Add some logging and a warning about CURLOPT_VERBOSE.

plugins/wordpress-mu-plugin-fasauth/fasauth.php

@@ -6,33 +6,33 @@ Description: FAS Authentication integration plugin
 Version: 0.1.0
 Author: Fedora Infrastructure Team
 Author URI: http://fedoraproject.org/wiki/Infrastructure
-*/
+ */
 
 // overriding wp_authenticate
-if(!function_exists('wp_authenticate')) :
+if (!function_exists('wp_authenticate')) {
 
-// let's disable a few things
+    // let's disable a few things
-add_action('lost_password', 'disable_function');
+    add_action('lost_password', 'disable_function');
-add_action('retrieve_password', 'disable_function');
+    add_action('retrieve_password', 'disable_function');
-add_action('password_reset', 'disable_function');
+    add_action('password_reset', 'disable_function');
 
 
-/*
+    /*
      * Configuration Options
      */
-function fasauth_config(){
+    function fasauth_config(){
 
         $config['fas_json_url'] 		= 'https://admin.fedoraproject.org/accounts/json/person_by_username?tg_format=json';
         $config['fas_redir_pass_reset'] = 'https://admin.fedoraproject.org/accounts/user/resetpass';
         $config['fas_email_domain'] 	= 'fedoraproject.org';
 
         return $config;
-}
+    }
 
-/*
+    /*
      * FAS Authentication
      */ 
-function wp_authenticate($username, $password) {
+    function wp_authenticate($username, $password) {
 
         $config = fasauth_config();
 
@@ -44,7 +44,11 @@ function wp_authenticate($username, $password) {
         curl_setopt($ch, CURLOPT_USERAGENT, "Auth_FAS 0.9");
         curl_setopt($ch, CURLOPT_POSTFIELDS, "username=".urlencode($username)."&user_name=".urlencode($username)."&password=".urlencode($password)."&login=Login");                            
         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
+
+        # WARNING: Never leave this on in production, as it will cause
+        # plaintext passwords to show up in error logs.
         curl_setopt($ch, CURLOPT_VERBOSE, 0);
+
         $fasuserdata = json_decode(curl_exec($ch), true);
         curl_close ($ch);
 
@@ -53,6 +57,7 @@ function wp_authenticate($username, $password) {
 
             // check minimum requirements
             if (check_login_requirement($fasuserdata) !== true) {
+                fwrite(STDERR, "FAS auth failed for $username: insufficient group membership\n");
                 return new WP_Error('fasauth_min_requirement', __('<strong>Error</strong>: You do not meet minimum requirements to login.'));		
             }
 
@@ -66,41 +71,44 @@ function wp_authenticate($username, $password) {
                     return new WP_Error('fasauth_create_wp_user', __('<strong>Error</strong>: Unable to create account. Please contact the webmaster.'));		
                 }
 
+                fwrite(STDERR, "FAS auth succeeded for $username\n");
                 return new WP_User($user_id);
             }
 
             // all good, let go on
+            fwrite(STDERR, "FAS auth succeeded for $username\n");
             return new WP_User($user->ID);
 
         } else {
+            fwrite(STDERR, "FAS auth failed for $username: incorrect username or password\n");
             return new WP_Error('fasauth_wrong_credentials', __('<strong>Error</strong>: FAS login unsuccessful.'));
         }
-}
+    }
 
-/*
+    /*
      * Creates user in wp db
      */ 
-function create_wp_user($username) {
+    function create_wp_user($username) {
 
         $config = fasauth_config();
 
         $password = '';
         require_once(WPINC . DIRECTORY_SEPARATOR . 'registration.php');
         return wpmu_create_user($username, $password, $username.'@'.$config['fas_email_domain']);
-}
+    }
 
-/*
+    /*
-* Used to disable certain login functions, e.g. retrieving a
+     * Used to disable certain login functions, e.g. retrieving a
-* user's password.
+     * user's password.
-*/
+     */
-function disable_function() {
+    function disable_function() {
         die('Feature disabled.');
-}
+    }
 
-/*
+    /*
-*  checks minimum login requirements
+     *  checks minimum login requirements
-*/
+     */
-function check_login_requirement($user) {
+    function check_login_requirement($user) {
 
         $groups = $user["person"]["approved_memberships"];
         //echo "Group: ". print_r($groups);
@@ -127,8 +135,8 @@ function check_login_requirement($user) {
 
         // requirements not met
         return false;
+    }
+
 }
 
-endif;
-
 ?>