Skip to content
This repository was archived by the owner on Sep 19, 2022. It is now read-only.

Commit 6387206

Browse files
author
Dominik František Bučík
authored
Merge pull request #255 from BaranekD/filters_lsaai_separate_commits
Filters lsaai separate commits
2 parents 18dc026 + fca9739 commit 6387206

17 files changed

+574
-102
lines changed

‎config-templates/processFilterConfigurations-example.md‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,15 +297,38 @@ Configuration options:
297297
* `vo_short_names_attr`: mapping to the attribute containing shortnames of the VOs for which the service has resources (gives access to the groups).
298298
* `registration_link_attr`: mapping to the attribute containing custom service registration link. Filter adds the callback URL, to which to redirect user after the registration, as query string in form of 'callback=URL'.
299299
* `allow_registration_attr`: mapping to the attribute containing flag, if registration in case of denied access is enabled
300+
* `handle_unsatisfied_membership`: whether handle unsatisfied membership
300301

301302
```php
302303
25 => [
303304
'class' => 'perun:SpAuthorization',
304-
'interface' => 'LDAP',
305+
'interface' => 'ldap',
305306
'registrar_url' => 'https://signup.perun.cesnet.cz/fed/registrar/',
306307
'check_group_membership_attr' => 'check_group_membership',
307308
'vo_short_names_attr' => 'vo_short_names',
308309
'registration_link_attr' => 'registration_link',
309310
'allow_registration_attr' => 'allow_registration',
311+
'handle_unsatisfied_membership' => true,
312+
],
313+
```
314+
315+
## EnsureVOMember
316+
317+
Checks whether the user is in the given VO (group). If not, redirects him/her to the registration.
318+
319+
Configuration options:
320+
* `registrationUrl`: URL to the registration
321+
* `voShortName`: VO shortname to check the user's membership
322+
* `groupName`: OPTIONAL, checks that user is in given group
323+
* `callbackParameterName`: name of the parameter wich will hold callback URL, where the user should be redirected after the AUP approval on URL configured in the `approval_url` property,
324+
* `interface`: specifies what interface of Perun should be used to fetch data. See class `SimpleSAML\Module\perun\PerunAdapter` for more details.
325+
```php
326+
25 => [
327+
'class' => 'perun:PerunEnsureMember',
328+
'registerUrl' => 'https://signup.perun.cesnet.cz/fed/registrar/',
329+
'voShortName' => 'cesnet',
330+
'groupName' => 'cesnet_group_name', // optional
331+
'callbackParameterName' => 'targetnew',
332+
'interface' => 'ldap',
310333
],
311334
```

‎lib/Adapter.php‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,14 @@ abstract public function getVoById($id);
8484
*/
8585
abstract public function getMemberGroups($user, $vo);
8686

87+
/**
88+
* @param User $user perun user
89+
* @param Vo $vo vo we are working with
90+
*
91+
* @return Group[] groups from vo where user is valid
92+
*/
93+
abstract public function getGroupsWhereMemberIsActive($user, $vo);
94+
8795
/**
8896
* @param string $spEntityId entity id of the sp
8997
*
@@ -170,7 +178,15 @@ abstract public function getFacilityByClientId($clientId, $clientIdAttr);
170178
*
171179
* @return Group[] from vo which are assigned to all facilities with spEntityId for this userId
172180
*/
173-
abstract public function getUsersGroupsOnFacility($spEntityId, $userId);
181+
abstract public function getUsersGroupsOnSp($spEntityId, $userId);
182+
183+
/**
184+
* @param Facility $facility entity id of the sp
185+
* @param int $userId
186+
*
187+
* @return Group[] from vo which are assigned to all facilities with spEntityId for this userId
188+
*/
189+
abstract public function getUsersGroupsOnFacility($facility, $userId);
174190

175191
/**
176192
* @param <String, String> map $attribute

‎lib/AdapterLdap.php‎

Lines changed: 45 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -152,6 +152,43 @@ public function getMemberGroups($user, $vo)
152152
return $groups;
153153
}
154154

155+
public function getGroupsWhereMemberIsActive($user, $vo)
156+
{
157+
$userId = $user->getId();
158+
$userWithMembership = $this->connector->searchForEntity(
159+
'perunUserId=' . $userId . ',ou=People,' . $this->ldapBase,
160+
'(objectClass=perunUser)',
161+
['perunUserId', 'memberOf']
162+
);
163+
164+
$groups = [];
165+
foreach ($userWithMembership['memberOf'] as $groupDn) {
166+
$voId = explode('=', explode(',', $groupDn)[1], 2)[1];
167+
if ($voId !== $vo->getId()) {
168+
continue;
169+
}
170+
171+
$group = $this->connector->searchForEntity(
172+
$groupDn,
173+
'(objectClass=perunGroup)',
174+
['perunGroupId', 'cn', 'perunUniqueGroupName', 'perunVoId', 'uuid', 'description']
175+
);
176+
array_push(
177+
$groups,
178+
new Group(
179+
$group['perunGroupId'][0],
180+
$group['perunVoId'][0],
181+
$group['uuid'][0],
182+
$group['cn'][0],
183+
$group['perunUniqueGroupName'][0],
184+
$group['description'][0] ?? ''
185+
)
186+
);
187+
}
188+
189+
return $groups;
190+
}
191+
155192
public function getSpGroups(string $spEntityId): array
156193
{
157194
$facility = $this->getFacilityByEntityId($spEntityId);
@@ -424,14 +461,18 @@ public function setUserExtSourceAttributes($userExtSourceId, $attributes)
424461
$this->fallbackAdapter->setUserExtSourceAttributes($userExtSourceId, $attributes);
425462
}
426463

427-
public function getUsersGroupsOnFacility($spEntityId, $userId)
464+
public function getUsersGroupsOnSp($spEntityId, $userId)
428465
{
429466
$facility = $this->getFacilityByEntityId($spEntityId);
430467

468+
return self::getUsersGroupsOnFacility($facility, $userId);
469+
}
470+
471+
public function getUsersGroupsOnFacility($facility, $userId)
472+
{
431473
if (null === $facility) {
432474
return [];
433475
}
434-
435476
$id = $facility->getId();
436477

437478
$resources = $this->connector->searchForEntities(
@@ -442,7 +483,7 @@ public function getUsersGroupsOnFacility($spEntityId, $userId)
442483
Logger::debug('Resources - ' . json_encode($resources));
443484

444485
if (null === $resources) {
445-
throw new Exception('Service with spEntityId: ' . $spEntityId . ' hasn\'t assigned any resource.');
486+
throw new Exception('Service with ID: ' . $id . ' hasn\'t assigned any resource.');
446487
}
447488
$resourcesString = '(|';
448489
foreach ($resources as $resource) {
@@ -470,10 +511,8 @@ public function getUsersGroupsOnFacility($spEntityId, $userId)
470511
)
471512
);
472513
}
473-
$resultGroups = $this->removeDuplicateEntities($resultGroups);
474-
Logger::debug('Groups - ' . json_encode($resultGroups));
475514

476-
return $resultGroups;
515+
return $this->removeDuplicateEntities($resultGroups);
477516
}
478517

479518
public function getMemberStatusByUserAndVo($user, $vo)

‎lib/AdapterRpc.php‎

Lines changed: 58 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,48 @@ public function getMemberGroups($user, $vo)
154154
return $convertedGroups;
155155
}
156156

157+
public function getGroupsWhereMemberIsActive($user, $vo)
158+
{
159+
try {
160+
$member = $this->connector->get('membersManager', 'getMemberByUser', [
161+
'vo' => $vo->getId(),
162+
'user' => $user->getId(),
163+
]);
164+
165+
$memberGroups = $this->connector->get('groupsManager', 'getGroupsWhereMemberIsActive', [
166+
'member' => $member['id'],
167+
]);
168+
} catch (PerunException $e) {
169+
return [];
170+
}
171+
172+
$convertedGroups = [];
173+
foreach ($memberGroups as $group) {
174+
try {
175+
$attr = $this->connector->get('attributesManager', 'getAttribute', [
176+
'group' => $group['id'],
177+
'attributeName' => 'urn:perun:group:attribute-def:virt:voShortName',
178+
]);
179+
$uniqueName = $attr['value'] . ':' . $group['name'];
180+
array_push(
181+
$convertedGroups,
182+
new Group(
183+
$group['id'],
184+
$group['voId'],
185+
$group['uuid'],
186+
$group['name'],
187+
$uniqueName,
188+
$group['description']
189+
)
190+
);
191+
} catch (PerunException $e) {
192+
continue;
193+
}
194+
}
195+
196+
return $convertedGroups;
197+
}
198+
157199
public function getSpGroups(string $spEntityId): array
158200
{
159201
$facility = $this->getFacilityByEntityId($spEntityId);
@@ -338,13 +380,17 @@ public function getFacilityAttribute($facility, $attrName)
338380
return $perunAttr['value'];
339381
}
340382

341-
public function getUsersGroupsOnFacility($spEntityId, $userId)
383+
public function getUsersGroupsOnSp($spEntityId, $userId)
342384
{
343385
$facility = $this->getFacilityByEntityId($spEntityId);
344-
$groups = [];
345386

387+
return self::getUsersGroupsOnFacility($facility, $userId);
388+
}
389+
390+
public function getUsersGroupsOnFacility($facility, $userId)
391+
{
346392
if (null === $facility) {
347-
return $groups;
393+
return [];
348394
}
349395

350396
$usersGroupsOnFacility = $this->connector->get(
@@ -357,6 +403,8 @@ public function getUsersGroupsOnFacility($spEntityId, $userId)
357403
]
358404
);
359405

406+
$groups = [];
407+
360408
foreach ($usersGroupsOnFacility as $usersGroupOnFacility) {
361409
if (isset($usersGroupOnFacility['attributes'][0]['friendlyName']) &&
362410
'voShortName' === $usersGroupOnFacility['attributes'][0]['friendlyName']) {
@@ -685,14 +733,13 @@ private function getAttributes($perunAttrs, $attrNamesMap)
685733

686734
foreach ($perunAttrs as $perunAttr) {
687735
$perunAttrName = $perunAttr['namespace'] . ':' . $perunAttr['friendlyName'];
688-
$attributes[$attrNamesMap[$perunAttrName]] = [
689-
'id' => $perunAttr['id'],
690-
'name' => $attrNamesMap[$perunAttrName],
691-
'displayName' => $perunAttr['displayName'],
692-
'type' => $perunAttr['type'],
693-
'value' => $perunAttr['value'],
694-
'friendlyName' => $perunAttr['friendlyName'],
695-
];
736+
$attribute = [];
737+
foreach (array_keys($perunAttr) as $key) {
738+
$attribute[$key] = $perunAttr[$key];
739+
}
740+
741+
$attribute['name'] = $attrNamesMap[$perunAttrName];
742+
$attributes[$attrNamesMap[$perunAttrName]] = $attribute;
696743
}
697744

698745
return $attributes;

‎lib/Auth/Process/ForceAup.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,6 +265,12 @@ private function fillAupsToBeApproved($requestedAups, $aups, $userApprovedAups)
265265
{
266266
$aupsToBeApproved = [];
267267
foreach ($requestedAups as $requestedAup) {
268+
if (!array_key_exists($requestedAup, $aups)) {
269+
Logger::debug(
270+
'perun:ForceAup - Requested AUP \'' . $requestedAup . '\' is not in the list of VO AUPS, probably VO does not have AUP'
271+
);
272+
continue;
273+
}
268274
$aupsInJson = $aups[$requestedAup];
269275
if (empty($aupsInJson)) {
270276
continue;

0 commit comments

Comments
 (0)