Skip to content
This repository was archived by the owner on Sep 19, 2022. It is now read-only.

Commit 45f016a

Browse files
vyskocilpavelvyskocilpavel
authored
Merge pull request #97 from melanger/perunMetadata
metadata import and export from/to Perun
2 parents ef9a22e + 88b5440 commit 45f016a

22 files changed

+1986
-166
lines changed

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,6 @@
33
*.iml
44
out
55
gen
6+
7+
vendor/
8+
composer.lock

‎composer.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,18 @@
1616
{
1717
"name": "Michal Prochazka",
1818
"email": "[email protected]"
19+
},
20+
{
21+
"name": "Pavel Brousek",
22+
"email": "[email protected]"
1923
}
2024
],
2125
"require": {
2226
"simplesamlphp/simplesamlphp": "~1.17",
2327
"simplesamlphp/composer-module-installer": "~1.0",
2428
"cesnet/simplesamlphp-module-perunauthorize": "~2.0",
2529
"cesnet/simplesamlphp-module-chartjs": "~2.8.0",
30+
"symfony/var-exporter": "^5.0",
2631
"ext-curl": "*",
2732
"ext-json": "*"
2833
}

‎config-templates/module_perun_getMetadata.php‎

Lines changed: 288 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
<?php
22

3+
use SimpleSAML\Module\perun\MetadataToPerun;
4+
35
$config = [
46
/**
57
* Identifier of Proxy
@@ -9,23 +11,304 @@
911
/**
1012
* Name of facility attribute Proxy Identifiers
1113
*/
12-
'perunProxyIdentifierAttr' => '',
14+
'perunProxyIdentifierAttr' => 'urn:perun:facility:attribute-def:def:proxyIdentifiers',
15+
16+
/**
17+
* Name of facility attribute Master Proxy Identifier
18+
*/
19+
'perunMasterProxyIdentifierAttr' => 'urn:perun:facility:attribute-def:def:masterProxyIdentifier',
1320

1421
/**
1522
* Name of facility attribute EntityID
1623
*/
17-
'perunProxyEntityIDAttr' => '',
24+
'perunProxyEntityIDAttr' => 'urn:perun:facility:attribute-def:def:entityID',
25+
26+
/**
27+
* Name of facility attribute isSamlFacility (optional)
28+
*/
29+
'perunIsSamlFacilityAttr' => 'urn:perun:facility:attribute-def:def:isSamlFacility',
1830

1931
/**
2032
* Absolute path, where the metadata will be stored
2133
*/
22-
'absoluteFileName' => '',
34+
//'absoluteFileName' => '',
2335

2436
/**
25-
* List of attributes definitions
37+
* List of attributes definitions (for export)
2638
*/
2739
'attributesDefinitions' => [
2840
// Name of attribute from perun => key which will be used in generated metadata
29-
'perunAttrName' => 'metadataName',
41+
'urn:perun:facility:attribute-def:def:entityID' => 'entityid',
42+
'urn:perun:facility:attribute-def:def:serviceName' => 'name',
43+
'urn:perun:facility:attribute-def:def:serviceDescription' => 'description',
44+
'urn:perun:facility:attribute-def:def:spInformationURL' => 'url',
45+
'urn:perun:facility:attribute-def:def:privacyPolicyURL' => 'privacypolicy',
46+
'urn:perun:facility:attribute-def:def:organizationName' => 'OrganizationName',
47+
'urn:perun:facility:attribute-def:def:spOrganizationURL' => 'OrganizationURL',
48+
'urn:perun:facility:attribute-def:def:assertionConsumerServices' => 'AssertionConsumerService',
49+
'urn:perun:facility:attribute-def:def:singleLogoutServices' => 'SingleLogoutService',
50+
'urn:perun:facility:attribute-def:def:relayState' => 'RelayState',
51+
'urn:perun:facility:attribute-def:def:requiredAttributes' => 'attributes',
52+
'urn:perun:facility:attribute-def:def:nameIDFormat' => 'NameIDFormat',
53+
'urn:perun:facility:attribute-def:def:signingCert' => 'signingCert',
54+
'urn:perun:facility:attribute-def:def:encryptionCert' => 'encryptionCert',
55+
'urn:perun:facility:attribute-def:def:spDisableEncryption' => 'assertion.encryption',
56+
],
57+
58+
/**
59+
* Transform attributes after retrieving from Perun (during export).
60+
* Array of arrays with string class (of the transformer),
61+
* array attributes (which are transformed)
62+
* and array config (passed to the transformer).
63+
* The transformers should implement the \SimpleSAML\Module\perun\AttributeTransformer interface.
64+
*/
65+
'exportTransformers' => [
66+
[
67+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\EndpointMapToArray',
68+
'attributes' => ['AssertionConsumerService'],
69+
'config' => ['defaultBinding' => 'HTTP-POST'],
70+
],
71+
[
72+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\EndpointMapToArray',
73+
'attributes' => ['SingleLogoutService'],
74+
'config' => ['defaultBinding' => 'HTTP-Redirect'],
75+
],
76+
[
77+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\LogicalNot',
78+
'attributes' => ['assertion.encryption'],
79+
'config' => [],
80+
],
81+
[
82+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\LogicalAnd',
83+
'attributes' => ['encryptionCert', 'assertion.encryption'],
84+
'config' => ['output' => 'assertion.encryption'],
85+
],
86+
[
87+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\KeyListsToArray',
88+
'attributes' => ['signingCert', 'encryptionCert'],
89+
'config' => [
90+
'purposes' => ['signingCert' => 'signing', 'encryptionCert' => 'encryption'],
91+
'outputKeys' => 'keys',
92+
'outputCertData' => 'certData',
93+
'keepSource' => false,
94+
],
95+
],
96+
],
97+
98+
/**
99+
* Attribute map used for extracting info during import from the entity descriptor XML.
100+
* Map of internal name => Xpath selector string or Xpath selector in array if array should be extracted
101+
*/
102+
'xml2internal' => [
103+
'CoCo' => 'boolean(//*[local-name() = "EntityAttributes"]/*[@Name = "http://macedir.org/entity-category"]/'
104+
. '*[local-name() = "AttributeValue"][text() = "http://www.geant.net/uri/dataprotection-code-of-conduct"])',
105+
'RaS' => 'boolean(//*[local-name() = "EntityAttributes"]/*[@Name = "http://macedir.org/entity-category"]/*'
106+
. '[local-name() = "AttributeValue"][text() = "http://refeds.org/category/research-and-scholarship"])',
107+
'requiredAttributes' => ['//*[local-name() = "RequestedAttribute"][@isRequired = "true"]/@FriendlyName'],
108+
'loginURL' => 'string(//*[local-name() = "RequestInitiator"]/@Location)',
109+
'entityCategory' => ['//*[local-name() = "EntityAttributes"]/*[@Name = "http://macedir.org/entity-category"]/*'
110+
. '[local-name() = "AttributeValue"]', ],
111+
MetadataToPerun::SERVICE_NAME => [
112+
MetadataToPerun::XPATH_LANG => '//*[local-name() = "UIInfo"]/*[local-name() = "DisplayName"]',
113+
],
114+
MetadataToPerun::SERVICE_DESCRIPTION => [
115+
MetadataToPerun::XPATH_LANG => '//*[local-name() = "UIInfo"]/*[local-name() = "Description"]',
116+
],
117+
'spInformationURL' => '//*[local-name() = "UIInfo"]/*[local-name() = "InformationURL"]',
118+
'privacyPolicyURL' => '//*[local-name() = "UIInfo"]/*[local-name() = "PrivacyStatementURL"]',
119+
MetadataToPerun::ORGANIZATION_NAME => '//*[local-name() = "Organization"]/*[local-name() = "OrganizationName"]',
120+
'spOrganizationURL' => '//*[local-name() = "Organization"]/*[local-name() = "OrganizationURL"]',
121+
'nameIDFormat' => ['//*[local-name() = "NameIDFormat"]'],
122+
'signingCert' => ['//*[local-name() = "KeyDescriptor" and (not(@use) or @use="signing")]'
123+
. '//*[local-name() = "X509Certificate"]'],
124+
'encryptionCert' => ['//*[local-name() = "KeyDescriptor" and (not(@use) or @use="encryption")]'
125+
. '//*[local-name() = "X509Certificate"]'],
126+
'spAdminContact' => ['//*[local-name() = "ContactPerson" and (@contactType="technical"'
127+
. ' or @contactType="administrative")]/*[local-name() = "EmailAddress"]'],
128+
'spSupportContact' => ['//*[local-name() = "ContactPerson" and (@contactType="support")]'
129+
. '/*[local-name() = "EmailAddress"]'],
130+
],
131+
132+
/**
133+
* Attribute map used for extracting info during import from the SSP array.
134+
* Map of internal name => flatfile name (nesting by dots) or array of indexes for multiple sources
135+
*/
136+
'flatfile2internal' => [
137+
MetadataToPerun::ENTITY_ID => 'entityid',
138+
MetadataToPerun::SERVICE_NAME => 'name',
139+
MetadataToPerun::SERVICE_DESCRIPTION => 'description',
140+
'spInformationURL' => 'url',
141+
'privacyPolicyURL' => 'UIInfo.PrivacyStatementURL',
142+
MetadataToPerun::ORGANIZATION_NAME => 'OrganizationName',
143+
'spOrganizationURL' => 'OrganizationURL',
144+
'nameIDFormat' => 'NameIDFormat',
145+
'relayState' => 'RelayState',
146+
'keys' => 'keys',
147+
'spAdminContact' => 'contacts',
148+
'spSupportContact' => 'contacts',
149+
'assertionConsumerService' => 'AssertionConsumerService',
150+
'singleLogoutService' => 'SingleLogoutService',
151+
],
152+
153+
/**
154+
* Attribute map used for storing extracted info in Perun during import.
155+
* Map of name in Perun => internal name (from xml2internal and flatfile2internal).
156+
*/
157+
'internal2perun' => [
158+
'urn:perun:facility:attribute-def:def:CoCo' => 'CoCo',
159+
'urn:perun:facility:attribute-def:def:RaS' => 'RaS',
160+
'urn:perun:facility:attribute-def:def:requiredAttributes' => 'requiredAttributes',
161+
'urn:perun:facility:attribute-def:def:loginURL' => 'loginURL',
162+
'urn:perun:facility:attribute-def:def:entityID' => MetadataToPerun::ENTITY_ID,
163+
'urn:perun:facility:attribute-def:def:serviceName' => MetadataToPerun::SERVICE_NAME,
164+
'urn:perun:facility:attribute-def:def:serviceDescription' => MetadataToPerun::SERVICE_DESCRIPTION,
165+
'urn:perun:facility:attribute-def:def:spInformationURL' => 'spInformationURL',
166+
'urn:perun:facility:attribute-def:def:privacyPolicyURL' => 'privacyPolicyURL',
167+
'urn:perun:facility:attribute-def:def:organizationName' => MetadataToPerun::ORGANIZATION_NAME,
168+
'urn:perun:facility:attribute-def:def:spOrganizationURL' => 'spOrganizationURL',
169+
'urn:perun:facility:attribute-def:def:nameIDFormat' => 'nameIDFormat',
170+
'urn:perun:facility:attribute-def:def:assertionConsumerServices' => 'assertionConsumerService',
171+
'urn:perun:facility:attribute-def:def:singleLogoutServices' => 'singleLogoutService',
172+
'urn:perun:facility:attribute-def:def:relayState' => 'relayState',
173+
'urn:perun:facility:attribute-def:def:signingCert' => 'signingCert',
174+
'urn:perun:facility:attribute-def:def:encryptionCert' => 'encryptionCert',
175+
'urn:perun:facility:attribute-def:def:spAdminContact' => 'spAdminContact',
176+
'urn:perun:facility:attribute-def:def:spSupportContact' => 'spSupportContact',
177+
'urn:perun:facility:attribute-def:def:entityCategory' => 'entityCategory',
178+
'urn:perun:facility:attribute-def:def:proxyIdentifiers' => 'proxyIdentifiers',
179+
],
180+
181+
/**
182+
* Transform attributes before storing in Perun (during import).
183+
* Array of arrays with string class (of the transformer),
184+
* array attributes (which are transformed)
185+
* and array config (passed to the transformer).
186+
* The transformers should implement the \SimpleSAML\Module\perun\AttributeTransformer interface.
187+
*/
188+
'importTransformers' => [
189+
[
190+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\EndpointMap',
191+
'attributes' => ['assertionConsumerService'],
192+
'config' => ['defaultBinding' => 'HTTP-POST'],
193+
],
194+
[
195+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\EndpointMap',
196+
'attributes' => ['singleLogoutService'],
197+
'config' => ['defaultBinding' => 'HTTP-Redirect'],
198+
],
199+
[
200+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\KeyLists',
201+
'attributes' => ['keys'],
202+
'config' => ['purpose2internal' => ['signing' => 'signingCert', 'encryption' => 'encryptionCert']],
203+
],
204+
[
205+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\EmailList',
206+
'attributes' => ['spAdminContact'],
207+
'config' => ['types' => ['administrative', 'technical']],
208+
],
209+
[
210+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\EmailList',
211+
'attributes' => ['spSupportContact'],
212+
'config' => ['types' => ['support']],
213+
],
214+
[
215+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\ShibbolethAttributeFilter',
216+
'attributes' => ['requiredAttributes', 'entityCategory'],
217+
'config' => [
218+
'tagsAttribute' => 'proxyIdentifiers',
219+
'entityCategoriesAttribute' => 'entityCategory',
220+
'attributesAttribute' => 'requiredAttributes',
221+
'skipDefault' => false,
222+
'ignore.attributes' => [
223+
'programme', 'field', 'national', 'degree', 'isTeacher', 'principal', 'encTest',
224+
],
225+
'ignore.entityIDs' => [
226+
],
227+
'entityCategories' => [
228+
'http://www.geant.net/uri/dataprotection-code-of-conduct/v1' => [
229+
'cn',
230+
'eduPersonPrincipalName',
231+
'eduPersonScopedAffiliation',
232+
'mail',
233+
'givenName',
234+
'sn',
235+
'tcsSchacHomeOrg',
236+
],
237+
'http://refeds.org/category/research-and-scholarship' => [
238+
'displayName',
239+
'eduPersonPrincipalName',
240+
'eduPersonScopedAffiliation',
241+
'eduPersonTargetedID',
242+
'mail',
243+
],
244+
'https://inacademia.org/metadata/inacademia-simple-validation.xml' => [
245+
'cn',
246+
'eduPersonPrincipalName',
247+
'eduPersonScopedAffiliation',
248+
'eduPersonUniqueId',
249+
'mail',
250+
'givenName',
251+
'sn',
252+
'tcsSchacHomeOrg',
253+
'transientId',
254+
],
255+
'http://eduid.cz/uri/sp-group/clarin' => [
256+
'eduPersonTargetedID',
257+
'cn',
258+
'mail',
259+
'o',
260+
],
261+
'http://eduid.cz/uri/group/mefanet' => [
262+
'mefanet',
263+
],
264+
],
265+
'file' => __DIR__ . '/attribute-filter.xml',
266+
//'xml' => '...',
267+
],
268+
],
269+
[
270+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\AttributeAlter',
271+
'attributes' => ['proxyIdentifiers'],
272+
'config' => [
273+
'pattern' => '/^release(To)?/',
274+
'replacement' => '',
275+
],
276+
],
277+
[
278+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\AttributeAlter',
279+
'attributes' => ['proxyIdentifiers'],
280+
'config' => [
281+
'pattern' => '/^(All|ScopedAffiliation|Mail|TargetedID|Entitlement|eduroamUID)$/',
282+
'%remove',
283+
],
284+
],
285+
[
286+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\AttributeAlter',
287+
'attributes' => ['proxyIdentifiers'],
288+
'config' => [
289+
'pattern' => '/^/',
290+
'replacement' => 'https://idp2.ics.muni.cz/idp/shibboleth#',
291+
],
292+
],
293+
[
294+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\LocalesToLanguages',
295+
'attributes' => [
296+
'serviceName',
297+
'serviceDescription',
298+
'organizationName',
299+
'spInformationURL',
300+
'spOrganizationURL',
301+
],
302+
],
303+
[
304+
'class' => '\\SimpleSAML\\Module\\perun\\transformers\\FlatMap',
305+
'attributes' => [
306+
'serviceName',
307+
'serviceDescription',
308+
'organizationName',
309+
'spInformationURL',
310+
'spOrganizationURL',
311+
],
312+
],
30313
],
31314
];

‎ecs.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
imports:
2+
- { resource: 'vendor/symplify/easy-coding-standard/config/set/clean-code.yaml' }
3+
- { resource: 'vendor/symplify/easy-coding-standard/config/set/common.yaml' }
4+
parameters:
5+
skip:
6+
PhpCsFixer\Fixer\Operator\NotOperatorWithSuccessorSpaceFixer: ~
7+
SlevomatCodingStandard\Sniffs\Variables\UnusedVariableSniff.UnusedVariable:
8+
- 'config-templates/module_discopower.php'
9+
- 'config-templates/module_perun.php'
10+
- 'config-templates/module_perun_getMetadata.php'
11+
- 'config-templates/module_perun_idpListsServiceDB.php'
12+
services:

0 commit comments

Comments
 (0)