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "false",
|
||||
"display.on.consent.screen": "false",
|
||||
"consent.screen.text": ""
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "4949c89a-5149-41ba-87a5-f3cd9b3f6b77",
|
||||
"name": "allowed web origins",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-allowed-origins-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "26b70183-e9a3-4383-893d-578ee135ac91",
|
||||
"name": "phone",
|
||||
"description": "OpenID Connect built-in scope: phone",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "true",
|
||||
"consent.screen.text": "${phoneScopeConsentText}"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "3e193f09-c5c4-4a5e-bf18-a191830cba62",
|
||||
"name": "phone number verified",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "phoneNumberVerified",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "phone_number_verified",
|
||||
"jsonType.label": "boolean"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "dcbb0641-3ddf-47aa-ad90-5f5f76f63cbe",
|
||||
"name": "phone number",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "phoneNumber",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "phone_number",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "cb7a60bc-d71f-4379-8bbc-d22e48a78a2e",
|
||||
"name": "address",
|
||||
"description": "OpenID Connect built-in scope: address",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "true",
|
||||
"consent.screen.text": "${addressScopeConsentText}"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "b177c977-c857-4c15-b985-8d489f3ab4aa",
|
||||
"name": "address",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-address-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute.formatted": "formatted",
|
||||
"user.attribute.country": "country",
|
||||
"user.attribute.postal_code": "postal_code",
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute.street": "street",
|
||||
"id.token.claim": "true",
|
||||
"user.attribute.region": "region",
|
||||
"access.token.claim": "true",
|
||||
"user.attribute.locality": "locality"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "a31d82e9-ae91-42e2-ba0d-115f53749780",
|
||||
"name": "roles",
|
||||
"description": "OpenID Connect scope for add user roles to the access token",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "false",
|
||||
"display.on.consent.screen": "true",
|
||||
"consent.screen.text": "${rolesScopeConsentText}"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "0e76249d-2f86-4e0d-8ddc-f034f96837f6",
|
||||
"name": "audience resolve",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-audience-resolve-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"id": "fad5d917-9728-43fb-99b8-b23547a125e2",
|
||||
"name": "client roles",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-client-role-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "foo",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "resource_access.${client_id}.roles",
|
||||
"jsonType.label": "String",
|
||||
"multivalued": "true"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "cbed5763-4f17-4f30-ae15-d9bcdc20d50a",
|
||||
"name": "realm roles",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-realm-role-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "foo",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "realm_access.roles",
|
||||
"jsonType.label": "String",
|
||||
"multivalued": "true"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "7bc8ebde-3563-4ce1-a0d2-ad58aba2cd7c",
|
||||
"name": "microprofile-jwt",
|
||||
"description": "Microprofile - JWT built-in scope",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "false"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "e5e10473-8bd1-42b5-89fa-d0b3e90a18ed",
|
||||
"name": "upn",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-property-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "username",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "upn",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "7d0b5233-08f1-47c1-9b21-ae8c471d67e1",
|
||||
"name": "groups",
|
||||
"protocol": "openid-connect",
|
||||
"protocolMapper": "oidc-usermodel-realm-role-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"multivalued": "true",
|
||||
"userinfo.token.claim": "true",
|
||||
"user.attribute": "foo",
|
||||
"id.token.claim": "true",
|
||||
"access.token.claim": "true",
|
||||
"claim.name": "groups",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "238cdd25-3e87-45cf-badf-89033829a1af",
|
||||
"name": "nine",
|
||||
"protocol": "cas",
|
||||
"attributes": {
|
||||
"include.in.token.scope": "true",
|
||||
"display.on.consent.screen": "true"
|
||||
},
|
||||
"protocolMappers": [
|
||||
{
|
||||
"id": "d4e42326-ec8b-4103-8e7b-afdc1c64d904",
|
||||
"name": "siren",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "siren",
|
||||
"claim.name": "siren",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "fcd2b58e-8be8-40b4-aec0-132fb6259d93",
|
||||
"name": "niveau01",
|
||||
"protocol": "cas",
|
||||
"protocolMapper": "cas-usermodel-attribute-mapper",
|
||||
"consentRequired": false,
|
||||
"config": {
|
||||
"user.attribute": "niveau01",
|
||||
"claim.name": "niveau01",
|
||||
"jsonType.label": "String"
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "44ab982e-a384-41a3-8610-a65600c489e4",
|
||||
"name": "offline_access",
|
||||
"description": "OpenID Connect built-in scope: offline_access",
|
||||
"protocol": "openid-connect",
|
||||
"attributes": {
|
||||
"consent.screen.text": "${offlineAccessScopeConsentText}",
|
||||
"display.on.consent.screen": "true"
|
||||
}
|
||||
}
|
||||
],
|
||||
"defaultDefaultClientScopes": [
|
||||
"web-origins",
|
||||
"roles",
|
||||
"role_list",
|
||||
"profile",
|
||||
"email"
|
||||
],
|
||||
"defaultOptionalClientScopes": [
|
||||
"phone",
|
||||
"offline_access",
|
||||
"microprofile-jwt",
|
||||
"address"
|
||||
],
|
||||
"browserSecurityHeaders": {
|
||||
"contentSecurityPolicyReportOnly": "",
|
||||
"xContentTypeOptions": "nosniff",
|
||||
"xRobotsTag": "none",
|
||||
"xFrameOptions": "SAMEORIGIN",
|
||||
"contentSecurityPolicy": "frame-src 'self'; frame-ancestors 'self'; object-src 'none';",
|
||||
"xXSSProtection": "1; mode=block",
|
||||
"strictTransportSecurity": "max-age=31536000; includeSubDomains"
|
||||
},
|
||||
"smtpServer": {},
|
||||
"eventsEnabled": false,
|
||||
"eventsListeners": [
|
||||
"jboss-logging"
|
||||
],
|
||||
"enabledEventTypes": [],
|
||||
"adminEventsEnabled": false,
|
||||
"adminEventsDetailsEnabled": false,
|
||||
"identityProviders": [],
|
||||
"identityProviderMappers": [],
|
||||
"components": {
|
||||
"org.keycloak.services.clientregistration.policy.ClientRegistrationPolicy": [
|
||||
{
|
||||
"id": "4534f093-d690-4e0e-afe1-3590257718f4",
|
||||
"name": "Max Clients Limit",
|
||||
"providerId": "max-clients",
|
||||
"subType": "anonymous",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"max-clients": [
|
||||
"200"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "6c90c03e-45f7-4ea6-83eb-fc6131e24c34",
|
||||
"name": "Allowed Protocol Mapper Types",
|
||||
"providerId": "allowed-protocol-mappers",
|
||||
"subType": "anonymous",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"allowed-protocol-mapper-types": [
|
||||
"oidc-usermodel-attribute-mapper",
|
||||
"saml-user-property-mapper",
|
||||
"oidc-address-mapper",
|
||||
"oidc-full-name-mapper",
|
||||
"saml-role-list-mapper",
|
||||
"oidc-sha256-pairwise-sub-mapper",
|
||||
"oidc-usermodel-property-mapper",
|
||||
"saml-user-attribute-mapper"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "55c9c339-6151-47cb-9f95-99076e157e1c",
|
||||
"name": "Full Scope Disabled",
|
||||
"providerId": "scope",
|
||||
"subType": "anonymous",
|
||||
"subComponents": {},
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"id": "e7af1382-7b01-4b25-9ae1-57bec1f0fec2",
|
||||
"name": "Trusted Hosts",
|
||||
"providerId": "trusted-hosts",
|
||||
"subType": "anonymous",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"host-sending-registration-request-must-match": [
|
||||
"true"
|
||||
],
|
||||
"client-uris-must-match": [
|
||||
"true"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "09380ed6-96a9-43ab-ba83-cb864a3f509a",
|
||||
"name": "Allowed Client Scopes",
|
||||
"providerId": "allowed-client-templates",
|
||||
"subType": "anonymous",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"allow-default-scopes": [
|
||||
"true"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "64924b80-6b72-4991-a838-b1c275cb79f8",
|
||||
"name": "Consent Required",
|
||||
"providerId": "consent-required",
|
||||
"subType": "anonymous",
|
||||
"subComponents": {},
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"id": "509b7501-be18-4425-bb25-68fe6868dc73",
|
||||
"name": "Allowed Protocol Mapper Types",
|
||||
"providerId": "allowed-protocol-mappers",
|
||||
"subType": "authenticated",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"allowed-protocol-mapper-types": [
|
||||
"saml-user-attribute-mapper",
|
||||
"oidc-sha256-pairwise-sub-mapper",
|
||||
"saml-user-property-mapper",
|
||||
"oidc-usermodel-attribute-mapper",
|
||||
"oidc-full-name-mapper",
|
||||
"oidc-address-mapper",
|
||||
"oidc-usermodel-property-mapper",
|
||||
"saml-role-list-mapper"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "164c42e5-13a3-4d67-82dd-3a24a21099c5",
|
||||
"name": "Allowed Client Scopes",
|
||||
"providerId": "allowed-client-templates",
|
||||
"subType": "authenticated",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"allow-default-scopes": [
|
||||
"true"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"org.keycloak.userprofile.UserProfileProvider": [
|
||||
{
|
||||
"id": "57b8edbf-3395-4ac3-80d7-2bd0ca1ec792",
|
||||
"providerId": "declarative-user-profile",
|
||||
"subComponents": {},
|
||||
"config": {}
|
||||
}
|
||||
],
|
||||
"org.keycloak.storage.UserStorageProvider": [
|
||||
{
|
||||
"id": "cc488d45-7acf-4460-9ce3-92fa33f2169a",
|
||||
"name": "ldap",
|
||||
"providerId": "ldap",
|
||||
"subComponents": {
|
||||
"org.keycloak.storage.ldap.mappers.LDAPStorageMapper": [
|
||||
{
|
||||
"id": "05b4c1c5-f1b3-418f-b4e3-40149e08cb9f",
|
||||
"name": "email",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"mail"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"is.binary.attribute": [
|
||||
"false"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"always.read.value.from.ldap": [
|
||||
"false"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"email"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "a019bec6-f45a-4cee-a2e2-04454e31c8a7",
|
||||
"name": "username",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"uid"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"is.binary.attribute": [
|
||||
"false"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"username"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "a5717a47-a717-4655-98cf-0cdfab2c8d9b",
|
||||
"name": "modify date",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"modifyTimestamp"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"always.read.value.from.ldap": [
|
||||
"true"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"modifyTimestamp"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "3dc5921d-44ac-4748-8c61-a4f1e2052d95",
|
||||
"name": "niveau01",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"niveau01"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"is.binary.attribute": [
|
||||
"false"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"niveau01"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "4dc6f603-4c19-466e-8929-279fd246c3b5",
|
||||
"name": "last name",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"sn"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"true"
|
||||
],
|
||||
"always.read.value.from.ldap": [
|
||||
"true"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"lastName"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "b35862bf-04c1-4b72-9eb4-1a511b44d66e",
|
||||
"name": "first name",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"givenName"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"is.binary.attribute": [
|
||||
"false"
|
||||
],
|
||||
"always.read.value.from.ldap": [
|
||||
"true"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"firstname"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "207e55ef-e171-4a96-ad85-7d9899472991",
|
||||
"name": "siren",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"siren"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"is.binary.attribute": [
|
||||
"false"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"siren"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "faf41ea6-f9f8-4872-9b9e-2461e0d9b834",
|
||||
"name": "creation date",
|
||||
"providerId": "user-attribute-ldap-mapper",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"ldap.attribute": [
|
||||
"createTimestamp"
|
||||
],
|
||||
"is.mandatory.in.ldap": [
|
||||
"false"
|
||||
],
|
||||
"read.only": [
|
||||
"true"
|
||||
],
|
||||
"always.read.value.from.ldap": [
|
||||
"true"
|
||||
],
|
||||
"user.model.attribute": [
|
||||
"createTimestamp"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"config": {
|
||||
"pagination": [
|
||||
"true"
|
||||
],
|
||||
"fullSyncPeriod": [
|
||||
"-1"
|
||||
],
|
||||
"connectionPooling": [
|
||||
"true"
|
||||
],
|
||||
"usersDn": [
|
||||
"ou=users,ou=ninegate,dc=nine,dc=org"
|
||||
],
|
||||
"cachePolicy": [
|
||||
"DEFAULT"
|
||||
],
|
||||
"useKerberosForPasswordAuthentication": [
|
||||
"false"
|
||||
],
|
||||
"importEnabled": [
|
||||
"false"
|
||||
],
|
||||
"enabled": [
|
||||
"true"
|
||||
],
|
||||
"usernameLDAPAttribute": [
|
||||
"uid"
|
||||
],
|
||||
"bindCredential": [
|
||||
"changeme"
|
||||
],
|
||||
"changedSyncPeriod": [
|
||||
"-1"
|
||||
],
|
||||
"bindDn": [
|
||||
"cn=admin,dc=nine,dc=org"
|
||||
],
|
||||
"lastSync": [
|
||||
"1698698495"
|
||||
],
|
||||
"vendor": [
|
||||
"other"
|
||||
],
|
||||
"uuidLDAPAttribute": [
|
||||
"entryUUID"
|
||||
],
|
||||
"connectionUrl": [
|
||||
"ldap://openldap:1389"
|
||||
],
|
||||
"allowKerberosAuthentication": [
|
||||
"false"
|
||||
],
|
||||
"syncRegistrations": [
|
||||
"false"
|
||||
],
|
||||
"authType": [
|
||||
"simple"
|
||||
],
|
||||
"debug": [
|
||||
"false"
|
||||
],
|
||||
"searchScope": [
|
||||
"1"
|
||||
],
|
||||
"useTruststoreSpi": [
|
||||
"ldapsOnly"
|
||||
],
|
||||
"trustEmail": [
|
||||
"false"
|
||||
],
|
||||
"priority": [
|
||||
"0"
|
||||
],
|
||||
"userObjectClasses": [
|
||||
"inetOrgPerson, organizationalPerson"
|
||||
],
|
||||
"rdnLDAPAttribute": [
|
||||
"uid"
|
||||
],
|
||||
"editMode": [
|
||||
"READ_ONLY"
|
||||
],
|
||||
"validatePasswordPolicy": [
|
||||
"false"
|
||||
],
|
||||
"batchSizeForSync": [
|
||||
"1000"
|
||||
]
|
||||
}
|
||||
}
|
||||
],
|
||||
"org.keycloak.keys.KeyProvider": [
|
||||
{
|
||||
"id": "20be504c-5093-4f94-b9c8-8048c49301dd",
|
||||
"name": "hmac-generated",
|
||||
"providerId": "hmac-generated",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"priority": [
|
||||
"100"
|
||||
],
|
||||
"algorithm": [
|
||||
"HS256"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "89c846d9-b9e9-4022-8cf7-03a63e4efc03",
|
||||
"name": "rsa-enc-generated",
|
||||
"providerId": "rsa-enc-generated",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"priority": [
|
||||
"100"
|
||||
],
|
||||
"algorithm": [
|
||||
"RSA-OAEP"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "048bb6eb-5423-476b-9c19-d39e6640a1cf",
|
||||
"name": "aes-generated",
|
||||
"providerId": "aes-generated",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"priority": [
|
||||
"100"
|
||||
]
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "f1c978f6-a133-46f6-a784-bc1c6a9dace9",
|
||||
"name": "rsa-generated",
|
||||
"providerId": "rsa-generated",
|
||||
"subComponents": {},
|
||||
"config": {
|
||||
"priority": [
|
||||
"100"
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"internationalizationEnabled": false,
|
||||
"supportedLocales": [],
|
||||
"authenticationFlows": [
|
||||
{
|
||||
"id": "2769839a-7135-4319-bcf2-1208e18004cb",
|
||||
"alias": "Account verification options",
|
||||
"description": "Method with which to verity the existing account",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "idp-email-verification",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 20,
|
||||
"flowAlias": "Verify Existing Account by Re-authentication",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "a03d0c39-b304-479f-beb3-0ac34048b3e7",
|
||||
"alias": "Authentication Options",
|
||||
"description": "Authentication options.",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "basic-auth",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "basic-auth-otp",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "DISABLED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "auth-spnego",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "DISABLED",
|
||||
"priority": 30,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "ccb129aa-f7e7-4111-a463-a19206b7fb37",
|
||||
"alias": "Browser - Conditional OTP",
|
||||
"description": "Flow to determine if the OTP is required for the authentication",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "conditional-user-configured",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "auth-otp-form",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "e590c666-bf10-455b-8a0b-fe26d15a5c0a",
|
||||
"alias": "Direct Grant - Conditional OTP",
|
||||
"description": "Flow to determine if the OTP is required for the authentication",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "conditional-user-configured",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "direct-grant-validate-otp",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "272ef112-7124-4361-83e1-fab3a43cb68d",
|
||||
"alias": "First broker login - Conditional OTP",
|
||||
"description": "Flow to determine if the OTP is required for the authentication",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "conditional-user-configured",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "auth-otp-form",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "2e80c4de-0a90-4751-919e-4cad083ebb39",
|
||||
"alias": "Handle Existing Account",
|
||||
"description": "Handle what to do if there is existing account with same email/username like authenticated identity provider",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "idp-confirm-link",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"flowAlias": "Account verification options",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "501be6a7-b886-4e0f-9b13-5ceabdb59ef6",
|
||||
"alias": "Reset - Conditional OTP",
|
||||
"description": "Flow to determine if the OTP should be reset or not. Set to REQUIRED to force.",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "conditional-user-configured",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "reset-otp",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "06e92c43-c436-4a32-91c5-6bb536403405",
|
||||
"alias": "User creation or linking",
|
||||
"description": "Flow for the existing/non-existing user alternatives",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticatorConfig": "create unique user config",
|
||||
"authenticator": "idp-create-user-if-unique",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 20,
|
||||
"flowAlias": "Handle Existing Account",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "96c60c50-0210-48c7-b39d-3118e11227b9",
|
||||
"alias": "Verify Existing Account by Re-authentication",
|
||||
"description": "Reauthentication of existing account",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "idp-username-password-form",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "CONDITIONAL",
|
||||
"priority": 20,
|
||||
"flowAlias": "First broker login - Conditional OTP",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "731ece9d-bfbb-4174-864d-3d609a6a9a8d",
|
||||
"alias": "browser",
|
||||
"description": "browser based authentication",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "auth-cookie",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "auth-spnego",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "DISABLED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "identity-provider-redirector",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 25,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 30,
|
||||
"flowAlias": "forms",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "3b6dedee-71b5-408c-a4ef-c3d9d56491fa",
|
||||
"alias": "clients",
|
||||
"description": "Base authentication for clients",
|
||||
"providerId": "client-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "client-secret",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "client-jwt",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "client-secret-jwt",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 30,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "client-x509",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "ALTERNATIVE",
|
||||
"priority": 40,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "05623406-4a49-4f73-a52e-16119b5ee7fa",
|
||||
"alias": "direct grant",
|
||||
"description": "OpenID Connect Resource Owner Grant",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "direct-grant-validate-username",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "direct-grant-validate-password",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "CONDITIONAL",
|
||||
"priority": 30,
|
||||
"flowAlias": "Direct Grant - Conditional OTP",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "7b96140b-16c1-4fb8-a59f-a362603b9830",
|
||||
"alias": "docker auth",
|
||||
"description": "Used by Docker clients to authenticate against the IDP",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "docker-http-basic-authenticator",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "53ce2fa4-56a0-4165-839d-62c3e14c15f7",
|
||||
"alias": "first broker login",
|
||||
"description": "Actions taken after first broker login with identity provider account, which is not yet linked to any Keycloak account",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticatorConfig": "review profile config",
|
||||
"authenticator": "idp-review-profile",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"flowAlias": "User creation or linking",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "f9a1fd59-e174-40e9-a28a-643b51366e4d",
|
||||
"alias": "forms",
|
||||
"description": "Username, password, otp and other auth forms.",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "auth-username-password-form",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "CONDITIONAL",
|
||||
"priority": 20,
|
||||
"flowAlias": "Browser - Conditional OTP",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "19d3a997-c030-401e-903c-d168650f0413",
|
||||
"alias": "http challenge",
|
||||
"description": "An authentication flow based on challenge-response HTTP Authentication Schemes",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "no-cookie-redirect",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"flowAlias": "Authentication Options",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "100db2b7-d0b1-4287-909a-8ab0a5f268bb",
|
||||
"alias": "registration",
|
||||
"description": "registration flow",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "registration-page-form",
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"flowAlias": "registration form",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "549011b0-b533-48cf-90d0-d1b8ca11105c",
|
||||
"alias": "registration form",
|
||||
"description": "registration form",
|
||||
"providerId": "form-flow",
|
||||
"topLevel": false,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "registration-user-creation",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "registration-profile-action",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 40,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "registration-password-action",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 50,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "registration-recaptcha-action",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "DISABLED",
|
||||
"priority": 60,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "98bc4f2e-8bc3-4187-97dc-90ce7ef0909d",
|
||||
"alias": "reset credentials",
|
||||
"description": "Reset credentials for a user if they forgot their password or something",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "reset-credentials-choose-user",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "reset-credential-email",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 20,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticator": "reset-password",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 30,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
},
|
||||
{
|
||||
"authenticatorFlow": true,
|
||||
"requirement": "CONDITIONAL",
|
||||
"priority": 40,
|
||||
"flowAlias": "Reset - Conditional OTP",
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": true
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "30f9008c-cba1-480f-9547-e0ad994f6165",
|
||||
"alias": "saml ecp",
|
||||
"description": "SAML ECP Profile Authentication Flow",
|
||||
"providerId": "basic-flow",
|
||||
"topLevel": true,
|
||||
"builtIn": true,
|
||||
"authenticationExecutions": [
|
||||
{
|
||||
"authenticator": "http-basic-authenticator",
|
||||
"authenticatorFlow": false,
|
||||
"requirement": "REQUIRED",
|
||||
"priority": 10,
|
||||
"userSetupAllowed": false,
|
||||
"autheticatorFlow": false
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"authenticatorConfig": [
|
||||
{
|
||||
"id": "8e916fa6-4d7e-4247-a9fa-5a185f23b6cb",
|
||||
"alias": "create unique user config",
|
||||
"config": {
|
||||
"require.password.update.after.registration": "false"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "91f281c4-3965-4897-a495-b61d15083306",
|
||||
"alias": "review profile config",
|
||||
"config": {
|
||||
"update.profile.on.first.login": "missing"
|
||||
}
|
||||
}
|
||||
],
|
||||
"requiredActions": [
|
||||
{
|
||||
"alias": "CONFIGURE_TOTP",
|
||||
"name": "Configure OTP",
|
||||
"providerId": "CONFIGURE_TOTP",
|
||||
"enabled": true,
|
||||
"defaultAction": false,
|
||||
"priority": 10,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"alias": "terms_and_conditions",
|
||||
"name": "Terms and Conditions",
|
||||
"providerId": "terms_and_conditions",
|
||||
"enabled": false,
|
||||
"defaultAction": false,
|
||||
"priority": 20,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"alias": "UPDATE_PASSWORD",
|
||||
"name": "Update Password",
|
||||
"providerId": "UPDATE_PASSWORD",
|
||||
"enabled": true,
|
||||
"defaultAction": false,
|
||||
"priority": 30,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"alias": "UPDATE_PROFILE",
|
||||
"name": "Update Profile",
|
||||
"providerId": "UPDATE_PROFILE",
|
||||
"enabled": true,
|
||||
"defaultAction": false,
|
||||
"priority": 40,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"alias": "VERIFY_EMAIL",
|
||||
"name": "Verify Email",
|
||||
"providerId": "VERIFY_EMAIL",
|
||||
"enabled": true,
|
||||
"defaultAction": false,
|
||||
"priority": 50,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"alias": "delete_account",
|
||||
"name": "Delete Account",
|
||||
"providerId": "delete_account",
|
||||
"enabled": false,
|
||||
"defaultAction": false,
|
||||
"priority": 60,
|
||||
"config": {}
|
||||
},
|
||||
{
|
||||
"alias": "update_user_locale",
|
||||
"name": "Update User Locale",
|
||||
"providerId": "update_user_locale",
|
||||
"enabled": true,
|
||||
"defaultAction": false,
|
||||
"priority": 1000,
|
||||
"config": {}
|
||||
}
|
||||
],
|
||||
"browserFlow": "browser",
|
||||
"registrationFlow": "registration",
|
||||
"directGrantFlow": "direct grant",
|
||||
"resetCredentialsFlow": "reset credentials",
|
||||
"clientAuthenticationFlow": "clients",
|
||||
"dockerAuthenticationFlow": "docker auth",
|
||||
"attributes": {
|
||||
"cibaBackchannelTokenDeliveryMode": "poll",
|
||||
"cibaExpiresIn": "120",
|
||||
"cibaAuthRequestedUserHint": "login_hint",
|
||||
"oauth2DeviceCodeLifespan": "600",
|
||||
"clientOfflineSessionMaxLifespan": "0",
|
||||
"oauth2DevicePollingInterval": "600",
|
||||
"clientSessionIdleTimeout": "0",
|
||||
"userProfileEnabled": "false",
|
||||
"parRequestUriLifespan": "60",
|
||||
"clientSessionMaxLifespan": "0",
|
||||
"clientOfflineSessionIdleTimeout": "0",
|
||||
"cibaInterval": "5"
|
||||
},
|
||||
"keycloakVersion": "16.1.1",
|
||||
"userManagedAccessAllowed": false,
|
||||
"clientProfiles": {
|
||||
"profiles": []
|
||||
},
|
||||
"clientPolicies": {
|
||||
"policies": []
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDbTCCAlWgAwIBAgIUdsa5zX+n2WvMe/ke0WnjLDmwh1YwDQYJKoZIhvcNAQEL
|
||||
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
|
||||
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAgFw0yMzEwMzAxOTQzMzlaGA8yMTIz
|
||||
MTAwNjE5NDMzOVowRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUx
|
||||
ITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDCCASIwDQYJKoZIhvcN
|
||||
AQEBBQADggEPADCCAQoCggEBAMfsg3/PMBKOYQUkpx93r21JRJC2nsBnSFUcNmZr
|
||||
LIXHBcdwy/NJyk/hQt6/RPbZ8+6caIM0pEf5miaYmtnqXv35ktG63UgpIq3uz6cx
|
||||
7ymLE9BDqJ+nqw0JDgE5gQjhzMwDvDJinFfoPomj6Z+zW1MlCfUg/lwPKnfGm1Qa
|
||||
qTh882EPirCWQI5OUwXDecvUMNaCb0I7ROBJo3VB3/1pJAlRXgwvu4ALtb+4b+kF
|
||||
HP7kBCts/FiUocrZfM2c6ghHDCr98UBMxIrI9tZMTRuQI3u0Wh+98JFf40tDUxd5
|
||||
uRcykgnHXZKTbkNH8BXXr3QZpWqe3pJvABg07OETWjiD318CAwEAAaNTMFEwHQYD
|
||||
VR0OBBYEFP75y7FWY7Z71/MBWJJMw3Vj3SetMB8GA1UdIwQYMBaAFP75y7FWY7Z7
|
||||
1/MBWJJMw3Vj3SetMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
|
||||
AAZHrzEMcjMAvfZvNsbNVUmOS860iq8uH1hRhykukNxmN1VdvP8jTgl1iHidJ3RX
|
||||
DYnqr9JM1Zqzin3tjsDBriaKLc/NGLtjqUiTV77C6mUrHOVOr93qT9Sd38HPPlED
|
||||
CC4356Vvl555vHUcOMRA4YnV+pZRT7m8Ac4pzRir9GuWR4sVyxehe9VM44v/sVLe
|
||||
i9yzcPrP+zhLbjXCM1cI+A9u5TQYFFp8XTdOXP2duXiuEJWb5tgWKaPatUL91bpE
|
||||
66Vuc+OogescrIjQTkFFSS3waqVxRqjI4EzUpib5YzFYKVCinPtvDsP9iHA9Focv
|
||||
qItOHHxZ48HM+tyYo7Ule1A=
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDH7IN/zzASjmEF
|
||||
JKcfd69tSUSQtp7AZ0hVHDZmayyFxwXHcMvzScpP4ULev0T22fPunGiDNKRH+Zom
|
||||
mJrZ6l79+ZLRut1IKSKt7s+nMe8pixPQQ6ifp6sNCQ4BOYEI4czMA7wyYpxX6D6J
|
||||
o+mfs1tTJQn1IP5cDyp3xptUGqk4fPNhD4qwlkCOTlMFw3nL1DDWgm9CO0TgSaN1
|
||||
Qd/9aSQJUV4ML7uAC7W/uG/pBRz+5AQrbPxYlKHK2XzNnOoIRwwq/fFATMSKyPbW
|
||||
TE0bkCN7tFofvfCRX+NLQ1MXebkXMpIJx12Sk25DR/AV1690GaVqnt6SbwAYNOzh
|
||||
E1o4g99fAgMBAAECggEAH4eLEZFmXnbP5uoUj/Tl2LwbsSBBQczIGTbIKYzbdQRM
|
||||
mAXk/wBzL00yU5jMp+BQWnWWUfhFCbOGqRxGHPnxHegfTIObjwbVw6KMYyzlL/hm
|
||||
w+Cia6jGDtnlDd0OHuLQKUNUNIoIEsu7bnpIR6Rspwc0s9EOlwwulryJa1EtFjhE
|
||||
I1Blzx2gcqcoVY1g4f6TJ2oH5beAQCyFW4O4xaK9AEukNxBVOaTKfc30KYaxwqvJ
|
||||
L424PllpWa31cw62yW1weomEmjmuGGwKV5UKchBOwRz26ZdhkUCLMJchtqfSEGmW
|
||||
cSde8xvf9/G9WB1iFXkdWPInIv622kwPa7agPtsHiQKBgQD5aLU1OqnHVInjDDlw
|
||||
v4ejgdYtsn9tSld6uIkCwCesk8BjAI2y7nfhQ3KtF5YMFomrggA24T0aHcx9Eg0J
|
||||
sb+eIl9uhuSZ+DSKeApGYyhwJYsKt7bE0875sh8RdBXwfexrBH/ofqdM4OjXfFUM
|
||||
H5idobKNfdvje4j6cpV5XhUYQwKBgQDNNQfq2iSo1ypA0HSInzLSc7Hx9iAjpl+I
|
||||
SQrkBnixbvZDaPsA3b+vAQmmABW+TbWBr80PaDErva3q2BVIqwisuTxj9877J5nP
|
||||
7Cwpw+ubKQX/bmk5z1Sl1hS4Dc6miT/GI/jY9Swha/jvWvOaSOyFtxXozyTJthHk
|
||||
rrDWLJ/otQKBgHA0dzGXTsJqeg43dbAPusoIo36zizhz9Z80Xg9qu26cmjTwDs+t
|
||||
ESm62mCc99hAW3dZaRdHheG1/kVWVZ9C5F4UQLLM5ROP4rNZBeZcvdiWS1NrC0LJ
|
||||
t5gGVovXmfcz76TFxXWnZUTk+lvXh7uIi3R/RoD5Wm+hKCLkYfLULNFZAoGBAL8b
|
||||
hjYX1lBPohAekoiyCnioOq5mU2QgC5Q2wie+RySnfD0nRat22I843i10ostKP6F5
|
||||
gfW5SSG9Un0FpDy63CdPk4hePqr0JHDZN//lcEReHjHWN7UY+3I+P6lxYmUCKRx0
|
||||
X8pd+i1eCsWO5JNpGq0k5wib8VzRbTSV5CZyBLKJAoGBAJOzVV4JMFiwKhB1S7rQ
|
||||
CfvZ9mVcw1dXNxkmka51ifzDY4m8LKQk6YQj0GepbtM0qXOcuuB6m6ArU2sj2ZRp
|
||||
OMstL3ZtZJJavHZrwmonrVpBk1M962b0VKaLQRsJwnzHk88tPMclmo/qC22fHO9z
|
||||
LRRHIzyAw96gP0rUr/Jh+p0H
|
||||
-----END PRIVATE KEY-----
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#!/bin/bash
|
||||
mariadb mysql -u root -p${MARIADB_ROOT_PASSWORD} -h localhost -e "select 1"
|
||||
|
|
@ -0,0 +1,2 @@
|
|||
#!/bin/bash
|
||||
mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "DROP DATABASE IF EXISTS $1;"
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/bash
|
||||
mariadb -u root -p$MARIADB_ROOT_PASSWORD < /nine/$1.sql
|
||||
mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "GRANT ALL PRIVILEGES ON $1.* TO '$MARIADB_USER'@'%';"
|
||||
|
|
@ -0,0 +1 @@
|
|||
CREATE DATABASE IF NOT EXISTS keycloak;
|
||||
|
|
@ -0,0 +1 @@
|
|||
CREATE DATABASE IF NOT EXISTS nextcloud;
|
||||
|
|
@ -0,0 +1 @@
|
|||
CREATE DATABASE IF NOT EXISTS nineboard;
|
||||
|
|
@ -0,0 +1 @@
|
|||
CREATE DATABASE IF NOT EXISTS ninegate;
|
||||
|
|
@ -0,0 +1 @@
|
|||
CREATE DATABASE IF NOT EXISTS wordpress;
|
||||
|
|
@ -0,0 +1,260 @@
|
|||
CHANGELOG
|
||||
=========
|
||||
|
||||
Version 1.11.0
|
||||
--------------
|
||||
|
||||
* Add compatibility up to Nextcloud 25 with PHP 8.1
|
||||
* Bumps phpCAS library to 1.6.1
|
||||
|
||||
|
||||
Version 1.10.0
|
||||
--------------
|
||||
|
||||
* Add compatibility for owncloud 10.10 and up to Nextcloud 24 with PHP 8.0
|
||||
* Bumps phpCAS library to 1.5.0
|
||||
|
||||
|
||||
Version 1.9.0
|
||||
-------------
|
||||
|
||||
* Add setting to allow json-decode for mapped group attribute (see: Issue [#51](https://github.com/felixrupp/user_cas/issues/51))
|
||||
* Add mapping for user-id attribute (see: Issue [#70](https://github.com/felixrupp/user_cas/issues/70))
|
||||
* Add setting for adding default group, based on the user’s name and an optional prefix (see: Issue [75](https://github.com/felixrupp/user_cas/issues/75))
|
||||
* Add setting to protect public share links with CAS (see: Issue [93](https://github.com/felixrupp/user_cas/issues/93))
|
||||
* Possibly fixes WEBDAV problems (see: Issues [57](https://github.com/felixrupp/user_cas/issues/57) and [94](https://github.com/felixrupp/user_cas/issues/94))
|
||||
* Bumps phpCAS library to 1.3.9
|
||||
|
||||
|
||||
Version 1.8.7
|
||||
-------------
|
||||
|
||||
* Raises compatibility to ownCloud 10.6 and Nextcloud 20
|
||||
* Changes the phpCAS Version to specify 1.3.5 or higher (was >= 1.3 before)
|
||||
|
||||
|
||||
Version 1.8.6
|
||||
-------------
|
||||
|
||||
* Raises compatibility to ownCloud 10.5 and Nextcloud 19
|
||||
* Fixes a static file path to the CAS login button logo on ownCloud
|
||||
|
||||
|
||||
Version 1.8.5
|
||||
-------------
|
||||
|
||||
* Improves SingleSignout to only remove CAS authtokens
|
||||
* Fixes Nextcloud login-flow bug (see Issue [#69](https://github.com/felixrupp/user_cas/issues/69)) - thanks to [@pingou2712](https://github.com/pingou2712>)
|
||||
|
||||
|
||||
Version 1.8.4
|
||||
-------------
|
||||
|
||||
* Adds option to disable SingleSignout requests to the ownCloud/Nextcloud instance in admin panel
|
||||
* Adds missing translations for options and readme entries
|
||||
|
||||
|
||||
Version 1.8.3
|
||||
-------------
|
||||
|
||||
* Fixes SingleSignOut feature - thanks to [@pingou2712](https://github.com/pingou2712>)
|
||||
* Fixes wrong link to Nextcloud AppStore in Readme - thanks to [@Emi94](https://github.com/Emi94)
|
||||
|
||||
|
||||
Version 1.8.2
|
||||
-------------
|
||||
|
||||
* Raises compatibility to ownCloud 10.4
|
||||
* Adds section in README to describe how to disable code integrity checks on dev setups
|
||||
|
||||
|
||||
Version 1.8.1
|
||||
-------------
|
||||
|
||||
* Raises compatibility to Nextcloud 18
|
||||
|
||||
* Fixes Nextcloud 18 WebDAV bug - thanks to [@landryb](https://github.com/landryb)
|
||||
* Fixes internal ip checks for *»Don’t use Multi-Factor-Authentication on these client-IPs«*
|
||||
* Fixes typo in acceptedStrength \[ECAS\]
|
||||
|
||||
|
||||
Version 1.8.0
|
||||
-------------
|
||||
|
||||
* Drops compatibility for Nextcloud 13
|
||||
* Raises compatibility to Nextcloud 17
|
||||
|
||||
* Fixes a redirect error with enabled enforce-authentication and non-authorized users
|
||||
* Fixes a security bug, where a user, not authorized by any groups, still had the possibility to gain access to a read only account
|
||||
* Fixes deprecated quota handling: all quotas should now be handled correctly (even 'none' and 'default')
|
||||
|
||||
* Adds option to overwrite the CAS login button’s label
|
||||
* Adds option to keep CAS-ticket-ids in URL (see [Issue #17](https://github.com/felixrupp/user_cas/issues/17))
|
||||
* Adds feature to use CAS Single-Logout
|
||||
|
||||
* Bumps phpCAS library to 1.3.8
|
||||
|
||||
|
||||
Version 1.7.4
|
||||
-------------
|
||||
|
||||
* Fixes CAS logout service backlink
|
||||
|
||||
|
||||
Version 1.7.3
|
||||
-------------
|
||||
|
||||
* Raises compatibility to ownCloud 10.3
|
||||
* Adds support for cas server path "/" - thanks to [@dattn](https://github.com/dattn)
|
||||
|
||||
|
||||
Version 1.7.2
|
||||
-------------
|
||||
|
||||
* Fixes double synchronisation of DisplayName, causing overlays in DisplayName on first login
|
||||
* Fixes problems with local database users being converted to user_cas backend by accident
|
||||
* Fixes logout handling to not need a list of Logout Servers anymore
|
||||
|
||||
* Adds error handling when CAS basic config is missing or truncated
|
||||
* Adds the license file for AGPL 3.0 or later
|
||||
* Adds ActiveDirectory import OCC command, let’s you import specific LDAP users as user_cas users to your ownCloud/Nextcloud instance
|
||||
* Adds options for group name filter and group umlaut replacement in "Groups" panel
|
||||
|
||||
|
||||
Version 1.7.1
|
||||
-------------
|
||||
|
||||
* Raises compatibility to ownCloud 10.2 and Nextcloud 16
|
||||
* Fixes Create-/UpdateCommand and synchronisation with the user_cas-Backend
|
||||
* Fixes user autocreation process and synchronisation with the user_cas-Backend
|
||||
* Fixes Nextcloud detection algorithm, it does not depend on a user-editable string anymore
|
||||
|
||||
|
||||
Version 1.7.0
|
||||
-------------
|
||||
|
||||
* Adds OCC commands to create and update CAS users directly via command line
|
||||
* Adds user quota mapping input in Settings Panel - user quota overwrites group quotas
|
||||
* Adds a filter to disable multi-factor-authentication for internal IP addresses on ECAS instances
|
||||
* Raises the ECAS client-version to 2.1.3
|
||||
* Fixes postLogin signals signature
|
||||
|
||||
|
||||
Version 1.6.2
|
||||
-------------
|
||||
* Changes default value of the autocreate option to "on"
|
||||
* Fixes postLogin signals signature
|
||||
|
||||
|
||||
Version 1.6.1
|
||||
-------------
|
||||
* Fixes 5min logout bug on Nextcloud
|
||||
* Unifies log levels in LoggingService
|
||||
* Moves hook registration to a higher level to ensure working postLoginHook
|
||||
|
||||
|
||||
Version 1.6.0
|
||||
-------------
|
||||
* Adds compatibility for ownCloud 10.1 and Nextcloud 15
|
||||
* Fixes app initialization to minimize incompatibilities with other apps
|
||||
* Removes hard app stopping when no phpCAS library is found
|
||||
* Updates jasig/phpcas to 1.3.6
|
||||
|
||||
|
||||
Version 1.5.6
|
||||
-------------
|
||||
* Changes most of the INFO log writes to DEBUG
|
||||
|
||||
|
||||
Version 1.5.5
|
||||
-------------
|
||||
* Adds Support for ownCloud 10.0.10 and Nextcloud 14.0.0
|
||||
|
||||
|
||||
Version 1.5.4
|
||||
-------------
|
||||
* Fixes Nextcloud log flood bug
|
||||
* Fixes documentation links in info.xml
|
||||
* Fixes ownCloud/Nextcloud Session Token-Password bug
|
||||
* Fixes enforce authentication issues with Database Backend
|
||||
* Fixes enforce authentication issues with public gallery interface
|
||||
|
||||
|
||||
* Adds support for ownCloud until version 10.0.9 and Nextcloud until version 13.0.6
|
||||
* Adds documentation for basic installation via release archive
|
||||
|
||||
|
||||
* Removes hardcoded PHP version requirements
|
||||
|
||||
|
||||
Version 1.5.3
|
||||
-------------
|
||||
* Hotfixes the IP address range separator in the exclude specific IPs field and changes it from "/" to "-"
|
||||
* Fixes ownCloud 10.0.8 bug and raises compatibility to 10.0.8
|
||||
|
||||
Version 1.5.2
|
||||
-------------
|
||||
* Add settings field to exclude specific Ips and/or IP-ranges from force login
|
||||
* Nextcloud: Move settings panel to section "Security" (was in "Additional" before)
|
||||
* Remove the signature from repo (if you need a signed version, please use one of the release packages or download from ownCloud Market/Nextcloud AppStore)
|
||||
|
||||
Version 1.5.1
|
||||
-------------
|
||||
* Hotfixes wrong links in 403 error page if enforce authentication was on
|
||||
* Hotfixes wrong translation in 403 error page for ECAS instances
|
||||
* Removes return type hints not compatible with PHP 5.6
|
||||
* Adds functionality to provide more than one mapping field to ownCloud userdata fields (e.g. DisplayName can now be concatenated by a firstname and a lastname CAS-field)
|
||||
|
||||
Version 1.5.0
|
||||
-------------
|
||||
* Drop ownCloud 9 support
|
||||
* Major source code optimizations, fix several errors associated with redirection after login
|
||||
* Add ECAS support
|
||||
* Add authorization feature via groups
|
||||
* Add error views for when not authorized or when the CAS-Client throws errors
|
||||
* Support for ownCloud oauth2 App, it’s now possible to authenticate a desktop or mobile phone client with CAS via oauth2 provider
|
||||
|
||||
Version 1.4.9
|
||||
-------------
|
||||
* Hotfixes the autocreate bug, mentioned in Issue [#13](https://github.com/felixrupp/user_cas/issues/13).
|
||||
|
||||
Version 1.4.8
|
||||
-------------
|
||||
* Hotfixes the current 1.4 version to fix a major bug preventing the OCS-Api to work, while the user_cas app is installed and enabled.
|
||||
|
||||
Version 1.4.7
|
||||
-------------
|
||||
* Hotfixes the min version and **lowers it to 9.1.6**
|
||||
|
||||
Version 1.4.6
|
||||
-------------
|
||||
* Hotfix for app initialization
|
||||
|
||||
Version 1.4.5
|
||||
-------------
|
||||
* Fix for autocreate bug
|
||||
* Re-add phpcas path to use custom phpcas library, if wanted
|
||||
* Remove GIT submodule for jasig phpcas
|
||||
* Add composer dependencies instead
|
||||
* **Raise minimum Owncloud Version to 10.0**
|
||||
|
||||
Version 1.4.2, 1.4.3, 1.4.4
|
||||
---------------------------
|
||||
* Hotfixes for logging
|
||||
|
||||
Version 1.4.1
|
||||
-------------
|
||||
* Hotfix for group and protected group handling
|
||||
|
||||
Version 1.4.0
|
||||
-------------
|
||||
* Completely rewritten in object oriented code, based on Owncloud 9.1 app programming guidelines
|
||||
|
||||
Version 0.1.1
|
||||
-------------
|
||||
* Added CSRF protection on setting form
|
||||
* Use openssl_random_pseudo_bytes instead of mt_rand (if available)
|
||||
|
||||
Version 0.1
|
||||
-------------
|
||||
* Initial plugin
|
||||
|
|
@ -0,0 +1,21 @@
|
|||
## Submitting issues
|
||||
|
||||
If you have questions about how to install or use ownCloud, please direct these to the [mailing list][mailinglist], the [forum][forum] or the [IRC Chat][irc].
|
||||
|
||||
### Guidelines
|
||||
* Please search the existing issues first, it's likely that your issue was already reported or even fixed.
|
||||
- Go to one of the repositories, click "issues" and type any word in the top search/command bar.
|
||||
- You can also filter by appending e. g. "state:open" to the search string.
|
||||
- More info on [search syntax within github](https://help.github.com/articles/searching-issues)
|
||||
* This repository ([user_cas](https://github.com/felixrupp/user_cas/issues)) is *only* for issues within the ownCloud user_cas code.
|
||||
* __SECURITY__: Report any potential security bug to security@owncloud.com following our [security policy](https://owncloud.org/security/) instead of filing an issue in our bug tracker
|
||||
* Report the issue using our template, it includes all the information we need to track down the issue.
|
||||
|
||||
Help us to maximize the effort we can spend fixing issues and adding new features, by not reporting duplicate issues.
|
||||
|
||||
[mailinglist]: https://mailman.owncloud.org/mailman/listinfo/owncloud
|
||||
[forum]: https://central.owncloud.org
|
||||
[irc]: https://webchat.freenode.net/?channels=owncloud&uio=d4
|
||||
|
||||
### Contribute Code and translations
|
||||
Please check [core's contribution guidelines](https://github.com/owncloud/core/blob/master/CONTRIBUTING.md) for further information about contributing code and translations.
|
||||
|
|
@ -0,0 +1,614 @@
|
|||
GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
|
||||
Version 3, 19 November 2007
|
||||
|
||||
Copyright (C) 2007 Free Software Foundation, Inc. <http s ://fsf.org/>
|
||||
|
||||
Everyone is permitted to copy and distribute verbatim copies of this license
|
||||
document, but changing it is not allowed.
|
||||
|
||||
Preamble
|
||||
|
||||
The GNU Affero General Public License is a free, copyleft license for software
|
||||
and other kinds of works, specifically designed to ensure cooperation with
|
||||
the community in the case of network server software.
|
||||
|
||||
The licenses for most software and other practical works are designed to take
|
||||
away your freedom to share and change the works. By contrast, our General
|
||||
Public Licenses are intended to guarantee your freedom to share and change
|
||||
all versions of a program--to make sure it remains free software for all its
|
||||
users.
|
||||
|
||||
When we speak of free software, we are referring to freedom, not price. Our
|
||||
General Public Licenses are designed to make sure that you have the freedom
|
||||
to distribute copies of free software (and charge for them if you wish), that
|
||||
you receive source code or can get it if you want it, that you can change
|
||||
the software or use pieces of it in new free programs, and that you know you
|
||||
can do these things.
|
||||
|
||||
Developers that use our General Public Licenses protect your rights with two
|
||||
steps: (1) assert copyright on the software, and (2) offer you this License
|
||||
which gives you legal permission to copy, distribute and/or modify the software.
|
||||
|
||||
A secondary benefit of defending all users' freedom is that improvements made
|
||||
in alternate versions of the program, if they receive widespread use, become
|
||||
available for other developers to incorporate. Many developers of free software
|
||||
are heartened and encouraged by the resulting cooperation. However, in the
|
||||
case of software used on network servers, this result may fail to come about.
|
||||
The GNU General Public License permits making a modified version and letting
|
||||
the public access it on a server without ever releasing its source code to
|
||||
the public.
|
||||
|
||||
The GNU Affero General Public License is designed specifically to ensure that,
|
||||
in such cases, the modified source code becomes available to the community.
|
||||
It requires the operator of a network server to provide the source code of
|
||||
the modified version running there to the users of that server. Therefore,
|
||||
public use of a modified version, on a publicly accessible server, gives the
|
||||
public access to the source code of the modified version.
|
||||
|
||||
An older license, called the Affero General Public License and published by
|
||||
Affero, was designed to accomplish similar goals. This is a different license,
|
||||
not a version of the Affero GPL, but Affero has released a new version of
|
||||
the Affero GPL which permits relicensing under this license.
|
||||
|
||||
The precise terms and conditions for copying, distribution and modification
|
||||
follow.
|
||||
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
0. Definitions.
|
||||
|
||||
"This License" refers to version 3 of the GNU Affero General Public License.
|
||||
|
||||
"Copyright" also means copyright-like laws that apply to other kinds of works,
|
||||
such as semiconductor masks.
|
||||
|
||||
"The Program" refers to any copyrightable work licensed under this License.
|
||||
Each licensee is addressed as "you". "Licensees" and "recipients" may be individuals
|
||||
or organizations.
|
||||
|
||||
To "modify" a work means to copy from or adapt all or part of the work in
|
||||
a fashion requiring copyright permission, other than the making of an exact
|
||||
copy. The resulting work is called a "modified version" of the earlier work
|
||||
or a work "based on" the earlier work.
|
||||
|
||||
A "covered work" means either the unmodified Program or a work based on the
|
||||
Program.
|
||||
|
||||
To "propagate" a work means to do anything with it that, without permission,
|
||||
would make you directly or secondarily liable for infringement under applicable
|
||||
copyright law, except executing it on a computer or modifying a private copy.
|
||||
Propagation includes copying, distribution (with or without modification),
|
||||
making available to the public, and in some countries other activities as
|
||||
well.
|
||||
|
||||
To "convey" a work means any kind of propagation that enables other parties
|
||||
to make or receive copies. Mere interaction with a user through a computer
|
||||
network, with no transfer of a copy, is not conveying.
|
||||
|
||||
An interactive user interface displays "Appropriate Legal Notices" to the
|
||||
extent that it includes a convenient and prominently visible feature that
|
||||
(1) displays an appropriate copyright notice, and (2) tells the user that
|
||||
there is no warranty for the work (except to the extent that warranties are
|
||||
provided), that licensees may convey the work under this License, and how
|
||||
to view a copy of this License. If the interface presents a list of user commands
|
||||
or options, such as a menu, a prominent item in the list meets this criterion.
|
||||
|
||||
1. Source Code.
|
||||
|
||||
The "source code" for a work means the preferred form of the work for making
|
||||
modifications to it. "Object code" means any non-source form of a work.
|
||||
|
||||
A "Standard Interface" means an interface that either is an official standard
|
||||
defined by a recognized standards body, or, in the case of interfaces specified
|
||||
for a particular programming language, one that is widely used among developers
|
||||
working in that language.
|
||||
|
||||
The "System Libraries" of an executable work include anything, other than
|
||||
the work as a whole, that (a) is included in the normal form of packaging
|
||||
a Major Component, but which is not part of that Major Component, and (b)
|
||||
serves only to enable use of the work with that Major Component, or to implement
|
||||
a Standard Interface for which an implementation is available to the public
|
||||
in source code form. A "Major Component", in this context, means a major essential
|
||||
component (kernel, window system, and so on) of the specific operating system
|
||||
(if any) on which the executable work runs, or a compiler used to produce
|
||||
the work, or an object code interpreter used to run it.
|
||||
|
||||
The "Corresponding Source" for a work in object code form means all the source
|
||||
code needed to generate, install, and (for an executable work) run the object
|
||||
code and to modify the work, including scripts to control those activities.
|
||||
However, it does not include the work's System Libraries, or general-purpose
|
||||
tools or generally available free programs which are used unmodified in performing
|
||||
those activities but which are not part of the work. For example, Corresponding
|
||||
Source includes interface definition files associated with source files for
|
||||
the work, and the source code for shared libraries and dynamically linked
|
||||
subprograms that the work is specifically designed to require, such as by
|
||||
intimate data communication or control flow between those
|
||||
|
||||
subprograms and other parts of the work.
|
||||
|
||||
The Corresponding Source need not include anything that users can regenerate
|
||||
automatically from other parts of the Corresponding Source.
|
||||
|
||||
The Corresponding Source for a work in source code form is that same work.
|
||||
|
||||
2. Basic Permissions.
|
||||
|
||||
All rights granted under this License are granted for the term of copyright
|
||||
on the Program, and are irrevocable provided the stated conditions are met.
|
||||
This License explicitly affirms your unlimited permission to run the unmodified
|
||||
Program. The output from running a covered work is covered by this License
|
||||
only if the output, given its content, constitutes a covered work. This License
|
||||
acknowledges your rights of fair use or other equivalent, as provided by copyright
|
||||
law.
|
||||
|
||||
You may make, run and propagate covered works that you do not convey, without
|
||||
conditions so long as your license otherwise remains in force. You may convey
|
||||
covered works to others for the sole purpose of having them make modifications
|
||||
exclusively for you, or provide you with facilities for running those works,
|
||||
provided that you comply with the terms of this License in conveying all material
|
||||
for which you do not control copyright. Those thus making or running the covered
|
||||
works for you must do so exclusively on your behalf, under your direction
|
||||
and control, on terms that prohibit them from making any copies of your copyrighted
|
||||
material outside their relationship with you.
|
||||
|
||||
Conveying under any other circumstances is permitted solely under the conditions
|
||||
stated below. Sublicensing is not allowed; section 10 makes it unnecessary.
|
||||
|
||||
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
|
||||
|
||||
No covered work shall be deemed part of an effective technological measure
|
||||
under any applicable law fulfilling obligations under article 11 of the WIPO
|
||||
copyright treaty adopted on 20 December 1996, or similar laws prohibiting
|
||||
or restricting circumvention of such measures.
|
||||
|
||||
When you convey a covered work, you waive any legal power to forbid circumvention
|
||||
of technological measures to the extent such circumvention is effected by
|
||||
exercising rights under this License with respect to the covered work, and
|
||||
you disclaim any intention to limit operation or modification of the work
|
||||
as a means of enforcing, against the work's users, your or third parties'
|
||||
legal rights to forbid circumvention of technological measures.
|
||||
|
||||
4. Conveying Verbatim Copies.
|
||||
|
||||
You may convey verbatim copies of the Program's source code as you receive
|
||||
it, in any medium, provided that you conspicuously and appropriately publish
|
||||
on each copy an appropriate copyright notice; keep intact all notices stating
|
||||
that this License and any non-permissive terms added in accord with section
|
||||
7 apply to the code; keep intact all notices of the absence of any warranty;
|
||||
and give all recipients a copy of this License along with the Program.
|
||||
|
||||
You may charge any price or no price for each copy that you convey, and you
|
||||
may offer support or warranty protection for a fee.
|
||||
|
||||
5. Conveying Modified Source Versions.
|
||||
|
||||
You may convey a work based on the Program, or the modifications to produce
|
||||
it from the Program, in the form of source code under the terms of section
|
||||
4, provided that you also meet all of these conditions:
|
||||
|
||||
a) The work must carry prominent notices stating that you modified it, and
|
||||
giving a relevant date.
|
||||
|
||||
b) The work must carry prominent notices stating that it is released under
|
||||
this License and any conditions added under section 7. This requirement modifies
|
||||
the requirement in section 4 to "keep intact all notices".
|
||||
|
||||
c) You must license the entire work, as a whole, under this License to anyone
|
||||
who comes into possession of a copy. This License will therefore apply, along
|
||||
with any applicable section 7 additional terms, to the whole of the work,
|
||||
and all its parts, regardless of how they are packaged. This License gives
|
||||
no permission to license the work in any other way, but it does not invalidate
|
||||
such permission if you have separately received it.
|
||||
|
||||
d) If the work has interactive user interfaces, each must display Appropriate
|
||||
Legal Notices; however, if the Program has interactive interfaces that do
|
||||
not display Appropriate Legal Notices, your work need not make them do so.
|
||||
|
||||
A compilation of a covered work with other separate and independent works,
|
||||
which are not by their nature extensions of the covered work, and which are
|
||||
not combined with it such as to form a larger program, in or on a volume of
|
||||
a storage or distribution medium, is called an "aggregate" if the compilation
|
||||
and its resulting copyright are not used to limit the access or legal rights
|
||||
of the compilation's users beyond what the individual works permit. Inclusion
|
||||
of a covered work in an aggregate does not cause this License to apply to
|
||||
the other parts of the aggregate.
|
||||
|
||||
6. Conveying Non-Source Forms.
|
||||
|
||||
You may convey a covered work in object code form under the terms of sections
|
||||
4 and 5, provided that you also convey the machine-readable Corresponding
|
||||
Source under the terms of this License, in one of these ways:
|
||||
|
||||
a) Convey the object code in, or embodied in, a physical product (including
|
||||
a physical distribution medium), accompanied by the Corresponding Source fixed
|
||||
on a durable physical medium customarily used for software interchange.
|
||||
|
||||
b) Convey the object code in, or embodied in, a physical product (including
|
||||
a physical distribution medium), accompanied by a written offer, valid for
|
||||
at least three years and valid for as long as you offer spare parts or customer
|
||||
support for that product model, to give anyone who possesses the object code
|
||||
either (1) a copy of the Corresponding Source for all the software in the
|
||||
product that is covered by this License, on a durable physical medium customarily
|
||||
used for software interchange, for a price no more than your reasonable cost
|
||||
of physically performing this conveying of source, or (2) access to copy the
|
||||
Corresponding Source from a network server at no charge.
|
||||
|
||||
c) Convey individual copies of the object code with a copy of the written
|
||||
offer to provide the Corresponding Source. This alternative is allowed only
|
||||
occasionally and noncommercially, and only if you received the object code
|
||||
with such an offer, in accord with subsection 6b.
|
||||
|
||||
d) Convey the object code by offering access from a designated place (gratis
|
||||
or for a charge), and offer equivalent access to the Corresponding Source
|
||||
in the same way through the same place at no further charge. You need not
|
||||
require recipients to copy the Corresponding Source along with the object
|
||||
code. If the place to copy the object code is a network server, the Corresponding
|
||||
Source may be on a different server (operated by you or a third party) that
|
||||
supports equivalent copying facilities, provided you maintain clear directions
|
||||
next to the object code saying where to find the Corresponding Source. Regardless
|
||||
of what server hosts the Corresponding Source, you remain obligated to ensure
|
||||
that it is available for as long as needed to satisfy these requirements.
|
||||
|
||||
e) Convey the object code using peer-to-peer transmission, provided you inform
|
||||
other peers where the object code and Corresponding Source of the work are
|
||||
being offered to the general public at no charge under subsection 6d.
|
||||
|
||||
A separable portion of the object code, whose source code is excluded from
|
||||
the Corresponding Source as a System Library, need not be included in conveying
|
||||
the object code work.
|
||||
|
||||
A "User Product" is either (1) a "consumer product", which means any tangible
|
||||
personal property which is normally used for personal, family, or household
|
||||
purposes, or (2) anything designed or sold for incorporation into a dwelling.
|
||||
In determining whether a product is a consumer product, doubtful cases shall
|
||||
be resolved in favor of coverage. For a particular product received by a particular
|
||||
user, "normally used" refers to a typical or common use of that class of product,
|
||||
regardless of the status of the particular user or of the way in which the
|
||||
particular user actually uses, or expects or is expected to use, the product.
|
||||
A product is a consumer product regardless of whether the product has substantial
|
||||
commercial, industrial or non-consumer uses, unless such uses represent the
|
||||
only significant mode of use of the product.
|
||||
|
||||
"Installation Information" for a User Product means any methods, procedures,
|
||||
authorization keys, or other information required to install and execute modified
|
||||
versions of a covered work in that User Product from a modified version of
|
||||
its Corresponding Source. The information must suffice to ensure that the
|
||||
continued functioning of the modified object code is in no case prevented
|
||||
or interfered with solely because modification has been made.
|
||||
|
||||
If you convey an object code work under this section in, or with, or specifically
|
||||
for use in, a User Product, and the conveying occurs as part of a transaction
|
||||
in which the right of possession and use of the User Product is transferred
|
||||
to the recipient in perpetuity or for a fixed term (regardless of how the
|
||||
transaction is characterized), the Corresponding Source conveyed under this
|
||||
section must be accompanied by the Installation Information. But this requirement
|
||||
does not apply if neither you nor any third party retains the ability to install
|
||||
modified object code on the User Product (for example, the work has been installed
|
||||
in ROM).
|
||||
|
||||
The requirement to provide Installation Information does not include a requirement
|
||||
to continue to provide support service, warranty, or updates for a work that
|
||||
has been modified or installed by the recipient, or for the User Product in
|
||||
which it has been modified or installed. Access to a network may be denied
|
||||
when the modification itself materially and adversely affects the operation
|
||||
of the network or violates the rules and protocols for communication across
|
||||
the network.
|
||||
|
||||
Corresponding Source conveyed, and Installation Information provided, in accord
|
||||
with this section must be in a format that is publicly documented (and with
|
||||
an implementation available to the public in source code form), and must require
|
||||
no special password or key for unpacking, reading or copying.
|
||||
|
||||
7. Additional Terms.
|
||||
|
||||
"Additional permissions" are terms that supplement the terms of this License
|
||||
by making exceptions from one or more of its conditions. Additional permissions
|
||||
that are applicable to the entire Program shall be treated as though they
|
||||
were included in this License, to the extent that they are valid under applicable
|
||||
law. If additional permissions apply only to part of the Program, that part
|
||||
may be used separately under those permissions, but the entire Program remains
|
||||
governed by this License without regard to the additional permissions.
|
||||
|
||||
When you convey a copy of a covered work, you may at your option remove any
|
||||
additional permissions from that copy, or from any part of it. (Additional
|
||||
permissions may be written to require their own removal in certain cases when
|
||||
you modify the work.) You may place additional permissions on material, added
|
||||
by you to a covered work, for which you have or can give appropriate copyright
|
||||
permission.
|
||||
|
||||
Notwithstanding any other provision of this License, for material you add
|
||||
to a covered work, you may (if authorized by the copyright holders of that
|
||||
material) supplement the terms of this License with terms:
|
||||
|
||||
a) Disclaiming warranty or limiting liability differently from the terms of
|
||||
sections 15 and 16 of this License; or
|
||||
|
||||
b) Requiring preservation of specified reasonable legal notices or author
|
||||
attributions in that material or in the Appropriate Legal Notices displayed
|
||||
by works containing it; or
|
||||
|
||||
c) Prohibiting misrepresentation of the origin of that material, or requiring
|
||||
that modified versions of such material be marked in reasonable ways as different
|
||||
from the original version; or
|
||||
|
||||
d) Limiting the use for publicity purposes of names of licensors or authors
|
||||
of the material; or
|
||||
|
||||
e) Declining to grant rights under trademark law for use of some trade names,
|
||||
trademarks, or service marks; or
|
||||
|
||||
f) Requiring indemnification of licensors and authors of that material by
|
||||
anyone who conveys the material (or modified versions of it) with contractual
|
||||
assumptions of liability to the recipient, for any liability that these contractual
|
||||
assumptions directly impose on those licensors and authors.
|
||||
|
||||
All other non-permissive additional terms are considered "further restrictions"
|
||||
within the meaning of section 10. If the Program as you received it, or any
|
||||
part of it, contains a notice stating that it is governed by this License
|
||||
along with a term that is a further restriction, you may remove that term.
|
||||
If a license document contains a further restriction but permits relicensing
|
||||
or conveying under this License, you may add to a covered work material governed
|
||||
by the terms of that license document, provided that the further restriction
|
||||
does not survive such relicensing or conveying.
|
||||
|
||||
If you add terms to a covered work in accord with this section, you must place,
|
||||
in the relevant source files, a statement of the additional terms that apply
|
||||
to those files, or a notice indicating where to find the applicable terms.
|
||||
|
||||
Additional terms, permissive or non-permissive, may be stated in the form
|
||||
of a separately written license, or stated as exceptions; the above requirements
|
||||
apply either way.
|
||||
|
||||
8. Termination.
|
||||
|
||||
You may not propagate or modify a covered work except as expressly provided
|
||||
under this License. Any attempt otherwise to propagate or modify it is void,
|
||||
and will automatically terminate your rights under this License (including
|
||||
any patent licenses granted under the third paragraph of section 11).
|
||||
|
||||
However, if you cease all violation of this License, then your license from
|
||||
a particular copyright holder is reinstated (a) provisionally, unless and
|
||||
until the copyright holder explicitly and finally terminates your license,
|
||||
and (b) permanently, if the copyright holder fails to notify you of the violation
|
||||
by some reasonable means prior to 60 days after the cessation.
|
||||
|
||||
Moreover, your license from a particular copyright holder is reinstated permanently
|
||||
if the copyright holder notifies you of the violation by some reasonable means,
|
||||
this is the first time you have received notice of violation of this License
|
||||
(for any work) from that copyright holder, and you cure the violation prior
|
||||
to 30 days after your receipt of the notice.
|
||||
|
||||
Termination of your rights under this section does not terminate the licenses
|
||||
of parties who have received copies or rights from you under this License.
|
||||
If your rights have been terminated and not permanently reinstated, you do
|
||||
not qualify to receive new licenses for the same material under section 10.
|
||||
|
||||
9. Acceptance Not Required for Having Copies.
|
||||
|
||||
You are not required to accept this License in order to receive or run a copy
|
||||
of the Program. Ancillary propagation of a covered work occurring solely as
|
||||
a consequence of using peer-to-peer transmission to receive a copy likewise
|
||||
does not require acceptance. However, nothing other than this License grants
|
||||
you permission to propagate or modify any covered work. These actions infringe
|
||||
copyright if you do not accept this License. Therefore, by modifying or propagating
|
||||
a covered work, you indicate your acceptance of this License to do so.
|
||||
|
||||
10. Automatic Licensing of Downstream Recipients.
|
||||
|
||||
Each time you convey a covered work, the recipient automatically receives
|
||||
a license from the original licensors, to run, modify and propagate that work,
|
||||
subject to this License. You are not responsible for enforcing compliance
|
||||
by third parties with this License.
|
||||
|
||||
An "entity transaction" is a transaction transferring control of an organization,
|
||||
or substantially all assets of one, or subdividing an organization, or merging
|
||||
organizations. If propagation of a covered work results from an entity transaction,
|
||||
each party to that transaction who receives a copy of the work also receives
|
||||
whatever licenses to the work the party's predecessor in interest had or could
|
||||
give under the previous paragraph, plus a right to possession of the Corresponding
|
||||
Source of the work from the predecessor in interest, if the predecessor has
|
||||
it or can get it with reasonable efforts.
|
||||
|
||||
You may not impose any further restrictions on the exercise of the rights
|
||||
granted or affirmed under this License. For example, you may not impose a
|
||||
license fee, royalty, or other charge for exercise of rights granted under
|
||||
this License, and you may not initiate litigation (including a cross-claim
|
||||
or counterclaim in a lawsuit) alleging that any patent claim is infringed
|
||||
by making, using, selling, offering for sale, or importing the Program or
|
||||
any portion of it.
|
||||
|
||||
11. Patents.
|
||||
|
||||
A "contributor" is a copyright holder who authorizes use under this License
|
||||
of the Program or a work on which the Program is based. The work thus licensed
|
||||
is called the contributor's "contributor version".
|
||||
|
||||
A contributor's "essential patent claims" are all patent claims owned or controlled
|
||||
by the contributor, whether already acquired or hereafter acquired, that would
|
||||
be infringed by some manner, permitted by this License, of making, using,
|
||||
or selling its contributor version, but do not include claims that would be
|
||||
infringed only as a consequence of further modification of the contributor
|
||||
version. For purposes of this definition, "control" includes the right to
|
||||
grant patent sublicenses in a manner consistent with the requirements of this
|
||||
License.
|
||||
|
||||
Each contributor grants you a non-exclusive, worldwide, royalty-free patent
|
||||
license under the contributor's essential patent claims, to make, use, sell,
|
||||
offer for sale, import and otherwise run, modify and propagate the contents
|
||||
of its contributor version.
|
||||
|
||||
In the following three paragraphs, a "patent license" is any express agreement
|
||||
or commitment, however denominated, not to enforce a patent (such as an express
|
||||
permission to practice a patent or covenant not to s ue for patent infringement).
|
||||
To "grant" such a patent license to a party means to make such an agreement
|
||||
or commitment not to enforce a patent against the party.
|
||||
|
||||
If you convey a covered work, knowingly relying on a patent license, and the
|
||||
Corresponding Source of the work is not available for anyone to copy, free
|
||||
of charge and under the terms of this License, through a publicly available
|
||||
network server or other readily accessible means, then you must either (1)
|
||||
cause the Corresponding Source to be so available, or (2) arrange to deprive
|
||||
yourself of the benefit of the patent license for this particular work, or
|
||||
(3) arrange, in a manner consistent with the requirements of this License,
|
||||
to extend the patent
|
||||
|
||||
license to downstream recipients. "Knowingly relying" means you have actual
|
||||
knowledge that, but for the patent license, your conveying the covered work
|
||||
in a country, or your recipient's use of the covered work in a country, would
|
||||
infringe one or more identifiable patents in that country that you have reason
|
||||
to believe are valid.
|
||||
|
||||
If, pursuant to or in connection with a single transaction or arrangement,
|
||||
you convey, or propagate by procuring conveyance of, a covered work, and grant
|
||||
a patent license to some of the parties receiving the covered work authorizing
|
||||
them to use, propagate, modify or convey a specific copy of the covered work,
|
||||
then the patent license you grant is automatically extended to all recipients
|
||||
of the covered work and works based on it.
|
||||
|
||||
A patent license is "discriminatory" if it does not include within the scope
|
||||
of its coverage, prohibits the exercise of, or is conditioned on the non-exercise
|
||||
of one or more of the rights that are specifically granted under this License.
|
||||
You may not convey a covered work if you are a party to an arrangement with
|
||||
a third party that is in the business of distributing software, under which
|
||||
you make payment to the third party based on the extent of your activity of
|
||||
conveying the work, and under which the third party grants, to any of the
|
||||
parties who would receive the covered work from you, a discriminatory patent
|
||||
license (a) in connection with copies of the covered work conveyed by you
|
||||
(or copies made from those copies), or (b) primarily for and in connection
|
||||
with specific products or compilations that contain the covered work, unless
|
||||
you entered into that arrangement, or that patent license was granted, prior
|
||||
to 28 March 2007.
|
||||
|
||||
Nothing in this License shall be construed as excluding or limiting any implied
|
||||
license or other defenses to infringement that may otherwise be available
|
||||
to you under applicable patent law.
|
||||
|
||||
12. No Surrender of Others' Freedom.
|
||||
|
||||
If conditions are imposed on you (whether by court order, agreement or otherwise)
|
||||
that contradict the conditions of this License, they do not excuse you from
|
||||
the conditions of this License. If you cannot convey a covered work so as
|
||||
to satisfy simultaneously your obligations under this License and any other
|
||||
pertinent obligations, then as a consequence you may
|
||||
|
||||
not convey it at all. For example, if you agree to terms that obligate you
|
||||
to collect a royalty for further conveying from those to whom you convey the
|
||||
Program, the only way you could satisfy both those terms and this License
|
||||
would be to refrain entirely from conveying the Program.
|
||||
|
||||
13. Remote Network Interaction; Use with the GNU General Public License.
|
||||
|
||||
Notwithstanding any other provision of this License, if you modify the Program,
|
||||
your modified version must prominently offer all users interacting with it
|
||||
remotely through a computer network (if your version supports such interaction)
|
||||
an opportunity to receive the Corresponding Source of your version by providing
|
||||
access to the Corresponding Source from a network server at no charge, through
|
||||
some standard or customary means of facilitating copying of software. This
|
||||
Corresponding Source shall include the Corresponding Source for any work covered
|
||||
by version 3 of the GNU General Public License that is incorporated pursuant
|
||||
to the following paragraph.
|
||||
|
||||
Notwithstanding any other provision of this License, you have permission to
|
||||
link or combine any covered work with a work licensed under version 3 of the
|
||||
GNU General Public License into a single combined work, and to convey the
|
||||
resulting work. The terms of this License will continue to apply to the part
|
||||
which is the covered work, but the work with which it is combined will remain
|
||||
governed by version 3 of the GNU General Public License.
|
||||
|
||||
14. Revised Versions of this License.
|
||||
|
||||
The Free Software Foundation may publish revised and/or new versions of the
|
||||
GNU Affero General Public License from time to time. Such new versions will
|
||||
be similar in spirit to the present version, but may differ in detail to address
|
||||
new problems or concerns.
|
||||
|
||||
Each version is given a distinguishing version number. If the Program specifies
|
||||
that a certain numbered version of the GNU Affero General Public License "or
|
||||
any later version" applies to it, you have the option of following the terms
|
||||
and conditions either of that numbered version or of any later version published
|
||||
by the Free Software Foundation. If the Program does not specify a version
|
||||
number of the GNU Affero General Public License, you may choose any version
|
||||
ever published by the Free Software Foundation.
|
||||
|
||||
If the Program specifies that a proxy can decide which future versions of
|
||||
the GNU Affero General Public License can be used, that proxy's public statement
|
||||
of acceptance of a version permanently authorizes you to choose that version
|
||||
for the Program.
|
||||
|
||||
Later license versions may give you additional or different permissions. However,
|
||||
no additional obligations are imposed on any author or copyright holder as
|
||||
a result of your choosing to follow a later version.
|
||||
|
||||
15. Disclaimer of Warranty.
|
||||
|
||||
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE
|
||||
LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR
|
||||
OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER
|
||||
EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
|
||||
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM
|
||||
PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR
|
||||
CORRECTION.
|
||||
|
||||
16. Limitation of Liability.
|
||||
|
||||
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL
|
||||
ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM
|
||||
AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL,
|
||||
INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO
|
||||
USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED
|
||||
INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE
|
||||
PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER
|
||||
PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
|
||||
|
||||
17. Interpretation of Sections 15 and 16.
|
||||
|
||||
If the disclaimer of warranty and limitation of liability provided above cannot
|
||||
be given local legal effect according to their terms, reviewing courts shall
|
||||
apply local law that most closely approximates an absolute waiver of all civil
|
||||
liability in connection with the Program, unless a warranty or assumption
|
||||
of liability accompanies a copy of the Program in return for a fee. END OF
|
||||
TERMS AND CONDITIONS
|
||||
|
||||
How to Apply These Terms to Your New Programs
|
||||
|
||||
If you develop a new program, and you want it to be of the greatest possible
|
||||
use to the public, the best way to achieve this is to make it free software
|
||||
which everyone can redistribute and change under these terms.
|
||||
|
||||
To do so, attach the following notices to the program. It is safest to attach
|
||||
them to the start of each source file to most effectively state the exclusion
|
||||
of warranty; and each file should have at least the "copyright" line and a
|
||||
pointer to where the full notice is found.
|
||||
|
||||
<one line to give the program's name and a brief idea of what it does.>
|
||||
|
||||
Copyright (C) <year> <name of author>
|
||||
|
||||
This program is free software: you can redistribute it and/or modify it under
|
||||
the terms of the GNU Affero General Public License as published by the Free
|
||||
Software Foundation, either version 3 of the License, or (at your option)
|
||||
any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful, but WITHOUT
|
||||
ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
|
||||
FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
|
||||
details.
|
||||
|
||||
You should have received a copy of the GNU Affero General Public License along
|
||||
with this program. If not, see <http s ://www.gnu.org/licenses/>.
|
||||
|
||||
Also add information on how to contact you by electronic and paper mail.
|
||||
|
||||
If your software can interact with users remotely through a computer network,
|
||||
you should also make sure that it provides a way for users to get its source.
|
||||
For example, if your program is a web application, its interface could display
|
||||
a "Source" link that leads users to an archive of the code. There are many
|
||||
ways you could offer source, and different solutions will be better for different
|
||||
programs; see section 13 for the specific requirements.
|
||||
|
||||
You should also get your employer (if you work as a programmer) or school,
|
||||
if any, to sign a "copyright disclaimer" for the program, if necessary. For
|
||||
more information on this, and how to apply and follow the GNU AGPL, see <http
|
||||
s://www.gnu.org/licenses/>.
|
||||
|
|
@ -0,0 +1,348 @@
|
|||
INTRODUCTION
|
||||
============
|
||||
|
||||
This App provides CAS authentication support, using the phpCAS library of jasig/apereo.
|
||||
|
||||
INSTALLATION
|
||||
============
|
||||
|
||||
1\. DEPENDENCIES
|
||||
---------------
|
||||
|
||||
- ownCloud >= 10.0.0 and Nextcloud >= 14.0.0
|
||||
- PHP >= 7.3
|
||||
- PHP Extensions:
|
||||
- ext-json
|
||||
- Optional: [Composer Dependency Manager](https://getcomposer.org/), if you want to install via GIT.
|
||||
- Optional: your own phpCAS installation with at least phpCAS 1.3.5.
|
||||
|
||||
This app does not require a standalone version of jasig’s/apereo’s phpCAS any longer. The library is shipped within composer dependencies, in the archive file you downloaded or the Market/App-Store version if used. Although you can configure to use your own version of jasig’s/apereo’s phpCAS library later on.
|
||||
|
||||
2\. Recommended - ownCloud Market:
|
||||
----------------------------
|
||||
|
||||
1. Access the ownCloud web interface with a locally created ownCloud user with admin privileges.
|
||||
2. Navigate to the market in your ownCloud instance.
|
||||
3. Navigate to the Security category and find **CAS user and group backend**.
|
||||
4. Install the app.
|
||||
5. Access the administrations panel => Apps and enable the **CAS user and group backend** app.
|
||||
6. Access the administration panel => User Authentication and configure the app.
|
||||
|
||||
|
||||
3\. Basic - Release archive/Nextcloud Appstore:
|
||||
---------------------------
|
||||
|
||||
1. Download the current stable release from [the github releases page](https://github.com/felixrupp/user_cas/releases) according to your platform (ownCloud or Nextcloud) or use the link provided on [apps.nextcloud.com](https://apps.nextcloud.com/apps/user_cas) for Nextcloud.
|
||||
2. Unzip/Untar the archive.
|
||||
3. Rename the unarchived folder to `user_cas` if not already named like that.
|
||||
4. Move the `user_cas` folder to the apps folder of your platform installation.
|
||||
5. Adjust the settings for the `user_cas` folder according to your webserver setup.
|
||||
6. Access the platform web interface with a locally created platform user with admin privileges.
|
||||
7. Access the administrations panel => Apps and enable the **CAS user and group backend** app.
|
||||
8. Access the administration panel => Security and configure the app.
|
||||
|
||||
|
||||
4\. Advanced for development purposes only – GIT clone with composer:
|
||||
-------------------------
|
||||
|
||||
1. Git clone/copy the downloaded `user_cas` folder into the platform’s apps folder and make sure to set correct permissions for your webserver.
|
||||
2. Change directory inside `user_cas` folder after cloning and perform a `composer update` command if you installed via GIT. The dependencies will be installed. Attention: You will need the [composer](https://getcomposer.org/doc/00-intro.md#installation-linux-unix-osx) binary to be installed.
|
||||
3. Adjust the settings for the `user_cas` folder according to your webserver setup.
|
||||
4. Access the platform web interface with a locally created platform user with admin privileges.
|
||||
5. Access the administrations panel => Apps and enable the **CAS user and group backend** app.
|
||||
6. Access the administration panel => User Authentication/Security and configure the app.
|
||||
|
||||
|
||||
**Be aware that you may need to add the following entry to your config/config.php to prevent warning messages about the missing app signature in your backend:**
|
||||
|
||||
```
|
||||
'integrity.ignore.missing.app.signature' =>
|
||||
array (
|
||||
0 => 'user_cas',
|
||||
),
|
||||
```
|
||||
|
||||
|
||||
CONFIGURATION
|
||||
=============
|
||||
|
||||
The app is configured by using the administration panel. Please make sure to configure with an admin user, authenticated locally against your ownCloud instance (and not against CAS). Make sure to fill in all the fields provided.
|
||||
|
||||
|
||||
CAS Server
|
||||
----------
|
||||
|
||||
**CAS Server Version**: Default is CAS version 3.0, if you have no special configuration leave it as is.
|
||||
|
||||
**CAS Server Hostname**: The host name of the webserver hosting your CAS, lookup /etc/hosts or your DNS configuration or ask your IT-Department.
|
||||
|
||||
**CAS Server Port**: The port CAS is listening to. Default for HTTPS should be `443`.
|
||||
|
||||
**CAS Server Path**: The directory of your CAS. In common setups this path is `/cas`. Use `/` if your CAS is in your document root.
|
||||
|
||||
**Service URL**: Service URL pointing to your plattform used for CAS authentication and redirection. Useful when behind a reverse proxy. This url must end in `/apps/user_cas/login`.
|
||||
|
||||
**Certification file path (.crt)**: If you don't want to validate the certificate (i.e. self-signed certificates) then leave this blank. Otherwise enter the absolute path to the certificate (.crt) on your server, beginning at root level.
|
||||
|
||||
**Use CAS proxy initialization**: If active, the CAS-Client is initialized as a proxy. Default off. Activate only, if you know what you’re doing.
|
||||
|
||||
|
||||
Basic
|
||||
-----
|
||||
|
||||
**Force user login using CAS?**: If checked, users will immediately be redirected to CAS login page, after visiting the ownCloud URL. If checked, *Disable CAS logout* is automatically disabled. Default: off
|
||||
|
||||
**Don’t use force login on these client-IPs**: Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if "Force user login" is enabled (e.g. 192.168.1.1-254,192.168.2.5). Default: empty
|
||||
|
||||
**Disable CAS logout**: If checked, you will only be logged out from ownCloud/Nextcloud and not from your CAS instance. Default: off
|
||||
|
||||
**Autocreate user after first CAS login?**: If checked, users authenticated against CAS are automatically created. This means, users which did not exist in the database yet who authenticate against CAS will be created and stored in the ownCloud database on their first login. Default: on
|
||||
|
||||
**Update user data after each CAS login?**: If checked, the data provided by CAS is used to update ownCloud user attributes each time the user logs in. Default: off
|
||||
|
||||
**Disable CAS SingleSignout**: If checked, SingleSignout requests from your CAS server will be ignored. ownCloud/Nextcloud sessions will not be terminated because of SSO. Default: off
|
||||
|
||||
**SingleSignout Servers**: Provide a list of servers which can send SingleSignout requests for your CAS ticket (leave empty if you do not have to restrict logout to defined servers).
|
||||
|
||||
**Keep CAS-ticket-ids in URL?**: If checked, CAS-ticket-ids are not removed from the URL. Beware: Potential security risk! Only activate, if you know what you are doing. Default off
|
||||
|
||||
**Overwrite Login Button Label**: Overwrites the CAS-Login button label (only used in Nextcloud). Default: empty
|
||||
|
||||
**Protect "public share" links with CAS**: If checked, public share links will be protected by CAS-login. If a user is already logged in with a valid ownCloud/Nexctloud session, no additional CAS-login is needed. Default off
|
||||
|
||||
|
||||
<a name="mapping"></a>
|
||||
|
||||
Mapping
|
||||
-------
|
||||
|
||||
If CAS provides extra attributes, `user_cas` can retrieve the values of them. Since their name differs in various setups it is necessary to map ownCloud-attribute-names to CAS-attribute-names.
|
||||
|
||||
**User-ID**: Name of user-id attribute in CAS. Only fill this out, if you need to use a specific CAS attribute for the user-id. If left empty, the default CAS user-id is used. Default: empty
|
||||
|
||||
**Email**: Name of email attribute in CAS. Default: empty
|
||||
|
||||
**Display Name**: Name of display name attribute(s) in CAS (this might be the "real name" of a user or a combination of two fields like: firstnames+surnames). Default: empty
|
||||
|
||||
**Group**: Name of group attribute in CAS. Default: empty
|
||||
|
||||
**Quota**: Name of quota attribute in CAS. Quota can be a numeric byte value or a human readable string, like 1GB or 512MB. Default: empty
|
||||
|
||||
|
||||
<a name="groups"></a>
|
||||
|
||||
Groups
|
||||
------
|
||||
|
||||
**Locked Groups**: Groups that will not be unlinked. These groups are preserved, when updating a user after login and are not unlinked. Please provide a comma separated list without blanks (eg.: group1,group2). Default: empty
|
||||
|
||||
**Default group (when autocreating users)**: When auto creating users after authentication, these groups are set as default if the user has no CAS groups. Please provide a comma separated list without blanks (eg.: group1,group2). Default: empty
|
||||
|
||||
**Authorized CAS Groups**: Members of these groups are authorized to use the ownCloud instance. This setting is especially helpful, if your CAS instance is not handling authorization itself. Please provide a comma separated list without blanks (eg.: group1,group2). Default: empty
|
||||
|
||||
**Group Quotas**: Define quotas for groups of the users authenticated via CAS. Please provide a comma separated list without blanks and with : between group names and quotas (eg.: group1:10GB,group2:500MB). Default: empty
|
||||
|
||||
**Group Name Filter**: Define a filter (PHP RegExp syntax!) with only the allowed characters for a group name. Group names are cut after 63 characters per definition by ownCloud/Nextcloud core and appended by an horizontal ellipsis. Default when empty: `a-zA-Z0-9\.\-_ @`
|
||||
|
||||
**Group Name: Replace Umlauts**: Activate to filter german umlauts out of the group’s name. Only works, if *Group* in "Mapping" is filled. Default: off
|
||||
|
||||
**Group Name: JSON Decode**: Activate to JSON decode the delivered data in the group field. Only works, if *Group* in "Mapping" is filled and your CAS-Server uses JSON syntax for it. Default: off
|
||||
|
||||
**User’s Default Group**: Create default group for each user with UID and optional prefix. Default: off and no prefix
|
||||
|
||||
|
||||
|
||||
ECAS Settings:
|
||||
--------------
|
||||
|
||||
Since Version 1.5 user_cas provides support for using a European Commission ECAS-Server implementation.
|
||||
|
||||
**Use ECAS Attribute Parser?**: Activate the ECAS attribute parser to enable the parsing of groups provided by the European Commission ECAS implementation (do **NOT** activate until you know what you are doing).
|
||||
|
||||
**Request full user details?**: Activate to request a full user profile in the ECAS callback (do **NOT** activate until you know what you are doing).
|
||||
|
||||
**ECAS Strength**: Set the authentication strength used by the ECAS instance when validating a user’s ticket (do **NOT** select until you know what you are doing).
|
||||
|
||||
**ECAS AssuranceLevel**: Set the assurance level used by the ECAS instance when validating a user’s ticket (do **NOT** select until you know what you are doing).
|
||||
|
||||
**Query ECAS groups**: Define which ECAS groups should be queried when validating a user’s ticket. Please provide a comma separated list without blanks (eg.: GROUP1,GROUP2 or use * for all groups). (Do **NOT** select until you know what you are doing).
|
||||
|
||||
**Don’t use Multi-Factor-Authentication on these client-IPs**: Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if "ECAS AssuranceLevel" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5). (Do **NOT** fill until you know what you are doing).
|
||||
|
||||
|
||||
Import CLI:
|
||||
-----------
|
||||
|
||||
Since Version Version 1.7.2 user_cas provides support for importing users from an ActiveDirectory LDAP.
|
||||
|
||||
#### ActiveDirectory (LDAP): Provide the necessary information to connect to your AD LDAP Server
|
||||
|
||||
**LDAP-Host**: Provide the LDAP-host information. Set the protocol, host and port to use. Default: empty
|
||||
|
||||
**LDAP-User and Domain**: Provide the LDAP user and domain to authenticate the LDAP connection Default: empty
|
||||
|
||||
**LDAP-User Password**: Set the password for the user (see above). Default: empty
|
||||
|
||||
**LDAP Base DN**: Set the LDAP Base Distinguished Name (DN) for the query. Default: empty
|
||||
|
||||
**LDAP Sync Filter**: Define the filter to be used when querying the according user’s from LDAP. Default: empty
|
||||
|
||||
**LDAP Syn Pagesize (1-1500)**: Define the pagesize of the LDAP query response according to your LDAP server’s settings. Default: 1500
|
||||
|
||||
#### CLI Attribute Mapping: Provide the necessary information to map your AD LDAP users to ownCloud
|
||||
|
||||
**UID/Username**: Name of uid/username attribute in your LDAP response. Default: empty
|
||||
|
||||
**Display Name**: Name of display name attribute(s) in your LDAP response (this might be the "real name" of a user or a combination of two fields like: givenname+sn). Default: empty
|
||||
|
||||
**Email**: Name of email attribute in your LDAP response. Default: empty
|
||||
|
||||
**Group**: Name of group attribute in your LDAP response. Default: empty
|
||||
|
||||
**Group Name Field**: Name of the LDAP attribute in your group node to set a group’s name. If no name filed is set or found, the DN of the group will be used as the group’s name. Default: empty
|
||||
|
||||
**Quota**: Name of quota attribute in your LDAP response. Quota can be a numeric byte value or a human readable string, like 1GB or 512MB. Default: empty
|
||||
|
||||
**Enable**: Name of the enable attribute in your LDAP response. This sets the account to enabled/disabled on import, while enabled = 1 and disabled = 0. Default: empty
|
||||
|
||||
**Calculate Enable Attribute Bitwise AND with**: Provide to use a bitwise AND calculation to define the enabled status of the account. Only use if your LDAP’s enabled attribute value is not 0|1. Default: empty
|
||||
|
||||
**Merge Accounts**: Activate to enable account merging. Default: off
|
||||
|
||||
**Prefer Enabled over Disabled Accounts on Merge**: Activate to prefer enabled second accounts over disabled primary accounts. Only works, if *Merge Accounts* is enabled. Default: off
|
||||
|
||||
**Merge two active accounts by**: Name of the attribute in your LDAP response by which you want to merge two activated accounts. Only works, if *Merge Accounts* is enabled. Default: empty
|
||||
|
||||
**Merge two active accounts by: Filterstring**: Define a filterstring for the *Merge by* attribute, that defines which activated account should be preferred on merge. Only works, if *Merge by* is set and *Merge Accounts* is enabled. Default: empty
|
||||
|
||||
|
||||
|
||||
<!--
|
||||
LDAP-Backend:
|
||||
-------------
|
||||
|
||||
**Link to LDAP backend**: Link CAS authentication with LDAP users and groups backend to use the same ownCloud user as if the user was logged in via LDAP.
|
||||
|
||||
-->
|
||||
|
||||
|
||||
PHP-CAS Library
|
||||
---------------
|
||||
|
||||
Setting up the PHP-CAS library options :
|
||||
|
||||
**Overwrite phpCAS path (CAS.php file)**: Set a custom path to a CAS.php file of the jasig/phpcas library version you want to use. Beginning at rootlevel of your server. Default: empty, meaning it uses the composer installed dependency in the `user_cas` folder.
|
||||
|
||||
**PHP CAS debug file**: Set path to a custom phpcas debug file. Beginning at rootlevel of your server. Default: empty
|
||||
|
||||
|
||||
EXTRA INFO
|
||||
==========
|
||||
|
||||
* If you enable the "Autocreate user after CAS login" option, a user will be created if he does not exist. If this option is disabled and the user does not exist, then the user will be not allowed to log into ownCloud. <!-- You might not want this if you check "Link to LDAP backend" -->
|
||||
|
||||
* If you enable the "Update user data" option, the app updates the user's Display Name, Email, Group Membership and Quota on each login.
|
||||
|
||||
By default the CAS App will unlink all the groups from a user and will provide the groups defined at the [**Mapping**](#mapping) attributes. If this mapping is not defined, the value of the *Default group* field will be used instead. If both are undefined, then the user will be set with no groups.
|
||||
If you set the *Locked Groups* field, those groups will not be unlinked from the user.
|
||||
|
||||
|
||||
OCC Commands
|
||||
============
|
||||
|
||||
user_cas has the following OCC commands implemented:
|
||||
|
||||
* cas
|
||||
* cas:create-user (Adds a user_cas user to the database.)
|
||||
* cas:update-user (Updates an existing user and, if not yet a CAS user, converts the record to CAS backend.)
|
||||
* cas:import-users-ad (Imports users from an ActiveDirectory LDAP.)
|
||||
|
||||
|
||||
Create a user:
|
||||
--------------
|
||||
|
||||
cas:create-user [--display-name [DISPLAY-NAME]] [--email [EMAIL]] [-g|--group [GROUP]] [-o|--quota [QUOTA]] [-e|--enabled [ENABLED]] [--] <uid>
|
||||
|
||||
- Parameters (required):
|
||||
- uid: the uid of the user
|
||||
|
||||
- Options (optional):
|
||||
- --display-name: The new display name of the user.
|
||||
- --email: The new email of the user.
|
||||
- -g | --group: The new group of the user, can be used multiple times (e.g. `-g Family -g Work`) to add multiple groups.
|
||||
- -o | --quota: The new quota of the user, either as numerical byte value or human readable value (e.g. 1GB)).
|
||||
- -e | --enabled: Enable or disable the user. Setting `-e 1` enables the user, setting `-e 0` disables the user.
|
||||
|
||||
**Notice: Protected groups will never be unlinked from the user! See also [Groups](#groups).**
|
||||
|
||||
|
||||
Update a user:
|
||||
--------------
|
||||
|
||||
cas:update-user [--display-name [DISPLAY-NAME]] [--email [EMAIL]] [-g|--group [GROUP]] [-o|--quota [QUOTA]] [-e|--enabled [ENABLED]] [-c|--convert-backend [CONVERT-BACKEND]] [--] <uid>
|
||||
|
||||
- Parameters (required):
|
||||
- uid: the uid of the user
|
||||
|
||||
- Options (optional):
|
||||
- --display-name: The new display name of the user.
|
||||
- --email: The new email of the user.
|
||||
- -g | --group: The new group of the user, can be used multiple times (e.g. `-g Family -g Work`) to add multiple groups.
|
||||
- -o | --quota: The new quota of the user, either as numerical byte value or human readable value (e.g. 1GB)).
|
||||
- -e | --enabled: Enable or disable the user. Setting `-e 1` enables the user, setting `-e 0` disables the user.
|
||||
- -c | --convert-backend: Set if the user’s backend should be converted to CAS backend. Setting `-c 1` converts to backend to CAS. **WARNING: This is not revocable!**
|
||||
|
||||
**Notice: Protected groups will never be unlinked from the user! See also [Groups](#groups).**
|
||||
|
||||
|
||||
Import users from ActiveDirectory (LDAP):
|
||||
-----------------------------------------
|
||||
|
||||
cas:import-users-ad [-d|--delta-update [1]] [-c|--convert-backend [1]]
|
||||
|
||||
- Options (optional):
|
||||
- -d | --delta-update: Enable or disable delta updates of accounts. Setting `-d 1` enables account updates.
|
||||
- -c | --convert-backend: Set if the user’s backend should be converted to CAS backend. Setting `-c 1` converts to backend to CAS. **WARNING: This is not revocable!**
|
||||
|
||||
|
||||
**Additional Info:** If you want to automate the ActiveDirectory import, call this command in a cronjob of your webservers user (e.g. `www-data` on debian based linux systems).
|
||||
|
||||
**Additional Info:** If you want additional debug information, use the options `-vv` or `-vvv` in your command, to raise the debug level. To quiet the output, use the option `-q`
|
||||
|
||||
**Example for usage as daily cronjob with delta updates and backend conversion (if needed), output will be zeroed**:
|
||||
|
||||
0 0 * * * /usr/bin/php /path/to/owncloud/occ cas:import-users-ad -d 1 -c 1 -q >/dev/null 2>&1
|
||||
|
||||
|
||||
Bugs and Support
|
||||
==============
|
||||
|
||||
Please contribute bug reports and feedback to [GitHub Issues](https://github.com/felixrupp/user_cas/issues).
|
||||
|
||||
Commercial support and feature implementation is available via [felixrupp.com](http://www.felixrupp.com).
|
||||
|
||||
|
||||
ABOUT
|
||||
=====
|
||||
|
||||
License
|
||||
-------
|
||||
|
||||
AGPL 3.0 or later - http://www.gnu.org/licenses/agpl-3.0.html
|
||||
|
||||
Authors
|
||||
-------
|
||||
|
||||
Current Version, since 1.4.0:
|
||||
* Felix Rupp - [github.com/felixrupp](https://github.com/felixrupp)
|
||||
|
||||
Older Versions:
|
||||
* Sixto Martin Garcia - [github.com/pitbulk](https://github.com/pitbulk)
|
||||
* David Willinger (Leonis Holding) - [github.com/leoniswebDAVe](https://github.com/leoniswebDAVe)
|
||||
* Florian Hintermeier (Leonis Holding) - [github.com/leonisCacheFlo](https://github.com/leonisCacheFlo)
|
||||
* brenard - [github.com/brenard](https://github.com/brenard)
|
||||
|
||||
Links
|
||||
-------
|
||||
* ownCloud - [owncloud.org](http://www.owncloud.org)
|
||||
* ownCloud @ GitHub - [github.com/owncloud](https://github.com/owncloud)
|
||||
|
|
@ -0,0 +1,125 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
use OCA\UserCAS\AppInfo\Application;
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
|
||||
/** @var Application $app */
|
||||
$app = new Application();
|
||||
$c = $app->getContainer();
|
||||
|
||||
$requestUri = (isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '');
|
||||
|
||||
if (\OC_App::isEnabled($c->getAppName()) && !\OC::$CLI) {
|
||||
|
||||
/** @var UserService $userService */
|
||||
$userService = $c->query('UserService');
|
||||
|
||||
/** @var AppService $appService */
|
||||
$appService = $c->query('AppService');
|
||||
|
||||
# Check for valid setup, only enable app if we have at least a CAS host, port and path
|
||||
if ($appService->isSetupValid()) {
|
||||
|
||||
// Register User Backend
|
||||
$userService->registerBackend($c->query('Backend'));
|
||||
|
||||
$loginScreen = (strpos($requestUri, '/login') !== FALSE && strpos($requestUri, '/apps/user_cas/login') === FALSE);
|
||||
$publicShare = (strpos($requestUri, '/index.php/s/') !== FALSE && $appService->arePublicSharesProtected());
|
||||
|
||||
if ($requestUri === '/' || $loginScreen || $publicShare) {
|
||||
|
||||
if ($_SERVER['REQUEST_METHOD'] !== 'POST') { // POST is used for single logout requests
|
||||
|
||||
// Register UserHooks
|
||||
$c->query('UserHooks')->register();
|
||||
|
||||
// URL params and redirect_url cookie
|
||||
setcookie("user_cas_enforce_authentication", "0", 0, '/');
|
||||
$urlParams = '';
|
||||
|
||||
if (isset($_REQUEST['redirect_url'])) {
|
||||
|
||||
$urlParams = $_REQUEST['redirect_url'];
|
||||
// Save the redirect_rul to a cookie
|
||||
$cookie = setcookie("user_cas_redirect_url", "$urlParams", 0, '/');
|
||||
}
|
||||
|
||||
// Register alternative LogIn
|
||||
$appService->registerLogIn();
|
||||
|
||||
/** @var boolean $isEnforced */
|
||||
$isEnforced = $appService->isEnforceAuthentication($_SERVER['REMOTE_ADDR'], $requestUri);
|
||||
|
||||
// Check if public share, if yes, enforce regardless the enforce-flag
|
||||
if($publicShare) {
|
||||
$isEnforced = true;
|
||||
}
|
||||
|
||||
// Check for enforced authentication
|
||||
if ($isEnforced && (!isset($_COOKIE['user_cas_enforce_authentication']) || (isset($_COOKIE['user_cas_enforce_authentication']) && $_COOKIE['user_cas_enforce_authentication'] === '0'))) {
|
||||
|
||||
/** @var LoggingService $loggingService */
|
||||
$loggingService = $c->query("LoggingService");
|
||||
|
||||
$loggingService->write(LoggingService::DEBUG, 'Enforce Authentication was: ' . $isEnforced);
|
||||
setcookie("user_cas_enforce_authentication", '1', 0, '/');
|
||||
|
||||
// Initialize app
|
||||
if (!$appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$appService->init();
|
||||
|
||||
//if (!\phpCAS::isAuthenticated()) {
|
||||
|
||||
$loggingService->write(LoggingService::DEBUG, 'Enforce Authentication was on and phpCAS is not authenticated. Redirecting to CAS Server.');
|
||||
|
||||
$cookie = setcookie("user_cas_redirect_url", urlencode($requestUri), 0, '/');
|
||||
|
||||
header("Location: " . $appService->linkToRouteAbsolute($c->getAppName() . '.authentication.casLogin'));
|
||||
die();
|
||||
//}
|
||||
|
||||
} catch (\OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$loggingService->write(LoggingService::ERROR, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
# Filter DAV requests
|
||||
if(strpos($requestUri, '/remote.php') === FALSE && strpos($requestUri, '/webdav') === FALSE && strpos($requestUri, '/dav') === FALSE) {
|
||||
// Register UserHooks
|
||||
$c->query('UserHooks')->register();
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
$appService->unregisterLogIn();
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,45 @@
|
|||
<?xml version="1.0"?>
|
||||
<info>
|
||||
<id>user_cas</id>
|
||||
<name>CAS user and group backend</name>
|
||||
<description>This app provides in-depth features to authenticate and authorize users against a [jasig/apereo Central Authentication Server (CAS)](https://www.apereo.org/projects/cas). The app provides all necessary options needed to connect to your CAS instance and also advanced features to manage the groups accessible by your CAS infrastructure to implement an authorization feature. This version supports ECAS instances used by the European Commission. Additionally this version supports ActiveDirectory (LDAP) import via commandline. Commercial support for user_cas is available through ownCloud GmbH and myself personally.</description>
|
||||
<summary>Authenticate users against an jasig/apereo CAS Server (https://github.com/apereo/cas)</summary>
|
||||
<licence>AGPL</licence>
|
||||
<screenshot>https://raw.githubusercontent.com/felixrupp/user_cas/master/.github/SCREENSHOTS/splashscreen.png</screenshot>
|
||||
<author>Felix Rupp</author>
|
||||
<namespace>UserCAS</namespace>
|
||||
<version>2.0</version>
|
||||
<types>
|
||||
<prelogin/>
|
||||
<authentication/>
|
||||
</types>
|
||||
|
||||
<category>security</category>
|
||||
|
||||
<website>https://github.com/felixrupp/user_cas</website>
|
||||
|
||||
<documentation>
|
||||
<user>https://github.com/felixrupp/user_cas/blob/master/README.md</user>
|
||||
<admin>https://github.com/felixrupp/user_cas/blob/master/README.md</admin>
|
||||
<developer>https://github.com/felixrupp/user_cas/blob/master/README.md</developer>
|
||||
</documentation>
|
||||
|
||||
<bugs>https://github.com/felixrupp/user_cas/issues</bugs>
|
||||
|
||||
<repository type="git">https://github.com/felixrupp/user_cas.git</repository>
|
||||
|
||||
<dependencies>
|
||||
<owncloud min-version="10.0" max-version="10.10"/>
|
||||
<nextcloud min-version="14" max-version="27.1"/>
|
||||
</dependencies>
|
||||
|
||||
<commands>
|
||||
<command>OCA\UserCAS\Command\CreateUser</command>
|
||||
<command>OCA\UserCAS\Command\UpdateUser</command>
|
||||
<command>OCA\UserCAS\Command\ImportUsersAd</command>
|
||||
</commands>
|
||||
|
||||
<settings>
|
||||
<admin>OCA\UserCAS\Panels\Admin</admin>
|
||||
</settings>
|
||||
</info>
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\AppInfo;
|
||||
|
||||
/** @var \OCA\UserCAS\AppInfo\Application $application */
|
||||
$application = new \OCA\UserCAS\AppInfo\Application();
|
||||
$application->registerRoutes($this, array(
|
||||
'routes' => [
|
||||
array('name' => 'settings#saveSettings', 'url' => '/settings/save', 'verb' => 'POST'),
|
||||
array('name' => 'authentication#casLogin', 'url' => '/login', 'verb' => 'GET'),
|
||||
array('name' => 'authentication#casLogout', 'url' => '/login', 'verb' => 'POST')
|
||||
]
|
||||
));
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"name": "felixrupp/user_cas",
|
||||
"description": "This is the package for Ownclouds 3rd Party App user_cas",
|
||||
"minimum-stability": "stable",
|
||||
"license": "AGPL-3.0-or-later",
|
||||
"authors": [
|
||||
{
|
||||
"name": "Felix Rupp",
|
||||
"email": "kontakt@felixrupp.com"
|
||||
}
|
||||
],
|
||||
"require": {
|
||||
"jasig/phpcas": "^1.6.1",
|
||||
"ec-europa/ecas-phpcas-parser": "^0.3",
|
||||
"php": "^8.1",
|
||||
"ext-json": "*"
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,184 @@
|
|||
{
|
||||
"_readme": [
|
||||
"This file locks the dependencies of your project to a known state",
|
||||
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
|
||||
"This file is @generated automatically"
|
||||
],
|
||||
"content-hash": "df3f3eb256a969fde6cdcd73553ac7d9",
|
||||
"packages": [
|
||||
{
|
||||
"name": "ec-europa/ecas-phpcas-parser",
|
||||
"version": "0.3",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/ec-europa/ecas-phpcas-parser.git",
|
||||
"reference": "1ecfb9a80ab0832580d9dbbdc38632d720659057"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/ec-europa/ecas-phpcas-parser/zipball/1ecfb9a80ab0832580d9dbbdc38632d720659057",
|
||||
"reference": "1ecfb9a80ab0832580d9dbbdc38632d720659057",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"jasig/phpcas": ">=1.3.5 <2.0"
|
||||
},
|
||||
"type": "library",
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"EcasPhpCASParser\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"EUPL"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Gregory Boddin",
|
||||
"email": "gregory@siwhine.net"
|
||||
}
|
||||
],
|
||||
"description": "phpCAS attribute parser for ECAS",
|
||||
"support": {
|
||||
"issues": "https://github.com/ec-europa/ecas-phpcas-parser/issues",
|
||||
"source": "https://github.com/ec-europa/ecas-phpcas-parser/tree/0.3"
|
||||
},
|
||||
"abandoned": true,
|
||||
"time": "2017-04-14T09:26:19+00:00"
|
||||
},
|
||||
{
|
||||
"name": "jasig/phpcas",
|
||||
"version": "1.6.1",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/apereo/phpCAS.git",
|
||||
"reference": "c129708154852656aabb13d8606cd5b12dbbabac"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/apereo/phpCAS/zipball/c129708154852656aabb13d8606cd5b12dbbabac",
|
||||
"reference": "c129708154852656aabb13d8606cd5b12dbbabac",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"ext-curl": "*",
|
||||
"ext-dom": "*",
|
||||
"php": ">=7.1.0",
|
||||
"psr/log": "^1.0 || ^2.0 || ^3.0"
|
||||
},
|
||||
"require-dev": {
|
||||
"monolog/monolog": "^1.0.0 || ^2.0.0",
|
||||
"phpstan/phpstan": "^1.5",
|
||||
"phpunit/phpunit": ">=7.5"
|
||||
},
|
||||
"type": "library",
|
||||
"extra": {
|
||||
"branch-alias": {
|
||||
"dev-master": "1.3.x-dev"
|
||||
}
|
||||
},
|
||||
"autoload": {
|
||||
"files": [
|
||||
"source/CAS.php"
|
||||
],
|
||||
"classmap": [
|
||||
"source/"
|
||||
]
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"Apache-2.0"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "Joachim Fritschi",
|
||||
"email": "jfritschi@freenet.de",
|
||||
"homepage": "https://github.com/jfritschi"
|
||||
},
|
||||
{
|
||||
"name": "Adam Franco",
|
||||
"homepage": "https://github.com/adamfranco"
|
||||
},
|
||||
{
|
||||
"name": "Henry Pan",
|
||||
"homepage": "https://github.com/phy25"
|
||||
}
|
||||
],
|
||||
"description": "Provides a simple API for authenticating users against a CAS server",
|
||||
"homepage": "https://wiki.jasig.org/display/CASC/phpCAS",
|
||||
"keywords": [
|
||||
"apereo",
|
||||
"cas",
|
||||
"jasig"
|
||||
],
|
||||
"support": {
|
||||
"issues": "https://github.com/apereo/phpCAS/issues",
|
||||
"source": "https://github.com/apereo/phpCAS/tree/1.6.1"
|
||||
},
|
||||
"time": "2023-02-19T19:52:35+00:00"
|
||||
},
|
||||
{
|
||||
"name": "psr/log",
|
||||
"version": "3.0.0",
|
||||
"source": {
|
||||
"type": "git",
|
||||
"url": "https://github.com/php-fig/log.git",
|
||||
"reference": "fe5ea303b0887d5caefd3d431c3e61ad47037001"
|
||||
},
|
||||
"dist": {
|
||||
"type": "zip",
|
||||
"url": "https://api.github.com/repos/php-fig/log/zipball/fe5ea303b0887d5caefd3d431c3e61ad47037001",
|
||||
"reference": "fe5ea303b0887d5caefd3d431c3e61ad47037001",
|
||||
"shasum": ""
|
||||
},
|
||||
"require": {
|
||||
"php": ">=8.0.0"
|
||||
},
|
||||
"type": "library",
|
||||
"extra": {
|
||||
"branch-alias": {
|
||||
"dev-master": "3.x-dev"
|
||||
}
|
||||
},
|
||||
"autoload": {
|
||||
"psr-4": {
|
||||
"Psr\\Log\\": "src"
|
||||
}
|
||||
},
|
||||
"notification-url": "https://packagist.org/downloads/",
|
||||
"license": [
|
||||
"MIT"
|
||||
],
|
||||
"authors": [
|
||||
{
|
||||
"name": "PHP-FIG",
|
||||
"homepage": "https://www.php-fig.org/"
|
||||
}
|
||||
],
|
||||
"description": "Common interface for logging libraries",
|
||||
"homepage": "https://github.com/php-fig/log",
|
||||
"keywords": [
|
||||
"log",
|
||||
"psr",
|
||||
"psr-3"
|
||||
],
|
||||
"support": {
|
||||
"source": "https://github.com/php-fig/log/tree/3.0.0"
|
||||
},
|
||||
"time": "2021-07-14T16:46:02+00:00"
|
||||
}
|
||||
],
|
||||
"packages-dev": [],
|
||||
"aliases": [],
|
||||
"minimum-stability": "stable",
|
||||
"stability-flags": [],
|
||||
"prefer-stable": false,
|
||||
"prefer-lowest": false,
|
||||
"platform": {
|
||||
"php": "^8.1",
|
||||
"ext-json": "*"
|
||||
},
|
||||
"platform-dev": [],
|
||||
"plugin-api-version": "2.0.0"
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
.casError{text-align:center!important}
|
||||
|
|
@ -0,0 +1,3 @@
|
|||
.casError {
|
||||
text-align: center !important;
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
#casSettings fieldset{border-bottom:1px solid #ddd;border-left:1px solid #ddd;border-right:1px solid #ddd;margin-bottom:10px}#casSettings input[type=text]{width:15em;margin-left:3px}#casSettings label{display:inline-block;width:31em}#casSettings label.no-indent{width:auto}#casSettings label.checkbox{display:inline;width:auto}#casSettings .csh{font-size:90%}
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
#casSettings fieldset {
|
||||
border-bottom: 1px solid #DDD;
|
||||
border-left: 1px solid #DDD;
|
||||
border-right: 1px solid #DDD;
|
||||
margin-bottom: 10px;
|
||||
}
|
||||
|
||||
#casSettings input[type="text"] {
|
||||
width: 15em;
|
||||
margin-left: 3px;
|
||||
}
|
||||
|
||||
#casSettings label {
|
||||
display: inline-block;
|
||||
width: 31em;
|
||||
}
|
||||
|
||||
#casSettings label.no-indent {
|
||||
width: auto;
|
||||
}
|
||||
|
||||
#casSettings label.checkbox {
|
||||
display: inline;
|
||||
width: auto;
|
||||
}
|
||||
|
||||
#casSettings .csh {
|
||||
font-size: 90%;
|
||||
}
|
||||
|
|
@ -0,0 +1 @@
|
|||
<?xml version="1.0" encoding="UTF-8" standalone="no"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg width="100%" height="100%" viewBox="0 0 32 32" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" xml:space="preserve" xmlns:serif="http://www.serif.com/" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linejoin:round;stroke-miterlimit:1.41421;"><g><path d="M12.641,10.786c0.108,-0.343 0.053,-0.717 -0.149,-1.015c-0.202,-0.298 -0.529,-0.488 -0.888,-0.516c-1.882,-0.125 -5.144,-0.082 -7.016,1.816c-2.37,2.402 -2.489,4.309 -2.507,5.951c-0.027,2.487 1.096,3.794 2.276,4.709c1.391,1.079 4.884,0.932 4.884,0.932l1.16,-2.436c0,0 -1.595,0.152 -3.082,-0.051c-1.71,-0.234 -2.035,-1.692 -2.177,-2.661c-0.228,-1.549 -0.033,-2.358 0.487,-3.41c1.233,-2.491 3.442,-2.751 4.322,-2.695c1.799,0.113 2.371,0.398 2.371,0.398c0,0 0.154,-0.492 0.319,-1.022Z" style="fill:#fff;"/><path d="M16.234,9.599l3.512,0.029l1.535,12.981l-2.957,-0.027l-0.788,-10.836l-4.724,10.924l-3.016,-0.047l6.438,-13.024Z" style="fill:#fff;"/><path d="M12.665,19.56c0,0 1.077,-0.152 1.562,0c0.484,0.153 0.75,0.544 0.75,0.544c0,0 1.288,-2.107 4.047,-2.107c2.759,0 4.247,1.831 4.247,1.831c0,0 -2.254,-2.408 -3.929,-2.495c-1.654,-0.087 -2.112,-0.132 -3.891,0.306c-1.78,0.438 -2.786,1.921 -2.786,1.921Z" style="fill:#fff;"/><path d="M29.919,9.932l-0.933,2.195c0,0 -1.2,-0.359 -2.329,-0.369c-1.129,-0.01 -1.881,0.005 -2.07,1.187c-0.305,1.915 4.24,1.523 4.539,5.538c0.152,2.046 -2.15,4.197 -3.501,4.265c-1.351,0.068 -4.023,-0.069 -4.023,-0.069l-0.089,-2.509c0,0 2.046,0.287 3.009,0.303c1.217,0.019 2.756,-1.949 -0.183,-3.414c-2.101,-1.047 -2.651,-2.16 -2.707,-3.455c-0.055,-1.295 0.4,-2.304 1.318,-3.074c0.92,-0.772 2.563,-1.301 3.877,-1.268c1.314,0.032 3.092,0.67 3.092,0.67Z" style="fill:#fff;"/></g></svg>
|
||||
|
After Width: | Height: | Size: 1.8 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 3.7 KiB |
|
|
@ -0,0 +1,83 @@
|
|||
$(document).ready(function () {
|
||||
|
||||
$('#user_cas #casSettings').tabs();
|
||||
|
||||
// Force Login and Disable Logout
|
||||
$("#user_cas #cas_force_login").on('change', function (event) {
|
||||
|
||||
if ($(this).is(':checked')) {
|
||||
|
||||
$("#user_cas #cas_disable_logout").attr("disabled", true);
|
||||
$("#user_cas #cas_disable_logout").prop('checked', false);
|
||||
|
||||
$("#user_cas #cas_force_login_exceptions").attr("disabled", false);
|
||||
} else {
|
||||
|
||||
$("#user_cas #cas_disable_logout").attr("disabled", false);
|
||||
$("#user_cas #cas_force_login_exceptions").attr("disabled", true);
|
||||
}
|
||||
});
|
||||
|
||||
// LogoutServers and Disable SSO
|
||||
$("#user_cas #cas_disable_singlesignout").on('change', function (event) {
|
||||
|
||||
if ($(this).is(':checked')) {
|
||||
|
||||
$("#user_cas #cas_handlelogout_servers").attr("disabled", true);
|
||||
} else {
|
||||
|
||||
$("#user_cas #cas_handlelogout_servers").attr("disabled", false);
|
||||
}
|
||||
});
|
||||
|
||||
$("#user_cas #casSettingsSubmit").on('click', function (event) {
|
||||
|
||||
event.preventDefault();
|
||||
|
||||
//console.log("Submit button clicked.");
|
||||
|
||||
var postData = $('#user_cas').serialize();
|
||||
var method = $('#user_cas').attr('method');
|
||||
var url = OC.generateUrl('/apps/user_cas/settings/save');
|
||||
|
||||
$.ajax({
|
||||
method: method,
|
||||
url: url,
|
||||
data: postData,
|
||||
success: function (data) {
|
||||
|
||||
var notification = OC.Notification.show(data.message);
|
||||
|
||||
setTimeout(function () {
|
||||
OC.Notification.hide(notification);
|
||||
}, 5000);
|
||||
|
||||
},
|
||||
error: function (data) {
|
||||
|
||||
var notification = OC.Notification.show(data.message);
|
||||
|
||||
setTimeout(function () {
|
||||
OC.Notification.hide(notification);
|
||||
}, 5000);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
$('input[type=range]').on('input', function () {
|
||||
$(this).trigger('change');
|
||||
});
|
||||
|
||||
$('#cas_import_ad_sync_pagesize').on ('change', function() {
|
||||
|
||||
console.log($(this).val());
|
||||
$("#cas_import_ad_sync_pagesize_value").val($(this).val());
|
||||
});
|
||||
|
||||
$('#cas_import_ad_sync_pagesize_value').on('keyup', function() {
|
||||
|
||||
console.log($(this).val());
|
||||
$("#cas_import_ad_sync_pagesize").val($(this).val());
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1 @@
|
|||
$(document).ready(function(){$("#user_cas #casSettings").tabs();$("#user_cas #cas_force_login").on("change",function(event){if($(this).is(":checked")){$("#user_cas #cas_disable_logout").attr("disabled",true);$("#user_cas #cas_disable_logout").prop("checked",false);$("#user_cas #cas_force_login_exceptions").attr("disabled",false);}else{$("#user_cas #cas_disable_logout").attr("disabled",false);$("#user_cas #cas_force_login_exceptions").attr("disabled",true);}});$("#user_cas #cas_disable_singlesignout").on("change",function(event){if($(this).is(":checked")){$("#user_cas #cas_handlelogout_servers").attr("disabled",true);}else{$("#user_cas #cas_handlelogout_servers").attr("disabled",false);}});$("#user_cas #casSettingsSubmit").on("click",function(event){event.preventDefault();var postData=$("#user_cas").serialize();var method=$("#user_cas").attr("method");var url=OC.generateUrl("/apps/user_cas/settings/save");$.ajax({method:method,url:url,data:postData,success:function(data){var notification=OC.Notification.show(data.message);setTimeout(function(){OC.Notification.hide(notification);},5000);},error:function(data){var notification=OC.Notification.show(data.message);setTimeout(function(){OC.Notification.hide(notification);},5000);}});});$("input[type=range]").on("input",function(){$(this).trigger("change");});$("#cas_import_ad_sync_pagesize").on("change",function(){console.log($(this).val());$("#cas_import_ad_sync_pagesize_value").val($(this).val());});$("#cas_import_ad_sync_pagesize_value").on("keyup",function(){console.log($(this).val());$("#cas_import_ad_sync_pagesize").val($(this).val());});});
|
||||
|
|
@ -0,0 +1,86 @@
|
|||
OC.L10N.register(
|
||||
"user_cas",
|
||||
{
|
||||
"CAS Authentication backend": "CAS Authentifizierungsbackend",
|
||||
"CAS Server": "CAS Server",
|
||||
"Basic": "Grundeinstellungen",
|
||||
"Mapping": "Zuordnungen",
|
||||
"phpCAS Library": "phpCAS Bibliothek",
|
||||
"CAS Server Version": "CAS Server Version",
|
||||
"CAS Server Hostname": "CAS Server Hostname",
|
||||
"CAS Server Port": "CAS Server Port",
|
||||
"CAS Server Path": "CAS Server Pfad",
|
||||
"Service URL": "Dienst URL",
|
||||
"Certification file path (.crt).": "Pfad zur Zertifikatsdatei (.crt).",
|
||||
"Leave empty if you don’t want to validate your CAS server instance": "Nicht ausfüllen, wenn Sie ihren CAS-Server nicht validieren möchten",
|
||||
"Use CAS proxy initialization": "CAS Proxy Initialisierung verwenden",
|
||||
"Force user login using CAS?": "CAS Login erzwingen?",
|
||||
"Don’t use force login on these client-IPs": "Login bei diesen Client-IPs nicht erzwingen",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)": "Kommagetrennte Liste an Client-IP-Adressen (oder Adressräumen), die nicht zum Login gezwungen werden, wenn \"CAS Login erzwingen\" aktiviert ist (z.B: 192.168.1.1-254,192.168.2.5)",
|
||||
"Disable CAS logout (do not logout CAS-session, only instance-session)": "CAS Logout deaktivieren (nicht die CAS-Session, sondern nur die Instanz-Session ausloggen)",
|
||||
"Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)": "CAS SingleSignout deaktivieren (nicht die Instanz-Session ausloggen, wenn der CAS-Server einen SSO-Request sendet)",
|
||||
"SingleSignout Servers": "Logout Server",
|
||||
"Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)": "Kommagetrennte Liste an Servern, die SingleSingout-Requests an ihren CAS-Server senden dürfen (Nicht ausfüllen, wenn Sie SingleSignouts nicht beschränken/erlauben müssen)",
|
||||
"Autocreate user after first CAS login?": "Benutzer nach erstem CAS Login automatisch erstellen?",
|
||||
"Keep CAS-ticket-ids in URL?": "CAS-Ticket-IDs nicht aus der URL entfernen",
|
||||
"Beware: Potential security risk! Only activate, if you know what you are doing.": "Achtung: Potentielles Sicherheitsrisiko! Nur aktivieren, wenn Sie wissen, was Sie tun.",
|
||||
"Overwrite Login Button Label": "Login Button Label überschreiben",
|
||||
"Protect \"public share\" links with CAS": "Öffentliche Teilen-Links mit CAS schützen",
|
||||
"Link CAS authentication with LDAP users and groups backend": "CAS Authentifizierung mit LDAP Backend verknüpfen",
|
||||
"Update user data after each CAS login?": "Benutzerdaten nach jedem CAS Login aktualisieren?",
|
||||
"Locked Groups": "Geschützte Gruppen",
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and the owncloud": "Gruppen, die beim Synchronisieren mit dem CAS Server nicht vom ownCloud Benutzer entfernt werden",
|
||||
"Multivalued field, use comma to separate values": "Mehrzeiliges Feld, nutzen Sie komma separierte Werte",
|
||||
"Default Group": "Standardgruppe",
|
||||
"Default group when autocreating users and no group data was found for the user": "Standardgruppe, die beim automatischen Neuerstellen von ownCloud Benutzern vergeben wird",
|
||||
"Authorized CAS Groups": "Authorisierte CAS Gruppen",
|
||||
"Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately": "Benutzer in den folgenden Gruppen können sich in ownCloud anmelden, Benutzer, die nicht in einer der Gruppen sind, werden sofort ausgeloggt",
|
||||
"Group Quotas": "Gruppenquotas",
|
||||
"Use ECAS Attribute Parser?": "ECAS Attribute Parser verwenden?",
|
||||
"Request full user details?": "Vollständige Benutzerdetails anfordern?",
|
||||
"ECAS Strength": "ECAS Strength",
|
||||
"Not set": "Nicht gesetzt",
|
||||
"ECAS AssuranceLevel": "ECAS AssuranceLevel",
|
||||
"Query ECAS groups": "Gruppen in ECAS-Abfrage",
|
||||
"Note down all groups which you want to receive from your ECAS instance, * returns all groups": "Setzen Sie alle Gruppen, die Sie von Ihrer ECAS-Instanz zurück erhalten möchten, * gibt alle Gruppen zurück",
|
||||
"Don’t use Multi-Factor-Authentication on these client-IPs": "Multi-Faktor-Authentifizierung bei diesen Client-IPs deaktivieren",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)": "Kommagetrennte Liste an Client-IP-Adressen (oder Adressräumen), die nicht zur Multi-Faktor-Authentifizierung gezwungen werden, wenn der \"ECAS AssuranceLevel\" mindestens MEDIUM ist (z.B: 192.168.1.1-254,192.168.2.5)",
|
||||
"User-ID": "Benutzername",
|
||||
"Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used.": "Verwenden Sie das Attribut nur, wenn Sie ein spezifisches CAS-Attribut als Benutzername verwenden wollen. Lassen Sie das Attribut leer, um den Standard CAS Benutzernamen zu verwenden.",
|
||||
"Email": "E-Mail",
|
||||
"Display Name": "Anzeigename",
|
||||
"Groups": "Gruppen",
|
||||
"Group Name: JSON Decode": "Gruppen Name: JSON-Decode aktivieren",
|
||||
"Overwrite phpCAS path (CAS.php file)": "phpCAS Pfad überschreiben (CAS.php Datei)",
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own version. Leave blank to use the shipped version.": "Optional: Überschreiben Sie den phpCAS Pfad (CAS.php Datei), wenn Sie eine eigene Version verwenden möchten. Nicht ausfüllen, wenn Sie die Standardversion verwenden möchten",
|
||||
"PHP CAS debug file": "PHP CAS debug Datei",
|
||||
"Save": "Speichern",
|
||||
"Your CAS settings have been updated.": "Ihre CAS Einstellungen wurden gespeichert.",
|
||||
"Your CAS settings could not be updated. Please try again.": "Ihre CAS Einstellungen konnten nicht gespeichert werden. Bitte versuchen Sie es erneut.",
|
||||
"Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you.": "Verboten. Sie haben keinen Zugriff auf diese Anwendung. Bitte wenden Sie sich an Ihren Administrator, wenn Sie denken, dass etwas nicht stimmt.",
|
||||
"You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you.": "Sie haben keinen Zugriff auf diese JRCbox Anwendung. Bitte wenden Sie sich an den JRCbox Administrator, wenn Sie denken, dass etwas nicht stimmt.",
|
||||
"Internal Server Error. The server encountered an error. Please try again.": "Interner Serverfehler. Die Serveranfrage war fehlerhaft, bitte versuchen Sie es erneut.",
|
||||
"Go back to the login page": "Zurück zur Startseite",
|
||||
|
||||
"Import CLI": "Import CLI",
|
||||
"ActiveDirectory (LDAP)": "ActiveDirectory (LDAP)",
|
||||
"LDAP Host": "LDAP Host",
|
||||
"LDAP User and Domain": "LDAP Benutzer und Domain",
|
||||
"LDAP User Password": "LDAP Benutzerpasswort",
|
||||
"LDAP Base DN": "LDAP Basis DN",
|
||||
"LDAP Sync Filter": "LDAP Sync Filter",
|
||||
"LDAP Sync Pagesize (1–1500)": "LDAP Sync Seitengröße (1–1500)",
|
||||
"CLI Attribute Mapping": "CLI Attributzuordnung",
|
||||
"UID/Username": "UID/Benutzername",
|
||||
"Group Name Field": "Gruppen Namensfeld",
|
||||
"Group Name Filter": "Gruppen Namensfeld Filter",
|
||||
"Attention: You must use PHP (PCRE) Regex syntax for the filter.": "Achtung: Sie müssen die PHP (PCRE) Regex Syntax für diesen Filter einhalten.",
|
||||
"Group Name: Replace Umlauts": "Gruppen Name: Ersetze Umlaute",
|
||||
"Enable": "Aktivierung",
|
||||
"Calculate Enable Attribute Bitwise AND with": "Berechne die Nutzer-Aktivierung 'Bitwise AND' mit",
|
||||
"Merge Accounts": "Accounts zusammenführen",
|
||||
"Prefer Enabled over Disabled Accounts on Merge": "Aktivierte Accounts beim Zusammenführen bevorzugen",
|
||||
"Merge Two Active Accounts by": "Zwei aktivierte Accounts zusammenfügen mit Hilfe vom Attribut",
|
||||
"Merge Two Active Accounts by: Filterstring": "Filterstring für das Zusammenfügen zweier aktivierter Accounts"
|
||||
},
|
||||
"nplurals=2; plural=(n != 1);");
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
{
|
||||
"translations": {
|
||||
"CAS Authentication backend": "CAS Authentifizierungsbackend",
|
||||
"CAS Server": "CAS Server",
|
||||
"Basic": "Grundeinstellungen",
|
||||
"Mapping": "Zuordnungen",
|
||||
"phpCAS Library": "phpCAS Bibliothek",
|
||||
"CAS Server Version": "CAS Server Version",
|
||||
"CAS Server Hostname": "CAS Server Hostname",
|
||||
"CAS Server Port": "CAS Server Port",
|
||||
"CAS Server Path": "CAS Server Pfad",
|
||||
"Service URL": "Dienst URL",
|
||||
"Certification file path (.crt).": "Pfad zur Zertifikatsdatei (.crt).",
|
||||
"Leave empty if you don’t want to validate your CAS server instance": "Nicht ausfüllen, wenn Sie ihren CAS-Server nicht validieren möchten",
|
||||
"Use CAS proxy initialization": "CAS Proxy Initialisierung verwenden",
|
||||
"Force user login using CAS?": "CAS Login erzwingen?",
|
||||
"Disable CAS logout (do not logout CAS-session, only instance-session)": "CAS Logout deaktivieren (nicht die CAS-Session, sondern nur die Instanz-Session ausloggen)",
|
||||
"Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)": "CAS SingleSignout deaktivieren (nicht die Instanz-Session ausloggen, wenn der CAS-Server einen SSO-Request sendet)",
|
||||
"Don’t use force login on these client-IPs": "Login bei diesen Client-IPs nicht erzwingen",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)": "Kommagetrennte Liste an Client-IP-Adressen (oder Adressräumen), die nicht zum Login gezwungen werden, wenn \"CAS Login erzwingen\" aktiviert ist (z.B: 192.168.1.1-254,192.168.2.5)",
|
||||
"SingleSignout Servers": "Logout Server",
|
||||
"Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)": "Kommagetrennte Liste an Servern, die SingleSingout-Requests an ihren CAS-Server senden dürfen (Nicht ausfüllen, wenn Sie SingleSignouts nicht beschränken/erlauben müssen)",
|
||||
"Autocreate user after first CAS login?": "Benutzer nach erstem CAS Login automatisch erstellen?",
|
||||
"Keep CAS-ticket-ids in URL?": "CAS-Ticket-IDs nicht aus der URL entfernen",
|
||||
"Beware: Potential security risk! Only activate, if you know what you are doing.": "Achtung: Potentielles Sicherheitsrisiko! Nur aktivieren, wenn Sie wissen, was Sie tun.",
|
||||
"Overwrite Login Button Label": "Login Button Label überschreiben",
|
||||
"Protect \"public share\" links with CAS": "Öffentliche Teilen-Links mit CAS schützen",
|
||||
"Link CAS authentication with LDAP users and groups backend": "CAS Authentifizierung mit LDAP Backend verknüpfen",
|
||||
"Update user data after each CAS login?": "Benutzerdaten nach jedem CAS Login aktualisieren?",
|
||||
"Locked Groups": "Geschützte Gruppen",
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and the owncloud": "Gruppen, die beim Synchronisieren mit dem CAS Server nicht vom ownCloud Benutzer entfernt werden",
|
||||
"Multivalued field, use comma to separate values": "Mehrzeiliges Feld, nutzen Sie komma separierte Werte",
|
||||
"Default Group": "Standardgruppe",
|
||||
"Default group when autocreating users and no group data was found for the user": "Standardgruppe, die beim automatischen Neuerstellen von ownCloud Benutzern vergeben wird",
|
||||
"Authorized CAS Groups": "Authorisierte CAS Gruppen",
|
||||
"Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately": "Benutzer in den folgenden Gruppen können sich in ownCloud anmelden, Benutzer, die nicht in einer der Gruppen sind, werden sofort ausgeloggt",
|
||||
"Group Quotas": "Gruppenquotas",
|
||||
"Use ECAS Attribute Parser?": "ECAS Attribute Parser verwenden?",
|
||||
"Request full user details?": "Vollständige Benutzerdetails anfordern?",
|
||||
"ECAS Strength": "ECAS Strength",
|
||||
"Not set": "Nicht gesetzt",
|
||||
"ECAS AssuranceLevel": "ECAS AssuranceLevel",
|
||||
"Query ECAS groups": "Gruppen in ECAS-Abfrage",
|
||||
"Note down all groups which you want to receive from your ECAS instance, * returns all groups": "Setzen Sie alle Gruppen, die Sie von Ihrer ECAS-Instanz zurück erhalten möchten, * gibt alle Gruppen zurück",
|
||||
"Don’t use Multi-Factor-Authentication on these client-IPs": "Multi-Faktor-Authentifizierung bei diesen Client-IPs deaktivieren",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)": "Kommagetrennte Liste an Client-IP-Adressen (oder Adressräumen), die nicht zur Multi-Faktor-Authentifizierung gezwungen werden, wenn der \"ECAS AssuranceLevel\" mindestens MEDIUM ist (z.B: 192.168.1.1-254,192.168.2.5)",
|
||||
"User-ID": "Benutzername",
|
||||
"Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used.": "Verwenden Sie das Attribut nur, wenn Sie ein spezifisches CAS-Attribut als Benutzername verwenden wollen. Lassen Sie das Attribut leer, um den Standard CAS Benutzernamen zu verwenden.",
|
||||
"Email": "E-Mail",
|
||||
"Display Name": "Anzeigename",
|
||||
"Groups": "Gruppen",
|
||||
"Group Name: JSON Decode": "Gruppen Name: JSON-Decode aktivieren",
|
||||
"Overwrite phpCAS path (CAS.php file)": "phpCAS Pfad überschreiben (CAS.php Datei)",
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own version. Leave blank to use the shipped version.": "Optional: Überschreiben Sie den phpCAS Pfad (CAS.php Datei), wenn Sie eine eigene Version verwenden möchten. Nicht ausfüllen, wenn Sie die Standardversion verwenden möchten",
|
||||
"PHP CAS debug file": "PHP CAS debug Datei",
|
||||
"Save": "Speichern",
|
||||
"Your CAS settings have been updated.": "Ihre CAS Einstellungen wurden gespeichert.",
|
||||
"Your CAS settings could not be updated. Please try again.": "Ihre CAS Einstellungen konnten nicht gespeichert werden. Bitte versuchen Sie es erneut.",
|
||||
"Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you.": "Verboten. Sie haben keinen Zugriff auf diese Anwendung. Bitte wenden Sie sich an Ihren Administrator, wenn Sie denken, dass etwas nicht stimmt.",
|
||||
"You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you.": "Sie haben keinen Zugriff auf diese JRCbox Anwendung. Bitte wenden Sie sich an den JRCbox Administrator, wenn Sie denken, dass etwas nicht stimmt.",
|
||||
"Internal Server Error. The server encountered an error. Please try again.": "Interner Serverfehler. Die Serveranfrage war fehlerhaft, bitte versuchen Sie es erneut.",
|
||||
"Go back to the login page": "Zurück zur Startseite",
|
||||
"Import CLI": "Import CLI",
|
||||
"ActiveDirectory (LDAP)": "ActiveDirectory (LDAP)",
|
||||
"LDAP Host": "LDAP Host",
|
||||
"LDAP User and Domain": "LDAP Benutzer und Domain",
|
||||
"LDAP User Password": "LDAP Benutzerpasswort",
|
||||
"LDAP Base DN": "LDAP Basis DN",
|
||||
"LDAP Sync Filter": "LDAP Sync Filter",
|
||||
"LDAP Sync Pagesize (1–1500)": "LDAP Sync Seitengröße (1–1500)",
|
||||
"CLI Attribute Mapping": "CLI Attributzuordnung",
|
||||
"UID/Username": "UID/Benutzername",
|
||||
"Group Name Field": "Gruppen Namensfeld",
|
||||
"Group Name Filter": "Gruppen Namensfeld Filter",
|
||||
"Attention: You must use PHP (PCRE) Regex syntax for the filter.": "Achtung: Sie müssen die PHP (PCRE) Regex Syntax für diesen Filter einhalten.",
|
||||
"Group Name: Replace Umlauts": "Gruppen Name: Ersetze Umlaute",
|
||||
"Enable": "Aktivierung",
|
||||
"Calculate Enable Attribute Bitwise AND with": "Berechne die Nutzer-Aktivierung 'Bitwise AND' mit",
|
||||
"Merge Accounts": "Accounts zusammenführen",
|
||||
"Prefer Enabled over Disabled Accounts on Merge": "Aktivierte Accounts beim Zusammenführen bevorzugen",
|
||||
"Merge Two Active Accounts by": "Zwei aktivierte Accounts zusammenfügen mit Hilfe vom Attribut",
|
||||
"Merge Two Active Accounts by: Filterstring": "Filterstring für das Zusammenfügen zweier aktivierter Accounts"
|
||||
},
|
||||
"pluralForm": "nplurals=2; plural=(n != 1);"
|
||||
}
|
||||
|
|
@ -0,0 +1,335 @@
|
|||
# Copyright (C) 2017 Felix Rupp
|
||||
# This file is distributed under the same license as the user_cas package.
|
||||
# Felix Rupp <kontakt@felixrupp.com>, 2017.
|
||||
msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: ownCloud Core 8.0.0\n"
|
||||
"Report-Msgid-Bugs-To: translations@owncloud.org\n"
|
||||
"POT-Creation-Date: 2017-07-24 12:40+0000\n"
|
||||
"PO-Revision-Date: 2017-07-24 14:49+0200\n"
|
||||
"Last-Translator: Felix Rupp <kontakt@felixrupp.com>\n"
|
||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
||||
"Language: de\n"
|
||||
"MIME-Version: 1.0\n"
|
||||
"Content-Type: text/plain; charset=UTF-8\n"
|
||||
"Content-Transfer-Encoding: 8bit\n"
|
||||
"Plural-Forms: nplurals=2; plural=(n != 1);\n"
|
||||
"X-Generator: Virtaal 0.7.1\n"
|
||||
|
||||
#: templates/admin.php:7
|
||||
msgid "CAS Authentication backend"
|
||||
msgstr "CAS Authentifizierungsbackend"
|
||||
|
||||
#: templates/admin.php:11
|
||||
msgid "CAS Server"
|
||||
msgstr "CAS Server"
|
||||
|
||||
#: templates/admin.php:12
|
||||
msgid "Basic"
|
||||
msgstr "Grundeinstellungen"
|
||||
|
||||
#: templates/admin.php:13
|
||||
msgid "Mapping"
|
||||
msgstr "Zuordnungen"
|
||||
|
||||
#: templates/admin.php:14
|
||||
msgid "phpCAS Library"
|
||||
msgstr "phpCAS Bibliothek"
|
||||
|
||||
#: templates/admin.php:18
|
||||
msgid "CAS Server Version"
|
||||
msgstr "CAS Server Version"
|
||||
|
||||
#: templates/admin.php:26
|
||||
msgid "CAS Server Hostname"
|
||||
msgstr "CAS Server Hostname"
|
||||
|
||||
#: templates/admin.php:31
|
||||
msgid "CAS Server Port"
|
||||
msgstr "CAS Server Port"
|
||||
|
||||
#: templates/admin.php:36
|
||||
msgid "CAS Server Path"
|
||||
msgstr "CAS Server Pfad"
|
||||
|
||||
#: templates/admin.php:41
|
||||
msgid "Service URL"
|
||||
msgstr "Dienst URL"
|
||||
|
||||
#: templates/admin.php:47
|
||||
msgid "Certification file path (.crt)."
|
||||
msgstr "Pfad zur Zertifikatsdatei (.crt)."
|
||||
|
||||
#: templates/admin.php:47
|
||||
msgid "Leave empty if you don’t want to validate your CAS server instance"
|
||||
msgstr "Nicht ausfüllen, wenn Sie ihren CAS-Server nicht validieren möchten"
|
||||
|
||||
#: templates/admin.php:52
|
||||
msgid "Use CAS proxy initialization"
|
||||
msgstr "CAS Proxy Initialisierung verwenden"
|
||||
|
||||
#: templates/admin.php:54
|
||||
msgid "Force user login using CAS?"
|
||||
msgstr "CAS Login erzwingen?"
|
||||
|
||||
#: templates/admin.php:58
|
||||
msgid "Don’t use force login on these client-IPs"
|
||||
msgstr "Login bei diesen Client-IPs nicht erzwingen"
|
||||
|
||||
#: templates/admin.php:58
|
||||
msgid "Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)"
|
||||
msgstr "Kommagetrennte Liste an Client-IP-Adressen (oder Adressräumen), die nicht zum Login gezwungen werden, wenn \"CAS Login erzwingen\" aktiviert ist (z.B: 192.168.1.1-254,192.168.2.5)"
|
||||
|
||||
#: templates/admin.php:60
|
||||
msgid "Disable CAS logout (do not logout CAS-session, only instance-session)"
|
||||
msgstr "CAS Logout deaktivieren (nicht die CAS-Session, sondern nur die Instanz-Session ausloggen)"
|
||||
|
||||
msgid "Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)"
|
||||
msgstr "CAS SingleSignout deaktivieren (nicht die Instanz-Session ausloggen, wenn der CAS-Server einen SSO-Request sendet)"
|
||||
|
||||
#: templates/admin.php63
|
||||
msgid "SingleSignout Servers"
|
||||
msgstr "Logout Server"
|
||||
|
||||
#: templates/admin.php63
|
||||
msgid "Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)"
|
||||
msgstr "Kommagetrennte Liste an Servern, die SingleSingout-Requests an ihren CAS-Server senden dürfen (Nicht ausfüllen, wenn Sie SingleSignouts nicht beschränken/erlauben müssen)"
|
||||
|
||||
msgid "Keep CAS-ticket-ids in URL?"
|
||||
msgstr "CAS-Ticket-IDs nicht aus der URL entfernen"
|
||||
|
||||
msgid "Beware: Potential security risk! Only activate, if you know what you are doing."
|
||||
msgstr "Achtung: Potentielles Sicherheitsrisiko! Nur aktivieren, wenn Sie wissen, was Sie tun."
|
||||
|
||||
msgid "Overwrite Login Button Label"
|
||||
msgstr "Login Button Label überschreiben"
|
||||
|
||||
msgid "Protect \"public share\" links with CAS"
|
||||
msgstr "Teilen-Links mit CAS schützen"
|
||||
|
||||
#: templates/admin.php:65
|
||||
msgid "Autocreate user after first CAS login?"
|
||||
msgstr "Benutzer nach erstem CAS Login automatisch erstellen?"
|
||||
|
||||
#: templates/admin.php:70
|
||||
msgid "Link CAS authentication with LDAP users and groups backend"
|
||||
msgstr "CAS Authentifizierung mit LDAP Backend verknüpfen"
|
||||
|
||||
#: templates/admin.php:75
|
||||
msgid "Update user data after each CAS login?"
|
||||
msgstr "Benutzerdaten nach jedem CAS Login aktualisieren?"
|
||||
|
||||
#: templates/admin.php:78
|
||||
msgid "Locked Groups"
|
||||
msgstr "Geschützte Gruppen"
|
||||
|
||||
#: templates/admin.php:78
|
||||
msgid ""
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and "
|
||||
"the owncloud"
|
||||
msgstr ""
|
||||
"Gruppen, die beim Synchronisieren mit dem CAS Server nicht vom ownCloud Benutzer entfernt werden"
|
||||
|
||||
#: templates/admin.php:81
|
||||
msgid "Multivalued field, use comma to separate values"
|
||||
msgstr "Mehrzeiliges Feld, nutzen Sie komma separierte Werte"
|
||||
|
||||
#: templates/admin.php:83
|
||||
msgid "Default Group"
|
||||
msgstr "Standardgruppe"
|
||||
|
||||
#: templates/admin.php:83
|
||||
msgid ""
|
||||
"Default group when autocreating users and no group data was found for the "
|
||||
"user"
|
||||
msgstr ""
|
||||
"Standardgruppe, die beim automatischen Neuerstellen von ownCloud Benutzern vergeben "
|
||||
"wird"
|
||||
|
||||
#: templates/admin.php:84
|
||||
msgid "Authorized CAS Groups"
|
||||
msgstr "Authorisierte CAS Gruppen"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately"
|
||||
msgstr "Benutzer in den folgenden Gruppen können sich in ownCloud anmelden, Benutzer, die nicht in einer der Gruppen sind, werden sofort ausgeloggt"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Group Quotas"
|
||||
msgstr "Gruppenquotas"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Use ECAS Attribute Parser?"
|
||||
msgstr "ECAS Attribute Parser verwenden?"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Request full user details?"
|
||||
msgstr "Vollständige Benutzerdetails anfordern?"
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "ECAS Strength"
|
||||
msgstr "ECAS Strength"
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "Not set"
|
||||
msgstr "Nicht gesetzt"
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "ECAS AssuranceLevel"
|
||||
msgstr "ECAS AssuranceLevel"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Query ECAS groups"
|
||||
msgstr "Gruppen in ECAS-Abfrage"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Note down all groups which you want to receive from your ECAS instance, * returns all groups"
|
||||
msgstr "Setzen Sie alle Gruppen, die Sie von Ihrer ECAS-Instanz zurück erhalten möchten, * gibt alle Gruppen zurück"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Don’t use Multi-Factor-Authentication on these client-IPs"
|
||||
msgstr "Multi-Faktor-Authentifizierung bei diesen Client-IPs deaktivieren"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)"
|
||||
msgstr "Kommagetrennte Liste an Client-IP-Adressen (oder Adressräumen), die nicht zur Multi-Faktor-Authentifizierung gezwungen werden, wenn der \"ECAS AssuranceLevel\" mindestens MEDIUM ist (z.B: 192.168.1.1-254,192.168.2.5)"
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "User-ID"
|
||||
msgstr "Benutzername"
|
||||
|
||||
msgid "Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used."
|
||||
msgstr "Verwenden Sie das Attribut nur, wenn Sie ein spezifisches CAS-Attribut als Benutzername verwenden wollen. Lassen Sie das Attribut leer, um den Standard CAS Benutzernamen zu verwenden."
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "Email"
|
||||
msgstr "E-Mail"
|
||||
|
||||
#: templates/admin.php:94
|
||||
msgid "Display Name"
|
||||
msgstr "Anzeigename"
|
||||
|
||||
#: templates/admin.php:99
|
||||
msgid "Groups"
|
||||
msgstr "Gruppen"
|
||||
|
||||
#: templates/admin.php:99
|
||||
msgid "Group Name: JSON Decode"
|
||||
msgstr "Gruppen Name: JSON-Decode aktivieren"
|
||||
|
||||
#: templates/admin.php:107
|
||||
msgid "Overwrite phpCAS path (CAS.php file)"
|
||||
msgstr "phpCAS Pfad überschreiben (CAS.php Datei)"
|
||||
|
||||
#: templates/admin.php:107
|
||||
msgid ""
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own "
|
||||
"version. Leave blank to use the shipped version."
|
||||
msgstr ""
|
||||
"Optional: Überschreiben Sie den phpCAS Pfad (CAS.php Datei), wenn Sie eine "
|
||||
"eigene Version verwenden möchten. Nicht ausfüllen, wenn Sie die "
|
||||
"Standardversion verwenden möchten"
|
||||
|
||||
#: templates/admin.php:112
|
||||
msgid "PHP CAS debug file"
|
||||
msgstr "PHP CAS debug Datei"
|
||||
|
||||
#: templates/admin.php:118
|
||||
msgid "Save"
|
||||
msgstr "Speichern"
|
||||
|
||||
#: lib/Controller/SettingsController.php:140
|
||||
msgid "Your CAS settings have been updated."
|
||||
msgstr "Ihre CAS Einstellungen wurden gespeichert."
|
||||
|
||||
#: lib/Controller/SettingsController.php:146
|
||||
msgid "Your CAS settings could not be updated. Please try again."
|
||||
msgstr "Ihre CAS Einstellungen konnten nicht gespeichert werden. Bitte versuchen Sie es erneut."
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "403"
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "500"
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you."
|
||||
msgstr "Verboten. Sie haben keinen Zugriff auf diese Anwendung. Bitte wenden Sie sich an Ihren Administrator, wenn Sie denken, dass etwas nicht stimmt."
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you."
|
||||
msgstr "Sie haben keinen Zugriff auf diese JRCbox Anwendung. Bitte wenden Sie sich an den JRCbox Administrator, wenn Sie denken, dass etwas nicht stimmt."
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "Internal Server Error. The server encountered an error. Please try again."
|
||||
msgstr "Interner Serverfehler. Die Serveranfrage war fehlerhaft, bitte versuchen Sie es erneut."
|
||||
|
||||
#: templates/cas-error.php:28
|
||||
msgid "Go back to the login page"
|
||||
msgstr "Zurück zur Startseite"
|
||||
|
||||
|
||||
# Import CLI
|
||||
msgid "Import CLI"
|
||||
msgstr "Import CLI"
|
||||
|
||||
|
||||
msgid "ActiveDirectory (LDAP)"
|
||||
msgstr "ActiveDirectory (LDAP)"
|
||||
|
||||
msgid "LDAP Host"
|
||||
msgstr "LDAP Host"
|
||||
|
||||
msgid "LDAP User and Domain"
|
||||
msgstr "LDAP Benutzer und Domain"
|
||||
|
||||
msgid "LDAP User Password"
|
||||
msgstr "LDAP Benutzerpasswort"
|
||||
|
||||
msgid "LDAP Base DN"
|
||||
msgstr "LDAP Basis DN"
|
||||
|
||||
msgid "LDAP Sync Filter"
|
||||
msgstr "LDAP Sync Filter"
|
||||
|
||||
msgid "LDAP Sync Pagesize (1–1500)"
|
||||
msgstr "LDAP Sync Seitengröße (1–1500)"
|
||||
|
||||
|
||||
msgid "CLI Attribute Mapping"
|
||||
msgstr "CLI Attributzuordnung"
|
||||
|
||||
msgid "UID/Username"
|
||||
msgstr "UID/Benutzername"
|
||||
|
||||
msgid "Group Name Field"
|
||||
msgstr "Gruppen Namensfeld"
|
||||
|
||||
msgid "Group Name Filter"
|
||||
msgstr "Gruppen Namensfeld Filter"
|
||||
|
||||
msgid "Attention: You must use PHP (PCRE) Regex syntax for the filter."
|
||||
msgstr "Achtung: Sie müssen die PHP (PCRE) Regex Syntax für diesen Filter einhalten."
|
||||
|
||||
msgid "Group Name: Replace Umlauts"
|
||||
msgstr "Gruppen Name: Ersetze Umlaute"
|
||||
|
||||
msgid "Enable"
|
||||
msgstr "Aktivierung"
|
||||
|
||||
msgid "Calculate Enable Attribute Bitwise AND with"
|
||||
msgstr "Berechne die Nutzer-Aktivierung 'Bitwise AND' mit"
|
||||
|
||||
msgid "Merge Accounts"
|
||||
msgstr "Accounts zusammenführen"
|
||||
|
||||
msgid "Prefer Enabled over Disabled Accounts on Merge"
|
||||
msgstr "Aktivierte Accounts beim Zusammenführen bevorzugen"
|
||||
|
||||
msgid "Merge Two Active Accounts by"
|
||||
msgstr "Zwei aktivierte Accounts zusammenfügen mit Hilfe vom Attribut"
|
||||
|
||||
msgid "Merge Two Active Accounts by: Filterstring"
|
||||
msgstr "Filterstring für das Zusammenfügen zweier aktivierter Accounts"
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
OC.L10N.register(
|
||||
"user_cas",
|
||||
{
|
||||
"CAS Authentication backend": "Authentification CAS",
|
||||
"CAS Server": "Serveur CAS",
|
||||
"Basic": "Basic",
|
||||
"Mapping": "Mapping",
|
||||
"phpCAS Library": "Librairie phpCAS",
|
||||
"CAS Server Version": "Version du serveur CAS",
|
||||
"CAS Server Hostname": "Nom d’hôte du serveur CAS",
|
||||
"CAS Server Port": "Port du serveur CAS",
|
||||
"CAS Server Path": "Chemin du serveur CAS",
|
||||
"Service URL": "URL du service",
|
||||
"Certification file path (.crt).": "Chemin du fichier de certification (.crt).",
|
||||
"Leave empty if you don’t want to validate your CAS server instance": "Laissez vide si vous ne voulez pas valider votre instance de serveur CAS",
|
||||
"Use CAS proxy initialization": "Utiliser l'initialisation du proxy CAS",
|
||||
"Force user login using CAS?": "Forcer la connexion de l'utilisateur en utilisant CAS?",
|
||||
"Don’t use force login on these client-IPs": "N'utilisez pas la connexion forcée sur ces adresses IP client",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)": "Liste des adresses IP (ou plages d'adresses) séparées par des virgules, qui ne sera pas obligée de se connecter si \"Forcer la connexion utilisateur\" est activé (par exemple 192.168.1.1-254, 192.168.2.5)",
|
||||
"Disable CAS logout (do not logout CAS-session, only instance-session)": "Désactiver la déconnexion CAS (ne pas déconnecter la session CAS, déconnecter la session d'instance)",
|
||||
"Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)": "Désactiver la déconnexion unique CAS (ne déconnecte pas la session d'instance si le serveur CAS envoie une demande SSO)",
|
||||
"SingleSignout Servers": "Serveurs de déconnexion",
|
||||
"Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)": "Liste de serveurs séparés par des virgules pouvant envoyer des demandes SingleSignout (laissez vide si vous n'avez pas à limiter SingleSignout à des serveurs définis)",
|
||||
"Autocreate user after first CAS login?": "Créer l'utilisateur automatiquement après la connexion CAS?",
|
||||
"Keep CAS-ticket-ids in URL?": "Gardez CAS-ticket-ids dans l'URL?",
|
||||
"Beware: Potential security risk! Only activate, if you know what you are doing.": "Attention: risque potentiel de sécurité! Activez uniquement si vous savez ce que vous faites.",
|
||||
"Overwrite Login Button Label": "Écraser l'étiquette du bouton de connexion",
|
||||
"Protect \"public share\" links with CAS": "Protéger les liens de «partage public» avec CAS ",
|
||||
"Link CAS authentication with LDAP users and groups backend": "Lier l'authentification CAS avec les utilisateurs et groupe de l'authentification LDAP?",
|
||||
"Update user data after each CAS login?": "Mettre à jour les données utilisateurs après la connexion?",
|
||||
"Locked Groups": "Groupes protégés",
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and the owncloud": "Groupes de l'utilisateur qui seront pas supprimés lors de la synchronisation entre le serveur CAS et Owncloud",
|
||||
"Multivalued field, use comma to separate values": "Champ multivalué, utilisez des virgules pour séparer les valeurs",
|
||||
"Default Group": "Groupe par défaut",
|
||||
"Default group when autocreating users and no group data was found for the user": "Groupe par défaut lors de la création automatique des utilisateurs ownCloud quand aucun groupe n'est trouvé pour l'utilisateur",
|
||||
"Authorized CAS Groups": "Groupes autorisés CAS",
|
||||
"Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately": "Les utilisateurs des groupes suivants pourront se connecter à ownCloud, les utilisateurs ne faisant pas partie d'un groupe seront déconnectés immédiatement",
|
||||
"Group Quotas": "Quotas de groupe",
|
||||
"Use ECAS Attribute Parser?": "Utiliser ECAS Attribute Parser?",
|
||||
"Request full user details?": "Demander des informations complètes sur l'utilisateur?",
|
||||
"ECAS Strength": "ECAS Strength",
|
||||
"Not set": "Pas encore défini",
|
||||
"ECAS AssuranceLevel": "ECAS AssuranceLevel",
|
||||
"Query ECAS groups": "ECAS groupes de requêtes",
|
||||
"Note down all groups which you want to receive from your ECAS instance, * returns all groups": "Notez tous les groupes que vous souhaitez recevoir de votre instance ECAS, * renvoie tous les groupes",
|
||||
"Don’t use Multi-Factor-Authentication on these client-IPs": "N'utilisez pas l'authentification multi-facteurs sur ces IP client",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)": "Liste d'adresses IP client (ou plages d'adresses), séparées par des virgules, qui ne seront pas obligées d'utiliser l'authentification à plusieurs facteurs si \"ECAS AssuranceLevel\" est au moins de MEDIUM (par exemple 192.168.1.1-254, 192.168.2.5)",
|
||||
"User-ID": "Nom d'utilisateur",
|
||||
"Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used.": "Mappez cet attribut uniquement si vous voulez un attribut CAS spécifique comme identifiant de votre utilisateur. S'il est laissé vide, le nom d'utilisateur CAS par défaut est utilisé.",
|
||||
"Email": "Email",
|
||||
"Display Name": "Nom affiché",
|
||||
"Groups": "Groupes",
|
||||
"Group Name: JSON Decode": "Nom du groupe: activer le décodage JSON",
|
||||
"Overwrite phpCAS path (CAS.php file)": "Chemin PHP CAS (fichier CAS.php)",
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own version. Leave blank to use the shipped version.": "Optionnel: Chemin PHP CAS (fichier CAS.php). Laissez vide pour utiliser la version expédiée.",
|
||||
"PHP CAS debug file": "Chemin du fichier de debug de PHP CAS",
|
||||
"Save": "Enregistrer",
|
||||
"Your CAS settings have been updated.": "Vos paramètres CAS ont été mis à jour.",
|
||||
"Your CAS settings could not be updated. Please try again.": "Vos paramètres CAS n'ont pas pu être mis à jour. Veuillez réessayer.",
|
||||
"Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you.": "Interdit. Vous n'avez pas accès à cette application. Veuillez vous adresser à votre administrateur si quelque chose vous semble incorrect.",
|
||||
"You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you.": "Vous n'avez pas accès à cette application JRCbox. Veuillez vous adresser à votre administrateur JRCbox si quelque chose vous semble incorrect.",
|
||||
"Internal Server Error. The server encountered an error. Please try again.": "Erreur Interne du Serveur. Le serveur a rencontré une erreur. Veuillez réessayer.",
|
||||
"Go back to the login page": "Retourner à la page d'accueil",
|
||||
"Import CLI": "Import CLI",
|
||||
"ActiveDirectory (LDAP)": "ActiveDirectory (LDAP)",
|
||||
"LDAP Host": "Hôte LDAP",
|
||||
"LDAP User and Domain": "Utilisateur et domaine LDAP",
|
||||
"LDAP User Password": "Mot de passe utilisateur LDAP",
|
||||
"LDAP Base DN": "LDAP Base DN",
|
||||
"LDAP Sync Filter": "Filtre de synchronisation LDAP",
|
||||
"LDAP Sync Pagesize (1–1500)": "LDAP Sync Pagesize (1–1500)",
|
||||
"CLI Attribute Mapping": "Mappage d'attributs CLI",
|
||||
"UID/Username": "UID/Nom d'utilisateur",
|
||||
"Group Name Field": "Nom du groupe",
|
||||
"Group Name Filter": "Filtre de nom de groupe",
|
||||
"Attention: You must use PHP (PCRE) Regex syntax for the filter.": "Attention: Vous devez utiliser la syntaxe PHP (PCRE) Regex pour le filtre.",
|
||||
"Group Name: Replace Umlauts": "Nom du groupe - Remplacer les trémas",
|
||||
"Enable": "Activer",
|
||||
"Calculate Enable Attribute Bitwise AND with": "Calculer Activer Attribut Bitwise AND avec",
|
||||
"Merge Accounts": "Fusionner des comptes",
|
||||
"Prefer Enabled over Disabled Accounts on Merge": "Préférer activé sur les comptes désactivés lors de la fusion",
|
||||
"Merge Two Active Accounts by": "Fusionner deux comptes actifs par",
|
||||
"Merge Two Active Accounts by: Filterstring": "Fusionner deux comptes actifs par: Filtres"
|
||||
},
|
||||
"nplurals=2; plural=(n != 1);");
|
||||
|
|
@ -0,0 +1,85 @@
|
|||
{
|
||||
"translations": {
|
||||
"CAS Authentication backend": "Authentification CAS",
|
||||
"CAS Server": "Serveur CAS",
|
||||
"Basic": "Basic",
|
||||
"Mapping": "Mapping",
|
||||
"phpCAS Library": "Librairie phpCAS",
|
||||
"CAS Server Version": "Version du serveur CAS",
|
||||
"CAS Server Hostname": "Nom d’hôte du serveur CAS",
|
||||
"CAS Server Port": "Port du serveur CAS",
|
||||
"CAS Server Path": "Chemin du serveur CAS",
|
||||
"Service URL": "URL du service",
|
||||
"Certification file path (.crt).": "Chemin du fichier de certification (.crt).",
|
||||
"Leave empty if you don’t want to validate your CAS server instance": "Laissez vide si vous ne voulez pas valider votre instance de serveur CAS",
|
||||
"Use CAS proxy initialization": "Utiliser l'initialisation du proxy CAS",
|
||||
"Force user login using CAS?": "Forcer la connexion de l'utilisateur en utilisant CAS?",
|
||||
"Don’t use force login on these client-IPs": "N'utilisez pas la connexion forcée sur ces adresses IP client",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)": "Liste des adresses IP (ou plages d'adresses) séparées par des virgules, qui ne sera pas obligée de se connecter si \"Forcer la connexion utilisateur\" est activé (par exemple 192.168.1.1-254, 192.168.2.5)",
|
||||
"Disable CAS logout (do not logout CAS-session, only instance-session)": "Désactiver la déconnexion CAS (ne pas déconnecter la session CAS, déconnecter la session d'instance)",
|
||||
"Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)": "Désactiver la déconnexion unique CAS (ne déconnecte pas la session d'instance si le serveur CAS envoie une demande SSO)",
|
||||
"SingleSignout Servers": "Serveurs de déconnexion",
|
||||
"Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)": "Liste de serveurs séparés par des virgules pouvant envoyer des demandes SingleSignout (laissez vide si vous n'avez pas à limiter SingleSignout à des serveurs définis)",
|
||||
"Autocreate user after first CAS login?": "Créer l'utilisateur automatiquement après la connexion CAS?",
|
||||
"Keep CAS-ticket-ids in URL?": "Gardez CAS-ticket-ids dans l'URL?",
|
||||
"Beware: Potential security risk! Only activate, if you know what you are doing.": "Attention: risque potentiel de sécurité! Activez uniquement si vous savez ce que vous faites.",
|
||||
"Overwrite Login Button Label": "Écraser l'étiquette du bouton de connexion",
|
||||
"Protect \"public share\" links with CAS": "Protéger les liens de «partage public» avec CAS ",
|
||||
"Link CAS authentication with LDAP users and groups backend": "Lier l'authentification CAS avec les utilisateurs et groupe de l'authentification LDAP?",
|
||||
"Update user data after each CAS login?": "Mettre à jour les données utilisateurs après la connexion?",
|
||||
"Locked Groups": "Groupes protégés",
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and the owncloud": "Groupes de l'utilisateur qui seront pas supprimés lors de la synchronisation entre le serveur CAS et Owncloud",
|
||||
"Multivalued field, use comma to separate values": "Champ multivalué, utilisez des virgules pour séparer les valeurs",
|
||||
"Default Group": "Groupe par défaut",
|
||||
"Default group when autocreating users and no group data was found for the user": "Groupe par défaut lors de la création automatique des utilisateurs ownCloud quand aucun groupe n'est trouvé pour l'utilisateur",
|
||||
"Authorized CAS Groups": "Groupes autorisés CAS",
|
||||
"Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately": "Les utilisateurs des groupes suivants pourront se connecter à ownCloud, les utilisateurs ne faisant pas partie d'un groupe seront déconnectés immédiatement",
|
||||
"Group Quotas": "Quotas de groupe",
|
||||
"Use ECAS Attribute Parser?": "Utiliser ECAS Attribute Parser?",
|
||||
"Request full user details?": "Demander des informations complètes sur l'utilisateur?",
|
||||
"ECAS Strength": "ECAS Strength",
|
||||
"Not set": "Pas encore défini",
|
||||
"ECAS AssuranceLevel": "ECAS AssuranceLevel",
|
||||
"Query ECAS groups": "ECAS groupes de requêtes",
|
||||
"Note down all groups which you want to receive from your ECAS instance, * returns all groups": "Notez tous les groupes que vous souhaitez recevoir de votre instance ECAS, * renvoie tous les groupes",
|
||||
"Don’t use Multi-Factor-Authentication on these client-IPs": "N'utilisez pas l'authentification multi-facteurs sur ces IP client",
|
||||
"Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)": "Liste d'adresses IP client (ou plages d'adresses), séparées par des virgules, qui ne seront pas obligées d'utiliser l'authentification à plusieurs facteurs si \"ECAS AssuranceLevel\" est au moins de MEDIUM (par exemple 192.168.1.1-254, 192.168.2.5)",
|
||||
"User-ID": "Nom d'utilisateur",
|
||||
"Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used.": "Mappez cet attribut uniquement si vous voulez un attribut CAS spécifique comme identifiant de votre utilisateur. S'il est laissé vide, le nom d'utilisateur CAS par défaut est utilisé.",
|
||||
"Email": "Email",
|
||||
"Display Name": "Nom affiché",
|
||||
"Groups": "Groupes",
|
||||
"Group Name: JSON Decode": "Nom du groupe: activer le décodage JSON",
|
||||
"Overwrite phpCAS path (CAS.php file)": "Chemin PHP CAS (fichier CAS.php)",
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own version. Leave blank to use the shipped version.": "Optionnel: Chemin PHP CAS (fichier CAS.php). Laissez vide pour utiliser la version expédiée.",
|
||||
"PHP CAS debug file": "Chemin du fichier de debug de PHP CAS",
|
||||
"Save": "Enregistrer",
|
||||
"Your CAS settings have been updated.": "Vos paramètres CAS ont été mis à jour.",
|
||||
"Your CAS settings could not be updated. Please try again.": "Vos paramètres CAS n'ont pas pu être mis à jour. Veuillez réessayer.",
|
||||
"Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you.": "Interdit. Vous n'avez pas accès à cette application. Veuillez vous adresser à votre administrateur si quelque chose vous semble incorrect.",
|
||||
"You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you.": "Vous n'avez pas accès à cette application JRCbox. Veuillez vous adresser à votre administrateur JRCbox si quelque chose vous semble incorrect.",
|
||||
"Internal Server Error. The server encountered an error. Please try again.": "Erreur Interne du Serveur. Le serveur a rencontré une erreur. Veuillez réessayer.",
|
||||
"Go back to the login page": "Retourner à la page d'accueil",
|
||||
"Import CLI": "Import CLI",
|
||||
"ActiveDirectory (LDAP)": "ActiveDirectory (LDAP)",
|
||||
"LDAP Host": "Hôte LDAP",
|
||||
"LDAP User and Domain": "Utilisateur et domaine LDAP",
|
||||
"LDAP User Password": "Mot de passe utilisateur LDAP",
|
||||
"LDAP Base DN": "LDAP Base DN",
|
||||
"LDAP Sync Filter": "Filtre de synchronisation LDAP",
|
||||
"LDAP Sync Pagesize (1–1500)": "LDAP Sync Pagesize (1–1500)",
|
||||
"CLI Attribute Mapping": "Mappage d'attributs CLI",
|
||||
"UID/Username": "UID/Nom d'utilisateur",
|
||||
"Group Name Field": "Nom du groupe",
|
||||
"Group Name Filter": "Filtre de nom de groupe",
|
||||
"Attention: You must use PHP (PCRE) Regex syntax for the filter.": "Attention: Vous devez utiliser la syntaxe PHP (PCRE) Regex pour le filtre.",
|
||||
"Group Name: Replace Umlauts": "Nom du groupe - Remplacer les trémas",
|
||||
"Enable": "Activer",
|
||||
"Calculate Enable Attribute Bitwise AND with": "Calculer Activer Attribut Bitwise AND avec",
|
||||
"Merge Accounts": "Fusionner des comptes",
|
||||
"Prefer Enabled over Disabled Accounts on Merge": "Préférer activé sur les comptes désactivés lors de la fusion",
|
||||
"Merge Two Active Accounts by": "Fusionner deux comptes actifs par",
|
||||
"Merge Two Active Accounts by: Filterstring": "Fusionner deux comptes actifs par: Filtres"
|
||||
},
|
||||
"pluralForm": "nplurals=2; plural=(n != 1);"
|
||||
}
|
||||
|
|
@ -0,0 +1,337 @@
|
|||
# Copyright (C) 2017 Felix Rupp
|
||||
# This file is distributed under the same license as the user_cas package.
|
||||
# Felix Rupp <kontakt@felixrupp.com>, 2017.
|
||||
msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: ownCloud Core 8.0.0\n"
|
||||
"Report-Msgid-Bugs-To: translations@owncloud.org\n"
|
||||
"POT-Creation-Date: 2017-07-24 12:40+0000\n"
|
||||
"PO-Revision-Date: 2017-07-24 14:57+0200\n"
|
||||
"Last-Translator: Felix Rupp <kontakt@felixrupp.com>\n"
|
||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
||||
"Language: de\n"
|
||||
"MIME-Version: 1.0\n"
|
||||
"Content-Type: text/plain; charset=UTF-8\n"
|
||||
"Content-Transfer-Encoding: 8bit\n"
|
||||
"Plural-Forms: nplurals=2; plural=(n != 1);\n"
|
||||
"X-Generator: Virtaal 0.7.1\n"
|
||||
|
||||
#: templates/admin.php:7
|
||||
msgid "CAS Authentication backend"
|
||||
msgstr "Authentification CAS"
|
||||
|
||||
#: templates/admin.php:11
|
||||
msgid "CAS Server"
|
||||
msgstr "Serveur CAS"
|
||||
|
||||
#: templates/admin.php:12
|
||||
msgid "Basic"
|
||||
msgstr "Basic"
|
||||
|
||||
#: templates/admin.php:13
|
||||
msgid "Mapping"
|
||||
msgstr "Mapping"
|
||||
|
||||
#: templates/admin.php:14
|
||||
msgid "phpCAS Library"
|
||||
msgstr "Librairie phpCAS"
|
||||
|
||||
#: templates/admin.php:18
|
||||
msgid "CAS Server Version"
|
||||
msgstr "Version du serveur CAS"
|
||||
|
||||
#: templates/admin.php:26
|
||||
msgid "CAS Server Hostname"
|
||||
msgstr "Nom d’hôte du serveur CAS"
|
||||
|
||||
#: templates/admin.php:31
|
||||
msgid "CAS Server Port"
|
||||
msgstr "Port du serveur CAS"
|
||||
|
||||
#: templates/admin.php:36
|
||||
msgid "CAS Server Path"
|
||||
msgstr "Chemin du serveur CAS"
|
||||
|
||||
#: templates/admin.php:41
|
||||
msgid "Service URL"
|
||||
msgstr "URL du service"
|
||||
|
||||
#: templates/admin.php:47
|
||||
msgid "Certification file path (.crt)."
|
||||
msgstr "Chemin du fichier de certification (.crt)."
|
||||
|
||||
#: templates/admin.php:47
|
||||
msgid "Leave empty if you don’t want to validate your CAS server instance"
|
||||
msgstr "Laissez vide si vous ne voulez pas valider votre instance de serveur CAS"
|
||||
|
||||
#: templates/admin.php:52
|
||||
msgid "Use CAS proxy initialization"
|
||||
msgstr "Utiliser l'initialisation du proxy CAS"
|
||||
|
||||
#: templates/admin.php:54
|
||||
msgid "Force user login using CAS?"
|
||||
msgstr "Forcer la connexion de l'utilisateur en utilisant CAS?"
|
||||
|
||||
#: templates/admin.php:58
|
||||
msgid "Don’t use force login on these client-IPs"
|
||||
msgstr "N'utilisez pas la connexion forcée sur ces adresses IP client"
|
||||
|
||||
#: templates/admin.php:58
|
||||
msgid "Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)"
|
||||
msgstr "Liste des adresses IP (ou plages d'adresses) séparées par des virgules, qui ne sera pas obligée de se connecter si \"Forcer la connexion utilisateur\" est activé (par exemple 192.168.1.1-254, 192.168.2.5)"
|
||||
|
||||
#: templates/admin.php:60
|
||||
msgid "Disable CAS logout (do not logout CAS-session, only instance-session)"
|
||||
msgstr "Désactiver la déconnexion CAS (ne pas déconnecter la session CAS, déconnecter la session d'instance)"
|
||||
|
||||
msgid "Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)"
|
||||
msgstr "Désactiver la déconnexion unique CAS (ne déconnecte pas la session d'instance si le serveur CAS envoie une demande SSO)"
|
||||
|
||||
#: templates/admin.php63
|
||||
msgid "SingleSignout Servers"
|
||||
msgstr "Serveurs de déconnexion"
|
||||
|
||||
#: templates/admin.php63
|
||||
msgid "Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)"
|
||||
msgstr "Liste de serveurs séparés par des virgules pouvant envoyer des demandes SingleSignout (laissez vide si vous n'avez pas à limiter SingleSignout à des serveurs définis)"
|
||||
|
||||
#: templates/admin.php:65
|
||||
msgid "Autocreate user after first CAS login?"
|
||||
msgstr "Créer l'utilisateur automatiquement après la connexion CAS?"
|
||||
|
||||
msgid "Keep CAS-ticket-ids in URL?"
|
||||
msgstr "Gardez CAS-ticket-ids dans l'URL?"
|
||||
|
||||
msgid "Beware: Potential security risk! Only activate, if you know what you are doing."
|
||||
msgstr "Attention: risque potentiel de sécurité! Activez uniquement si vous savez ce que vous faites."
|
||||
|
||||
msgid "Overwrite Login Button Label"
|
||||
msgstr "Écraser l'étiquette du bouton de connexion"
|
||||
|
||||
msgid "Protect \"public share\" links with CAS"
|
||||
msgstr "Protéger les liens de partage avec CAS"
|
||||
|
||||
#: templates/admin.php:70
|
||||
msgid "Link CAS authentication with LDAP users and groups backend"
|
||||
msgstr ""
|
||||
"Lier l'authentification CAS avec les utilisateurs et groupe de "
|
||||
"l'authentification LDAP?"
|
||||
|
||||
#: templates/admin.php:75
|
||||
msgid "Update user data after each CAS login?"
|
||||
msgstr "Mettre à jour les données utilisateurs après la connexion?"
|
||||
|
||||
#: templates/admin.php:78
|
||||
msgid "Locked Groups"
|
||||
msgstr "Groupes protégés"
|
||||
|
||||
#: templates/admin.php:78
|
||||
msgid ""
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and "
|
||||
"the owncloud"
|
||||
msgstr ""
|
||||
"Groupes de l'utilisateur qui seront pas supprimés lors de la synchronisation "
|
||||
"entre le serveur CAS et Owncloud"
|
||||
|
||||
#: templates/admin.php:81
|
||||
msgid "Multivalued field, use comma to separate values"
|
||||
msgstr "Champ multivalué, utilisez des virgules pour séparer les valeurs"
|
||||
|
||||
#: templates/admin.php:83
|
||||
msgid "Default Group"
|
||||
msgstr "Groupe par défaut"
|
||||
|
||||
#: templates/admin.php:83
|
||||
msgid ""
|
||||
"Default group when autocreating users and no group data was found for the "
|
||||
"user"
|
||||
msgstr ""
|
||||
"Groupe par défaut lors de la création automatique des utilisateurs quand "
|
||||
"aucun groupe n'est trouvé pour l'utilisateur"
|
||||
|
||||
#: templates/admin.php:84
|
||||
msgid "Authorized CAS Groups"
|
||||
msgstr "Groupes autorisés CAS"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately"
|
||||
msgstr "Les utilisateurs des groupes suivants pourront se connecter à ownCloud, les utilisateurs ne faisant pas partie d'un groupe seront déconnectés immédiatement"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Group Quotas"
|
||||
msgstr "Quotas de groupe"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Use ECAS Attribute Parser?"
|
||||
msgstr "Utiliser ECAS Attribute Parser?"
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Request full user details?"
|
||||
msgstr "Demander des informations complètes sur l'utilisateur?"
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "ECAS Strength"
|
||||
msgstr "ECAS Strength"
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "Not set"
|
||||
msgstr "Pas encore défini"
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "ECAS AssuranceLevel"
|
||||
msgstr "ECAS AssuranceLevel"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Query ECAS groups"
|
||||
msgstr "ECAS groupes de requêtes"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Note down all groups which you want to receive from your ECAS instance, * returns all groups"
|
||||
msgstr "Notez tous les groupes que vous souhaitez recevoir de votre instance ECAS, * renvoie tous les groupes"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Don’t use Multi-Factor-Authentication on these client-IPs"
|
||||
msgstr "N'utilisez pas l'authentification multi-facteurs sur ces IP client"
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)"
|
||||
msgstr "Liste d'adresses IP client (ou plages d'adresses), séparées par des virgules, qui ne seront pas obligées d'utiliser l'authentification à plusieurs facteurs si \"ECAS AssuranceLevel\" est au moins de MEDIUM (par exemple 192.168.1.1-254, 192.168.2.5)"
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "User-ID"
|
||||
msgstr "Nom d'utilisateur"
|
||||
|
||||
msgid "Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used."
|
||||
msgstr "Mappez cet attribut uniquement si vous voulez un attribut CAS spécifique comme identifiant de votre utilisateur. S'il est laissé vide, le nom d'utilisateur CAS par défaut est utilisé."
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "Email"
|
||||
msgstr "Email"
|
||||
|
||||
#: templates/admin.php:94
|
||||
msgid "Display Name"
|
||||
msgstr "Nom affiché"
|
||||
|
||||
#: templates/admin.php:99
|
||||
msgid "Groups"
|
||||
msgstr "Groupes"
|
||||
|
||||
#: templates/admin.php:99
|
||||
msgid "Group Name: JSON Decode"
|
||||
msgstr "Nom du groupe: activer le décodage JSON"
|
||||
|
||||
#: templates/admin.php:107
|
||||
msgid "Overwrite phpCAS path (CAS.php file)"
|
||||
msgstr "Chemin PHP CAS (fichier CAS.php)"
|
||||
|
||||
#: templates/admin.php:107
|
||||
msgid ""
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own "
|
||||
"version. Leave blank to use the shipped version."
|
||||
msgstr ""
|
||||
"Optionnel: Chemin PHP CAS (fichier CAS.php). Laissez vide pour utiliser la "
|
||||
"version expédiée."
|
||||
|
||||
#: templates/admin.php:112
|
||||
msgid "PHP CAS debug file"
|
||||
msgstr "Chemin du fichier de debug de PHP CAS"
|
||||
|
||||
#: templates/admin.php:118
|
||||
msgid "Save"
|
||||
msgstr "Enregistrer"
|
||||
|
||||
#: lib/Controller/SettingsController.php:140
|
||||
msgid "Your CAS settings have been updated."
|
||||
msgstr "Vos paramètres CAS ont été mis à jour."
|
||||
|
||||
#: lib/Controller/SettingsController.php:146
|
||||
msgid "Your CAS settings could not be updated. Please try again."
|
||||
msgstr "Vos paramètres CAS n'ont pas pu être mis à jour. Veuillez réessayer."
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "403"
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "500"
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you."
|
||||
msgstr "Interdit. Vous n'avez pas accès à cette application. Veuillez vous adresser à votre administrateur si quelque chose vous semble incorrect."
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you."
|
||||
msgstr "Vous n'avez pas accès à cette application JRCbox. Veuillez vous adresser à votre administrateur JRCbox si quelque chose vous semble incorrect."
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "Internal Server Error. The server encountered an error. Please try again."
|
||||
msgstr "Erreur Interne du Serveur. Le serveur a rencontré une erreur. Veuillez réessayer."
|
||||
|
||||
#: templates/cas-error.php:28
|
||||
msgid "Go back to the login page"
|
||||
msgstr "Retourner à la page d'accueil"
|
||||
|
||||
|
||||
# Import CLI
|
||||
msgid "Import CLI"
|
||||
msgstr "Import CLI"
|
||||
|
||||
|
||||
msgid "ActiveDirectory (LDAP)"
|
||||
msgstr "ActiveDirectory (LDAP)"
|
||||
|
||||
msgid "LDAP Host"
|
||||
msgstr "Hôte LDAP"
|
||||
|
||||
msgid "LDAP User and Domain"
|
||||
msgstr "Utilisateur et domaine LDAP"
|
||||
|
||||
msgid "LDAP User Password"
|
||||
msgstr "Mot de passe utilisateur LDAP"
|
||||
|
||||
msgid "LDAP Base DN"
|
||||
msgstr "LDAP Base DN"
|
||||
|
||||
msgid "LDAP Sync Filter"
|
||||
msgstr "Filtre de synchronisation LDAP"
|
||||
|
||||
msgid "LDAP Sync Pagesize (1–1500)"
|
||||
msgstr "LDAP Sync Pagesize (1–1500)"
|
||||
|
||||
|
||||
msgid "CLI Attribute Mapping"
|
||||
msgstr "Mappage d'attributs CLI"
|
||||
|
||||
msgid "UID/Username"
|
||||
msgstr "UID/Nom d'utilisateur"
|
||||
|
||||
msgid "Group Name Field"
|
||||
msgstr "Nom du groupe"
|
||||
|
||||
msgid "Group Name Filter"
|
||||
msgstr "Filtre de nom de groupe"
|
||||
|
||||
msgid "Attention: You must use PHP (PCRE) Regex syntax for the filter."
|
||||
msgstr "Attention: Vous devez utiliser la syntaxe PHP (PCRE) Regex pour le filtre."
|
||||
|
||||
msgid "Group Name: Replace Umlauts"
|
||||
msgstr "Nom du groupe - Remplacer les trémas"
|
||||
|
||||
msgid "Enable"
|
||||
msgstr "Activer"
|
||||
|
||||
msgid "Calculate Enable Attribute Bitwise AND with"
|
||||
msgstr "Calculer Activer Attribut Bitwise AND avec"
|
||||
|
||||
msgid "Merge Accounts"
|
||||
msgstr "Fusionner des comptes"
|
||||
|
||||
msgid "Prefer Enabled over Disabled Accounts on Merge"
|
||||
msgstr "Préférer activé sur les comptes désactivés lors de la fusion"
|
||||
|
||||
msgid "Merge Two Active Accounts by"
|
||||
msgstr "Fusionner deux comptes actifs par"
|
||||
|
||||
msgid "Merge Two Active Accounts by: Filterstring"
|
||||
msgstr "Fusionner deux comptes actifs par: Filtres"
|
||||
|
|
@ -0,0 +1,332 @@
|
|||
# SOME DESCRIPTIVE TITLE.
|
||||
# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
|
||||
# This file is distributed under the same license as the PACKAGE package.
|
||||
# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
|
||||
#
|
||||
#, fuzzy
|
||||
msgid ""
|
||||
msgstr ""
|
||||
"Project-Id-Version: ownCloud Core 8.0.0\n"
|
||||
"Report-Msgid-Bugs-To: translations@owncloud.org\n"
|
||||
"POT-Creation-Date: 2017-07-24 12:40+0000\n"
|
||||
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
|
||||
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
|
||||
"Language-Team: LANGUAGE <LL@li.org>\n"
|
||||
"Language: \n"
|
||||
"MIME-Version: 1.0\n"
|
||||
"Content-Type: text/plain; charset=CHARSET\n"
|
||||
"Content-Transfer-Encoding: 8bit\n"
|
||||
|
||||
#: templates/admin.php:7
|
||||
msgid "CAS Authentication backend"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:11
|
||||
msgid "CAS Server"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:12
|
||||
msgid "Basic"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:13
|
||||
msgid "Mapping"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:14
|
||||
msgid "phpCAS Library"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:18
|
||||
msgid "CAS Server Version"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:26
|
||||
msgid "CAS Server Hostname"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:31
|
||||
msgid "CAS Server Port"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:36
|
||||
msgid "CAS Server Path"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:41
|
||||
msgid "Service URL"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:47
|
||||
msgid "Certification file path (.crt)."
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:47
|
||||
msgid "Leave empty if you don’t want to validate your CAS server instance"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:52
|
||||
msgid "Use CAS proxy initialization"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:54
|
||||
msgid "Force user login using CAS?"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:58
|
||||
msgid "Don’t use force login on these client-IPs"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:58
|
||||
msgid "Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if \"Force user login\" is enabled (e.g. 192.168.1.1-254,192.168.2.5)"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:60
|
||||
msgid "Disable CAS logout (do not logout CAS-session, only instance-session)"
|
||||
msgstr ""
|
||||
|
||||
msgid "Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php63
|
||||
msgid "SingleSignout Servers"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php63
|
||||
msgid "Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:65
|
||||
msgid "Autocreate user after first CAS login?"
|
||||
msgstr ""
|
||||
|
||||
msgid "Keep CAS-ticket-ids in URL?"
|
||||
msgstr ""
|
||||
|
||||
msgid "Beware: Potential security risk! Only activate, if you know what you are doing."
|
||||
msgstr ""
|
||||
|
||||
msgid "Overwrite Login Button Label"
|
||||
msgstr ""
|
||||
|
||||
msgid "Protect \"public share\" links with CAS"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:70
|
||||
msgid "Link CAS authentication with LDAP users and groups backend"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:75
|
||||
msgid "Update user data after each CAS login?"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:78
|
||||
msgid "Locked Groups"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:78
|
||||
msgid ""
|
||||
"Groups that will not be unlinked from the user when sync the CAS server and "
|
||||
"the owncloud"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:81
|
||||
msgid "Multivalued field, use comma to separate values"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:83
|
||||
msgid "Default Group"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:83
|
||||
msgid ""
|
||||
"Default group when autocreating users and no group data was found for the "
|
||||
"user"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:84
|
||||
msgid "Authorized CAS Groups"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Users in the following groups will be able to log into ownCloud, users not in one of the groups will be logged out immediately"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Group Quotas"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Use ECAS Attribute Parser?"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:85
|
||||
msgid "Request full user details?"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "ECAS Strength"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "Not set"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:86
|
||||
msgid "ECAS AssuranceLevel"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Query ECAS groups"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Note down all groups which you want to receive from your ECAS instance, * returns all groups"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Don’t use Multi-Factor-Authentication on these client-IPs"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:87
|
||||
msgid "Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if \"ECAS AssuranceLevel\" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "User-ID"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used."
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:89
|
||||
msgid "Email"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:94
|
||||
msgid "Display Name"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:99
|
||||
msgid "Groups"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:99
|
||||
msgid "Group Name: JSON Decode"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:107
|
||||
msgid "Overwrite phpCAS path (CAS.php file)"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:107
|
||||
msgid ""
|
||||
"Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own "
|
||||
"version. Leave blank to use the shipped version."
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:112
|
||||
msgid "PHP CAS debug file"
|
||||
msgstr ""
|
||||
|
||||
#: templates/admin.php:118
|
||||
msgid "Save"
|
||||
msgstr ""
|
||||
|
||||
#: lib/Controller/SettingsController.php:140
|
||||
msgid "Your CAS settings have been updated."
|
||||
msgstr ""
|
||||
|
||||
#: lib/Controller/SettingsController.php:146
|
||||
msgid "Your CAS settings could not be updated. Please try again."
|
||||
msgstr ""
|
||||
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "403"
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "500"
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you."
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you."
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:24
|
||||
msgid "Internal Server Error. The server encountered an error. Please try again."
|
||||
msgstr ""
|
||||
|
||||
#: templates/cas-error.php:28
|
||||
msgid "Go back to the login page"
|
||||
msgstr ""
|
||||
|
||||
|
||||
# Import CLI
|
||||
msgid "Import CLI"
|
||||
msgstr ""
|
||||
|
||||
|
||||
msgid "ActiveDirectory (LDAP)"
|
||||
msgstr ""
|
||||
|
||||
msgid "LDAP Host"
|
||||
msgstr ""
|
||||
|
||||
msgid "LDAP User and Domain"
|
||||
msgstr ""
|
||||
|
||||
msgid "LDAP User Password"
|
||||
msgstr ""
|
||||
|
||||
msgid "LDAP Base DN"
|
||||
msgstr ""
|
||||
|
||||
msgid "LDAP Sync Filter"
|
||||
msgstr ""
|
||||
|
||||
msgid "LDAP Sync Pagesize (1–1500)"
|
||||
msgstr ""
|
||||
|
||||
|
||||
msgid "CLI Attribute Mapping"
|
||||
msgstr ""
|
||||
|
||||
msgid "UID/Username"
|
||||
msgstr ""
|
||||
|
||||
msgid "Group Name Field"
|
||||
msgstr ""
|
||||
|
||||
msgid "Group Name Filter"
|
||||
msgstr ""
|
||||
|
||||
msgid "Attention: You must use PHP (PCRE) Regex syntax for the filter."
|
||||
msgstr ""
|
||||
|
||||
msgid "Group Name: Replace Umlauts"
|
||||
msgstr ""
|
||||
|
||||
msgid "Enable"
|
||||
msgstr ""
|
||||
|
||||
msgid "Calculate Enable Attribute Bitwise AND with"
|
||||
msgstr ""
|
||||
|
||||
msgid "Merge Accounts"
|
||||
msgstr ""
|
||||
|
||||
msgid "Prefer Enabled over Disabled Accounts on Merge"
|
||||
msgstr ""
|
||||
|
||||
msgid "Merge Two Active Accounts by"
|
||||
msgstr ""
|
||||
|
||||
msgid "Merge Two Active Accounts by: Filterstring"
|
||||
msgstr ""
|
||||
|
|
@ -0,0 +1,197 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\AppInfo;
|
||||
|
||||
use \OCP\AppFramework\App;
|
||||
use \OCP\IContainer;
|
||||
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Hooks\UserHooks;
|
||||
use OCA\UserCAS\Controller\SettingsController;
|
||||
use OCA\UserCAS\Controller\AuthenticationController;
|
||||
use OCA\UserCAS\User\Backend;
|
||||
use OCA\UserCAS\User\NextBackend;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
|
||||
/**
|
||||
* Class Application
|
||||
*
|
||||
* @package OCA\UserCAS\AppInfo
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4.0
|
||||
*/
|
||||
class Application extends App
|
||||
{
|
||||
|
||||
/**
|
||||
* Application constructor.
|
||||
*
|
||||
* @param array $urlParams
|
||||
*/
|
||||
public function __construct(array $urlParams = array())
|
||||
{
|
||||
|
||||
parent::__construct('user_cas', $urlParams);
|
||||
|
||||
$container = $this->getContainer();
|
||||
|
||||
$container->registerService('User', function (IContainer $c) {
|
||||
return $c->query('UserSession')->getUser();
|
||||
});
|
||||
|
||||
$container->registerService('Config', function (IContainer $c) {
|
||||
return $c->query('ServerContainer')->getConfig();
|
||||
});
|
||||
|
||||
$container->registerService('L10N', function (IContainer $c) {
|
||||
return $c->query('ServerContainer')->getL10N($c->query('AppName'));
|
||||
});
|
||||
|
||||
$container->registerService('Logger', function (IContainer $c) {
|
||||
return $c->query('ServerContainer')->getLogger();
|
||||
});
|
||||
|
||||
/**
|
||||
* Register LoggingService
|
||||
*/
|
||||
$container->registerService('LoggingService', function (IContainer $c) {
|
||||
return new LoggingService(
|
||||
$c->query('AppName'),
|
||||
$c->query('Config'),
|
||||
$c->query('Logger')
|
||||
);
|
||||
});
|
||||
|
||||
/**
|
||||
* Register AppService with config
|
||||
*/
|
||||
$container->registerService('AppService', function (IContainer $c) {
|
||||
return new AppService(
|
||||
$c->query('AppName'),
|
||||
$c->query('Config'),
|
||||
$c->query('LoggingService'),
|
||||
$c->query('ServerContainer')->getUserManager(),
|
||||
$c->query('ServerContainer')->getUserSession(),
|
||||
$c->query('ServerContainer')->getURLGenerator(),
|
||||
$c->query('ServerContainer')->getAppManager()
|
||||
);
|
||||
});
|
||||
|
||||
|
||||
// Workaround for Nextcloud >= 14.0.0
|
||||
if ($container->query('AppService')->isNotNextcloud()) {
|
||||
|
||||
/**
|
||||
* Register regular Backend
|
||||
*/
|
||||
$container->registerService('Backend', function (IContainer $c) {
|
||||
return new Backend(
|
||||
$c->query('AppName'),
|
||||
$c->query('Config'),
|
||||
$c->query('LoggingService'),
|
||||
$c->query('AppService'),
|
||||
$c->query('ServerContainer')->getUserManager(),
|
||||
$c->query('UserService')
|
||||
);
|
||||
});
|
||||
} else {
|
||||
|
||||
/**
|
||||
* Register Nextcloud Backend
|
||||
*/
|
||||
$container->registerService('Backend', function (IContainer $c) {
|
||||
return new NextBackend(
|
||||
$c->query('AppName'),
|
||||
$c->query('Config'),
|
||||
$c->query('LoggingService'),
|
||||
$c->query('AppService'),
|
||||
$c->query('ServerContainer')->getUserManager(),
|
||||
$c->query('UserService')
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Register UserService with UserSession for login/logout and UserManager for create
|
||||
*/
|
||||
$container->registerService('UserService', function (IContainer $c) {
|
||||
return new UserService(
|
||||
$c->query('AppName'),
|
||||
$c->query('Config'),
|
||||
$c->query('ServerContainer')->getUserManager(),
|
||||
$c->query('ServerContainer')->getUserSession(),
|
||||
$c->query('ServerContainer')->getGroupManager(),
|
||||
$c->query('AppService'),
|
||||
$c->query('LoggingService')
|
||||
);
|
||||
});
|
||||
|
||||
/**
|
||||
* Register SettingsController
|
||||
*/
|
||||
$container->registerService('SettingsController', function (IContainer $c) {
|
||||
return new SettingsController(
|
||||
$c->query('AppName'),
|
||||
$c->query('Request'),
|
||||
$c->query('Config'),
|
||||
$c->query('L10N')
|
||||
);
|
||||
});
|
||||
|
||||
/**
|
||||
* Register AuthenticationController
|
||||
*/
|
||||
$container->registerService('AuthenticationController', function (IContainer $c) {
|
||||
return new AuthenticationController(
|
||||
$c->query('AppName'),
|
||||
$c->query('Request'),
|
||||
$c->query('Config'),
|
||||
$c->query('UserService'),
|
||||
$c->query('AppService'),
|
||||
$c->query('ServerContainer')->getUserSession(),
|
||||
$c->query('LoggingService')
|
||||
);
|
||||
});
|
||||
|
||||
/**
|
||||
* Register UserHooks
|
||||
*/
|
||||
$container->registerService('UserHooks', function (IContainer $c) {
|
||||
return new UserHooks(
|
||||
$c->query('AppName'),
|
||||
$c->query('ServerContainer')->getUserManager(),
|
||||
$c->query('ServerContainer')->getUserSession(),
|
||||
$c->query('Config'),
|
||||
$c->query('UserService'),
|
||||
$c->query('AppService'),
|
||||
$c->query('LoggingService'),
|
||||
$c->query('Backend')
|
||||
);
|
||||
});
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,304 @@
|
|||
<?php
|
||||
|
||||
namespace OCA\UserCAS\Command;
|
||||
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
|
||||
use OCA\UserCAS\User\Backend;
|
||||
use OCA\UserCAS\User\NextBackend;
|
||||
use OCA\UserCAS\User\UserCasBackendInterface;
|
||||
use OCP\IConfig;
|
||||
use OCP\IGroupManager;
|
||||
use OCP\IUser;
|
||||
use OCP\IUserManager;
|
||||
use OCP\Mail\IMailer;
|
||||
use Symfony\Component\Console\Command\Command;
|
||||
use Symfony\Component\Console\Input\InputInterface;
|
||||
use Symfony\Component\Console\Input\InputOption;
|
||||
use Symfony\Component\Console\Output\OutputInterface;
|
||||
use Symfony\Component\Console\Input\InputArgument;
|
||||
|
||||
|
||||
/**
|
||||
* Class CreateUser
|
||||
*
|
||||
* @package OCA\UserCAS\Command
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.7.0
|
||||
*/
|
||||
class CreateUser extends Command
|
||||
{
|
||||
|
||||
/**
|
||||
* @var UserService
|
||||
*/
|
||||
protected $userService;
|
||||
|
||||
/**
|
||||
* @var AppService
|
||||
*/
|
||||
protected $appService;
|
||||
|
||||
/**
|
||||
* @var IUserManager
|
||||
*/
|
||||
protected $userManager;
|
||||
|
||||
/**
|
||||
* @var IGroupManager
|
||||
*/
|
||||
protected $groupManager;
|
||||
|
||||
/**
|
||||
* @var IMailer
|
||||
*/
|
||||
protected $mailer;
|
||||
|
||||
/**
|
||||
* @var LoggingService
|
||||
*/
|
||||
protected $loggingService;
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
protected $config;
|
||||
|
||||
/**
|
||||
* @var Backend|UserCasBackendInterface
|
||||
*/
|
||||
protected $backend;
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
public function __construct()
|
||||
{
|
||||
parent::__construct();
|
||||
|
||||
$userManager = \OC::$server->getUserManager();
|
||||
$groupManager = \OC::$server->getGroupManager();
|
||||
$mailer = \OC::$server->getMailer();
|
||||
$config = \OC::$server->getConfig();
|
||||
$userSession = \OC::$server->getUserSession();
|
||||
$logger = \OC::$server->getLogger();
|
||||
$urlGenerator = \OC::$server->getURLGenerator();
|
||||
$appManager = \OC::$server->getAppManager();
|
||||
|
||||
$loggingService = new LoggingService('user_cas', $config, $logger);
|
||||
$this->appService = new AppService('user_cas', $config, $loggingService, $userManager, $userSession, $urlGenerator, $appManager);
|
||||
|
||||
$userService = new UserService(
|
||||
'user_cas',
|
||||
$config,
|
||||
$userManager,
|
||||
$userSession,
|
||||
$groupManager,
|
||||
$this->appService,
|
||||
$loggingService
|
||||
);
|
||||
|
||||
if ($this->appService->isNotNextcloud()) {
|
||||
|
||||
$backend = new Backend(
|
||||
'user_cas',
|
||||
$config,
|
||||
$loggingService,
|
||||
$this->appService,
|
||||
$userManager,
|
||||
$userService
|
||||
);
|
||||
} else {
|
||||
|
||||
$backend = new NextBackend(
|
||||
'user_cas',
|
||||
$config,
|
||||
$loggingService,
|
||||
$this->appService,
|
||||
$userManager,
|
||||
$userService
|
||||
);
|
||||
}
|
||||
|
||||
$this->userService = $userService;
|
||||
$this->userManager = $userManager;
|
||||
$this->groupManager = $groupManager;
|
||||
$this->mailer = $mailer;
|
||||
$this->loggingService = $loggingService;
|
||||
$this->config = $config;
|
||||
$this->backend = $backend;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
protected function configure()
|
||||
{
|
||||
$this
|
||||
->setName('cas:create-user')
|
||||
->setDescription('Adds a user_cas user to the database.')
|
||||
->addArgument(
|
||||
'uid',
|
||||
InputArgument::REQUIRED,
|
||||
'User ID used to login (must only contain a-z, A-Z, 0-9, -, _ and @).'
|
||||
)
|
||||
->addOption(
|
||||
'display-name',
|
||||
null,
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'User name used in the web UI (can contain any characters).'
|
||||
)
|
||||
->addOption(
|
||||
'email',
|
||||
null,
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Email address for the user.'
|
||||
)
|
||||
->addOption(
|
||||
'group',
|
||||
'g',
|
||||
InputOption::VALUE_OPTIONAL | InputOption::VALUE_IS_ARRAY,
|
||||
'The groups the user should be added to (The group will be created if it does not exist).'
|
||||
)
|
||||
->addOption(
|
||||
'quota',
|
||||
'o',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'The quota the user should get either as numeric value in bytes or as a human readable string (e.g. 1GB for 1 Gigabyte)'
|
||||
)
|
||||
->addOption(
|
||||
'enabled',
|
||||
'e',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Set user enabled'
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param InputInterface $input
|
||||
* @param OutputInterface $output
|
||||
* @return int|null
|
||||
* @throws \Exception
|
||||
*/
|
||||
protected function execute(InputInterface $input, OutputInterface $output)
|
||||
{
|
||||
|
||||
$uid = $input->getArgument('uid');
|
||||
if ($this->userManager->userExists($uid)) {
|
||||
$output->writeln('<error>The user "' . $uid . '" already exists.</error>');
|
||||
return 1;
|
||||
}
|
||||
|
||||
// Validate email before we create the user
|
||||
if ($input->getOption('email')) {
|
||||
// Validate first
|
||||
if (!$this->mailer->validateMailAddress($input->getOption('email'))) {
|
||||
// Invalid! Error
|
||||
$output->writeln('<error>Invalid email address supplied</error>');
|
||||
return 1;
|
||||
} else {
|
||||
$email = $input->getOption('email');
|
||||
}
|
||||
} else {
|
||||
$email = null;
|
||||
}
|
||||
|
||||
# Register Backend
|
||||
$this->userService->registerBackend($this->backend);
|
||||
|
||||
/**
|
||||
* @var IUser
|
||||
*/
|
||||
$user = $this->userService->create($uid, $this->backend);
|
||||
|
||||
if ($user instanceof IUser) {
|
||||
|
||||
$output->writeln('<info>The user "' . $user->getUID() . '" was created successfully</info>');
|
||||
} else {
|
||||
|
||||
$output->writeln('<error>An error occurred while creating the user</error>');
|
||||
return 1;
|
||||
}
|
||||
|
||||
# Set displayName
|
||||
if ($input->getOption('display-name')) {
|
||||
|
||||
$user->setDisplayName($input->getOption('display-name'));
|
||||
$output->writeln('Display name set to "' . $user->getDisplayName() . '"');
|
||||
}
|
||||
|
||||
# Set email if supplied & valid
|
||||
if ($email !== null) {
|
||||
|
||||
$user->setEMailAddress($email);
|
||||
$output->writeln('Email address set to "' . $user->getEMailAddress() . '"');
|
||||
}
|
||||
|
||||
# Set Groups
|
||||
$groups = (array)$input->getOption('group');
|
||||
|
||||
if (count($groups) > 0) {
|
||||
|
||||
$this->userService->updateGroups($user, $groups, $this->config->getAppValue('user_cas', 'cas_protected_groups'), TRUE);
|
||||
$output->writeln('Groups have been set.');
|
||||
}
|
||||
|
||||
# Set Quota
|
||||
$quota = $input->getOption('quota');
|
||||
|
||||
if (!empty($quota)) {
|
||||
|
||||
if (is_numeric($quota)) {
|
||||
|
||||
$newQuota = $quota;
|
||||
} elseif ($quota === 'default') {
|
||||
|
||||
$newQuota = 'default';
|
||||
} elseif ($quota === 'none') {
|
||||
|
||||
$newQuota = 'none';
|
||||
} else {
|
||||
|
||||
$newQuota = \OCP\Util::computerFileSize($quota);
|
||||
}
|
||||
|
||||
$user->setQuota($newQuota);
|
||||
$output->writeln('Quota set to "' . $user->getQuota() . '"');
|
||||
}
|
||||
|
||||
# Set enabled
|
||||
$enabled = $input->getOption('enabled');
|
||||
|
||||
if (is_numeric($enabled) || is_bool($enabled)) {
|
||||
|
||||
$user->setEnabled(boolval($enabled));
|
||||
|
||||
$enabledString = ($user->isEnabled()) ? 'enabled' : 'not enabled';
|
||||
$output->writeln('Enabled set to "' . $enabledString . '"');
|
||||
}
|
||||
|
||||
# Set Backend
|
||||
if ($this->appService->isNotNextcloud()) {
|
||||
|
||||
if (!is_null($user) && ($user->getBackendClassName() === 'OC\User\Database' || $user->getBackendClassName() === "Database")) {
|
||||
|
||||
$query = \OC_DB::prepare('UPDATE `*PREFIX*accounts` SET `backend` = ? WHERE LOWER(`user_id`) = LOWER(?)');
|
||||
$result = $query->execute([get_class($this->backend), $uid]);
|
||||
|
||||
$output->writeln('New user added to CAS backend.');
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
$output->writeln('This is a Nextcloud instance, no backend update needed.');
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,187 @@
|
|||
<?php
|
||||
|
||||
|
||||
namespace OCA\UserCAS\Command;
|
||||
|
||||
use OC\User\Manager;
|
||||
use OCA\UserCAS\Service\Import\AdImporter;
|
||||
use OCA\UserCAS\Service\Import\ImporterInterface;
|
||||
use OCP\IConfig;
|
||||
use Psr\Log\LoggerInterface;
|
||||
use Symfony\Component\Console\Command\Command;
|
||||
use Symfony\Component\Console\Helper\ProgressBar;
|
||||
use Symfony\Component\Console\Input\ArrayInput;
|
||||
use Symfony\Component\Console\Input\InputInterface;
|
||||
use Symfony\Component\Console\Input\InputOption;
|
||||
use Symfony\Component\Console\Logger\ConsoleLogger;
|
||||
use Symfony\Component\Console\Output\NullOutput;
|
||||
use Symfony\Component\Console\Output\OutputInterface;
|
||||
|
||||
|
||||
/**
|
||||
* Class ImportUsersAd
|
||||
* @package OCA\UserCAS\Command
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
class ImportUsersAd extends Command
|
||||
{
|
||||
|
||||
/**
|
||||
* @var Manager $userManager
|
||||
*/
|
||||
private $userManager;
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
|
||||
/**
|
||||
* ImportUsersAd constructor.
|
||||
*/
|
||||
public function __construct()
|
||||
{
|
||||
parent::__construct();
|
||||
|
||||
$this->userManager = \OC::$server->getUserManager();
|
||||
$this->config = \OC::$server->getConfig();
|
||||
}
|
||||
|
||||
/**
|
||||
* Configure method
|
||||
*/
|
||||
protected function configure()
|
||||
{
|
||||
$this
|
||||
->setName('cas:import-users-ad')
|
||||
->setDescription('Imports users from an ActiveDirectory LDAP.')
|
||||
->addOption(
|
||||
'delta-update',
|
||||
'd',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Activate updates on existing accounts'
|
||||
)
|
||||
->addOption(
|
||||
'convert-backend',
|
||||
'c',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Convert the backend to CAS (on update only)'
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Execute method
|
||||
*
|
||||
* @param InputInterface $input
|
||||
* @param OutputInterface $output
|
||||
*/
|
||||
protected function execute(InputInterface $input, OutputInterface $output)
|
||||
{
|
||||
|
||||
|
||||
try {
|
||||
/**
|
||||
* @var LoggerInterface $logger
|
||||
*/
|
||||
$logger = new ConsoleLogger($output);
|
||||
|
||||
# Check for ldap extension
|
||||
if (extension_loaded("ldap")) {
|
||||
|
||||
$output->writeln('Start account import from ActiveDirectory.');
|
||||
|
||||
/**
|
||||
* @var ImporterInterface $importer
|
||||
*/
|
||||
$importer = new AdImporter($this->config);
|
||||
|
||||
$importer->init($logger);
|
||||
|
||||
$allUsers = $importer->getUsers();
|
||||
|
||||
$importer->close();
|
||||
|
||||
$output->writeln('Account import from ActiveDirectory finished.');
|
||||
|
||||
#$importer->exportAsCsv($allUsers);
|
||||
#$importer->exportAsText($allUsers);
|
||||
#exit;
|
||||
|
||||
$output->writeln('Start account import to database.');
|
||||
|
||||
$progressBar = new ProgressBar($output, count($allUsers));
|
||||
|
||||
# Convert backend
|
||||
$convertBackend = $input->getOption('convert-backend');
|
||||
|
||||
if ($convertBackend) {
|
||||
|
||||
$logger->info("Backend conversion: Backends will be converted to CAS-Backend.");
|
||||
}
|
||||
|
||||
# Delta Update
|
||||
$deltaUpdate = $input->getOption('delta-update');
|
||||
|
||||
if ($deltaUpdate) {
|
||||
|
||||
$logger->info("Delta updates: Existing users will be updated.");
|
||||
}
|
||||
|
||||
$createCommand = $this->getApplication()->find('cas:create-user');
|
||||
$updateCommand = $this->getApplication()->find('cas:update-user');
|
||||
|
||||
foreach ($allUsers as $user) {
|
||||
|
||||
$arguments = [
|
||||
'command' => 'cas:create-user',
|
||||
'uid' => $user["uid"],
|
||||
'--display-name' => $user["displayName"],
|
||||
'--email' => $user["email"],
|
||||
'--quota' => $user["quota"],
|
||||
'--enabled' => $user["enable"],
|
||||
'--group' => $user["groups"]
|
||||
];
|
||||
|
||||
# Create user if he does not exist
|
||||
if (!$this->userManager->userExists($user["uid"])) {
|
||||
|
||||
$input = new ArrayInput($arguments);
|
||||
|
||||
$createCommand->run($input, new NullOutput());
|
||||
} # Update user if he already exists and delta update is true
|
||||
else if ($this->userManager->userExists($user["uid"]) && $deltaUpdate) {
|
||||
|
||||
$arguments['command'] = 'cas:update-user';
|
||||
|
||||
if ($convertBackend) {
|
||||
|
||||
$arguments["--convert-backend"] = 1;
|
||||
}
|
||||
$input = new ArrayInput($arguments);
|
||||
|
||||
$updateCommand->run($input, new NullOutput());
|
||||
}
|
||||
|
||||
$progressBar->advance();
|
||||
}
|
||||
|
||||
$progressBar->finish();
|
||||
$progressBar->clear();
|
||||
|
||||
$output->writeln('Account import to database finished.');
|
||||
|
||||
} else {
|
||||
|
||||
throw new \Exception("User import failed. PHP extension 'ldap' is not loaded.");
|
||||
}
|
||||
} catch (\Exception $e) {
|
||||
|
||||
$logger->critical("Fatal Error: " . $e->getMessage());
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,313 @@
|
|||
<?php
|
||||
|
||||
namespace OCA\UserCAS\Command;
|
||||
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
|
||||
use OCA\UserCAS\User\Backend;
|
||||
use OCA\UserCAS\User\NextBackend;
|
||||
use OCA\UserCAS\User\UserCasBackendInterface;
|
||||
use OCP\IGroupManager;
|
||||
use OCP\IUser;
|
||||
use OCP\IUserManager;
|
||||
use OCP\Mail\IMailer;
|
||||
use Symfony\Component\Console\Command\Command;
|
||||
use Symfony\Component\Console\Input\InputInterface;
|
||||
use Symfony\Component\Console\Input\InputOption;
|
||||
use Symfony\Component\Console\Output\OutputInterface;
|
||||
use Symfony\Component\Console\Input\InputArgument;
|
||||
|
||||
|
||||
/**
|
||||
* Class UpdateUser
|
||||
*
|
||||
* @package OCA\UserCAS\Command
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.7.0
|
||||
*/
|
||||
class UpdateUser extends Command
|
||||
{
|
||||
|
||||
/**
|
||||
* @var UserService
|
||||
*/
|
||||
protected $userService;
|
||||
|
||||
/**
|
||||
* @var AppService
|
||||
*/
|
||||
protected $appService;
|
||||
|
||||
/**
|
||||
* @var IUserManager
|
||||
*/
|
||||
protected $userManager;
|
||||
|
||||
/**
|
||||
* @var IGroupManager
|
||||
*/
|
||||
protected $groupManager;
|
||||
|
||||
/**
|
||||
* @var IMailer
|
||||
*/
|
||||
protected $mailer;
|
||||
|
||||
/**
|
||||
* @var LoggingService
|
||||
*/
|
||||
protected $loggingService;
|
||||
|
||||
/**
|
||||
* @var \OCP\IConfig
|
||||
*/
|
||||
protected $config;
|
||||
|
||||
/**
|
||||
* @var Backend|UserCasBackendInterface
|
||||
*/
|
||||
protected $backend;
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
public function __construct()
|
||||
{
|
||||
parent::__construct();
|
||||
|
||||
$userManager = \OC::$server->getUserManager();
|
||||
$groupManager = \OC::$server->getGroupManager();
|
||||
$mailer = \OC::$server->getMailer();
|
||||
$config = \OC::$server->getConfig();
|
||||
$userSession = \OC::$server->getUserSession();
|
||||
$logger = \OC::$server->getLogger();
|
||||
$urlGenerator = \OC::$server->getURLGenerator();
|
||||
$appManager = \OC::$server->getAppManager();
|
||||
|
||||
$loggingService = new LoggingService('user_cas', $config, $logger);
|
||||
$this->appService = new AppService('user_cas', $config, $loggingService, $userManager, $userSession, $urlGenerator, $appManager);
|
||||
|
||||
$userService = new UserService(
|
||||
'user_cas',
|
||||
$config,
|
||||
$userManager,
|
||||
$userSession,
|
||||
$groupManager,
|
||||
$this->appService,
|
||||
$loggingService
|
||||
);
|
||||
|
||||
if ($this->appService->isNotNextcloud()) {
|
||||
|
||||
$backend = new Backend(
|
||||
'user_cas',
|
||||
$config,
|
||||
$loggingService,
|
||||
$this->appService,
|
||||
$userManager,
|
||||
$userService
|
||||
);
|
||||
} else {
|
||||
|
||||
$backend = new NextBackend(
|
||||
'user_cas',
|
||||
$config,
|
||||
$loggingService,
|
||||
$this->appService,
|
||||
$userManager,
|
||||
$userService
|
||||
);
|
||||
}
|
||||
|
||||
$this->userService = $userService;
|
||||
$this->userManager = $userManager;
|
||||
$this->groupManager = $groupManager;
|
||||
$this->mailer = $mailer;
|
||||
$this->loggingService = $loggingService;
|
||||
$this->config = $config;
|
||||
$this->backend = $backend;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
protected function configure()
|
||||
{
|
||||
$this
|
||||
->setName('cas:update-user')
|
||||
->setDescription('Updates an existing user and, if not yet a CAS user, converts the record to CAS backend.')
|
||||
->addArgument(
|
||||
'uid',
|
||||
InputArgument::REQUIRED,
|
||||
'User ID used to login (must only contain a-z, A-Z, 0-9, -, _ and @).'
|
||||
)
|
||||
->addOption(
|
||||
'display-name',
|
||||
null,
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'User name used in the web UI (can contain any characters).'
|
||||
)
|
||||
->addOption(
|
||||
'email',
|
||||
null,
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Email address for the user.'
|
||||
)
|
||||
->addOption(
|
||||
'group',
|
||||
'g',
|
||||
InputOption::VALUE_OPTIONAL | InputOption::VALUE_IS_ARRAY,
|
||||
'The groups the user should be added to (The group will be created if it does not exist).'
|
||||
)
|
||||
->addOption(
|
||||
'quota',
|
||||
'o',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'The quota the user should get, either as numeric value in bytes or as a human readable string (e.g. 1GB for 1 Gigabyte)'
|
||||
)
|
||||
->addOption(
|
||||
'enabled',
|
||||
'e',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Set user enabled'
|
||||
)
|
||||
->addOption(
|
||||
'convert-backend',
|
||||
'c',
|
||||
InputOption::VALUE_OPTIONAL,
|
||||
'Convert the backend to CAS'
|
||||
);
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param InputInterface $input
|
||||
* @param OutputInterface $output
|
||||
* @return int|null
|
||||
* @throws \Exception
|
||||
*/
|
||||
protected function execute(InputInterface $input, OutputInterface $output)
|
||||
{
|
||||
|
||||
$uid = $input->getArgument('uid');
|
||||
if (!$this->userManager->userExists($uid)) {
|
||||
$output->writeln('<error>The user "' . $uid . '" does not exist.</error>');
|
||||
return 1;
|
||||
}
|
||||
|
||||
// Validate email before we create the user
|
||||
if ($input->getOption('email')) {
|
||||
// Validate first
|
||||
if (!$this->mailer->validateMailAddress($input->getOption('email'))) {
|
||||
// Invalid! Error
|
||||
$output->writeln('<error>Invalid email address supplied</error>');
|
||||
return 1;
|
||||
} else {
|
||||
$email = $input->getOption('email');
|
||||
}
|
||||
} else {
|
||||
$email = null;
|
||||
}
|
||||
|
||||
# Register Backend
|
||||
$this->userService->registerBackend($this->backend);
|
||||
|
||||
/**
|
||||
* @var IUser
|
||||
*/
|
||||
$user = $this->userManager->get($uid);
|
||||
|
||||
if ($user instanceof IUser) {
|
||||
|
||||
$output->writeln('<info>The user "' . $user->getUID() . '" has been found</info>');
|
||||
} else {
|
||||
|
||||
$output->writeln('<error>An error occurred while finding the user</error>');
|
||||
return 1;
|
||||
}
|
||||
|
||||
# Set displayName
|
||||
if ($input->getOption('display-name')) {
|
||||
|
||||
$user->setDisplayName($input->getOption('display-name'));
|
||||
$output->writeln('Display name set to "' . $user->getDisplayName() . '"');
|
||||
}
|
||||
|
||||
# Set email if supplied & valid
|
||||
if ($email !== null) {
|
||||
|
||||
$user->setEMailAddress($email);
|
||||
$output->writeln('Email address set to "' . $user->getEMailAddress() . '"');
|
||||
}
|
||||
|
||||
# Set Groups
|
||||
$groups = (array)$input->getOption('group');
|
||||
|
||||
if (count($groups) > 0) {
|
||||
|
||||
$this->userService->updateGroups($user, $groups, $this->config->getAppValue('user_cas', 'cas_protected_groups'));
|
||||
$output->writeln('Groups have been updated.');
|
||||
}
|
||||
|
||||
# Set Quota
|
||||
$quota = $input->getOption('quota');
|
||||
|
||||
if (!empty($quota)) {
|
||||
|
||||
if (is_numeric($quota)) {
|
||||
|
||||
$newQuota = $quota;
|
||||
} elseif ($quota === 'default') {
|
||||
|
||||
$newQuota = 'default';
|
||||
} elseif ($quota === 'none') {
|
||||
|
||||
$newQuota = 'none';
|
||||
} else {
|
||||
|
||||
$newQuota = \OCP\Util::computerFileSize($quota);
|
||||
}
|
||||
|
||||
$user->setQuota($newQuota);
|
||||
$output->writeln('Quota set to "' . $user->getQuota() . '"');
|
||||
}
|
||||
|
||||
# Set enabled
|
||||
$enabled = $input->getOption('enabled');
|
||||
|
||||
if (is_numeric($enabled) || is_bool($enabled)) {
|
||||
|
||||
$user->setEnabled(boolval($enabled));
|
||||
|
||||
$enabledString = ($user->isEnabled()) ? 'enabled' : 'not enabled';
|
||||
$output->writeln('Enabled set to "' . $enabledString . '"');
|
||||
}
|
||||
|
||||
# Convert backend
|
||||
$convertBackend = $input->getOption('convert-backend');
|
||||
|
||||
if ($convertBackend) {
|
||||
|
||||
# Set Backend
|
||||
if ($this->appService->isNotNextcloud()) {
|
||||
|
||||
$query = \OC_DB::prepare('UPDATE `*PREFIX*accounts` SET `backend` = ? WHERE LOWER(`user_id`) = LOWER(?)');
|
||||
$result = $query->execute([get_class($this->backend), $uid]);
|
||||
|
||||
$output->writeln('New user added to CAS backend.');
|
||||
|
||||
} else {
|
||||
|
||||
$output->writeln('This is a Nextcloud instance, no backend update needed.');
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,296 @@
|
|||
<?php
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Controller;
|
||||
|
||||
|
||||
use OCP\AppFramework\Http\TemplateResponse;
|
||||
use \OCP\IRequest;
|
||||
use \OCP\AppFramework\Http\RedirectResponse;
|
||||
use \OCP\AppFramework\Controller;
|
||||
use \OCP\IConfig;
|
||||
use \OCP\IUserSession;
|
||||
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException;
|
||||
|
||||
|
||||
/**
|
||||
* Class AuthenticationController
|
||||
*
|
||||
* @package OCA\UserCAS\Controller
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4.0
|
||||
*/
|
||||
class AuthenticationController extends Controller
|
||||
{
|
||||
|
||||
/**
|
||||
* @var string $appName
|
||||
*/
|
||||
protected $appName;
|
||||
|
||||
/**
|
||||
* @var \OCP\IConfig $config
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\UserService $userService
|
||||
*/
|
||||
private $userService;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\AppService $appService
|
||||
*/
|
||||
private $appService;
|
||||
|
||||
/**
|
||||
* @var IUserSession $userSession
|
||||
*/
|
||||
private $userSession;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\LoggingService $loggingService
|
||||
*/
|
||||
private $loggingService;
|
||||
|
||||
/**
|
||||
* AuthenticationController constructor.
|
||||
* @param $appName
|
||||
* @param IRequest $request
|
||||
* @param IConfig $config
|
||||
* @param UserService $userService
|
||||
* @param AppService $appService
|
||||
* @param IUserSession $userSession
|
||||
* @param LoggingService $loggingService
|
||||
*/
|
||||
public function __construct($appName, IRequest $request, IConfig $config, UserService $userService, AppService $appService, IUserSession $userSession, LoggingService $loggingService)
|
||||
{
|
||||
$this->appName = $appName;
|
||||
$this->config = $config;
|
||||
$this->userService = $userService;
|
||||
$this->appService = $appService;
|
||||
$this->userSession = $userSession;
|
||||
$this->loggingService = $loggingService;
|
||||
parent::__construct($appName, $request);
|
||||
}
|
||||
|
||||
/**
|
||||
* Login method.
|
||||
*
|
||||
* @NoAdminRequired
|
||||
* @NoCSRFRequired
|
||||
* @PublicPage
|
||||
* @UseSession
|
||||
* @OnlyUnauthenticatedUsers
|
||||
*
|
||||
* @return RedirectResponse|TemplateResponse
|
||||
*/
|
||||
public function casLogin()
|
||||
{
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::FATAL, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
header("Location: " . $this->appService->getAbsoluteURL('/'));
|
||||
die();
|
||||
}
|
||||
}
|
||||
|
||||
# Handle redirect based on cookie value
|
||||
if (isset($_COOKIE['user_cas_redirect_url'])) {
|
||||
|
||||
$url = urldecode($_COOKIE['user_cas_redirect_url']);
|
||||
|
||||
if (strpos($url, 'http') !== FALSE || strpos($url, 'https') !== FALSE) {
|
||||
|
||||
$location = $url;
|
||||
} else {
|
||||
|
||||
$location = $this->appService->getAbsoluteURL($url);
|
||||
}
|
||||
} else {
|
||||
|
||||
$location = $this->appService->getAbsoluteURL("/");
|
||||
}
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'The Redirect URL Parameter in Login Action was: ' . $location);
|
||||
|
||||
if (!$this->userService->isLoggedIn()) {
|
||||
|
||||
try {
|
||||
|
||||
if (\phpCAS::isAuthenticated()) {
|
||||
|
||||
#$userName = \phpCAS::getUser();
|
||||
$userName = $this->userService->getUserId();
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS user " . $userName . " has been authenticated.");
|
||||
|
||||
$isLoggedIn = $this->userService->login($this->request, $userName);
|
||||
|
||||
if ($isLoggedIn) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS user has been authenticated against owncloud.");
|
||||
|
||||
# Reset cookie
|
||||
setcookie("user_cas_redirect_url", '/', 0, '/');
|
||||
|
||||
return new RedirectResponse($location);
|
||||
} else { # Not authenticated against owncloud
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS user has not been authenticated against owncloud.");
|
||||
|
||||
return $this->casError(null, \OCP\AppFramework\Http::STATUS_FORBIDDEN);
|
||||
}
|
||||
} else { # Not authenticated against CAS
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS user is not authenticated, redirect to CAS server.");
|
||||
|
||||
\phpCAS::forceAuthentication();
|
||||
}
|
||||
} catch (\CAS_Exception $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, "phpCAS has thrown an exception with code: " . $e->getCode() . " and message: " . $e->getMessage() . ".");
|
||||
|
||||
return $this->casError(null, \OCP\AppFramework\Http::STATUS_INTERNAL_SERVER_ERROR);
|
||||
}
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS user is already authenticated against owncloud.");
|
||||
|
||||
# Reset cookie
|
||||
setcookie("user_cas_redirect_url", '/', 0, '/');
|
||||
|
||||
return new RedirectResponse($location);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Logout method for CAS Single-Logout-Feature.
|
||||
*
|
||||
* @NoAdminRequired
|
||||
* @NoCSRFRequired
|
||||
* @PublicPage
|
||||
* @UseSession
|
||||
*/
|
||||
public function casLogout()
|
||||
{
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::FATAL, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
header("Location: " . $this->appService->getAbsoluteURL('/'));
|
||||
die();
|
||||
}
|
||||
}
|
||||
|
||||
// Logout oC/NC user
|
||||
if ($this->userService->isLoggedIn()) {
|
||||
|
||||
$this->userService->logout();
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Render error view
|
||||
*
|
||||
* @NoAdminRequired
|
||||
* @NoCSRFRequired
|
||||
* @PublicPage
|
||||
* @UseSession
|
||||
* @OnlyUnauthenticatedUsers
|
||||
*
|
||||
* @param \Exception|null $exception
|
||||
* @param int $additionalErrorCode
|
||||
*
|
||||
* @return TemplateResponse
|
||||
*/
|
||||
private function casError(\Exception $exception = NULL, $additionalErrorCode = 0)
|
||||
{
|
||||
$params = [];
|
||||
|
||||
if ($additionalErrorCode !== 0) {
|
||||
|
||||
if ($additionalErrorCode === \OCP\AppFramework\Http::STATUS_FORBIDDEN) {
|
||||
|
||||
if (boolval($this->config->getAppValue('user_cas', 'cas_ecas_attributeparserenabled', false))) {
|
||||
|
||||
$params['errorCode'] = '';
|
||||
$params['errorMessage'] = "You do not have access to the JRCbox application. Please contact the JRCbox administrator if something feels wrong to you.";
|
||||
} else {
|
||||
|
||||
$params['errorCode'] = $additionalErrorCode;
|
||||
$params['errorMessage'] = "Forbidden. You do not have access to this application. Please refer to your administrator if something feels wrong to you.";
|
||||
}
|
||||
}
|
||||
|
||||
if ($additionalErrorCode === \OCP\AppFramework\Http::STATUS_INTERNAL_SERVER_ERROR) {
|
||||
|
||||
$params['errorCode'] = $additionalErrorCode;
|
||||
$params['errorMessage'] = "Internal Server Error. The server encountered an error. Please try again.";
|
||||
}
|
||||
} else if ($exception instanceof \Exception) {
|
||||
|
||||
$params['errorCode'] = $exception->getCode();
|
||||
$params['errorMessage'] = $exception->getMessage();
|
||||
}
|
||||
|
||||
/*if ($this->config->getAppValue($this->appName, 'cas_force_login') === '1') {
|
||||
|
||||
$newProtocol = 'http://';
|
||||
|
||||
if (intval($this->config->getAppValue($this->appName, 'cas_server_port')) === 443) {
|
||||
|
||||
$newProtocol = 'https://';
|
||||
}
|
||||
|
||||
$params['backUrl'] = $newProtocol . $this->config->getAppValue($this->appName, 'cas_server_hostname') . $this->config->getAppValue($this->appName, 'cas_server_path');
|
||||
} else {*/
|
||||
|
||||
$params['backUrl'] = $this->appService->getAbsoluteURL('/');
|
||||
//}
|
||||
|
||||
$response = new TemplateResponse($this->appName, 'cas-error', $params, 'guest');
|
||||
|
||||
return $response;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,246 @@
|
|||
<?php
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Controller;
|
||||
|
||||
use OCP\IRequest;
|
||||
use OCP\AppFramework\Controller;
|
||||
use OCP\IL10N;
|
||||
use OCP\IConfig;
|
||||
|
||||
|
||||
/**
|
||||
* Class SettingsController
|
||||
*
|
||||
* @package OCA\UserCAS\Controller
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4
|
||||
*/
|
||||
class SettingsController extends Controller
|
||||
{
|
||||
/**
|
||||
* @var IL10N
|
||||
*/
|
||||
private $l10n;
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $appName;
|
||||
|
||||
/**
|
||||
* SettingsController constructor.
|
||||
* @param $appName
|
||||
* @param IRequest $request
|
||||
* @param IConfig $config
|
||||
* @param IL10N $l10n
|
||||
*/
|
||||
public function __construct($appName, IRequest $request, IConfig $config, IL10N $l10n)
|
||||
{
|
||||
$this->config = $config;
|
||||
$this->appName = $appName;
|
||||
$this->l10n = $l10n;
|
||||
parent::__construct($appName, $request);
|
||||
}
|
||||
|
||||
/**
|
||||
* @AdminRequired
|
||||
*
|
||||
* @param string $cas_server_version
|
||||
* @param string $cas_server_hostname
|
||||
* @param string $cas_server_port
|
||||
* @param string $cas_server_path
|
||||
* @param string $cas_protected_groups
|
||||
* @param string $cas_default_group
|
||||
* @param string $cas_groups_letter_filter
|
||||
* @param string $cas_groups_create_default_for_user_prefix
|
||||
* @param string $cas_userid_mapping
|
||||
* @param string $cas_email_mapping
|
||||
* @param string $cas_displayName_mapping
|
||||
* @param string $cas_group_mapping
|
||||
* @param string $cas_quota_mapping
|
||||
* @param string $cas_cert_path
|
||||
* @param string $cas_debug_file
|
||||
* @param string $cas_php_cas_path
|
||||
* @param string $cas_service_url
|
||||
* @param string $cas_handlelogout_servers
|
||||
* @param string $cas_login_button_label
|
||||
* @param string $cas_access_allow_groups
|
||||
* @param string $cas_ecas_accepted_strengths
|
||||
* @param string $cas_ecas_retrieve_groups
|
||||
* @param string $cas_ecas_assurance_level
|
||||
* @param string $cas_access_group_quotas
|
||||
* @param string $cas_force_login_exceptions
|
||||
* @param string $cas_ecas_internal_ip_range
|
||||
* @param string $cas_import_ad_protocol
|
||||
* @param string $cas_import_ad_host
|
||||
* @param string $cas_import_ad_port
|
||||
* @param string $cas_import_ad_user
|
||||
* @param string $cas_import_ad_domain
|
||||
* @param string $cas_import_ad_password
|
||||
* @param string $cas_import_ad_base_dn
|
||||
* @param string $cas_import_ad_sync_filter
|
||||
* @param string $cas_import_ad_sync_pagesize
|
||||
* @param string $cas_import_map_uid
|
||||
* @param string $cas_import_map_displayname
|
||||
* @param string $cas_import_map_email
|
||||
* @param string $cas_import_map_groups
|
||||
* @param string $cas_import_map_groups_description
|
||||
* @param string $cas_import_map_quota
|
||||
* @param string $cas_import_map_enabled
|
||||
* @param string $cas_import_map_enabled_and_bitwise
|
||||
* @param string $cas_import_map_dn
|
||||
* @param string $cas_import_map_dn_filter
|
||||
* @param string|null $cas_ecas_attributeparserenabled
|
||||
* @param string|null $cas_ecas_request_full_userdetails
|
||||
* @param string|null $cas_force_login
|
||||
* @param string|null $cas_autocreate
|
||||
* @param string|null $cas_update_user_data
|
||||
* @param string|null $cas_link_to_ldap_backend
|
||||
* @param string|null $cas_disable_logout
|
||||
* @param string|null $cas_disable_singlesignout
|
||||
* @param string|null $cas_use_proxy
|
||||
* @param string|null $cas_import_merge
|
||||
* @param string|null $cas_import_merge_enabled
|
||||
* @param string|null $cas_groups_letter_umlauts
|
||||
* @param string|null $cas_keep_ticket_ids
|
||||
* @param string|null $cas_groups_json_decode
|
||||
* @param string|null $cas_groups_create_default_for_user
|
||||
* @param string|null $cas_shares_protected
|
||||
* @return mixed
|
||||
*/
|
||||
public function saveSettings($cas_server_version, $cas_server_hostname, $cas_server_port, $cas_server_path, $cas_protected_groups, $cas_default_group, $cas_groups_letter_filter, $cas_groups_create_default_for_user_prefix,
|
||||
$cas_userid_mapping, $cas_email_mapping, $cas_displayName_mapping, $cas_group_mapping, $cas_quota_mapping, $cas_cert_path, $cas_debug_file, $cas_php_cas_path, $cas_service_url, $cas_handlelogout_servers, $cas_login_button_label,
|
||||
$cas_access_allow_groups, $cas_ecas_accepted_strengths, $cas_ecas_retrieve_groups, $cas_ecas_assurance_level, $cas_access_group_quotas, $cas_force_login_exceptions, $cas_ecas_internal_ip_range,
|
||||
$cas_import_ad_protocol, $cas_import_ad_host, $cas_import_ad_port, $cas_import_ad_user, $cas_import_ad_domain, $cas_import_ad_password, $cas_import_ad_base_dn, $cas_import_ad_sync_filter, $cas_import_ad_sync_pagesize,
|
||||
$cas_import_map_uid, $cas_import_map_displayname, $cas_import_map_email, $cas_import_map_groups, $cas_import_map_groups_description, $cas_import_map_quota, $cas_import_map_enabled, $cas_import_map_enabled_and_bitwise, $cas_import_map_dn, $cas_import_map_dn_filter,
|
||||
$cas_ecas_attributeparserenabled = NULL, $cas_ecas_request_full_userdetails = NULL, $cas_force_login = NULL, $cas_autocreate = NULL, $cas_update_user_data = NULL, $cas_link_to_ldap_backend = NULL,
|
||||
$cas_disable_logout = NULL, $cas_disable_singlesignout = NULL, $cas_use_proxy = NULL, $cas_import_merge = NULL, $cas_import_merge_enabled = NULL, $cas_groups_letter_umlauts = NULL, $cas_keep_ticket_ids = NULL, $cas_groups_json_decode = NULL,
|
||||
$cas_groups_create_default_for_user = NULL, $cas_shares_protected = NULL)
|
||||
{
|
||||
|
||||
try {
|
||||
|
||||
# CAS Server
|
||||
$this->config->setAppValue($this->appName, 'cas_server_version', $cas_server_version);
|
||||
$this->config->setAppValue($this->appName, 'cas_server_hostname', $cas_server_hostname);
|
||||
$this->config->setAppValue($this->appName, 'cas_server_port', $cas_server_port);
|
||||
$this->config->setAppValue($this->appName, 'cas_server_path', $cas_server_path);
|
||||
|
||||
# Basic
|
||||
$this->config->setAppValue($this->appName, 'cas_force_login_exceptions', $cas_force_login_exceptions);
|
||||
$this->config->setAppValue($this->appName, 'cas_protected_groups', $cas_protected_groups);
|
||||
$this->config->setAppValue($this->appName, 'cas_default_group', $cas_default_group);
|
||||
$this->config->setAppValue($this->appName, 'cas_access_allow_groups', $cas_access_allow_groups);
|
||||
$this->config->setAppValue($this->appName, 'cas_access_group_quotas', $cas_access_group_quotas);
|
||||
$this->config->setAppValue($this->appName, 'cas_cert_path', $cas_cert_path);
|
||||
$this->config->setAppValue($this->appName, 'cas_service_url', $cas_service_url);
|
||||
$this->config->setAppValue($this->appName, 'cas_handlelogout_servers', $cas_handlelogout_servers);
|
||||
$this->config->setAppValue($this->appName, 'cas_login_button_label', $cas_login_button_label);
|
||||
|
||||
# Mapping
|
||||
$this->config->setAppValue($this->appName, 'cas_userid_mapping', $cas_userid_mapping);
|
||||
$this->config->setAppValue($this->appName, 'cas_email_mapping', $cas_email_mapping);
|
||||
$this->config->setAppValue($this->appName, 'cas_displayName_mapping', $cas_displayName_mapping);
|
||||
$this->config->setAppValue($this->appName, 'cas_group_mapping', $cas_group_mapping);
|
||||
$this->config->setAppValue($this->appName, 'cas_quota_mapping', $cas_quota_mapping);
|
||||
$this->config->setAppValue($this->appName, 'cas_groups_letter_filter', $cas_groups_letter_filter);
|
||||
$this->config->setAppValue($this->appName, 'cas_groups_create_default_for_user_prefix', $cas_groups_create_default_for_user_prefix);
|
||||
|
||||
# phpCas
|
||||
$this->config->setAppValue($this->appName, 'cas_debug_file', $cas_debug_file);
|
||||
$this->config->setAppValue($this->appName, 'cas_php_cas_path', $cas_php_cas_path);
|
||||
|
||||
# ECAS settings
|
||||
$this->config->setAppValue($this->appName, 'cas_ecas_accepted_strengths', $cas_ecas_accepted_strengths);
|
||||
$this->config->setAppValue($this->appName, 'cas_ecas_retrieve_groups', $cas_ecas_retrieve_groups);
|
||||
$this->config->setAppValue($this->appName, 'cas_ecas_assurance_level', $cas_ecas_assurance_level);
|
||||
$this->config->setAppValue($this->appName, 'cas_ecas_internal_ip_range', $cas_ecas_internal_ip_range);
|
||||
|
||||
# Import module AD
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_protocol', $cas_import_ad_protocol);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_host', $cas_import_ad_host);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_port', intval($cas_import_ad_port));
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_user', $cas_import_ad_user);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_domain', $cas_import_ad_domain);
|
||||
|
||||
if(strlen($cas_import_ad_password) > 0) { # Only save if a new password is given
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_password', $cas_import_ad_password);
|
||||
}
|
||||
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_base_dn', $cas_import_ad_base_dn);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_sync_filter', htmlspecialchars_decode($cas_import_ad_sync_filter));
|
||||
$this->config->setAppValue($this->appName, 'cas_import_ad_sync_pagesize', intval($cas_import_ad_sync_pagesize));
|
||||
|
||||
# Import module cli mapping
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_uid', $cas_import_map_uid);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_displayname', $cas_import_map_displayname);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_email', $cas_import_map_email);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_groups', $cas_import_map_groups);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_groups_description', $cas_import_map_groups_description);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_quota', $cas_import_map_quota);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_enabled', $cas_import_map_enabled);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_enabled_and_bitwise', $cas_import_map_enabled_and_bitwise);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_dn', $cas_import_map_dn);
|
||||
$this->config->setAppValue($this->appName, 'cas_import_map_dn_filter', $cas_import_map_dn_filter);
|
||||
|
||||
# Checkbox settings
|
||||
$this->config->setAppValue($this->appName, 'cas_force_login', ($cas_force_login !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_autocreate', ($cas_autocreate !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_update_user_data', ($cas_update_user_data !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_link_to_ldap_backend', ($cas_link_to_ldap_backend !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_disable_logout', ($cas_disable_logout !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_disable_singlesignout', ($cas_disable_singlesignout !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_ecas_attributeparserenabled', ($cas_ecas_attributeparserenabled !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_ecas_request_full_userdetails', ($cas_ecas_request_full_userdetails !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_use_proxy', ($cas_use_proxy !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_import_merge', ($cas_import_merge !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_import_merge_enabled', ($cas_import_merge_enabled !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_groups_letter_umlauts', ($cas_groups_letter_umlauts !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_keep_ticket_ids', ($cas_keep_ticket_ids !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_groups_json_decode', ($cas_groups_json_decode !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_groups_create_default_for_user', ($cas_groups_create_default_for_user !== NULL) ? '1' : '0');
|
||||
$this->config->setAppValue($this->appName, 'cas_shares_protected', ($cas_shares_protected !== NULL) ? '1' : '0');
|
||||
|
||||
|
||||
return array(
|
||||
'code' => 200,
|
||||
'message' => $this->l10n->t('Your CAS settings have been updated.')
|
||||
);
|
||||
} catch (\Exception $e) {
|
||||
|
||||
return array(
|
||||
'code' => 500,
|
||||
'message' => $this->l10n->t('Your CAS settings could not be updated. Please try again.')
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,40 @@
|
|||
<?php
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Exception\PhpCas;
|
||||
|
||||
|
||||
use OCA\UserCAS\Exception\UserCasException;
|
||||
|
||||
/**
|
||||
* Class PhpUserCasLibraryNotFoundException
|
||||
*
|
||||
* @package OCA\UserCAS\Exception\PhpCas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.5.0
|
||||
*/
|
||||
class PhpUserCasLibraryNotFoundException extends UserCasException
|
||||
{
|
||||
}
|
||||
|
|
@ -0,0 +1,38 @@
|
|||
<?php
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Exception;
|
||||
|
||||
|
||||
/**
|
||||
* Class UserCasException
|
||||
*
|
||||
* @package OCA\UserCAS\Exception
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.5.0
|
||||
*/
|
||||
class UserCasException extends \Exception
|
||||
{
|
||||
}
|
||||
|
|
@ -0,0 +1,448 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Hooks;
|
||||
|
||||
use OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException;
|
||||
use OCA\UserCAS\User\UserCasBackendInterface;
|
||||
use \OCP\IUserManager;
|
||||
use \OCP\IUserSession;
|
||||
use \OCP\IConfig;
|
||||
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
|
||||
/**
|
||||
* Class UserCAS_Hooks
|
||||
*
|
||||
* @package OCA\UserCAS\Hooks
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4.0
|
||||
*/
|
||||
class UserHooks
|
||||
{
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $appName;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserManager $userManager
|
||||
*/
|
||||
private $userManager;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserSession $userSession
|
||||
*/
|
||||
private $userSession;
|
||||
|
||||
/**
|
||||
* @var \OCP\IConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\UserService $userService
|
||||
*/
|
||||
private $userService;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\AppService $appService
|
||||
*/
|
||||
private $appService;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\LoggingService
|
||||
*/
|
||||
private $loggingService;
|
||||
|
||||
/**
|
||||
* @var UserCasBackendInterface
|
||||
*/
|
||||
private $backend;
|
||||
|
||||
|
||||
/**
|
||||
* UserHooks constructor.
|
||||
*
|
||||
* @param string $appName
|
||||
* @param \OCP\IUserManager $userManager
|
||||
* @param \OCP\IUserSession $userSession
|
||||
* @param \OCP\IConfig $config
|
||||
* @param \OCA\UserCAS\Service\UserService $userService
|
||||
* @param \OCA\UserCAS\Service\AppService $appService
|
||||
* @param \OCA\UserCAS\Service\LoggingService $loggingService
|
||||
* @param UserCasBackendInterface $backend
|
||||
*/
|
||||
public function __construct($appName, IUserManager $userManager, IUserSession $userSession, IConfig $config, UserService $userService, AppService $appService, LoggingService $loggingService, UserCasBackendInterface $backend)
|
||||
{
|
||||
$this->appName = $appName;
|
||||
$this->userManager = $userManager;
|
||||
$this->userSession = $userSession;
|
||||
$this->config = $config;
|
||||
$this->userService = $userService;
|
||||
$this->appService = $appService;
|
||||
$this->loggingService = $loggingService;
|
||||
$this->backend = $backend;
|
||||
}
|
||||
|
||||
/**
|
||||
* Register method.
|
||||
*/
|
||||
public function register()
|
||||
{
|
||||
#$this->userSession->listen('\OC\User', 'preLogin', array($this, 'preLogin'));
|
||||
$this->userSession->listen('\OC\User', 'postLogin', array($this, 'postLogin'));
|
||||
$this->userSession->listen('\OC\User', 'postLogout', array($this, 'postLogout'));
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* postLogin method to update user data.
|
||||
*
|
||||
* @param mixed $uid
|
||||
* @param string $password
|
||||
* @return bool
|
||||
* @throws \Exception
|
||||
*
|
||||
* @deprecated
|
||||
* @since 1.8.0
|
||||
*/
|
||||
public function preLogin($uid, $password)
|
||||
{
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::FATAL, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
};
|
||||
|
||||
if ($uid instanceof \OCP\IUser) {
|
||||
|
||||
$user = $uid;
|
||||
$uid = $user->getUID();
|
||||
}
|
||||
else {
|
||||
|
||||
$user = $this->userManager->get($uid);
|
||||
}
|
||||
|
||||
if (\phpCAS::isAuthenticated() && !$this->userSession->isLoggedIn()) {
|
||||
|
||||
#$casUid = \phpCAS::getUser();
|
||||
$casUid = $this->userService->getUserId();
|
||||
|
||||
if ($casUid === $uid) {
|
||||
|
||||
if (boolval($this->config->getAppValue($this->appName, 'cas_autocreate'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas pre login hook triggered. User: ' . $uid);
|
||||
|
||||
// Autocreate user if needed or create a new account in CAS Backend
|
||||
if (is_null($user)) {
|
||||
|
||||
// create users if they do not exist
|
||||
if (preg_match('/[^a-zA-Z0-9 _\.@\-]/', $uid)) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'Invalid username "' . $uid . '", allowed chars "a-zA-Z0-9" and "_.@-" ');
|
||||
|
||||
return FALSE;
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS creating a new user with UID: ' . $uid);
|
||||
|
||||
/** @var bool|\OCP\IUser the created user or false $uid */
|
||||
$user = $this->userService->create($uid, $this->backend);
|
||||
|
||||
if ($user instanceof \OCP\IUser) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS created new user with UID: ' . $uid);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS no new user has been created.');
|
||||
}
|
||||
}
|
||||
|
||||
# Update the Backend of the user if necessary
|
||||
#$this->userService->updateBackend($user);
|
||||
}
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas pre login hook NOT triggered. User: ' . $uid);
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* postLogin method to update user data.
|
||||
*
|
||||
* @param mixed $uid
|
||||
* @param string $password
|
||||
* @return bool
|
||||
*/
|
||||
public function postLogin($uid, $password)
|
||||
{
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::FATAL, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
};
|
||||
|
||||
if ($uid instanceof \OCP\IUser) {
|
||||
|
||||
$user = $uid;
|
||||
$uid = $user->getUID();
|
||||
} else {
|
||||
|
||||
$user = $this->userManager->get($uid);
|
||||
}
|
||||
|
||||
if (\phpCAS::isAuthenticated() && $this->userSession->isLoggedIn()) {
|
||||
|
||||
if (boolval($this->config->getAppValue($this->appName, 'cas_update_user_data'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas post login hook triggered. User: ' . $uid);
|
||||
|
||||
// $cas_attributes may vary in name, therefore attributes are fetched to $attributes
|
||||
|
||||
#$casUid = \phpCAS::getUser();
|
||||
$casUid = $this->userService->getUserId();
|
||||
|
||||
if ($casUid === $uid) {
|
||||
|
||||
# Update the Backend of the user if necessary
|
||||
#$this->userService->updateBackend($user);
|
||||
|
||||
$casAttributes = \phpCAS::getAttributes();
|
||||
|
||||
# Test if an attribute parser added a new dimension to our attributes array
|
||||
if (array_key_exists('attributes', $casAttributes)) {
|
||||
|
||||
$newAttributes = $casAttributes['attributes'];
|
||||
|
||||
unset($casAttributes['attributes']);
|
||||
|
||||
$casAttributes = array_merge($casAttributes, $newAttributes);
|
||||
}
|
||||
|
||||
$casAttributesString = '';
|
||||
foreach ($casAttributes as $key => $attribute) {
|
||||
|
||||
$attributeString = $this->convertArrayAttributeValuesForDebug($attribute);
|
||||
|
||||
$casAttributesString .= $key . ': ' . $attributeString . '; ';
|
||||
}
|
||||
|
||||
// parameters
|
||||
$attributes = array();
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'Attributes for the user: ' . $uid . ' => ' . $casAttributesString);
|
||||
|
||||
|
||||
// DisplayName
|
||||
$displayNameMapping = $this->config->getAppValue($this->appName, 'cas_displayName_mapping');
|
||||
|
||||
$displayNameMappingArray = explode("+", $displayNameMapping);
|
||||
|
||||
$attributes['cas_name'] = '';
|
||||
|
||||
foreach ($displayNameMappingArray as $displayNameMapping) {
|
||||
|
||||
if (array_key_exists($displayNameMapping, $casAttributes)) {
|
||||
|
||||
$attributes['cas_name'] .= $casAttributes[$displayNameMapping] . " ";
|
||||
}
|
||||
}
|
||||
|
||||
$attributes['cas_name'] = trim($attributes['cas_name']);
|
||||
|
||||
if ($attributes['cas_name'] === '' && array_key_exists('displayName', $casAttributes)) {
|
||||
|
||||
$attributes['cas_name'] = $casAttributes['displayName'];
|
||||
}
|
||||
|
||||
|
||||
// E-Mail
|
||||
$mailMapping = $this->config->getAppValue($this->appName, 'cas_email_mapping');
|
||||
if (array_key_exists($mailMapping, $casAttributes)) {
|
||||
|
||||
$attributes['cas_email'] = $casAttributes[$mailMapping];
|
||||
} else if (array_key_exists('mail', $casAttributes)) {
|
||||
|
||||
$attributes['cas_email'] = $casAttributes['mail'];
|
||||
}
|
||||
|
||||
|
||||
// Group handling
|
||||
$groupMapping = $this->config->getAppValue($this->appName, 'cas_group_mapping');
|
||||
$defaultGroup = $this->config->getAppValue($this->appName, 'cas_default_group');
|
||||
# Test for mapped attribute from settings
|
||||
if (array_key_exists($groupMapping, $casAttributes)) {
|
||||
|
||||
$attributes['cas_groups'] = $casAttributes[$groupMapping];
|
||||
} # Test for standard 'groups' attribute
|
||||
else if (array_key_exists('groups', $casAttributes)) {
|
||||
|
||||
$attributes['cas_groups'] = $casAttributes['groups'];
|
||||
} else if (is_string($defaultGroup) && strlen($defaultGroup) > 0) {
|
||||
|
||||
$attributes['cas_groups'] = array($defaultGroup);
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'Using default group "' . $defaultGroup . '" for the user: ' . $uid);
|
||||
}
|
||||
|
||||
// Group Quota handling
|
||||
$groupQuotas = $this->config->getAppValue($this->appName, 'cas_access_group_quotas');
|
||||
$groupQuotas = explode(",", $groupQuotas);
|
||||
|
||||
foreach ($groupQuotas as $groupQuota) {
|
||||
|
||||
$groupQuota = explode(":", $groupQuota);
|
||||
|
||||
if (is_array($groupQuota) && count($groupQuota) === 2) {
|
||||
|
||||
$attributes['cas_group_quota'][$groupQuota[0]] = $groupQuota[1];
|
||||
}
|
||||
}
|
||||
|
||||
// User Quota handling
|
||||
// Overwrites group quota
|
||||
$userQuotaMapping = $this->config->getAppValue($this->appName, 'cas_quota_mapping');
|
||||
|
||||
#$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas quota-mapping-contents: '.$userQuotaMapping);
|
||||
|
||||
if (array_key_exists($userQuotaMapping, $casAttributes)) {
|
||||
|
||||
$attributes['cas_quota'] = $casAttributes[$userQuotaMapping];
|
||||
} else if (array_key_exists('quota', $casAttributes)) {
|
||||
|
||||
$attributes['cas_quota'] = $casAttributes['quota'];
|
||||
}
|
||||
|
||||
// Try to update user attributes
|
||||
$this->userService->updateUser($user, $attributes);
|
||||
}
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas post login hook finished.');
|
||||
}
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas post login hook NOT triggered. User: ' . $uid);
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Logout hook method.
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function postLogout()
|
||||
{
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::FATAL, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
};
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'Logout hook triggered.');
|
||||
|
||||
if (!boolval($this->config->getAppValue($this->appName, 'cas_disable_logout'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS logging out.');
|
||||
|
||||
# Reset cookie
|
||||
setcookie("user_cas_redirect_url", '/', 0, '/');
|
||||
|
||||
\phpCAS::logout(array("service" => $this->appService->getAbsoluteURL('/')));
|
||||
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS not logging out, because CAS logout was disabled.');
|
||||
}
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Convert CAS Attribute values for debug reasons
|
||||
*
|
||||
* @param $attributes
|
||||
* @return string
|
||||
*/
|
||||
private function convertArrayAttributeValuesForDebug($attributes)
|
||||
{
|
||||
|
||||
if (is_array($attributes)) {
|
||||
$stringValue = '';
|
||||
|
||||
foreach ($attributes as $attribute) {
|
||||
|
||||
if (is_array($attribute)) {
|
||||
|
||||
$stringValue .= $this->convertArrayAttributeValuesForDebug($attribute);
|
||||
} else {
|
||||
|
||||
$stringValue .= $attribute . ", ";
|
||||
}
|
||||
}
|
||||
|
||||
return $stringValue;
|
||||
}
|
||||
|
||||
return $attributes;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,136 @@
|
|||
<?php
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Panels;
|
||||
|
||||
use OCP\Settings\ISettings;
|
||||
use OCP\Template;
|
||||
use OCP\AppFramework\Http\TemplateResponse;
|
||||
use OCP\IConfig;
|
||||
|
||||
/**
|
||||
* Class Admin
|
||||
*
|
||||
* @package OCA\UserCAS\Panels
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.5
|
||||
*/
|
||||
class Admin implements ISettings
|
||||
{
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
private $params = array('cas_server_version', 'cas_server_hostname', 'cas_server_port', 'cas_server_path', 'cas_force_login', 'cas_force_login_exceptions','cas_autocreate',
|
||||
'cas_update_user_data', 'cas_keep_ticket_ids', 'cas_login_button_label', 'cas_protected_groups', 'cas_default_group', 'cas_ecas_attributeparserenabled', 'cas_userid_mapping', 'cas_email_mapping', 'cas_displayName_mapping', 'cas_group_mapping', 'cas_quota_mapping',
|
||||
'cas_cert_path', 'cas_debug_file', 'cas_php_cas_path', 'cas_link_to_ldap_backend', 'cas_disable_logout', 'cas_disable_singlesignout', 'cas_handlelogout_servers', 'cas_service_url', 'cas_access_allow_groups',
|
||||
'cas_access_group_quotas', 'cas_groups_letter_filter', 'cas_groups_letter_umlauts', 'cas_groups_json_decode', 'cas_groups_create_default_for_user', 'cas_groups_create_default_for_user_prefix',
|
||||
'cas_import_ad_protocol', 'cas_import_ad_host', 'cas_import_ad_port', 'cas_import_ad_user', 'cas_import_ad_domain', 'cas_import_ad_password', 'cas_import_ad_base_dn', 'cas_import_ad_sync_filter', 'cas_import_ad_sync_pagesize',
|
||||
'cas_import_map_uid', 'cas_import_map_displayname', 'cas_import_map_email', 'cas_import_map_groups', 'cas_import_map_groups_description', 'cas_import_map_quota', 'cas_import_map_enabled', 'cas_import_map_enabled_and_bitwise', 'cas_import_map_dn_filter', 'cas_import_map_dn', 'cas_import_merge', 'cas_import_merge_enabled',
|
||||
'cas_ecas_accepted_strengths', 'cas_ecas_retrieve_groups','cas_ecas_request_full_userdetails', 'cas_ecas_assurance_level','cas_use_proxy', 'cas_ecas_internal_ip_range', 'cas_shares_protected');
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* Admin constructor.
|
||||
*
|
||||
* @param IConfig $config
|
||||
*/
|
||||
public function __construct(IConfig $config)
|
||||
{
|
||||
$this->config = $config;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getSectionID()
|
||||
{
|
||||
return 'authentication';
|
||||
}
|
||||
|
||||
/**
|
||||
* @see Nextcloud 13 support
|
||||
*
|
||||
* @return string
|
||||
*
|
||||
* @since 1.5.0
|
||||
*/
|
||||
public function getSection()
|
||||
{
|
||||
return 'security';
|
||||
}
|
||||
|
||||
/**
|
||||
* @return int
|
||||
*/
|
||||
public function getPriority()
|
||||
{
|
||||
return 50;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get Panel
|
||||
*
|
||||
* @return Template
|
||||
*/
|
||||
public function getPanel()
|
||||
{
|
||||
|
||||
$tmpl = new Template('user_cas', 'admin');
|
||||
|
||||
foreach ($this->params as $param) {
|
||||
|
||||
$value = htmlentities($this->config->getAppValue('user_cas', $param));
|
||||
|
||||
$tmpl->assign($param, $value);
|
||||
}
|
||||
|
||||
return $tmpl;
|
||||
}
|
||||
|
||||
/**
|
||||
* @see Nextcloud 13 support
|
||||
*
|
||||
* @return TemplateResponse
|
||||
*
|
||||
* @since 1.5.0
|
||||
*/
|
||||
public function getForm()
|
||||
{
|
||||
|
||||
$parameters = array();
|
||||
|
||||
foreach ($this->params as $param) {
|
||||
|
||||
$parameters[$param] = htmlentities($this->config->getAppValue('user_cas', $param));
|
||||
}
|
||||
|
||||
return new TemplateResponse('user_cas', 'admin', $parameters);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,1025 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Service;
|
||||
|
||||
use OC\Authentication\Token\IToken;
|
||||
use OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException;
|
||||
use OCP\App\IAppManager;
|
||||
use \OCP\IConfig;
|
||||
use \OCP\IUserSession;
|
||||
use \OCP\IUserManager;
|
||||
use \OCP\IURLGenerator;
|
||||
|
||||
/**
|
||||
* Class UserService
|
||||
*
|
||||
* @package OCA\UserCAS\Service
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4.0
|
||||
*/
|
||||
class AppService
|
||||
{
|
||||
|
||||
/**
|
||||
* @var string $appName
|
||||
*/
|
||||
private $appName;
|
||||
|
||||
/**
|
||||
* @var \OCP\IConfig $appConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\LoggingService
|
||||
*/
|
||||
private $loggingService;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserManager $userManager
|
||||
*/
|
||||
private $userManager;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserSession $userSession
|
||||
*/
|
||||
private $userSession;
|
||||
|
||||
/**
|
||||
* @var \OCP\IURLGenerator $urlGenerator
|
||||
*/
|
||||
private $urlGenerator;
|
||||
|
||||
/**
|
||||
* @var IAppManager $appManager
|
||||
*/
|
||||
private $appManager;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casVersion;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casHostname;
|
||||
|
||||
/**
|
||||
* @var int
|
||||
*/
|
||||
private $casPort;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casPath;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casDebugFile;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casCertPath;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casPhpFile;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $casServiceUrl;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $casDisableLogout;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $casDisableSinglesignout;
|
||||
|
||||
/**
|
||||
* @var array
|
||||
*/
|
||||
private $casHandleLogoutServers;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $casKeepTicketIds;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $cas_ecas_accepted_strengths;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $cas_ecas_retrieve_groups;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $cas_ecas_assurance_level;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $cas_ecas_request_full_userdetails;
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
private $cas_ecas_internal_ip_range;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $casInitialized;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $ecasAttributeParserEnabled;
|
||||
|
||||
/**
|
||||
* @var boolean
|
||||
*/
|
||||
private $casUseProxy;
|
||||
|
||||
/**
|
||||
* UserService constructor.
|
||||
* @param $appName
|
||||
* @param \OCP\IConfig $config
|
||||
* @param \OCA\UserCAS\Service\LoggingService $loggingService
|
||||
* @param \OCP\IUserManager $userManager
|
||||
* @param \OCP\IUserSession $userSession
|
||||
* @param \OCP\IURLGenerator $urlGenerator
|
||||
* @param IAppManager $appManager
|
||||
*/
|
||||
public function __construct($appName, IConfig $config, LoggingService $loggingService, IUserManager $userManager, IUserSession $userSession, IURLGenerator $urlGenerator, IAppManager $appManager)
|
||||
{
|
||||
|
||||
$this->appName = $appName;
|
||||
$this->config = $config;
|
||||
$this->loggingService = $loggingService;
|
||||
$this->userManager = $userManager;
|
||||
$this->userSession = $userSession;
|
||||
$this->urlGenerator = $urlGenerator;
|
||||
$this->appManager = $appManager;
|
||||
$this->casInitialized = FALSE;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* init method.
|
||||
* @throws PhpUserCasLibraryNotFoundException
|
||||
*/
|
||||
public function init()
|
||||
{
|
||||
|
||||
$serverHostName = (isset($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : '';
|
||||
|
||||
// Gather all app config values
|
||||
$this->casVersion = $this->config->getAppValue($this->appName, 'cas_server_version', '3.0');
|
||||
$this->casHostname = $this->config->getAppValue($this->appName, 'cas_server_hostname', $serverHostName);
|
||||
$this->casPort = intval($this->config->getAppValue($this->appName, 'cas_server_port', 443));
|
||||
$this->casPath = $this->config->getAppValue($this->appName, 'cas_server_path', '/cas');
|
||||
$this->casServiceUrl = $this->config->getAppValue($this->appName, 'cas_service_url', '');
|
||||
$this->casCertPath = $this->config->getAppValue($this->appName, 'cas_cert_path', '');
|
||||
|
||||
|
||||
// Correctly handle cas server path for document root
|
||||
if ($this->casPath === '/') {
|
||||
$this->casPath = '';
|
||||
}
|
||||
|
||||
$this->casUseProxy = boolval($this->config->getAppValue($this->appName, 'cas_use_proxy', false));
|
||||
$this->casDisableLogout = boolval($this->config->getAppValue($this->appName, 'cas_disable_logout', false));
|
||||
$this->casDisableSinglesignout = boolval($this->config->getAppValue($this->appName, 'cas_disable_singlesignout', false));
|
||||
$logoutServersArray = explode(",", $this->config->getAppValue($this->appName, 'cas_handlelogout_servers', ''));
|
||||
$this->casHandleLogoutServers = array();
|
||||
$this->casKeepTicketIds = boolval($this->config->getAppValue($this->appName, 'cas_keep_ticket_ids', false));
|
||||
|
||||
# ECAS
|
||||
$this->ecasAttributeParserEnabled = boolval($this->config->getAppValue($this->appName, 'cas_ecas_attributeparserenabled', false));
|
||||
$this->cas_ecas_request_full_userdetails = boolval($this->config->getAppValue($this->appName, 'cas_ecas_request_full_userdetails', false));
|
||||
$this->cas_ecas_accepted_strengths = $this->config->getAppValue($this->appName, 'cas_ecas_accepted_strengths');
|
||||
$this->cas_ecas_retrieve_groups = $this->config->getAppValue($this->appName, 'cas_ecas_retrieve_groups');
|
||||
$this->cas_ecas_assurance_level = $this->config->getAppValue($this->appName, 'cas_ecas_assurance_level');
|
||||
$this->cas_ecas_internal_ip_range = $this->config->getAppValue($this->appName, 'cas_ecas_internal_ip_range');
|
||||
|
||||
|
||||
foreach ($logoutServersArray as $casHandleLogoutServer) {
|
||||
|
||||
$casHandleLogoutServer = ltrim(trim($casHandleLogoutServer));
|
||||
|
||||
if (strlen($casHandleLogoutServer) > 4) {
|
||||
|
||||
$this->casHandleLogoutServers[] = $casHandleLogoutServer;
|
||||
}
|
||||
}
|
||||
|
||||
$this->casDebugFile = $this->config->getAppValue($this->appName, 'cas_debug_file', '');
|
||||
$this->casPhpFile = $this->config->getAppValue($this->appName, 'cas_php_cas_path', '');
|
||||
|
||||
if (is_string($this->casPhpFile) && strlen($this->casPhpFile) > 0) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'Use custom phpCAS file:: ' . $this->casPhpFile);
|
||||
#\OCP\Util::writeLog('cas', 'Use custom phpCAS file:: ' . $this->casPhpFile, \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
|
||||
if (is_file($this->casPhpFile)) {
|
||||
|
||||
require_once("$this->casPhpFile");
|
||||
} else {
|
||||
|
||||
throw new PhpUserCasLibraryNotFoundException('Your custom phpCAS library could not be loaded. The class was not found. Please disable the app with ./occ command or in Database and adjust the path to your library (or remove it to use the shipped library).', 500);
|
||||
}
|
||||
|
||||
} else {
|
||||
|
||||
if (is_file(__DIR__ . '/../../vendor/jasig/phpcas/CAS.php')) {
|
||||
|
||||
require_once(__DIR__ . '/../../vendor/jasig/phpcas/CAS.php');
|
||||
} else {
|
||||
|
||||
throw new PhpUserCasLibraryNotFoundException('phpCAS library could not be loaded. The class was not found.', 500);
|
||||
}
|
||||
}
|
||||
|
||||
if (!class_exists('\\phpCAS')) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'phpCAS library could not be loaded. The class was not found.');
|
||||
|
||||
throw new PhpUserCasLibraryNotFoundException('phpCAS library could not be loaded. The class was not found.', 500);
|
||||
}
|
||||
|
||||
if (!\phpCAS::isInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
\phpCAS::setVerbose(FALSE);
|
||||
|
||||
if (!empty($this->casDebugFile)) {
|
||||
|
||||
\phpCAS::setDebug($this->casDebugFile);
|
||||
\phpCAS::setVerbose(TRUE);
|
||||
}
|
||||
|
||||
$serviceBasedUrl = $this->getServiceBasedUrl();
|
||||
|
||||
# Initialize client
|
||||
if ($this->casUseProxy) {
|
||||
|
||||
\phpCAS::proxy($this->casVersion, $this->casHostname, (int)($this->casPort), $this->casPath, $serviceBasedUrl);
|
||||
} else {
|
||||
|
||||
\phpCAS::client($this->casVersion, $this->casHostname, (int)($this->casPort), $this->casPath, $serviceBasedUrl);
|
||||
}
|
||||
|
||||
# Handle SingleSignout requests
|
||||
if (!$this->casDisableSinglesignout) {
|
||||
|
||||
\phpCAS::setSingleSignoutCallback([$this, 'casSingleSignOut']);
|
||||
\phpCAS::handleLogoutRequests(true, $this->casHandleLogoutServers);
|
||||
}
|
||||
|
||||
# Handle fixed service URL
|
||||
if (!empty($this->casServiceUrl)) {
|
||||
|
||||
\phpCAS::setFixedServiceURL($this->casServiceUrl);
|
||||
}
|
||||
|
||||
# Handle certificate
|
||||
if (!empty($this->casCertPath)) {
|
||||
|
||||
\phpCAS::setCasServerCACert($this->casCertPath);
|
||||
} else {
|
||||
|
||||
\phpCAS::setNoCasServerValidation();
|
||||
}
|
||||
|
||||
# Handle keeping of cas-ticket-ids
|
||||
if ($this->casKeepTicketIds) {
|
||||
|
||||
\phpCAS::setNoClearTicketsFromUrl();
|
||||
}
|
||||
|
||||
# Handle ECAS Attributes if enabled
|
||||
if ($this->ecasAttributeParserEnabled) {
|
||||
|
||||
if (is_file(__DIR__ . '/../../vendor/ec-europa/ecas-phpcas-parser/src/EcasPhpCASParser.php')) {
|
||||
|
||||
require_once(__DIR__ . '/../../vendor/ec-europa/ecas-phpcas-parser/src/EcasPhpCASParser.php');
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'phpCAS EcasPhpCASParser library could not be loaded. The class was not found.');
|
||||
|
||||
throw new PhpUserCasLibraryNotFoundException('phpCAS EcasPhpCASParser could not be loaded. The class was not found.', 500);
|
||||
}
|
||||
|
||||
# Register the parser
|
||||
\phpCAS::setCasAttributeParserCallback(array(new \EcasPhpCASParser\EcasPhpCASParser(), 'parse'));
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS EcasPhpCASParser has been successfully set.");
|
||||
}
|
||||
|
||||
#### Register the new ticket validation url
|
||||
if ((is_string($this->cas_ecas_retrieve_groups) && strlen($this->cas_ecas_retrieve_groups) > 0)
|
||||
|| ($this->cas_ecas_request_full_userdetails)
|
||||
|| (is_string($this->cas_ecas_assurance_level) && strlen($this->cas_ecas_assurance_level) > 0)
|
||||
|| (is_string($this->cas_ecas_accepted_strengths) && strlen($this->cas_ecas_accepted_strengths) > 0)) {
|
||||
|
||||
|
||||
## Check for external IP Ranges to en-/disable the Two-Factor-Authentication (AcceptedStrength at least MEDIUM)
|
||||
if ($this->isIpInLocalRange($this->cas_ecas_internal_ip_range) && $this->cas_ecas_accepted_strengths !== '') {
|
||||
|
||||
$this->cas_ecas_accepted_strengths = 'BASIC';
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS AcceptedStrength Level is forced to BASIC, because the user is in the internal network. Test Address: " . $endIp . " | Users Remote Address: " . $remoteAddress);
|
||||
}
|
||||
|
||||
# Add acceptedStrength Querystring Parameters
|
||||
if (is_string($this->cas_ecas_accepted_strengths) && strlen($this->cas_ecas_accepted_strengths) > 0) {
|
||||
|
||||
# Register the new login url
|
||||
$serverLoginUrl = \phpCAS::getServerLoginURL();
|
||||
|
||||
$serverLoginUrl = $this->buildQueryUrl($serverLoginUrl, 'acceptStrengths=' . urlencode($this->cas_ecas_accepted_strengths));
|
||||
|
||||
\phpCAS::setServerLoginURL($serverLoginUrl);
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS strength attribute has been successfully set. New service login URL: " . $serverLoginUrl);
|
||||
}
|
||||
|
||||
## Change validation URL based on ECAS assuranceLevel
|
||||
$newProtocol = 'http://';
|
||||
$newUrl = '';
|
||||
$newSamlUrl = '';
|
||||
|
||||
if ($this->getCasPort() === 443) {
|
||||
|
||||
$newProtocol = 'https://';
|
||||
}
|
||||
|
||||
if ($this->getCasVersion() === "1.0") {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/validate';
|
||||
} else if ($this->getCasVersion() === "2.0") {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/serviceValidate';
|
||||
} else if ($this->getCasVersion() === "3.0") {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/p3/serviceValidate';
|
||||
} else if ($this->getCasVersion() === "S1") {
|
||||
|
||||
$newSamlUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/samlValidate';
|
||||
}
|
||||
|
||||
if (is_string($this->cas_ecas_assurance_level) && $this->cas_ecas_assurance_level === 'LOW') {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/laxValidate';
|
||||
} else if (is_string($this->cas_ecas_assurance_level) && $this->cas_ecas_assurance_level === 'MEDIUM') {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/sponsorValidate';
|
||||
} else if (is_string($this->cas_ecas_assurance_level) && $this->cas_ecas_assurance_level === 'HIGH') {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/interinstitutionalValidate';
|
||||
} else if (is_string($this->cas_ecas_assurance_level) && $this->cas_ecas_assurance_level === 'TOP') {
|
||||
|
||||
$newUrl = $newProtocol . $this->getCasHostname() . $this->getCasPath() . '/strictValidate';
|
||||
}
|
||||
|
||||
if (!empty($this->casServiceUrl)) {
|
||||
|
||||
$newUrl = $this->buildQueryUrl($newUrl, 'service=' . urlencode($this->casServiceUrl));
|
||||
$newSamlUrl = $this->buildQueryUrl($newSamlUrl, 'TARGET=' . urlencode($this->casServiceUrl));
|
||||
} else {
|
||||
|
||||
$newUrl = $this->buildQueryUrl($newUrl, 'service=' . urlencode(\phpCAS::getServiceURL()));
|
||||
$newSamlUrl = $this->buildQueryUrl($newSamlUrl, 'TARGET=' . urlencode(\phpCAS::getServiceURL()));
|
||||
}
|
||||
|
||||
# Add the groups to retrieve
|
||||
if (is_string($this->cas_ecas_retrieve_groups) && strlen($this->cas_ecas_retrieve_groups) > 0) {
|
||||
|
||||
$newUrl = $this->buildQueryUrl($newUrl, 'groups=' . urlencode($this->cas_ecas_retrieve_groups));
|
||||
$newSamlUrl = $this->buildQueryUrl($newSamlUrl, 'groups=' . urlencode($this->cas_ecas_retrieve_groups));
|
||||
}
|
||||
|
||||
# Add the requestFullUserDetails flag
|
||||
if ($this->cas_ecas_request_full_userdetails) {
|
||||
|
||||
$newUrl = $this->buildQueryUrl($newUrl, 'userDetails=' . urlencode('true'));
|
||||
$newSamlUrl = $this->buildQueryUrl($newSamlUrl, 'userDetails=' . urlencode('true'));
|
||||
}
|
||||
|
||||
# Set the user agent to mimic an ecas client
|
||||
$userAgent = sprintf("ECAS PHP Client (%s, %s)",
|
||||
'2.1.3',
|
||||
$_SERVER['SERVER_SOFTWARE']);
|
||||
\phpCAS::setExtraCurlOption(CURLOPT_USERAGENT, $userAgent);
|
||||
|
||||
# Set the new URLs
|
||||
if ($this->getCasVersion() !== "S1" && !empty($newUrl)) {
|
||||
|
||||
\phpCAS::setServerServiceValidateURL($newUrl);
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS additional attributes have been successfully set. New CAS " . $this->getCasVersion() . " service validate URL: " . $newUrl);
|
||||
|
||||
} elseif ($this->getCasVersion() === "S1" && !empty($newSamlUrl)) {
|
||||
|
||||
\phpCAS::setServerSamlValidateURL($newSamlUrl);
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS additional attributes have been successfully set. New SAML 1.0 service validate URL: " . $newSamlUrl);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
$this->casInitialized = TRUE;
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS has been successfully initialized.");
|
||||
|
||||
} catch (\CAS_Exception $e) {
|
||||
|
||||
\phpCAS::setVerbose(TRUE);
|
||||
|
||||
$this->casInitialized = FALSE;
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, "phpCAS has thrown an exception with code: " . $e->getCode() . " and message: " . $e->getMessage() . ".");
|
||||
}
|
||||
} else {
|
||||
|
||||
$this->casInitialized = TRUE;
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS has already been initialized.");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Test if the instance is not a Nextcloud instance
|
||||
*
|
||||
* @return bool
|
||||
*/
|
||||
public function isNotNextcloud()
|
||||
{
|
||||
|
||||
require __DIR__ . '/../../../../version.php';
|
||||
|
||||
/**
|
||||
* @var string $vendor The vendor of this instance
|
||||
*/
|
||||
|
||||
#$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS vendor: ".$vendor);
|
||||
|
||||
if (strpos(strtolower($vendor), 'next') === FALSE) {
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if login should be enforced using user_cas.
|
||||
*
|
||||
* @param $remoteAddress
|
||||
* @param string $requestUri
|
||||
* @return bool TRUE|FALSE
|
||||
*/
|
||||
public function isEnforceAuthentication($remoteAddress, $requestUri)
|
||||
{
|
||||
|
||||
$isEnforced = TRUE;
|
||||
|
||||
$forceLoginExceptions = $this->config->getAppValue($this->appName, 'cas_force_login_exceptions', '');
|
||||
$forceLoginExceptionsArray = explode(',', $forceLoginExceptions);
|
||||
|
||||
# Enforce off
|
||||
if ($this->config->getAppValue($this->appName, 'cas_force_login') !== '1') {
|
||||
|
||||
$isEnforced = FALSE;
|
||||
} else {
|
||||
|
||||
# Check enforce IP ranges
|
||||
foreach ($forceLoginExceptionsArray as $forceLoginException) {
|
||||
|
||||
$forceLoginExceptionRanges = explode('-', $forceLoginException);
|
||||
|
||||
if (isset($forceLoginExceptionRanges[0])) {
|
||||
|
||||
if (isset($forceLoginExceptionRanges[1])) {
|
||||
|
||||
$baseIpComponents = explode('.', $forceLoginExceptionRanges[0]);
|
||||
|
||||
$baseIp = $baseIpComponents[0] . '.' . $baseIpComponents[1] . '.';
|
||||
|
||||
$additionalIpComponents = explode('.', $forceLoginExceptionRanges[1]);
|
||||
|
||||
if (isset($additionalIpComponents[1]) && $additionalIpComponents[0]) {
|
||||
|
||||
# We have a two part range here (eg. 127.0.0.1-1.19) which means, we have to cover 127.0.0.1-127.0.0.254 and 127.0.1.1-127.0.1.19
|
||||
|
||||
for ($ipThirdPart = intval($baseIpComponents[2]); $ipThirdPart <= intval($additionalIpComponents[0]); $ipThirdPart++) {
|
||||
|
||||
if ($ipThirdPart !== intval($additionalIpComponents[0])) {
|
||||
|
||||
$ipFourthPartMax = 254;
|
||||
} else {
|
||||
|
||||
$ipFourthPartMax = intval($additionalIpComponents[1]);
|
||||
}
|
||||
|
||||
for ($ipFourthPart = intval($baseIpComponents[3]); $ipFourthPart <= $ipFourthPartMax; $ipFourthPart++) {
|
||||
|
||||
$endIp = $baseIp . $ipThirdPart . '.' . $ipFourthPart;
|
||||
|
||||
#$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS Enforce Login IP checked: " . $endIp);
|
||||
|
||||
if ($remoteAddress === $endIp) {
|
||||
|
||||
$isEnforced = FALSE;
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS Enforce Login NOT triggered. Test Address: " . $endIp . " | Users Remote Address: " . $remoteAddress);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} elseif ($additionalIpComponents[0]) {
|
||||
|
||||
# We have a one part range here (eg. 127.0.0.1-19)
|
||||
|
||||
$newIp = $baseIp . $baseIpComponents[2] . '.';
|
||||
|
||||
for ($ipFourthPart = intval($baseIpComponents[3]); $ipFourthPart <= intval($additionalIpComponents[0]); $ipFourthPart++) {
|
||||
|
||||
$endIp = $newIp . $ipFourthPart;
|
||||
|
||||
if ($remoteAddress === $endIp) {
|
||||
|
||||
$isEnforced = FALSE;
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS Enforce Login NOT triggered. Test Address: " . $endIp . " | Users Remote Address: " . $remoteAddress);
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
# Single IP-Adress given
|
||||
if ($remoteAddress === $forceLoginExceptionRanges[0]) {
|
||||
|
||||
$isEnforced = FALSE;
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS Enforce Login NOT triggered. Test Address: " . $forceLoginExceptionRanges[0] . " | Users Remote Address: " . $remoteAddress);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# User already logged in
|
||||
if ($this->userSession->isLoggedIn()) {
|
||||
|
||||
$isEnforced = FALSE;
|
||||
}
|
||||
|
||||
# Disable on Nextcloud login-flow use
|
||||
if (!$this->isNotNextcloud() && strpos($requestUri, "/login/flow") !== FALSE) {
|
||||
|
||||
$isEnforced = FALSE;
|
||||
}
|
||||
|
||||
return $isEnforced;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if public shares should be protected
|
||||
*
|
||||
* @return bool TRUE|FALSE
|
||||
*/
|
||||
public function arePublicSharesProtected()
|
||||
{
|
||||
$protected = (bool)$this->config->getAppValue($this->appName, 'cas_shares_protected', FALSE);
|
||||
$loggedIn = $this->userSession->isLoggedIn();
|
||||
|
||||
if($loggedIn && $protected) {
|
||||
$protected = FALSE;
|
||||
}
|
||||
|
||||
return $protected;
|
||||
}
|
||||
|
||||
/**
|
||||
* Register Login
|
||||
*
|
||||
*/
|
||||
public function registerLogIn()
|
||||
{
|
||||
|
||||
$loginButtonLabel = $this->config->getAppValue($this->appName, 'cas_login_button_label', 'CAS Login');
|
||||
|
||||
// Login Button handling
|
||||
if (strlen($loginButtonLabel) <= 0) {
|
||||
|
||||
$loginButtonLabel = 'CAS Login';
|
||||
}
|
||||
|
||||
$this->unregisterLogin();
|
||||
|
||||
if ($this->isNotNextcloud()) {
|
||||
|
||||
/** @var array $loginAlternatives */
|
||||
/*$loginAlternatives = $this->config->getSystemValue('login.alternatives', []);
|
||||
|
||||
$loginAlreadyRegistered = FALSE;
|
||||
|
||||
foreach ($loginAlternatives as $key => $loginAlternative) {
|
||||
|
||||
if (isset($loginAlternative['name']) && $loginAlternative['name'] === $loginButtonLabel) {
|
||||
|
||||
$loginAlternatives[$key]['href'] = $this->linkToRoute($this->appName . '.authentication.casLogin');
|
||||
$this->config->setSystemValue('login.alternatives', $loginAlternatives);
|
||||
$loginAlreadyRegistered = TRUE;
|
||||
}
|
||||
}
|
||||
|
||||
if (!$loginAlreadyRegistered) {*/
|
||||
|
||||
$loginAlternatives[] = ['href' => $this->linkToRoute($this->appName . '.authentication.casLogin'), 'name' => $loginButtonLabel, 'img' => $this->appManager->getAppWebPath($this->appName).'/img/cas-logo.png'];
|
||||
|
||||
$this->config->setSystemValue('login.alternatives', $loginAlternatives);
|
||||
#}
|
||||
} else {
|
||||
|
||||
#$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS Nextcloud " . $version[0] . "." . $version[1] . "." . $version[2] . "." . " detected.");
|
||||
\OC_App::registerLogIn(array('href' => $this->linkToRoute($this->appName . '.authentication.casLogin'), 'name' => $loginButtonLabel));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* UnregisterLogin
|
||||
*/
|
||||
public function unregisterLogin()
|
||||
{
|
||||
|
||||
$loginButtonLabel = $this->config->getAppValue($this->appName, 'cas_login_button_label', 'CAS Login');
|
||||
|
||||
// Login Button handling
|
||||
if (strlen($loginButtonLabel) <= 0) {
|
||||
|
||||
$loginButtonLabel = 'CAS Login';
|
||||
}
|
||||
|
||||
if ($this->isNotNextcloud()) {
|
||||
|
||||
$loginAlternatives = $this->config->getSystemValue('login.alternatives', []);
|
||||
|
||||
foreach ($loginAlternatives as $key => $loginAlternative) {
|
||||
|
||||
if (isset($loginAlternative['name']) && ($loginAlternative['name'] === $loginButtonLabel || $loginAlternative['name'] === 'CAS Login')) {
|
||||
|
||||
unset($loginAlternatives[$key]);
|
||||
}
|
||||
}
|
||||
|
||||
$this->config->setSystemValue('login.alternatives', $loginAlternatives);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @return bool
|
||||
*/
|
||||
public function isSetupValid()
|
||||
{
|
||||
|
||||
$casHostname = $this->config->getAppValue($this->appName, 'cas_server_hostname');
|
||||
$casPort = intval($this->config->getAppValue($this->appName, 'cas_server_port'));
|
||||
$casPath = $this->config->getAppValue($this->appName, 'cas_server_path');
|
||||
|
||||
if (is_string($casHostname) && strlen($casHostname) > 1 && is_int($casPort) && $casPort > 1 && is_string($casPath) && strpos($casPath, "/") === 0) {
|
||||
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a link to $route with URLGenerator.
|
||||
*
|
||||
* @param string $route
|
||||
* @param array $arguments
|
||||
* @return string
|
||||
*/
|
||||
public function linkToRoute($route, $arguments = array())
|
||||
{
|
||||
|
||||
return $this->urlGenerator->linkToRoute($route, $arguments);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an absolute link to $route with URLGenerator.
|
||||
*
|
||||
* @param string $route
|
||||
* @param array $arguments
|
||||
* @return string
|
||||
*/
|
||||
public function linkToRouteAbsolute($route, $arguments = array())
|
||||
{
|
||||
|
||||
return $this->urlGenerator->linkToRouteAbsolute($route, $arguments);
|
||||
}
|
||||
|
||||
/**
|
||||
* Create an url relative to owncloud host
|
||||
*
|
||||
* @param string $url
|
||||
* @return mixed
|
||||
*/
|
||||
public function getAbsoluteURL($url)
|
||||
{
|
||||
|
||||
return $this->urlGenerator->getAbsoluteURL($url);
|
||||
}
|
||||
|
||||
/**
|
||||
* @return boolean
|
||||
*/
|
||||
public function isCasInitialized()
|
||||
{
|
||||
return $this->casInitialized;
|
||||
}
|
||||
|
||||
/**
|
||||
* This method is used to append query parameters to an url. Since the url
|
||||
* might already contain parameter it has to be detected and to build a proper
|
||||
* URL
|
||||
*
|
||||
* @param string $url base url to add the query params to
|
||||
* @param string $query params in query form with & separated
|
||||
*
|
||||
* @return string url with query params
|
||||
*/
|
||||
private function buildQueryUrl($url, $query)
|
||||
{
|
||||
$url .= (strstr($url, '?') === false) ? '?' : '&';
|
||||
$url .= $query;
|
||||
return $url;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Test if the client’s IP adress is in our local range
|
||||
*
|
||||
* @param string|array $internalIps
|
||||
* @return bool TRUE|FALSE
|
||||
*/
|
||||
private function isIpInLocalRange($internalIps)
|
||||
{
|
||||
|
||||
if (is_string($internalIps)) {
|
||||
|
||||
$internalIps = explode(',', $internalIps);
|
||||
}
|
||||
|
||||
$remoteAddress = $_SERVER['REMOTE_ADDR'];
|
||||
|
||||
$proxyHeader = "HTTP_X_FORWARDED_FOR";
|
||||
|
||||
# Header can contain multiple IP-s of proxies that are passed through.
|
||||
# Only the IP added by the last proxy (last IP in the list) can be trusted.
|
||||
if (array_key_exists($proxyHeader, $_SERVER)) {
|
||||
|
||||
$explodedProxyHeader = explode(",", $_SERVER[$proxyHeader]);
|
||||
$proxyIp = trim(end($explodedProxyHeader));
|
||||
|
||||
if (filter_var($proxyIp, FILTER_VALIDATE_IP)) {
|
||||
|
||||
$remoteAddress = $proxyIp;
|
||||
}
|
||||
}
|
||||
|
||||
# Check enforce IP ranges for acceptedStrength attribute
|
||||
foreach ($internalIps as $internalIp) {
|
||||
|
||||
$internalIpRanges = explode('-', $internalIp);
|
||||
|
||||
if (isset($internalIpRanges[0])) {
|
||||
|
||||
if (isset($internalIpRanges[1])) {
|
||||
|
||||
$baseIpComponents = explode('.', $internalIpRanges[0]);
|
||||
|
||||
$baseIp = $baseIpComponents[0] . '.' . $baseIpComponents[1] . '.';
|
||||
|
||||
$additionalIpComponents = explode('.', $internalIpRanges[1]);
|
||||
|
||||
if (isset($additionalIpComponents[1]) && $additionalIpComponents[0]) {
|
||||
|
||||
# We have a two part range here (eg. 127.0.0.1-1.19) which means, we have to cover 127.0.0.1-127.0.0.254 and 127.0.1.1-127.0.1.19
|
||||
|
||||
for ($ipThirdPart = intval($baseIpComponents[2]); $ipThirdPart <= intval($additionalIpComponents[0]); $ipThirdPart++) {
|
||||
|
||||
if ($ipThirdPart !== intval($additionalIpComponents[0])) {
|
||||
|
||||
$ipFourthPartMax = 254;
|
||||
} else {
|
||||
|
||||
$ipFourthPartMax = intval($additionalIpComponents[1]);
|
||||
}
|
||||
|
||||
for ($ipFourthPart = intval($baseIpComponents[3]); $ipFourthPart <= $ipFourthPartMax; $ipFourthPart++) {
|
||||
|
||||
$endIp = $baseIp . $ipThirdPart . '.' . $ipFourthPart;
|
||||
|
||||
#$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS Enforce Login IP checked: " . $endIp);
|
||||
|
||||
if ($remoteAddress === $endIp) {
|
||||
|
||||
return TRUE;
|
||||
|
||||
/*if ($this->cas_ecas_accepted_strengths !== '') {
|
||||
|
||||
$this->cas_ecas_accepted_strengths = 'BASIC';
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS AcceptedStrength Level is forced to BASIC, because the user is in the internal network. Test Address: " . $endIp . " | Users Remote Address: " . $remoteAddress);
|
||||
}*/
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
} elseif ($additionalIpComponents[0]) {
|
||||
|
||||
# We have a one part range here (eg. 127.0.0.1-19)
|
||||
|
||||
$newIp = $baseIp . $baseIpComponents[2] . '.';
|
||||
|
||||
for ($ipFourthPart = intval($baseIpComponents[3]); $ipFourthPart <= intval($additionalIpComponents[0]); $ipFourthPart++) {
|
||||
|
||||
$endIp = $newIp . $ipFourthPart;
|
||||
|
||||
if ($remoteAddress === $endIp) {
|
||||
|
||||
return TRUE;
|
||||
|
||||
/*if ($this->cas_ecas_accepted_strengths !== '') {
|
||||
|
||||
$this->cas_ecas_accepted_strengths = 'BASIC';
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS AcceptedStrength is forced to BASIC, because the user is in the internal network. Test Address: " . $endIp . " | Users Remote Address: " . $remoteAddress);
|
||||
}*/
|
||||
}
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
||||
# Single IP-Adress given
|
||||
if ($remoteAddress === $internalIpRanges[0]) {
|
||||
|
||||
return TRUE;
|
||||
|
||||
/*if ($this->cas_ecas_accepted_strengths !== '') {
|
||||
|
||||
$this->cas_ecas_accepted_strengths = 'BASIC';
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, "phpCAS ECAS AcceptedStrength is forced to BASIC, because the user is in the internal network. Test Address: " . $internalIpRanges[0] . " | Users Remote Address: " . $remoteAddress);
|
||||
}*/
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/**
|
||||
* Callback function for CAS singleSignOut call
|
||||
*
|
||||
* @author Vincent <https://github.com/pingou2712>
|
||||
*
|
||||
* @param string $ticket Ticket Object
|
||||
*/
|
||||
public function casSingleSignOut($ticket)
|
||||
{
|
||||
// Extract the userID from the SAML Request
|
||||
$decodedLogoutRequest = urldecode($_POST['logoutRequest']);
|
||||
preg_match(
|
||||
"|<saml:NameID[^>]*>(.*)</saml:NameID>|",
|
||||
$decodedLogoutRequest, $tick, PREG_OFFSET_CAPTURE, 3
|
||||
);
|
||||
$wrappedSamlNameId = preg_replace(
|
||||
'|<saml:NameID[^>]*>|', '', $tick[0][0]
|
||||
);
|
||||
$nameId = preg_replace(
|
||||
'|</saml:NameID>|', '', $wrappedSamlNameId
|
||||
);
|
||||
|
||||
//Kill Session Of UserID:
|
||||
$this->killSessionUserName($nameId);
|
||||
}
|
||||
|
||||
/**
|
||||
* Kill the username's session.
|
||||
*
|
||||
* @author Vincent <https://github.com/pingou2712>
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @param string $username The username of the user.
|
||||
* @return NULL
|
||||
*/
|
||||
private function killSessionUserName($username)
|
||||
{
|
||||
|
||||
if ($this->userManager->userExists($username)) {
|
||||
|
||||
$tokenType = IToken::TEMPORARY_TOKEN;
|
||||
|
||||
$sql = "DELETE FROM oc_authtoken WHERE uid = ? AND type = ? AND password IS NULL;";
|
||||
$stmt = \OC::$server->getDatabaseConnection()->prepare($sql);
|
||||
$stmt->bindParam(1, $username, \PDO::PARAM_STR);
|
||||
$stmt->bindParam(2, $tokenType, \PDO::PARAM_INT);
|
||||
|
||||
$stmt->execute();
|
||||
}
|
||||
|
||||
return NULL;
|
||||
}
|
||||
|
||||
|
||||
## Setters/Getters
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getAppName()
|
||||
{
|
||||
return $this->appName;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getCasVersion()
|
||||
{
|
||||
return $this->casVersion;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getCasHostname()
|
||||
{
|
||||
return $this->casHostname;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return int
|
||||
*/
|
||||
public function getCasPort()
|
||||
{
|
||||
return $this->casPort;
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getCasPath()
|
||||
{
|
||||
return $this->casPath;
|
||||
}
|
||||
|
||||
private function getServiceBasedUrl(): string {
|
||||
$overwrite = \OC::$server->getConfig()->getSystemValue('overwrite.cli.url');
|
||||
if($overwrite) return $overwrite;
|
||||
|
||||
$httpProtocol = \OC::$server->getConfig()->getSystemValue('protocol');
|
||||
$currentUrl = $_SERVER['SERVER_NAME'];
|
||||
|
||||
return $httpProtocol . $currentUrl;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,477 @@
|
|||
<?php
|
||||
|
||||
|
||||
namespace OCA\UserCAS\Service\Import;
|
||||
|
||||
use OCA\UserCAS\Service\Merge\AdUserMerger;
|
||||
use OCA\UserCAS\Service\Merge\MergerInterface;
|
||||
use OCP\IConfig;
|
||||
use Psr\Log\LoggerInterface;
|
||||
|
||||
|
||||
/**
|
||||
* Class AdImporter
|
||||
* @package OCA\UserCAS\Service\Import
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
class AdImporter implements ImporterInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* @var boolean|resource
|
||||
*/
|
||||
private $ldapConnection;
|
||||
|
||||
/**
|
||||
* @var MergerInterface $merger
|
||||
*/
|
||||
private $merger;
|
||||
|
||||
/**
|
||||
* @var LoggerInterface $logger
|
||||
*/
|
||||
private $logger;
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* @var string $appName
|
||||
*/
|
||||
private $appName = 'user_cas';
|
||||
|
||||
|
||||
/**
|
||||
* AdImporter constructor.
|
||||
* @param IConfig $config
|
||||
*/
|
||||
public function __construct(IConfig $config)
|
||||
{
|
||||
|
||||
$this->config = $config;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param LoggerInterface $logger
|
||||
*
|
||||
* @throws \Exception
|
||||
*/
|
||||
public function init(LoggerInterface $logger)
|
||||
{
|
||||
|
||||
$this->merger = new AdUserMerger($logger);
|
||||
$this->logger = $logger;
|
||||
|
||||
$this->ldapConnect();
|
||||
$this->ldapBind();
|
||||
|
||||
$this->logger->info("Init complete.");
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws \Exception
|
||||
*/
|
||||
public function close()
|
||||
{
|
||||
|
||||
$this->ldapClose();
|
||||
}
|
||||
|
||||
/**
|
||||
* Get User data
|
||||
*
|
||||
* @return array User data
|
||||
*/
|
||||
public function getUsers()
|
||||
{
|
||||
|
||||
$uidAttribute = $this->config->getAppValue($this->appName, 'cas_import_map_uid');
|
||||
|
||||
$displayNameAttribute1 = $this->config->getAppValue($this->appName, 'cas_import_map_displayname');
|
||||
$displayNameAttribute2 = '';
|
||||
|
||||
if (strpos($displayNameAttribute1, "+") !== FALSE) {
|
||||
$displayNameAttributes = explode("+", $displayNameAttribute1);
|
||||
$displayNameAttribute1 = $displayNameAttributes[0];
|
||||
$displayNameAttribute2 = $displayNameAttributes[1];
|
||||
}
|
||||
|
||||
|
||||
$emailAttribute = $this->config->getAppValue($this->appName, 'cas_import_map_email');
|
||||
$groupsAttribute = $this->config->getAppValue($this->appName, 'cas_import_map_groups');
|
||||
$quotaAttribute = $this->config->getAppValue($this->appName, 'cas_import_map_quota');
|
||||
$enableAttribute = $this->config->getAppValue($this->appName, 'cas_import_map_enabled');
|
||||
$dnAttribute = $this->config->getAppValue($this->appName, 'cas_import_map_dn');
|
||||
$mergeAttribute = boolval($this->config->getAppValue($this->appName, 'cas_import_merge'));
|
||||
$primaryAccountDnStartswWith = $this->config->getAppValue($this->appName, 'cas_import_map_dn_filter');
|
||||
$preferEnabledAccountsOverDisabled = boolval($this->config->getAppValue($this->appName, 'cas_import_merge_enabled'));
|
||||
$andEnableAttributeBitwise = $this->config->getAppValue($this->appName, 'cas_import_map_enabled_and_bitwise');
|
||||
|
||||
$keep = [$uidAttribute, $displayNameAttribute1, $displayNameAttribute2, $emailAttribute, $groupsAttribute, $quotaAttribute, $enableAttribute, $dnAttribute];
|
||||
|
||||
$groupAttrField = $this->config->getAppValue($this->appName, 'cas_import_map_groups_description');
|
||||
$groupsKeep = [$groupAttrField];
|
||||
|
||||
$pageSize = $this->config->getAppValue($this->appName, 'cas_import_ad_sync_pagesize');
|
||||
|
||||
$users = [];
|
||||
|
||||
$this->logger->info("Getting all users from the AD …");
|
||||
|
||||
# Get all members of the sync group
|
||||
$memberPages = $this->getLdapList($this->config->getAppValue($this->appName, 'cas_import_ad_base_dn'), $this->config->getAppValue($this->appName, 'cas_import_ad_sync_filter'), $keep, $pageSize);
|
||||
|
||||
foreach ($memberPages as $memberPage) {
|
||||
|
||||
#var_dump($memberPage["count"]);
|
||||
|
||||
for ($key = 0; $key < $memberPage["count"]; $key++) {
|
||||
|
||||
$m = $memberPage[$key];
|
||||
|
||||
# Each attribute is returned as an array, the first key is [count], [0]+ will contain the actual value(s)
|
||||
$employeeID = isset($m[$uidAttribute][0]) ? $m[$uidAttribute][0] : "";
|
||||
$mail = isset($m[$emailAttribute][0]) ? $m[$emailAttribute][0] : "";
|
||||
$dn = isset($m[$dnAttribute]) ? $m[$dnAttribute] : "";
|
||||
|
||||
$displayName = $employeeID;
|
||||
|
||||
if (isset($m[$displayNameAttribute1][0])) {
|
||||
|
||||
$displayName = $m[$displayNameAttribute1][0];
|
||||
|
||||
if (strlen($displayNameAttribute2) > 0 && isset($m[$displayNameAttribute2][0])) {
|
||||
|
||||
$displayName .= " " . $m[$displayNameAttribute2][0];
|
||||
}
|
||||
} else {
|
||||
|
||||
if (strlen($displayNameAttribute2) > 0 && isset($m[$displayNameAttribute2][0])) {
|
||||
|
||||
$displayName = $m[$displayNameAttribute2][0];
|
||||
}
|
||||
}
|
||||
|
||||
$quota = isset($m[$quotaAttribute][0]) ? intval($m[$quotaAttribute][0]) : 0;
|
||||
|
||||
|
||||
$enable = 1;
|
||||
|
||||
# Shift enable attribute bytewise?
|
||||
if (isset($m[$enableAttribute][0])) {
|
||||
|
||||
if (strlen($andEnableAttributeBitwise) > 0) {
|
||||
|
||||
if (is_numeric($andEnableAttributeBitwise)) {
|
||||
|
||||
$andEnableAttributeBitwise = intval($andEnableAttributeBitwise);
|
||||
}
|
||||
|
||||
$enable = intval((intval($m[$enableAttribute][0]) & $andEnableAttributeBitwise) == 0);
|
||||
} else {
|
||||
|
||||
$enable = intval($m[$enableAttribute][0]);
|
||||
}
|
||||
}
|
||||
|
||||
$groupsArray = [];
|
||||
|
||||
$addUser = FALSE;
|
||||
|
||||
if (isset($m[$groupsAttribute][0])) {
|
||||
|
||||
# Cycle all groups of the user
|
||||
for ($j = 0; $j < $m[$groupsAttribute]["count"]; $j++) {
|
||||
|
||||
# Check if user has MAP_GROUPS attribute
|
||||
if (isset($m[$groupsAttribute][$j])) {
|
||||
|
||||
$addUser = TRUE; # Only add user if the group has a MAP_GROUPS attribute
|
||||
|
||||
$groupCn = $m[$groupsAttribute][$j];
|
||||
|
||||
# Retrieve the MAP_GROUPS_FIELD attribute of the group
|
||||
$groupAttr = $this->getLdapAttributes($groupCn, $groupsKeep);
|
||||
$groupName = '';
|
||||
|
||||
if (isset($groupAttr[$groupAttrField][0])) {
|
||||
|
||||
$groupName = $groupAttr[$groupAttrField][0];
|
||||
|
||||
/*# Replace umlauts
|
||||
if (boolval($this->config->getAppValue($this->appName, 'cas_import_map_groups_letter_umlauts'))) {
|
||||
|
||||
$groupName = str_replace("Ä", "Ae", $groupName);
|
||||
$groupName = str_replace("Ö", "Oe", $groupName);
|
||||
$groupName = str_replace("Ü", "Ue", $groupName);
|
||||
$groupName = str_replace("ä", "ae", $groupName);
|
||||
$groupName = str_replace("ö", "oe", $groupName);
|
||||
$groupName = str_replace("ü", "ue", $groupName);
|
||||
$groupName = str_replace("ß", "ss", $groupName);
|
||||
}
|
||||
|
||||
# Filter unwanted characters
|
||||
$nameFilter = $this->config->getAppValue($this->appName, 'cas_import_map_groups_letter_filter');
|
||||
|
||||
if (strlen($nameFilter) > 0) {
|
||||
|
||||
$groupName = preg_replace("/[^" . $nameFilter . "]+/", "", $groupName);
|
||||
}
|
||||
|
||||
# Filter length to max 64 chars
|
||||
$groupName = substr($groupName, 0, 64);*/
|
||||
}
|
||||
else {
|
||||
|
||||
$groupCnArray = explode(",", $groupCn);
|
||||
$groupName = substr($groupCnArray[0], 3, strlen($groupCnArray[0]));
|
||||
}
|
||||
|
||||
if (strlen($groupName) > 0) {
|
||||
|
||||
$groupsArray[] = $groupName;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Fill the users array only if we have an employeeId and addUser is true
|
||||
if (isset($employeeID) && $addUser) {
|
||||
|
||||
$this->merger->mergeUsers($users, ['uid' => $employeeID, 'displayName' => $displayName, 'email' => $mail, 'quota' => $quota, 'groups' => $groupsArray, 'enable' => $enable, 'dn' => $dn], $mergeAttribute, $preferEnabledAccountsOverDisabled, $primaryAccountDnStartswWith);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$this->logger->info("Users have been retrieved.");
|
||||
|
||||
return $users;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* List ldap entries in the base dn
|
||||
*
|
||||
* @param string $object_dn
|
||||
* @param $filter
|
||||
* @param array $keepAtributes
|
||||
* @param $pageSize
|
||||
* @return array
|
||||
*/
|
||||
protected function getLdapList($object_dn, $filter, $keepAtributes, $pageSize)
|
||||
{
|
||||
|
||||
$cookie = '';
|
||||
$members = [];
|
||||
|
||||
do {
|
||||
|
||||
// Query Group members
|
||||
ldap_control_paged_result($this->ldapConnection, $pageSize, false, $cookie);
|
||||
|
||||
$results = ldap_search($this->ldapConnection, $object_dn, $filter, $keepAtributes/*, array("member;range=$range_start-$range_end")*/) or die('Error searching LDAP: ' . ldap_error($this->ldapConnection));
|
||||
$members[] = ldap_get_entries($this->ldapConnection, $results);
|
||||
|
||||
ldap_control_paged_result_response($this->ldapConnection, $results, $cookie);
|
||||
|
||||
} while ($cookie !== null && $cookie != '');
|
||||
|
||||
// Return sorted member list
|
||||
sort($members);
|
||||
|
||||
return $members;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param string $user_dn
|
||||
* @param bool $keep
|
||||
* @return array Attribute list
|
||||
*/
|
||||
protected function getLdapAttributes($user_dn, $keep = false)
|
||||
{
|
||||
|
||||
if (!isset($this->ldapConnection)) die('Error, no LDAP connection established');
|
||||
if (empty($user_dn)) die('Error, no LDAP user specified');
|
||||
|
||||
// Disable pagination setting, not needed for individual attribute queries
|
||||
ldap_control_paged_result($this->ldapConnection, 1);
|
||||
|
||||
// Query user attributes
|
||||
$results = (($keep) ? ldap_search($this->ldapConnection, $user_dn, 'cn=*', $keep) : ldap_search($this->ldapConnection, $user_dn, 'cn=*'))
|
||||
or die('Error searching LDAP: ' . ldap_error($this->ldapConnection));
|
||||
|
||||
$attributes = ldap_get_entries($this->ldapConnection, $results);
|
||||
|
||||
$this->logger->debug("AD attributes successfully retrieved.");
|
||||
|
||||
// Return attributes list
|
||||
if (isset($attributes[0])) return $attributes[0];
|
||||
else return array();
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Connect ldap
|
||||
*
|
||||
* @return bool|resource
|
||||
* @throws \Exception
|
||||
*/
|
||||
protected function ldapConnect()
|
||||
{
|
||||
try {
|
||||
|
||||
$host = $this->config->getAppValue($this->appName, 'cas_import_ad_host');
|
||||
|
||||
$this->ldapConnection = ldap_connect($this->config->getAppValue($this->appName, 'cas_import_ad_protocol') . $host . ":" . $this->config->getAppValue($this->appName, 'cas_import_ad_port')) or die("Could not connect to " . $host);
|
||||
|
||||
ldap_set_option($this->ldapConnection, LDAP_OPT_PROTOCOL_VERSION, 3);
|
||||
ldap_set_option($this->ldapConnection, LDAP_OPT_REFERRALS, 0);
|
||||
ldap_set_option($this->ldapConnection, LDAP_OPT_NETWORK_TIMEOUT, 10);
|
||||
|
||||
$this->logger->info("AD connected successfully.");
|
||||
|
||||
return $this->ldapConnection;
|
||||
} catch (\Exception $e) {
|
||||
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Bind ldap
|
||||
*
|
||||
* @throws \Exception
|
||||
*/
|
||||
protected function ldapBind()
|
||||
{
|
||||
|
||||
try {
|
||||
|
||||
if ($this->ldapConnection) {
|
||||
|
||||
$ldapIsBound = ldap_bind($this->ldapConnection, $this->config->getAppValue($this->appName, 'cas_import_ad_user') . "@" . $this->config->getAppValue($this->appName, 'cas_import_ad_domain'), $this->config->getAppValue($this->appName, 'cas_import_ad_password'));
|
||||
|
||||
if (!$ldapIsBound) {
|
||||
|
||||
throw new \Exception("LDAP bind failed. Error: " . ldap_error($this->ldapConnection));
|
||||
} else {
|
||||
|
||||
$this->logger->info("AD bound successfully.");
|
||||
}
|
||||
}
|
||||
} catch (\Exception $e) {
|
||||
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Unbind ldap
|
||||
*
|
||||
* @throws \Exception
|
||||
*/
|
||||
protected function ldapUnbind()
|
||||
{
|
||||
|
||||
try {
|
||||
|
||||
ldap_unbind($this->ldapConnection);
|
||||
|
||||
$this->logger->info("AD unbound successfully.");
|
||||
} catch (\Exception $e) {
|
||||
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Close ldap connection
|
||||
*
|
||||
* @throws \Exception
|
||||
*/
|
||||
protected function ldapClose()
|
||||
{
|
||||
try {
|
||||
|
||||
ldap_close($this->ldapConnection);
|
||||
|
||||
$this->logger->info("AD connection closed successfully.");
|
||||
} catch (\Exception $e) {
|
||||
|
||||
throw $e;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $exportData
|
||||
*/
|
||||
public function exportAsCsv(array $exportData)
|
||||
{
|
||||
|
||||
$this->logger->info("Exporting users to .csv …");
|
||||
|
||||
$fp = fopen('accounts.csv', 'wa+');
|
||||
|
||||
fputcsv($fp, ["UID", "displayName", "email", "quota", "groups", "enabled"]);
|
||||
|
||||
foreach ($exportData as $fields) {
|
||||
|
||||
for ($i = 0; $i < count($fields); $i++) {
|
||||
|
||||
if (is_array($fields[$i])) {
|
||||
|
||||
$fields[$i] = $this->multiImplode($fields[$i], " ");
|
||||
}
|
||||
}
|
||||
|
||||
fputcsv($fp, $fields);
|
||||
}
|
||||
|
||||
fclose($fp);
|
||||
|
||||
$this->logger->info("CSV export finished.");
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $exportData
|
||||
*/
|
||||
public function exportAsText(array $exportData)
|
||||
{
|
||||
|
||||
$this->logger->info("Exporting users to .txt …");
|
||||
|
||||
file_put_contents('accounts.txt', serialize($exportData));
|
||||
|
||||
$this->logger->info("TXT export finished.");
|
||||
}
|
||||
|
||||
/**
|
||||
* @param array $array
|
||||
* @param string $glue
|
||||
* @return bool|string
|
||||
*/
|
||||
private function multiImplode($array, $glue)
|
||||
{
|
||||
$ret = '';
|
||||
|
||||
foreach ($array as $item) {
|
||||
if (is_array($item)) {
|
||||
$ret .= $this->multiImplode($item, $glue) . $glue;
|
||||
} else {
|
||||
$ret .= $item . $glue;
|
||||
}
|
||||
}
|
||||
|
||||
$ret = substr($ret, 0, 0 - strlen($glue));
|
||||
|
||||
return $ret;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,34 @@
|
|||
<?php
|
||||
|
||||
|
||||
namespace OCA\UserCAS\Service\Import;
|
||||
|
||||
use Psr\Log\LoggerInterface;
|
||||
|
||||
|
||||
/**
|
||||
* Interface ImporterInterface
|
||||
* @package OCA\UserCAS\Service\Import
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
interface ImporterInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* @param LoggerInterface $logger
|
||||
*/
|
||||
public function init(LoggerInterface $logger);
|
||||
|
||||
public function close();
|
||||
|
||||
public function getUsers();
|
||||
|
||||
/**
|
||||
* @param array $userData
|
||||
*/
|
||||
public function exportAsCsv(array $userData);
|
||||
}
|
||||
|
|
@ -0,0 +1,101 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Service;
|
||||
|
||||
use \OCP\IConfig;
|
||||
use \OCP\ILogger;
|
||||
|
||||
/**
|
||||
* Class LoggingService
|
||||
*
|
||||
* @package OCA\UserCAS\Service
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.5.0
|
||||
*/
|
||||
class LoggingService
|
||||
{
|
||||
|
||||
/**
|
||||
* @since 1.6.1
|
||||
*/
|
||||
const DEBUG = 0;
|
||||
/**
|
||||
* @since 1.6.1
|
||||
*/
|
||||
const INFO = 1;
|
||||
/**
|
||||
* @since 1.6.1
|
||||
*/
|
||||
const WARN = 2;
|
||||
/**
|
||||
* @since 1.6.1
|
||||
*/
|
||||
const ERROR = 3;
|
||||
/**
|
||||
* @since 1.6.1
|
||||
*/
|
||||
const FATAL = 4;
|
||||
|
||||
/**
|
||||
* @var string $appName
|
||||
*/
|
||||
private $appName;
|
||||
|
||||
/**
|
||||
* @var \OCP\IConfig $appConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* @var \OCP\ILogger $logger
|
||||
*/
|
||||
private $logger;
|
||||
|
||||
/**
|
||||
* LoggingService constructor.
|
||||
* @param string $appName
|
||||
* @param \OCP\IConfig $config
|
||||
* @param \OCP\ILogger $logger
|
||||
*/
|
||||
public function __construct($appName, IConfig $config, ILogger $logger)
|
||||
{
|
||||
|
||||
$this->appName = $appName;
|
||||
$this->config = $config;
|
||||
$this->logger = $logger;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param mixed $level
|
||||
* @param string $message
|
||||
*/
|
||||
public function write($level, $message)
|
||||
{
|
||||
|
||||
$this->logger->log($level, $message, ['app' => $this->appName]);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,89 @@
|
|||
<?php
|
||||
|
||||
|
||||
namespace OCA\UserCAS\Service\Merge;
|
||||
|
||||
|
||||
use Psr\Log\LoggerInterface;
|
||||
|
||||
/**
|
||||
* Class AdUserMerger
|
||||
* @package OCA\UserCAS\Service\Merge
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
class AdUserMerger implements MergerInterface
|
||||
{
|
||||
|
||||
|
||||
/**
|
||||
* @var LoggerInterface
|
||||
*/
|
||||
protected $logger;
|
||||
|
||||
|
||||
/**
|
||||
* AdUserMerger constructor.
|
||||
* @param LoggerInterface $logger
|
||||
*/
|
||||
public function __construct(LoggerInterface $logger)
|
||||
{
|
||||
$this->logger = $logger;
|
||||
}
|
||||
|
||||
/**
|
||||
* Merge users method
|
||||
*
|
||||
* @param array $userStack
|
||||
* @param array $userToMerge
|
||||
* @param bool $merge
|
||||
* @param bool $preferEnabledAccountsOverDisabled
|
||||
* @param string $primaryAccountDnStartswWith
|
||||
*/
|
||||
public function mergeUsers(array &$userStack, array $userToMerge, $merge, $preferEnabledAccountsOverDisabled, $primaryAccountDnStartswWith)
|
||||
{
|
||||
# User already in stack
|
||||
if ($merge && isset($userStack[$userToMerge["uid"]])) {
|
||||
|
||||
$this->logger->debug("User " . $userToMerge["uid"] . " has to be merged …");
|
||||
|
||||
// Check if accounts are enabled or disabled
|
||||
// if both disabled, first account stays
|
||||
// if one is enabled, use this account
|
||||
// if both enabled, use information of $primaryAccountDnStartswWith
|
||||
|
||||
if ($preferEnabledAccountsOverDisabled && $userStack[$userToMerge["uid"]]['enable'] == 0 && $userToMerge['enable'] == 1) { # First disabled, second enabled and $preferEnabledAccountsOverDisabled is true
|
||||
|
||||
$this->logger->info("User " . $userToMerge["uid"] . " is merged because first account was disabled.");
|
||||
|
||||
$userStack[$userToMerge["uid"]] = $userToMerge;
|
||||
}
|
||||
elseif(!$preferEnabledAccountsOverDisabled && $userStack[$userToMerge["uid"]]['enable'] == 0 && $userToMerge['enable'] == 1) { # First disabled, second enabled and $preferEnabledAccountsOverDisabled is false
|
||||
|
||||
$this->logger->info("User " . $userToMerge["uid"] . " has not been merged, second enabled account was not preferred, because of preferEnabledAccountsOverDisabled option.");
|
||||
}
|
||||
elseif ($userStack[$userToMerge["uid"]]['enable'] == 1 && $userToMerge['enable'] == 1) { # Both enabled
|
||||
|
||||
if (strpos(strtolower($userToMerge['dn']), strtolower($primaryAccountDnStartswWith) !== FALSE)) {
|
||||
|
||||
$this->logger->info("User " . $userToMerge["uid"] . " is merged because second account is primary, based on merge filter.");
|
||||
|
||||
$userStack[$userToMerge["uid"]] = $userToMerge;
|
||||
}
|
||||
else {
|
||||
|
||||
$this->logger->info("User " . $userToMerge["uid"] . " has not been merged, second account was not primary, based on merge filter.");
|
||||
}
|
||||
} else {
|
||||
|
||||
$this->logger->info("User " . $userToMerge["uid"] . " has not been merged, second account was disabled, first account was enabled.");
|
||||
}
|
||||
} else { # User not in stack
|
||||
|
||||
$userStack[$userToMerge["uid"]] = $userToMerge;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,20 @@
|
|||
<?php
|
||||
|
||||
|
||||
namespace OCA\UserCAS\Service\Merge;
|
||||
|
||||
|
||||
/**
|
||||
* Interface MergerInterface
|
||||
* @package OCA\UserCAS\Service\Merge
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp
|
||||
*
|
||||
* @since 1.0.0
|
||||
*/
|
||||
interface MergerInterface
|
||||
{
|
||||
|
||||
public function mergeUsers(array &$userStack, array $userToMerge, $merge, $preferEnabledAccountsOverDisabled, $primaryAccountDnStartswWith);
|
||||
}
|
||||
|
|
@ -0,0 +1,680 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\Service;
|
||||
|
||||
use OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException;
|
||||
use OCA\UserCas\Service\LoggingService;
|
||||
use OCA\UserCAS\User\UserCasBackendInterface;
|
||||
use \OCP\IConfig;
|
||||
use \OCP\IUserManager;
|
||||
use \OCP\IGroupManager;
|
||||
use \OCP\IUserSession;
|
||||
|
||||
use OCA\UserCAS\User\Backend;
|
||||
|
||||
/**
|
||||
* Class UserService
|
||||
*
|
||||
* @package OCA\UserCAS\Service
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4
|
||||
*/
|
||||
class UserService
|
||||
{
|
||||
|
||||
/**
|
||||
* @var string $appName
|
||||
*/
|
||||
private $appName;
|
||||
|
||||
/**
|
||||
* @var \OCP\IConfig $appConfig
|
||||
*/
|
||||
private $config;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserSession $userSession
|
||||
*/
|
||||
private $userSession;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserManager $userManager
|
||||
*/
|
||||
private $userManager;
|
||||
|
||||
/**
|
||||
* @var \OCP\IGroupManager
|
||||
*/
|
||||
private $groupManager;
|
||||
|
||||
/**
|
||||
* @var AppService $appService
|
||||
*/
|
||||
private $appService;
|
||||
|
||||
/**
|
||||
* @var LoggingService $loggingService
|
||||
*/
|
||||
private $loggingService;
|
||||
|
||||
|
||||
/**
|
||||
* UserService constructor.
|
||||
*
|
||||
* @param $appName
|
||||
* @param IConfig $config
|
||||
* @param IUserManager $userManager
|
||||
* @param IUserSession $userSession
|
||||
* @param IGroupManager $groupManager
|
||||
* @param AppService $appService
|
||||
* @param LoggingService $loggingService
|
||||
*/
|
||||
public function __construct($appName, IConfig $config, IUserManager $userManager, IUserSession $userSession, IGroupManager $groupManager, AppService $appService, LoggingService $loggingService)
|
||||
{
|
||||
|
||||
$this->appName = $appName;
|
||||
$this->config = $config;
|
||||
$this->userManager = $userManager;
|
||||
$this->userSession = $userSession;
|
||||
$this->groupManager = $groupManager;
|
||||
$this->appService = $appService;
|
||||
$this->loggingService = $loggingService;
|
||||
}
|
||||
|
||||
/**
|
||||
* Login hook method.
|
||||
*
|
||||
* @param $request
|
||||
* @param string $uid
|
||||
* @param string $password
|
||||
* @return bool
|
||||
*/
|
||||
public function login($request, $uid, $password = '')
|
||||
{
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCAS login function step 1.');
|
||||
#\OCP\Util::writeLog('cas', 'phpCAS login function step 1.', \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
|
||||
try {
|
||||
|
||||
if (!boolval($this->config->getAppValue($this->appName, 'cas_autocreate')) && !$this->userExists($uid)) {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas autocreate disabled, and OC User does not exist, phpCas based login not possible. Bye.');
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
|
||||
# Check if user may be authorized based on groups or not
|
||||
$cas_access_allow_groups = $this->config->getAppValue($this->appName, 'cas_access_allow_groups');
|
||||
if (is_string($cas_access_allow_groups) && strlen($cas_access_allow_groups) > 0) {
|
||||
|
||||
$cas_access_allow_groups = explode(',', $cas_access_allow_groups);
|
||||
$casAttributes = \phpCAS::getAttributes();
|
||||
$casGroups = array();
|
||||
$isAuthorized = FALSE;
|
||||
|
||||
$groupMapping = $this->config->getAppValue($this->appName, 'cas_group_mapping');
|
||||
|
||||
# Test if an attribute parser added a new dimension to our attributes array
|
||||
if (array_key_exists('attributes', $casAttributes)) {
|
||||
|
||||
$newAttributes = $casAttributes['attributes'];
|
||||
|
||||
unset($casAttributes['attributes']);
|
||||
|
||||
$casAttributes = array_merge($casAttributes, $newAttributes);
|
||||
}
|
||||
|
||||
# Test for mapped attribute from settings
|
||||
if (array_key_exists($groupMapping, $casAttributes)) {
|
||||
|
||||
$casGroups = (array)$casAttributes[$groupMapping];
|
||||
} # Test for standard 'groups' attribute
|
||||
else if (array_key_exists('groups', $casAttributes)) {
|
||||
|
||||
if($this->config->getAppValue($this->appName, 'cas_groups_json_decode')) {
|
||||
|
||||
$casGroups = json_decode($casAttributes['groups']);
|
||||
}
|
||||
else {
|
||||
|
||||
$casGroups = (array)$casAttributes['groups'];
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($casGroups as $casGroup) {
|
||||
|
||||
if (in_array($casGroup, $cas_access_allow_groups)) {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has been authorized with group: ' . $casGroup);
|
||||
|
||||
$isAuthorized = TRUE;
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has not been authorized with group: ' . $casGroup . ', because the group was not in allowedGroups: ' . implode(", ", $cas_access_allow_groups));
|
||||
}
|
||||
}
|
||||
|
||||
if ($this->groupManager->isInGroup($uid, 'admin')) {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has been authorized with group: admin');
|
||||
|
||||
$isAuthorized = TRUE;
|
||||
}
|
||||
|
||||
if (!$isAuthorized) {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS user is not authorized to log into ownCloud. Bye.');
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
$loginSuccessful = $this->userSession->login($uid, $password);
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCAS login function result: ' . $loginSuccessful);
|
||||
#\OCP\Util::writeLog('cas', 'phpCAS login function result: ' . $loginSuccessful, \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
|
||||
if ($loginSuccessful) {
|
||||
|
||||
return $this->userSession->createSessionToken($request, $this->userSession->getUser()->getUID(), $uid, NULL);
|
||||
}
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCAS login function not successful.');
|
||||
#\OCP\Util::writeLog('cas', 'phpCAS login function not successful.', \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
|
||||
return FALSE;
|
||||
} catch (\OC\User\LoginException $e) {
|
||||
|
||||
$this->loggingService->write(LoggingService::ERROR, 'Owncloud could not log in the user with UID: ' . $uid . '. Exception thrown with code: ' . $e->getCode() . ' and message: ' . $e->getMessage() . '.');
|
||||
#\OCP\Util::writeLog('cas', 'Owncloud could not log in the user with UID: ' . $uid . '. Exception thrown with code: ' . $e->getCode() . ' and message: ' . $e->getMessage() . '.', \OCA\UserCas\Service\LoggingService::ERROR);
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Logout function
|
||||
*
|
||||
* @return bool|void
|
||||
*/
|
||||
public function logout()
|
||||
{
|
||||
|
||||
return $this->userSession->logout();
|
||||
}
|
||||
|
||||
/**
|
||||
* IsLoggedIn method.
|
||||
*
|
||||
* @return boolean
|
||||
*/
|
||||
public function isLoggedIn()
|
||||
{
|
||||
|
||||
return $this->userSession->isLoggedIn();
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $userId
|
||||
* @param UserCasBackendInterface $backend
|
||||
* @return boolean|\OCP\IUser the created user or false
|
||||
*/
|
||||
public function create($userId, UserCasBackendInterface $backend)
|
||||
{
|
||||
|
||||
$randomPassword = $this->getNewPassword();
|
||||
|
||||
if ($backend->implementsActions(\OC\User\Backend::CREATE_USER)) {
|
||||
|
||||
return $this->userManager->createUserFromBackend($userId, $randomPassword, $backend);
|
||||
}
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
/**
|
||||
* @param string $userId
|
||||
* @return mixed
|
||||
*/
|
||||
public function userExists($userId)
|
||||
{
|
||||
|
||||
return $this->userManager->userExists($userId);
|
||||
}
|
||||
|
||||
/**
|
||||
* @return string
|
||||
*/
|
||||
public function getUserId()
|
||||
{
|
||||
$uid = \phpCAS::getUser();
|
||||
|
||||
$casAttributes = \phpCAS::getAttributes();
|
||||
|
||||
if($this->config->getAppValue($this->appName, 'cas_userid_mapping') && strlen($this->config->getAppValue($this->appName, 'cas_userid_mapping')) > 0) {
|
||||
|
||||
$userIdAttribute = $this->config->getAppValue($this->appName, 'cas_userid_mapping');
|
||||
if(isset($casAttributes[$userIdAttribute])) {
|
||||
|
||||
$uid = $casAttributes[$userIdAttribute];
|
||||
}
|
||||
}
|
||||
|
||||
return $uid;
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the user
|
||||
*
|
||||
* @param \OCP\IUser $user
|
||||
* @param array $attributes
|
||||
*/
|
||||
public function updateUser($user, $attributes)
|
||||
{
|
||||
|
||||
$userId = $user->getUID();
|
||||
|
||||
/*$attributesString = '';
|
||||
foreach ($attributes as $key => $attribute) {
|
||||
|
||||
$attributesString .= $key . ': ' . $attribute . '; ';
|
||||
}*/
|
||||
|
||||
$newGroupQuota = NULL;
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'Updating data of the user: ' . $userId);
|
||||
#\OCP\Util::writeLog('cas', 'Updating data of the user: ' . $userId, \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
#\OCP\Util::writeLog('cas', 'Attributes: ' . $attributesString, \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
|
||||
if (isset($attributes['cas_email']) && is_object($user)) {
|
||||
|
||||
$this->updateMail($user, $attributes['cas_email']);
|
||||
}
|
||||
if (isset($attributes['cas_name']) && is_object($user)) {
|
||||
|
||||
$this->updateName($user, $attributes['cas_name']);
|
||||
}
|
||||
if (isset($attributes['cas_groups']) && is_object($user)) {
|
||||
|
||||
$this->updateGroups($user, $attributes['cas_groups'], $this->config->getAppValue($this->appName, 'cas_protected_groups'));
|
||||
}
|
||||
if (isset($attributes['cas_group_quota']) && is_object($user)) {
|
||||
|
||||
$newGroupQuota = $this->updateGroupQuota($user, $attributes['cas_group_quota']);
|
||||
}
|
||||
if (isset($attributes['cas_quota']) && is_object($user)) {
|
||||
|
||||
$this->updateQuota($user, $newGroupQuota, $attributes['cas_quota']);
|
||||
}
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'Updating data finished.');
|
||||
#\OCP\Util::writeLog('cas', 'Updating data finished.', \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the eMail address
|
||||
*
|
||||
* @param \OCP\IUser $user
|
||||
* @param string|array $email
|
||||
*/
|
||||
private function updateMail($user, $email)
|
||||
{
|
||||
|
||||
if (is_array($email)) {
|
||||
|
||||
$email = $email[0];
|
||||
}
|
||||
|
||||
if ($email !== $user->getEMailAddress()) {
|
||||
|
||||
$user->setEMailAddress($email);
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'Set email "' . $email . '" for the user: ' . $user->getUID());
|
||||
#\OCP\Util::writeLog('cas', 'Set email "' . $email . '" for the user: ' . $user->getUID(), \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the display name
|
||||
*
|
||||
* @param \OCP\IUser $user
|
||||
* @param string| $name
|
||||
*/
|
||||
private function updateName($user, $name)
|
||||
{
|
||||
|
||||
if (is_array($name)) {
|
||||
|
||||
$name = $name[0];
|
||||
}
|
||||
|
||||
if ($name !== $user->getDisplayName() && strlen($name) > 0) {
|
||||
|
||||
$user->setDisplayName($name);
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'Set Name: ' . $name . ' for the user: ' . $user->getUID());
|
||||
#\OCP\Util::writeLog('cas', 'Set Name: ' . $name . ' for the user: ' . $user->getUID(), \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Gets an array of groups and will try to add the group to OC and then add the user to the groups.
|
||||
*
|
||||
* @param \OCP\IUser $user
|
||||
* @param string|array $groups
|
||||
* @param string|array $protectedGroups
|
||||
* @param bool $justCreated
|
||||
*/
|
||||
public function updateGroups($user, $groups, $protectedGroups = '', $justCreated = false)
|
||||
{
|
||||
|
||||
if (is_string($groups)) $groups = explode(",", $groups);
|
||||
if (is_string($protectedGroups)) $protectedGroups = explode(",", $protectedGroups);
|
||||
|
||||
$uid = $user->getUID();
|
||||
|
||||
# Add default user group to groups and protectedGroups
|
||||
if($this->config->getAppValue($this->appName, 'cas_groups_create_default_for_user')) {
|
||||
|
||||
$userGroupPrefix = $this->config->getAppValue($this->appName, 'cas_groups_create_default_for_user_prefix', '');
|
||||
|
||||
if(strpos($userGroupPrefix, '/') !== strlen($userGroupPrefix)) {
|
||||
|
||||
$userGroupPrefix .= '/';
|
||||
}
|
||||
|
||||
$userGroupName = $userGroupPrefix.$uid;
|
||||
|
||||
$groups[] = $userGroupName;
|
||||
$protectedGroups[] = $userGroupName;
|
||||
}
|
||||
|
||||
if (!$justCreated) {
|
||||
|
||||
$oldGroups = $this->groupManager->getUserGroups($user);
|
||||
|
||||
foreach ($oldGroups as $group) {
|
||||
|
||||
if ($group instanceof \OCP\IGroup) {
|
||||
|
||||
$groupId = $group->getGID();
|
||||
|
||||
if (!in_array($groupId, $protectedGroups) && !in_array($groupId, $groups)) {
|
||||
|
||||
$group->removeUser($user);
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, "Removed '" . $uid . "' from the group '" . $groupId . "'");
|
||||
#\OCP\Util::writeLog('cas', 'Removed "' . $uid . '" from the group "' . $groupId . '"', \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
foreach ($groups as $group) {
|
||||
|
||||
$groupObject = NULL;
|
||||
|
||||
# Replace umlauts
|
||||
if (boolval($this->config->getAppValue($this->appName, 'cas_groups_letter_umlauts'))) {
|
||||
|
||||
$group = str_replace("Ä", "Ae", $group);
|
||||
$group = str_replace("Ö", "Oe", $group);
|
||||
$group = str_replace("Ü", "Ue", $group);
|
||||
$group = str_replace("ä", "ae", $group);
|
||||
$group = str_replace("ö", "oe", $group);
|
||||
$group = str_replace("ü", "ue", $group);
|
||||
$group = str_replace("ß", "ss", $group);
|
||||
}
|
||||
|
||||
# Filter unwanted characters
|
||||
$nameFilter = $this->config->getAppValue($this->appName, 'cas_groups_letter_filter');
|
||||
|
||||
if (strlen($nameFilter) > 0) {
|
||||
|
||||
$group = preg_replace("/[^" . $nameFilter . "]+/", "", $group);
|
||||
} else { # Use default filter
|
||||
|
||||
$group = preg_replace("/[^a-zA-Z0-9\.\-_ @\/]+/", "", $group);
|
||||
}
|
||||
|
||||
# Filter length to max 64 chars
|
||||
if (strlen($group) > 64) {
|
||||
|
||||
$group = substr($group, 0, 63) . "…";
|
||||
}
|
||||
|
||||
if (!$this->groupManager->isInGroup($uid, $group)) {
|
||||
|
||||
if (!$this->groupManager->groupExists($group)) {
|
||||
|
||||
$groupObject = $this->groupManager->createGroup($group);
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'New group created: ' . $group);
|
||||
#\OCP\Util::writeLog('cas', 'New group created: ' . $group, \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
} else {
|
||||
|
||||
$groupObject = $this->groupManager->get($group);
|
||||
}
|
||||
|
||||
$groupObject->addUser($user);
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, "Added '" . $uid . "' to the group '" . $group . "'");
|
||||
#\OCP\Util::writeLog('cas', 'Added "' . $uid . '" to the group "' . $group . '"', \OCA\UserCas\Service\LoggingService::DEBUG);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param \OCP\IUser $user
|
||||
* @param int|boolean $newGroupQuota
|
||||
* @param string $quota
|
||||
*/
|
||||
public function updateQuota($user, $newGroupQuota, $quota = 'default')
|
||||
{
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCas new UserQuota contents: ' . $quota . ' | New GroupQuota was: ' . $newGroupQuota);
|
||||
|
||||
$defaultQuota = $this->config->getAppValue('files', 'default_quota');
|
||||
|
||||
if ($defaultQuota === '') {
|
||||
|
||||
$defaultQuota = 'none';
|
||||
}
|
||||
|
||||
$uid = $user->getUID();
|
||||
|
||||
if ($quota === 'none') {
|
||||
|
||||
$newQuota = PHP_INT_MAX;
|
||||
} elseif ($quota === 'default') {
|
||||
|
||||
$newQuota = \OCP\Util::computerFileSize($defaultQuota);
|
||||
} else {
|
||||
|
||||
$newQuota = \OCP\Util::computerFileSize($quota);
|
||||
}
|
||||
|
||||
$usersOldQuota = $user->getQuota();
|
||||
|
||||
if ($usersOldQuota === 'none') {
|
||||
|
||||
$usersOldQuota = PHP_INT_MAX;
|
||||
} elseif ($usersOldQuota === 'default') {
|
||||
|
||||
$usersOldQuota = \OCP\Util::computerFileSize($defaultQuota);
|
||||
} else {
|
||||
|
||||
$usersOldQuota = \OCP\Util::computerFileSize($usersOldQuota);
|
||||
}
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, "Default System Quota is: '" . $defaultQuota . "'");
|
||||
$this->loggingService->write(LoggingService::DEBUG, "User '" . $uid . "' old computerized Quota is: '" . $usersOldQuota . "'");
|
||||
$this->loggingService->write(LoggingService::DEBUG, "User '" . $uid . "' new computerized User Quota would be: '" . $newQuota . "'");
|
||||
|
||||
if ($usersOldQuota < $newQuota || ($usersOldQuota > $newQuota && $newGroupQuota != NULL)) {
|
||||
|
||||
$user->setQuota($newQuota);
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, "User '" . $uid . "' has new Quota: '" . $newQuota . "'");
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* @param \OCP\IUser $user
|
||||
* @param array $groupQuotas
|
||||
* @return int New Quota
|
||||
*/
|
||||
private function updateGroupQuota($user, $groupQuotas)
|
||||
{
|
||||
|
||||
$defaultQuota = $this->config->getAppValue('files', 'default_quota');
|
||||
|
||||
if ($defaultQuota === '') {
|
||||
|
||||
$defaultQuota = 'none';
|
||||
}
|
||||
|
||||
$uid = $user->getUID();
|
||||
$collectedQuotas = array();
|
||||
|
||||
foreach ($groupQuotas as $groupName => $groupQuota) {
|
||||
|
||||
if ($this->groupManager->isInGroup($uid, $groupName)) {
|
||||
|
||||
if ($groupQuota === 'none') {
|
||||
|
||||
$collectedQuotas[PHP_INT_MAX] = $groupQuota;
|
||||
} elseif ($groupQuota === 'default') {
|
||||
|
||||
$defaultQuotaFilesize = \OCP\Util::computerFileSize($defaultQuota);
|
||||
|
||||
$collectedQuotas[$defaultQuotaFilesize] = $groupQuota;
|
||||
} else {
|
||||
|
||||
$groupQuotaComputerFilesize = \OCP\Util::computerFileSize($groupQuota);
|
||||
$collectedQuotas[$groupQuotaComputerFilesize] = $groupQuota;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
# Sort descending by key
|
||||
krsort($collectedQuotas);
|
||||
|
||||
$newQuota = \OCP\Util::computerFileSize(array_shift($collectedQuotas));
|
||||
|
||||
$usersOldQuota = $user->getQuota();
|
||||
|
||||
if ($usersOldQuota === 'none') {
|
||||
|
||||
$usersOldQuota = PHP_INT_MAX;
|
||||
} elseif ($usersOldQuota === 'default') {
|
||||
|
||||
$usersOldQuota = \OCP\Util::computerFileSize($defaultQuota);
|
||||
} else {
|
||||
|
||||
$usersOldQuota = \OCP\Util::computerFileSize($usersOldQuota);
|
||||
}
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, "Default System Quota is: '" . $defaultQuota . "'");
|
||||
$this->loggingService->write(LoggingService::DEBUG, "User '" . $uid . "' old computerized Quota is: '" . $usersOldQuota . "'");
|
||||
$this->loggingService->write(LoggingService::DEBUG, "User '" . $uid . "' new computerized Group Quota would be: '" . $newQuota . "'");
|
||||
|
||||
if ($usersOldQuota < $newQuota) {
|
||||
|
||||
$user->setQuota($newQuota);
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, "User '" . $uid . "' has new Quota: '" . $newQuota . "'");
|
||||
|
||||
return $newQuota;
|
||||
}
|
||||
|
||||
return $usersOldQuota;
|
||||
}
|
||||
|
||||
/**
|
||||
* Register User Backend.
|
||||
*
|
||||
* @param UserCasBackendInterface $backend
|
||||
*/
|
||||
public function registerBackend(UserCasBackendInterface $backend)
|
||||
{
|
||||
|
||||
$this->userManager->registerBackend($backend);
|
||||
}
|
||||
|
||||
/**
|
||||
* Update the backend of the user on ownCloud
|
||||
*
|
||||
* @param \OCP\IUser $user
|
||||
* @return bool|int|\OC_DB_StatementWrapper
|
||||
*
|
||||
* @deprecated
|
||||
**/
|
||||
public function updateBackend(\OCP\IUser $user)
|
||||
{
|
||||
|
||||
try {
|
||||
|
||||
$uid = $user->getUID();
|
||||
$result = false;
|
||||
|
||||
if ($this->appService->isNotNextcloud()) {
|
||||
|
||||
if (!is_null($user) && ($user->getBackendClassName() === 'OC\User\Database' || $user->getBackendClassName() === "Database")) {
|
||||
|
||||
$query = \OC_DB::prepare('UPDATE `*PREFIX*accounts` SET `backend` = ? WHERE LOWER(`user_id`) = LOWER(?)');
|
||||
$result = $query->execute([get_class($this->getBackend()), $uid]);
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS user existing in database backend, move to CAS-Backend with result: ' . $result);
|
||||
}
|
||||
}
|
||||
|
||||
return $result;
|
||||
} catch (\Exception $e) {
|
||||
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Generate a random PW with special char symbol characters
|
||||
*
|
||||
* @return string New Password
|
||||
*/
|
||||
protected function getNewPassword()
|
||||
{
|
||||
|
||||
$newPasswordCharsLower = \OC::$server->getSecureRandom()->generate(8, \OCP\Security\ISecureRandom::CHAR_LOWER);
|
||||
$newPasswordCharsUpper = \OC::$server->getSecureRandom()->generate(4, \OCP\Security\ISecureRandom::CHAR_UPPER);
|
||||
$newPasswordNumbers = \OC::$server->getSecureRandom()->generate(4, \OCP\Security\ISecureRandom::CHAR_DIGITS);
|
||||
$newPasswordSymbols = \OC::$server->getSecureRandom()->generate(4, \OCP\Security\ISecureRandom::CHAR_SYMBOLS);
|
||||
|
||||
return str_shuffle($newPasswordCharsLower . $newPasswordCharsUpper . $newPasswordNumbers . $newPasswordSymbols);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,301 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\User;
|
||||
|
||||
use OC\User\Database;
|
||||
use OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException;
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
use OCP\IConfig;
|
||||
use OCP\IUserBackend;
|
||||
use OCP\IUserManager;
|
||||
use OCP\User\IProvidesDisplayNameBackend;
|
||||
use OCP\User\IProvidesHomeBackend;
|
||||
use OCP\UserInterface;
|
||||
|
||||
|
||||
/**
|
||||
* Class Backend
|
||||
*
|
||||
* @package OCA\UserCAS\User
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4.0
|
||||
*/
|
||||
class Backend extends Database implements UserInterface, IUserBackend, IProvidesHomeBackend, IProvidesDisplayNameBackend, UserCasBackendInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $appName;
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
protected $config;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\LoggingService $loggingService
|
||||
*/
|
||||
protected $loggingService;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\AppService $appService
|
||||
*/
|
||||
protected $appService;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\UserService $userService
|
||||
*/
|
||||
protected $userService;
|
||||
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserManager $userManager
|
||||
*/
|
||||
protected $userManager;
|
||||
|
||||
|
||||
/**
|
||||
* Backend constructor.
|
||||
* @param string $appName
|
||||
* @param IConfig $config
|
||||
* @param LoggingService $loggingService
|
||||
* @param AppService $appService
|
||||
* @param IUserManager $userManager
|
||||
* @param UserService $userService
|
||||
*/
|
||||
public function __construct($appName, IConfig $config, LoggingService $loggingService, AppService $appService, IUserManager $userManager, UserService $userService)
|
||||
{
|
||||
|
||||
parent::__construct();
|
||||
$this->appName = $appName;
|
||||
$this->loggingService = $loggingService;
|
||||
$this->appService = $appService;
|
||||
$this->userService = $userService;
|
||||
$this->config = $config;
|
||||
$this->userManager = $userManager;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Backend name to be shown in user management
|
||||
* @return string the name of the backend to be shown
|
||||
*/
|
||||
public function getBackendName()
|
||||
{
|
||||
|
||||
return "CAS";
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param string $uid
|
||||
* @param string $password
|
||||
* @return string|bool The users UID or false
|
||||
*/
|
||||
public function checkPassword($uid, $password)
|
||||
{
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
if (\phpCAS::isInitialized()) {
|
||||
|
||||
if ($uid === FALSE) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'phpCAS returned no user.');
|
||||
}
|
||||
|
||||
if (\phpCAS::isAuthenticated()) {
|
||||
|
||||
#$casUid = \phpCAS::getUser();
|
||||
$casUid = $this->userService->getUserId();
|
||||
|
||||
$isAuthorized = TRUE;
|
||||
$createUser = TRUE;
|
||||
|
||||
|
||||
# Check if user may be authorized based on groups or not
|
||||
$cas_access_allow_groups = $this->config->getAppValue($this->appName, 'cas_access_allow_groups');
|
||||
if (is_string($cas_access_allow_groups) && strlen($cas_access_allow_groups) > 0) {
|
||||
|
||||
$cas_access_allow_groups = explode(',', $cas_access_allow_groups);
|
||||
$casAttributes = \phpCAS::getAttributes();
|
||||
$casGroups = array();
|
||||
$groupMapping = $this->config->getAppValue($this->appName, 'cas_group_mapping');
|
||||
|
||||
# Test if an attribute parser added a new dimension to our attributes array
|
||||
if (array_key_exists('attributes', $casAttributes)) {
|
||||
|
||||
$newAttributes = $casAttributes['attributes'];
|
||||
|
||||
unset($casAttributes['attributes']);
|
||||
|
||||
$casAttributes = array_merge($casAttributes, $newAttributes);
|
||||
}
|
||||
|
||||
# Test for mapped attribute from settings
|
||||
if (array_key_exists($groupMapping, $casAttributes)) {
|
||||
|
||||
$casGroups = (array)$casAttributes[$groupMapping];
|
||||
} # Test for standard 'groups' attribute
|
||||
else if (array_key_exists('groups', $casAttributes)) {
|
||||
|
||||
if ($this->config->getAppValue($this->appName, 'cas_groups_json_decode')) {
|
||||
|
||||
$casGroups = json_decode($casAttributes['groups']);
|
||||
} else {
|
||||
|
||||
$casGroups = (array)$casAttributes['groups'];
|
||||
}
|
||||
}
|
||||
|
||||
$isAuthorized = FALSE;
|
||||
|
||||
foreach ($casGroups as $casGroup) {
|
||||
|
||||
if (in_array($casGroup, $cas_access_allow_groups)) {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has been authorized with group: ' . $casGroup);
|
||||
|
||||
$isAuthorized = TRUE;
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has not been authorized with group: ' . $casGroup . ', because the group was not in allowedGroups: ' . implode(", ", $cas_access_allow_groups));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// Autocreate user if needed or create a new account in CAS Backend
|
||||
if (!$this->userManager->userExists($uid) && boolval($this->config->getAppValue($this->appName, 'cas_autocreate'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS creating a new user with UID: ' . $uid);
|
||||
} elseif (!$this->userManager->userExists($uid) && !boolval($this->config->getAppValue($this->appName, 'cas_autocreate'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS no new user has been created.');
|
||||
|
||||
$createUser = FALSE;
|
||||
}
|
||||
|
||||
// Finalize check
|
||||
if ($casUid === $uid && $isAuthorized && $createUser) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS user password has been checked.');
|
||||
|
||||
return $uid;
|
||||
}
|
||||
}
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS user password has been checked, user not logged in.');
|
||||
|
||||
return FALSE;
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'phpCAS has not been initialized.');
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* @param string $uid
|
||||
* @return bool|string
|
||||
*/
|
||||
public function getDisplayName($uid)
|
||||
{
|
||||
|
||||
$displayName = $uid;
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
return $displayName;
|
||||
}
|
||||
}
|
||||
|
||||
if (\phpCAS::isInitialized()) {
|
||||
|
||||
if (\phpCAS::isAuthenticated()) {
|
||||
|
||||
$casAttributes = \phpCAS::getAttributes();
|
||||
|
||||
# Test if an attribute parser added a new dimension to our attributes array
|
||||
if (array_key_exists('attributes', $casAttributes)) {
|
||||
|
||||
$newAttributes = $casAttributes['attributes'];
|
||||
|
||||
unset($casAttributes['attributes']);
|
||||
|
||||
$casAttributes = array_merge($casAttributes, $newAttributes);
|
||||
}
|
||||
|
||||
// DisplayName
|
||||
$displayNameMapping = $this->config->getAppValue($this->appName, 'cas_displayName_mapping');
|
||||
|
||||
$displayNameMappingArray = explode("+", $displayNameMapping);
|
||||
|
||||
$displayName = '';
|
||||
|
||||
foreach ($displayNameMappingArray as $displayNameMapping) {
|
||||
|
||||
if (array_key_exists($displayNameMapping, $casAttributes)) {
|
||||
|
||||
$displayName .= $casAttributes[$displayNameMapping] . " ";
|
||||
}
|
||||
}
|
||||
|
||||
$displayName = trim($displayName);
|
||||
|
||||
if ($displayName === '' && array_key_exists('displayName', $casAttributes)) {
|
||||
|
||||
$displayName = $casAttributes['displayName'];
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return $displayName;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,263 @@
|
|||
<?php
|
||||
|
||||
/**
|
||||
* ownCloud - user_cas
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* This library is free software; you can redistribute it and/or
|
||||
* modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE
|
||||
* License as published by the Free Software Foundation; either
|
||||
* version 3 of the License, or any later version.
|
||||
*
|
||||
* This library is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU AFFERO GENERAL PUBLIC LICENSE for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public
|
||||
* License along with this library. If not, see <http://www.gnu.org/licenses/>.
|
||||
*
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\User;
|
||||
|
||||
use OC\User\Database;
|
||||
use OCA\UserCAS\Exception\PhpCas\PhpUserCasLibraryNotFoundException;
|
||||
use OCA\UserCAS\Service\AppService;
|
||||
use OCA\UserCAS\Service\LoggingService;
|
||||
use OCA\UserCAS\Service\UserService;
|
||||
use OCP\IConfig;
|
||||
use OCP\IUser;
|
||||
use OCP\IUserBackend;
|
||||
use OCP\IUserManager;
|
||||
use \OCP\User\Backend\ICheckPasswordBackend;
|
||||
use OCP\UserInterface;
|
||||
|
||||
|
||||
/**
|
||||
* Class Backend
|
||||
*
|
||||
* @package OCA\UserCAS\User
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @since 1.4.0
|
||||
*/
|
||||
class NextBackend extends Database implements UserInterface, IUserBackend, ICheckPasswordBackend, UserCasBackendInterface
|
||||
{
|
||||
|
||||
/**
|
||||
* @var string
|
||||
*/
|
||||
protected $appName;
|
||||
|
||||
/**
|
||||
* @var IConfig
|
||||
*/
|
||||
protected $config;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\LoggingService $loggingService
|
||||
*/
|
||||
protected $loggingService;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\AppService $appService
|
||||
*/
|
||||
protected $appService;
|
||||
|
||||
/**
|
||||
* @var \OCP\IUserManager;
|
||||
*/
|
||||
protected $userManager;
|
||||
|
||||
/**
|
||||
* @var \OCA\UserCAS\Service\UserService $userService
|
||||
*/
|
||||
protected $userService;
|
||||
|
||||
|
||||
/**
|
||||
* Backend constructor.
|
||||
*
|
||||
* @param string $appName
|
||||
* @param IConfig $config
|
||||
* @param LoggingService $loggingService
|
||||
* @param AppService $appService
|
||||
* @param IUserManager $userManager
|
||||
* @param UserService $userService
|
||||
*/
|
||||
public function __construct($appName, IConfig $config, LoggingService $loggingService, AppService $appService, IUserManager $userManager, UserService $userService)
|
||||
{
|
||||
|
||||
parent::__construct();
|
||||
$this->appName = $appName;
|
||||
$this->loggingService = $loggingService;
|
||||
$this->appService = $appService;
|
||||
$this->config = $config;
|
||||
$this->userManager = $userManager;
|
||||
$this->userService = $userService;
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Backend name to be shown in user management
|
||||
*
|
||||
* @return string the name of the backend to be shown
|
||||
*/
|
||||
public function getBackendName()
|
||||
{
|
||||
|
||||
return "CAS";
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Check the password
|
||||
*
|
||||
* @param string $loginName
|
||||
* @param string $password
|
||||
* @return string|bool The users UID or false
|
||||
*/
|
||||
public function checkPassword(string $loginName, string $password)
|
||||
{
|
||||
|
||||
if (!$this->appService->isCasInitialized()) {
|
||||
|
||||
try {
|
||||
|
||||
$this->appService->init();
|
||||
} catch (PhpUserCasLibraryNotFoundException $e) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'Fatal error with code: ' . $e->getCode() . ' and message: ' . $e->getMessage());
|
||||
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
if (\phpCAS::isInitialized()) {
|
||||
|
||||
if ($loginName === FALSE) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'phpCAS returned no user.');
|
||||
}
|
||||
|
||||
if (\phpCAS::isAuthenticated()) {
|
||||
|
||||
#$casUid = \phpCAS::getUser();
|
||||
$casUid = $this->userService->getUserId();
|
||||
|
||||
$isAuthorized = TRUE;
|
||||
$createUser = TRUE;
|
||||
|
||||
|
||||
# Check if user may be authorized based on groups or not
|
||||
$cas_access_allow_groups = $this->config->getAppValue($this->appName, 'cas_access_allow_groups');
|
||||
if (is_string($cas_access_allow_groups) && strlen($cas_access_allow_groups) > 0) {
|
||||
|
||||
$cas_access_allow_groups = explode(',', $cas_access_allow_groups);
|
||||
$casAttributes = \phpCAS::getAttributes();
|
||||
$casGroups = array();
|
||||
$groupMapping = $this->config->getAppValue($this->appName, 'cas_group_mapping');
|
||||
|
||||
# Test if an attribute parser added a new dimension to our attributes array
|
||||
if (array_key_exists('attributes', $casAttributes)) {
|
||||
|
||||
$newAttributes = $casAttributes['attributes'];
|
||||
|
||||
unset($casAttributes['attributes']);
|
||||
|
||||
$casAttributes = array_merge($casAttributes, $newAttributes);
|
||||
}
|
||||
|
||||
# Test for mapped attribute from settings
|
||||
if (array_key_exists($groupMapping, $casAttributes)) {
|
||||
|
||||
$casGroups = (array)$casAttributes[$groupMapping];
|
||||
} # Test for standard 'groups' attribute
|
||||
else if (array_key_exists('groups', $casAttributes)) {
|
||||
|
||||
if ($this->config->getAppValue($this->appName, 'cas_groups_json_decode')) {
|
||||
|
||||
$casGroups = json_decode($casAttributes['groups']);
|
||||
} else {
|
||||
|
||||
$casGroups = (array)$casAttributes['groups'];
|
||||
}
|
||||
}
|
||||
|
||||
$isAuthorized = FALSE;
|
||||
|
||||
foreach ($casGroups as $casGroup) {
|
||||
|
||||
if (in_array($casGroup, $cas_access_allow_groups)) {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has been authorized with group: ' . $casGroup);
|
||||
|
||||
$isAuthorized = TRUE;
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(LoggingService::DEBUG, 'phpCas CAS users login has not been authorized with group: ' . $casGroup . ', because the group was not in allowedGroups: ' . implode(", ", $cas_access_allow_groups));
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// Autocreate user if needed or create a new account in CAS Backend
|
||||
if (!$this->userManager->userExists($loginName) && boolval($this->config->getAppValue($this->appName, 'cas_autocreate'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS creating a new user with UID: ' . $loginName);
|
||||
|
||||
try {
|
||||
|
||||
$createUser = $this->userService->create($loginName, $this);
|
||||
|
||||
if (!$createUser instanceof IUser) {
|
||||
|
||||
$createUser = FALSE;
|
||||
}
|
||||
} catch (\Exception $e) {
|
||||
|
||||
$createUser = FALSE;
|
||||
}
|
||||
} elseif (!$this->userManager->userExists($loginName) && !boolval($this->config->getAppValue($this->appName, 'cas_autocreate'))) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS no new user has been created.');
|
||||
|
||||
$createUser = FALSE;
|
||||
}
|
||||
|
||||
// Finalize check
|
||||
if ($casUid === $loginName && $isAuthorized && $createUser) {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::DEBUG, 'phpCAS user password has been checked.');
|
||||
|
||||
return $loginName;
|
||||
}
|
||||
}
|
||||
|
||||
return FALSE;
|
||||
} else {
|
||||
|
||||
$this->loggingService->write(\OCA\UserCas\Service\LoggingService::ERROR, 'phpCAS has not been initialized.');
|
||||
return FALSE;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get the real UID
|
||||
*
|
||||
* @param string $uid
|
||||
* @return string
|
||||
*
|
||||
* @since 1.8.0
|
||||
*/
|
||||
public function getRealUID(string $uid): string
|
||||
{
|
||||
|
||||
return $uid;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
<?php
|
||||
/**
|
||||
* Created by PhpStorm.
|
||||
* User: felixrupp
|
||||
* Date: 17.09.18
|
||||
* Time: 01:51
|
||||
*/
|
||||
|
||||
namespace OCA\UserCAS\User;
|
||||
|
||||
use OCP\UserInterface;
|
||||
|
||||
/**
|
||||
* Interface UserCasBackendInterface
|
||||
*
|
||||
* @package OCA\UserCAS\User
|
||||
*
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*/
|
||||
interface UserCasBackendInterface extends UserInterface
|
||||
{
|
||||
}
|
||||
|
|
@ -0,0 +1,441 @@
|
|||
<?php
|
||||
/**
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @license AGPL-3.0
|
||||
*
|
||||
* This code is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License, version 3,
|
||||
* as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License, version 3,
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
||||
*/
|
||||
script('user_cas', 'settings');
|
||||
style('user_cas', 'settings');
|
||||
?>
|
||||
|
||||
<form id="user_cas" class='section' method="post">
|
||||
|
||||
<input type="hidden" autocomplete="false" />
|
||||
|
||||
<h2><?php p($l->t('CAS Authentication backend')); ?>
|
||||
<?php p(\OC_App::getAppInfo('user_cas')["version"]); ?></h2>
|
||||
|
||||
<div id="casSettings" class="personalblock">
|
||||
<ul>
|
||||
<li><a href="#casSettings-1"><?php p($l->t('CAS Server')); ?></a></li>
|
||||
<li><a href="#casSettings-2"><?php p($l->t('Basic')); ?></a></li>
|
||||
<li><a href="#casSettings-3"><?php p($l->t('Mapping')); ?></a></li>
|
||||
<li><a href="#casSettings-4"><?php p($l->t('Groups')); ?></a></li>
|
||||
<li><a href="#casSettings-5"><?php p($l->t('ECAS Settings')); ?></a></li>
|
||||
<li><a href="#casSettings-6"><?php p($l->t('Import CLI')); ?></a></li>
|
||||
<li><a href="#casSettings-7"><?php p($l->t('phpCAS Library')); ?></a></li>
|
||||
</ul>
|
||||
<!-- CAS Server Settings -->
|
||||
<fieldset id="casSettings-1">
|
||||
<p><label for="cas_server_version"><?php p($l->t('CAS Server Version')); ?></label>
|
||||
<select id="cas_server_version" name="cas_server_version">
|
||||
<?php $version = $_['cas_server_version']; ?>
|
||||
<option value="3.0" <?php echo $version === '3.0' ? 'selected' : ''; ?>>CAS 3.0</option>
|
||||
<option value="2.0" <?php echo $version === '2.0' ? 'selected' : ''; ?>>CAS 2.0</option>
|
||||
<option value="1.0" <?php echo $version === '1.0' ? 'selected' : ''; ?>>CAS 1.0</option>
|
||||
<option value="S1" <?php echo $version === 'S1' ? 'selected' : ''; ?>>SAML 1.1</option>
|
||||
</select>
|
||||
</p>
|
||||
<p><label for="cas_server_hostname"><?php p($l->t('CAS Server Hostname')); ?></label><input
|
||||
id="cas_server_hostname"
|
||||
name="cas_server_hostname"
|
||||
value="<?php p($_['cas_server_hostname']); ?>">
|
||||
</p>
|
||||
<p><label for="cas_server_port"><?php p($l->t('CAS Server Port')); ?></label><input
|
||||
id="cas_server_port"
|
||||
name="cas_server_port"
|
||||
placeholder="443"
|
||||
autocomplete="off"
|
||||
value="<?php if( !empty($_['cas_server_port']) ) { p($_['cas_server_port']); } else { p('443'); } ?>">
|
||||
</p>
|
||||
<p><label for="cas_server_path"><?php p($l->t('CAS Server Path')); ?></label><input
|
||||
id="cas_server_path"
|
||||
name="cas_server_path"
|
||||
autocomplete="off"
|
||||
placeholder="/cas"
|
||||
value="<?php if( !empty($_['cas_server_path']) ) { p($_['cas_server_path']);} else { p('/cas'); } ?>">
|
||||
</p>
|
||||
<p><label for="cas_service_url"><?php p($l->t('Service URL')); ?></label><input
|
||||
id="cas_service_url"
|
||||
name="cas_service_url"
|
||||
value="<?php p($_['cas_service_url']); ?>">
|
||||
</p>
|
||||
<p><label
|
||||
for="cas_cert_path"><?php p($l->t('Certification file path (.crt).')); ?></label><input
|
||||
id="cas_cert_path" name="cas_cert_path" value="<?php p($_['cas_cert_path']); ?>"> <span
|
||||
class="csh"><?php p($l->t('Leave empty if you don’t want to validate your CAS server instance')); ?></span>
|
||||
</p>
|
||||
<p>
|
||||
<input type="checkbox" id="cas_use_proxy"
|
||||
name="cas_use_proxy" <?php print_unescaped((($_['cas_use_proxy'] === 'true' || $_['cas_use_proxy'] === 'on' || $_['cas_use_proxy'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_use_proxy"><?php p($l->t('Use CAS proxy initialization')); ?></label>
|
||||
</p>
|
||||
</fieldset>
|
||||
<!-- Basic Settings -->
|
||||
<fieldset id="casSettings-2">
|
||||
<p><input type="checkbox" id="cas_force_login"
|
||||
name="cas_force_login" <?php print_unescaped((($_['cas_force_login'] === 'true' || $_['cas_force_login'] === 'on' || $_['cas_force_login'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_force_login"><?php p($l->t('Force user login using CAS?')); ?></label>
|
||||
</p>
|
||||
<p>
|
||||
<label for="cas_force_login_exceptions"><?php p($l->t('Don’t use force login on these client-IPs')); ?></label><input
|
||||
id="cas_force_login_exceptions"
|
||||
name="cas_force_login_exceptions"
|
||||
value="<?php p($_['cas_force_login_exceptions']); ?>"
|
||||
<?php print_unescaped((($_['cas_force_login'] === 'false' || $_['cas_force_login'] === 'off' || $_['cas_force_login'] === '0') ? 'disabled="disabled"' : '')); ?> />
|
||||
<span class="csh"><?php p($l->t('Comma separated list of client IP addresses (or address ranges), which won’t be forced to login if "Force user login" is enabled (e.g. 192.168.1.1-254,192.168.2.5)')) ?></span>
|
||||
</p>
|
||||
<p><input type="checkbox" id="cas_disable_logout"
|
||||
name="cas_disable_logout" <?php print_unescaped((($_['cas_disable_logout'] === 'true' || $_['cas_disable_logout'] === 'on' || $_['cas_disable_logout'] === '1') ? 'checked="checked"' : ''));
|
||||
print_unescaped((($_['cas_force_login'] === 'true' || $_['cas_force_login'] === 'on' || $_['cas_force_login'] === '1') ? 'disabled="disabled"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_disable_logout"><?php p($l->t('Disable CAS logout (do not logout CAS-session, only instance-session)')); ?></label>
|
||||
</p>
|
||||
<p><input type="checkbox" id="cas_autocreate"
|
||||
name="cas_autocreate" <?php print_unescaped((($_['cas_autocreate'] === 'true' || $_['cas_autocreate'] === 'on' || $_['cas_autocreate'] === '1' || $_['cas_autocreate'] === '') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_autocreate"><?php p($l->t('Autocreate user after first CAS login?')); ?></label>
|
||||
</p>
|
||||
|
||||
<p><input type="checkbox" id="cas_update_user_data"
|
||||
name="cas_update_user_data" <?php print_unescaped((($_['cas_update_user_data'] === 'true' || $_['cas_update_user_data'] === 'on' || $_['cas_update_user_data'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_update_user_data"><?php p($l->t('Update user data after each CAS login?')); ?></label>
|
||||
</p>
|
||||
|
||||
<p><input type="checkbox" id="cas_disable_singlesignout"
|
||||
name="cas_disable_singlesignout" <?php print_unescaped((($_['cas_disable_singlesignout'] === 'true' || $_['cas_disable_singlesignout'] === 'on' || $_['cas_disable_singlesignout'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_disable_singlesignout"><?php p($l->t('Disable CAS SingleSignout (do not logout instance-session if CAS-server sends SSO-Request)')); ?></label>
|
||||
</p>
|
||||
<p>
|
||||
<label for="cas_handlelogoutrequest_servers"><?php p($l->t('SingleSignout Servers')); ?></label><input
|
||||
id="cas_handlelogout_servers"
|
||||
name="cas_handlelogout_servers"
|
||||
value="<?php p($_['cas_handlelogout_servers']); ?>"
|
||||
<?php print_unescaped((($_['cas_disable_singlesignout'] === 'true' || $_['cas_disable_singlesignout'] === 'on' || $_['cas_disable_singlesignout'] === '1') ? 'disabled="disabled"' : '')); ?> />
|
||||
<span class="csh"><?php p($l->t('Comma separated list of servers which can send SingleSignout requests (leave empty if you do not have to restrict SingleSignout to defined servers)')) ?></span>
|
||||
</p>
|
||||
|
||||
<p><input type="checkbox" id="cas_keep_ticket_ids"
|
||||
name="cas_keep_ticket_ids" <?php print_unescaped((($_['cas_keep_ticket_ids'] === 'true' || $_['cas_keep_ticket_ids'] === 'on' || $_['cas_keep_ticket_ids'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_keep_ticket_ids"><?php p($l->t('Keep CAS-ticket-ids in URL?')); ?></label>
|
||||
<span class="csh">(<?php p($l->t('Beware: Potential security risk! Only activate, if you know what you are doing.')) ?>)</span>
|
||||
|
||||
</p>
|
||||
<p>
|
||||
<label for="cas_login_button_label"><?php p($l->t('Overwrite Login Button Label')); ?></label><input
|
||||
id="cas_login_button_label"
|
||||
name="cas_login_button_label"
|
||||
value="<?php p($_['cas_login_button_label']); ?>" />
|
||||
</p>
|
||||
<p>
|
||||
<input type="checkbox" id="cas_shares_protected"
|
||||
name="cas_shares_protected" <?php print_unescaped((($_['cas_shares_protected'] === 'true' || $_['cas_shares_protected'] === 'on' || $_['cas_shares_protected'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_shares_protected"><?php p($l->t('Protect "public share" links with CAS')); ?></label>
|
||||
</p>
|
||||
|
||||
<!-- <p><input type="checkbox" id="cas_link_to_ldap_backend"
|
||||
name="cas_link_to_ldap_backend" <?php /*print_unescaped((($_['cas_link_to_ldap_backend'] === 'true' || $_['cas_link_to_ldap_backend'] === 'on' || $_['cas_link_to_ldap_backend'] === '1') ? 'checked="checked"' : ''));*/ ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_link_to_ldap_backend"><?php p($l->t('Link CAS authentication with LDAP users and groups backend')); ?></label>
|
||||
</p> -->
|
||||
|
||||
</fieldset>
|
||||
<!-- Mapping Settings -->
|
||||
<fieldset id="casSettings-3">
|
||||
<p>
|
||||
<label for="cas_userid_mapping"><?php p($l->t('User-ID')); ?></label><input
|
||||
id="cas_userid_mapping"
|
||||
name="cas_userid_mapping"
|
||||
value="<?php p($_['cas_userid_mapping']); ?>"/> <span class="csh">(<?php p($l->t('Only map this attribute, if you want one specific CAS attribute as your user’s id. If left blank, the default CAS user-id is used.')) ?>)</span>
|
||||
</p>
|
||||
<p><label for="cas_email_mapping"><?php p($l->t('Email')); ?></label><input
|
||||
id="cas_email_mapping"
|
||||
name="cas_email_mapping"
|
||||
value="<?php p($_['cas_email_mapping']); ?>" placeholder="email"/>
|
||||
</p>
|
||||
<p><label for="cas_displayName_mapping"><?php p($l->t('Display Name')); ?></label><input
|
||||
id="cas_displayName_mapping"
|
||||
name="cas_displayName_mapping"
|
||||
value="<?php p($_['cas_displayName_mapping']); ?>" placeholder="displayName"/>
|
||||
</p>
|
||||
<p><label for="cas_group_mapping"><?php p($l->t('Groups')); ?></label><input
|
||||
id="cas_group_mapping"
|
||||
name="cas_group_mapping"
|
||||
value="<?php p($_['cas_group_mapping']); ?>" placeholder="groups"/>
|
||||
</p>
|
||||
<p><label for="cas_quota_mapping"><?php p($l->t('Quota')); ?></label><input
|
||||
id="cas_quota_mapping"
|
||||
name="cas_quota_mapping"
|
||||
value="<?php p($_['cas_quota_mapping']); ?>" placeholder="quota"/>
|
||||
</p>
|
||||
</fieldset>
|
||||
<!-- Groups -->
|
||||
<fieldset id="casSettings-4">
|
||||
<p><label
|
||||
for="cas_protected_groups"><?php p($l->t('Locked Groups')); ?></label><input
|
||||
id="cas_protected_groups" name="cas_protected_groups"
|
||||
value="<?php p($_['cas_protected_groups']); ?>"
|
||||
placeholder="group1,group2,group3"
|
||||
title="<?php p($l->t('Multivalued field, use comma to separate values')); ?>"/> <span class="csh"><?php p($l->t('Groups that will not be unlinked from the user when sync the CAS server and the NextCloud')); ?></span></p>
|
||||
<p><label
|
||||
for="cas_default_group"><?php p($l->t('Default Group')); ?></label><input
|
||||
id="cas_default_group" name="cas_default_group"
|
||||
placeholder="defaultGroup"
|
||||
value="<?php p($_['cas_default_group']); ?>"> <span class="csh"><?php p($l->t('Default group when autocreating users and no group data was found for the user')); ?></span></p>
|
||||
<p><label
|
||||
for="cas_access_allow_groups"><?php p($l->t('Authorized CAS Groups')); ?></label><input
|
||||
id="cas_access_allow_groups" name="cas_access_allow_groups"
|
||||
value="<?php p($_['cas_access_allow_groups']); ?>"
|
||||
placeholder="group1,group2,group3"
|
||||
title="<?php p($l->t('Multivalued field, use comma to separate values')); ?>"/> <span class="csh"><?php p($l->t('Users in the following groups will be able to log into NextCloud, users not in one of the groups will be logged out immediately')); ?></span></p>
|
||||
<p><label
|
||||
for="cas_access_group_quotas"><?php p($l->t('Group Quotas')); ?></label><input
|
||||
id="cas_access_group_quotas" name="cas_access_group_quotas"
|
||||
value="<?php p($_['cas_access_group_quotas']); ?>"
|
||||
placeholder="group1:5GB,group2:20GB,group3:none"
|
||||
title="<?php p($l->t('Multivalued field, use comma to separate values')); ?>"/></p>
|
||||
<p><label for="cas_groups_letter_filter"><?php p($l->t('Group Name Filter')); ?></label><input
|
||||
id="cas_groups_letter_filter"
|
||||
name="cas_groups_letter_filter"
|
||||
value="<?php p($_['cas_groups_letter_filter']); ?>" placeholder="a-zA-Z0-9\.\-_ @\/"/> <span class="csh"><?php p($l->t('Attention: You must use PHP (PCRE) Regex syntax for the filter.')) ?></span>
|
||||
</p>
|
||||
<p>
|
||||
<input type="checkbox" id="cas_groups_letter_umlauts"
|
||||
name="cas_groups_letter_umlauts" <?php print_unescaped((($_['cas_groups_letter_umlauts'] === 'true' || $_['cas_groups_letter_umlauts'] === 'on' || $_['cas_groups_letter_umlauts'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_groups_letter_umlauts"><?php p($l->t('Group Name: Replace Umlauts')); ?></label>
|
||||
</p>
|
||||
<p>
|
||||
<input type="checkbox" id="cas_groups_json_decode"
|
||||
name="cas_groups_json_decode" <?php print_unescaped((($_['cas_groups_json_decode'] === 'true' || $_['cas_groups_json_decode'] === 'on' || $_['cas_groups_json_decode'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_groups_json_decode"><?php p($l->t('Group Name: JSON Decode')); ?></label>
|
||||
<span class="csh">(<?php p($l->t('Beware: Potential security risk! Only activate, if you know what you are doing.')) ?>)</span>
|
||||
</p>
|
||||
<p>
|
||||
<input type="checkbox" id="cas_groups_create_default_for_user"
|
||||
name="cas_groups_create_default_for_user" <?php print_unescaped((($_['cas_groups_create_default_for_user'] === 'true' || $_['cas_groups_create_default_for_user'] === 'on' || $_['cas_groups_create_default_for_user'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_groups_create_default_for_user"><?php p($l->t('User’s Default Group: Create default group for each user with UID and optional prefix:')); ?></label>
|
||||
<input
|
||||
id="cas_groups_create_default_for_user_prefix"
|
||||
name="cas_groups_create_default_for_user_prefix"
|
||||
value="<?php p($_['cas_groups_create_default_for_user_prefix']); ?>" placeholder="FooBar"/>
|
||||
</p>
|
||||
</fieldset>
|
||||
<!-- ECAS Settings -->
|
||||
<fieldset id="casSettings-5">
|
||||
<p><input type="checkbox" id="cas_ecas_attributeparserenabled"
|
||||
name="cas_ecas_attributeparserenabled" <?php print_unescaped((($_['cas_ecas_attributeparserenabled'] === 'true' || $_['cas_ecas_attributeparserenabled'] === 'on' || $_['cas_ecas_attributeparserenabled'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_ecas_attributeparserenabled"><?php p($l->t('Use ECAS Attribute Parser?')); ?></label>
|
||||
</p>
|
||||
<p><input type="checkbox" id="cas_ecas_request_full_userdetails"
|
||||
name="cas_ecas_request_full_userdetails" <?php print_unescaped((($_['cas_ecas_request_full_userdetails'] === 'true' || $_['cas_ecas_request_full_userdetails'] === 'on' || $_['cas_ecas_request_full_userdetails'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_ecas_request_full_userdetails"><?php p($l->t('Request full user details?')); ?></label>
|
||||
</p>
|
||||
<p><label for="cas_ecas_accepted_strengths"><?php p($l->t('ECAS Strength')); ?></label>
|
||||
<input id="cas_ecas_accepted_strengths" name="cas_ecas_accepted_strengths" placeholder=""
|
||||
value="<?php p($_['cas_ecas_accepted_strengths']); ?>"> <span class="csh"><?php p($l->t('Multiple values separated by comma can be added. i.e. \'PASSWORD_SMS,PASSWORD_TOKEN,STRONG,PASSWORD_MOBILE_APP\'')); ?></span>
|
||||
</p>
|
||||
<p><label for="cas_ecas_assurance_level"><?php p($l->t('ECAS AssuranceLevel')); ?></label>
|
||||
<select id="cas_ecas_assurance_level" name="cas_ecas_assurance_level">
|
||||
<?php $assuranceLevel = $_['cas_ecas_assurance_level']; ?>
|
||||
<option value="" <?php echo $assuranceLevel === '' ? 'selected' : ''; ?>><?php p($l->t('Not set')); ?></option>
|
||||
<option value="LOW" <?php echo $assuranceLevel === 'LOW' ? 'selected' : ''; ?>>LOW</option>
|
||||
<option value="MEDIUM" <?php echo $assuranceLevel === 'MEDIUM' ? 'selected' : ''; ?>>MEDIUM</option>
|
||||
<option value="HIGH" <?php echo $assuranceLevel === 'HIGH' ? 'selected' : ''; ?>>HIGH</option>
|
||||
<option value="TOP" <?php echo $assuranceLevel === 'TOP' ? 'selected' : ''; ?>>TOP</option>
|
||||
</select>
|
||||
</p>
|
||||
<p>
|
||||
<label for="cas_ecas_retrieve_groups"
|
||||
title=""><?php p($l->t('Query ECAS groups')); ?></label><input
|
||||
id="cas_ecas_retrieve_groups" name="cas_ecas_retrieve_groups" placeholder="*"
|
||||
value="<?php p($_['cas_ecas_retrieve_groups']); ?>"> <span class="csh"><?php p($l->t('Note down all groups which you want to receive from your ECAS instance, * returns all groups')); ?></span></p>
|
||||
<p>
|
||||
<label for="cas_ecas_internal_ip_range"><?php p($l->t('Don’t use Multi-Factor-Authentication on these client-IPs')); ?></label><input
|
||||
id="cas_ecas_internal_ip_range"
|
||||
name="cas_ecas_internal_ip_range"
|
||||
value="<?php p($_['cas_ecas_internal_ip_range']); ?>" />
|
||||
<span class="csh"><?php p($l->t('Comma separated list of client IP addresses (or address ranges), which won’t be forced to use Multi-Factor-Authentication if "ECAS AssuranceLevel" is at least MEDIUM (e.g. 192.168.1.1-254,192.168.2.5)')) ?></span>
|
||||
</p>
|
||||
</fieldset>
|
||||
<!-- Import-CLI Settings -->
|
||||
<fieldset id="casSettings-6">
|
||||
|
||||
<h3><?php p($l->t('ActiveDirectory (LDAP)')); ?>:</h3>
|
||||
|
||||
<p><label for="cas_import_ad_host"><?php p($l->t('LDAP Host')); ?></label>
|
||||
<select id="cas_import_ad_protocol" name="cas_import_ad_protocol">
|
||||
<?php $importAdProtocol = $_['cas_import_ad_protocol']; ?>
|
||||
<option value="ldaps://" <?php echo $importAdProtocol === 'ldaps://' ? 'selected' : ''; ?>>ldaps://</option>
|
||||
<option value="ldap://" <?php echo $importAdProtocol === 'ldap://' ? 'selected' : ''; ?>>ldap://</option>
|
||||
|
||||
</select>
|
||||
<input
|
||||
id="cas_import_ad_host"
|
||||
name="cas_import_ad_host"
|
||||
value="<?php p($_['cas_import_ad_host']); ?>" placeholder="ldap.mydomain.com"/>
|
||||
:
|
||||
<input
|
||||
id="cas_import_ad_port"
|
||||
name="cas_import_ad_port"
|
||||
value="<?php p($_['cas_import_ad_port']); ?>" placeholder="636"/>
|
||||
</p>
|
||||
<p><label for="cas_import_ad_user"><?php p($l->t('LDAP User and Domain')); ?></label>
|
||||
<input
|
||||
id="cas_import_ad_user"
|
||||
name="cas_import_ad_user"
|
||||
value="<?php p($_['cas_import_ad_user']); ?>" placeholder="admin"/>
|
||||
@
|
||||
<input
|
||||
id="cas_import_ad_domain"
|
||||
name="cas_import_ad_domain"
|
||||
value="<?php p($_['cas_import_ad_domain']); ?>" placeholder="ldap.mydomain.com"/>
|
||||
</p>
|
||||
<p><label for="cas_import_ad_password"><?php p($l->t('LDAP User Password')); ?></label>
|
||||
<input
|
||||
type="password"
|
||||
id="cas_import_ad_password"
|
||||
name="cas_import_ad_password"/>
|
||||
</p>
|
||||
<p><label for="cas_import_ad_base_dn"><?php p($l->t('LDAP Base DN')); ?></label>
|
||||
<input
|
||||
id="cas_import_ad_base_dn"
|
||||
name="cas_import_ad_base_dn"
|
||||
value="<?php p($_['cas_import_ad_base_dn']); ?>" placeholder="OU=People,DC=mydomain,DC=com"/>
|
||||
</p>
|
||||
<p><label for="cas_import_ad_sync_filter"><?php p($l->t('LDAP Sync Filter')); ?></label>
|
||||
<input
|
||||
id="cas_import_ad_sync_filter"
|
||||
name="cas_import_ad_sync_filter"
|
||||
value="<?php print_unescaped($_['cas_import_ad_sync_filter']); ?>" placeholder="(&(objectCategory=user)(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=CN=owncloudusers,CN=Users,DC=mydomain,DC=com))"/>
|
||||
</p>
|
||||
<p><label for="cas_import_ad_sync_pagesize_value"><?php p($l->t('LDAP Sync Pagesize (1–1500)')); ?></label>
|
||||
<input
|
||||
type="range"
|
||||
min="1" max="1500" step="1"
|
||||
id="cas_import_ad_sync_pagesize"
|
||||
name="cas_import_ad_sync_pagesize"
|
||||
value="<?php if(isset($_['cas_import_ad_sync_pagesize'])) { p($_['cas_import_ad_sync_pagesize']); } else { print_unescaped('1500'); } ?>"
|
||||
onchange="updateRangeInput(this.value, 'cas_import_ad_sync_pagesize_value');"/>
|
||||
<input type="number" id="cas_import_ad_sync_pagesize_value" size="4" maxlength="4" min="1" max="1500" value="<?php if(isset($_['cas_import_ad_sync_pagesize'])) { p($_['cas_import_ad_sync_pagesize']); } else { print_unescaped('1500'); } ?>">
|
||||
</p>
|
||||
|
||||
<h3><?php p($l->t('CLI Attribute Mapping')); ?>:</h3>
|
||||
|
||||
<p><label for="cas_import_map_uid"><?php p($l->t('UID/Username')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_uid"
|
||||
name="cas_import_map_uid"
|
||||
value="<?php p($_['cas_import_map_uid']); ?>" placeholder="sn"/>
|
||||
</p>
|
||||
<p><label for="cas_import_map_displayname"><?php p($l->t('Display Name')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_displayname"
|
||||
name="cas_import_map_displayname"
|
||||
value="<?php p($_['cas_import_map_displayname']); ?>" placeholder="givenname"/>
|
||||
</p>
|
||||
<p><label for="cas_import_map_email"><?php p($l->t('Email')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_email"
|
||||
name="cas_import_map_email"
|
||||
value="<?php p($_['cas_import_map_email']); ?>" placeholder="email"/>
|
||||
</p>
|
||||
|
||||
<p><label for="cas_import_map_groups"><?php p($l->t('Groups')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_groups"
|
||||
name="cas_import_map_groups"
|
||||
value="<?php p($_['cas_import_map_groups']); ?>" placeholder="memberof"/>
|
||||
</p>
|
||||
<p><label for="cas_import_map_groups_description"><?php p($l->t('Group Name Field')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_groups_description"
|
||||
name="cas_import_map_groups_description"
|
||||
value="<?php p($_['cas_import_map_groups_description']); ?>" placeholder="description"/>
|
||||
</p>
|
||||
|
||||
<p><label for="cas_import_map_quota"><?php p($l->t('Quota')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_quota"
|
||||
name="cas_import_map_quota"
|
||||
value="<?php p($_['cas_import_map_quota']); ?>" placeholder="quota"/>
|
||||
</p>
|
||||
<p><label for="cas_import_map_enabled"><?php p($l->t('Enable')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_enabled"
|
||||
name="cas_import_map_enabled"
|
||||
value="<?php p($_['cas_import_map_enabled']); ?>" placeholder="useraccountcontrol"/>
|
||||
</p>
|
||||
<p><label for="cas_import_map_enabled_and_bitwise"><?php p($l->t('Calculate Enable Attribute Bitwise AND with')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_enabled_and_bitwise"
|
||||
name="cas_import_map_enabled_and_bitwise"
|
||||
value="<?php p($_['cas_import_map_enabled_and_bitwise']); ?>" placeholder="2"/>
|
||||
</p>
|
||||
|
||||
<p>
|
||||
<input type="checkbox" id="cas_import_merge"
|
||||
name="cas_import_merge" <?php print_unescaped((($_['cas_import_merge'] === 'true' || $_['cas_import_merge'] === 'on' || $_['cas_import_merge'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_import_merge"><?php p($l->t('Merge Accounts')); ?></label>
|
||||
</p>
|
||||
<p>
|
||||
<input type="checkbox" id="cas_import_merge_enabled"
|
||||
name="cas_import_merge_enabled" <?php print_unescaped((($_['cas_import_merge_enabled'] === 'true' || $_['cas_import_merge_enabled'] === 'on' || $_['cas_import_merge_enabled'] === '1') ? 'checked="checked"' : '')); ?>>
|
||||
<label class='checkbox'
|
||||
for="cas_import_merge_enabled"><?php p($l->t('Prefer Enabled over Disabled Accounts on Merge')); ?></label>
|
||||
</p>
|
||||
<p><label for="cas_import_map_dn"><?php p($l->t('Merge Two Active Accounts by')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_dn"
|
||||
name="cas_import_map_dn"
|
||||
value="<?php p($_['cas_import_map_dn']); ?>" placeholder="dn"/>
|
||||
</p>
|
||||
<p><label for="cas_import_map_dn_filter"><?php p($l->t('Merge Two Active Accounts by: Filterstring')); ?></label>
|
||||
<input
|
||||
id="cas_import_map_dn_filter"
|
||||
name="cas_import_map_dn_filter"
|
||||
value="<?php p($_['cas_import_map_dn_filter']); ?>" placeholder="cn=p"/>
|
||||
</p>
|
||||
</fieldset>
|
||||
<!-- phpCAS Settings -->
|
||||
<fieldset id="casSettings-7">
|
||||
<p>
|
||||
<label for="cas_php_cas_path"><?php p($l->t('Overwrite phpCAS path (CAS.php file)')); ?></label><input
|
||||
id="cas_php_cas_path"
|
||||
name="cas_php_cas_path"
|
||||
value="<?php p($_['cas_php_cas_path']); ?>"/> <span class="csh"><?php p($l->t('Optional: Overwrite phpCAS path (CAS.php file) if you want to use your own version. Leave blank to use the shipped version.')); ?></span>
|
||||
</p>
|
||||
<p><label for="cas_debug_file"><?php p($l->t('PHP CAS debug file')); ?></label><input
|
||||
id="cas_debug_file"
|
||||
name="cas_debug_file"
|
||||
value="<?php p($_['cas_debug_file']); ?>"/>
|
||||
</p>
|
||||
</fieldset>
|
||||
<input type="hidden" value="<?php p($_['requesttoken']); ?>" name="requesttoken"/>
|
||||
<input id="casSettingsSubmit" type="submit" value="<?php p($l->t('Save')); ?>"/>
|
||||
</div>
|
||||
</form>
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
<?php
|
||||
/**
|
||||
* @author Felix Rupp <kontakt@felixrupp.com>
|
||||
* @copyright Felix Rupp <kontakt@felixrupp.com>
|
||||
*
|
||||
* @license AGPL-3.0
|
||||
*
|
||||
* This code is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License, version 3,
|
||||
* as published by the Free Software Foundation.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License, version 3,
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
||||
*/
|
||||
style('user_cas', 'casError');
|
||||
?>
|
||||
|
||||
<span class="error casError">
|
||||
<p>
|
||||
<b><?php if($_['errorCode']) { p($l->t($_['errorCode']));?>: <?php } ?><?php p($l->t($_['errorMessage'])); ?></b>
|
||||
</p>
|
||||
<p>
|
||||
<a href="<?php p($_['backUrl']); ?>">
|
||||
<button><?php p($l->t('Go back to the login page')); ?></button>
|
||||
</a>
|
||||
</p>
|
||||
</span>
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
<?php
|
||||
|
||||
// autoload.php @generated by Composer
|
||||
|
||||
require_once __DIR__ . '/composer/autoload_real.php';
|
||||
|
||||
return ComposerAutoloaderInit693962d224b97822c6484f42a89fec4f::getLoader();
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue