MetaLoader.php

Go to the documentation of this file.

<?php
/*
 * @author Andreas Åkre Solberg <andreas.solberg@uninett.no>
 * @package SimpleSAMLphp
 */
class sspmod_metarefresh_MetaLoader {


        private $expire;
        private $metadata;
        private $oldMetadataSrc;
        private $stateFile;
        private $changed;
        private $types = array(
                'saml20-idp-remote',
                'saml20-sp-remote',
                'shib13-idp-remote',
                'shib13-sp-remote',
                'attributeauthority-remote'
        );


        public function __construct($expire = NULL, $stateFile = NULL, $oldMetadataSrc = NULL) {
                $this->expire = $expire;
                $this->metadata = array();
                $this->oldMetadataSrc = $oldMetadataSrc;
                $this->stateFile = $stateFile;
                $this->changed = FALSE;

                // Read file containing $state from disk
                if(is_readable($stateFile)) {
                        require($stateFile);
                }

                $this->state = (isset($state)) ? $state : array();

        }


        public function getTypes()
        {
                return $this->types;
        }


        public function setTypes($types)
        {
                if (!is_array($types)) {
                        $types = array($types);
                }
                $this->types = $types;
        }


        public function loadSource($source) {

                if (preg_match('@^https?://@i', $source['src'])) {
                        // Build new HTTP context
                        $context = $this->createContext($source);

                        // GET!
                        try {
                                list($data, $responseHeaders) = \SimpleSAML\Utils\HTTP::fetch($source['src'], $context, TRUE);
                        } catch(Exception $e) {
                                SimpleSAML\Logger::warning('metarefresh: ' . $e->getMessage());
                        }

                        // We have response headers, so the request succeeded
                        if(!isset($responseHeaders)) {
                                // No response headers, this means the request failed in some way, so re-use old data
                                SimpleSAML\Logger::debug('No response from ' . $source['src'] . ' - attempting to re-use cached metadata');
                                $this->addCachedMetadata($source);
                                return;
                        } elseif(preg_match('@^HTTP/1\.[01]\s304\s@', $responseHeaders[0])) {
                                // 304 response
                                SimpleSAML\Logger::debug('Received HTTP 304 (Not Modified) - attempting to re-use cached metadata');
                                $this->addCachedMetadata($source);
                                return;
                        } elseif(!preg_match('@^HTTP/1\.[01]\s200\s@', $responseHeaders[0])) {
                                // Other error
                                SimpleSAML\Logger::debug('Error from ' . $source['src'] . ' - attempting to re-use cached metadata');
                                $this->addCachedMetadata($source);
                                return;
                        }
                } else {
                        // Local file.
                        $data = file_get_contents($source['src']);
                        $responseHeaders = NULL;
                }

                // Everything OK. Proceed.
                if (isset($source['conditionalGET']) && $source['conditionalGET']) {
                        // Stale or no metadata, so a fresh copy
                        SimpleSAML\Logger::debug('Downloaded fresh copy');
                }

                try {
                        $entities = $this->loadXML($data, $source);
                } catch(Exception $e) {
                        SimpleSAML\Logger::debug('XML parser error when parsing ' . $source['src'] . ' - attempting to re-use cached metadata');
                        $this->addCachedMetadata($source);
                        return;
                }

                foreach($entities as $entity) {

                        if(isset($source['blacklist'])) {
                                if(!empty($source['blacklist']) && in_array($entity->getEntityID(), $source['blacklist'], true)) {
                                        SimpleSAML\Logger::info('Skipping "' .  $entity->getEntityID() . '" - blacklisted.' . "\n");
                                        continue;
                                }
                        }

                        if(isset($source['whitelist'])) {
                                if(!empty($source['whitelist']) && !in_array($entity->getEntityID(), $source['whitelist'], true)) {
                                        SimpleSAML\Logger::info('Skipping "' .  $entity->getEntityID() . '" - not in the whitelist.' . "\n");
                                        continue;
                                }
                        }

                        if(array_key_exists('certificates', $source) && $source['certificates'] !== NULL) {
                                if(!$entity->validateSignature($source['certificates'])) {
                                        SimpleSAML\Logger::info('Skipping "' . $entity->getEntityId() . '" - could not verify signature using certificate.' . "\n");
                                        continue;
                                }
                        }

                        if(array_key_exists('validateFingerprint', $source) && $source['validateFingerprint'] !== NULL) {
                                if(!array_key_exists('certificates', $source) || $source['certificates'] == NULL) {
                                        if(!$entity->validateFingerprint($source['validateFingerprint'])) {
                                                SimpleSAML\Logger::info('Skipping "' . $entity->getEntityId() . '" - could not verify signature using fingerprint.' . "\n");
                                                continue;
                                        }
                                } else {
                                        SimpleSAML\Logger::info('Skipping validation with fingerprint since option certificate is set.' . "\n");
                                }
                        }

                        $template = NULL;
                        if (array_key_exists('template', $source)) $template = $source['template'];

                        $this->addMetadata($source['src'], $entity->getMetadata1xSP(), 'shib13-sp-remote', $template);
                        $this->addMetadata($source['src'], $entity->getMetadata1xIdP(), 'shib13-idp-remote', $template);
                        $this->addMetadata($source['src'], $entity->getMetadata20SP(), 'saml20-sp-remote', $template);
                        $this->addMetadata($source['src'], $entity->getMetadata20IdP(), 'saml20-idp-remote', $template);
                        $attributeAuthorities = $entity->getAttributeAuthorities();
                        if (!empty($attributeAuthorities)) {
                                $this->addMetadata($source['src'], $attributeAuthorities[0], 'attributeauthority-remote', $template);
                        }
                }

                $this->saveState($source, $responseHeaders);
        }

        private function createContext($source) {

                $context = NULL;

                $config = SimpleSAML_Configuration::getInstance();
                $name = $config->getString('technicalcontact_name', NULL);
                $mail = $config->getString('technicalcontact_email', NULL);

                $rawheader = "User-Agent: SimpleSAMLphp metarefresh, run by $name <$mail>\r\n";

                if (isset($source['conditionalGET']) && $source['conditionalGET']) {
                        if(array_key_exists($source['src'], $this->state)) {

                                $sourceState = $this->state[$source['src']];

                                if(isset($sourceState['last-modified'])) {
                                        $rawheader .= 'If-Modified-Since: ' . $sourceState['last-modified'] . "\r\n";
                                }

                                if(isset($sourceState['etag'])) {
                                        $rawheader .= 'If-None-Match: ' . $sourceState['etag'] . "\r\n";
                                }
                        }
                }

                return array('http' => array('header' => $rawheader));
        }


        private function addCachedMetadata($source) {
                if(isset($this->oldMetadataSrc)) {
                        foreach($this->types as $type) {
                                foreach($this->oldMetadataSrc->getMetadataSet($type) as $entity) {
                                        if(array_key_exists('metarefresh:src', $entity)) {
                                                if($entity['metarefresh:src'] == $source['src']) {
                                                        $this->addMetadata($source['src'], $entity, $type);
                                                }
                                        }
                                }
                        }
                }
        }


        private function saveState($source, $responseHeaders) {

                if (isset($source['conditionalGET']) && $source['conditionalGET']) {

                        // Headers section
                        $candidates = array('last-modified', 'etag');

                        foreach($candidates as $candidate) {
                                if(array_key_exists($candidate, $responseHeaders)) {
                                        $this->state[$source['src']][$candidate] = $responseHeaders[$candidate];
                                }
                        }

                        if(!empty($this->state[$source['src']])) {
                                // Timestamp when this src was requested.
                                $this->state[$source['src']]['requested_at'] = $this->getTime();

                                $this->changed = TRUE;
                        }
                }
        }


        private function loadXML($data, $source) {
                $entities = array();
                try {
                        $doc = \SAML2\DOMDocumentFactory::fromString($data);
                } catch (Exception $e) {
                        throw new Exception('Failed to read XML from ' . $source['src']);
                }
                if ($doc->documentElement === NULL) {
                        throw new Exception('Opened file is not an XML document: ' . $source['src']);
                }
                $entities = SimpleSAML_Metadata_SAMLParser::parseDescriptorsElement($doc->documentElement);
                return $entities;
        }


        public function writeState() {
                if($this->changed) {
                        SimpleSAML\Logger::debug('Writing: ' . $this->stateFile);
            SimpleSAML\Utils\System::writeFile(
                                $this->stateFile,
                                "<?php\n/* This file was generated by the metarefresh module at ".$this->getTime() . ".\n".
                                " Do not update it manually as it will get overwritten. */\n".
                                '$state = ' . var_export($this->state, TRUE) . ";\n?>\n",
                                0644
                        );
                }
        }


        public function dumpMetadataStdOut() {
        
                foreach($this->metadata as $category => $elements) {
        
                        echo('/* The following data should be added to metadata/' . $category . '.php. */' . "\n");
        
        
                        foreach($elements as $m) {
                                $filename = $m['filename'];
                                $entityID = $m['metadata']['entityid'];
        
                                echo("\n");
                                echo('/* The following metadata was generated from ' . $filename . ' on ' . $this->getTime() . '. */' . "\n");
                                echo('$metadata[\'' . addslashes($entityID) . '\'] = ' . var_export($m['metadata'], TRUE) . ';' . "\n");
                        }
        
        
                        echo("\n");
                        echo('/* End of data which should be added to metadata/' . $category . '.php. */' . "\n");
                        echo("\n");
                }
        }

        
        private function addMetadata($filename, $metadata, $type, $template = NULL) {
        
                if($metadata === NULL) {
                        return;
                }
        
                if (isset($template)) {
                        $metadata = array_merge($metadata, $template);
                }
        
                $metadata['metarefresh:src'] = $filename;
                if(!array_key_exists($type, $this->metadata)) {
                        $this->metadata[$type] = array();
                }
                
                // If expire is defined in constructor...
                if (!empty($this->expire)) {
                        
                        // If expire is already in metadata
                        if (array_key_exists('expire', $metadata)) {
                        
                                // Override metadata expire with more restrictive global config-
                                if ($this->expire < $metadata['expire'])
                                        $metadata['expire'] = $this->expire;
                                        
                        // If expire is not already in metadata use global config
                        } else {
                                $metadata['expire'] = $this->expire;
                        }
                }
                

        
                $this->metadata[$type][] = array('filename' => $filename, 'metadata' => $metadata);
        }


        function writeARPfile($config) {
                
                assert('is_a($config, \'SimpleSAML_Configuration\')');
                
                $arpfile = $config->getValue('arpfile');
                $types = array('saml20-sp-remote');
                
                $md = array();
                foreach($this->metadata as $category => $elements) {
                        if (!in_array($category, $types, true)) continue;
                        $md = array_merge($md, $elements);
                }
                
                // $metadata, $attributemap, $prefix, $suffix
                $arp = new sspmod_metarefresh_ARP($md, 
                        $config->getValue('attributemap', ''),  
                        $config->getValue('prefix', ''),  
                        $config->getValue('suffix', '')
                );
                
                
                $arpxml = $arp->getXML();

                SimpleSAML\Logger::info('Writing ARP file: ' . $arpfile . "\n");
                file_put_contents($arpfile, $arpxml);

        }
        
        
        function writeMetadataFiles($outputDir) {
        
                while(strlen($outputDir) > 0 && $outputDir[strlen($outputDir) - 1] === '/') {
                        $outputDir = substr($outputDir, 0, strlen($outputDir) - 1);
                }
        
                if(!file_exists($outputDir)) {
                        SimpleSAML\Logger::info('Creating directory: ' . $outputDir . "\n");
                        $res = @mkdir($outputDir, 0777, TRUE);
                        if ($res === FALSE) {
                                throw new Exception('Error creating directory: ' . $outputDir);
                        }
                }
        
                foreach($this->types as $type) {

                        $filename = $outputDir . '/' . $type . '.php';

                        if(array_key_exists($type, $this->metadata)) {
                                $elements = $this->metadata[$type];
                                SimpleSAML\Logger::debug('Writing: ' . $filename);

                                $content  = '<?php' . "\n" . '/* This file was generated by the metarefresh module at '. $this->getTime() . "\n";
                                $content .= ' Do not update it manually as it will get overwritten' . "\n" . '*/' . "\n";

                                foreach($elements as $m) {
                                        $entityID = $m['metadata']['entityid'];
                                        $content .= "\n";
                                        $content .= '$metadata[\'' . addslashes($entityID) . '\'] = ' . var_export($m['metadata'], TRUE) . ';' . "\n";
                                }

                                $content .= "\n" . '?>';

                SimpleSAML\Utils\System::writeFile($filename, $content, 0644);
                        } elseif(is_file($filename)) {
                                if(unlink($filename)) {
                                        SimpleSAML\Logger::debug('Deleting stale metadata file: ' . $filename);
                                } else {
                                        SimpleSAML\Logger::warning('Could not delete stale metadata file: ' . $filename);
                                }
                        }
                }
        }


        public function writeMetadataSerialize($outputDir) {
                assert('is_string($outputDir)');

                $metaHandler = new SimpleSAML_Metadata_MetaDataStorageHandlerSerialize(array('directory' => $outputDir));

                /* First we add all the metadata entries to the metadata handler. */
                foreach ($this->metadata as $set => $elements) {
                        foreach ($elements as $m) {
                                $entityId = $m['metadata']['entityid'];

                                SimpleSAML\Logger::debug('metarefresh: Add metadata entry ' .
                                        var_export($entityId, TRUE) . ' in set ' . var_export($set, TRUE) . '.');
                                $metaHandler->saveMetadata($entityId, $set, $m['metadata']);
                        }
                }

                /* Then we delete old entries which should no longer exist. */
                $ct = time();
                foreach ($metaHandler->getMetadataSets() as $set) {
                        foreach ($metaHandler->getMetadataSet($set) as $entityId => $metadata) {
                                if (!array_key_exists('expire', $metadata)) {
                                        SimpleSAML\Logger::warning('metarefresh: Metadata entry without expire timestamp: ' . var_export($entityId, TRUE) .
                                                ' in set ' . var_export($set, TRUE) . '.');
                                        continue;
                                }
                                if ($metadata['expire'] > $ct) {
                                        continue;
                                }
                                SimpleSAML\Logger::debug('metarefresh: ' . $entityId . ' expired ' . date('l jS \of F Y h:i:s A', $metadata['expire']) );
                                SimpleSAML\Logger::debug('metarefresh: Delete expired metadata entry ' .
                                        var_export($entityId, TRUE) . ' in set ' . var_export($set, TRUE) . '. (' . ($ct - $metadata['expire']) . ' sec)');
                                $metaHandler->deleteMetadata($entityId, $set);
                        }
                }
        }


        private function getTime() {
                /* The current date, as a string. */
                date_default_timezone_set('UTC');
                $when = date('Y-m-d\\TH:i:s\\Z');
                return $when;
        }

}