From 963a9ab35f58f1f3ff5ca2822aed3b908717bb68 Mon Sep 17 00:00:00 2001
From: cash <cash@36083f99-b078-4883-b0ff-0f9b5a30f544>
Date: Sat, 7 Nov 2009 22:36:23 +0000
Subject: combined the two different pams into one and fixed an issue with hmac
 authentication

git-svn-id: http://code.elgg.org/elgg/trunk@3635 36083f99-b078-4883-b0ff-0f9b5a30f544
---
 engine/lib/pam.php | 44 ++++++++++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 16 deletions(-)

(limited to 'engine/lib/pam.php')

diff --git a/engine/lib/pam.php b/engine/lib/pam.php
index 17b10b5cc..590ef9fde 100644
--- a/engine/lib/pam.php
+++ b/engine/lib/pam.php
@@ -3,12 +3,13 @@
  * Elgg Simple PAM library
  * Contains functions for managing authentication.
  * This is not a full implementation of PAM. It supports a single facility 
- * (authentication) and only allows one policy at a time. There are two control
- * flags possible for each module: sufficient or required. The entire chain for 
- * a policy is processed (or until a required module fails). A module fails by 
- * returning false or throwing an exception. The order that modules are 
- * processed is determined by the order they are registered. For an example of
- * a PAM, see pam_auth_userpass() in sessions.php.
+ * (authentication) and allows multiple policies (user authentication is the
+ * default). There are two control flags possible for each module: sufficient 
+ * or required. The entire chain for a policy is processed (or until a 
+ * required module fails). A module fails by returning false or throwing an 
+ * exception. The order that modules are processed is determined by the order 
+ * they are registered. For an example of a PAM, see pam_auth_userpass() in 
+ * sessions.php.
  * 
  * For more information on PAMs see:
  * http://www.freebsd.org/doc/en/articles/pam/index.html
@@ -27,16 +28,23 @@ $_PAM_HANDLERS_MSG = array();
  *
  * @param string $handler The handler function in the format
  * 		pam_handler($credentials = NULL);
- * @param string $importance The importance - "sufficient" or "required"
+ * @param string $importance The importance - "sufficient" (default) or "required"
+ * @param string $policy - the policy type, default is "user"
+ * @return boolean
  */
-function register_pam_handler($handler, $importance = "sufficient") {
+function register_pam_handler($handler, $importance = "sufficient", $policy = "user") {
 	global $_PAM_HANDLERS;
 
+	// setup array for this type of pam if not already set
+	if (!isset($_PAM_HANDLERS[$policy])) {
+		$_PAM_HANDLERS[$policy] = array();
+	}
+	
 	if (is_callable($handler)) {
-		$_PAM_HANDLERS[$handler] = new stdClass;
+		$_PAM_HANDLERS[$policy][$handler] = new stdClass;
 
-		$_PAM_HANDLERS[$handler]->handler = $handler;
-		$_PAM_HANDLERS[$handler]->importance = strtolower($importance);
+		$_PAM_HANDLERS[$policy][$handler]->handler = $handler;
+		$_PAM_HANDLERS[$policy][$handler]->importance = strtolower($importance);
 
 		return true;
 	}
@@ -48,18 +56,19 @@ function register_pam_handler($handler, $importance = "sufficient") {
  * Unregisters a PAM handler.
  *
  * @param string $handler The PAM handler function name
+ * @param string $policy - the policy type, default is "user"
  */
-function unregister_pam_handler($handler) {
+function unregister_pam_handler($handler, $policy = "user") {
 	global $_PAM_HANDLERS;
 
-	unset($_PAM_HANDLERS[$handler]);
+	unset($_PAM_HANDLERS[$policy][$handler]);
 }
 
 /**
  * Attempt to authenticate.
  * This function will process all registered PAM handlers or stop when the first 
  * handler fails. A handler fails by either returning false or throwing an 
- * exception. The advatange of throwing an exception is that it returns a message
+ * exception. The advantage of throwing an exception is that it returns a message
  * through the global $_PAM_HANDLERS_MSG which can be used in communication with 
  * a user. The order that handlers are processed is determined by the order that
  * they were registered.
@@ -69,14 +78,17 @@ function unregister_pam_handler($handler) {
  * otherwise retrieved (eg from the HTTP header or $_SESSION).
  *
  * @param mixed $credentials Mixed PAM handler specific credentials (e.g. username, password)
+ * @param string $policy - the policy type, default is "user"
  * @return bool true if authenticated, false if not.
  */
-function pam_authenticate($credentials = NULL) {
+function pam_authenticate($credentials = NULL, $policy = "user") {
 	global $_PAM_HANDLERS, $_PAM_HANDLERS_MSG;
 
+	$_PAM_HANDLERS_MSG = array();
+	
 	$authenticated = false;
 
-	foreach ($_PAM_HANDLERS as $k => $v) {
+	foreach ($_PAM_HANDLERS[$policy] as $k => $v) {
 		$handler = $v->handler;
 		$importance = $v->importance;
 
-- 
cgit v1.2.3