<?

/*

 * This script will serve as a drop in wind authenticatorizor
   for session oriented pages.

 * Instructions for use:
   * Change 1 line in the login form so that your particular realm or service
     is the one used.
   * Prompt the user to login.  The primitive login form included does this, 
     but there are much more elegant ways.
   * Change the authorized user stanzas to reflect your desired userbase.

   * Use the session variables in your own scripts.  The variables set are:

     $UNI
     $kitten_email
     $kitten_userlevel
     $kitten_loggedin

 * Last modified by: ed2019@columbia.edu , credits to benno@columbia.edu and others.
 * Copyright Columbia University 2003.

 * To do: Change the primitive die messages to become error messages that could be caught later
 * for more sophisticated error handling.

*/

$wind_server = "www1.columbia.edu";
$wind_login_uri = "/sec-cgi-bin/wind/login";
$wind_validate_uri = "/sec-cgi-bin/wind/validate";

$UNI = 0; // Your Columbia Universal Network Identifier
$kitten_email = "";
$kitten_loggedin = FALSE;
$kitten_userlevel = 0;

session_start();

list($UNI, $kitten_email, $kitten_userlevel, $kitten_loggedin) = refresh_session_variables();

if($_GET["user_action"]) {
  $user_action = $_GET["user_action"];
} elseif($_POST["user_action"]) {
  $user_action = $_POST["user_action"];
}

//  BEGIN LOGIN PROCESSING if necessary

if ($user_action == "login") {
  // If the user wants to login, check to see if they have a ticket.
  if($_GET["ticketid"]) {
    // If they have a ticket, validate it against the wind server.
    $validate = "https://$wind_server$wind_validate_uri?ticketid=" . $_GET["ticketid"];   
    $ch = curl_init("$validate");
    // Tell curl_exec to return the page instead of passing it to stdout
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    // Enable SSL verification
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);

    if($ch) {
      $answer = curl_exec($ch);
      curl_close($ch);
      
      list($authed, $user, $junk) = preg_split("/[\s]/", $answer, 3);
	// $authed will be "yes" or "no".  If "yes", $user will be the username.
      if($authed == "yes"){
	// die('yes, we are authenticated<br>\n');
	$authenticated = TRUE;
	$UNI = $user;

	}
    } else {
      die("Wind Authentication failed, Please try again later.\n");
    }
  }
  // At this point, if authentication was successful, $authenticated and $UNI are set
  // If unsuccessful, $authenticated is false.

  if ($authenticated == TRUE) {
    /*
       These per user stanzas are hokey, but this is version .1
       format as follows:
    
    if($UNI == "some_uni_here"){
      $kitten_loggedin = TRUE;
      $kitten_email = "$UNI" . "@columbia.edu";
      $kitten_userlevel = numerical_user_permission_level;
    } 
    else if($UNI == "some_other_uni"){  // Stanza 2, repeat as necessary.
      $kitten_loggedin = TRUE;
      $kitten_email = "$UNI" . "@columbia.edu";
      $kitten_userlevel = another_permission_level;
    } 
    else die("Only authorized users may use this service. \n");

    */
    if($UNI == "ed2019"){
      $kitten_loggedin = TRUE;
      $kitten_email = "$UNI" . "@columbia.edu";
      $kitten_userlevel = 10;
    } else if($UNI == "gfg1"){
      $kitten_loggedin = TRUE;
      $kitten_email = "$UNI" . "@columbia.edu";
      $kitten_userlevel = 10;
    } else if($UNI == "andrew0"){
      $kitten_loggedin = TRUE;
      $kitten_email = "$UNI" . "@columbia.edu";
      $kitten_userlevel = 10;
    } else {
      die("Only authorized users may use this service. \n");
    }

    $_SESSION["UNI"] = $UNI;
    $_SESSION["kitten_email"] = $kitten_email;
    $_SESSION["kitten_userlevel"] = $kitten_userlevel;
    $_SESSION["kitten_loggedin"] = $kitten_loggedin;
  }
} 

// At this point, if the user had a valid ticket and was authorized, the session variables are set and he is
// logged in.

// END LOGIN PROCESSING

// BEGIN LOGOUT PROCESSING

elseif ($user_action == "logout") {
  session_destroy();
  $kitten_loggedin = false;
  $kitten_uid = 0;
  $kitten_email = "";
  $kitten_userlevel = 0;
}

// END LOGOUT PROCESSING

// Simple login form

function login_form($target){
  $wind_server = "www1.columbia.edu";
  $wind_login_uri = "/sec-cgi-bin/wind/login";
  $wind_validate_uri = "/sec-cgi-bin/wind/validate";
  // Change this line to reflect your particular realm.
  $wind_realm = "sysmanual";
  
  if($_SERVER["SERVER_PORT"] == 443) {
    $server_protocol = "https";
  } else {
    $server_protocol = "http";
  }
  
  $destination = $server_protocol . "://" . $_SERVER["SERVER_NAME"] . ":"
    . $_SERVER["SERVER_PORT"] . $_SERVER["PHP_SELF"] . "?user_action=login";

  $login_link = "https://$wind_server$wind_login_uri?service=$wind_realm&destination="
    . urlencode($destination);

  global $kitten_loggedin;
  global $kitten_email;
  global $login_error;
  
  if ($kitten_loggedin) {
    echo "You are currently logged in as <b>$kitten_email</b> "
      ."<FORM name=\"Logout\" method=\"POST\" action=\"$target\">"
      ."<input type=\"hidden\" name=\"user_action\" value=\"logout\">"
      ."<input type=\"submit\" name=\"submit\" value=\"Logout\"></FORM>";
  } else { 
    echo "You must login to use this page.<a href=\"$login_link\">Click here to login.</a>";
  }
}

// End login form

// Refresh the session variables into the current scope.

function refresh_session_variables(){

  if(!isset($_SESSION["kitten_email"])) {
    $_SESSION["kitten_email"] = "";
  }
  if(!isset($_SESSION["UNI"])) {
    $_SESSION["UNI"] = 0;
  }
  if(!isset($_SESSION["kitten_userlevel"])){
    $_SESSION["kitten_userlevel"] = 0;
  }
  
  $UNI = $_SESSION["UNI"];
  $kitten_email = $_SESSION["kitten_email"];
  $kitten_userlevel = $_SESSION["kitten_userlevel"];
  
  if($kitten_userlevel > 0){
    $kitten_loggedin = TRUE;
  }
  
  return array($UNI, $kitten_email, $kitten_userlevel, $kitten_loggedin);
 
}

// End refresh

?>