Docs For Class Auth

Auth

Description

The Auth:: class provides a common abstracted interface into the various backends for the Horde authentication system.

$Horde: framework/Auth/Auth.php,v 1.142.10.37 2009/10/26 11:58:58 jan Exp $

See the enclosed file COPYING for license information (LGPL). If you did not receive this file, see http://opensource.org/licenses/lgpl-license.php.

author: Chuck Hagenbuch <chuck@horde.org>
since: Horde 1.3

Located in /Auth/Auth.php (line 80)

Direct descendents

Class	Description
Auth_application	The Auth_application class provides a wrapper around application-provided Horde authentication which fits inside the Horde Auth:: API.
Auth_auto	The Auth_auto class transparently logs users in to Horde using ONE username, either defined in the config or defaulting to 'horde_user'. This is only for use in testing or behind a firewall; it should NOT be used on a public, production machine.
Auth_composite	The Auth_composite class provides a wrapper around application-provided Horde authentication which fits inside the Horde Auth:: API.
Auth_cyrus	The Auth_cyrus class provides horde with the ability of administrating a Cyrus mail server authentications against another backend that Horde can update (eg SQL or LDAP).
Auth_ftp	The Auth_ftp class provides an FTP implementation of the Horde authentication system.
Auth_http	The Auth_http class transparently logs users in to Horde using already present HTTP authentication headers.
Auth_http_remote	The Auth_http_remote class authenticates users against a remote HTTP-Auth endpoint.
Auth_imap	The Auth_imap:: class provides an IMAP implementation of the Horde authentication system.
Auth_imsp	The Auth_imsp class provides basic authentication against an IMSP server.
Auth_ipbasic	The Auth_ipbasic class provides access control based on CIDR masks (client IP addresses). It is not meant for user-based systems, but for times when you want a block of IPs to be able to access a site, and that access is simply on/off - no preferences, etc...
Auth_kolab	The Kolab implementation of the Horde authentication system. Derives from the Auth_imap IMAP authentication object, and provides parameters to it based on the global Kolab configuration.
Auth_krb5	The Auth_krb5 class provides an kerberos implementation of the Horde authentication system.
Auth_ldap	The Auth_ldap class provides an LDAP implementation of the Horde authentication system.
Auth_login	The Auth_login:: class provides a system login implementation of the Horde authentication system.
Auth_pam	The Auth_pam:: class provides a PAM-based implementation of the Horde authentication system.
Auth_passwd	The Auth_passwd:: class provides a passwd-file implementation of the Horde authentication system.
Auth_peclsasl	The Auth_peclsasl:: class provides a SASL-based implementation of the Horde authentication system.
Auth_radius	The Auth_radius class provides a RADIUS implementation of the Horde authentication system.
Auth_shibboleth	The Auth_shibboleth class only provides transparent authentication based on the headers set by a Shibboleth SP. Note that this class does not provide any actual SP functionality, it just takes the username from the HTTP headers that should be set by the Shibboleth SP.
Auth_smb	The Auth_smb class provides an SMB implementation of the Horde authentication system.
Auth_smbclient	The Auth_smbclient class provides an smbclient implementation of the Horde authentication system.
Auth_sql	The Auth_sql class provides a SQL implementation of the Horde authentication system.

Variable Summary

array $capabilities

array $_authCredentials

array $_params

Method Summary

string addHook (string $userId)

string addLogoutParameters (string $url, [string $reason = null], [string $msg = null])

mixed addUser (string $userId, array $credentials)

boolean authenticate (string $userId, array $credentials, [boolean $login = true], [string $realm = null])

void clearAuth ([string $realm = null])

boolean exists (string $userId)

Auth factory (mixed $driver, [array $params = null])

string genRandomPassword ()

mixed getAuth ()

mixed getAuthDomain ()

mixed getBareAuth ()

mixed getCredential (string $credential)

string getCryptedPassword (string $plaintext, [string $salt = ''], [string $encryption = 'md5-hex'], [boolean $show_encrypt = false])

string getDriver ()

string getLoginScreen ([string $app = 'horde'], [string $url = ''])

string getLogoutReason ()

string getLogoutReasonString ()

string getParam (string $param)

string getProvider ([string $driver = null], [array $params = null])

string getSalt ([string $encryption = 'md5-hex'], [string $seed = ''], [string $plaintext = ''])

boolean hasCapability (string $capability)

boolean isAdmin ([string $permission = null], [integer $permlevel = null], [string $user = null])

boolean isAuthenticated ([string $realm = null])

boolean isPasswordChangeRequested ()

mixed listUsers ()

array readSessionData (string $session_data, boolean $info)

string removeHook (string $userId)

mixed removeUser (string $userId)

mixed removeUserData (string $userId)

void setAuth (string $userId, array $credentials, [string $realm = null], [boolean $changeRequested = false])

void setCredential (string $credential, string $value)

Auth &singleton (string $driver, [array $params = null])

boolean transparent ()

mixed updateUser (string $oldID, string $newID, array $credentials)

boolean _authenticate ()

boolean _isAdmin ([ $permission = null], [ $permlevel = null], [ $user = null])

Variables

array $capabilities = array('add' => false,
'update' => false,
'resetpassword' => false,
'remove' => false,
'list' => false,
'groups' => false,
'admins' => false,
'transparent' => false) (line 88)

An array of capabilities, so that the driver can report which operations it supports and which it doesn't.

Redefined in descendants as:

Auth_application::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_auto::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_cyrus::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_http::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_http_remote::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_imsp::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_ipbasic::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_kolab::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_krb5::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_ldap::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_login::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_pam::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_passwd::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_peclsasl::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_radius::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_shibboleth::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_smb::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_smbclient::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_sql::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.
Auth_customsql::$capabilities : An array of capabilities, so that the driver can report which operations it supports and which it doesn't.

array $_authCredentials = array() (line 111)

The credentials currently being authenticated.

access: protected

array $_params = array() (line 102)

Hash containing parameters.

Methods

addHook (line 865)

Applies a hook defined by the function _username_hook_frombackend() to the given user name if this function exists and user hooks are enabled.

This method should be called if a authentication backend's user name needs to be converted to a (unique) Horde user name. The backend's user name is what the user sees and uses, but internally we use the Horde user name.

return: The internal Horde user name.

string addHook (string $userId)

string $userId: The authentication backend's user name.

addLogoutParameters (line 1057)

Generates the correct parameters to pass to the given logout URL.

If no reason/msg is passed in, use the current global authentication error message.

return: The formatted URL

string addLogoutParameters (string $url, [string $reason = null], [string $msg = null])

string $url: The URL to redirect to.
string $reason: The reason for logout.
string $msg: If reason is AUTH_REASON_MESSAGE, the message to display to the user.

addUser (line 394)

Adds a set of authentication credentials.

return: True on success or a PEAR_Error object on failure.
abstract:

mixed addUser (string $userId, array $credentials)

string $userId: The userId to add.
array $credentials: The credentials to use.

Redefined in descendants as:

Auth_application::addUser() : Add a set of authentication credentials.
Auth_composite::addUser() : Add a set of authentication credentials.
Auth_cyrus::addUser() : Add a set of authentication credentials.
Auth_imap::addUser() : Add a set of authentication credentials.
Auth_kolab::addUser() : Add a set of authentication credentials.
Auth_ldap::addUser() : Add a set of authentication credentials.
Auth_msad::addUser() : Add a set of authentication credentials.
Auth_passwd::addUser() : Add a set of authentication credentials.
Auth_sql::addUser() : Add a set of authentication credentials.
Auth_customsql::addUser() : Add a set of authentication credentials.
Auth_cyrsql::addUser() : Add a set of authentication credentials.

authenticate (line 136)

Finds out if a set of login credentials are valid, and if requested, mark the user as logged in in the current session.

return: Whether or not the credentials are valid.

boolean authenticate (string $userId, array $credentials, [boolean $login = true], [string $realm = null])

string $userId: The userId to check.
array $credentials: The credentials to check.
boolean $login: Whether to log the user in. If false, we'll only test the credentials and won't modify the current session. Defaults to true.
string $realm: The authentication realm to check.

clearAuth (line 794)

Clears any authentication tokens in the current session.

void clearAuth ([string $realm = null])

string $realm: The authentication realm to clear.

exists (line 480)

Checks if $userId exists in the system.

return: Whether or not $userId already exists.
abstract:

boolean exists (string $userId)

string $userId: User ID for which to check

Redefined in descendants as:

Auth_application::exists() : Checks if $userId exists in the system.
Auth_composite::exists() : Checks if a userId exists in the system.
Auth_cyrus::exists() : Checks if a userId exists in the system.
Auth_sql::exists() : Checks if a userId exists in the system.
Auth_customsql::exists() : Checks if a userId exists in the system.

factory (line 1300)

Attempts to return a concrete Auth instance based on $driver.

return: The newly created concrete Auth instance, or false on an error.

Auth factory (mixed $driver, [array $params = null])

mixed $driver: The type of concrete Auth subclass to return. This is based on the storage driver ($driver). The code is dynamically included. If $driver is an array, then we will look in $driver[0]/lib/Auth/ for the subclass implementation named $driver[1].php.
array $params: A hash containing any additional configuration or connection parameters a subclass might need.

genRandomPassword (line 365)

Generates a random, hopefully pronounceable, password. This can be used when resetting automatically a user's password.

return: A random password

string genRandomPassword ()

getAuth (line 543)

Returns the currently logged in user, if there is one.

return: The userId of the current user, or false if no user is logged in.

mixed getAuth ()

getAuthDomain (line 599)

Returns the domain of currently logged-in user (e.g., bob@example.com would be returned as 'example.com').

return: The domain suffix of the current user, or false.
since: Horde 3.0.6

mixed getAuthDomain ()

getBareAuth (line 578)

Returns the curently logged-in user without any domain information (e.g., bob@example.com would be returned as 'bob').

return: The user ID of the current user, or false if no user is logged in.

mixed getBareAuth ()

getCredential (line 620)

Returns the requested credential for the currently logged in user, if present.

return: The requested credential, or false if no user is logged in.

mixed getCredential (string $credential)

string $credential: The credential to retrieve.

getCryptedPassword (line 200)

Formats a password using the current encryption.

return: The encrypted password.

string getCryptedPassword (string $plaintext, [string $salt = ''], [string $encryption = 'md5-hex'], [boolean $show_encrypt = false])

string $plaintext: The plaintext password to encrypt.
string $salt: The salt to use to encrypt the password. If not present, a new salt will be generated.
string $encryption: The kind of pasword encryption to use. Defaults to md5-hex.
boolean $show_encrypt: Some password systems prepend the kind of encryption to the crypted password ({SHA}, etc). Defaults to false.

getDriver (line 118)

Returns the name of the concrete Auth implementation.

return: The Auth implementation name.

string getDriver ()

getLoginScreen (line 924)

Returns the URI of the login screen for the current authentication method.

return: The login screen URI.

string getLoginScreen ([string $app = 'horde'], [string $url = ''])

string $app: The application to use.
string $url: The URL to redirect to after login.

getLogoutReason (line 984)

Returns the logout reason.

return: One of the logout reasons (see the AUTH_LOGOUT_* constants for the valid reasons). Returns null if there is no logout reason present.

string getLogoutReason ()

getLogoutReasonString (line 998)

Returns the status string to use for logout messages.

return: The logout reason string.

string getLogoutReasonString ()

getParam (line 937)

Returns the named parameter for the current auth driver.

return: The parameter's value.

string getParam (string $param)

string $param: The parameter to fetch.

Redefined in descendants as:

Auth_composite::getParam() : Return the named parameter for the current auth driver.

getProvider (line 953)

Returns the name of the authentication provider.

return: The name of the driver currently providing authentication.

string getProvider ([string $driver = null], [array $params = null])

string $driver: Used by recursive calls when untangling composite auth.
array $params: Used by recursive calls when untangling composite auth.

getSalt (line 299)

Returns a salt for the appropriate kind of password encryption.

Optionally takes a seed and a plaintext password, to extract the seed of an existing password, or for encryption types that use the plaintext in the generation of the salt.

return: The generated or extracted salt.

string getSalt ([string $encryption = 'md5-hex'], [string $seed = ''], [string $plaintext = ''])

string $encryption: The kind of pasword encryption to use. Defaults to md5-hex.
string $seed: The seed to get the salt from (probably a previously generated password). Defaults to generating a new seed.
string $plaintext: The plaintext password that we're generating a salt for. Defaults to none.

hasCapability (line 910)

Queries the current Auth object to find out if it supports the given capability.

return: Whether or not the capability is supported.

boolean hasCapability (string $capability)

string $capability: The capability to test for.

Redefined in descendants as:

Auth_application::hasCapability() : Queries the current Auth object to find out if it supports the given capability.
Auth_composite::hasCapability() : Query the current Auth object to find out if it supports the given capability.

isAdmin (line 822)

Is the current user an administrator?

return: Whether or not this is an admin user.

boolean isAdmin ([string $permission = null], [integer $permlevel = null], [string $user = null])

string $permission: Allow users with this permission admin access in the current context.
integer $permlevel: The level of permissions to check for (PERMS_EDIT, PERMS_DELETE, etc). Defaults to PERMS_EDIT.
string $user: The user to check. Defaults to Auth::getAuth().

isAuthenticated (line 510)

Checks if there is a session with valid auth information. for the specified user. If there isn't, but the configured Auth driver supports transparent authentication, then we try that.

return: Whether or not the user is authenticated.

boolean isAuthenticated ([string $realm = null])

string $realm: The authentication realm to check.

isPasswordChangeRequested (line 560)

Return whether the authentication backend requested a password change.

return: Whether the backend requested a password change.

boolean isPasswordChangeRequested ()

listUsers (line 466)

Lists all users in the system.

return: The array of userIds, or a PEAR_Error object on failure.
abstract:

mixed listUsers ()

Redefined in descendants as:

Auth_application::listUsers() : List all users in the system.
Auth_composite::listUsers() : List all users in the system.
Auth_cyrus::listUsers() : List all users in the system.
Auth_http::listUsers() : List all users in the system.
Auth_imap::listUsers() : List all users in the system.
Auth_kolab::listUsers() : List Users
Auth_ldap::listUsers() : List Users
Auth_passwd::listUsers() : List all users in the system.
Auth_sql::listUsers() : List all users in the system.
Auth_customsql::listUsers() : List all users in the system.
Auth_cyrsql::listUsers() : List all users in the system.

readSessionData (line 1097)

Reads session data to determine if it contains Horde authentication credentials.

return: An array of the user's sesion information if authenticated or false. The following information is returned: userid, realm, timestamp, remote_addr, browser.
since: Horde 3.2

array readSessionData (string $session_data, boolean $info)

string $session_data: The session data.
boolean $info: Return session information. The following information is returned: userid, realm, timestamp, remote_addr, browser.

removeHook (line 890)

Applies a hook defined by the function _username_hook_tobackend() to the given user name if this function exists and user hooks are enabled.

This method should be called if a Horde user name needs to be converted to an authentication backend's user name or displayed to the user. The backend's user name is what the user sees and uses, but internally we use the Horde user name.

return: The authentication backend's user name.

string removeHook (string $userId)

string $userId: The internal Horde user name.

removeUser (line 424)

Deletes a set of authentication credentials.

return: True on success or a PEAR_Error object on failure.
abstract:

mixed removeUser (string $userId)

string $userId: The userId to delete.

Redefined in descendants as:

Auth_application::removeUser() : Delete a set of authentication credentials.
Auth_composite::removeUser() : Delete a set of authentication credentials.
Auth_cyrus::removeUser() : Delete a set of authentication credentials.
Auth_imap::removeUser() : Delete a set of authentication credentials.
Auth_ldap::removeUser() : Remove a set of authentication credentials.
Auth_msad::removeUser() : Remove a set of authentication credentials.
Auth_passwd::removeUser() : Delete a set of authentication credentials.
Auth_sql::removeUser() : Delete a set of authentication credentials.
Auth_customsql::removeUser() : Delete a set of authentication credentials.
Auth_cyrsql::removeUser() : Delete a set of authentication credentials.

removeUserData (line 436)

Calls all applications' removeUser API methods.

return: True on success or a PEAR_Error object on failure.

mixed removeUserData (string $userId)

string $userId: The userId to delete.

setAuth (line 673)

Sets a variable in the session saying that authorization has succeeded, note which userId was authorized, and note when the login took place.

If a user name hook was defined in the configuration, it gets applied to the userId at this point.

void setAuth (string $userId, array $credentials, [string $realm = null], [boolean $changeRequested = false])

string $userId: The userId who has been authorized.
array $credentials: The credentials of the user.
string $realm: The authentication realm to use.
boolean $changeRequested: Whether to request that the user change their password.

Redefined in descendants as:

Auth_kolab::setAuth() : Sets a variable in the session saying that authorization has succeeded, note which userId was authorized, and note when the login took place.

setCredential (line 645)

Sets the requested credential for the currently logged in user.

void setCredential (string $credential, string $value)

string $credential: The credential to set.
string $value: The value to set the credential to.

singleton (line 1358)

Attempts to return a reference to a concrete Auth instance based on $driver. It will only create a new instance if no Auth instance with the same parameters currently exists.

This should be used if multiple authentication sources (and, thus, multiple Auth instances) are required.

This method must be invoked as: $var = &Auth::singleton()

return: The concrete Auth reference, or false on an error.

Auth &singleton (string $driver, [array $params = null])

string $driver: The type of concrete Auth subclass to return. This is based on the storage driver ($driver). The code is dynamically included.
array $params: A hash containing any additional configuration or connection parameters a subclass might need.

transparent (line 496)

Automatic authentication.

return: Whether or not the user is authenticated automatically.
abstract:

boolean transparent ()

Redefined in descendants as:

Auth_auto::transparent() : Automatic authentication: Set the user allowed IP block.
Auth_composite::transparent() : Automatic authentication: Find out if the client matches an allowed IP block.
Auth_cyrus::transparent() : Automatic authentication: Find out if the client matches an allowed IP block.
Auth_http::transparent() : Automatic authentication: Find out if the client has HTTP authentication info present.
Auth_ipbasic::transparent() : Automatic authentication: Find out if the client matches an allowed IP block.
Auth_shibboleth::transparent() : Automatic authentication: Check if the username is set in the configured header.

updateUser (line 410)

Updates a set of authentication credentials.

return: True on success or a PEAR_Error object on failure.
abstract:

mixed updateUser (string $oldID, string $newID, array $credentials)

string $oldID: The old userId.
string $newID: The new userId.
array $credentials: The new credentials

Redefined in descendants as:

Auth_application::updateUser() : Update a set of authentication credentials.
Auth_composite::updateUser() : Update a set of authentication credentials.
Auth_cyrus::updateUser() : Update a set of authentication credentials.
Auth_ldap::updateUser() : Update a set of authentication credentials.
Auth_msad::updateUser() : Update a set of authentication credentials.
Auth_passwd::updateUser() : Update a set of authentication credentials.
Auth_sql::updateUser() : Update a set of authentication credentials.
Auth_customsql::updateUser() : Update a set of authentication credentials.
Auth_cyrsql::updateUser() : Update a set of authentication credentials.

_authenticate (line 1160)

Authentication stub.

return: False.
abstract:
access: protected

boolean _authenticate ()

_isAdmin (line 1173)

Driver-level admin check stub.

return: False.
abstract:
access: protected

boolean _isAdmin ([ $permission = null], [ $permlevel = null], [ $user = null])

$permission
$permlevel
$user

Documentation generated on Sun, 30 Jan 2011 05:15:19 +0000 by phpDocumentor 1.4.3