Configuration.php

Go to the documentation of this file.

<?php
 
 
class SimpleSAML_Configuration implements \SimpleSAML\Utils\ClearableState
{
 
    const REQUIRED_OPTION = '___REQUIRED_OPTION___';
 
 
    private static $instance = array();
 
 
    private static $configDirs = array();
 
 
    private static $loadedConfigs = array();
 
 
    private $configuration;
 
 
    private $location;
 
 
    private $filename = null;
 
 
    private $deprecated_base_url_used = false;
 
 
    public function __construct($config, $location)
    {
        assert('is_array($config)');
        assert('is_string($location)');
 
        $this->configuration = $config;
        $this->location = $location;
    }
 
 
    private static function loadFromFile($filename, $required)
    {
        assert('is_string($filename)');
        assert('is_bool($required)');
 
        if (array_key_exists($filename, self::$loadedConfigs)) {
            return self::$loadedConfigs[$filename];
        }
 
        if (file_exists($filename)) {
            $config = 'UNINITIALIZED';
 
            // the file initializes a variable named '$config'
            ob_start();
            if (interface_exists('Throwable')) {
                try {
                    require($filename);
                } catch (ParseError $e) {
                    self::$loadedConfigs[$filename] = self::loadFromArray(array(), '[ARRAY]', 'simplesaml');
                    throw new SimpleSAML\Error\ConfigurationError($e->getMessage(), $filename, array());
                }
            } else {
                require($filename);
            }
 
            $spurious_output = ob_get_length() > 0;
            ob_end_clean();
 
            // check that $config exists
            if (!isset($config)) {
                throw new \SimpleSAML\Error\ConfigurationError(
                    '$config is not defined in the configuration file.',
                    $filename
                );
            }
 
            // check that $config is initialized to an array
            if (!is_array($config)) {
                throw new \SimpleSAML\Error\ConfigurationError(
                    '$config is not an array.',
                    $filename
                );
            }
 
            // check that $config is not empty
            if (empty($config)) {
                throw new \SimpleSAML\Error\ConfigurationError(
                    '$config is empty.',
                    $filename
                );
            }
        } elseif ($required) {
            // file does not exist, but is required
            throw new \SimpleSAML\Error\ConfigurationError('Missing configuration file', $filename);
        } else {
            // file does not exist, but is optional, so return an empty configuration object without saving it
            $cfg = new SimpleSAML_Configuration(array(), $filename);
            $cfg->filename = $filename;
            return $cfg;
        }
 
        $cfg = new SimpleSAML_Configuration($config, $filename);
        $cfg->filename = $filename;
 
        self::$loadedConfigs[$filename] = $cfg;
 
        if ($spurious_output) {
            SimpleSAML\Logger::warning(
                "The configuration file '$filename' generates output. Please review your configuration."
            );
        }
 
        return $cfg;
    }
 
 
    public static function setConfigDir($path, $configSet = 'simplesaml')
    {
        assert('is_string($path)');
        assert('is_string($configSet)');
 
        self::$configDirs[$configSet] = $path;
    }
 
 
    public static function getConfig($filename = 'config.php', $configSet = 'simplesaml')
    {
        assert('is_string($filename)');
        assert('is_string($configSet)');
 
        if (!array_key_exists($configSet, self::$configDirs)) {
            if ($configSet !== 'simplesaml') {
                throw new Exception('Configuration set \''.$configSet.'\' not initialized.');
            } else {
                self::$configDirs['simplesaml'] = SimpleSAML\Utils\Config::getConfigDir();
            }
        }
 
        $dir = self::$configDirs[$configSet];
        $filePath = $dir.'/'.$filename;
        return self::loadFromFile($filePath, true);
    }
 
 
    public static function getOptionalConfig($filename = 'config.php', $configSet = 'simplesaml')
    {
        assert('is_string($filename)');
        assert('is_string($configSet)');
 
        if (!array_key_exists($configSet, self::$configDirs)) {
            if ($configSet !== 'simplesaml') {
                throw new Exception('Configuration set \''.$configSet.'\' not initialized.');
            } else {
                self::$configDirs['simplesaml'] = SimpleSAML\Utils\Config::getConfigDir();
            }
        }
 
        $dir = self::$configDirs[$configSet];
        $filePath = $dir.'/'.$filename;
        return self::loadFromFile($filePath, false);
    }
 
 
    public static function loadFromArray($config, $location = '[ARRAY]', $instance = null)
    {
        assert('is_array($config)');
        assert('is_string($location)');
 
        $c = new SimpleSAML_Configuration($config, $location);
        if ($instance !== null) {
            self::$instance[$instance] = $c;
        }
        return $c;
    }
 
 
    public static function getInstance($instancename = 'simplesaml')
    {
        assert('is_string($instancename)');
 
        // check if the instance exists already
        if (array_key_exists($instancename, self::$instance)) {
            return self::$instance[$instancename];
        }
 
        if ($instancename === 'simplesaml') {
            try {
                return self::getConfig();
            } catch (SimpleSAML\Error\ConfigurationError $e) {
                throw \SimpleSAML\Error\CriticalConfigurationError::fromException($e);
            }
        }
 
        throw new \SimpleSAML\Error\CriticalConfigurationError(
            'Configuration with name '.$instancename.' is not initialized.'
        );
    }
 
 
    public static function init($path, $instancename = 'simplesaml', $configfilename = 'config.php')
    {
        assert('is_string($path)');
        assert('is_string($instancename)');
        assert('is_string($configfilename)');
 
        if ($instancename === 'simplesaml') {
            // for backwards compatibility
            self::setConfigDir($path, 'simplesaml');
        }
 
        // check if we already have loaded the given config - return the existing instance if we have
        if (array_key_exists($instancename, self::$instance)) {
            return self::$instance[$instancename];
        }
 
        self::$instance[$instancename] = self::loadFromFile($path.'/'.$configfilename, true);
        return self::$instance[$instancename];
    }
 
 
    public function copyFromBase($instancename, $filename)
    {
        assert('is_string($instancename)');
        assert('is_string($filename)');
        assert('$this->filename !== NULL');
 
        // check if we already have loaded the given config - return the existing instance if we have
        if (array_key_exists($instancename, self::$instance)) {
            return self::$instance[$instancename];
        }
 
        $dir = dirname($this->filename);
 
        self::$instance[$instancename] = self::loadFromFile($dir.'/'.$filename, true);
        return self::$instance[$instancename];
    }
 
 
    public function getVersion()
    {
        return '1.15.3';
    }
 
 
    public function getValue($name, $default = null)
    {
        // return the default value if the option is unset
        if (!array_key_exists($name, $this->configuration)) {
            if ($default === self::REQUIRED_OPTION) {
                throw new Exception(
                    $this->location.': Could not retrieve the required option '.
                    var_export($name, true)
                );
            }
            return $default;
        }
 
        return $this->configuration[$name];
    }
 
 
    public function hasValue($name)
    {
        return array_key_exists($name, $this->configuration);
    }
 
 
    public function hasValueOneOf($names)
    {
        foreach ($names as $name) {
            if ($this->hasValue($name)) {
                return true;
            }
        }
        return false;
    }
 
 
    public function getBaseURL()
    {
        if (!$this->deprecated_base_url_used) {
            $this->deprecated_base_url_used = true;
            SimpleSAML\Logger::warning(
                "SimpleSAML_Configuration::getBaseURL() is deprecated, please use getBasePath() instead."
            );
        }
        if (preg_match('/^\*(.*)$/D', $this->getString('baseurlpath', 'simplesaml/'), $matches)) {
            // deprecated behaviour, will be removed in the future
            return \SimpleSAML\Utils\HTTP::getFirstPathElement(false).$matches[1];
        }
        return ltrim($this->getBasePath(), '/');
    }
 
 
    public function getBasePath()
    {
        $baseURL = $this->getString('baseurlpath', 'simplesaml/');
 
        if (preg_match('#^https?://[^/]*(?:/(.+/?)?)?$#', $baseURL, $matches)) {
            // we have a full url, we need to strip the path
            if (!array_key_exists(1, $matches)) {
                // absolute URL without path
                return '/';
            }
            return '/'.rtrim($matches[1], '/')."/";
        } elseif ($baseURL === '' || $baseURL === '/') {
            // root directory of site
            return '/';
        } elseif (preg_match('#^/?((?:[^/\s]+/?)+)#', $baseURL, $matches)) {
            // local path only
            return '/'.rtrim($matches[1], '/').'/';
        } else {
            /*
             * Invalid 'baseurlpath'. We cannot recover from this, so throw a critical exception and try to be graceful
             * with the configuration. Use a guessed base path instead of the one provided.
             */
            $c = $this->toArray();
            $c['baseurlpath'] = SimpleSAML\Utils\HTTP::guessBasePath();
            throw new SimpleSAML\Error\CriticalConfigurationError(
                'Incorrect format for option \'baseurlpath\'. Value is: "'.
                $this->getString('baseurlpath', 'simplesaml/').'". Valid format is in the form'.
                ' [(http|https)://(hostname|fqdn)[:port]]/[path/to/simplesaml/].',
                $this->filename,
                $c
            );
        }
    }
 
 
    public function resolvePath($path)
    {
        if ($path === null) {
            return null;
        }
 
        assert('is_string($path)');
 
        /* Prepend path with basedir if it doesn't start with a slash or a Windows drive letter (e.g. "C:\"). We assume
         * getBaseDir ends with a slash.
         */
        if ($path[0] !== '/' &&
            !(preg_match('@^[a-z]:[\\\\/]@i', $path, $matches) && is_dir($matches[0]))
        ) {
            $path = $this->getBaseDir().$path;
        }
 
        // remove trailing slashes
        $path = rtrim($path, '/');
 
        return $path;
    }
 
 
    public function getPathValue($name, $default = null)
    {
        // return the default value if the option is unset
        if (!array_key_exists($name, $this->configuration)) {
            $path = $default;
        } else {
            $path = $this->configuration[$name];
        }
 
        if ($path === null) {
            return null;
        }
 
        return $this->resolvePath($path).'/';
    }
 
 
    public function getBaseDir()
    {
        // check if a directory is configured in the configuration file
        $dir = $this->getString('basedir', null);
        if ($dir !== null) {
            // add trailing slash if it is missing
            if (substr($dir, -1) !== DIRECTORY_SEPARATOR) {
                $dir .= DIRECTORY_SEPARATOR;
            }
 
            return $dir;
        }
 
        // the directory wasn't set in the configuration file, path is <base directory>/lib/SimpleSAML/Configuration.php
        $dir = __FILE__;
        assert('basename($dir) === "Configuration.php"');
 
        $dir = dirname($dir);
        assert('basename($dir) === "SimpleSAML"');
 
        $dir = dirname($dir);
        assert('basename($dir) === "lib"');
 
        $dir = dirname($dir);
 
        // Add trailing directory separator
        $dir .= DIRECTORY_SEPARATOR;
 
        return $dir;
    }
 
 
    public function getBoolean($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_bool($ret)) {
            throw new Exception(
                $this->location.': The option '.var_export($name, true).
                ' is not a valid boolean value.'
            );
        }
 
        return $ret;
    }
 
 
    public function getString($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_string($ret)) {
            throw new Exception(
                $this->location.': The option '.var_export($name, true).
                ' is not a valid string value.'
            );
        }
 
        return $ret;
    }
 
 
    public function getInteger($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_int($ret)) {
            throw new Exception(
                $this->location.': The option '.var_export($name, true).
                ' is not a valid integer value.'
            );
        }
 
        return $ret;
    }
 
 
    public function getIntegerRange($name, $minimum, $maximum, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
        assert('is_int($minimum)');
        assert('is_int($maximum)');
 
        $ret = $this->getInteger($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if ($ret < $minimum || $ret > $maximum) {
            throw new Exception(
                $this->location.': Value of option '.var_export($name, true).
                ' is out of range. Value is '.$ret.', allowed range is ['
                .$minimum.' - '.$maximum.']'
            );
        }
 
        return $ret;
    }
 
 
    public function getValueValidate($name, $allowedValues, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
        assert('is_array($allowedValues)');
 
        $ret = $this->getValue($name, $default);
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!in_array($ret, $allowedValues, true)) {
            $strValues = array();
            foreach ($allowedValues as $av) {
                $strValues[] = var_export($av, true);
            }
            $strValues = implode(', ', $strValues);
 
            throw new Exception(
                $this->location.': Invalid value given for the option '.
                var_export($name, true).'. It should have one of the following values: '.
                $strValues.'; but it had the following value: '.var_export($ret, true)
            );
        }
 
        return $ret;
    }
 
 
    public function getArray($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_array($ret)) {
            throw new Exception($this->location.': The option '.var_export($name, true).' is not an array.');
        }
 
        return $ret;
    }
 
 
    public function getArrayize($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_array($ret)) {
            $ret = array($ret);
        }
 
        return $ret;
    }
 
 
    public function getArrayizeString($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getArrayize($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        foreach ($ret as $value) {
            if (!is_string($value)) {
                throw new Exception(
                    $this->location.': The option '.var_export($name, true).
                    ' must be a string or an array of strings.'
                );
            }
        }
 
        return $ret;
    }
 
 
    public function getConfigItem($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_array($ret)) {
            throw new Exception(
                $this->location.': The option '.var_export($name, true).
                ' is not an array.'
            );
        }
 
        return self::loadFromArray($ret, $this->location.'['.var_export($name, true).']');
    }
 
 
    public function getConfigList($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
 
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        if (!is_array($ret)) {
            throw new Exception(
                $this->location.': The option '.var_export($name, true).
                ' is not an array.'
            );
        }
 
        $out = array();
        foreach ($ret as $index => $config) {
            $newLoc = $this->location.'['.var_export($name, true).']['.
                var_export($index, true).']';
            if (!is_array($config)) {
                throw new Exception($newLoc.': The value of this element was expected to be an array.');
            }
            $out[$index] = self::loadFromArray($config, $newLoc);
        }
 
        return $out;
    }
 
 
    public function getOptions()
    {
        return array_keys($this->configuration);
    }
 
 
    public function toArray()
    {
        return $this->configuration;
    }
 
 
    private function getDefaultBinding($endpointType)
    {
        assert('is_string($endpointType)');
 
        $set = $this->getString('metadata-set');
        switch ($set.':'.$endpointType) {
            case 'saml20-idp-remote:SingleSignOnService':
            case 'saml20-idp-remote:SingleLogoutService':
            case 'saml20-sp-remote:SingleLogoutService':
                return \SAML2\Constants::BINDING_HTTP_REDIRECT;
            case 'saml20-sp-remote:AssertionConsumerService':
                return \SAML2\Constants::BINDING_HTTP_POST;
            case 'saml20-idp-remote:ArtifactResolutionService':
                return \SAML2\Constants::BINDING_SOAP;
            case 'shib13-idp-remote:SingleSignOnService':
                return 'urn:mace:shibboleth:1.0:profiles:AuthnRequest';
            case 'shib13-sp-remote:AssertionConsumerService':
                return 'urn:oasis:names:tc:SAML:1.0:profiles:browser-post';
            default:
                throw new Exception('Missing default binding for '.$endpointType.' in '.$set);
        }
    }
 
 
    public function getEndpoints($endpointType)
    {
        assert('is_string($endpointType)');
 
        $loc = $this->location.'['.var_export($endpointType, true).']:';
 
        if (!array_key_exists($endpointType, $this->configuration)) {
            // no endpoints of the given type
            return array();
        }
 
 
        $eps = $this->configuration[$endpointType];
        if (is_string($eps)) {
            // for backwards-compatibility
            $eps = array($eps);
        } elseif (!is_array($eps)) {
            throw new Exception($loc.': Expected array or string.');
        }
 
 
        foreach ($eps as $i => &$ep) {
            $iloc = $loc.'['.var_export($i, true).']';
 
            if (is_string($ep)) {
                // for backwards-compatibility
                $ep = array(
                    'Location' => $ep,
                    'Binding'  => $this->getDefaultBinding($endpointType),
                );
                $responseLocation = $this->getString($endpointType.'Response', null);
                if ($responseLocation !== null) {
                    $ep['ResponseLocation'] = $responseLocation;
                }
            } elseif (!is_array($ep)) {
                throw new Exception($iloc.': Expected a string or an array.');
            }
 
            if (!array_key_exists('Location', $ep)) {
                throw new Exception($iloc.': Missing Location.');
            }
            if (!is_string($ep['Location'])) {
                throw new Exception($iloc.': Location must be a string.');
            }
 
            if (!array_key_exists('Binding', $ep)) {
                throw new Exception($iloc.': Missing Binding.');
            }
            if (!is_string($ep['Binding'])) {
                throw new Exception($iloc.': Binding must be a string.');
            }
 
            if (array_key_exists('ResponseLocation', $ep)) {
                if (!is_string($ep['ResponseLocation'])) {
                    throw new Exception($iloc.': ResponseLocation must be a string.');
                }
            }
 
            if (array_key_exists('index', $ep)) {
                if (!is_int($ep['index'])) {
                    throw new Exception($iloc.': index must be an integer.');
                }
            }
        }
 
        return $eps;
    }
 
 
    public function getEndpointPrioritizedByBinding($endpointType, array $bindings, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($endpointType)');
 
        $endpoints = $this->getEndpoints($endpointType);
 
        foreach ($bindings as $binding) {
            foreach ($endpoints as $ep) {
                if ($ep['Binding'] === $binding) {
                    return $ep;
                }
            }
        }
 
        if ($default === self::REQUIRED_OPTION) {
            $loc = $this->location.'['.var_export($endpointType, true).']:';
            throw new Exception($loc.'Could not find a supported '.$endpointType.' endpoint.');
        }
 
        return $default;
    }
 
 
    public function getDefaultEndpoint($endpointType, array $bindings = null, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($endpointType)');
 
        $endpoints = $this->getEndpoints($endpointType);
 
        $defaultEndpoint = \SimpleSAML\Utils\Config\Metadata::getDefaultEndpoint($endpoints, $bindings);
        if ($defaultEndpoint !== null) {
            return $defaultEndpoint;
        }
 
        if ($default === self::REQUIRED_OPTION) {
            $loc = $this->location.'['.var_export($endpointType, true).']:';
            throw new Exception($loc.'Could not find a supported '.$endpointType.' endpoint.');
        }
 
        return $default;
    }
 
 
    public function getLocalizedString($name, $default = self::REQUIRED_OPTION)
    {
        assert('is_string($name)');
 
        $ret = $this->getValue($name, $default);
        if ($ret === $default) {
            // the option wasn't found, or it matches the default value. In any case, return this value
            return $ret;
        }
 
        $loc = $this->location.'['.var_export($name, true).']';
 
        if (is_string($ret)) {
            $ret = array('en' => $ret,);
        }
 
        if (!is_array($ret)) {
            throw new Exception($loc.': Must be an array or a string.');
        }
 
        foreach ($ret as $k => $v) {
            if (!is_string($k)) {
                throw new Exception($loc.': Invalid language code: '.var_export($k, true));
            }
            if (!is_string($v)) {
                throw new Exception($loc.'['.var_export($v, true).']: Must be a string.');
            }
        }
 
        return $ret;
    }
 
 
    public function getPublicKeys($use = null, $required = false, $prefix = '')
    {
        assert('is_bool($required)');
        assert('is_string($prefix)');
 
        if ($this->hasValue($prefix.'keys')) {
            $ret = array();
            foreach ($this->getArray($prefix.'keys') as $key) {
                if ($use !== null && isset($key[$use]) && !$key[$use]) {
                    continue;
                }
                if (isset($key['X509Certificate'])) {
                    // Strip whitespace from key
                    $key['X509Certificate'] = preg_replace('/\s+/', '', $key['X509Certificate']);
                }
                $ret[] = $key;
            }
            if (!empty($ret)) {
                return $ret;
            }
        } elseif ($this->hasValue($prefix.'certData')) {
            $certData = $this->getString($prefix.'certData');
            $certData = preg_replace('/\s+/', '', $certData);
            return array(
                array(
                    'encryption'      => true,
                    'signing'         => true,
                    'type'            => 'X509Certificate',
                    'X509Certificate' => $certData,
                ),
            );
        } elseif ($this->hasValue($prefix.'certificate')) {
            $file = $this->getString($prefix.'certificate');
            $file = \SimpleSAML\Utils\Config::getCertPath($file);
            $data = @file_get_contents($file);
 
            if ($data === false) {
                throw new Exception($this->location.': Unable to load certificate/public key from file "'.$file.'".');
            }
 
            // extract certificate data (if this is a certificate)
            $pattern = '/^-----BEGIN CERTIFICATE-----([^-]*)^-----END CERTIFICATE-----/m';
            if (!preg_match($pattern, $data, $matches)) {
                throw new SimpleSAML_Error_Exception(
                    $this->location.': Could not find PEM encoded certificate in "'.$file.'".'
                );
            }
            $certData = preg_replace('/\s+/', '', $matches[1]);
 
            return array(
                array(
                    'encryption'      => true,
                    'signing'         => true,
                    'type'            => 'X509Certificate',
                    'X509Certificate' => $certData,
                ),
            );
        }
 
        if ($required) {
            throw new SimpleSAML_Error_Exception($this->location.': Missing certificate in metadata.');
        } else {
            return null;
        }
    }
 
    public static function clearInternalState()
    {
        self::$configDirs = array();
        self::$instance = array();
        self::$loadedConfigs = array();
    }
}