Actualización

main/auth/shibboleth/app/controller/shibboleth_controller.class.php

@@ -0,0 +1,158 @@
+<?php
+
+namespace Shibboleth;
+
+use \Redirect;
+use \Display;
+use IndexManager;
+
+/**
+ * Controller for the Shibboleth authentication system. 
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class ShibbolethController
+{
+
+    /**
+     *
+     * @return ShibbolethController 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+
+    /**
+     * Log user in with Shibboleth authentication 
+     */
+    function login()
+    {
+
+        if (Shibboleth::session()->is_logged_in())
+        {
+            Redirect::home();
+        }
+
+        $user = Shibboleth::store()->get_user();
+
+        if ($user->is_empty())
+        {
+            $message = get_lang('SystemCouldNotLogYouIn');
+            Shibboleth::display()->error_page($message);
+        }
+
+        $is_new_user = !User::store()->shibboleth_id_exists($user->unique_id);
+
+        if ($is_new_user && empty($user->email) && Shibboleth::config()->is_email_mandatory)
+        {
+            $form = ShibbolethEmailForm::instance();
+            if ($email = $form->get_email())
+            {
+                $user->email = $email;
+            }
+            else
+            {
+                $content = $form->display();
+                Shibboleth::display()->page($content);
+            }
+        }
+
+        Shibboleth::save($user);
+        $chamilo_user = User::store()->get_by_shibboleth_id($user->unique_id);
+        Shibboleth::session()->login($chamilo_user->user_id);
+
+        if ($is_new_user && $user->status_request)
+        {
+            Shibboleth::redirect('/main/auth/shibboleth/app/view/request.php');
+        }
+        else
+        {
+            Shibboleth::redirect();
+        }
+    }
+
+    /**
+     * Log user in using the standard Chamilo way of logging in.
+     * Useful when the normal login screen is removed from the user interface
+     * - replaced by Shibboleth login - and user want to login using a standard
+     * account
+     */
+    public function admin_login()
+    {
+        $title = get_lang('InternalLogin');
+        if (Shibboleth::session()->is_logged_in())
+        {
+            $message = get_lang('AlreadyLoggedIn');
+            Shibboleth::display()->message_page($message, $title);
+        }
+        $index_manager = new IndexManager('');
+        $html = $index_manager->display_login_form();
+        Shibboleth::display()->page($html, $title);
+    }
+
+    /**
+     * Display the request new status page to administrator for new users. 
+     */
+    public function request_status()
+    {
+        /*
+         * That may happen if a user visit that url again.
+         */
+        if (!Shibboleth::session()->is_logged_in())
+        {
+            Shibboleth::redirect();
+        }
+        $user = Shibboleth::session()->user();
+        if ($user['status'] == Shibboleth::TEACHER_STATUS)
+        {
+            //Maximum user right is reached.
+            Shibboleth::redirect();
+        }
+        
+        $form = ShibbolethStatusRequestForm::instance();
+
+        if ($form->cancelled())
+        {
+            Shibboleth::redirect();
+        }
+
+        if ($reason = $form->get_reason())
+        {
+            $subject = get_lang('RequestStatus');
+            $status = $form->get_status();
+            $status = Shibboleth::format_status($status);
+
+            $message = <<<EOT
+New status: $status
+            
+Reason:
+$reason
+EOT;
+
+            $success = Shibboleth::email_admin($subject, $message);
+            if ($success)
+            {
+                $request_submitted = get_lang('RequestSubmitted');
+                Shibboleth::display()->message_page($request_submitted);
+            }
+            else
+            {
+                $request_failed = get_lang('RequestFailed');
+                Shibboleth::display()->error_page($request_failed);
+            }
+        }
+
+        $title = get_lang('RequestStatus');
+        Display :: display_header($title);
+        echo $form->display();
+        Display :: display_footer();
+    }
+
+}

main/auth/shibboleth/app/model/admin.class.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace Shibboleth;
+
+require_once __DIR__.'/scaffold/admin.class.php';
+
+/**
+ * A Chamilo admin. Model for the Admin table.
+ * 
+ * Should be moved to the core. It only exists because it is not available through
+ * the API.
+ * 
+ * The _Admin objet is generated by the scaffolder. Admin inherits from it to allow
+ * modifications without touching the generated file. Don't modify _Admin as
+ * it may change in the future. Instead add modifications to this class.
+ * 
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class Admin extends _Admin
+{
+    
+}
+
+/**
+ * Store for Admin objects. Interact with the database. Allows to save and retrieve
+ * admin objects. 
+ * 
+ * Should be moved to the core. It only exists because it is not available through
+ * the API.
+ *  
+ * The _AdminStore objet is generated by the scaffolder. This class inherits from it to allow
+ * modifications without touching the generated file. Don't modify the _ object as
+ * it may change in the future. Instead add modifications to this class.
+ *
+ * @copyright (c) 2012 University of Geneva
+ * @license GNU General Public License - http://www.gnu.org/copyleft/gpl.html
+ * @author Laurent Opprecht <laurent@opprecht.info>
+ */
+class AdminStore extends _AdminStore
+{
+
+
+}

main/auth/shibboleth/app/model/scaffold/admin.class.php

@@ -0,0 +1,134 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * This file is autogenerated. Do not modifiy it.
+ */
+
+/**
+ *
+ * Model for table admin 
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class _Admin
+{
+
+    /**
+    * Store for Admin objects. Interact with the database.
+    *
+    * @return AdminStore 
+    */
+    public static function store()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new AdminStore();
+        }
+        return $result;
+    }
+        
+    /**
+     *
+     * @return Admin 
+     */
+    public static function create($data = null)
+    {
+        return self::store()->create_object($data);
+    }   
+
+    public $user_id = null;     
+ 
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function save()
+    {
+        return self::store()->save($this);
+    }
+    
+}
+
+/**
+ * Store for Admin objects. Interact with the database.
+ *
+ * @copyright (c) 2012 University of Geneva
+ * @license GNU General Public License - http://www.gnu.org/copyleft/gpl.html
+ * @author Laurent Opprecht <laurent@opprecht.info>
+ */
+class _AdminStore extends Store
+{
+
+    /**
+     *
+     * @return AdminStore 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+    
+    public function __construct()
+    {
+        parent::__construct('admin', '\Shibboleth\Admin', 'user_id');
+    }
+    
+    /**
+     *
+     * @return Admin 
+     */
+    public function get($w)
+    {
+        $args = func_get_args();
+        $f = array('parent', 'get');
+        return call_user_func_array($f, $args);
+    }    
+    
+    /**
+     *
+     * @return Admin 
+     */
+    public function create_object($data)
+    {
+        return parent::create_object($data);
+    }    
+    
+    /**
+     *
+     * @return Admin 
+     */
+    public function get_by_user_id($value)
+    {
+        return $this->get(array('user_id' => $value));
+    }    
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function user_id_exists($value)
+    {
+        return $this->exist(array('user_id' => $value));
+    }     
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function delete_by_user_id($value)
+    {
+        return $this->delete(array('user_id' => $value));
+    }    
+    
+     
+}

main/auth/shibboleth/app/model/scaffold/user.class.php

@@ -0,0 +1,185 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * This file is autogenerated. Do not modifiy it.
+ */
+
+/**
+ *
+ * Model for table user 
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class _User
+{
+
+    /**
+    * Store for User objects. Interact with the database.
+    *
+    * @return UserStore 
+    */
+    public static function store()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new UserStore();
+        }
+        return $result;
+    }
+        
+    /**
+     *
+     * @return User 
+     */
+    public static function create($data = null)
+    {
+        return self::store()->create_object($data);
+    }   
+
+    public $user_id = null;    
+    public $lastname = null;    
+    public $firstname = null;    
+    public $username = null;    
+    public $password = null;    
+    public $auth_source = null;    
+    public $shibb_unique_id = null;    
+    public $email = null;    
+    public $status = null;    
+    public $official_code = null;    
+    public $phone = null;    
+    public $picture_uri = null;    
+    public $creator_id = null;    
+    public $competences = null;    
+    public $diplomas = null;    
+    public $openarea = null;    
+    public $teach = null;    
+    public $productions = null;
+    public $language = null;    
+    public $registration_date = null;    
+    public $expiration_date = null;    
+    public $active = null;    
+    public $openid = null;    
+    public $theme = null;    
+    public $hr_dept_id = null;    
+    public $shibb_persistent_id = null;    
+ 
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function save()
+    {
+        return self::store()->save($this);
+    }
+    
+}
+
+/**
+ * Store for User objects. Interact with the database.
+ *
+ * @copyright (c) 2012 University of Geneva
+ * @license GNU General Public License - http://www.gnu.org/copyleft/gpl.html
+ * @author Laurent Opprecht <laurent@opprecht.info>
+ */
+class _UserStore extends Store
+{
+
+    /**
+     *
+     * @return UserStore 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+    
+    public function __construct()
+    {
+        parent::__construct('user', '\Shibboleth\User', 'user_id');
+    }
+    
+    /**
+     *
+     * @return User 
+     */
+    public function get($w)
+    {
+        $args = func_get_args();
+        $f = array('parent', 'get');
+        return call_user_func_array($f, $args);
+    }    
+    
+    /**
+     *
+     * @return User 
+     */
+    public function create_object($data)
+    {
+        return parent::create_object($data);
+    }    
+    
+    /**
+     *
+     * @return User 
+     */
+    public function get_by_user_id($value)
+    {
+        return $this->get(array('user_id' => $value));
+    }    
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function user_id_exists($value)
+    {
+        return $this->exist(array('user_id' => $value));
+    }     
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function delete_by_user_id($value)
+    {
+        return $this->delete(array('user_id' => $value));
+    }    
+    
+    /**
+     *
+     * @return User 
+     */
+    public function get_by_username($value)
+    {
+        return $this->get(array('username' => $value));
+    }    
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function username_exists($value)
+    {
+        return $this->exist(array('username' => $value));
+    }     
+    
+    /**
+     *
+     * @return bool 
+     */
+    public function delete_by_username($value)
+    {
+        return $this->delete(array('username' => $value));
+    }    
+     
+}

main/auth/shibboleth/app/model/shibboleth_store.class.php

@@ -0,0 +1,197 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * Returns Shibboleth user's values based on Shibboleth's configuration.
+ * Shibboleth returns not only whether a user is authenticated but returns as
+ * well several paralemeter fields.
+ * 
+ * If a user is not authenticated nothing is returned.
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class ShibbolethStore
+{
+
+    /**
+     *
+     * @return ShibbolethStore 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+
+    /**
+     *
+     * @return ShibbolethConfig
+     */
+    public static function config()
+    {
+        return Shibboleth::config();
+    }
+
+    public function get_unique_id()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    /**
+     * If the user has more than one surname, it is possible depending of the user 
+     * home organization that they are all given to the resource.
+     * In the case of the University of Geneva, with two surnames, three different values
+     * for the surname are sent. They are:
+     * 1) "givenname1"
+     * 2) "givenname2"
+     * 3) "givenname1 givenname2"
+     *    meaning the string is as follow: "givenname1;givenname2;givenname1 givenname2"
+     *    
+     * In such a case, the correct surname is the one which is followed by a space.
+     * This function tests if such a situation is encountered, and returns the first given name.
+     *
+     * @author Nicolas Rod
+     */
+    public function get_firstname()
+    {
+        $result = $this->get(__FUNCTION__);
+
+        if (!is_array($result))
+        {
+            $result = ucfirst($result);
+            return $result;
+        }
+        foreach ($result as $name)
+        {
+            $parts = explode(' ', $name);
+
+            if (count($parts) > 1)
+            {
+                $result = reset($parts);
+                $result = ucfirst($result);
+                return $result;
+            }
+        }
+        $result = reset($result);
+        $result = ucfirst($result);
+        return $result;
+    }
+
+    public function get_lastname()
+    {
+        $result = $this->get(__FUNCTION__);
+        $result = ucfirst($result);
+        return $result;
+    }
+
+    public function get_email()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_language()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_gender()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_address()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_staff_category()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_home_organization_type()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_home_organization()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    public function get_affiliation()
+    {
+        return $this->get(__FUNCTION__);
+    }
+
+    /**
+     * @return ShibbolethUser 
+     */
+    public function get_user()
+    {
+        $result = new ShibbolethUser();
+        foreach ($result as $key => $val)
+        {
+            $f = array($this, "get_$key");
+            if (is_callable($f))
+            {
+                $result->{$key} = call_user_func($f);
+            }
+        }
+        return $result;
+    }
+
+    /**
+     * Returns the shibboleth value stored in $_SERVER if it exists or $default if it is not the case.
+     *
+     * @param string $name the generic name. I.e. one of the class const.
+     * @param string $default default value if it is not provided by Shibboleth
+     * @return string
+     */
+    public function get($name = '', $default = '')
+    {
+        $config = (array) Shibboleth::config();
+        if ($name)
+        {
+            $name = str_replace('get_', '', $name);
+            $shib_name = isset($config[$name]) ? $config[$name] : '';
+            if ($shib_name)
+            {
+                $result = isset($_SERVER[$shib_name]) ? $_SERVER[$shib_name] : $default;
+                $result = explode(';', $result);
+                if (empty($result))
+                {
+                    $result = $default;
+                }
+                else if (count($result) == 1)
+                {
+                    $result = reset($result);
+                }
+                else
+                {
+                    $result = $result;
+                }
+                return $result;
+            }
+        }
+
+        $result = array();
+        foreach ($config as $key => $val)
+        {
+            $f = array($this, "get_$key");
+            if (is_callable($f))
+            {
+                $result[$key] = call_user_func($f);
+            }
+        }
+
+        return $result;
+    }
+
+}

main/auth/shibboleth/app/model/shibboleth_user.class.php

@@ -0,0 +1,33 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * Represent a Shibboleth user. Not to be missunderstand with a Chamilo user
+ * since they don't have the same attributes.
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class ShibbolethUser
+{       
+
+    public $unique_id = '';
+    public $firstname = '';
+    public $lastname = '';
+    public $email = '';
+    public $language = '';
+    public $gender = '';
+    public $address = '';
+    public $staff_category = '';
+    public $home_organization_type = '';
+    public $home_organization = '';
+    public $affiliation = '';
+    public $persistent_id = '';
+
+    public function is_empty()
+    {
+        return empty($this->unique_id);
+    }
+
+}

main/auth/shibboleth/app/model/user.class.php

@@ -0,0 +1,95 @@
+<?php
+
+namespace Shibboleth;
+
+require_once __DIR__.'/scaffold/user.class.php';
+
+/**
+ * A Chamilo user. Model for the User table.
+ * 
+ * Should be moved to the core. It only exists because it is not available through
+ * the API.
+ * 
+ * The _User objet is generated by the scaffolder. User inherits from it to allow
+ * modifications without touching the generated file. Don't modify _User as
+ * it may change in the future. Instead add modifications to this class.
+ * 
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class User extends _User
+{
+    
+}
+
+/**
+ * Store for User objects. Interact with the database. Allows to save and retrieve
+ * user objects. 
+ * 
+ * Should be moved to the core. It only exists because it is not available through
+ * the API.
+ *  
+ * The _UserStore objet is generated by the scaffolder. This class inherits from it to allow
+ * modifications without touching the generated file. Don't modify the _ object as
+ * it may change in the future. Instead add modifications to this class.
+ *
+ * @copyright (c) 2012 University of Geneva
+ * @license GNU General Public License - http://www.gnu.org/copyleft/gpl.html
+ * @author Laurent Opprecht <laurent@opprecht.info>
+ */
+class UserStore extends _UserStore
+{
+
+    function __construct()
+    {
+        parent::__construct();
+        ShibbolethUpgrade::update();
+    }
+
+    /**
+     *
+     * @param string $id
+     * @return User
+     */
+    public function get_by_shibboleth_id($id)
+    {
+        return $this->get(array('shibb_unique_id' => $id));
+    }
+    
+    /**
+     * @param string $id
+     */
+    public function shibboleth_id_exists($id)
+    {
+        return $this->exist(array('shibb_unique_id' => $id));
+    }
+
+    /**
+     *
+     * @param User $object 
+     */
+    protected function before_save($object)
+    {
+        $object->username = $object->username ? $object->username : $this->generate_username();
+        $object->password = $object->password ? $object->password : api_generate_password();
+        $object->language = $object->language ? $object->language : $this->default_language();
+    }
+    
+    function default_language()
+    {
+        return api_get_setting('platformLanguage');
+    }
+
+    function generate_username()
+    {
+        $result = uniqid('s', true);
+        $result = str_replace('.', '', $result);
+        while ($this->username_exists($result))
+        {
+            $result = uniqid('s', true);
+            $result = str_replace('.', '', $result);
+        }
+        return $result;
+    }
+
+}

main/auth/shibboleth/app/shibboleth.class.php

@@ -0,0 +1,266 @@
+<?php
+
+namespace Shibboleth;
+
+use \Redirect;
+
+/**
+ * Shibboleth main class. Provides access to various Shibboleth sub components and
+ * provides the high level functionalities.
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class Shibboleth
+{
+
+    const NAME = 'shibboleth';
+    const UNKNOWN_STATUS = -1;
+    const TEACHER_STATUS = 1;
+    const STUDENT_STATUS = 5;
+
+    static $config = null;
+
+    public static function format_status($status)
+    {
+        if ($status == Shibboleth::TEACHER_STATUS) {
+            return 'Teacher';
+        } else if ($status == Shibboleth::STUDENT_STATUS) {
+            return 'Student';
+        } else if ($status == Shibboleth::UNKNOWN_STATUS) {
+            return 'Unknown';
+        } else {
+            return '???';
+        }
+    }
+
+    /**
+     *
+     * @return ShibbolethConfig
+     */
+    public static function config()
+    {
+        self::$config = self::$config ? self::$config : new ShibbolethConfig();
+        return self::$config;
+    }
+
+    public static function set_config($config)
+    {
+        self::$config = $config;
+    }
+
+    /**
+     *
+     * @return ShibbolethSession
+     */
+    public static function session()
+    {
+        return ShibbolethSession::instance();
+    }
+
+    /**
+     *
+     * @return ShibbolethStore
+     */
+    public static function store()
+    {
+        return ShibbolethStore::instance();
+    }
+
+    /**
+     *
+     * @return ShibbolethDisplay
+     */
+    public static function display()
+    {
+        return ShibbolethDisplay::instance();
+    }
+
+    public static function sys_path()
+    {
+        $path = __DIR__.'/../';
+        return $path;
+    }
+
+    public static function url($path = '')
+    {
+        $result = api_get_path('WEB_PATH');
+        $result .= '/main/auth/shibboleth/' . $path;
+        return $result;
+    }
+
+    public static function redirect($url = '')
+    {
+        if (empty($url)) {
+            $url = isset($_SESSION['shibb_direct_url']) ? $_SESSION['shibb_direct_url'] : '';
+            unset($_SESSION['shibb_direct_url']);
+
+            /*
+             * Tests if the user tried to login directly in a protected course before to come here
+             * (this variable could be set in the modified code of /chamilo/inc/lib/main_api.lib.php)
+             *
+             * Note:
+             *       this part was added to give the possibility to access Chamilo directly on a course URL from a link diplayed in a portal.
+             *       This is not a direct Shibboleth related functionnality, but this could be used in a shibbolethized
+             *       Dokeos installation, mainly if you have a SSO system in your network.
+             *       Please note that the file /claroline/inc/lib/main_api.lib.php must be adapted to your Shibboleth settings
+             *       If any interest or question, please contact Nicolas.Rod_at_adm.unige.ch
+             *
+             */
+        }
+        if ($url) {
+            //needed to log the user in his courses. Normally it is done by visiting /chamilo/index.php
+//            $include_path = api_get_path(INCLUDE_PATH);
+//            require("$include_path/local.inc.php");
+//
+//            if (strpos($url, '?') === false) {
+//                $url = "$url?";
+//            }
+//
+//            $rootWeb = api_get_path('WEB_PATH');
+//            $first_slash_pos = strpos($rootWeb, '/', 8);
+//            $rootWeb_wo_uri = substr($rootWeb, 0, $first_slash_pos);
+//            $url = $rootWeb_wo_uri . $course_url . '_stop';
+            Redirect::go($url);
+        }
+        Redirect::home();
+    }
+
+    /**
+     *
+     * @param ShibbolethUser $shibb_user
+     */
+    public static function save($shibb_user)
+    {
+        $shibb_user->status = self::infer_user_status($shibb_user);
+        $shibb_user->status_request = self::infer_status_request($shibb_user);
+        $shibb_user->shibb_unique_id = $shibb_user->unique_id;
+        $shibb_user->shibb_persistent_id = $shibb_user->persistent_id;
+
+        $user = User::store()->get_by_shibboleth_id($shibb_user->unique_id);
+        if (empty($user)) {
+            $shibb_user->auth_source == self::NAME;
+            return User::create($shibb_user)->save();
+        }
+
+        $shibb_user->status_request = false;
+        $fields = self::config()->update_fields;
+        foreach ($fields as $key => $updatable) {
+            if ($updatable) {
+                $user->{$key} = $shibb_user->{$key};
+            }
+        }
+        $user->auth_source == self::NAME;
+        $user->shibb_unique_id = $shibb_user->shibb_unique_id;
+        $user->shibb_persistent_id = $shibb_user->shibb_persistent_id;
+        $user->save();
+        return $result;
+    }
+
+    /**
+     * Infer the rights/status the user can have in Chamilo based on his affiliation attribute
+     *
+     * @param  ShibbolethUser $user
+     * @return The Chamilo user status, one of TEACHER, STUDENT or UNKNOWN
+     */
+    public static function infer_user_status($user)
+    {
+        $affiliations = $user->affiliation;
+        $affiliations = is_array($affiliations) ? $affiliations : array($affiliations);
+
+        $map = self::config()->affiliation_status;
+
+        $rights = array();
+        foreach ($affiliations as $affiliation) {
+            $affiliation = strtolower($affiliation);
+            if (isset($map[$affiliation])) {
+                $right = $map[$affiliation];
+                $rights[$right] = $right;
+            }
+        }
+
+        $teacher_status = isset($rights[self::TEACHER_STATUS]);
+        $student_status = isset($rights[self::STUDENT_STATUS]);
+
+        //if the user has got teacher rights, we doesn't check anything else
+        if ($teacher_status) {
+            return self::TEACHER_STATUS;
+        }
+
+        if ($student_status) {
+            return self::STUDENT_STATUS;
+        }
+
+        $result = self::config()->default_status;
+        $result = (int) $result;
+        $result = ($result == Shibboleth::TEACHER_STATUS || $result == Shibboleth::STUDENT_STATUS) ? $result : Shibboleth::UNKNOWN_STATUS;
+        return $result;
+    }
+
+    /**
+     * Return true if the user can ask for a greater status than student.
+     * This happens for staff members.
+     *
+     * @param ShibbolethUser $user
+     * @return boolean
+     */
+    public static function infer_status_request($user)
+    {
+        if ($user->status == self::TEACHER_STATUS) {
+            return false;
+        }
+        if ($user->status == self::UNKNOWN_STATUS) {
+            return true;
+        }
+
+        $config = Shibboleth::config();
+        $affiliations = $user->affiliation;
+        $affiliations = is_array($affiliations) ? $affiliations : array($affiliations);
+        foreach ($affiliations as $affiliation) {
+            $result = isset($config->affiliation_status_request[$affiliation]) ? $config->affiliation_status_request[$affiliation] : false;
+            if ($result) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Sends an email to the Chamilo and Shibboleth administrators in the name
+     * of the logged-in user.
+     *
+     * @param string $subject
+     */
+    public static function email_admin($subject, $message)
+    {
+        $user = Shibboleth::session()->user();
+        $firstname = $user['firstname'];
+        $lastname = $user['lastname'];
+        $email = $user['email'];
+        $status = $user['status'];
+        $status = self::format_status($status);
+
+        $signagure = <<<EOT
+
+_________________________
+$firstname $lastname
+$email
+$status
+EOT;
+
+        $message .= $signagure;
+
+        $header = "From: $email \n";
+
+        $shibb_admin_email = Shibboleth::config()->admnistrator_email;
+        if ($shibb_admin_email) {
+            $header .= "Cc: $shibb_admin_email";
+        }
+
+        $administrator_email = api_get_setting('emailAdministrator');
+        $result = mail($administrator_email, $subject, $message);
+        return (bool) $result;
+    }
+
+}

main/auth/shibboleth/app/view/admin_login.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * Administratrive login. Useful when the standard login is not available anymore
+ * which is usually the case.
+ *
+ * This page allow administrators to log into the application using the standard
+ * Chamilo method when Shibboleth is not available.
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+$dir = __DIR__;
+include_once "$dir/../../init.php";
+
+ShibbolethController::instance()->admin_login();

main/auth/shibboleth/app/view/request.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * Display the Request another status/additional rights. The request is emailed
+ * to the shibboleth and platform administrators for processing.
+ * 
+ * Users such as staff that can be either student or teachers are presented with
+ * this page upon first login. 
+ * 
+ * Other users - teachers, students - are directly logged-in.
+ * 
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+$dir = __DIR__;
+include_once "$dir/../../init.php";
+
+ShibbolethController::instance()->request_status();

main/auth/shibboleth/app/view/shibboleth_display.class.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace Shibboleth;
+
+use \Display;
+
+/**
+ * Utility display functions tailored for the Shibboleth pluging.
+ * 
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class ShibbolethDisplay
+{
+
+    /**
+     *
+     * @return ShibbolethDisplay 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+
+    /**
+     * @param string $message
+     */
+    public function error_page($message)
+    {
+        $page_title = get_lang('ShibbolethLogin');
+
+        Display :: display_header($page_title);
+        echo Display::return_message($message, 'error');
+        Display :: display_footer();
+        die;
+    }
+    
+    /**
+     * @param string $message
+     */
+    public function message_page($message, $title = '')
+    {
+        $title = $title ? $title : get_lang('ShibbolethLogin');
+
+        Display::display_header($title);
+        echo Display::return_message($message, 'confirm');
+        Display::display_footer();
+        die;
+    }
+    
+    public function page($content, $title = '')
+    {
+        $title = $title ? $title : get_lang('ShibbolethLogin');
+
+        Display :: display_header($title);
+        echo $content;
+        Display :: display_footer();
+        die;
+    }
+
+}

main/auth/shibboleth/app/view/shibboleth_email_form.class.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace Shibboleth;
+
+/**
+ * Enter email form. When the email is mandatory and the Shibboleth email user field
+ * is empty the system display this form and ask the user to provide an email.
+ * 
+ * @todo: add email validation
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class ShibbolethEmailForm
+{
+        
+    /**
+     *
+     * @return ShibbolethEmailForm 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+
+    function display()
+    {
+        
+        $email = get_lang('Email');
+        $submit = get_lang('Submit');
+        return <<<EOT
+        <form id="email_form" action="" method="post">
+            <label for="">$email</label>
+            <input type="text" value="" tabindex="1" name="email" id="email_email" class=""><br/>
+            <input type="submit" value="$submit" tabindex="2" name="submit" id="email_submit" class="submit">
+        </form>
+        
+EOT;
+    }
+    
+    function get_email()
+    {
+        return isset($_POST['email']) ? $_POST['email'] : '';
+    }
+
+}

main/auth/shibboleth/app/view/shibboleth_status_request_form.class.php

@@ -0,0 +1,97 @@
+<?php
+
+namespace Shibboleth;
+
+use Display;
+
+/**
+ * Status request form. Display a form allowing the user to request additional
+ * rights/ another status. 
+ *
+ * @license see /license.txt
+ * @author Laurent Opprecht <laurent@opprecht.info>, Nicolas Rod for the University of Geneva
+ */
+class ShibbolethStatusRequestForm
+{
+
+    /**
+     *
+     * @return ShibbolethStatusRequestForm 
+     */
+    public static function instance()
+    {
+        static $result = false;
+        if (empty($result))
+        {
+            $result = new self();
+        }
+        return $result;
+    }
+
+    function display()
+    {
+        if ($this->is_submitted() && $this->get_reason() == '')
+        {
+            $reason_is_mandatory = get_lang('ReasonIsMandatory');
+            echo Display::return_message($reason_is_mandatory, 'error');
+        }
+
+        $status_request_message = get_lang('StatusRequestMessage');
+        $label_new_status = get_lang('NewStatus');
+        $label_reason = get_lang('Reason');
+        $label_ok = get_lang('Ok');
+        $label_cancel = get_lang('Cancel');
+
+        $user = Shibboleth::session()->user();
+        $items = array();
+        if ($user['status'] == Shibboleth::UNKNOWN_STATUS)
+        {
+            $items[Shibboleth::STUDENT_STATUS] = get_lang('Student');
+        }
+        $items[Shibboleth::TEACHER_STATUS] = get_lang('Teacher');
+        $status_options = '';
+        foreach ($items as $key => $value)
+        {
+            $status_options.= "<option value=\"$key\">$value</option>";
+        }
+
+        return <<<EOT
+            <div id="askAccountText">
+                <p>$status_request_message</p>
+            </div>
+            <form method="post" action="request.php" id="status_request_form">
+    
+                <input type="hidden" name="formPosted" value="true"/>
+    
+            <label for="status">$label_new_status:</label>
+            <select name="status">
+                    $status_options
+            </select>
+            <label for="reason">$label_reason:</label>
+            <textarea name="reason" style="min-width:400px; min-height:100px;"></textarea>
+            <p><input name="submit" type="submit" value="$label_ok" style="margin-right:10px;"/><input name="cancel" type="submit" value="$label_cancel" /></p>
+            </form>
+EOT;
+    }
+
+    public function is_submitted()
+    {
+        return isset($_POST['submit']) ? $_POST['submit'] : false;
+    }
+
+    public function cancelled()
+    {
+        return isset($_POST['cancel']) ? $_POST['cancel'] : false;
+    }
+
+    function get_reason()
+    {
+        return isset($_POST['reason']) ? $_POST['reason'] : '';
+    }
+
+    function get_status()
+    {
+        return isset($_POST['status']) ? $_POST['status'] : '';
+    }
+
+}