sspmod_core_Auth_Process_AttributeLimit Class Reference

Inheritance diagram for sspmod_core_Auth_Process_AttributeLimit:

Collaboration diagram for sspmod_core_Auth_Process_AttributeLimit:

Public Member Functions
	__construct ($config, $reserved)
	Initialize this filter. More...
	process (&$request)
	Apply filter to remove attributes. More...
Public Member Functions inherited from SimpleSAML_Auth_ProcessingFilter
	__construct (&$config, $reserved)
	Constructor for a processing filter. More...
	process (&$request)
	Process a request. More...

Static Private Member Functions
static	getSPIdPAllowed (array &$request)
	Get list of allowed from the SP/IdP config. More...

Private Attributes
	$allowedAttributes = array()
	List of attributes which this filter will allow through. More...
	$isDefault = FALSE

Additional Inherited Members
Data Fields inherited from SimpleSAML_Auth_ProcessingFilter
	$priority = 50
	Priority of this filter. More...

Detailed Description

Definition at line 9 of file AttributeLimit.php.

Constructor & Destructor Documentation

__construct()

sspmod_core_Auth_Process_AttributeLimit::__construct	(		$config,
			$reserved
	)

Initialize this filter.

Parameters

array	$config	Configuration information about this filter.
mixed	$reserved	For future use

Exceptions

SimpleSAML_Error_Exception

If invalid configuration is found.

Definition at line 32 of file AttributeLimit.php.

References $config, and $index.

                                                        {
                parent::__construct($config, $reserved);

                assert('is_array($config)');

                foreach ($config as $index => $value) {
                        if ($index === 'default') {
                                $this->isDefault = (bool)$value;
                        } elseif (is_int($index)) {
                                if (!is_string($value)) {
                                        throw new SimpleSAML_Error_Exception('AttributeLimit: Invalid attribute name: ' .
                        var_export($value, TRUE));
                                }
                                $this->allowedAttributes[] = $value;
            } elseif (is_string($index)) {
                if (!is_array($value)) {
                    throw new SimpleSAML_Error_Exception('AttributeLimit: Values for ' . var_export($index, TRUE) .
                        ' must be specified in an array.');
                }
                $this->allowedAttributes[$index] = $value;
                        } else {
                                throw new SimpleSAML_Error_Exception('AttributeLimit: Invalid option: ' . var_export($index, TRUE));
                        }
                }
        }

Member Function Documentation

getSPIdPAllowed()

static sspmod_core_Auth_Process_AttributeLimit::getSPIdPAllowed ( array &  $request )

staticprivate

Get list of allowed from the SP/IdP config.

Parameters

array

&$request

The current request.

Returns

array|NULL Array with attribute names, or NULL if no limit is placed.

Definition at line 65 of file AttributeLimit.php.

                                                                 {

                if (array_key_exists('attributes', $request['Destination'])) {
                        // SP Config
                        return $request['Destination']['attributes'];
                }
                if (array_key_exists('attributes', $request['Source'])) {
                        // IdP Config
                        return $request['Source']['attributes'];
                }
                return NULL;
        }

process()

sspmod_core_Auth_Process_AttributeLimit::process

(

&

$request

)

Apply filter to remove attributes.

Removes all attributes which aren't one of the allowed attributes.

Parameters

array

&$request

The current request

Exceptions

SimpleSAML_Error_Exception

If invalid configuration is found.

Definition at line 87 of file AttributeLimit.php.

References $allowedAttributes, $attributes, and $name.

                                           {
                assert('is_array($request)');
                assert('array_key_exists("Attributes", $request)');

                if ($this->isDefault) {
                        $allowedAttributes = self::getSPIdPAllowed($request);
                        if ($allowedAttributes === NULL) {
                                $allowedAttributes = $this->allowedAttributes;
                        }
                } elseif (!empty($this->allowedAttributes)) {
                        $allowedAttributes = $this->allowedAttributes;
                } else {
                        $allowedAttributes = self::getSPIdPAllowed($request);
                        if ($allowedAttributes === NULL) {
                                return; /* No limit on attributes. */
                        }
                }

                $attributes =& $request['Attributes'];

                foreach ($attributes as $name => $values) {
                        if (!in_array($name, $allowedAttributes, TRUE)) {
                // the attribute name is not in the array of allowed attributes
                if (array_key_exists($name, $allowedAttributes)) {
                    // but it is an index of the array
                    if (!is_array($allowedAttributes[$name])) {
                        throw new SimpleSAML_Error_Exception('AttributeLimit: Values for ' . var_export($name, TRUE) .
                            ' must be specified in an array.');
                    }
                    $attributes[$name] = array_intersect($attributes[$name], $allowedAttributes[$name]);
                    if (!empty($attributes[$name])) {
                        continue;
                    }
                }
                unset($attributes[$name]);
                        }
                }

        }

Field Documentation

$allowedAttributes

sspmod_core_Auth_Process_AttributeLimit::$allowedAttributes = array()

private

List of attributes which this filter will allow through.

Definition at line 14 of file AttributeLimit.php.

Referenced by process().

$isDefault

sspmod_core_Auth_Process_AttributeLimit::$isDefault = FALSE

private

Definition at line 22 of file AttributeLimit.php.

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/modules/core/lib/Auth/Process/AttributeLimit.php