ProcessingChain.php

Go to the documentation of this file.

<?php
 
class SimpleSAML_Auth_ProcessingChain {
 
 
        const FILTERS_INDEX = 'SimpleSAML_Auth_ProcessingChain.filters';
 
 
        const COMPLETED_STAGE = 'SimpleSAML_Auth_ProcessingChain.completed';
 
 
        const AUTHPARAM = 'AuthProcId';
 
 
        private $filters;
 
 
        public function __construct($idpMetadata, $spMetadata, $mode = 'idp') {
                assert('is_array($idpMetadata)');
                assert('is_array($spMetadata)');
 
                $this->filters = array();
                
                $config = SimpleSAML_Configuration::getInstance();
                $configauthproc = $config->getArray('authproc.' . $mode, NULL);
                
                if (!empty($configauthproc)) {
                        $configfilters = self::parseFilterList($configauthproc);
                        self::addFilters($this->filters, $configfilters);
                }
 
                if (array_key_exists('authproc', $idpMetadata)) {
                        $idpFilters = self::parseFilterList($idpMetadata['authproc']);
                        self::addFilters($this->filters, $idpFilters);
                }
 
                if (array_key_exists('authproc', $spMetadata)) {
                        $spFilters = self::parseFilterList($spMetadata['authproc']);
                        self::addFilters($this->filters, $spFilters);
                }
 
 
                SimpleSAML\Logger::debug('Filter config for ' . $idpMetadata['entityid'] . '->' .
                        $spMetadata['entityid'] . ': ' . str_replace("\n", '', var_export($this->filters, TRUE)));
 
        }
 
 
        private static function addFilters(&$target, $src) {
                assert('is_array($target)');
                assert('is_array($src)');
 
                foreach ($src as $filter) {
                        $fp = $filter->priority;
 
                        // Find insertion position for filter
                        for($i = count($target)-1; $i >= 0; $i--) {
                                if ($target[$i]->priority <= $fp) {
                                        // The new filter should be inserted after this one
                                        break;
                                }
                        }
                        /* $i now points to the filter which should preceede the current filter. */
                        array_splice($target, $i+1, 0, array($filter));
                }
 
        }
 
 
        private static function parseFilterList($filterSrc) {
                assert('is_array($filterSrc)');
 
                $parsedFilters = array();
 
                foreach ($filterSrc as $priority => $filter) {
 
                        if (is_string($filter)) {
                                $filter = array('class' => $filter);
                        }
 
                        if (!is_array($filter)) {
                                throw new Exception('Invalid authentication processing filter configuration: ' .
                                        'One of the filters wasn\'t a string or an array.');
                        }
 
                        $parsedFilters[] = self::parseFilter($filter, $priority);
                }
 
                return $parsedFilters;
        }
 
 
        private static function parseFilter($config, $priority) {
                assert('is_array($config)');
 
                if (!array_key_exists('class', $config)) 
                        throw new Exception('Authentication processing filter without name given.');
 
                $className = SimpleSAML\Module::resolveClass($config['class'], 'Auth_Process', 'SimpleSAML_Auth_ProcessingFilter');
                $config['%priority'] = $priority;
                unset($config['class']);
                return new $className($config, NULL);
        }
 
 
        public function processState(&$state) {
                assert('is_array($state)');
                assert('array_key_exists("ReturnURL", $state) || array_key_exists("ReturnCall", $state)');
                assert('!array_key_exists("ReturnURL", $state) || !array_key_exists("ReturnCall", $state)');
 
                $state[self::FILTERS_INDEX] = $this->filters;
 
                try {
 
                        // TODO: remove this in SSP 2.0
                        if (!array_key_exists('UserID', $state)) {
                                // No unique user ID present. Attempt to add one.
                                self::addUserID($state);
                        }
 
                        while (count($state[self::FILTERS_INDEX]) > 0) {
                                $filter = array_shift($state[self::FILTERS_INDEX]);
                                $filter->process($state);
                        }
 
                } catch (SimpleSAML_Error_Exception $e) {
                        // No need to convert the exception
                        throw $e;
                } catch (Exception $e) {
                        /*
                         * To be consistent with the exception we return after an redirect,
                         * we convert this exception before returning it.
                         */
                        throw new SimpleSAML_Error_UnserializableException($e);
                }
 
                // Completed
        }
 
 
        public static function resumeProcessing($state) {
                assert('is_array($state)');
 
                while (count($state[self::FILTERS_INDEX]) > 0) {
                        $filter = array_shift($state[self::FILTERS_INDEX]);
                        try {
                                $filter->process($state);
                        } catch (SimpleSAML_Error_Exception $e) {
                                SimpleSAML_Auth_State::throwException($state, $e);
                        } catch (Exception $e) {
                                $e = new SimpleSAML_Error_UnserializableException($e);
                                SimpleSAML_Auth_State::throwException($state, $e);
                        }
                }
 
                // Completed
 
                assert('array_key_exists("ReturnURL", $state) || array_key_exists("ReturnCall", $state)');
                assert('!array_key_exists("ReturnURL", $state) || !array_key_exists("ReturnCall", $state)');
 
 
                if (array_key_exists('ReturnURL', $state)) {
                        /*
                         * Save state information, and redirect to the URL specified
                         * in $state['ReturnURL'].
                         */
                        $id = SimpleSAML_Auth_State::saveState($state, self::COMPLETED_STAGE);
                        \SimpleSAML\Utils\HTTP::redirectTrustedURL($state['ReturnURL'], array(self::AUTHPARAM => $id));
                } else {
                        /* Pass the state to the function defined in $state['ReturnCall']. */
 
                        // We are done with the state array in the session. Delete it.
                        SimpleSAML_Auth_State::deleteState($state);
 
                        $func = $state['ReturnCall'];
                        assert('is_callable($func)');
 
                        call_user_func($func, $state);
                        assert(FALSE);
                }
        }
 
 
        public function processStatePassive(&$state) {
                assert('is_array($state)');
                // Should not be set when calling this method
                assert('!array_key_exists("ReturnURL", $state)');
 
                // Notify filters about passive request
                $state['isPassive'] = TRUE;
 
                $state[self::FILTERS_INDEX] = $this->filters;
 
                // TODO: remove this in SSP 2.0
                if (!array_key_exists('UserID', $state)) {
                        // No unique user ID present. Attempt to add one.
                        self::addUserID($state);
                }
 
                while (count($state[self::FILTERS_INDEX]) > 0) {
                        $filter = array_shift($state[self::FILTERS_INDEX]);
                        try {
                                $filter->process($state);
 
                        // Ignore SimpleSAML_Error_NoPassive exceptions
                        } catch (SimpleSAML_Error_NoPassive $e) { }
                }
        }
 
        public static function fetchProcessedState($id) {
                assert('is_string($id)');
 
                return SimpleSAML_Auth_State::loadState($id, self::COMPLETED_STAGE);
        }
 
 
        private static function addUserID(&$state) {
                assert('is_array($state)');
                assert('array_key_exists("Attributes", $state)');
 
                if (isset($state['Destination']['userid.attribute'])) {
                        $attributeName = $state['Destination']['userid.attribute'];
                        SimpleSAML\Logger::warning("The 'userid.attribute' option has been deprecated.");
                } elseif (isset($state['Source']['userid.attribute'])) {
                        $attributeName = $state['Source']['userid.attribute'];
                        SimpleSAML\Logger::warning("The 'userid.attribute' option has been deprecated.");
                } else {
                        // Default attribute
                        $attributeName = 'eduPersonPrincipalName';
                }
 
                if (!array_key_exists($attributeName, $state['Attributes'])) {
                        return;
                }
 
                $uid = $state['Attributes'][$attributeName];
                if (count($uid) === 0) {
                        SimpleSAML\Logger::warning('Empty user id attribute [' . $attributeName . '].');
                        return;
                }
 
                if (count($uid) > 1) {
                        SimpleSAML\Logger::warning('Multiple attribute values for user id attribute [' . $attributeName . '].');
                        return;
                }
 
                // TODO: the attribute value should be trimmed
                $uid = $uid[0];
 
                if (empty($uid)) {
                        SimpleSAML\Logger::warning('Empty value in attribute '.$attributeName.". on user. Cannot set UserID.");
                        return;
                }
                $state['UserID'] = $uid;
        }
 
}