Changeset 159838
- Timestamp:
- 10/01/2009 11:52:02 PM (16 years ago)
- Location:
- shibboleth/trunk
- Files:
-
- 2 added
- 1 edited
-
options-admin.php (added)
-
options-user.php (added)
-
shibboleth.php (modified) (5 diffs)
Legend:
- Unmodified
- Added
- Removed
-
shibboleth/trunk/shibboleth.php
r112345 r159838 6 6 Author: Will Norris 7 7 Author URI: http://willnorris.com/ 8 Version: trunk8 Version: 1.3-dev 9 9 License: Apache 2 (http://www.apache.org/licenses/LICENSE-2.0.html) 10 10 */ … … 19 19 add_action('admin_init', 'shibboleth_activate_plugin'); 20 20 } 21 21 22 22 23 /** … … 77 78 78 79 /** 80 * Load Shibboleth admin hooks only on admin page loads. admin_init is 81 * actually called *after* admin_menu, so we have to hook in to the 'init' 82 * action for this. 83 */ 84 function shibboleth_admin_hooks() { 85 if ( defined('WP_ADMIN') && WP_ADMIN === true ) { 86 require_once dirname(__FILE__) . '/options-admin.php'; 87 require_once dirname(__FILE__) . '/options-user.php'; 88 } 89 } 90 add_action('init', 'shibboleth_admin_hooks'); 91 92 93 /** 79 94 * Use the 'authenticate' filter if it is available (WordPress >= 2.8). 80 95 * Otherwise, hook into 'init'. … … 167 182 } 168 183 add_filter('site_url', 'shibboleth_site_url', 10, 3); 184 169 185 170 186 /** … … 398 414 * Add a "Login with Shibboleth" link to the WordPress login form. This link 399 415 * will be wrapped in a <p> with an id value of "shibboleth_login" so that 400 * users can style this however they choose.416 * deployers can style this however they choose. 401 417 */ 402 418 function shibboleth_login_form() { 403 419 $login_url = shibboleth_login_url(); 404 420 echo '<p id="shibboleth_login"><a href="' . $login_url . '">' . __('Login with Shibboleth', 'shibboleth') . '</a></p>'; 405 }406 407 408 /**409 * For WordPress accounts that were created by Shibboleth, limit what profile410 * attributes they can modify.411 */412 function shibboleth_profile_personal_options() {413 $user = wp_get_current_user();414 if (get_usermeta($user->ID, 'shibboleth_account')) {415 add_filter('show_password_fields', create_function('$v', 'return false;'));416 417 if (shibboleth_get_option('shibboleth_update_users')) {418 echo '419 <script type="text/javascript">420 jQuery(function() {421 jQuery("#first_name,#last_name,#nickname,#display_name,#email").attr("disabled", true);422 jQuery("h3:contains(\'Name\')").after("<div class=\"updated fade\"><p>'423 . __('These fields cannot be changed from WordPress.', 'shibboleth') . '<p></div>");424 jQuery("form#your-profile").submit(function() {425 jQuery("#first_name,#last_name,#nickname,#display_name,#email").attr("disabled", false);426 });427 });428 </script>';429 }430 }431 }432 433 434 /**435 * For WordPress accounts that were created by Shibboleth, warn the admin of436 * Shibboleth managed attributes.437 */438 function shibboleth_edit_user_profile() {439 global $user_id;440 441 if (get_usermeta($user_id, 'shibboleth_account')) {442 $shibboleth_fields = array();443 444 if (shibboleth_get_option('shibboleth_update_users')) {445 $shibboleth_fields = array_merge($shibboleth_fields,446 array('user_login', 'first_name', 'last_name', 'nickname', 'display_name', 'email'));447 }448 449 if (shibboleth_get_option('shibboleth_update_roles')) {450 $shibboleth_fields = array_merge($shibboleth_fields, array('role'));451 }452 453 if (!empty($shibboleth_fields)) {454 $selectors = array();455 456 foreach($shibboleth_fields as $field) {457 $selectors[] = 'label[for=\'' . $field . '\']';458 }459 460 echo '461 <script type="text/javascript">462 jQuery(function() {463 jQuery("' . implode(',', $selectors) . '").before("<span style=\"color: #F00; font-weight: bold;\">*</span> ");464 jQuery("h3:contains(\'Name\')")465 .after("<div class=\"updated fade\"><p><span style=\"color: #F00; font-weight: bold;\">*</span> '466 . __('Starred fields are managed by Shibboleth and should not be changed from WordPress.', 'shibboleth') . '</p></div>");467 });468 </script>';469 }470 }471 }472 473 474 /**475 * Add change password link to the user profile for Shibboleth users.476 */477 function shibboleth_show_user_profile() {478 $user = wp_get_current_user();479 if (get_usermeta($user->ID, 'shibboleth_account')) {480 if (shibboleth_get_option('shibboleth_password_change_url')) {481 ?>482 <table class="form-table">483 <tr>484 <th>Change Password</th>485 <td><a href="<?php echo shibboleth_get_option('shibboleth_password_change_url');486 ?>" target="_blank"><?php _e('Change your password', 'shibboleth'); ?></a></td>487 </tr>488 </table>489 <?php490 }491 }492 }493 494 495 /**496 * Ensure profile data isn't updated by the user. This only applies to497 * accounts that were provisioned through Shibboleth, and only if the option498 * to manage user attributes exclusively from Shibboleth is enabled.499 */500 function shibboleth_personal_options_update() {501 $user = wp_get_current_user();502 503 if (get_usermeta($user->ID, 'shibboleth_account') && shibboleth_get_option('shibboleth_update_users')) {504 add_filter('pre_user_first_name',505 create_function('$n', 'return $GLOBALS["current_user"]->first_name;'));506 507 add_filter('pre_user_last_name',508 create_function('$n', 'return $GLOBALS["current_user"]->last_name;'));509 510 add_filter('pre_user_nickname',511 create_function('$n', 'return $GLOBALS["current_user"]->nickname;'));512 513 add_filter('pre_user_display_name',514 create_function('$n', 'return $GLOBALS["current_user"]->display_name;'));515 516 add_filter('pre_user_email',517 create_function('$e', 'return $GLOBALS["current_user"]->user_email;'));518 }519 }520 521 522 /**523 * Setup admin menus for Shibboleth options.524 *525 * @action: admin_menu526 **/527 function shibboleth_admin_panels() {528 // global options page529 if (isset($GLOBALS['wpmu_version'])) {530 $hookname = add_submenu_page('wpmu-admin.php', __('Shibboleth Options', 'shibboleth'), 'Shibboleth', 8, 'shibboleth-options', 'shibboleth_options_page' );531 } else {532 $hookname = add_options_page(__('Shibboleth options', 'shibboleth'), 'Shibboleth', 8, 'shibboleth-options', 'shibboleth_options_page' );533 }534 535 add_contextual_help($hookname, shibboleth_help_text());536 537 add_action('profile_personal_options', 'shibboleth_profile_personal_options');538 add_action('personal_options_update', 'shibboleth_personal_options_update');539 add_action('show_user_profile', 'shibboleth_show_user_profile');540 add_action('edit_user_profile', 'shibboleth_edit_user_profile');541 }542 add_action('admin_menu', 'shibboleth_admin_panels');543 544 545 function shibboleth_help_text() {546 $text = '547 <ul>548 <li><a href="https://spaces.internet2.edu/display/SHIB/" target="_blank">Shibboleth 1.3 Wiki</a></li>549 <li><a href="https://spaces.internet2.edu/display/SHIB2/" target="_blank">Shibboleth 2 Wiki</a></li>550 <li><a href="http://shibboleth.internet2.edu/lists.html" target="_blank">Shibboleth Mailing Lists</a></li>551 </ul>';552 553 return $text;554 }555 556 /**557 * WordPress options page to configure the Shibboleth plugin.558 *559 * @uses apply_filters() Calls 'shibboleth_plugin_path'560 */561 function shibboleth_options_page() {562 global $wp_roles;563 564 if (isset($_POST['submit'])) {565 check_admin_referer('shibboleth_update_options');566 567 $shib_headers = (array) shibboleth_get_option('shibboleth_headers');568 $shib_headers = array_merge($shib_headers, $_POST['headers']);569 shibboleth_update_option('shibboleth_headers', $shib_headers);570 571 $shib_roles = (array) shibboleth_get_option('shibboleth_roles');572 $shib_roles = array_merge($shib_roles, $_POST['shibboleth_roles']);573 shibboleth_update_option('shibboleth_roles', $shib_roles);574 575 shibboleth_update_option('shibboleth_login_url', $_POST['login_url']);576 shibboleth_update_option('shibboleth_logout_url', $_POST['logout_url']);577 shibboleth_update_option('shibboleth_password_change_url', $_POST['password_change_url']);578 shibboleth_update_option('shibboleth_password_reset_url', $_POST['password_reset_url']);579 shibboleth_update_option('shibboleth_default_login', (boolean) $_POST['default_login']);580 shibboleth_update_option('shibboleth_update_users', (boolean) $_POST['update_users']);581 shibboleth_update_option('shibboleth_update_roles', (boolean) $_POST['update_roles']);582 }583 584 $shib_headers = shibboleth_get_option('shibboleth_headers');585 $shib_roles = shibboleth_get_option('shibboleth_roles');586 587 $shibboleth_plugin_path = apply_filters('shibboleth_plugin_path', plugins_url('shibboleth'));588 589 screen_icon('shibboleth');590 591 ?>592 <style type="text/css">593 #icon-shibboleth { background: url("<?php echo $shibboleth_plugin_path . '/icon.png' ?>") no-repeat; height: 36px width: 36px; }594 </style>595 596 <div class="wrap">597 <form method="post">598 599 <h2><?php _e('Shibboleth Options', 'shibboleth') ?></h2>600 601 <table class="form-table">602 <tr valign="top">603 <th scope="row"><label for="login_url"><?php _e('Session Initiator URL', 'shibboleth') ?></label</th>604 <td>605 <input type="text" id="login_url" name="login_url" value="<?php echo shibboleth_get_option('shibboleth_login_url') ?>" size="50" /><br />606 <?php _e('This URL is constructed from values found in your main Shibboleth'607 . ' SP configuration file: your site hostname, the Sessions handlerURL,'608 . ' and the SessionInitiator Location.', 'shibboleth'); ?>609 <br /><?php _e('Wiki Documentation', 'shibboleth') ?>:610 <a href="https://spaces.internet2.edu/display/SHIB/SessionInitiator" target="_blank">Shibboleth 1.3</a> |611 <a href="https://spaces.internet2.edu/display/SHIB2/NativeSPSessionInitiator" target="_blank">Shibboleth 2</a>612 </td>613 </tr>614 <tr valign="top">615 <th scope="row"><label for="logout_url"><?php _e('Logout URL', 'shibboleth') ?></label</th>616 <td>617 <input type="text" id="logout_url" name="logout_url" value="<?php echo shibboleth_get_option('shibboleth_logout_url') ?>" size="50" /><br />618 <?php _e('This URL is constructed from values found in your main Shibboleth'619 . ' SP configuration file: your site hostname, the Sessions handlerURL,'620 . ' and the LogoutInitiator Location (also known as the'621 . ' SingleLogoutService Location in Shibboleth 1.3).', 'shibboleth'); ?>622 <br /><?php _e('Wiki Documentation', 'shibboleth') ?>:623 <a href="https://spaces.internet2.edu/display/SHIB/SPMainConfig" target="_blank">Shibboleth 1.3</a> |624 <a href="https://spaces.internet2.edu/display/SHIB2/NativeSPLogoutInitiator" target="_blank">Shibboleth 2</a>625 </td>626 </tr>627 <tr valign="top">628 <th scope="row"><label for="password_change_url"><?php _e('Password Change URL', 'shibboleth') ?></label</th>629 <td>630 <input type="text" id="password_change_url" name="password_change_url" value="<?php echo shibboleth_get_option('shibboleth_password_change_url') ?>" size="50" /><br />631 <?php _e('If this option is set, Shibboleth users will see a "change password" link on their profile page directing them to this URL.', 'shibboleth') ?>632 </td>633 </tr>634 <tr valign="top">635 <th scope="row"><label for="password_reset_url"><?php _e('Password Reset URL', 'shibboleth') ?></label</th>636 <td>637 <input type="text" id="password_reset_url" name="password_reset_url" value="<?php echo shibboleth_get_option('shibboleth_password_reset_url') ?>" size="50" /><br />638 <?php _e('If this option is set, Shibboleth users who try to reset their forgotten password using WordPress will be redirected to this URL.', 'shibboleth') ?>639 </td>640 </tr>641 <tr>642 <th scope="row"><label for="default_login"><?php _e('Shibboleth is default login', 'shibboleth') ?></label></th>643 <td>644 <input type="checkbox" id="default_login" name="default_login" <?php echo shibboleth_get_option('shibboleth_default_login') ? ' checked="checked"' : '' ?> />645 <label for="default_login"><?php _e('Use Shibboleth as the default login method for users.', 'shibboleth'); ?></label>646 647 <p><?php _e('If set, this will cause all standard WordPress login links to initiate Shibboleth'648 . ' login instead of local WordPress authentication. Shibboleth login can always be'649 . ' initiated from the WordPress login form by clicking the "Login with Shibboleth" link.', 'shibboleth'); ?></p>650 </td>651 </tr>652 </table>653 654 <br class="clear" />655 656 <h3><?php _e('User Profile Data', 'shibboleth') ?></h3>657 658 <p><?php _e('Define the Shibboleth headers which should be mapped to each user profile attribute. These'659 . ' header names are configured in <code>attribute-map.xml</code> (for Shibboleth 2.x) or'660 . ' <code>AAP.xml</code> (for Shibboleth 1.x).', 'shibboleth') ?></p>661 662 <p>663 <?php _e('Wiki Documentation', 'shibboleth') ?>:664 <a href="https://spaces.internet2.edu/display/SHIB/AttributeAcceptancePolicy" target="_blank">Shibboleth 1.3</a> |665 <a href="https://spaces.internet2.edu/display/SHIB2/NativeSPAddAttribute" target="_blank">Shibboleth 2</a>666 </p>667 668 <table class="form-table optiontable editform" cellspacing="2" cellpadding="5" width="100%">669 <tr valign="top">670 <th scope="row"><label for="username"><?php _e('Username') ?></label</th>671 <td><input type="text" id="username" name="headers[username]" value="<?php echo $shib_headers['username'] ?>" /></td>672 </tr>673 <tr valign="top">674 <th scope="row"><label for="first_name"><?php _e('First name') ?></label</th>675 <td><input type="text" id="first_name" name="headers[first_name]" value="<?php echo $shib_headers['first_name'] ?>" /></td>676 </tr>677 <tr valign="top">678 <th scope="row"><label for="last_name"><?php _e('Last name') ?></label</th>679 <td><input type="text" id="last_name" name="headers[last_name]" value="<?php echo $shib_headers['last_name'] ?>" /></td>680 </tr>681 <tr valign="top">682 <th scope="row"><label for="nickname"><?php _e('Nickname') ?></label</th>683 <td><input type="text" id="nickname" name="headers[nickname]" value="<?php echo $shib_headers['nickname'] ?>" /></td>684 </tr>685 <tr valign="top">686 <th scope="row"><label for="display_name"><?php _e('Display name') ?></label</th>687 <td><input type="text" id="display_name" name="headers[display_name]" value="<?php echo $shib_headers['display_name'] ?>" /></td>688 </tr>689 <tr valign="top">690 <th scope="row"><label for="email"><?php _e('Email Address') ?></label</th>691 <td><input type="text" id="email" name="headers[email]" value="<?php echo $shib_headers['email'] ?>" /></td>692 </tr>693 <tr valign="top">694 <th scope="row"><label for="update_users"><?php _e('Update User Data', 'shibboleth') ?></label</th>695 <td>696 <input type="checkbox" id="update_users" name="update_users" <?php echo shibboleth_get_option('shibboleth_update_users') ? ' checked="checked"' : '' ?> />697 <label for="update_users"><?php _e('Use Shibboleth data to update user profile data each time the user logs in.', 'shibboleth'); ?></label>698 699 <p><?php _e('This will prevent users from being able to manually update these'700 . ' fields. Note that Shibboleth data is always used to populate the user'701 . ' profile during account creation.', 'shibboleth'); ?></p>702 703 </td>704 </tr>705 </table>706 707 <br class="clear" />708 709 <h3><?php _e('User Role Mappings', 'shibboleth') ?></h3>710 711 <p><?php _e('Users can be placed into one of WordPress\'s internal roles based on any'712 . ' attribute. For example, you could define a special eduPersonEntitlement value'713 . ' that designates the user as a WordPress Administrator. Or you could automatically'714 . ' place all users with an eduPersonAffiliation of "faculty" in the Author role.', 'shibboleth'); ?></p>715 716 <p><?php _e('<strong>Current Limitations:</strong> While WordPress supports users having'717 . ' multiple roles, the Shibboleth plugin will only place the user in the highest ranking'718 . ' role. Only a single header/value pair is supported for each user role. This may be'719 . ' expanded in the future to support multiple header/value pairs or regular expression'720 . ' values. In the meantime, you can use the <em>shibboleth_roles</em> and'721 . ' <em>shibboleth_user_role</em> WordPress filters to provide your own logic for assigning'722 . ' user roles.', 'shibboleth'); ?></p>723 724 <style type="text/css">725 #role_mappings { padding: 0; }726 #role_mappings thead th { padding: 5px 10px; }727 #role_mappings td, #role_mappings th { border-bottom: 0px; }728 </style>729 730 <table class="form-table optiontable editform" cellspacing="2" cellpadding="5" width="100%">731 732 <tr>733 <th scope="row"><?php _e('Role Mappings', 'shibboleth') ?></th>734 <td id="role_mappings">735 <table id="">736 <col width="10%"></col>737 <col></col>738 <col></col>739 <thead>740 <tr>741 <th></th>742 <th scope="column"><?php _e('Header Name', 'shibboleth') ?></th>743 <th scope="column"><?php _e('Header Value', 'shibboleth') ?></th>744 </tr>745 </thead>746 <tbody>747 <?php748 749 foreach ($wp_roles->role_names as $key => $name) {750 echo'751 <tr valign="top">752 <th scope="row">' . _c($name) . '</th>753 <td><input type="text" id="role_'.$key.'_header" name="shibboleth_roles['.$key.'][header]" value="' . @$shib_roles[$key]['header'] . '" style="width: 100%" /></td>754 <td><input type="text" id="role_'.$key.'_value" name="shibboleth_roles['.$key.'][value]" value="' . @$shib_roles[$key]['value'] . '" style="width: 100%" /></td>755 </tr>';756 }757 ?>758 759 </tbody>760 </table>761 </td>762 </tr>763 764 <tr>765 <th scope="row"><?php _e('Default Role', 'shibboleth') ?></th>766 <td>767 <select id="default_role" name="shibboleth_roles[default]">768 <option value=""><?php _e('(none)') ?></option>769 <?php770 foreach ($wp_roles->role_names as $key => $name) {771 echo '772 <option value="' . $key . '"' . ($shib_roles['default'] == $key ? ' selected="selected"' : '') . '>' . _c($name) . '</option>';773 }774 ?>775 </select>776 777 <p><?php _e('If a user does not map into any of the roles above, they will'778 . ' be placed into the default role. If there is no default role, the'779 . ' user will not be able to login with Shibboleth.', 'shibboleth'); ?></p>780 </td>781 </tr>782 783 <tr>784 <th scope="row"><label for="update_roles"><?php _e('Update User Roles', 'shibboleth') ?></label></th>785 <td>786 <input type="checkbox" id="update_roles" name="update_roles" <?php echo shibboleth_get_option('shibboleth_update_roles') ? ' checked="checked"' : '' ?> />787 <label for="update_roles"><?php _e('Use Shibboleth data to update user role mappings each time the user logs in.', 'shibboleth') ?></label>788 789 <p><?php _e('Be aware that if you use this option, you should <strong>not</strong> update user roles manually,'790 . ' since they will be overwritten from Shibboleth the next time the user logs in. Note that Shibboleth data'791 . ' is always used to populate the initial user role during account creation.', 'shibboleth') ?></p>792 793 </td>794 </tr>795 </table>796 797 798 <?php wp_nonce_field('shibboleth_update_options') ?>799 <p class="submit"><input type="submit" name="submit" value="<?php _e('Update Options') ?>" /></p>800 </form>801 </div>802 803 <?php804 421 } 805 422
Note: See TracChangeset
for help on using the changeset viewer.