Changed login and registration process

* Login process in PerunIdentity has been changed. Now we always check status of member in defaultVO(configuration option 'voShortName' in metadata/saml20-idp-hosted.php). If user is not member of this VO or status of the member is EXPIRED, user will be redirected to registration to this VO. User is redirected to the unauthorized page if the member has different status than VALID / EXPIRED.

* Added new options for each facility. Facility manager is able to set if registration is allowed (if not, user is redirected to unauthorized access page instead of the registration page), set the registrationURL, enable/disable GroupMembershipCheck (if enabled, user must be a valid member in one of assigned groups to access the service), select the registration type (normal/dynamic; Normal type means redirect to registrationURL, Dynamic registration means ability to choose VO and Group for registration from assigned groups with registration form)

Author: vyskocilpavel

CHANGELOG.md

@@ -4,17 +4,18 @@ All notable changes to this project will be documented in this file.
  ## [Unreleased]
  [Added]
  - Added badges to README
- - Added new property to Facility model: description
  - Added page with configurable table of SPs on Proxy
  - Added new model Member
  - Added new model Resource
  - New methods for getting data from Perun LDAP and Perun RPC
 
-[Changed]
-- Connectors methods are not static for now.
-- Added constructors to Adapters, which allows specified config file for each connections.
-- New properties voId and uniqueName in Group model
-- Function getSpGroup require only one param($spEntityId)
+ [Changed]
+ - Connectors methods are not static for now.
+ - Added constructors to Adapters, which allows specified config file for each connections.
+ - New properties voId and uniqueName in Group model
+ - Function getSpGroup require only one param($spEntityId)
+ - Function unauthorize in PerunIdentity is now public
+ - Changed the login and registration process
 
  ## [v1.0.0]
 

config-templates/processFilterConfigurations-example.md

@@ -1,3 +1,27 @@
+## PerunIdentity
+
+Example how to configure PerunIdentity module:
+```php
+24 => array(
+        'class' => 'perun:ProxyFilter',
+        'filterSPs' => $perunEntityIds,
+        'config' => array(
+                'class' => 'perun:PerunIdentity',
+                'uidsAttr' => array('eduPersonUniqueId', 'eduPersonPrincipalName', 'eduPersonTargetedIDString', 'nameid', 'uid'),
+                'voShortName' => 'einfra',
+                'registerUrlBase' => 'https://perun.cesnet.cz/allfed/registrar',
+                'registerUrl' => 'https://login.cesnet.cz/register',
+                'interface' => 'ldap',
+                'facilityCheckGroupMembershipAttr' => 'urn:perun:facility:attribute-def:def:checkGroupMembership',
+                'facilityVoShortNamesAttr' => 'urn:perun:facility:attribute-def:virt:voShortNames',
+                'facilityDynamicRegistrationAttr' => 'urn:perun:facility:attribute-def:def:dynamicRegistration',
+                'facilityRegisterUrlAttr' => 'urn:perun:facility:attribute-def:def:registerUrl',
+                'facilityAllowRegistrationToGroups' => 'urn:perun:facility:attribute-def:def:allowRegistration',
+        ),
+),
+```
+
+
 ## IdPAttribute
 
 Example how to enable filter IdPAttribute:

dictionaries/perun.definition.json

@@ -1,11 +1,27 @@
 {
-  "choose-group-tpl_header": {
-	"en": "Select group which fits you most",
-	"cs": "Vyberte si odpovídající skupinu"
+  "choose-vo-and-group-tpl_header": {
+    "en": "Access forbidden",
+    "cs": "Přístup odepřen"
   },
-  "choose-group-tpl_text": {
-	"en": "It will give you access to the requested service.",
-	"cs": "Získáte tak přístup k požadované službě."
+  "choose-vo-and-group-tpl_text": {
+    "en": "You don't meet the prerequisites for accessing the service: ",
+    "cs": "Nesplňujete prerekvizity pro přístup ke službě: "
+  },
+  "choose-vo-and-group-tpl_message": {
+    "en": "To access the service it is necessary to have a valid membership in one of the following groups. Please proceed with selection of organization and group for registration.",
+    "cs": "Pro získání přístupu k dané službě je nutné se zaregistrovat do jedné z následujících skupin. Pokračujte výběrem příslušné organizace a skupiny."
+  },
+  "choose-vo-and-group-tpl_select-vo": {
+	"en": "Select virtual organization for registration: ",
+	"cs": "Vyberte virtuální organizaci: "
+  },
+  "choose-vo-and-group-tpl_select-group": {
+    "en": "Select group for registration: ",
+    "cs": "Vyberte skupinu pro registraci: "
+  },
+  "choose-vo-and-group-tpl_continue": {
+    "en": "Continue",
+    "cs": "Pokračovat"
   },
   "disco-tpl_previous-selection": {
 	"en": "your previous selection",
@@ -63,6 +79,10 @@
     "en": "Go back to ",
     "cs": "Vraťte se zpět na "
   },
+  "unauthorized-access_redirect_to_registration": {
+    "en": "Now you will be redirected to registration to Perun system.",
+    "cs": "Nyní budete přesměrování na registraci do systému Perun."
+  },
   "listOfSps_header": {
     "en": "List of Service providers",
     "cs": "Seznam služeb"

lib/AdapterRpc.php

@@ -123,7 +123,7 @@ public function getSpGroups($spEntityId)
 
 		$spGroups = array();
 		foreach ($resources as $resource) {
-			$groups = sspmod_perun_RpcConnector::get('resourcesManager', 'getAssignedGroups', array(
+			$groups = $this->connector->get('resourcesManager', 'getAssignedGroups', array(
 				'resource' => $resource->getId(),
 			));
 
@@ -306,7 +306,7 @@ public function getFacilitiesByEntityId($spEntityId)
 	 * @return sspmod_perun_model_Member
 	 */
 	public function getMemberByUser($user, $vo) {
-		$member = sspmod_perun_RpcConnector::get('membersManager', 'getMemberByUser', array(
+		$member = $this->connector->get('membersManager', 'getMemberByUser', array(
 			'user' => $user->getId(),
 			'vo' => $vo->getId(),
 		));
@@ -324,7 +324,7 @@ public function getMemberByUser($user, $vo) {
 	 */
 	public function hasRegistrationForm($group) {
 		try {
-			sspmod_perun_RpcConnector::get( 'registrarManager', 'getApplicationForm', array(
+			$this->connector->get( 'registrarManager', 'getApplicationForm', array(
 				'group' => $group->getId(),
 			));
 			return true;