public function WindowsAad::buildConfigurationForm in OpenID Connect Microsoft Azure Active Directory client 2.0.x

Same name and namespace in other branches

1. 8 src/Plugin/OpenIDConnectClient/WindowsAad.php \Drupal\openid_connect_windows_aad\Plugin\OpenIDConnectClient\WindowsAad::buildConfigurationForm()

Overrides OpenIDConnectClientBase::settingsForm().

Parameters

array $form: Windows AAD form array containing form elements.

\Drupal\Core\Form\FormStateInterface $form_state: Submitted form values.

Return value

array Renderable form array with form elements.

Overrides OpenIDConnectClientBase::buildConfigurationForm

File

src/Plugin/OpenIDConnectClient/WindowsAad.php, line 85

Class

WindowsAad

Generic OpenID Connect client.

Namespace

Drupal\openid_connect_windows_aad\Plugin\OpenIDConnectClient

Code

public function buildConfigurationForm(array $form, FormStateInterface $form_state) {
  $form = parent::buildConfigurationForm($form, $form_state);
  $form['enable_single_sign_out'] = [
    '#title' => $this
      ->t('Enable Single Sign Out'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['enable_single_sign_out']) ? $this->configuration['enable_single_sign_out'] : FALSE,
    '#description' => $this
      ->t('Checking this option will enable Single Sign Out to occur so long as the logout url has been set to (http(s)://yoursite.com/openid-connect/windows_aad/signout) in your Azure AD registered app settings. If a user logs out of the Drupal app then they will be logged out of their SSO session elsewhere as well. Conversely if a user signs out of their SSO account elsewhere, such as Office 365, they will also be logged out of this app.'),
  ];
  $form['authorization_endpoint_wa'] = [
    '#title' => $this
      ->t('Authorization endpoint'),
    '#type' => 'textfield',
    '#default_value' => $this->configuration['authorization_endpoint_wa'],
  ];
  $form['token_endpoint_wa'] = [
    '#title' => $this
      ->t('Token endpoint'),
    '#type' => 'textfield',
    '#default_value' => $this->configuration['token_endpoint_wa'],
  ];
  $form['map_ad_groups_to_roles'] = [
    '#title' => $this
      ->t('Map user\'s AD groups to Drupal roles'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['map_ad_groups_to_roles']) ? $this->configuration['map_ad_groups_to_roles'] : '',
    '#description' => $this
      ->t('Enable this to configure Drupal user role assignment based on AD group membership.'),
  ];

  // AD group mapping configuration field set.
  $form['group_mapping'] = [
    '#type' => 'fieldset',
    '#title' => $this
      ->t('AD group mapping options'),
    '#states' => [
      'invisible' => [
        ':input[name="clients[windows_aad][settings][map_ad_groups_to_roles]"]' => [
          'checked' => FALSE,
        ],
      ],
    ],
  ];
  $form['group_mapping']['method'] = [
    '#type' => 'radios',
    '#title' => $this
      ->t('Method for mapping AD groups to roles'),
    '#options' => [
      0 => $this
        ->t('Automatic (AD group names or ids identically match Drupal role names)'),
      1 => $this
        ->t('Manual (Specify which AD groups map to which Drupal roles)'),
    ],
    '#default_value' => !empty($this->configuration['group_mapping']['method']) ? $this->configuration['group_mapping']['method'] : 0,
    '#description' => $this
      ->t('Note: For name mapping to function the Azure AD Graph or Windows Graph APIs must be selected as a User endpoint. Otherwise only mapping based on Group Object IDs can be used.'),
  ];
  $form['group_mapping']['mappings'] = [
    '#title' => $this
      ->t('Manual mappings'),
    '#type' => 'textarea',
    '#default_value' => isset($this->configuration['group_mapping']) && isset($this->configuration['group_mapping']['mappings']) ? $this->configuration['group_mapping']['mappings'] : '',
    '#description' => $this
      ->t('Add one role|group(s) mapping per line. Role and Group should be separated by "|". Multiple groups can be mapped to a single role on the same line using ";" to separate the groups. Ideally you should use the group id since it is immutable, but the title (displayName) may also be used.'),
    '#states' => [
      'invisible' => [
        ':input[name="clients[windows_aad][settings][group_mapping][method]"]' => [
          'value' => 0,
        ],
      ],
    ],
  ];
  $form['group_mapping']['strict'] = [
    '#type' => 'checkbox',
    '#title' => $this
      ->t('Only allow users to have roles that map to an AD group they are a member of.'),
    '#default_value' => !empty($this->configuration['group_mapping']['strict']) ? $this->configuration['group_mapping']['strict'] : '',
    '#description' => $this
      ->t('Removes roles from a Drupal user account that do not map to AD groups the user is a member of. Also, with this enabled you can not grant unmapped roles to a user through the usual Drupal user/role interface such as editing a user account. Note: Only affects users with connected AD accounts.'),
  ];
  $form['userinfo_graph_api_wa'] = [
    '#title' => $this
      ->t('User info endpoint configuration'),
    '#type' => 'radios',
    '#default_value' => !empty($this->configuration['userinfo_graph_api_wa']) ? $this->configuration['userinfo_graph_api_wa'] : 0,
    '#options' => [
      0 => $this
        ->t('Alternate or no user endpoint'),
      1 => $this
        ->t('Azure AD Graph API (v1.6)'),
      2 => $this
        ->t('Windows Graph API (v1.0)'),
    ],
    '#description' => $this
      ->t('Most user/group info can be returned in the access token response through proper claims/permissions configuration for your app registration within Azure AD. If this is the case for your setup then you can choose "Alternate or no user endpoint" and leave blank the dependent "Alternate userinfo endpoint" text box. Otherwise you can choose to use the Azure AD graph API or the Windows Graph API (recommended) to retrieve user and/or graph info.'),
  ];
  $form['userinfo_endpoint_wa'] = [
    '#title' => $this
      ->t('Alternate UserInfo endpoint'),
    '#type' => 'textfield',
    '#default_value' => $this->configuration['userinfo_endpoint_wa'],
    '#states' => [
      'visible' => [
        ':input[name="clients[windows_aad][settings][userinfo_graph_api_wa]"]' => [
          'value' => 0,
        ],
      ],
    ],
  ];
  $form['userinfo_graph_api_use_other_mails'] = [
    '#title' => $this
      ->t('Use Graph API otherMails property for email address'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['userinfo_graph_api_use_other_mails']) ? $this->configuration['userinfo_graph_api_use_other_mails'] : '',
    '#description' => $this
      ->t('Find the first occurrence of an email address in the Graph otherMails property and use this as email address.'),
    '#states' => [
      'visible' => [
        ':input[name="clients[windows_aad][settings][userinfo_graph_api_wa]"]' => [
          'value' => 1,
        ],
      ],
    ],
  ];
  $form['userinfo_update_email'] = [
    '#title' => $this
      ->t('Update email address in user profile'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['userinfo_update_email']) ? $this->configuration['userinfo_update_email'] : '',
    '#description' => $this
      ->t('If email address has been changed for existing user, save the new value to the user profile.'),
  ];
  $form['hide_email_address_warning'] = [
    '#title' => $this
      ->t('Hide missing email address warning'),
    '#type' => 'checkbox',
    '#default_value' => !empty($this->configuration['hide_email_address_warning']) ? $this->configuration['hide_email_address_warning'] : '',
    '#description' => $this
      ->t('By default, when email address is not found, a message will appear on the screen. This option hides that message (as it might be confusing for end users).'),
  ];
  $form['client_secret'] = [
    '#title' => $this
      ->t('Client secret'),
    '#type' => 'key_select',
    '#default_value' => $this->configuration['client_secret'],
  ];
  return $form;
}