Skip to content
This repository was archived by the owner on Sep 19, 2022. It is now read-only.

Commit 8ed4748

Browse files
tauceti2tauceti2
committed
Support for multiple uids (eppn, epuid, targetedid, ...)
1 parent 895edcc commit 8ed4748

File tree

4 files changed

+64
-40
lines changed

4 files changed

+64
-40
lines changed

‎lib/Adapter.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,10 @@ public static function getInstance($interface) {
2626

2727
/**
2828
* @param string $idpEntityId entity id of hosted idp used as extSourceName
29-
* @param string $uid user identifier received from remote idp used as userExtSourceLogin
29+
* @param string $uids list of user identifiers received from remote idp used as userExtSourceLogin
3030
* @return sspmod_perun_model_User or null if not exists
3131
*/
32-
public abstract function getPerunUser($idpEntityId, $uid);
32+
public abstract function getPerunUser($idpEntityId, $uids);
3333

3434
/**
3535
* @param sspmod_perun_model_Vo $vo
@@ -86,4 +86,4 @@ protected function removeDuplicateEntities($entities) {
8686
return $removed;
8787

8888
}
89-
}
89+
}

‎lib/AdapterLdap.php‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,23 @@ class sspmod_perun_AdapterLdap extends sspmod_perun_Adapter
99
{
1010

1111

12-
public function getPerunUser($idpEntityId, $uid)
12+
public function getPerunUser($idpEntityId, $uids)
1313
{
14+
# Build a LDAP query, we are searching for the user who has at least one of the uid
15+
$query = '';
16+
foreach ($uids as $uid) {
17+
$query .= "(eduPersonPrincipalNames=$uid)";
18+
}
19+
20+
if ($empty($query)) {
21+
return null;
22+
}
23+
1424
$user = sspmod_perun_LdapConnector::searchForEntity("ou=People,dc=perun,dc=cesnet,dc=cz",
15-
"(eduPersonPrincipalNames=$uid)",
25+
"(!$query)",
1626
array("perunUserId", "displayName", "cn", "givenName", "sn", "preferredMail", "mail")
1727
);
28+
1829
if (is_null($user)) {
1930
return $user;
2031
}

‎lib/AdapterRpc.php‎

Lines changed: 27 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,32 +9,38 @@ class sspmod_perun_AdapterRpc extends sspmod_perun_Adapter
99
{
1010

1111

12-
public function getPerunUser($idpEntityId, $uid)
12+
public function getPerunUser($idpEntityId, $uids)
1313
{
14-
try {
15-
$user = sspmod_perun_RpcConnector::get('usersManager', 'getUserByExtSourceNameAndExtLogin', array(
16-
'extSourceName' => $idpEntityId,
17-
'extLogin' => $uid,
18-
));
14+
$user = null;
1915

20-
$name = '';
21-
if (!empty($user['titleBefore'])) $name .= $user['titleBefore'].' ';
22-
if (!empty($user['titleBefore'])) $name .= $user['firstName'].' ';
23-
if (!empty($user['titleBefore'])) $name .= $user['middleName'].' ';
24-
if (!empty($user['titleBefore'])) $name .= $user['lastName'];
25-
if (!empty($user['titleBefore'])) $name .= ' '.$user['titleAfter'];
16+
foreach ($uids as $uid) {
17+
try {
18+
$user = sspmod_perun_RpcConnector::get('usersManager', 'getUserByExtSourceNameAndExtLogin', array(
19+
'extSourceName' => $idpEntityId,
20+
'extLogin' => $uid,
21+
));
2622

27-
return new sspmod_perun_model_User($user['id'], $name);
28-
} catch (sspmod_perun_Exception $e) {
29-
if ($e->getName() === 'UserExtSourceNotExistsException') {
30-
return null;
31-
} else if ($e->getName() === 'ExtSourceNotExistsException') {
32-
// Because use of original/source entityID as extSourceName
33-
return null;
34-
} else {
35-
throw $e;
23+
$name = '';
24+
if (!empty($user['titleBefore'])) $name .= $user['titleBefore'].' ';
25+
if (!empty($user['titleBefore'])) $name .= $user['firstName'].' ';
26+
if (!empty($user['titleBefore'])) $name .= $user['middleName'].' ';
27+
if (!empty($user['titleBefore'])) $name .= $user['lastName'];
28+
if (!empty($user['titleBefore'])) $name .= ' '.$user['titleAfter'];
29+
30+
return new sspmod_perun_model_User($user['id'], $name);
31+
} catch (sspmod_perun_Exception $e) {
32+
if ($e->getName() === 'UserExtSourceNotExistsException') {
33+
continue;
34+
} else if ($e->getName() === 'ExtSourceNotExistsException') {
35+
// Because use of original/source entityID as extSourceName
36+
continue;
37+
} else {
38+
throw $e;
39+
}
3640
}
3741
}
42+
43+
return $user;
3844
}
3945

4046

‎lib/Auth/Process/PerunIdentity.php‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,19 @@
1818
* It relays on RetainIdPEntityID filter. Config it properly before this filter. (in SP context)
1919
*
2020
* @author Ondrej Velisek <[email protected]>
21+
* @author Michal Prochazka <[email protected]>
2122
*/
2223
class sspmod_perun_Auth_Process_PerunIdentity extends SimpleSAML_Auth_ProcessingFilter
2324
{
24-
const UID_ATTR = 'uidAttr';
25+
const UIDS_ATTR = 'uidsAttr';
2526
const VO_SHORTNAME = 'voShortName';
2627
const REGISTER_URL = 'registerUrl';
2728
const CALLBACK_PARAM_NAME = 'callbackParamName';
2829
const INTERFACE_PROPNAME = 'interface';
2930
const SOURCE_IDP_ENTITY_ID_ATTR = 'sourceIdPEntityIDAttr';
3031
const FORCE_REGISTRATION_TO_GROUPS = 'forceRegistrationToGroups';
3132

32-
private $uidAttr;
33+
private $uidsAttr;
3334
private $registerUrl;
3435
private $voShortName;
3536
private $callbackParamName;
@@ -47,8 +48,8 @@ public function __construct($config, $reserved)
4748
{
4849
parent::__construct($config, $reserved);
4950

50-
if (!isset($config[self::UID_ATTR])) {
51-
throw new SimpleSAML_Error_Exception("perun:PerunIdentity: missing mandatory config option '".self::UID_ATTR."'.");
51+
if (!isset($config[self::UIDS_ATTR])) {
52+
throw new SimpleSAML_Error_Exception("perun:PerunIdentity: missing mandatory config option '".self::UIDS_ATTR."'.");
5253
}
5354
if (!isset($config[self::REGISTER_URL])) {
5455
throw new SimpleSAML_Error_Exception("perun:PerunIdentity: missing mandatory config option '".self::REGISTER_URL."'.");
@@ -69,7 +70,7 @@ public function __construct($config, $reserved)
6970
$config[self::FORCE_REGISTRATION_TO_GROUPS] = false;
7071
}
7172

72-
$this->uidAttr = (string) $config[self::UID_ATTR];
73+
$this->uidsAttr = $config[self::UIDS_ATTR];
7374
$this->registerUrl = (string) $config[self::REGISTER_URL];
7475
$this->voShortName = (string) $config[self::VO_SHORTNAME];
7576
$this->callbackParamName = (string) $config[self::CALLBACK_PARAM_NAME];
@@ -84,11 +85,17 @@ public function process(&$request)
8485
{
8586
assert('is_array($request)');
8687

87-
if (isset($request['Attributes'][$this->uidAttr][0])) {
88-
$uid = $request['Attributes'][$this->uidAttr][0];
89-
} else {
88+
# Store all user ids in an array
89+
$uids = array();
90+
91+
foreach ($this->uidsAttr as $uidAttr) {
92+
if (isset($request['Attributes'][$uidAttr][0])) {
93+
array_push($uids,$request['Attributes'][$uidAttr][0]);
94+
}
95+
}
96+
if (empty($uids)) {
9097
throw new SimpleSAML_Error_Exception("perun:PerunIdentity: " .
91-
"missing mandatory attribute " . $this->uidAttr . " in request.");
98+
"missing one of the mandatory attribute " . implode(', ', $this->uidsAttr) . " in request.");
9299
}
93100

94101
if (isset($request['Attributes'][$this->sourceIdPEntityIDAttr][0])) {
@@ -129,10 +136,10 @@ public function process(&$request)
129136

130137
SimpleSAML_Logger::debug("SP GROUPs - ".var_export($spGroups, true));
131138

132-
$user = $this->adapter->getPerunUser($idpEntityId, $uid);
139+
$user = $this->adapter->getPerunUser($idpEntityId, $uids);
133140

134141
if ($user === null) {
135-
SimpleSAML_Logger::info('Perun user with identity: '.$uid.' has NOT been found. He is being redirected to register.');
142+
SimpleSAML_Logger::info('Perun user with identity/ies: '. implode(',', $uids).' has NOT been found. He is being redirected to register.');
136143
$this->register($request, $this->registerUrl, $this->callbackParamName, $vo, $spGroups, $this->interface);
137144
}
138145

@@ -145,11 +152,11 @@ public function process(&$request)
145152
$groups = $this->intersectById($spGroups, $memberGroups);
146153

147154
if (empty($groups)) {
148-
SimpleSAML_Logger::warning('Perun user with identity: '.$uid.' is not member of any assigned group for resource (' . $spEntityId . ')');
155+
SimpleSAML_Logger::warning('Perun user with identity/ies: '. implode(',', $uids) .' is not member of any assigned group for resource (' . $spEntityId . ')');
149156
$this->unauthorized($request);
150157
}
151158

152-
SimpleSAML_Logger::info('Perun user with identity: '.$uid.' has been found and SP has sufficient rights to get info about him. '.
159+
SimpleSAML_Logger::info('Perun user with identity/ies: '. implode(',', $uids) .' has been found and SP has sufficient rights to get info about him. '.
153160
'User '.$user->getName().' with id: '.$user->getId().' is being set to request');
154161

155162
if (!isset($request['perun'])) {
@@ -176,7 +183,7 @@ public function process(&$request)
176183
protected function register($request, $registerUrl, $callbackParamName, $vo, $groups, $interface) {
177184

178185
$request['config'] = array(
179-
self::UID_ATTR => $this->uidAttr,
186+
self::UIDS_ATTR => $this->uidsAttr,
180187
self::VO_SHORTNAME => $this->voShortName,
181188
self::REGISTER_URL => $this->registerUrl,
182189
self::CALLBACK_PARAM_NAME => $this->callbackParamName,

0 commit comments

Comments
 (0)