sspmod_statistics_AccessCheck Class Reference

Collaboration diagram for sspmod_statistics_AccessCheck:

Static Public Member Functions
static	checkAccess (SimpleSAML_Configuration $statconfig)
	Check that the user has access to the statistics. More...

Detailed Description

Definition at line 8 of file AccessCheck.php.

Member Function Documentation

checkAccess()

static sspmod_statistics_AccessCheck::checkAccess ( SimpleSAML_Configuration  $statconfig )

static

Check that the user has access to the statistics.

If the user doesn't have access, send the user to the login page.

Definition at line 15 of file AccessCheck.php.

    {
        $protected = $statconfig->getBoolean('protected', false);
        $authsource = $statconfig->getString('auth', null);
        $allowedusers = $statconfig->getValue('allowedUsers', null);
        $useridattr = $statconfig->getString('useridattr', 'eduPersonPrincipalName');
 
        $acl = $statconfig->getValue('acl', null);
        if ($acl !== null && !is_string($acl) && !is_array($acl)) {
            throw new SimpleSAML_Error_Exception('Invalid value for \'acl\'-option. Should be an array or a string.');
        }
 
        if (!$protected) {
            return;
        }
 
        if (SimpleSAML\Utils\Auth::isAdmin()) {
            // User logged in as admin. OK.
            SimpleSAML\Logger::debug('Statistics auth - logged in as admin, access granted');
            return;
        }
 
        if (!isset($authsource)) {
            // If authsource is not defined, init admin login.
            SimpleSAML\Utils\Auth::requireAdmin();
        }
 
        // We are using an authsource for login.
 
        $as = new \SimpleSAML\Auth\Simple($authsource);
        $as->requireAuth();
 
        // User logged in with auth source.
        SimpleSAML\Logger::debug('Statistics auth - valid login with auth source [' . $authsource . ']');
 
        // Retrieving attributes
        $attributes = $as->getAttributes();
 
        if (!empty($allowedusers)) {
            // Check if userid exists
            if (!isset($attributes[$useridattr][0])) {
                throw new Exception('User ID is missing');
            }
 
            // Check if userid is allowed access..
            if (in_array($attributes[$useridattr][0], $allowedusers, true)) {
                SimpleSAML\Logger::debug('Statistics auth - User granted access by user ID [' . $attributes[$useridattr][0] . ']');
                return;
            }
            SimpleSAML\Logger::debug('Statistics auth - User denied access by user ID [' . $attributes[$useridattr][0] . ']');
        } else {
            SimpleSAML\Logger::debug('Statistics auth - no allowedUsers list.');
        }
 
        if (!is_null($acl)) {
            $acl = new sspmod_core_ACL($acl);
            if ($acl->allows($attributes)) {
                SimpleSAML\Logger::debug('Statistics auth - allowed access by ACL.');
                return;
            }
            SimpleSAML\Logger::debug('Statistics auth - denied access by ACL.');
        } else {
            SimpleSAML\Logger::debug('Statistics auth - no ACL configured.');
        }
        throw new SimpleSAML_Error_Exception('Access denied to the current user.');
    }

References $as, $attributes, $authsource, $statconfig, $useridattr, SimpleSAML\Logger\debug(), and SimpleSAML\Utils\Auth\requireAdmin().

Here is the call graph for this function:

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/modules/statistics/lib/AccessCheck.php