diff --git a/admin/tool/oauth2/issuers.php b/admin/tool/oauth2/issuers.php
index ad720c4d5d1..4b6409f1aed 100644
--- a/admin/tool/oauth2/issuers.php
+++ b/admin/tool/oauth2/issuers.php
@@ -234,6 +234,12 @@ if ($mform && $mform->is_cancelled()) {
$addurl = new moodle_url('/admin/tool/oauth2/issuers.php', $params);
echo $renderer->single_button($addurl, get_string('imsobv2p1_service', 'tool_oauth2'));
+ // Linkedin template.
+ $docs = 'admin/tool/oauth2/issuers/linkedin';
+ $params = ['action' => 'edittemplate', 'type' => 'linkedin', 'sesskey' => sesskey(), 'docslink' => $docs];
+ $addurl = new moodle_url('/admin/tool/oauth2/issuers.php', $params);
+ echo $renderer->single_button($addurl, get_string('linkedin_service', 'tool_oauth2'));
+
// Generic issuer.
$addurl = new moodle_url('/admin/tool/oauth2/issuers.php', ['action' => 'edit']);
echo $renderer->single_button($addurl, get_string('custom_service', 'tool_oauth2'));
diff --git a/admin/tool/oauth2/lang/en/tool_oauth2.php b/admin/tool/oauth2/lang/en/tool_oauth2.php
index 1fba23480c6..f6fd074806c 100644
--- a/admin/tool/oauth2/lang/en/tool_oauth2.php
+++ b/admin/tool/oauth2/lang/en/tool_oauth2.php
@@ -96,6 +96,7 @@ $string['issueruseininternalonly'] = 'Internal services only';
$string['issueruseinloginonly'] = 'Login page only';
$string['issuerusedforlogin'] = 'Login';
$string['issuerusedforinternal'] = 'Internal services';
+$string['linkedin_service'] = 'LinkedIn';
$string['logindisplay'] = 'Display on login page as';
$string['loginissuer'] = 'Allow login';
$string['microsoft_service'] = 'Microsoft';
diff --git a/lib/classes/oauth2/api.php b/lib/classes/oauth2/api.php
index c01474eedee..3556c250350 100644
--- a/lib/classes/oauth2/api.php
+++ b/lib/classes/oauth2/api.php
@@ -428,8 +428,8 @@ class api {
}
// Get all the scopes!
$scopes = self::get_system_scopes_for_issuer($issuer);
-
- $client = new \core\oauth2\client($issuer, null, $scopes, true);
+ $class = self::get_client_classname($issuer->get('servicetype'));
+ $client = new $class($issuer, null, $scopes, true);
if (!$client->is_logged_in()) {
if (!$client->upgrade_refresh_token($systemaccount)) {
@@ -451,11 +451,33 @@ class api {
*/
public static function get_user_oauth_client(issuer $issuer, moodle_url $currenturl, $additionalscopes = '',
$autorefresh = false) {
- $client = new \core\oauth2\client($issuer, $currenturl, $additionalscopes, false, $autorefresh);
+ $class = self::get_client_classname($issuer->get('servicetype'));
+ $client = new $class($issuer, $currenturl, $additionalscopes, false, $autorefresh);
return $client;
}
+ /**
+ * Get the client classname for an issuer.
+ *
+ * @param string $type The OAuth issuer type (google, facebook...).
+ * @return string The classname for the custom client or core client class if the class for the defined type
+ * doesn't exist or null type is defined.
+ */
+ protected static function get_client_classname(?string $type): string {
+ // Default core client class.
+ $classname = 'core\\oauth2\\client';
+
+ if (!empty($type)) {
+ $typeclassname = 'core\\oauth2\\client\\' . $type;
+ if (class_exists($typeclassname)) {
+ $classname = $typeclassname;
+ }
+ }
+
+ return $classname;
+ }
+
/**
* Get the list of defined endpoints for this OAuth issuer
*
@@ -798,8 +820,8 @@ class api {
$scopes = self::get_system_scopes_for_issuer($issuer);
// Allow callbacks to inject non-standard scopes to the auth request.
-
- $client = new client($issuer, $returnurl, $scopes, true);
+ $class = self::get_client_classname($issuer->get('servicetype'));
+ $client = new $class($issuer, $returnurl, $scopes, true);
if (!optional_param('response', false, PARAM_BOOL)) {
$client->log_out();
diff --git a/lib/classes/oauth2/client.php b/lib/classes/oauth2/client.php
index 5b637531743..bc2cd05a803 100644
--- a/lib/classes/oauth2/client.php
+++ b/lib/classes/oauth2/client.php
@@ -501,6 +501,16 @@ class client extends \oauth2_client {
return false;
}
+ return $this->map_userinfo_to_fields($userinfo);
+ }
+
+ /**
+ * Maps the oauth2 response to userfields.
+ *
+ * @param stdClass $userinfo
+ * @return array
+ */
+ protected function map_userinfo_to_fields(stdClass $userinfo): array {
$map = $this->get_userinfo_mapping();
$user = new stdClass();
@@ -508,10 +518,25 @@ class client extends \oauth2_client {
// We support nested objects via a-b-c syntax.
$getfunc = function($obj, $prop) use (&$getfunc) {
$proplist = explode('-', $prop, 2);
- if (empty($proplist[0]) || empty($obj->{$proplist[0]})) {
+
+ // The value of proplist[0] can be falsey, so just check if not set.
+ if (empty($obj) || !isset($proplist[0])) {
+ return false;
+ }
+
+ if (preg_match('/^(.*)\[([0-9]*)\]$/', $proplist[0], $matches)
+ && count($matches) == 3) {
+ $property = $matches[1];
+ $index = $matches[2];
+ $obj = $obj->{$property}[$index] ?? null;
+ } else if (!empty($obj->{$proplist[0]})) {
+ $obj = $obj->{$proplist[0]};
+ } else if (is_array($obj) && !empty($obj[$proplist[0]])) {
+ $obj = $obj[$proplist[0]];
+ } else {
+ // Nothing found after checking all possible valid combinations, return false.
return false;
}
- $obj = $obj->{$proplist[0]};
if (count($proplist) > 1) {
return $getfunc($obj, $proplist[1]);
diff --git a/lib/classes/oauth2/client/linkedin.php b/lib/classes/oauth2/client/linkedin.php
new file mode 100644
index 00000000000..521dd766af8
--- /dev/null
+++ b/lib/classes/oauth2/client/linkedin.php
@@ -0,0 +1,63 @@
+.
+
+namespace core\oauth2\client;
+
+use core\oauth2\client;
+
+/**
+ * Class linkedin - Custom client handler to fetch data from linkedin
+ *
+ * Custom oauth2 client for linkedin as it doesn't support OIDC and has a different way to get
+ * key information for users - firstname, lastname, email.
+ *
+ * @copyright 2021 Peter Dias
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @package core
+ */
+class linkedin extends client {
+ /**
+ * Fetch the user info from the userinfo and email endpoint and map fields back
+ *
+ * @return array|false
+ */
+ public function get_userinfo() {
+ $user = array_merge(parent::get_userinfo(), $this->get_useremail());
+ return $user;
+ }
+
+ /**
+ * Get the email address of the user from the email endpoint
+ *
+ * @return array|false
+ */
+ private function get_useremail() {
+ $url = $this->get_issuer()->get_endpoint_url('email');
+
+ $response = $this->get($url);
+ if (!$response) {
+ return false;
+ }
+ $userinfo = new \stdClass();
+ try {
+ $userinfo = json_decode($response);
+ } catch (\Exception $e) {
+ return false;
+ }
+
+ return $this->map_userinfo_to_fields($userinfo);
+ }
+}
diff --git a/lib/classes/oauth2/service/linkedin.php b/lib/classes/oauth2/service/linkedin.php
new file mode 100644
index 00000000000..565c367aa52
--- /dev/null
+++ b/lib/classes/oauth2/service/linkedin.php
@@ -0,0 +1,106 @@
+.
+
+namespace core\oauth2\service;
+
+use core\oauth2\issuer;
+use core\oauth2\endpoint;
+use core\oauth2\user_field_mapping;
+
+/**
+ * Class linkedin.
+ *
+ * Custom oauth2 issuer for linkedin as it doesn't support OIDC and has a different way to get
+ * key information for users - firstname, lastname, email.
+ *
+ * @copyright 2021 Peter Dias
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @package core
+ */
+class linkedin implements issuer_interface {
+ /**
+ * Build an OAuth2 issuer, with all the default values for this service.
+ *
+ * @return issuer The issuer initialised with proper default values.
+ */
+ public static function init(): issuer {
+ $record = (object) [
+ 'name' => 'LinkedIn',
+ 'image' => 'https://static.licdn.com/scds/common/u/images/logos/favicons/v1/favicon.ico',
+ 'baseurl' => 'https://api.linkedin.com/v2',
+ 'loginscopes' => 'r_liteprofile r_emailaddress',
+ 'loginscopesoffline' => 'r_liteprofile r_emailaddress',
+ 'showonloginpage' => issuer::EVERYWHERE,
+ 'servicetype' => 'linkedin',
+ ];
+
+ $issuer = new issuer(0, $record);
+ return $issuer;
+ }
+
+ /**
+ * Create endpoints for this issuer.
+ *
+ * @param issuer $issuer Issuer the endpoints should be created for.
+ * @return issuer
+ */
+ public static function create_endpoints(issuer $issuer): issuer {
+ $endpoints = [
+ 'authorization_endpoint' => 'https://www.linkedin.com/oauth/v2/authorization',
+ 'token_endpoint' => 'https://www.linkedin.com/oauth/v2/accessToken',
+ 'email_endpoint' => 'https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))',
+ 'userinfo_endpoint' => "https://api.linkedin.com/v2/me?projection=(localizedFirstName,localizedLastName,"
+ . "profilePicture(displayImage~digitalmediaAsset:playableStreams))",
+ ];
+ foreach ($endpoints as $name => $url) {
+ $record = (object) [
+ 'issuerid' => $issuer->get('id'),
+ 'name' => $name,
+ 'url' => $url
+ ];
+ $endpoint = new endpoint(0, $record);
+ $endpoint->create();
+ }
+
+ // Create the field mappings.
+ $mapping = [
+ 'localizedFirstName' => 'firstname',
+ 'localizedLastName' => 'lastname',
+ 'elements[0]-handle~-emailAddress' => 'email',
+ 'profilePicture-displayImage~-elements[0]-identifiers[0]-identifier' => 'picture'
+ ];
+ foreach ($mapping as $external => $internal) {
+ $record = (object) [
+ 'issuerid' => $issuer->get('id'),
+ 'externalfield' => $external,
+ 'internalfield' => $internal
+ ];
+ $userfieldmapping = new user_field_mapping(0, $record);
+ $userfieldmapping->create();
+ }
+
+ return $issuer;
+ }
+
+ /**
+ * Linkedin does not have a discovery url that could be found. Return empty.
+ * @param issuer $issuer
+ * @return int
+ */
+ public static function discover_endpoints($issuer): int {
+ return 0;
+ }
+}
diff --git a/lib/db/install.xml b/lib/db/install.xml
index a6689d62b24..4aa9583d222 100644
--- a/lib/db/install.xml
+++ b/lib/db/install.xml
@@ -3849,7 +3849,7 @@
-
+
diff --git a/lib/db/upgrade.php b/lib/db/upgrade.php
index 450318a8f87..c405d055e24 100644
--- a/lib/db/upgrade.php
+++ b/lib/db/upgrade.php
@@ -2672,5 +2672,15 @@ function xmldb_main_upgrade($oldversion) {
upgrade_main_savepoint(true, 2021051700.03);
}
+ if ($oldversion < 2021051700.05) {
+ // Update the externalfield to be larger.
+ $table = new xmldb_table('oauth2_user_field_mapping');
+ $field = new xmldb_field('externalfield', XMLDB_TYPE_CHAR, '500', null, XMLDB_NOTNULL, false, null, 'issuerid');
+ $dbman->change_field_type($table, $field);
+
+ // Main savepoint reached.
+ upgrade_main_savepoint(true, 2021051700.05);
+ }
+
return true;
}
diff --git a/lib/tests/client_test.php b/lib/tests/client_test.php
new file mode 100644
index 00000000000..2f6a7183847
--- /dev/null
+++ b/lib/tests/client_test.php
@@ -0,0 +1,125 @@
+.
+
+/**
+ * Unit test client_test.
+ *
+ * Unit test for testable functions in core/oauth2/client.php
+ *
+ * @copyright 2021 Peter Dias
+ * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
+ * @package core
+ */
+class client_test extends advanced_testcase {
+ /**
+ * Uses the static dataset as feed-in
+ *
+ * @return array
+ */
+ public function map_response_provider(): array {
+ return [
+ "Nested objects syntax a-b-c syntax " => [
+ [
+ "name-firstname" => "firstname",
+ "contact-phone-home" => "homenumber",
+ ], [
+ "firstname" => "John",
+ "homenumber" => "020000000",
+ ]
+ ],
+ "Nested objects syntax with array support a-b[0]-c syntax " => [
+ [
+ "name-firstname" => "firstname",
+ "contact-phone-home" => "homenumber",
+ "picture[0]-url" => "urltest",
+ ], [
+ "firstname" => "John",
+ "homenumber" => "020000000",
+ "urltest" => "www.google.com",
+ ]
+ ],
+ "Nested objects syntax with array support a-b-0-c syntax " => [
+ [
+ "name-firstname" => "firstname",
+ "contact-phone-home" => "homenumber",
+ "picture-0-url" => "urltest",
+ ], [
+ "firstname" => "John",
+ "homenumber" => "020000000",
+ "urltest" => "www.google.com",
+ ]
+ ],
+ "Nested objects syntax with array support a-b-0-c syntax with non-existent nodes" => [
+ [
+ "name-firstname" => "firstname",
+ "contact-phone-home" => "homenumber",
+ "picture-0-url-url" => "urltest",
+ ], [
+ "firstname" => "John",
+ "homenumber" => "020000000",
+ ]
+ ],
+ ];
+ }
+
+ /**
+ * Test the map_userinfo_to_fields function
+ *
+ * @dataProvider map_response_provider
+ * @param array $mapping
+ * @param array $expected
+ * @throws ReflectionException
+ */
+ public function test_map_userinfo_to_fields(array $mapping, array $expected) {
+ $dataset = [
+ "name" => (object) [
+ "firstname" => "John",
+ "lastname" => "Doe",
+ ],
+ "contact" => (object) [
+ "email" => "john@example.com",
+ "phone" => (object) [
+ "mobile" => "010000000",
+ "home" => "020000000"
+ ],
+ ],
+ "picture" => [
+ [
+ "url" => "www.google.com",
+ "description" => "This is a URL",
+ ],
+ [
+ "url" => "www.facebook.com",
+ "description" => "This is another URL",
+ ]
+ ]
+ ];
+
+ $method = new ReflectionMethod("core\oauth2\client", "map_userinfo_to_fields");
+ $method->setAccessible(true);
+
+ $issuer = new \core\oauth2\issuer(0);
+ $mockbuilder = $this->getMockBuilder('core\oauth2\client');
+ $mockbuilder->onlyMethods(['get_userinfo_mapping']);
+ $mockbuilder->setConstructorArgs([$issuer, "", ""]);
+
+ $mock = $mockbuilder->getMock();
+ $mock->expects($this->once())
+ ->method('get_userinfo_mapping')
+ ->will($this->returnValue($mapping));
+ $this->assertSame($expected, $method->invoke($mock, (object) $dataset));
+ }
+}
diff --git a/version.php b/version.php
index 4bc52234b7c..295d573c7b0 100644
--- a/version.php
+++ b/version.php
@@ -29,7 +29,7 @@
defined('MOODLE_INTERNAL') || die();
-$version = 2021051700.04; // 20210517 = branching date YYYYMMDD - do not modify!
+$version = 2021051700.05; // 20210517 = branching date YYYYMMDD - do not modify!
// RR = release increments - 00 in DEV branches.
// .XX = incremental changes.
$release = '3.11+ (Build: 20210604)';// Human-friendly version name