AttributeLimit.php

Go to the documentation of this file.

<?php

class sspmod_core_Auth_Process_AttributeLimit extends SimpleSAML_Auth_ProcessingFilter {

        private $allowedAttributes = array();


        private $isDefault = FALSE;


        public function __construct($config, $reserved) {
                parent::__construct($config, $reserved);

                assert('is_array($config)');

                foreach ($config as $index => $value) {
                        if ($index === 'default') {
                                $this->isDefault = (bool)$value;
                        } elseif (is_int($index)) {
                                if (!is_string($value)) {
                                        throw new SimpleSAML_Error_Exception('AttributeLimit: Invalid attribute name: ' .
                        var_export($value, TRUE));
                                }
                                $this->allowedAttributes[] = $value;
            } elseif (is_string($index)) {
                if (!is_array($value)) {
                    throw new SimpleSAML_Error_Exception('AttributeLimit: Values for ' . var_export($index, TRUE) .
                        ' must be specified in an array.');
                }
                $this->allowedAttributes[$index] = $value;
                        } else {
                                throw new SimpleSAML_Error_Exception('AttributeLimit: Invalid option: ' . var_export($index, TRUE));
                        }
                }
        }


        private static function getSPIdPAllowed(array &$request) {

                if (array_key_exists('attributes', $request['Destination'])) {
                        // SP Config
                        return $request['Destination']['attributes'];
                }
                if (array_key_exists('attributes', $request['Source'])) {
                        // IdP Config
                        return $request['Source']['attributes'];
                }
                return NULL;
        }


        public function process(&$request) {
                assert('is_array($request)');
                assert('array_key_exists("Attributes", $request)');

                if ($this->isDefault) {
                        $allowedAttributes = self::getSPIdPAllowed($request);
                        if ($allowedAttributes === NULL) {
                                $allowedAttributes = $this->allowedAttributes;
                        }
                } elseif (!empty($this->allowedAttributes)) {
                        $allowedAttributes = $this->allowedAttributes;
                } else {
                        $allowedAttributes = self::getSPIdPAllowed($request);
                        if ($allowedAttributes === NULL) {
                                return; /* No limit on attributes. */
                        }
                }

                $attributes =& $request['Attributes'];

                foreach ($attributes as $name => $values) {
                        if (!in_array($name, $allowedAttributes, TRUE)) {
                // the attribute name is not in the array of allowed attributes
                if (array_key_exists($name, $allowedAttributes)) {
                    // but it is an index of the array
                    if (!is_array($allowedAttributes[$name])) {
                        throw new SimpleSAML_Error_Exception('AttributeLimit: Values for ' . var_export($name, TRUE) .
                            ' must be specified in an array.');
                    }
                    $attributes[$name] = array_intersect($attributes[$name], $allowedAttributes[$name]);
                    if (!empty($attributes[$name])) {
                        continue;
                    }
                }
                unset($attributes[$name]);
                        }
                }

        }

}