Moodle 1.8 Multiauth

AUTHENTICATION PLUGINS

Changes to the API

Each authentication plugin is now contained in a subfolder as a class definition in the auth.php file. For instance, the LDAP authentication plugin is the class called auth_plugin_ldap defined in:

/auth/ldap/auth.php

To instantiate the class, there is a function in lib/moodlelib called get_auth_plugin() that does the work for you:

$ldapauth = get_auth_plugin('ldap');

Auth plugin classes are pretty basic. They contain the same functions that were previously in each plugin's lib.php file, but refactored to become class methods, and tweaked to reference the plugin's instantiated config to get at the settings, rather than the global $CFG variable.

Configuration

All auth plugins must have a config property that contains the name value pairs from the config_plugins table. This is populated using the get_config() function in the constructor. The settings keys have also had the "auth_" prefix, as well as the auth plugin name, trimmed. For instance, what used to be

echo $CFG->auth_ldapversion;

is now accessed as

echo $ldapauth->config->version;

Authentication settings have been moved to the config_plugins database table, with the plugin field set to "auth/foo" (for instance, "auth/ldap").

Method Names

When the functions from lib.php were ported to methods in auth.php, the "auth_" prefix was dropped. For instance, calls to

auth_user_login($user, $pass);

now become

$ldapauth->user_login($user, $pass);

Code Use

Code calling auth plugins will use method_exists() to determine plugin functionality, much in the same way that function_exists() was used until now. In addition, auth plugins provide some methods by default that can be called:

is_internal() Returns true if this authentication plugin is "internal" (stores the users' passwords and other details in the local Moodle database).

can_change_password() Returns true if the plugin can change the users' passwords.

change_password_url() Returns the URL for changing the users' passwords, or false if the default URL can be used.

Methods

auth_plugin_foo()

Constructor. At the least, it populates config member variable with settings from the Moodle database. There may be other startup code here.

user_login($username, $password)

Attempts to log the user in, returns boolean success.

get_userinfo($username)
get_userinfo_asobj($username)

Return a user array or object containing all available fields from the external source.

get_userlist()

Returns a list of all usernames from the external source.

user_exists($username)

Returns true if the username exists in the external source.

user_create($userobject, $plainpass)

Attempts to create a new user on the external source. Returns boolean success.

get_users($filter = '*', $dontlistcreated = false)

Returns an array of user objects, given a username filter criterion and whether to include newly created users.

password_expire($username)

Returns number of days before the password will expire. If already expired it returns a negative value, or zero if it never expires.

sync_users ($bulk_insert_records = 1000, $do_updates = 1)

Syncronises users from the external source to the Moodle user table. Sync should be done using the idnumber attribute, not the username. You need to pass the firstsync parameter to fill in idnumbers if they do not exist in the Moodle user table. Users that don't exist anymore in the external source are removed (disabled). Creates new users and updates course-creator status of users.

update_user_record($username, $updatekeys = false)

Update a local user record from the external source. This is a lighter version of the one in moodlelib - it won't do expensive ops such as enrolment.

user_activate($username)

Activates (enables) user in the external source so the user can login to external source.

user_disable($username)

Disables user in the external source so the user cannot login.

user_update($olduser, $newuser)

Modifies user record in the external source. It takes olduser (before changes) and newuser (after changes), compares and saves modified information to the external source.

user_update_password($user, $newpassword)

Changes the user's password in the external source.

is_internal()

Returns true if this authentication plugin is 'internal' (stores the users' passwords and other details in the local Moodle database).

can_change_password()

Returns true if the plugin can change the users' passwords.

change_password_url()

Returns the URL for changing the users' passwords, or false if the default URL can be used.

config_form($config, $err)

This function is called from admin/auth.php, and outputs a full page with a form for configuring this plugin.

process_config($config)

Processes and stores configuration data for this authentication plugin.

Error Codes

AUTH_OK 0 // success

AUTH_FAIL 1 // authentication failed (non-specific)

AUTH_DENIED 2 // access denied

AUTH_ERROR 4 // error

OR-mask these together???