Skip to content
This repository was archived by the owner on Sep 19, 2022. It is now read-only.

Commit 359b04c

Browse files
BaranekDBaranekD
authored
Added extended entitlements (#138)
1 parent 0040970 commit 359b04c

File tree

8 files changed

+352
-111
lines changed

8 files changed

+352
-111
lines changed

‎CHANGELOG.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,9 @@ All notable changes to this project will be documented in this file.
33

44
## [Unreleased]
55

6+
#### Added
7+
- Added extended PerunEntitlements
8+
69
## [v4.1.1]
710
#### Fixed
811
- Fixed bad log message in PerunIdentity in mode USERONLY

‎config-templates/processFilterConfigurations-example.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,21 @@ Example how to enable/configure filter PerunEntitlement:
5757
),
5858
```
5959

60+
## PerunEntitlementExtended
61+
62+
Example how to enable/configure filter PerunEntitlement:
63+
64+
```php
65+
33 => array(
66+
'class' => 'perun:PerunEntitlementExtended',
67+
'interface' => 'ldap',
68+
'outputAttrName' => 'eduPersonEntitlementExtended',
69+
# forwarded entitlement are released by default
70+
#'releaseForwardedEntitlement' => false, OPTIONAL
71+
'forwardedEduPersonEntitlement' => 'eduPersonEntitlement',
72+
),
73+
```
74+
6075
## ForceAup
6176

6277
1.Create these attributes in Perun:

‎lib/AdapterLdap.php‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -114,13 +114,14 @@ public function getMemberGroups($user, $vo)
114114
$group = $this->connector->searchForEntity(
115115
$groupDn,
116116
'(objectClass=perunGroup)',
117-
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'description']
117+
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'uuid', 'description']
118118
);
119119
array_push(
120120
$groups,
121121
new Group(
122122
$group['perunGroupId'][0],
123123
$group['perunVoId'][0],
124+
$group['uuid'][0],
124125
$group['cn'][0],
125126
$group['perunUniqueGroupName'][0],
126127
$group['description'][0] ?? ''
@@ -154,13 +155,14 @@ public function getSpGroups($spEntityId)
154155
$group = $this->connector->searchForEntity(
155156
'perunGroupId=' . $groupId . ',perunVoId=' . $resource['perunVoId'][0] . ',' . $this->ldapBase,
156157
'(objectClass=perunGroup)',
157-
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'description']
158+
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'uuid', 'description']
158159
);
159160
array_push(
160161
$groups,
161162
new Group(
162163
$group['perunGroupId'][0],
163164
$group['perunVoId'][0],
165+
$group['uuid'][0],
164166
$group['cn'],
165167
$group['perunUniqueGroupName'][0],
166168
$group['description'][0] ?? ''
@@ -180,7 +182,7 @@ public function getGroupByName($vo, $name)
180182
$group = $this->connector->searchForEntity(
181183
'perunVoId=' . $voId . ',' . $this->ldapBase,
182184
'(&(objectClass=perunGroup)(perunUniqueGroupName=' . $name . '))',
183-
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'description']
185+
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'uuid', 'description']
184186
);
185187
if ($group === null) {
186188
throw new Exception(
@@ -190,6 +192,7 @@ public function getGroupByName($vo, $name)
190192
return new Group(
191193
$group['perunGroupId'][0],
192194
$group['perunVoId'][0],
195+
$group['uuId'][0],
193196
$group['cn'][0],
194197
$group['perunUniqueGroupName'][0],
195198
$group['description'][0] ?? ''
@@ -404,7 +407,7 @@ public function getUsersGroupsOnFacility($spEntityId, $userId)
404407
$groups = $this->connector->searchForEntities(
405408
$this->ldapBase,
406409
'(&(uniqueMember=perunUserId=' . $userId . ', ou=People,' . $this->ldapBase . ')' . $resourcesString . ')',
407-
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'description']
410+
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'uuid', 'description']
408411
);
409412

410413
foreach ($groups as $group) {
@@ -413,6 +416,7 @@ public function getUsersGroupsOnFacility($spEntityId, $userId)
413416
new Group(
414417
$group['perunGroupId'][0],
415418
$group['perunVoId'][0],
419+
$group['uuid'][0],
416420
$group['cn'][0],
417421
$group['perunUniqueGroupName'][0],
418422
$group['description'][0] ?? ''

‎lib/AdapterRpc.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,7 @@ public function getMemberGroups($user, $vo)
139139
new Group(
140140
$group['id'],
141141
$group['voId'],
142+
$group['uuid'],
142143
$group['name'],
143144
$uniqueName,
144145
$group['description']
@@ -194,6 +195,7 @@ public function getSpGroups($spEntityId)
194195
new Group(
195196
$group['id'],
196197
$group['voId'],
198+
$group['uuid'],
197199
$group['name'],
198200
$uniqueName,
199201
$group['description']
@@ -219,6 +221,7 @@ public function getGroupByName($vo, $name)
219221
return new Group(
220222
$group['id'],
221223
$group['voId'],
224+
$group['uuid'],
222225
$group['name'],
223226
$uniqueName,
224227
$group['description']
@@ -360,6 +363,7 @@ public function getUsersGroupsOnFacility($spEntityId, $userId)
360363
array_push($groups, new Group(
361364
$usersGroupOnFacility['id'],
362365
$usersGroupOnFacility['voId'],
366+
$usersGroupOnFacility['uuid'],
363367
$usersGroupOnFacility['name'],
364368
$uniqueName,
365369
$usersGroupOnFacility['description']

‎lib/Auth/Process/PerunEntitlement.php‎

Lines changed: 17 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
use \SimpleSAML\Auth\ProcessingFilter;
88
use SimpleSAML\Module\perun\Adapter;
99
use SimpleSAML\Logger;
10+
use SimpleSAML\Module\perun\EntitlementUtils;
1011

1112
/**
1213
* Class PerunEntitlement
@@ -77,16 +78,25 @@ public function process(&$request)
7778

7879
if (isset($request['perun']['groups'])) {
7980
$eduPersonEntitlement = $this->getEduPersonEntitlement($request);
80-
$capabilities = $this->getCapabilities($request);
81+
$capabilities = EntitlementUtils::getCapabilities(
82+
$request,
83+
$this->adapter,
84+
$this->entitlementPrefix,
85+
$this->entitlementAuthority
86+
);
8187
} else {
8288
Logger::debug(
83-
'perun:PerunEntitlement: There are no user groups assign to facility.' .
84-
'=> Skipping getEduPersonEntitlement and getResourceCapabilities'
89+
'perun:PerunEntitlement: There are no user groups assigned to facility.' .
90+
'=> Skipping getEduPersonEntitlement and getCapabilities'
8591
);
8692
}
8793

8894
if ($this->releaseForwardedEntitlement) {
89-
$forwardedEduPersonEntitlement = $this->getForwardedEduPersonEntitlement($request);
95+
$forwardedEduPersonEntitlement = EntitlementUtils::getForwardedEduPersonEntitlement(
96+
$request,
97+
$this->adapter,
98+
$this->forwardedEduPersonEntitlement
99+
);
90100
}
91101

92102
$request['Attributes'][$this->eduPersonEntitlement] = array_unique(array_merge(
@@ -126,76 +136,11 @@ private function getEduPersonEntitlement(&$request)
126136
return $eduPersonEntitlement;
127137
}
128138

129-
private function getForwardedEduPersonEntitlement(&$request)
130-
{
131-
$forwardedEduPersonEntitlement = [];
132-
133-
if (!isset($request['perun']['user'])) {
134-
Logger::debug(
135-
'perun:PerunEntitlement: Object Perun User is not specified.' .
136-
'=> Skipping getting forwardedEntitlement.'
137-
);
138-
return $forwardedEduPersonEntitlement;
139-
}
140-
141-
$user = $request['perun']['user'];
142-
143-
try {
144-
$forwardedEduPersonEntitlementMap = $this->adapter->getUserAttributesValues(
145-
$user,
146-
[$this->forwardedEduPersonEntitlement]
147-
);
148-
} catch (Exception $exception) {
149-
Logger::error(
150-
'perun:PerunEntitlement: Exception ' . $exception->getMessage() .
151-
' was thrown in method \'getForwardedEduPersonEntitlement\'.'
152-
);
153-
}
154-
155-
if (!empty($forwardedEduPersonEntitlementMap)) {
156-
$forwardedEduPersonEntitlement = array_values($forwardedEduPersonEntitlementMap)[0];
157-
}
158-
159-
return $forwardedEduPersonEntitlement;
160-
}
161-
162-
private function getCapabilities(&$request)
163-
{
164-
$resourceCapabilities = [];
165-
$facilityCapabilities = [];
166-
$capabilitiesResult = [];
167-
168-
$spEntityId = $this->getSpEntityId($request);
169-
try {
170-
$resourceCapabilities = $this->adapter->getResourceCapabilities($spEntityId, $request['perun']['groups']);
171-
$facilityCapabilities = $this->adapter->getFacilityCapabilities($spEntityId);
172-
} catch (Exception $exception) {
173-
Logger::error(
174-
'perun:PerunEntitlement: Exception ' . $exception->getMessage() .
175-
' was thrown in method \'getCapabilities\'.'
176-
);
177-
}
178-
179-
$capabilities = array_unique(array_merge($resourceCapabilities, $facilityCapabilities));
180-
181-
foreach ($capabilities as $capability) {
182-
$wrappedCapability = $this->capabilitiesWrapper($capability);
183-
array_push($capabilitiesResult, $wrappedCapability);
184-
}
185-
186-
return $capabilitiesResult;
187-
}
188-
189139
private function groupNameWrapper($groupName)
190140
{
191-
return $this->entitlementPrefix . 'group:' . implode(':', $this->encodeName($groupName)) .
192-
'#' . $this->entitlementAuthority;
193-
}
194-
195-
private function capabilitiesWrapper($capabilities)
196-
{
197-
return $this->entitlementPrefix . implode(':', $this->encodeName($capabilities)) .
198-
'#' . $this->entitlementAuthority;
141+
return $this->entitlementPrefix . 'group:' .
142+
implode(':', EntitlementUtils::encodeEntitlement($groupName)) .
143+
'#' . $this->entitlementAuthority;
199144
}
200145

201146
/**
@@ -228,38 +173,4 @@ protected function mapGroupName($request, $groupName)
228173
return $this->entitlementPrefix . 'group:' . $groupName;
229174
}
230175
}
231-
232-
private function encodeName($name)
233-
{
234-
$charsToSkip = [
235-
'!' => '%21',
236-
'$' => '%24',
237-
'\'' => '%27',
238-
'(' => '%28',
239-
')' => '%29',
240-
'*' => '%2A',
241-
',' => '%2C',
242-
';' => '%3B',
243-
'&' => '%26',
244-
'=' => '%3D',
245-
'@' => '%40',
246-
':' => '%3A',
247-
'+' => '%2B'
248-
];
249-
250-
$name = array_map('rawurlencode', explode(':', $name));
251-
$name = str_replace(array_values($charsToSkip), array_keys($charsToSkip), $name);
252-
253-
return $name;
254-
}
255-
256-
private function getSpEntityId(&$request)
257-
{
258-
if (isset($request['SPMetadata']['entityid'])) {
259-
return $request['SPMetadata']['entityid'];
260-
} else {
261-
throw new Exception('perun:PerunEntitlement: Cannot find entityID of remote SP. ' .
262-
'hint: Do you have this filter in IdP context?');
263-
}
264-
}
265176
}

0 commit comments

Comments
 (0)