Authentication

Hello,

I am VERY interested in making moodle multi-authentication capable...even if I have to code the mods myself.  I have a mission I must complete in the next 6 months that involves my being able to authenticate folks using EITHER manual, LDAP1, LDAP2, LDAP3, or other means such as NTLM or smart card auto aware. Smart Card would be once you select it, it would search you browser for PKI certs from an inserted smart card and simply ask you for your pin from your inserted smart card to authenticate you.  A 'wee' bit simplistic since this smart card would need to be authenticated via a central CA...!  This is extremely important because of the sheer number of various authentication mechanisms I will need to use.  A common database and website is mission essential.   Appreciate your feedback and/or assistance as to means of attacking this problem...

-Michael

The way I'm currently doing this (it's the only coded part of the whole multi-instance thing) is:

$auth_instance is an object with all of the instance properties: type, name, back-end settings, capabilities (can be disabled, is internal, can have multiple instances, etc.). Then I have a function called get_auth_instance_settings() that you pass an instance object (that you get from the database) and you are returned the full blown object.

This is the code (just to show the idea, not to suggest any actual implementation, see http://docs.moodle.org/en/Multi_Authentication to have a look at the database tables and their meanings):

/**
 * Get the configuration settings for a given auth instance, including
 * auth type properties.
 *
 * @param $authinstance object holding all the authinstance details.
 * @return false on error, true otherwise.
 *
 */
function get_auth_instance_settings(&$authinstance) {
    global $CFG;

    if ((!is_object($authinstance)) or empty($authinstance->id)) {
        return false;
    }

    // First, get all the instance settings.
    if ($settings = get_records('auth_instance_settings', 'instanceid',
                                $authinstance->id, '', 'name,value')) {
        foreach ($settings as $setting) {
            $authinstance->settings[$setting->name] = $setting->value;
        }
    } else {
        return false;
    }

    // Next, get instance type properties (isinternal, multiple, etc.).
    if ($typeprops = get_record_sql ('SELECT at.* FROM ' . $CFG->prefix .
                                     'auth_type at, '. $CFG->prefix .
                                     'auth_instance ai WHERE ' .
                                     'at.id = ai.typeid ' .
                                     'AND ai.id = '.$instanceid)) {

        $authinstance->type = $typeprops;
        return true;
    } else {
        return false;
    }
}

/**
 * Get an array with all the authentication instance objects
 * completely defined.
 *
 * @param none
 * @return array of authentication instance objects or false on error.
 * 
 */
function get_auth_instances() {
    global $CFG;

    if (!($intances = get_records ('auth_instance', '','','sortorder'))) {
        return false;
    }

    foreach ($instances as $instance) {
        if (!get_auth_instance_settings ($instance)) {
            return false;
        }
    }

    return $instances;
}

Then you can say $auth_intance->enabled, or $auth_instance->settings['ldap_host_url], or $auth_instance->type->candisable or whatever you stored in your database config (for the auth instance itself or the auth type it belongs to).

Saludos. Iñaki.

In fact, unless auth is somehow linked to a unique authentication source (LDAP domain, AD domain, site, campus, host, whatever), having unique (auth,username) won't be enough.

That's why I proposed the separation between the authentication types (db, ldap, etc.) and the authentication instances (this db, that other db, this other ldap server, etc.) in the 'multi-instance' multi-auth "specification" (http://docs.moodle.org/en/Development:Multi_authentication).

This way an auth instance completely specifies the 'namespace' where a given username is valid, thus making collisions only possible inside that namespace (where you can easily fix them).

Of course this creates its own set of problems, like having to specify not only your username but your 'namespace' too when you log in, and having a default 'namespace' for self-created accounts, etc.

Saludos. Iñaki.