Skip to content
This repository was archived by the owner on Sep 19, 2022. It is now read-only.

Commit 5771a1b

Browse files
author
Dominik Frantisek Bucik
committed
feat: 🎸 SpAuthorization authproc filter
1 parent a2ca6ea commit 5771a1b

14 files changed

+832
-32
lines changed

‎config-templates/processFilterConfigurations-example.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,3 +285,27 @@ Configuration options:
285285
],
286286
],
287287
```
288+
## SpAuthorization
289+
290+
Performs authorization check define dby the SP based on group membership in Perun. User has to be valid member of at least one of the groups assigned to resources of the facility representing the service. If not satisfied, the filter check if registration is enabled. In case of enabled registration, user is forwarded to custom registration link (if configured), or to a dynamic form, where user will select the combination of VO and group to which he/she applies for access. Form then forwards user to Perun registration component. In all other cases, user is forwarded to access denied page.
291+
NOTE: for correct functionality, RPC adapter must be available, as other adapters cannot fetch info about what groups allow registration (have registration forms) and similar data.
292+
293+
Configuration options:
294+
* `interface`: specifies what interface of Perun should be used to fetch data. See class `SimpleSAML\Module\perun\PerunAdapter` for more details.
295+
* `registrar_url`: URL where Perun registration component is located. Expected URL is the base, without any parameters.
296+
* `check_group_membership_attr`: mapping to the attribute containing flag, if membership check should be performed.
297+
* `vo_short_names_attr`: mapping to the attribute containing shortnames of the VOs for which the service has resources (gives access to the groups).
298+
* `registration_link_attr`: mapping to the attribute containing custom service registration link. Filter adds the callback URL, to which to redirect user after the registration, as query string in form of 'callback=URL'.
299+
* `allow_registration_attr`: mapping to the attribute containing flag, if registration in case of denied access is enabled
300+
301+
```php
302+
25 => [
303+
'class' => 'perun:SpAuthorization',
304+
'interface' => 'LDAP',
305+
'registrar_url' => 'https://signup.perun.cesnet.cz/fed/registrar/',
306+
'check_group_membership_attr' => 'check_group_membership',
307+
'vo_short_names_attr' => 'vo_short_names',
308+
'registration_link_attr' => 'registration_link',
309+
'allow_registration_attr' => 'allow_registration',
310+
],
311+
```

‎dictionaries/perun.definition.json‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,5 +110,50 @@
110110
"aup_button": {
111111
"en": "Proceed to approval of the AUP",
112112
"cs": "Pokračovat na potvrzení souhlasu s AUP"
113+
},
114+
,
115+
"sp_authorize_403_header": {
116+
"en": "Unauthorized",
117+
"cs": "Přístup zamítnut"
118+
},
119+
"sp_authorize_403_text": {
120+
"en": "You are not authorized to access the service ",
121+
"cs": "Nesplňujete autorizační pravidla pro přístup ke službě "
122+
},
123+
"sp_authorize_403_information_page": {
124+
"en": "For more information about the service, visit ",
125+
"cs": "Pro více informací o službě, navštivte "
126+
},
127+
"sp_authorize_403_information_page_link_text": {
128+
"en": "this page",
129+
"cs": "tuhle stránku"
130+
},
131+
"sp_authorize_403_contact_support": {
132+
"en": "If you think you should have access to the service, please contact the service administrator at ",
133+
"cs": "Jestli máte mít přístup ke službě, kontaktujte správce služby na "
134+
},
135+
"sp_authorize_403_subject": {
136+
"en": "Unauthorized access",
137+
"cs": "Přístup zamítnut"
138+
},
139+
"sp_authorize_notify_text": {
140+
"en": "You are not authorized to access the service ",
141+
"cs": "Nesplňujete autorizační pravidla pro přístup ke službě"
142+
},
143+
"sp_authorize_notify_information_page": {
144+
"en": "For more information about the service, visit ",
145+
"cs": "Pro více informací o službě, navštivte "
146+
},
147+
"sp_authorize_notify_information_page_link_text": {
148+
"en": "this page",
149+
"cs": "tuhle stránku"
150+
},
151+
"sp_authorize_notify_text2": {
152+
"en": "We will now redirect you to a registration page, where you will apply for the access.",
153+
"cs": "Budete přesmerován(a) na stránku, kde můžete o p%rístup na službu zažádat."
154+
},
155+
"sp_authorize_notify_button": {
156+
"en": "Proceed to registration",
157+
"cs": "Pokračovat na registrační stránku"
113158
}
114159
}

‎lib/Adapter.php‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,15 @@ abstract public function getMemberGroups($user, $vo);
9090
* @return Group[] from vo which are assigned to all facilities with spEntityId.
9191
* registering to those groups should should allow access to the service
9292
*/
93-
abstract public function getSpGroups($spEntityId);
93+
abstract public function getSpGroups(string $spEntityId): array;
94+
95+
/**
96+
* @param Facility $facility representing the SP
97+
*
98+
* @return Group[] from vo which are assigned to all facilities with spEntityId.
99+
* registering to those groups should allow access to the service
100+
*/
101+
abstract public function getSpGroupsByFacility(Facility $facility): array;
94102

95103
/**
96104
* @param User $user

‎lib/AdapterLdap.php‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -152,14 +152,15 @@ public function getMemberGroups($user, $vo)
152152
return $groups;
153153
}
154154

155-
public function getSpGroups($spEntityId)
155+
public function getSpGroups(string $spEntityId): array
156156
{
157157
$facility = $this->getFacilityByEntityId($spEntityId);
158158

159-
if (null === $facility) {
160-
return [];
161-
}
159+
return $this->getSpGroupsByFacility($facility);
160+
}
162161

162+
public function getSpGroupsByFacility(Facility $facility): array
163+
{
163164
$id = $facility->getId();
164165

165166
$resources = $this->connector->searchForEntities(
@@ -177,16 +178,13 @@ public function getSpGroups($spEntityId)
177178
'(objectClass=perunGroup)',
178179
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'uuid', 'description']
179180
);
180-
array_push(
181-
$groups,
182-
new Group(
183-
$group['perunGroupId'][0],
184-
$group['perunVoId'][0],
185-
$group['uuid'][0],
186-
$group['cn'],
187-
$group['perunUniqueGroupName'][0],
188-
$group['description'][0] ?? ''
189-
)
181+
$groups[] = new Group(
182+
$group['perunGroupId'][0],
183+
$group['perunVoId'][0],
184+
$group['uuid'][0],
185+
$group['cn'],
186+
$group['perunUniqueGroupName'][0],
187+
$group['description'][0] ?? ''
190188
);
191189
}
192190
}

‎lib/AdapterRpc.php‎

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -154,23 +154,30 @@ public function getMemberGroups($user, $vo)
154154
return $convertedGroups;
155155
}
156156

157-
public function getSpGroups($spEntityId)
157+
public function getSpGroups(string $spEntityId): array
158158
{
159159
$facility = $this->getFacilityByEntityId($spEntityId);
160160

161161
if (null === $facility) {
162162
return [];
163163
}
164164

165+
return $this->getSpGroupsByFacility($facility);
166+
}
167+
168+
public function getSpGroupsByFacility(Facility $facility): array
169+
{
165170
$perunAttrs = $this->connector->get('facilitiesManager', 'getAssignedResources', [
166171
'facility' => $facility->getId(),
167172
]);
168173

169174
$resources = [];
170175
foreach ($perunAttrs as $perunAttr) {
171-
array_push(
172-
$resources,
173-
new Resource($perunAttr['id'], $perunAttr['voId'], $perunAttr['facilityId'], $perunAttr['name'])
176+
$resources[] = new Resource(
177+
$perunAttr['id'],
178+
$perunAttr['voId'],
179+
$perunAttr['facilityId'],
180+
$perunAttr['name']
174181
);
175182
}
176183

@@ -186,16 +193,13 @@ public function getSpGroups($spEntityId)
186193
'attributeName' => 'urn:perun:group:attribute-def:virt:voShortName',
187194
]);
188195
$uniqueName = $attr['value'] . ':' . $group['name'];
189-
array_push(
190-
$spGroups,
191-
new Group(
192-
$group['id'],
193-
$group['voId'],
194-
$group['uuid'],
195-
$group['name'],
196-
$uniqueName,
197-
$group['description']
198-
)
196+
$spGroups[] = new Group(
197+
$group['id'],
198+
$group['voId'],
199+
$group['uuid'],
200+
$group['name'],
201+
$uniqueName,
202+
$group['description']
199203
);
200204
}
201205
}

0 commit comments

Comments
 (0)