modules/netforum_authentication/netforum_authentication.module

<?php
// $Id: netforum_authentication.module,v 1.13 2009/07/11 13:42:47 jamesmichaelhill Exp $

//TODO:  There are two places still calling GetQuery w/o regard to OD or Enterprise.  One for the forgot password section,
// and one for the load section.  The load section needs to be rewritten to use the data from the login (if possible) or
// to use a separate function to get user data.  Maybe not load data on login?

// This is used for the shared SSO, since the user redirects after login we have to pause a beat before
// including the magic link in the page
if ($_SESSION['netforum_auth_link']) {
  drupal_add_link($_SESSION['netforum_auth_link']);
  unset($_SESSION['netforum_auth_link']);
}


/**
 * Implementation of hook_menu()
 */
function netforum_authentication_menu($may_cache) {
  $items = array();
  global $user;
  
  if ($may_cache) {
    $items[] = array(
      'path' => 'admin/user/netforum-authentication',
      'title' => t('netFORUM user authentication'),
      'description' => t('Set the authentication settings for netFORUM customers'),
      'callback' => 'drupal_get_form',
      'callback arguments' => array('netforum_auth_admin_settings'),
      'access' => user_access('administer site configuration'),
    );
    
    $items[] = array(
      'path' => 'admin/user/netforum-roles',
      'title' => t('netFORUM user roles'),
      'description' => t('Choose what site roles are given to netFORUM users'),
      'callback' => 'drupal_get_form',
      'callback arguments' => array('netforum_auth_role_settings'),
      'access' => user_access('administer site configuration') || user_access('administer access control'),
    );
    
    $items[] = array('path' => 'admin/settings/netforum/clearcache',
      'title' => t('Clear menu cache'),
      'callback' => 'netforum_auth_cache_clear',
      'access' => user_access('administer site configuration'),
      'type' => MENU_CALLBACK,
    );
    
    $items[] = array('path' => 'user/netforum_sso_check',
      'title' => t('netFORM Authentication Shared SSO Check'),
      'callback' => 'netforum_auth_shared_sso_check',
      'access' => true,
      'type' => MENU_CALLBACK,
    );
    
    $items[] = array('path' => 'user/netforum_sso_share',
      'title' => t('netFORM Authentication Shared SSO'),
      'callback' => 'netforum_auth_shared_sso_login',
      'access' => true,
      'type' => MENU_CALLBACK,
    );
            
    $items[] = array('path' => 'nf_od_sso_transfer',
      'title' => t('Transfer to netFORUM OD w/ SSO'),
      'callback' => 'netforum_auth_od_sso_transfer',
      'access' => true,
      'type' => MENU_CALLBACK,
    );
    
    
    //here we will overwrite some special user URLs if we want to alter the behavior, if this isn't working check the load
    // order of the modules to make sure netFORUM loads AFTER the user module.  Load order is determined by weight in the 
    //system table and it should be set automatically on installation
    if (strtolower(variable_get('netforum_auth_forgotten_password', '<drupal>')) != '<drupal>' || variable_get('netforum_auth_forgot_password_add', 0) == 1) {
      $items[] = array('path' => 'user/password', 'title' => t('Request new password'),
      'callback' => 'netforum_auth_forgotten_password_redirect', 'callback arguments' => array('user_pass'), 'access' => !$user->uid, 'type' => MENU_LOCAL_TASK);
    }
    
    if (strtolower(variable_get('netforum_auth_user_register', '<drupal>')) != '<drupal>') {
     $items[] = array('path' => 'user/register', 'title' => t('Create new account'),
      'callback' => 'netforum_auth_user_register_redirect', 'callback arguments' => '', 'access' => !$user->uid && variable_get('user_register', 1), 'type' => MENU_LOCAL_TASK);
    }
    
  }
  else{
    if ( (arg(0) == 'user' && is_numeric(arg(1)) && arg(1) > 0)  && $user !== FALSE) {
      if (strtolower(variable_get('netforum_auth_user_editing', '<drupal>')) != '<drupal>') {
       $items[] = array('path' => 'user/'. arg(1) .'/edit', 'title' => t('Edit'),
            'callback' => 'netforum_auth_user_editing_redirect', 'callback arguments' => '',
            'access' => user_access('administer users') || $user->uid == arg(1), 'type' => MENU_LOCAL_TASK);
      }
    }
  }
return $items;
}

/**
 * direct the user to the correct edit info page
 *
 * called by the user/ID/edit url if drupal is set to use an external site for editing user info
 */
function netforum_auth_user_editing_redirect() {
  global $user;
  if (netforum_is_empty_guid($user->cst_key) === false && strtolower(variable_get('netforum_auth_user_editing', '<drupal>')) != '<drupal>') {
    $loc = variable_get('netforum_auth_user_editing', '');
    if (netforum_is_team() && stristr($loc, "netforumondemand.com")) { 
      netforum_auth_od_sso_transfer($loc);
    }
    else {
      drupal_goto($loc);      
    }
  }
  else { 
    return drupal_get_form('user_edit');
  }
}

/**
 * direct the user to the correct forgot password page
 *
 * called by the user/password url if we're overwriting the default drupal behavior
 */
function netforum_auth_forgotten_password_redirect() {
  if (strtolower(variable_get('netforum_auth_forgotten_password', '<drupal>')) != '<drupal>') {
    drupal_goto(variable_get('netforum_auth_forgotten_password', ''));
  }
  elseif (variable_get('netforum_auth_forgot_password_add', 0) == 1) {
    return drupal_get_form('netforum_auth_user_pass');
  }
  else {
    return drupal_get_form('user_pass');
  }
}

/**
 * direct the user to the correct registration page
 *
 * called by the user/register url if we're overwriting the default drupal behavior
 */
function netforum_auth_user_register_redirect() {
  if (strtolower(variable_get('netforum_auth_user_register', '<drupal>')) != '<drupal>') {
    drupal_goto(variable_get('netforum_auth_user_register', ''));
  }
  else {
    return drupal_get_form('user_register');
  }
}


/**
 * The user password form 
 *
 * This is called by the netforum_auth_forgotten_password_redirect function if they want to allow users who have
 * not logged in to request a password.  Really we overwrite it because we want our own validation form.
 * @ingroup forms
 */
function netforum_auth_user_pass() {
  $form = user_pass() ;
  $form['#validate'] = array('netforum_auth_user_pass_validate' => array());
  $form['#submit'] = array('user_pass_submit' => array());
  return $form;
}

/**
 * Add the user if they exist in netFORUM when validating the login form
 *
 * This is a modified version of the regular user_pass_validate function that
 * does the additional step of checking to see if the user exists in netFORUM, and if they do
 * then it creates a new drupal user and declares netforum_authentication to be the authentication
 * module.  That way they can reset their password if using drupal's password reset function
 */
function netforum_auth_user_pass_validate($form_id, $form_values) {
  $name = $form_values['name'];
  $account = user_load(array('mail' => $name, 'status' => 1));
  if (!$account) {
    $account = user_load(array('name' => $name, 'status' => 1));
  }
  if (!$account) {
    $eml_field = _netforum_auth_get_email_field('Customer');
    $query = array('szObjectName' => 'Customer @TOP 1',
        'szColumnList' => 'cst_type, cst_web_login, '. $eml_field,
        'szWhereClause' => "(". $eml_field ."  = '$name' OR cst_web_login = '$name')",
        'szOrderBy' => '');
    $response = netforum_xweb_request('GetQuery', $query);
    if ($response && $response->attributes()->recordReturn == 1) {
      $cst_obj = $response->CustomerObject;
      $cst_name = (string)$cst_obj->cst_web_login;
      $cst_mail = (string)$cst_obj->{$eml_field};
      $cst_type = (string)$cst_obj->cst_type;
      $cst_key = (string)$cst_obj->cst_key;
      
      if (empty($cst_name)) {
        $cst_name = $cst_mail;
      }
      //adapted from user_authenticate in the user module to add a new user
      $userinfo = array('name' => $cst_name, 'mail' => $cst_mail, 'pass' => user_password(), 'cst_key' => $cst_key, 'cst_type' => $cst_type, 'init' => $name, 'status' => 1 );
      $userinfo["authname_netforum_authentication"] = $name;
      $account = user_save('', $userinfo);
      watchdog('user', t('New external user: %user using module %module.', array('%user' => $name, '%module' => 'netforum_authentication')), WATCHDOG_NOTICE, l(t('edit'), 'user/'. $user->uid .'/edit'));
    }
  }
  if ($account->uid) {
    form_set_value(array('#parents' => array('account')), $account);
  }
  else {
    form_set_error('name', t('Sorry, %name is not recognized as a user name or an email address.', array('%name' => $name)));
  }
}


/**
 * Define the admin settings form
 * @ingroup forms
 */
function netforum_auth_admin_settings() {
  $form['settings'] = array(
    '#title' => "User authentication settings",
    '#type' => 'fieldset',
    '#description' => t("Determine what parts of user authentication and information drupal is responsible for."),
  );
  
  $form['settings']['netforum_auth_user_register'] = array(
    '#title' => t('New User Registration'),
    '#type' => 'textfield',
    '#description' => t('Enter the URL users should be redirected to when they click on create new account.  This can be an external URL or a drupal node, such as node/newuserinfo.  Enter &lt;drupal&gt; to use the defaul drupal new user screen'),
    '#size' => 40,
    '#required' => TRUE,
    '#default_value' => variable_get('netforum_auth_user_register', '<drupal>'),
  );

  $form['settings']['netforum_auth_forgotten_password'] = array(
    '#title' => t('Forgotten Passwords'),
    '#type' => 'textfield',
    '#description' => t('Enter the URL users should be redirected to to reset their password, or &lt;drupal&gt; to use built in functionality at user/password.'),
    '#size' => 40,
    '#required' => TRUE,
    '#default_value' => variable_get('netforum_auth_forgotten_password', '<drupal>'),
  );

  $form['settings']['netforum_auth_forgot_password_add'] = array(
    '#title' => t('Search netFORUM for users with forgotten passwords'),
    '#type' => 'checkbox',
    '#description' => t('If using drupal for forgotten passwords, should Drupal check both local users and netFORUM when looking for usernames?  If this is not checked only users who have already logged in can reset their password with Drupal.  '),
    '#size' => 40,
    '#default_value' => variable_get('netforum_auth_forgot_password_add', 0),
  );  

  $form['settings']['netforum_auth_user_editing'] = array(
    '#title' => t('Edit User info'),
    '#type' => 'textfield',
    '#description' => t('Enter the URL users should be redirected to to edit their information, or &lt;drupal&gt; to use built in functionality.  Note that this includes setting passwords and email addresses by default.  '),
    '#size' => 40,
    '#required' => TRUE,
    '#default_value' => variable_get('netforum_auth_user_editing', '<drupal>'),
  );
  
  if (netforum_is_team()) {
    $form['settings']['netforum_auth_user_text'] = array(
      '#title' => t('Edit User notes'),
      '#type' => 'textarea',
      '#description' => t('If the edit user info URL above is set to &lt;drupal&gt;, this block of text will appear at the top of the user edit info form instead of the username and password.  Use this space to provide notes and links to locations where users should edit their username and password if desired.'),
      '#default_value' => variable_get('netforum_auth_user_text',''),
    );
    
    $form['settings']['netforum_auth_user_editing']['#description'] .= t('<b>Note:</b>  netFORUM On Demand cannot update user information, no changes to user name or password will be allowed on the drupal form.');
    $form['settings']['netforum_auth_forgot_password_add']['#description'] .= t('<b>Note:</b>  netFORUM On Demand cannot update user information, no changes to user name or password will be allowed on the drupal form.');
  }
  
  $form['settings']['cache_clear'] = array(
    '#title' => 'Menu troubleshooting',
    '#type' => 'item',
    '#description' => t('If the settings above are not working properly try '. l(t('clearing the menu cache'), 'admin/settings/netforum/clearcache')),
  );  

  //Enterprise only
  if (netforum_is_enterprise()) {    
    $form['sso'] = array(
      '#title' => "Single Sign On settings",
      '#type' => 'fieldset',
      '#description' => t("Which eWeb sites should a user automatically be logged on to when logged in to drupal?"),
    );
    
    $form['sso']['netforum_auth_eweb_sso'] = array(
      '#title' => t('eWeb Sites'),
      '#type' => 'checkboxes',
      '#description' => t('Select all to log users onto every eweb site in netFORUM or pick only the sites you want'),
      '#options' => array_merge(array('ALL' => 'All eweb sites'), netforum_auth_eweb_sites()),
      '#default_value' => variable_get('netforum_auth_eweb_sso', array()),
    );
  
    $form['sso']['netforum_auth_cookie_domain'] = array(
      '#title' => t('SSO Cookie domain'),
      '#type' => 'textfield',
      '#description' => t('To use SSO both eWeb and your drupal installation must share the same top level domain (tld).  For example, if you have drupal running www.example.com then the address for eWeb needs to be something that ends in example.com like store.example.com and this field should be set to .example.com'),
      '#size' => 40,
      '#default_value' => variable_get('netforum_auth_cookie_domain', $_SERVER['HTTP_HOST']),
    );
  
    $form['sso']['netforum_auth_sso_logout_url'] = array(
      '#title' => t('SSO logout URL'),
      '#type' => 'textfield',
      '#description' => t('When a user logs out of drupal any netFORUM cookies set for the domain above will be deleted, but the user can also be directed to a url that will log them out of eWeb such as http://eweb.example.com/eWeb/Logout.aspx .  If this is set to &lt;drupal&gt; then only the cookies will be removed, and the user will be logged out of eWeb when they close the browser.'),
      '#validate' => array('netforum_valid_sso_logout' => array()),
      '#size' => 40,
      '#default_value' => variable_get('netforum_auth_sso_logout_url', '<drupal>'),
    );
    
    /*
    NOTE:  This was added in response to http://drupal.org/node/454578 - although current testing suggests the old style
           of setting the login and pw to the modified md5 plaintext password still works with the current version of netforum
    */
    $form['sso']['pw_encryption'] = array(
      '#title' => "Custom SSO Encryption Key",
      '#type' => 'fieldset',
      '#description' => t("For netFORUM 2.2 and above, these fields depend on the eWebUserPasswordCookieEncryptionKey setting in eweb/web.config.  Leave blank to use the pre-2.2 style of SSO."),
    );
    $form['sso']['pw_encryption']['netforum_auth_custom_password_encryption_key'] = array(
      '#title' => t('AES Key'),
      '#type' => 'textfield',
      '#description' => t('The encryption key should be the Base 64 encoded.  It must be generated for you based on the value of the eWebUserPasswordCookieEncryptionKey.  '),
      '#size' => 40,
      '#required' => FALSE,
      '#default_value' => variable_get('netforum_auth_custom_password_encryption_key', ''),
    );
    $form['sso']['pw_encryption']['netforum_auth_custom_password_encryption_iv'] = array(
      '#title' => t('AES Initialization Vector (IV)'),
      '#type' => 'textfield',
      '#description' => t('The IV should also be Base 64 encoded and shorter than the key.'),
      '#size' => 30,
      '#required' => FALSE,
      '#default_value' => variable_get('netforum_auth_custom_password_encryption_iv', ''),
    );
    
    
    $form['sso']['netforum_auth_shared_sso'] = array(
      '#title' => t('Allow other drupal sites to share this domain for SSO'),
      '#type' => 'checkbox',
      '#description' => t("Sometimes users might log into another website running Drupal with a different domain than eWeb, in that case SSO won't work.  Checking this will allow other websites to use this site and domain for logging in to eWeb."),
      '#default_value' => variable_get('netforum_auth_shared_sso', 0),
    );
  
    $form['sso']['netforum_auth_shared_sso_secret'] = array(
      '#title' => t('Shared secret password'),
      '#type' => 'textfield',
      '#description' => t('Both sites sharing a domain for SSO must have the same shared secret password.  This is used to help ensure that only authorized sites can log users on.'),
      '#default_value' => variable_get('netforum_auth_shared_sso_secret', ''),
      '#size' => 40,
    );
  
    $form['sso']['netforum_auth_shared_sso_url'] = array(
      '#title' => t('Shared SSO url'),
      '#type' => 'textfield',
      '#description' => t('To use another website for eWeb SSO, enter the URL of the site here.  The website must also have netFORUM Authentication enabled, a shared key, and allowing other sites must be checked.  The cookie domain and eweb site settings listed above will be ignored, and the settings on the remote site will be used instead.'),
      '#default_value' => variable_get('netforum_auth_shared_sso_url', ''),
      '#size' => 40,
    );
  }

  return system_settings_form($form);
}

function netforum_auth_admin_settings_validate($form_id, $form_values) {
  if (($form_values['netforum_auth_shared_sso'] == 1 || $form_values['netforum_auth_shared_sso_url'] != '') && trim($form_values['netforum_auth_shared_sso_secret']) == '' ) {
    form_set_error('netforum_auth_shared_sso_secret', t('The shared secret is required when using this domain for shared sso'));
  }
  else {
    $secret_okay = true;
  }
  
  if (trim($form_values['netforum_auth_shared_sso_url']) != ''  && substr($form_values['netforum_auth_shared_sso_url'], 0, 7) != 'http://' && substr($form_values['netforum_auth_shared_sso_url'], 0, 8) != 'https://') {
    form_set_error('netforum_auth_shared_sso_url', t('Shared SSO url must start with http:// or https://'));
  }
  else {
    $url_okay = true;
  }
  
  if ( $secret_okay === true && $url_okay === true && trim($form_values['netforum_auth_shared_sso_url']) != ''  ) {
    if (ini_get('allow_url_fopen')) {
      $check_url = $form_values['netforum_auth_shared_sso_url'];
      if (substr($check_url, -1) != '/') {
        $check_url .= "/";
      }
      $token = md5("netFORUMAUTHINTERNAL". $form_values['netforum_auth_shared_sso_secret']);
      $check_url .= "user/netforum_sso_check/". $token;
      $remote_site_response = file_get_contents($check_url);
      if (stristr($remote_site_response, "<checkresult>1</checkresult>") === FALSE) {
        form_set_error('form', t("The shared SSO site either could not be reached or the shared secret didn't match."));
      }
    }
  }
  
  if (trim($form_values['netforum_auth_custom_password_encryption_key']) != '' || trim($form_values['netforum_auth_custom_password_encryption_iv']) != '') {
    $key = trim($form_values['netforum_auth_custom_password_encryption_key']);
    $iv = trim($form_values['netforum_auth_custom_password_encryption_iv']);

    # TODO:  The two else statements should check for appropriate key length, but mb_strlen is returning less than expected.  Instead we
    # run one test encryption to see if it works.  If there are errors Drupal will catch and display them.
    netforum_aes_encrypt("test", $key, $iv);


    if ($key == '') {
      form_set_error('netforum_auth_custom_password_encryption_key', t('SSO key cannot be blank if SSO IV is set'));
    }    
    // else {
    //   $keylen = mb_strlen(base64_decode($key));
    //   if ($keylen != 32) {
    //     form_set_error('netforum_auth_custom_password_encryption_key', t('SSO key is the wrong size, 32 bytes expected but %size found after decoding.', array('%size' => $keylen)));
    //   }
    // }
    
    if ($iv == '') {
      form_set_error('netforum_auth_custom_password_encryption_iv', t('SSO IV cannot be blank if SSO key is set'));
    }
    // else {
    //   $keylen = mb_strlen(base64_decode($iv));
    //   if ($keylen != 16) {
    //     form_set_error('netforum_auth_custom_password_encryption_iv', t('SSO IV is the wrong size, 16 bytes expected but %size found after decoding.', array('%size' => $keylen)));
    //   }
    // }
    
  }
  
  if (strtolower($form_values['netforum_auth_user_register']) != '<drupal>' || strtolower($form_values['netforum_auth_forgotten_password']) != '<drupal>' || strtolower($form_values['netforum_auth_user_editing']) != '<drupal>') {
    cache_clear_all('*', 'cache_menu', TRUE);
  }
}

/**
 * The form describing netforum user roles
 *
 * @ingroup forms
 */
function netforum_auth_role_settings() {
  $ignore_roles = netforum_auth_ignore_roles();
  
  $form['desc'] = array(
    '#type' => 'item',
    '#description' => t('For each of the following roles on the drupal website, identify which individual or organizations should receive those roles'),
  );
  
  $form['#submit'] = array('netforum_auth_role_settings_submit' => array());
  
  $categories = netforum_auth_categories();
  $netforum_auth_roles = variable_get('netforum_auth_roles', array_keys(user_roles(1)));
  // This iterates only on the roles we are NOT ignoring, by default this is authenticated and anonymous
  foreach (array_diff_key(user_roles(), $ignore_roles) as $rid => $role) {
    $form[$rid] = array(
      '#title' => $role,
      '#type' => 'fieldset',
      '#description' => t("Which netFORUM users are assigned to the drupal site role %role ?", array('%role' => $role) ),
      '#collapsible' => TRUE, 
      '#collapsed' => TRUE,
    );
    $form[$rid]["netforum_auth_roles_$rid"] = array(
      '#title' => 'netFORUM Types',
      '#type' => 'checkboxes',
      '#options' => $categories,
      '#default_value' => $netforum_auth_roles[$rid],
    );
  }
  
  $form['buttons']['submit'] = array('#type' => 'submit', '#value' => t('Save configuration') );
  $form['buttons']['reset'] = array('#type' => 'submit', '#value' => t('Reset to defaults') );

  if (!empty($_POST) && form_get_errors()) {
    drupal_set_message(t('The settings have not been saved because of the errors.'), 'error');
  }
  $form['#base'] = 'system_settings_form';
  
  return $form;
}

function netforum_auth_role_settings_submit($form_id, $form_values) {
  $netforum_auth_roles = array();
  
  foreach (array_diff_key(user_roles(), netforum_auth_ignore_roles()) as $rid => $role) {
    $element = 'netforum_auth_roles_'. $rid;
    $netforum_auth_roles[$rid] = array();
    if (isset($form_values[$element]) && is_array($form_values[$element])) {
      foreach ($form_values[$element] as $key => $check_val) {
        if ((string)$key == (string)$check_val) {
          $netforum_auth_roles[$rid][] = $key;
        }
      }
    }
  }
  
  variable_set('netforum_auth_roles', $netforum_auth_roles);
  drupal_set_message(t('The configuration options have been saved.'));
}

/**
 * Validate the sso logout url option
 */
function netforum_valid_sso_logout($form = null) {
  if ($form == null) {
    return;
  }
  $url = $form['#post']['netforum_auth_sso_logout_url'];
  if (strtolower(trim($url)) != '<drupal>' && valid_url($url, true) == false) {
    form_set_error('netforum_auth_sso_logout_url', t('Valid sso logout URL required'));
  }
}

/**
 * clear the menu cache and redirect to netforum settings
 *
 */
function netforum_auth_cache_clear() {
  cache_clear_all('*', 'cache_menu', TRUE);
  drupal_set_message(t('Menu cache cleared.'));
  drupal_goto('admin/settings/netforum');
}

/**
 * Confirm that this site is available for shared sso and that the shared secret is valid
 *
 */
function netforum_auth_shared_sso_check($token = '') {
  $passed_check = false;
  if (variable_get('netforum_auth_shared_sso', 0) != 0 && variable_get('netforum_auth_shared_sso_secret', '') != '') {
    $internal_token = md5("netFORUMAUTHINTERNAL". variable_get('netforum_auth_shared_sso_secret', ''));
    if ($internal_token == $token) {
      $passed_check = true;
    }
  }
  print "<checkresult>". $passed_check ."</checkresult>";
  exit;
}


/**
 * Find the username and password for the individual and log them into eweb
 *
 * We use two tokens to save a DB/xweb hit where not necessary, one for the password one for the cst_id
 * 
 * Enterprise only.
 */
function netforum_auth_shared_sso_login($cstid = '', $cstid_token = '', $pw_token = '') {
  $allow_logins = variable_get('netforum_auth_shared_sso', 0);
  $shared_secret = variable_get('netforum_auth_shared_sso_secret', '');
  if ($allow_logins != 0 && $shared_secret != '' && $cstid != '' && $cstid_token != '') {
    $cstid_internal_token = _netforum_auth_make_cstid_token($cstid);
    if ($cstid_internal_token == $cstid_token) {
      $account = new stdClass();
      $res = db_query("SELECT cst_key, cst_id, cst_web_password FROM {users} WHERE cst_id = '%s'", $cstid);
      if (db_num_rows($res) >= 0) {
        while ($account = db_fetch_object($res)) {
          if (_netforum_auth_match_password_token($account->cst_web_password, $pw_token) ) {
            $account->name = $account->cst_id;
            $found_user = true;
            break;
          }
        }
      }
      else {
        $arguments = array(
          'szObjectName' => "Customer",
          'szColumnList' => "cst_id, cst_web_password",
          'szWhereClause' => "cst_id = \'". $cstid ."\'",
          'szOrderBy' => "",
        );
        $response = netforum_xweb_request('GetQuery', $arguments);
        if ($response && $response->attributes()->recordReturn > 0) {
          foreach ($response->CustomerObject as $cst) {
            if (_netforum_auth_match_password_token($cst->cst_web_password, $pw_token)) {
              $found_user = true;
              $account->cst_key = (string)$cst->cst_key;
              $account->cst_web_password = (string)$cst->cst_web_password;
              $account->cst_id = $cstid;
              $account->name = $cstid;
            }
          }
        }
      }
      if ($found_user === true) {
        netforum_auth_eweb_sso_login($account);
      }
    }
  }
  print "<!--";
  exit;
}

/**
 * Take a customer ID and turn it into a unique token
 *
 */
function _netforum_auth_make_cstid_token($cstid = ''){
  return md5(variable_get('netforum_auth_shared_sso_secret', '') ."evensalt". $_SERVER['REMOTE_ADDR'] .'FreeTokensforall!'. $cstid ."nfautthcstid");
}

/**
 * Take a password and turn it into a unique token
 *
 */
function _netforum_auth_make_password_token($cst_web_password = '', $timestamp = ''){
  if ($timestamp == '') {
    $timestamp = time();
  }
  return md5('nfauthpwstr'. $cst_web_password .'oddsalt'. $_SERVER['REMOTE_ADDR'] .'goodfornow'. $timestamp ."looooongstringsalt!". variable_get('netforum_auth_shared_sso_secret', ''));
}

/**
 * Find out if the password matches a recently generated token
 *
 * for the tokens to match they must be generated within 20 seconds of each other and requsted by the same host/ip address
 */
function _netforum_auth_match_password_token($cst_web_password, $token) {
  $seconds_back = 10;
  $timestamp = time();
  $match = false;
  for ($i = 0; $i <= $seconds_back ; $i++) {
    $internal_token = _netforum_auth_make_password_token($cst_web_password, ($timestamp - $i));
    if ($internal_token == $token) {
      $match = true;
      break;
    }
  }
  return $match;
}

/**
* Implementation of hook_auth() 
 *
 * uses xWeb to get an auth token, returns true if the token is set,
 * false if the token is empty (eg, all zeroes)
 *
 * Also intercepts all login requests with an email address associated and 
 * authenticates against netFORUM.  Local users should have no @ sign in their
 * username
 */
function netforum_authentication_auth($username, $password, $server) {  
  global $_netforum_auth_password_plain;
  $_netforum_auth_password_plain = $password;
  if ($server != '') {
    $username .= "@$server";
  }
  
  //If we are using OD skip the rest of our function and let the OD function handle it.
  if (netforum_is_team()) {
    return _netforum_authentication_auth_od($username, $password);
  }
  
  $result = netforum_xweb_request("WebLogin", array("userLoginPlain" => $username,
      "passwordPlain" => $password,
      "keyOverride" => ""));
		
  if (is_null($result) || isset($result->WebLoginResult) === false ) {
    //try local authentication juuuust in case xWeb is unavailable
    if (_netforum_authentication_auth_local($username, $password)) {
      return true;
    }
    else {
      drupal_set_message(t('Could not communicate with authentication server, please try again in a few minutes'), 'error');
      watchdog('netforum', t("Could not authenticate user %username because the xweb query returned a null result - is the server available and responsive?", array('%username' => $username)), WATCHDOG_ERROR);
      return false;
    }
  }
  
  
  $auth_token = $result->WebLoginResult;

  if (netforum_is_empty_guid($auth_token)) {
    return FALSE;
  }
  else {
    global $_netforum_auth_token;
    $_netforum_auth_token = $auth_token;
    return TRUE;
  }
  
}

/**
 *  Called from netforum_authentication_auth which is the implementation of hook_auth()
 *
 * uses xWeb On Demand to verify a login, returns true a matching username and pw,
 * false if CheckeWebUser returns no records
 *
 */
function _netforum_authentication_auth_od($username, $password) {
  $result = netforum_xweb_request("CheckEWebUser", array("szEmail" => $username,
      "szPassword" => $password));
		
  if (is_null($result) ) {
    //try local authentication juuuust in case xWeb is unavailable
    if (_netforum_authentication_auth_local($username, $password)) {
      $_SESSION['_netforum_auth_eweb_pw'] = $password;
      return true;
    }
    else {
      drupal_set_message(t('Could not communicate with authentication server, please try again in a few minutes'), 'error');
      watchdog('netforum', t("Could not authenticate user %username because the xweb query returned a null result - is the server available and responsive?", array('%username' => $username)), WATCHDOG_ERROR);
      return false;
    }
  }

  if ($result->attributes()->recordReturn == 0) {
    return FALSE;
  }
  else {
    global $_netforum_auth_eweb_od_user;
    $_netforum_auth_eweb_od_user = $result->Result;
    $_SESSION['_netforum_auth_eweb_pw'] = $password; //We'll need this if they hit a link going to the netforum site
    return TRUE;
  }
}

/**
 * Authenticate a username using the local DB cache
 *
 */
function _netforum_authentication_auth_local($username, $password) {
  $result = db_query("SELECT uid FROM {users} WHERE name='%s' AND cst_web_password = '%s'", $username, netforum_auth_hash_pw($password));
  if (db_num_rows($result) > 0) {
    return true;
  }
  else {
    return false;
  }
}

/**
 * Implementation of hook_info()
 * 
 */
function netforum_authentication_info($field = 0) {
  $info['name'] = 'netFORUM';
  $info['protocol'] = 'SOAP';

  if ($field) {
    return $info[$field];
  }
  else {
    return $info;
  }
} 

/**
 * Implementation of hook_user()
 * 
 */
function netforum_authentication_user($op, &$edit, &$account, $category = NULL) {
  global $user;
  switch ($op) {
    case 'load': 
      //we do a lot on load because whenever a user is displayed, logged in, or worked with they should have the most up to date information, 
      //which means getting all of their data from netFORUM
      if (!netforum_is_empty_guid($account->cst_key)) { 
        if ($_SESSION['netforum_auth_skip_info_sync'] !== true) {
          global $_netforum_auth_already_checked_roles;
          $ignore_roles = netforum_auth_ignore_roles();
          $new_info = array();
          
          
          if ($_netforum_auth_already_checked_roles !== true) {
            $netforum_roles = netforum_auth_map_user_roles($account);
            //If there is no response from xweb we get an empty array, this is to prevent us from mistaing no response for no roles or entering an infinite update loop
            if (netforum_auth_fresh_user_categories() === true) { 
              //these are the roles that are checked off on the site's user edit page, not set via netForum.
              $sticky_roles = array();
              //no, not the delicious kind of sticky roles.
            
              if (is_array($account->netforum_auth_admin_set_roles)) {
                $sticky_roles = array_diff_key($account->netforum_auth_admin_set_roles, $netforum_roles);  //take out the roles that are being set by netforum
                $sticky_roles = array_diff_key($sticky_roles, $ignore_roles); //take out the roles like authenticated user
              
                if ($sticky_roles != $account->netforum_auth_admin_set_roles) {
                  //if the netforum roles now include a role that was sticky it's removed from the sticky roles and is no longer given to the user by the sticky roles.
                  //That way, when netforum stops returning that role, then it will also dissapear from their account.
                  $new_info['netforum_auth_admin_set_roles'] = $sticky_roles;
                }
              }
            
              //Now we need to look at the current user roles (from the db) and compare them to the combined netforum roles and sticky roles. 
              //if they are different, update the roles and save them to the database.
              $combined_roles = array();
              foreach ($sticky_roles as $k => $v) {
                $combined_roles[$k] = $v;
              }
              foreach ($netforum_roles as $k => $v){
                $combined_roles[$k] = $v;
              }
            
              //just to make sure that that the roles we're comparing are the actual values from site, eg if the name of the role was changed, 
              //we use array_walk to replace the values of our combined roles array with the freshest site values based on the id
              $site_roles = user_roles(true);
              array_walk($combined_roles, create_function('&$v, $k, &$roles', '$v = $roles[$k];'), $site_roles); 
            
              //If there is some change, store them in the database.  This way, if xWeb is unavailable we can still give the user appropriate permissions
              if ($combined_roles != array_diff_key($account->roles, $ignore_roles)) {
                $new_info['roles'] = $combined_roles;
              }
              $_netforum_auth_already_checked_roles = true;
            } //end ofthe roles checking and assigning
          }
          
          $cst_fields = netforum_auth_user_fields();
          $eml_field = _netforum_auth_get_email_field('Customer');
          if (in_array($eml_field, $cst_fields) === false) {
            $cst_fields[] = $eml_field; //make sure we grab the email address
          }
          if (in_array('cst_web_force_password_change', $cst_fields) === false) {
            $cst_fields[] = 'cst_web_force_password_change'; //make sure we check to see if they should change their pw
          }
          
          //Now that we know what fields we want, go get them
          $cst_obj = false;
          if (netforum_is_enterprise()) { //Enterprise only gets the query
            //check to see if  any of the customer fields are different from the information in the DB
            $query = Array('szObjectName' => 'Customer',
                  'szColumnList' => implode(", ", $cst_fields),
                  'szWhereClause' => "cst_key = '". $account->cst_key ."'",
                  'szOrderBy' => '');
            $response = netforum_xweb_request('GetQuery', $query, '3 seconds'); //do not look for cached results to this query longer than this request
            if ($response && $response->attributes()->recordReturn == 1) {
              $cst_obj = $response->CustomerObject;
            }
          }
          else { //This is the NF OD Section
            //For netFORUM Team/Pro/On Demand use the data returned from CheckEWebUser
            global $_netforum_auth_eweb_od_user;
      	    if (isset($_netforum_auth_eweb_od_user)) {
      	      $cst_obj = $_netforum_auth_eweb_od_user;
    	      }
    	      else {
              $query = Array('szObjectName' => 'Customer',
                    'sz' => implode(", ", $cst_fields),
                    'szWhereClause' => "cst_key = '". $account->cst_key ."'",
                    'szOrderBy' => '');
              

              $arguments = array(
                'szObjectName' => "Customer",
                'szObjectKey' => $account->cst_key,
              );
              $response = netforum_xweb_request('GetFacadeObject', $arguments, '3 seconds'); //do not look for cached results to this query longer than this request
              if ($response && $response->attributes()->recordReturn == 1) {
                $cst_obj = $response->CustomerObject;
              } 
    	      }
          }
          
          // If either of the above calls to get user data succeeded, load up the account
          if ($cst_obj) {
            $email = (string)$cst_obj->{$eml_field};
            if ($account->mail != $email ) {
              $new_info['mail'] = $email;
            }
            
            if ((int)$cst_obj->cst_web_force_password_change == 1) {
              global $_netforum_auth_must_change_pw;
              $_netforum_auth_must_change_pw = true;
            }
            
            foreach ($cst_fields as $field) {
              $field_value = (string)$cst_obj->{$field};
              if (empty($field) === false && $account->{$field} != $field_value) {
                $new_info[$field] = $field_value;
              }
            }
          }

          if (count($new_info) > 0) {
            user_save($account, $new_info);
          }
        }
      }
      break;
      
    case 'login':
      global $_netforum_auth_must_change_pw;
      
      if ($_netforum_auth_must_change_pw === true) {
        $current_path = isset($_GET['q']) ? $_GET['q'] : '';
        $edit_path = 'user/'. $account->uid .'/edit';
        if ($current_path != $edit_path && ($user->uid == $account->uid)) {
          drupal_set_message('Your password needs to be reset, please do so now by clicking '. l('here', $edit_path), 'error');
        }
      }
      //Shared SSO is Enterprise only
      if (netforum_is_enterprise() && netforum_is_empty_guid($account->cst_key) === false) {
        
        netforum_auth_eweb_sso_login();
        
        $shared_sso_url = variable_get('netforum_auth_shared_sso_url', '');
        if ($shared_sso_url != '') {
          if (substr($shared_sso_url, -1) != "/") {
            $shared_sso_url .= "/";
          }
          $cstid_token = _netforum_auth_make_cstid_token($account->cst_id);
          $pw_token = _netforum_auth_make_password_token($account->cst_web_password);
          $link_attributes = array('rel' => 'stylesheet', 'type' => 'text/css', 
              'href' => $shared_sso_url ."user/netforum_sso_share/". $account->cst_id ."/". $cstid_token ."/". $pw_token);
          $_SESSION['netforum_auth_link'] = $link_attributes;
        }
      }
      break;
      
    case 'logout': //Enterprise only
      if (netforum_is_empty_guid($account->cst_key) === false) {
        netforum_auth_eweb_sso_logout();
        unset($_SESSION['_netforum_auth_eweb_pw']);
      }
      break;
      
    case 'insert':
      global $_netforum_auth_token, $_netforum_auth_cst_key, $_netforum_auth_eweb_od_user;
      
      $nf_user_data = array(); //The goal is to populate this so we can add in the new user
      $eml_field = _netforum_auth_get_email_field('Customer');
      $needed_columns = array_unique(array('cst_type', 'cst_web_password', 'cst_id') + netforum_auth_user_fields());
      
      
      //For Enterprise netforum if we have the customer key or can get it
      if (netforum_is_empty_guid($_netforum_auth_token) === false || netforum_is_empty_guid($_netforum_auth_cst_key) === false) {
        if (netforum_is_empty_guid($_netforum_auth_token) === false) { 
          $result = netforum_xweb_request("WebValidate", array("authenticationToken" => $_netforum_auth_token));
          if (is_null($result) || isset($result->WebValidateResult) === false ) {
            drupal_set_message(t('Could not fetch netFORUM information for new user'), 'error');
            break;
          }
          else {
            $_netforum_auth_cst_key =  (string)$result->WebValidateResult;
            $_netforum_auth_token = null; //unset this so we don't keep calling xweb
          }
        }
        
        if (netforum_is_empty_guid($_netforum_auth_cst_key) === false) { 

          $query = Array('szObjectName' => 'Customer',
                  'szColumnList' => $eml_field .", ". implode($needed_columns, ", "),
                  'szWhereClause' => "cst_key = '". $_netforum_auth_cst_key ."'",
                  'szOrderBy' => '');
          $response = netforum_xweb_request('GetQuery', $query);
          if (isset($response) && $response->attributes()->recordReturn == 1) {
            $cst_obj = $response->CustomerObject;
            $nf_user_data = Array(
              'cst_key' => $_netforum_auth_cst_key,
              'mail' => (string)$cst_obj->{$eml_field},
            );
            foreach($needed_columns as $col) {
              $nf_user_data[$col] = (string)$cst_obj->{$col};
            }
            $nf_user_data['cst_web_password'] = (string)$cst_obj->cst_web_password;
          }
          else {
            $nf_user_data['cst_key'] = $_netforum_auth_cst_key;
          }
        }
	    }
	    
	    //For netFORUM Team/Pro/On Demand use the data returned from CheckEWebUser
	    if (isset($_netforum_auth_eweb_od_user)) {
	      $nf_user_data = Array(
          'cst_key' => (string)$_netforum_auth_eweb_od_user->cst_key,
          'mail' => (string)$_netforum_auth_eweb_od_user->{$eml_field},
        );
        foreach($needed_columns as $col) {
          $nf_user_data[$col] = (string)$_netforum_auth_eweb_od_user->{$col};
        }
        $nf_user_data['cst_web_password'] = (string)$_netforum_auth_eweb_od_user->cst_web_password;
	    }
	    
      
      if ($nf_user_data) {
        user_save($account, $nf_user_data);
      }
      
      
      break;
      
    case 'update':
      if ( netforum_is_empty_guid($account->cst_key) === false) { 
        if (netforum_is_enterprise()) { //We only push data back to Enterprise netforum
          $eml_field = _netforum_auth_get_email_field('Customer');
          //this array keeps key => value pairs to correspond to the netFORUM information to be updated.
          $nf_variables = array();
          if (strtolower(variable_get('netforum_auth_user_editing', '<drupal>')) == '<drupal>') {
            if (isset($edit['mail']) && $edit['mail'] != '' && $edit['mail'] != $account->mail) {
              $nf_variables[$eml_field] = $edit['mail'];
            }
            if (isset($edit['pass']) && empty($edit['pass']) === false) {
              $nf_variables['cst_web_password'] = $edit['pass'];
              $nf_variables['cst_web_force_password_change'] = 0;
              //Save cst_web_password because we use it if the user is logging in and xWeb is not available.  
              $edit['cst_web_password'] = netforum_auth_hash_pw($edit['pass']);
            }
            if (isset($edit['name']) && $edit['name'] != '' && $edit['name'] != $account->name) {
              $nf_variables['cst_web_login'] = $edit['name'];
            }
          }
          
          if (count($nf_variables) > 0) {
            $success = false; //don't assume it worked by default, this is set on success below
            if ($account->cst_type == 'Individual') { //this way customers and individuals can log in and edit info.  Beware when setting variables above that they are cst_type agnostic
              $data_node = netforum_ind_info_parameters($nf_variables);
              $response = netforum_xweb_request('SetIndividualInformation', array('IndividualKey' => $account->cst_key, 'oUpdateNode' => $data_node));
              if (isset($response) && $response->attributes()->recordReturn == 1 && $response->IndividualObject->ind_cst_key == $account->cst_key) {
                $success = true;
              }
            }
            elseif ($account->cst_type == 'Organization') {
              $data_node = netforum_org_info_parameters($nf_variables);
              $response = netforum_xweb_request('SetOrganizationInformation', array('OrganizationKey' => $account->cst_key, 'oUpdateNode' => $data_node));
              if ( isset($response) && $response->attributes()->recordReturn == 1 && $response->OrganizationObject->org_cst_key == $account->cst_key) {
                $success = true;
              }
            }
	    
            if ($success === false) {
              drupal_set_message(t('Information update failed, please try again in a few minutes.'), 'error');
              watchdog('netforum', t("Could not update user information in netFORUM for %name", array('%name' => $account->name)), WATCHDOG_ERROR);
              $path = isset($_GET['q']) ? $_GET['q'] : '';
              $query = drupal_query_string_encode($_GET, array('q'));
              if ($query != '') {
                $path .= '?'. $query;
              } 
              drupal_goto($path);
            }
            else {
              $_SESSION['netforum_auth_skip_info_sync'] = true;
            }
          }
        }

        if (isset($edit['roles']) ) {
          //keep track of any roles set in case it was set by an admin.  If the admin added a role that doesn't get set via netforum remember that and
          //add / save it in when the user is loaded.  If the role is later something gets set for this user via netforum, then when it is removed (ie, no longer
          //set via netforum) it will also be removed from the user record.  That means you can make the website override netforum, but if netforum later gives that
          //permission it will be taken away when netforum also takes it away.
           
          //what's the phrase?  Store em all and let the load sort it out?
          $edit['netforum_auth_admin_set_roles'] = $edit['roles'];
        }
      }
      
      break;
      
    case 'after_update':
      if (isset($_SESSION['netforum_auth_skip_info_sync']) && $_SESSION['netforum_auth_skip_info_sync'] === true) {
        unset($_SESSION['netforum_auth_skip_info_sync']);
      }
      break;
      
    default:
      break;
  }
}

/**
 * Fetch the netforum criteria for assigning users to groups
 *
 * This function should return an associative array of netFORUM keys and
 * descrptions that will be used to determine what drupal roles map to 
 * what netFORUM roles.  For example, member types or committes.
 *
 * To assign users to groups based on something other than membership create
 * a module that implements hook_netforum_auth_categories.
 *
 * If you use netFORUM Team or Pro use hook_netforum_auth_od_categories 
 *
 * Remember to cast all associatve array keys to strings before storing in the array
 *
 * @return
 *    Returns an associative array of unique keys corresponding to descriptions
 */
function netforum_auth_categories() {  
  $categories = array();
