See Release Notes
Long Term Support Release
<?php // This file is part of Moodle - http://moodle.org/ // // Moodle is free software: you can redistribute it and/or modify // it under the terms of the GNU General Public License as published by // the Free Software Foundation, either version 3 of the License, or // (at your option) any later version. // // Moodle is distributed in the hope that it will be useful, // but WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the // GNU General Public License for more details. // // You should have received a copy of the GNU General Public License // along with Moodle. If not, see <http://www.gnu.org/licenses/>. /** * Class for loading/storing oauth2 endpoints from the DB. * * @package core * @copyright 2017 Damyon Wiese * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later */ namespace core\oauth2; defined('MOODLE_INTERNAL') || die(); require_once($CFG->libdir . '/filelib.php');< use context_system; < use curl;use stdClass;< use moodle_exception;use moodle_url;<> use context_system; > use moodle_exception;/** * Static list of api methods for system oauth2 configuration. * * @copyright 2017 Damyon Wiese * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later */ class api { /**< * Build a google ready OAuth 2 service. < * @return \core\oauth2\issuer < */ < private static function init_google() { < $record = (object) [ < 'name' => 'Google', < 'image' => 'https://accounts.google.com/favicon.ico', < 'baseurl' => 'https://accounts.google.com/', < 'loginparamsoffline' => 'access_type=offline&prompt=consent', < 'showonloginpage' => true < ]; < < $issuer = new issuer(0, $record); < return $issuer; < } < < /** < * Create endpoints for google issuers. < * @param issuer $issuer issuer the endpoints should be created for. < * @return mixed < * @throws \coding_exception < * @throws \core\invalid_persistent_exception < */ < private static function create_endpoints_for_google($issuer) { < < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'name' => 'discovery_endpoint', < 'url' => 'https://accounts.google.com/.well-known/openid-configuration' < ]; < $endpoint = new endpoint(0, $record); < $endpoint->create(); < return $issuer; < } < < /** < * Build a facebook ready OAuth 2 service. < * @return \core\oauth2\issuer < */ < private static function init_facebook() { < // Facebook is a custom setup. < $record = (object) [ < 'name' => 'Facebook', < 'image' => 'https://facebookbrand.com/wp-content/uploads/2016/05/flogo_rgb_hex-brc-site-250.png', < 'baseurl' => '', < 'loginscopes' => 'public_profile email', < 'loginscopesoffline' => 'public_profile email', < 'showonloginpage' => true < ]; < < $issuer = new issuer(0, $record); < return $issuer; < } < < /** < * Create endpoints for facebook issuers. < * @param issuer $issuer issuer the endpoints should be created for. < * @return mixed < * @throws \coding_exception < * @throws \core\invalid_persistent_exception < */ < private static function create_endpoints_for_facebook($issuer) { < // The Facebook API version. < $apiversion = '2.12'; < // The Graph API URL. < $graphurl = 'https://graph.facebook.com/v' . $apiversion; < // User information fields that we want to fetch. < $infofields = [ < 'id', < 'first_name', < 'last_name', < 'link', < 'picture.type(large)', < 'name', < 'email', < ]; < $endpoints = [ < 'authorization_endpoint' => sprintf('https://www.facebook.com/v%s/dialog/oauth', $apiversion), < 'token_endpoint' => $graphurl . '/oauth/access_token', < 'userinfo_endpoint' => $graphurl . '/me?fields=' . implode(',', $infofields) < ]; < < foreach ($endpoints as $name => $url) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'name' => $name, < 'url' => $url < ]; < $endpoint = new endpoint(0, $record); < $endpoint->create(); < } < < // Create the field mappings. < $mapping = [ < 'name' => 'alternatename', < 'last_name' => 'lastname', < 'email' => 'email', < 'first_name' => 'firstname', < 'picture-data-url' => 'picture', < 'link' => 'url', < ]; < foreach ($mapping as $external => $internal) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'externalfield' => $external, < 'internalfield' => $internal < ]; < $userfieldmapping = new user_field_mapping(0, $record); < $userfieldmapping->create(); < } < return $issuer; < } < < /** < * Build a microsoft ready OAuth 2 service. < * @return \core\oauth2\issuer < */ < private static function init_microsoft() { < // Microsoft is a custom setup. < $record = (object) [ < 'name' => 'Microsoft', < 'image' => 'https://www.microsoft.com/favicon.ico', < 'baseurl' => '', < 'loginscopes' => 'openid profile email user.read', < 'loginscopesoffline' => 'openid profile email user.read offline_access', < 'showonloginpage' => true < ]; < < $issuer = new issuer(0, $record); < return $issuer; < } < < /** < * Create endpoints for microsoft issuers. < * @param issuer $issuer issuer the endpoints should be created for. < * @return mixed < * @throws \coding_exception < * @throws \core\invalid_persistent_exception < */ < private static function create_endpoints_for_microsoft($issuer) { < < $endpoints = [ < 'authorization_endpoint' => 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize', < 'token_endpoint' => 'https://login.microsoftonline.com/common/oauth2/v2.0/token', < 'userinfo_endpoint' => 'https://graph.microsoft.com/v1.0/me/', < 'userpicture_endpoint' => 'https://graph.microsoft.com/v1.0/me/photo/$value', < ]; < < foreach ($endpoints as $name => $url) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'name' => $name, < 'url' => $url < ]; < $endpoint = new endpoint(0, $record); < $endpoint->create(); < } < < // Create the field mappings. < $mapping = [ < 'givenName' => 'firstname', < 'surname' => 'lastname', < 'userPrincipalName' => 'email', < 'displayName' => 'alternatename', < 'officeLocation' => 'address', < 'mobilePhone' => 'phone1', < 'preferredLanguage' => 'lang' < ]; < foreach ($mapping as $external => $internal) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'externalfield' => $external, < 'internalfield' => $internal < ]; < $userfieldmapping = new user_field_mapping(0, $record); < $userfieldmapping->create(); < } < return $issuer; < } < < /** < * Build a nextcloud ready OAuth 2 service. < * @return \core\oauth2\issuer < */ < private static function init_nextcloud() { < // Nextcloud has a custom baseurl. Thus, the creation of endpoints has to be done later. < $record = (object) [ < 'name' => 'Nextcloud', < 'image' => 'https://nextcloud.com/wp-content/themes/next/assets/img/common/favicon.png?x16328', < 'basicauth' => 1, < ]; < < $issuer = new issuer(0, $record); < < return $issuer; < } < < /** < * Create endpoints for nextcloud issuers. < * @param issuer $issuer issuer the endpoints should be created for. < * @return mixed < * @throws \coding_exception < * @throws \core\invalid_persistent_exception < */ < private static function create_endpoints_for_nextcloud($issuer) { < $baseurl = $issuer->get('baseurl'); < // Add trailing slash to baseurl, if needed. < if (substr($baseurl, -1) !== '/') { < $baseurl .= '/'; < } < < $endpoints = [ < // Baseurl will be prepended later. < 'authorization_endpoint' => 'index.php/apps/oauth2/authorize', < 'token_endpoint' => 'index.php/apps/oauth2/api/v1/token', < 'userinfo_endpoint' => 'ocs/v2.php/cloud/user?format=json', < 'webdav_endpoint' => 'remote.php/webdav/', < 'ocs_endpoint' => 'ocs/v1.php/apps/files_sharing/api/v1/shares', < ]; < < foreach ($endpoints as $name => $url) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'name' => $name, < 'url' => $baseurl . $url, < ]; < $endpoint = new \core\oauth2\endpoint(0, $record); < $endpoint->create(); < } < < // Create the field mappings. < $mapping = [ < 'ocs-data-email' => 'email', < 'ocs-data-id' => 'username', < ]; < foreach ($mapping as $external => $internal) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'externalfield' => $external, < 'internalfield' => $internal < ]; < $userfieldmapping = new \core\oauth2\user_field_mapping(0, $record); < $userfieldmapping->create(); < } < } < < /** < * Create a linkedin OAuth2 issuer < * < * @return issuer < */ < private static function init_linkedin(): issuer { < $record = (object) [ < 'name' => 'LinkedIn', < 'image' => 'https://static.licdn.com/scds/common/u/images/logos/favicons/v1/favicon.ico', < 'baseurl' => 'https://api.linkedin.com/v2', < 'loginscopes' => 'r_liteprofile r_emailaddress', < 'loginscopesoffline' => 'r_liteprofile r_emailaddress', < 'showonloginpage' => true < ]; < < $issuer = new issuer(0, $record); < return $issuer; < } < < /** < * Create endpoints for linkedin issuers. < * < * @param issuer $issuer < * @throws \coding_exception < * @throws \core\invalid_persistent_exception < */ < private static function create_endpoints_for_linkedin(issuer $issuer) { < $endpoints = [ < 'authorization_endpoint' => 'https://www.linkedin.com/oauth/v2/authorization', < 'token_endpoint' => 'https://www.linkedin.com/oauth/v2/accessToken', < 'email_endpoint' => 'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))', < 'userinfo_endpoint' => "https://api.linkedin.com/v2/me?projection=(localizedFirstName,localizedLastName," < . "profilePicture(displayImage~digitalmediaAsset:playableStreams))", < ]; < foreach ($endpoints as $name => $url) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'name' => $name, < 'url' => $url < ]; < $endpoint = new endpoint(0, $record); < $endpoint->create(); < } < < // Create the field mappings. < $mapping = [ < 'localizedFirstName' => 'firstname', < 'localizedLastName' => 'lastname', < 'elements[0]-handle~-emailAddress' => 'email', < 'profilePicture-displayImage~-elements[0]-identifiers[0]-identifier' => 'picture' < ]; < foreach ($mapping as $external => $internal) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'externalfield' => $external, < 'internalfield' => $internal < ]; < $userfieldmapping = new user_field_mapping(0, $record); < $userfieldmapping->create(); < } < } < < /*** Initializes a record for one of the standard issuers to be displayed in the settings. * The issuer is not yet created in the database.< * @param string $type One of google, facebook, microsoft, nextcloud> * @param string $type One of google, facebook, microsoft, nextcloud, imsobv2p1* @return \core\oauth2\issuer */ public static function init_standard_issuer($type) { require_capability('moodle/site:config', context_system::instance());< if ($type == 'google') { < return self::init_google(); < } else if ($type == 'microsoft') { < return self::init_microsoft(); < } else if ($type == 'facebook') { < return self::init_facebook(); < } else if ($type == 'nextcloud') { < return self::init_nextcloud(); < } else if ($type == 'linkedin') { < return self::init_linkedin(); < } else { < throw new moodle_exception('OAuth 2 service type not recognised: ' . $type);> > $classname = self::get_service_classname($type); > if (class_exists($classname)) { > return $classname::init();}> throw new moodle_exception('OAuth 2 service type not recognised: ' . $type);} /** * Create endpoints for standard issuers, based on the issuer created from submitted data.< * @param string $type One of google, facebook, microsoft, nextcloud> * @param string $type One of google, facebook, microsoft, nextcloud, imsobv2p1* @param issuer $issuer issuer the endpoints should be created for. * @return \core\oauth2\issuer */ public static function create_endpoints_for_standard_issuer($type, $issuer) { require_capability('moodle/site:config', context_system::instance());< if ($type == 'google') { < $issuer = self::create_endpoints_for_google($issuer); < self::discover_endpoints($issuer);> > $classname = self::get_service_classname($type); > if (class_exists($classname)) { > $classname::create_endpoints($issuer);return $issuer;< } else if ($type == 'microsoft') { < return self::create_endpoints_for_microsoft($issuer); < } else if ($type == 'facebook') { < return self::create_endpoints_for_facebook($issuer); < } else if ($type == 'nextcloud') { < return self::create_endpoints_for_nextcloud($issuer); < } else if ($type == 'linkedin') { < return self::create_endpoints_for_linkedin($issuer); < } else { < throw new moodle_exception('OAuth 2 service type not recognised: ' . $type);}> throw new moodle_exception('OAuth 2 service type not recognised: ' . $type);} /** * Create one of the standard issuers.< * @param string $type One of google, facebook, microsoft, or nextcloud < * @param string|false $baseurl Baseurl (only required for nextcloud)> * > * @param string $type One of google, facebook, microsoft, nextcloud or imsobv2p1 > * @param string|false $baseurl Baseurl (only required for nextcloud and imsobv2p1)* @return \core\oauth2\issuer */ public static function create_standard_issuer($type, $baseurl = false) { require_capability('moodle/site:config', context_system::instance());< if ($type == 'google') { < $issuer = self::init_google(); < $issuer->create(); < return self::create_endpoints_for_google($issuer); < } else if ($type == 'microsoft') { < $issuer = self::init_microsoft(); < $issuer->create(); < return self::create_endpoints_for_microsoft($issuer); < } else if ($type == 'facebook') { < $issuer = self::init_facebook(); < $issuer->create(); < return self::create_endpoints_for_facebook($issuer); < } else if ($type == 'nextcloud') {> > switch ($type) { > case 'imsobv2p1': > if (!$baseurl) { > throw new moodle_exception('IMS OBv2.1 service type requires the baseurl parameter.'); > } > case 'nextcloud':if (!$baseurl) { throw new moodle_exception('Nextcloud service type requires the baseurl parameter.'); }< $issuer = self::init_nextcloud();> case 'google': > case 'facebook': > case 'microsoft': > $classname = self::get_service_classname($type); > $issuer = $classname::init(); > if ($baseurl) {$issuer->set('baseurl', $baseurl);> }$issuer->create();< return self::create_endpoints_for_nextcloud($issuer); < } else { < throw new moodle_exception('OAuth 2 service type not recognised: ' . $type);> return self::create_endpoints_for_standard_issuer($type, $issuer);}> } > throw new moodle_exception('OAuth 2 service type not recognised: ' . $type);/** * List all the issuers, ordered by the sortorder field> * * @return \core\oauth2\issuer[] > * @param bool $includeloginonly also include issuers that are configured to be shown only on login page, */ > * By default false, in this case the method returns all issuers that can be used in services< public static function get_all_issuers() {> public static function get_all_issuers(bool $includeloginonly = false) { > if ($includeloginonly) {return issuer::get_records([], 'sortorder');> } else { } > return array_values(issuer::get_records_select('showonloginpage<>?', [issuer::LOGINONLY], 'sortorder')); > }/** * Get a single issuer by id. * * @param int $id * @return \core\oauth2\issuer */ public static function get_issuer($id) { return new issuer($id); } /** * Get a single endpoint by id. * * @param int $id * @return \core\oauth2\endpoint */ public static function get_endpoint($id) { return new endpoint($id); } /** * Get a single user field mapping by id. * * @param int $id * @return \core\oauth2\user_field_mapping */ public static function get_user_field_mapping($id) { return new user_field_mapping($id); } /** * Get the system account for an installed OAuth service. * Never ever ever expose this to a webservice because it contains the refresh token which grants API access. * * @param \core\oauth2\issuer $issuer * @return system_account|false */ public static function get_system_account(issuer $issuer) { return system_account::get_record(['issuerid' => $issuer->get('id')]); } /** * Get the full list of system scopes required by an oauth issuer. * This includes the list required for login as well as any scopes injected by the oauth2_system_scopes callback in plugins. * * @param \core\oauth2\issuer $issuer * @return string */ public static function get_system_scopes_for_issuer($issuer) { $scopes = $issuer->get('loginscopesoffline'); $pluginsfunction = get_plugins_with_function('oauth2_system_scopes', 'lib.php'); foreach ($pluginsfunction as $plugintype => $plugins) { foreach ($plugins as $pluginfunction) { // Get additional scopes from the plugin. $pluginscopes = $pluginfunction($issuer); if (empty($pluginscopes)) { continue; } // Merge the additional scopes with the existing ones. $additionalscopes = explode(' ', $pluginscopes); foreach ($additionalscopes as $scope) { if (!empty($scope)) { if (strpos(' ' . $scopes . ' ', ' ' . $scope . ' ') === false) { $scopes .= ' ' . $scope; } } } } } return $scopes; } /** * Get an authenticated oauth2 client using the system account. * This call uses the refresh token to get an access token. * * @param \core\oauth2\issuer $issuer * @return \core\oauth2\client|false An authenticated client (or false if the token could not be upgraded) * @throws moodle_exception Request for token upgrade failed for technical reasons */ public static function get_system_oauth_client(issuer $issuer) { $systemaccount = self::get_system_account($issuer); if (empty($systemaccount)) { return false; } // Get all the scopes! $scopes = self::get_system_scopes_for_issuer($issuer);< $class = self::get_client_classname($issuer->get('name'));> $class = self::get_client_classname($issuer->get('servicetype'));$client = new $class($issuer, null, $scopes, true); if (!$client->is_logged_in()) { if (!$client->upgrade_refresh_token($systemaccount)) { return false; } } return $client; } /** * Get an authenticated oauth2 client using the current user account. * This call does the redirect dance back to the current page after authentication. * * @param \core\oauth2\issuer $issuer The desired OAuth issuer * @param moodle_url $currenturl The url to the current page. * @param string $additionalscopes The additional scopes required for authorization. * @param bool $autorefresh Should the client support the use of refresh tokens to persist access across sessions. * @return \core\oauth2\client */ public static function get_user_oauth_client(issuer $issuer, moodle_url $currenturl, $additionalscopes = '', $autorefresh = false) {< $class = self::get_client_classname($issuer->get('name'));> $class = self::get_client_classname($issuer->get('servicetype'));$client = new $class($issuer, $currenturl, $additionalscopes, false, $autorefresh); return $client; } /** * Get the client classname for an issuer. *< * @param string $type The OAuth issuer name> * @param string $type The OAuth issuer type (google, facebook...).* @return string The classname for the custom client or core client class if the class for the defined type * doesn't exist or null type is defined. */ protected static function get_client_classname(?string $type): string { // Default core client class. $classname = 'core\\oauth2\\client';< if (strpos(strtolower($type), 'linkedin') !== false) { < $classname = 'core\\oauth2\\client\\linkedin';> if (!empty($type)) { > $typeclassname = 'core\\oauth2\\client\\' . $type; > if (class_exists($typeclassname)) { > $classname = $typeclassname; > }} return $classname; } /** * Get the list of defined endpoints for this OAuth issuer * * @param \core\oauth2\issuer $issuer The desired OAuth issuer * @return \core\oauth2\endpoint[] */ public static function get_endpoints(issuer $issuer) { return endpoint::get_records(['issuerid' => $issuer->get('id')]); } /** * Get the list of defined mapping from OAuth user fields to moodle user fields. * * @param \core\oauth2\issuer $issuer The desired OAuth issuer * @return \core\oauth2\user_field_mapping[] */ public static function get_user_field_mappings(issuer $issuer) { return user_field_mapping::get_records(['issuerid' => $issuer->get('id')]); } /** * Guess an image from the discovery URL. * * @param \core\oauth2\issuer $issuer The desired OAuth issuer */ protected static function guess_image($issuer) { if (empty($issuer->get('image')) && !empty($issuer->get('baseurl'))) { $baseurl = parse_url($issuer->get('baseurl')); $imageurl = $baseurl['scheme'] . '://' . $baseurl['host'] . '/favicon.ico'; $issuer->set('image', $imageurl); $issuer->update(); } } /**< * If the discovery endpoint exists for this issuer, try and determine the list of valid endpoints. < * < * @param issuer $issuer < * @return int The number of discovered services. < */ < protected static function discover_endpoints($issuer) { < $curl = new curl(); < < if (empty($issuer->get('baseurl'))) { < return 0; < } < < $url = $issuer->get_endpoint_url('discovery'); < if (!$url) { < $url = $issuer->get('baseurl') . '/.well-known/openid-configuration'; < } < < if (!$json = $curl->get($url)) { < $msg = 'Could not discover end points for identity issuer' . $issuer->get('name'); < throw new moodle_exception($msg); < } < < if ($msg = $curl->error) { < throw new moodle_exception('Could not discover service endpoints: ' . $msg); < } < < $info = json_decode($json); < if (empty($info)) { < $msg = 'Could not discover end points for identity issuer' . $issuer->get('name'); < throw new moodle_exception($msg); < } < < foreach (endpoint::get_records(['issuerid' => $issuer->get('id')]) as $endpoint) { < if ($endpoint->get('name') != 'discovery_endpoint') { < $endpoint->delete(); < } < } < < foreach ($info as $key => $value) { < if (substr_compare($key, '_endpoint', - strlen('_endpoint')) === 0) { < $record = new stdClass(); < $record->issuerid = $issuer->get('id'); < $record->name = $key; < $record->url = $value; < < $endpoint = new endpoint(0, $record); < $endpoint->create(); < } < < if ($key == 'scopes_supported') { < $issuer->set('scopessupported', implode(' ', $value)); < $issuer->update(); < } < } < < // We got to here - must be a decent OpenID connect service. Add the default user field mapping list. < foreach (user_field_mapping::get_records(['issuerid' => $issuer->get('id')]) as $userfieldmapping) { < $userfieldmapping->delete(); < } < < // Create the field mappings. < $mapping = [ < 'given_name' => 'firstname', < 'middle_name' => 'middlename', < 'family_name' => 'lastname', < 'email' => 'email', < 'website' => 'url', < 'nickname' => 'alternatename', < 'picture' => 'picture', < 'address' => 'address', < 'phone' => 'phone1', < 'locale' => 'lang' < ]; < foreach ($mapping as $external => $internal) { < $record = (object) [ < 'issuerid' => $issuer->get('id'), < 'externalfield' => $external, < 'internalfield' => $internal < ]; < $userfieldmapping = new user_field_mapping(0, $record); < $userfieldmapping->create(); < } < < return endpoint::count_records(['issuerid' => $issuer->get('id')]); < } < < /*** Take the data from the mform and update the issuer. * * @param stdClass $data * @return \core\oauth2\issuer */ public static function update_issuer($data) {< require_capability('moodle/site:config', context_system::instance()); < $issuer = new issuer(0, $data); < < // Will throw exceptions on validation failures. < $issuer->update(); < < // Perform service discovery. < self::discover_endpoints($issuer); < self::guess_image($issuer); < return $issuer;> return self::create_or_update_issuer($data, false);} /** * Take the data from the mform and create the issuer. * * @param stdClass $data * @return \core\oauth2\issuer */ public static function create_issuer($data) {> return self::create_or_update_issuer($data, true); require_capability('moodle/site:config', context_system::instance()); > } $issuer = new issuer(0, $data); > > /** // Will throw exceptions on validation failures. > * Take the data from the mform and create or update the issuer. $issuer->create(); > * > * @param stdClass $data Form data for them issuer to be created/updated. // Perform service discovery. > * @param bool $create If true, the issuer will be created; otherwise, it will be updated. self::discover_endpoints($issuer); > * @return issuer The created/updated issuer. self::guess_image($issuer); > */ return $issuer; > protected static function create_or_update_issuer($data, bool $create): issuer {< $issuer = new issuer(0, $data);> $issuer = new issuer($data->id ?? 0, $data);> if ($create) {< self::discover_endpoints($issuer);> $classname = self::get_service_classname($issuer->get('servicetype')); > $classname::discover_endpoints($issuer);* Take the data from the mform and update the endpoint.> } else { * > $issuer->update(); * @param stdClass $data > } * @return \core\oauth2\endpoint >*/> * Get the service classname for an issuer. public static function update_endpoint($data) { > * require_capability('moodle/site:config', context_system::instance()); > * @param string $type The OAuth issuer type (google, facebook...). $endpoint = new endpoint(0, $data); > * > * @return string The classname for this issuer or "Custom" service class if the class for the defined type doesn't exist // Will throw exceptions on validation failures. > * or null type is defined. $endpoint->update(); > */ > protected static function get_service_classname(?string $type): string { return $endpoint; > // Default custom service class. } > $classname = 'core\\oauth2\\service\\custom'; > /** > if (!empty($type)) { * Take the data from the mform and create the endpoint. > $typeclassname = 'core\\oauth2\\service\\' . $type; * > if (class_exists($typeclassname)) { * @param stdClass $data > $classname = $typeclassname; * @return \core\oauth2\endpoint > } */ > } public static function create_endpoint($data) { > require_capability('moodle/site:config', context_system::instance()); > return $classname; $endpoint = new endpoint(0, $data); > } > // Will throw exceptions on validation failures. > /**$endpoint->create(); return $endpoint; } /** * Take the data from the mform and update the user field mapping. * * @param stdClass $data * @return \core\oauth2\user_field_mapping */ public static function update_user_field_mapping($data) { require_capability('moodle/site:config', context_system::instance()); $userfieldmapping = new user_field_mapping(0, $data); // Will throw exceptions on validation failures. $userfieldmapping->update(); return $userfieldmapping; } /** * Take the data from the mform and create the user field mapping. * * @param stdClass $data * @return \core\oauth2\user_field_mapping */ public static function create_user_field_mapping($data) { require_capability('moodle/site:config', context_system::instance()); $userfieldmapping = new user_field_mapping(0, $data); // Will throw exceptions on validation failures. $userfieldmapping->create(); return $userfieldmapping; } /** * Reorder this identity issuer. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the identity issuer to move. * @return boolean */ public static function move_up_issuer($id) { require_capability('moodle/site:config', context_system::instance()); $current = new issuer($id); $sortorder = $current->get('sortorder'); if ($sortorder == 0) { return false; } $sortorder = $sortorder - 1; $current->set('sortorder', $sortorder); $filters = array('sortorder' => $sortorder); $children = issuer::get_records($filters, 'id'); foreach ($children as $needtoswap) { $needtoswap->set('sortorder', $sortorder + 1); $needtoswap->update(); } // OK - all set. $result = $current->update(); return $result; } /** * Reorder this identity issuer. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the identity issuer to move. * @return boolean */ public static function move_down_issuer($id) { require_capability('moodle/site:config', context_system::instance()); $current = new issuer($id); $max = issuer::count_records(); if ($max > 0) { $max--; } $sortorder = $current->get('sortorder'); if ($sortorder >= $max) { return false; } $sortorder = $sortorder + 1; $current->set('sortorder', $sortorder); $filters = array('sortorder' => $sortorder); $children = issuer::get_records($filters); foreach ($children as $needtoswap) { $needtoswap->set('sortorder', $sortorder - 1); $needtoswap->update(); } // OK - all set. $result = $current->update(); return $result; } /** * Disable an identity issuer. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the identity issuer to disable. * @return boolean */ public static function disable_issuer($id) { require_capability('moodle/site:config', context_system::instance()); $issuer = new issuer($id); $issuer->set('enabled', 0); return $issuer->update(); } /** * Enable an identity issuer. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the identity issuer to enable. * @return boolean */ public static function enable_issuer($id) { require_capability('moodle/site:config', context_system::instance()); $issuer = new issuer($id); $issuer->set('enabled', 1); return $issuer->update(); } /** * Delete an identity issuer. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the identity issuer to delete. * @return boolean */ public static function delete_issuer($id) { require_capability('moodle/site:config', context_system::instance()); $issuer = new issuer($id); $systemaccount = self::get_system_account($issuer); if ($systemaccount) { $systemaccount->delete(); } $endpoints = self::get_endpoints($issuer); if ($endpoints) { foreach ($endpoints as $endpoint) { $endpoint->delete(); } } // Will throw exceptions on validation failures. return $issuer->delete(); } /** * Delete an endpoint. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the endpoint to delete. * @return boolean */ public static function delete_endpoint($id) { require_capability('moodle/site:config', context_system::instance()); $endpoint = new endpoint($id); // Will throw exceptions on validation failures. return $endpoint->delete(); } /** * Delete a user_field_mapping. * * Requires moodle/site:config capability at the system context. * * @param int $id The id of the user_field_mapping to delete. * @return boolean */ public static function delete_user_field_mapping($id) { require_capability('moodle/site:config', context_system::instance()); $userfieldmapping = new user_field_mapping($id); // Will throw exceptions on validation failures. return $userfieldmapping->delete(); } /** * Perform the OAuth dance and get a refresh token. * * Requires moodle/site:config capability at the system context. * * @param \core\oauth2\issuer $issuer * @param moodle_url $returnurl The url to the current page (we will be redirected back here after authentication). * @return boolean */ public static function connect_system_account($issuer, $returnurl) { require_capability('moodle/site:config', context_system::instance()); // We need to authenticate with an oauth 2 client AS a system user and get a refresh token for offline access. $scopes = self::get_system_scopes_for_issuer($issuer); // Allow callbacks to inject non-standard scopes to the auth request.< $class = self::get_client_classname($issuer->get('name'));> $class = self::get_client_classname($issuer->get('servicetype'));$client = new $class($issuer, $returnurl, $scopes, true); if (!optional_param('response', false, PARAM_BOOL)) { $client->log_out(); } if (optional_param('error', '', PARAM_RAW)) { return false; } if (!$client->is_logged_in()) { redirect($client->get_login_url()); } $refreshtoken = $client->get_refresh_token(); if (!$refreshtoken) { return false; } $systemaccount = self::get_system_account($issuer); if ($systemaccount) { $systemaccount->delete(); } $userinfo = $client->get_userinfo(); $record = new stdClass(); $record->issuerid = $issuer->get('id'); $record->refreshtoken = $refreshtoken; $record->grantedscopes = $scopes; $record->email = isset($userinfo['email']) ? $userinfo['email'] : ''; $record->username = $userinfo['username']; $systemaccount = new system_account(0, $record); $systemaccount->create(); $client->log_out(); return true; } }