TargetedID.php

Go to the documentation of this file.

<?php

class sspmod_core_Auth_Process_TargetedID extends SimpleSAML_Auth_ProcessingFilter {


        private $attribute = NULL;


        private $generateNameId = FALSE;


        public function __construct($config, $reserved) {
                parent::__construct($config, $reserved);

                assert('is_array($config)');

                if (array_key_exists('attributename', $config)) {
                        $this->attribute = $config['attributename'];
                        if (!is_string($this->attribute)) {
                                throw new Exception('Invalid attribute name given to core:TargetedID filter.');
                        }
                }

                if (array_key_exists('nameId', $config)) {
                        $this->generateNameId = $config['nameId'];
                        if (!is_bool($this->generateNameId)) {
                                throw new Exception('Invalid value of \'nameId\'-option to core:TargetedID filter.');
                        }
                }
        }


        public function process(&$state) {
                assert('is_array($state)');
                assert('array_key_exists("Attributes", $state)');

                if ($this->attribute === NULL) {
                        if (!array_key_exists('UserID', $state)) {
                                throw new Exception('core:TargetedID: Missing UserID for this user. Please' .
                                        ' check the \'userid.attribute\' option in the metadata against the' .
                                        ' attributes provided by the authentication source.');
                        }

                        $userID = $state['UserID'];
                } else {
                        if (!array_key_exists($this->attribute, $state['Attributes'])) {
                                throw new Exception('core:TargetedID: Missing attribute \'' . $this->attribute .
                                        '\', which is needed to generate the targeted ID.');
                        }

                        $userID = $state['Attributes'][$this->attribute][0];
                }


                $secretSalt = SimpleSAML\Utils\Config::getSecretSalt();

                if (array_key_exists('Source', $state)) {
                        $srcID = self::getEntityId($state['Source']);
                } else {
                        $srcID = '';
                }

                if (array_key_exists('Destination', $state)) {
                        $dstID = self::getEntityId($state['Destination']);
                } else {
                        $dstID = '';
                }

                $uidData = 'uidhashbase' . $secretSalt;
                $uidData .= strlen($srcID) . ':' . $srcID;
                $uidData .= strlen($dstID) . ':' . $dstID;
                $uidData .= strlen($userID) . ':' . $userID;
                $uidData .= $secretSalt;

                $uid = hash('sha1', $uidData);

                if ($this->generateNameId) {
                        // Convert the targeted ID to a SAML 2.0 name identifier element
                        $nameId = new \SAML2\XML\saml\NameID();
                        $nameId->value = $uid;
                        $nameId->Format = \SAML2\Constants::NAMEID_PERSISTENT;

                        if (isset($state['Source']['entityid'])) {
                                $nameId->NameQualifier = $state['Source']['entityid'];
                        }
                        if (isset($state['Destination']['entityid'])) {
                                $nameId->SPNameQualifier = $state['Destination']['entityid'];
                        }
                } else {
                        $nameId = $uid;
                }

                $state['Attributes']['eduPersonTargetedID'] = array($nameId);
        }


        private static function getEntityId($metadata) {
                assert('is_array($metadata)');

                $id = '';

                if (array_key_exists('metadata-set', $metadata)) {
                        $set = $metadata['metadata-set'];
                        $id .= 'set' . strlen($set) . ':' . $set;
                }

                if (array_key_exists('entityid', $metadata)) {
                        $entityid = $metadata['entityid'];
                        $id .= 'set' . strlen($entityid) . ':' . $entityid;
                }

                return $id;
        }

}