sspmod_authX509_Auth_Source_X509userCert Class Reference

Inheritance diagram for sspmod_authX509_Auth_Source_X509userCert:

Collaboration diagram for sspmod_authX509_Auth_Source_X509userCert:

Public Member Functions
	__construct ($info, &$config)
	Constructor for this authentication source. More...
	authFailed (&$state)
	Finish a failed authentication. More...
	authenticate (&$state)
	Validate certificate and login. More...
	authSuccesful (&$state)
	Finish a successful authentication. More...
Public Member Functions inherited from SimpleSAML_Auth_Source
	__construct ($info, &$config)
	Constructor for an authentication source. More...
	getAuthId ()
	Retrieve the ID of this authentication source. More...
	authenticate (&$state)
	Process a request. More...
	reauthenticate (array &$state)
	Reauthenticate an user. More...
	initLogin ($return, $errorURL=null, array $params=array())
	Start authentication. More...
	logout (&$state)
	Log out from this authentication source. More...

Private Attributes
	$x509attributes = array('UID' => 'uid')
	x509 attributes to use from the certificate for searching the user in the LDAP directory. More...
	$ldapusercert = array('userCertificate;binary')
	LDAP attribute containing the user certificate. More...
	$ldapcf
	LDAPConfigHelper object. More...

Additional Inherited Members
Static Public Member Functions inherited from SimpleSAML_Auth_Source
static	getSourcesOfType ($type)
	Get sources of a specific type. More...
static	completeAuth (&$state)
	Complete authentication. More...
static	loginCompleted ($state)
	Called when a login operation has finished. More...
static	completeLogout (&$state)
	Complete logout. More...
static	getById ($authId, $type=null)
	Retrieve authentication source. More...
static	logoutCallback ($state)
	Called when the authentication source receives an external logout request. More...
static	getSources ()
	Retrieve list of authentication sources. More...
Protected Member Functions inherited from SimpleSAML_Auth_Source
	addLogoutCallback ($assoc, $state)
	Add a logout callback association. More...
	callLogoutCallback ($assoc)
	Call a logout callback based on association. More...
Static Protected Member Functions inherited from SimpleSAML_Auth_Source
static	validateSource ($source, $id)
	Make sure that the first element of an auth source is its identifier. More...
Protected Attributes inherited from SimpleSAML_Auth_Source
	$authId

Detailed Description

Definition at line 9 of file X509userCert.php.

Constructor & Destructor Documentation

__construct()

sspmod_authX509_Auth_Source_X509userCert::__construct	(		$info,
		&	$config
	)

Constructor for this authentication source.

All subclasses who implement their own constructor must call this constructor before using $config for anything.

Parameters

array	$info	Information about this authentication source.
array	&$config	Configuration for this authentication source.

Definition at line 38 of file X509userCert.php.

References $config, and $info.

    {
        assert('is_array($info)');
        assert('is_array($config)');

        if (isset($config['authX509:x509attributes'])) {
            $this->x509attributes = $config['authX509:x509attributes'];
        }

        if (array_key_exists('authX509:ldapusercert', $config)) {
            $this->ldapusercert = $config['authX509:ldapusercert'];
        }

        parent::__construct($info, $config);

        $this->ldapcf = new sspmod_ldap_ConfigHelper(
            $config,
            'Authentication source ' . var_export($this->authId, true)
        );

        return;
    }

Member Function Documentation

authenticate()

sspmod_authX509_Auth_Source_X509userCert::authenticate

(

&

$state

)

Validate certificate and login.

This function try to validate the certificate. On success, the user is logged in without going through the login page. On failure, The authX509:X509error.php template is loaded.

Parameters

array

&$state

Information about the current authentication.

Definition at line 90 of file X509userCert.php.

References $_SERVER, $attributes, $ldapcf, $state, array, authFailed(), authSuccesful(), SimpleSAML\Utils\Crypto\der2pem(), SimpleSAML\Logger\error(), and SimpleSAML\Logger\info().

    {
        assert('is_array($state)');
        $ldapcf = $this->ldapcf;

        if (!isset($_SERVER['SSL_CLIENT_CERT']) ||
            ($_SERVER['SSL_CLIENT_CERT'] == '')) {
            $state['authX509.error'] = "NOCERT";
            $this->authFailed($state);

            assert('false'); // should never be reached
            return;
        }

        $client_cert = $_SERVER['SSL_CLIENT_CERT'];
        $client_cert_data = openssl_x509_parse($client_cert);
        if ($client_cert_data === false) {
            SimpleSAML\Logger::error('authX509: invalid cert');
            $state['authX509.error'] = "INVALIDCERT";
            $this->authFailed($state);

            assert('false'); // should never be reached
            return;
        }

        $dn = null;
        foreach ($this->x509attributes as $x509_attr => $ldap_attr) {
            // value is scalar
            if (array_key_exists($x509_attr, $client_cert_data['subject'])) {
                $value = $client_cert_data['subject'][$x509_attr];
                SimpleSAML\Logger::info('authX509: cert '. $x509_attr.' = '.$value);
                $dn = $ldapcf->searchfordn($ldap_attr, $value, true);
                if ($dn !== null) {
                    break;
                }
            }
        }

        if ($dn === null) {
            SimpleSAML\Logger::error('authX509: cert has no matching user in LDAP.');
            $state['authX509.error'] = "UNKNOWNCERT";
            $this->authFailed($state);

            assert('false'); // should never be reached
            return;
        }

        if ($this->ldapusercert === null) { // do not check for certificate match
            $attributes = $ldapcf->getAttributes($dn);
            assert('is_array($attributes)');
            $state['Attributes'] = $attributes;
            $this->authSuccesful($state);

            assert('false'); // should never be reached
            return;
        }

        $ldap_certs = $ldapcf->getAttributes($dn, $this->ldapusercert);
        if ($ldap_certs === false) {
            SimpleSAML\Logger::error('authX509: no certificate found in LDAP for dn='.$dn);
            $state['authX509.error'] = "UNKNOWNCERT";
            $this->authFailed($state);

            assert('false'); // should never be reached
            return;
        }


        $merged_ldapcerts = array();
        foreach ($this->ldapusercert as $attr) {
            $merged_ldapcerts = array_merge($merged_ldapcerts, $ldap_certs[$attr]);
        }
        $ldap_certs = $merged_ldapcerts;

        foreach ($ldap_certs as $ldap_cert) {
            $pem = \SimpleSAML\Utils\Crypto::der2pem($ldap_cert);
            $ldap_cert_data = openssl_x509_parse($pem);
            if ($ldap_cert_data === false) {
                SimpleSAML\Logger::error('authX509: cert in LDAP is invalid for dn='.$dn);
                continue;
            }

            if ($ldap_cert_data === $client_cert_data) {
                $attributes = $ldapcf->getAttributes($dn);
                assert('is_array($attributes)');
                $state['Attributes'] = $attributes;
                $this->authSuccesful($state);

                assert('false'); // should never be reached
                return;
            }
        }

        SimpleSAML\Logger::error('authX509: no matching cert in LDAP for dn='.$dn);
        $state['authX509.error'] = "UNKNOWNCERT";
        $this->authFailed($state);

        assert('false'); // should never be reached
        return;
    }

Here is the call graph for this function:

authFailed()

sspmod_authX509_Auth_Source_X509userCert::authFailed

(

&

$state

)

Finish a failed authentication.

This function can be overloaded by a child authentication class that wish to perform some operations on failure.

Parameters

array

&$state

Information about the current authentication.

Definition at line 69 of file X509userCert.php.

References $config, $state, $t, exit, SimpleSAML\Error\ErrorCodes\getAllErrorCodeMessages(), and SimpleSAML_Configuration\getInstance().

Referenced by authenticate().

    {
        $config = SimpleSAML_Configuration::getInstance();

        $t = new SimpleSAML_XHTML_Template($config, 'authX509:X509error.php');
        $t->data['errorcode'] = $state['authX509.error'];
        $t->data['errorcodes'] = SimpleSAML\Error\ErrorCodes::getAllErrorCodeMessages();

        $t->show();
        exit();
    }

Here is the call graph for this function:

Here is the caller graph for this function:

authSuccesful()

sspmod_authX509_Auth_Source_X509userCert::authSuccesful

(

&

$state

)

Finish a successful authentication.

This function can be overloaded by a child authentication class that wish to perform some operations after login.

Parameters

array

&$state

Information about the current authentication.

Definition at line 199 of file X509userCert.php.

References $state, and SimpleSAML_Auth_Source\completeAuth().

Referenced by authenticate().

    {
        SimpleSAML_Auth_Source::completeAuth($state);

        assert('false'); // should never be reached
        return;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

Field Documentation

$ldapcf

sspmod_authX509_Auth_Source_X509userCert::$ldapcf

private

LDAPConfigHelper object.

Definition at line 27 of file X509userCert.php.

Referenced by authenticate().

$ldapusercert

sspmod_authX509_Auth_Source_X509userCert::$ldapusercert = array('userCertificate;binary')

private

LDAP attribute containing the user certificate.

Definition at line 21 of file X509userCert.php.

$x509attributes

sspmod_authX509_Auth_Source_X509userCert::$x509attributes = array('UID' => 'uid')

private

x509 attributes to use from the certificate for searching the user in the LDAP directory.

Definition at line 15 of file X509userCert.php.

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/modules/authX509/lib/Auth/Source/X509userCert.php