LDAP SSO: Add the ability to SSO based on IP address range [#1992130]

My organization had a need because our site is both public and private to be able to limit single sign on to only occur if you belong to our internal IP address range. Otherwise you need to authenticate normally. So here is a patch that adds that functionality for a variety of IP range options. Sorry I don't know how to write tests so this does not include them.

Comment	File	Size	Author
#2	ldap-included-ip-sso-1992130-2.patch	8.26 KB	Agileware
	ldap-included-ip-sso.patch	8.27 KB	haydeniv

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

Comment #1

johnbarclay CreditAttribution: johnbarclay commented 7 July 2013 at 05:05

Title:

Add the ability to SSO based on IP address range

» LDAP SSO: Add the ability to SSO based on IP address range

this looks like a good patch. I'm avoiding SSO committs since I'm not on top of it.

Comment #2

Agileware CreditAttribution: Agileware commented 27 October 2014 at 23:53

Issue summary:

View changes

File	Size
ldap-included-ip-sso-1992130-2.patch	8.26 KB

Doesn't apply on 7.x-2.0-beta8
I've manually added the rejected hunks and re-rolled the patch.

Comment #3

larowlan

🇦🇺🏝.au GMT+10

CreditAttribution: larowlan at PreviousNext commented 11 March 2016 at 04:37

Status:

Needs review

» Needs work

+++ b/ldap_authentication/LdapAuthenticationConfAdmin.class.php
@@ -131,6 +131,18 @@ class LdapAuthenticationConfAdmin extends LdapAuthenticationConf {
+          you do not specify any value here, all IPs will be subject to SSO. ¶
+          This is useful if you have a site that exists both publicly and ¶

couple of trailing whitespaces here

+++ b/ldap_sso/ldap_sso.module
@@ -173,6 +179,28 @@ function ldap_sso_path_excluded_from_sso($path = FALSE) {
+ * Returns FALSE if IP ranges have been specified in ssoIncludedIps
...
+function ldap_sso_ip_included_for_sso() {

The function name should be ldap_sso_ip_excluded_for_sso based on the signature and comment

+++ b/ldap_sso/ldap_sso.module
@@ -428,3 +456,120 @@ function ldap_servers_delete_globals($global_type, $key, $only_mock_values = FAL
+class LdapSsoIpRangeMatch {

this needs tests