diff --git a/README.md b/README.md index 66f3541d1713873be42f06395265b15953493d96..69bddb64be350b1d2382a1e023c4225b113756aa 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,15 @@ $shib_email = isset($_SERVER['HTTP_EMAIL']) ? $_SERVER['HTTP_EMAIL'] : null; $shib_groups = isset($_SERVER['isMemberOf']) ? $_SERVER['isMemberOf'] : null; $shib_group_prefix = "wiki"; +// Should pre-existing groups be deleted? +// If groups are fetched only from Shibboleth it should be true +// if memberships are granted from mediawiki User rights management +// page, it should be false +// PLEASE NOTE: with $shib_group_delete = false, in order to revoke +// a membership it should be deleted both from Shibboleth and +// User rights management page! +$shib_group_delete = false; + // The ShibUpdateUser hook is executed on login. // It has two arguments: // - $existing: True if this is an existing user, false if it is a new user being added diff --git a/ShibAuthPlugin.php b/ShibAuthPlugin.php index 1a0084b3d0a5c58bb3aef34b3b1d2816de9f3708..065756a0a6b08f9abedeef896218a293bf09862a 100644 --- a/ShibAuthPlugin.php +++ b/ShibAuthPlugin.php @@ -469,11 +469,14 @@ function ShibUserLoadFromSession($user, &$result) function ShibAddGroups($user) { global $shib_groups; global $shib_group_prefix; + global $shib_group_delete; - $oldGroups = $user->getGroups(); - foreach ($oldGroups as $group) { - $user->removeGroup($group); - } + if (isset($shib_group_delete) && $shib_group_delete) { + $oldGroups = $user->getGroups(); + foreach ($oldGroups as $group) { + $user->removeGroup($group); + } + } if (isset($shib_groups)) { foreach (explode(';', $shib_groups) as $group) {