From ad9f023c64b6df6cae232b6cfeb87a85931ca838 Mon Sep 17 00:00:00 2001 From: exe-cutor Date: Wed, 18 Mar 2009 13:28:57 +0000 Subject: [PATCH] MDL-18597 Merging from STABLE --- auth/shibboleth/README.txt | 28 +++- auth/shibboleth/auth.php | 14 +- auth/shibboleth/config.html | 40 +++-- auth/shibboleth/login.php | 6 +- auth/shibboleth/logout.php | 294 ++++++++++++++++++------------------ 5 files changed, 218 insertions(+), 164 deletions(-) diff --git a/auth/shibboleth/README.txt b/auth/shibboleth/README.txt index 1a71fb6412..850b59d26e 100644 --- a/auth/shibboleth/README.txt +++ b/auth/shibboleth/README.txt @@ -2,8 +2,8 @@ Shibboleth Authentication for Moodle ------------------------------------------------------------------------------- Requirements: -- Shibboleth target 1.1 or later. See documentation for your Shibboleth - federation on how to set up Shibboleth. +- Shibboleth Service Provider 1.3 or newer. Recommended is 2.1 or newer. + See documentation for your Shibboleth federation on how to set up Shibboleth. Changes: - 11. 2004: Created by Markus Hagman @@ -23,6 +23,8 @@ Changes: - 12. 2008: Shibboleth 2.x and Single Logout support added - 1. 2008: Added logout hook and moved Shibboleth config strings to utf8 auth language files. +- 3. 2009: Added various improvements and bug fixes reported by Ina Müller from + university Tuebingen and Peter Ellis of University of Washington Moodle Configuration with Dual login ------------------------------------------------------------------------------- @@ -42,7 +44,20 @@ Moodle Configuration with Dual login with something that fits your needs, e.g. 'require affiliation student'. For IIS you have protect the auth/shibboleth directory directly in the - RequestMap of the Shibboleth configuration file (shibboleth.xml). See + RequestMap of the Shibboleth configuration file (shibboleth.xml or + shibboleth2.xml). + +-- + + + + ... + + + +-- + + Also see: https://spaces.internet2.edu/display/SHIB2/NativeSPRequestMapper and https://spaces.internet2.edu/display/SHIB2/NativeSPAccessControl @@ -274,10 +289,13 @@ Shibboleth installation). If everything worked well, you should see a Shibboleth page saying that you were successfully logged out and if you go back to Moodle you also should be logged out from Moodle. +Requirements: +- PHP needs the Soap Extension, which maybe must installed manually: + More information is available here http://ch.php.net/soap +- Logout only works with Shibboleth Service Provider 2.1 or higher Limitations: -Single Logout is only supported with SAML2 and so far only with the Shibboleth -Service Provider 2.x. +Single Logout is only supported when SAML2 is used at the SP and the IdP. As of December 2008, the Shibboleth Identity Provider 2.1.1 does not yet support Single Logout (SLO). Therefore, the single logout feature cannot be used yet. One of the reasons why SLO isn't supported yet is because there aren't many diff --git a/auth/shibboleth/auth.php b/auth/shibboleth/auth.php index 764435849f..9fcfdbf780 100644 --- a/auth/shibboleth/auth.php +++ b/auth/shibboleth/auth.php @@ -196,8 +196,17 @@ class auth_plugin_shibboleth extends auth_plugin_base { isset($this->config->logout_handler) && !empty($this->config->logout_handler) ){ - // Backup old redirect url - $temp_redirect = $redirect; + // Check if there is an alternative logout return url defined + if ( + isset($this->config->logout_return_url) + && !empty($this->config->logout_return_url) + ){ + // Set temp_redirect to alternative return url + $temp_redirect = $this->config->logout_return_url; + } else { + // Backup old redirect url + $temp_redirect = $redirect; + } // Overwrite redirect in order to send user to Shibboleth logout page and let him return back $redirect = $this->config->logout_handler.'?return='.urlencode($temp_redirect); @@ -266,6 +275,7 @@ class auth_plugin_shibboleth extends auth_plugin_base { set_config('organization_selection', $config->organization_selection, 'auth/shibboleth'); } set_config('logout_handler', $config->logout_handler, 'auth/shibboleth'); + set_config('logout_return_url', $config->logout_return_url, 'auth/shibboleth'); set_config('login_name', $config->login_name, 'auth/shibboleth'); set_config('convert_data', $config->convert_data, 'auth/shibboleth'); set_config('auth_instructions', $config->auth_instructions, 'auth/shibboleth'); diff --git a/auth/shibboleth/config.html b/auth/shibboleth/config.html index 1322c0487b..5bad214533 100755 --- a/auth/shibboleth/config.html +++ b/auth/shibboleth/config.html @@ -45,7 +45,7 @@ - Moodle WAYF Service: + : alt_login) and $config->alt_login == 'on' ){ @@ -53,17 +53,17 @@ } ?> /> - If you check this, Moodle will use its own WAYF service instead of the one configured for Shibboleth. Moodle will display a drop-down list on this alternative login page where the user has to select his Identity Provider. + - Identity Providers: + :