Skip to content

Commit 372cb13

Browse files
author
Boy Baukema
committed
Merge pull request #221 from OpenConext/develop
EB 4.7.1
2 parents 5c77d96 + f5aa64b commit 372cb13

File tree

33 files changed

+696
-53
lines changed

33 files changed

+696
-53
lines changed

‎application/configs/application.ini‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,15 @@ serviceRegistry.caching.backend.name = "File"
209209
serviceRegistry.caching.backend.options.file_name_prefix = "eb_sr_cache"
210210
serviceRegistry.caching.backend.options.lifetime = 1;
211211

212+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
213+
;;;;;;;;;; API VO VALIDATION SETTINGS ;;;;;;;;;;
214+
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
215+
216+
; Base URL that engineblock can use to validate that a given use belongs to a given Virtual Organization.
217+
api.vovalidate.baseUrl = "https://api.demo.openconext.org"
218+
api.vovalidate.key = "oauth_key"
219+
api.vovalidate.secret = "oauth_secret"
220+
212221
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
213222
;;;;;;;;;; EngineBlock API credentials ;;;;;;;;;
214223
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

‎application/modules/Authentication/Controller/Feedback.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,12 @@
22

33
class Authentication_Controller_Feedback extends EngineBlock_Controller_Abstract
44
{
5+
public function vomembershiprequiredAction()
6+
{
7+
$this->_getResponse()->setStatus(403, 'Forbidden');
8+
session_start();
9+
}
10+
511
public function unableToReceiveMessageAction()
612
{
713
$this->_getResponse()->setStatus(400, 'Bad Request');

‎application/modules/Authentication/Controller/IdentityProvider.php‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ protected function _singleSignOn($service = 'singleSignOn', array $arguments = a
3636

3737
$idPEntityId = NULL;
3838

39-
// Optionally allow /single-sign-on/remoteIdPHash or
40-
// /single-sign-on/remoteIdPHash/key:20140420
39+
// Optionally allow /single-sign-on/vo:myVoId/remoteIdPHash or
40+
// /single-sign-on/remoteIdPHash/vo:myVoId/key:20140420
4141
foreach ($arguments as $argument) {
4242
if (substr($argument, 0, 3) == 'vo:') {
4343
$proxyServer->setVirtualOrganisationContext(substr($argument, 3));
@@ -68,6 +68,14 @@ protected function _singleSignOn($service = 'singleSignOn', array $arguments = a
6868
$application->handleExceptionWithFeedback($e,
6969
'/authentication/feedback/unable-to-receive-message');
7070
}
71+
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
72+
$application->getLogInstance()->notice(
73+
"User is not a member",
74+
array('exception' => $e)
75+
);
76+
$application->handleExceptionWithFeedback($e,
77+
'/authentication/feedback/vomembershiprequired');
78+
}
7179
catch (EngineBlock_Corto_Module_Services_SessionLostException $e) {
7280
$application->getLogInstance()->notice(
7381
"Session lost",
@@ -176,6 +184,10 @@ public function processConsentAction()
176184
$application->handleExceptionWithFeedback($e,
177185
'/authentication/feedback/unable-to-receive-message');
178186
}
187+
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
188+
$application->handleExceptionWithFeedback($e,
189+
'/authentication/feedback/vomembershiprequired');
190+
}
179191
catch (EngineBlock_Corto_Module_Services_SessionLostException $e) {
180192
$application->handleExceptionWithFeedback($e,
181193
'/authentication/feedback/session-lost');

‎application/modules/Authentication/Controller/Proxy.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,16 @@ public function processedAssertionAction()
9595
$proxyServer = new EngineBlock_Corto_Adapter();
9696
$proxyServer->processedAssertionConsumer();
9797
}
98+
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
99+
$application->getLogInstance()->notice(
100+
"VO membership required",
101+
array('exception' => $e)
102+
);
103+
$application->handleExceptionWithFeedback(
104+
$e,
105+
'/authentication/feedback/vomembershiprequired'
106+
);
107+
}
98108
catch (EngineBlock_Attributes_Manipulator_CustomException $e) {
99109
$application->getLogInstance()->notice(
100110
"Custom attribute manipulator exception",

‎application/modules/Authentication/Controller/ServiceProvider.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,16 @@ public function consumeAssertionAction()
1212
try {
1313
$proxyServer->consumeAssertion();
1414
}
15+
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
16+
$application->getLogInstance()->notice(
17+
"VO membership required",
18+
array('exception' => $e)
19+
);
20+
$application->handleExceptionWithFeedback(
21+
$e,
22+
'/authentication/feedback/vomembershiprequired'
23+
);
24+
}
1525
catch (EngineBlock_Corto_Exception_PEPNoAccess $e) {
1626
$application->getLogInstance()->notice(
1727
"PEP authorization rule violation",
@@ -135,6 +145,10 @@ public function processConsentAction()
135145
$application->handleExceptionWithFeedback($e,
136146
'/authentication/feedback/session-lost');
137147
}
148+
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
149+
$application->handleExceptionWithFeedback($e,
150+
'/authentication/feedback/vomembershiprequired');
151+
}
138152
catch (EngineBlock_Corto_Exception_PEPNoAccess $e) {
139153
$application->getLogInstance()->notice(
140154
"PEP authorization rule violation",

‎application/modules/Authentication/View/Feedback/Vomembershiprequired.phtml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php /* This file is generated. Please edit the files of the appropriate theme in the 'theme/' directory. */ ?>
2+
<?php
3+
4+
/**
5+
* @var Zend_Layout $layout
6+
*/
7+
$layout = $this->layout();
8+
9+
// Set Layout properties
10+
$layout->title = $layout->title. ' - ' .$this->t('error_vo_membership_required');
11+
$layout->header = $layout->title;
12+
$layout->subheader = $this->t('error_vo_membership_required');
13+
$layout->wide = true;
14+
15+
?>
16+
<div class="box">
17+
<div class="mod-content">
18+
<h1><?php echo htmlentities($this->layout()->subheader, 0, "UTF-8"); ?></h1>
19+
<p><?= $this->t('error_vo_membership_required_desc') ?></p>
20+
21+
<?php require_once realpath(__DIR__ . '/../../../Default/View/Error/include/footer.php') ?>
22+
</div>
23+
</div>

‎application/modules/Authentication/View/Proxy/form.phtml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,9 @@ $layout->title = $layout->title.' - '.$this->t('post_data');
5858

5959
<?php if ($trace): ?>
6060
<input id="submitbutton" type="submit" value="Submit" class="c-button" />
61-
<pre>
61+
<pre style="text-align: left; margin: 0 auto; width: 500px; height: 800px;">
6262
<?= $trace ?>
63-
</pre>
63+
</pre>
6464
<script type="text/javascript">
6565
document.getElementById('submitbutton').focus();
6666
</script>

‎docs/release_notes/4.7.1.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# OpenConext EngineBlock v4.7.1 Release Notes #
2+
3+
Bring back VO support, executed before policy enforcement.

‎languages/en.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -267,6 +267,8 @@
267267
'error_unknown_issuer_desc' => '<p>
268268
The service you are trying to log in to is unknown to SURFconext. Possibly your institution has never enabled access to this service. Please contact the helpdesk of your institution and provide them with the following information:
269269
</p>',
270+
'error_vo_membership_required' => 'Membership of a Virtual Organisation required',
271+
'error_vo_membership_required_desc' => 'You have successfully authenticated at your Identity Provider, however in order to use this service you have to be a member of a Virtual Organisation.',
270272
'error_generic' => 'Error - An error occurred',
271273
'error_generic_desc' => '<p>
272274
It is not possible to sign in. Please try again.

‎languages/nl.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -263,6 +263,8 @@
263263
'error_unknown_issuer_desc' => '<p>
264264
De dienst waarop je probeert in te loggen is niet bekend bij SURFconext. Mogelijk heeft jouw instelling de toegang tot deze dienst nooit aangevraagd. Neem contact op met de helpdesk van je instelling en geef daarbij de volgende informatie door:
265265
</p>',
266+
'error_vo_membership_required' => 'Lidmaatschap van een Virtuele Organisatie vereist',
267+
'error_vo_membership_required_desc' => 'Je bent succesvol ingelogd bij jouw instelling, maar om gebruik te kunnen maken van deze dienst moet je ook lid zijn van een Virtuele Organisatie.',
266268
'error_generic' => 'Error - Foutmelding',
267269
'error_generic_desc' => '<p>
268270
Het is niet mogelijk om in te loggen. Probeer het alstublieft opnieuw.

0 commit comments

Comments
 (0)