Metadata, LDAP, SSP

config-templates/config.php

@@ -1090,7 +1090,7 @@
     'metadata.sign.privatekey' => null,
     'metadata.sign.privatekey_pass' => null,
     'metadata.sign.certificate' => null,
-    'metadata.sign.algorithm' => null,
+    'metadata.sign.algorithm' => 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
 
 
     /****************************

dictionaries/idpinstaller.definition.json

@@ -230,11 +230,20 @@
     "step5_ldap_referral": {
         "es": "Activar el seguimiento de referrals. Los controladores de dominio de Active Directory pueden requerir su desactivación para functionar correctamente"
     },
+    "step5_ldap_bindtext": {
+        "es": "En el caso de realizar bind anónimo especifique el DN y password:"
+    },
+    "step5_ldap_sspassword": {
+        "es": "¿Desea instalar y configurar la aplicación Self Service Password para que cada usuario pueda gestionar su contraseña?"
+    },
     "step5_ldap_timeout": {
         "es": "Timeout de acceso al LDAP, en segundos"
     },
     "step5_ldap_info": {
-        "es": "Esta configuración permitirá la conexión del IdP a la fuente de datos, pero no incluye la configuración de obtención de la información de la misma. Para configurar esta, se deberá seguir la documentación oficial de SimpleSAMLphp."
+        "es": "Esta configuración permitirá la conexión del IdP a la fuente de datos, pero no incluye la configuración de obtención de la información de la misma. Para configurar esta, se deberá seguir <a target='_blank' href='http://wiki.rediris.es/SIR2/SSp_directorios_LDAP'>esta documentación.</a>."
+    },
+    "step5_pdo_info": {
+        "es": "Esta configuración permitirá la conexión del IdP a la fuente de datos, pero no incluye la configuración de obtención de la información de la misma. Para configurar esta, se deberá seguir <a target='_blank' href='http://wiki.rediris.es/SIR2/SSp_bases_de_datos'>esta documentación.</a>."
     },
     "step5_ldap_title":{
         "es":"Configuración de fuente de datos de tipo LDAP"

hooks/hook_step1.php

@@ -67,6 +67,7 @@ function idpinstaller_hook_step1(&$data) {
         $data['errors'][] = $ssphpobj->t('{idpinstaller:idpinstaller:step1_error_version}');
     } else {
         //Continuamos comprobando las extensiones de PHP
+
         $extensions        = array("date", "dom", "hash", "libxml", "openssl", "pcre", "SPL", "zlib", "json", "mbstring");
         $windows_os = array("WIN32","WINNT","Windows");
 

hooks/hook_step3.php

@@ -79,12 +79,9 @@ function idpinstaller_hook_step3(&$data) {
         if (strcmp($pass, $pass2) == 0) {
             if (array_key_exists('ssphp_technicalcontact_name', $_REQUEST) && array_key_exists('ssphp_technicalcontact_email', $_REQUEST) && !empty($_REQUEST['ssphp_technicalcontact_name']) && !empty($_REQUEST['ssphp_technicalcontact_email'])) {
                 $filename                         = __DIR__ . '/../../../config/config.php';
-                include($filename);
-
-                $algoritmo = 'sha512';
-
+                include($filename);				
         		$salt = shell_exec("tr -cd '[:alnum:][:blank:]' < /dev/urandom | head -c48; echo");
-        		$config['auth.adminpassword'] = SimpleSAML\Utils\Crypto::pwHash($pass, strtoupper($algoritmo), $salt);
+        		$config['auth.adminpassword'] = SimpleSAML\Utils\Crypto::pwHash($pass);
         		$config['secretsalt']		  = $salt;
                 $config['technicalcontact_name']  = $_REQUEST['ssphp_technicalcontact_name'];
                 $config['technicalcontact_email'] = $_REQUEST['ssphp_technicalcontact_email'];
@@ -104,7 +101,7 @@ function idpinstaller_hook_step3(&$data) {
         		$config['trusted.url.domains']	  = array();
         		/*Fin de aniadido por Adrian Gomez*/
 
-                $res                              = @file_put_contents($filename, '<?php  $config = ' . var_export($config, 1) . "; ?>");
+                $res = @file_put_contents($filename, '<?php  $config = ' . var_export($config, 1) . "; ?>");
                 if (!$res) {
                     $data['errors'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step2_contact_save_error}');
                     $data['errors'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step2_contact_save_error2}') . " <i>" . realpath($filename) . "</i>";

hooks/hook_step5.php

@@ -76,17 +76,7 @@ function idpinstaller_hook_step5(&$data) {
                         $data['errors'][] = $ssphpobj->t('{idpinstaller:idpinstaller:step4_error}');
                     }
                 }
-            } else { //PARA LOS QUE QUEREMOS DESACTIVAR
-                if (file_exists($f . '/default-enable')) {
-
-                    @unlink($f . '/default-enable');
-                    @touch($f . '/default-disable');
-
-                    if (!file_exists($f . '/default-disable')) {
-                        $data['errors'][] = $ssphpobj->t('{idpinstaller:idpinstaller:step4_error}');
-                    }
-                }
-            }
+            } 
         }
     }
     if (count($modules_ko) > 0) {

hooks/hook_step6.php

@@ -134,7 +134,7 @@ function idpinstaller_hook_step6(&$data) {
                 }
                 return true;
             }
-        }else if (strcmp($ds_type, "config") == 0 && ($data['datasources'] == "all" || $data['datasources'] == "config")) {
+        }else if (strcmp($ds_type, "config") == 0) {
             if (array_key_exists('config_user', $_REQUEST) && !empty($_REQUEST['config_user'])
                     && array_key_exists('config_pass', $_REQUEST) && !empty($_REQUEST['config_pass'])
                     && array_key_exists('config_rol', $_REQUEST) && !empty($_REQUEST['config_rol'])) {

hooks/hook_step7.php

@@ -302,7 +302,7 @@ function idpinstaller_hook_step7(&$data) {
         $data['errors2'][] = $data['ssphpobj']->t("{idpinstaller:idpinstaller:step1_remember_change_perms}");
     }
     if (count($data['errors2']) == 0) {
-        $url_meta = 'http://' . $_SERVER['HTTP_HOST'] . substr($_SERVER['SCRIPT_NAME'], 0, -24) . "saml2/idp/metadata.php?output=xhtml";
+        $url_meta = SimpleSAML\Utils\HTTP::getBaseURL() . "saml2/idp/metadata.php?output=xhtml";
         $data['info'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step7_all_ok}');
         $data['info'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step7_all_info_extra}') . " <a href='$url_meta' target='_blank'>" . $data['ssphpobj']->t('{idpinstaller:idpinstaller:step7_here}') . "</a>";
     } else {

hooks/hook_step9.php

@@ -91,10 +91,10 @@ function idpinstaller_hook_step9(&$data) {
     $aux .= "<pre>&gt;" . $idpr_path . "</pre>";
     $data['info'][] = $aux;
 
-    $url_meta       = 'http://'.$_SERVER['HTTP_HOST'].substr($_SERVER['SCRIPT_NAME'], 0, -24) . "saml2/idp/metadata.php?output=xhtml";
+    $url_meta       = SimpleSAML\Utils\HTTP::getBaseURL() . "saml2/idp/metadata.php?output=xhtml";
     $data['info'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step7_all_info_extra}') . " <a href='$url_meta' target='_blank'>" . $data['ssphpobj']->t('{idpinstaller:idpinstaller:step7_here}') . "</a>";
 
-    $url_init       = 'http://'.$_SERVER['HTTP_HOST'].substr($_SERVER['SCRIPT_NAME'], 0, -24) . "module.php/core/frontpage_welcome.php";
+    $url_init       = SimpleSAML\Module::getModuleURL("core/frontpage_welcome.php");
     $data['info'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step9_url_init}') . " <a href='$url_init' target='_blank'>" . $data['ssphpobj']->t('{idpinstaller:idpinstaller:step7_here}') . "</a></br>";
 
     $data['info'][] = $data['ssphpobj']->t('{idpinstaller:idpinstaller:step9_remember_cert}').'<i>'.$cert_path.'</i>';

lib/functions.php

@@ -143,6 +143,91 @@ function transaleXMLToSsPHP($xmldata){
     return $output;
 }
 
+function saveSSPLDAPConfiguration($params){
+
+    $filenameSource = __DIR__ . '/../../../www/selfservicepassword/conf/config.inc.php';
+    $filenameTarget = __DIR__ . '/../../../www/selfservicepassword/conf/config.inc.local.php';
+
+    if(file_exists($filenameSource)){
+
+        $old = get_defined_vars();
+
+        include($filenameSource);
+
+        $new = get_defined_vars();
+
+        $fileSettings = array_diff($new, $old);
+
+        $keyphrase = "H3C31J3w0aSgCvfZuAPAInqKBBsyK6hH0RQEDm5Apj4PduQYmBv4m3myf6wF";
+
+        $newSettings = array(
+                        'ldap_url' => $params['ldap_hostname'].":".$params['ldap_port'],
+                        'ldap_starttls' => ($params['ldap_enable_tls'] == 0 ? TRUE : FALSE),
+                        'ldap_binddn' => $params['ldap_binddn'],
+                        'ldap_bindpw' => $params['ldap_bindpassword'],
+                        'ldap_base' => "dc=tuorganizacion,dc=es",
+                        'ldap_login_attribute' => "uid",
+                        'ldap_fullname_attribute' => "cn",
+                        'ldap_filter' => "(&(objectClass=person)($ldap_login_attribute={login}))",
+                        'keyphrase' => $keyphrase
+                    );
+
+        $fileSettings = array_merge($fileSettings, $newSettings);
+
+        $content = "<?php \n";
+
+        foreach ($fileSettings as $key => $value) {
+
+            if (gettype($value) == 'string' ){
+                $val = "'{$value}'";
+            } else if (gettype($value) == 'boolean' ){
+                if ($value == 0){
+                    $val = "FALSE";
+                } else {
+                    $val = "TRUE";
+                }
+            } else if (gettype($value) == 'NULL' ) {
+                $val = "NULL";
+            } else {
+                $val = "{$value}";
+            }
+
+            $content .= "$".$key." = ".$val."; \n";
+
+        }
+
+        $content .= "\n ?>";
+
+        file_put_contents($filenameTarget, $content);
+
+    }
+
+}
+
+function downloadSSPLdap(){
+
+    if (!file_exists(__DIR__ . '/../../../www/selfservicepassword')) {
+		$url = "https://ltb-project.org/archives/ltb-project-self-service-password-1.3.tar.gz";
+		$ch = curl_init($url);
+		curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+		curl_setopt($ch, CURLOPT_BINARYTRANSFER, true);
+		$output = curl_exec($ch);
+		//Guardamos la imagen en un archivo
+		$fh = fopen(__DIR__ . '/../../../www/sspass.tar.gz', 'w');
+		fwrite($fh, $output);
+		fclose($fh);
+
+		$p = new PharData(__DIR__ . '/../../../www/sspass.tar.gz');
+		//$p->decompress();
+		$p->extractTo(__DIR__ . '/../../../www/sspass', null, true);
+
+		rename(__DIR__ . '/../../../www/sspass/ltb-project-self-service-password-1.3', __DIR__ . '/../../../www/selfservicepassword');
+
+		rmdir(__DIR__ . '/../../../www/sspass');
+		unlink(__DIR__ . '/../../../www/sspass.tar.gz');
+	}
+
+}
 function generateSecurePass($length = 9, $add_dashes = false, $available_sets = 'luds')
     {
         $sets = array();

templates/step5.php

@@ -131,15 +131,13 @@ function showDatasource() {
     } else if (strcmp($this->data['sir']['datasources'], "ldap") == 0) {
         $ldap = true;
         $pdo = false;
-        $conf = false;
+        $conf = true;
         unset($options['pdo']);
-        unset($options['config']);
     } else if (strcmp($this->data['sir']['datasources'], "pdo") == 0) {
         $pdo  = true;
         $ldap = false;
-        $conf = false;
+        $conf = true;
         unset($options['ldap']);
-        unset($options['config']);
     } else if(strcmp($this->data['sir']['datasources'], "config") == 0){
         $pdo  = false;
         $ldap = false;