sspmod_authorize_Auth_Process_Authorize Class Reference

Inheritance diagram for sspmod_authorize_Auth_Process_Authorize:

Collaboration diagram for sspmod_authorize_Auth_Process_Authorize:

Public Member Functions
	__construct ($config, $reserved)
	Initialize this filter. More...
	process (&$request)
	Apply filter to validate attributes. More...
Public Member Functions inherited from SimpleSAML_Auth_ProcessingFilter
	__construct (&$config, $reserved)
	Constructor for a processing filter. More...
	process (&$request)
	Process a request. More...

Protected Member Functions
	unauthorized (&$request)
	When the process logic determines that the user is not authorized for this service, then forward the user to an 403 unauthorized page. More...

Protected Attributes
	$deny = FALSE
	$regex = TRUE
	$valid_attribute_values = array()
	Array of valid users. More...

Additional Inherited Members
Data Fields inherited from SimpleSAML_Auth_ProcessingFilter
	$priority = 50
	Priority of this filter. More...

Detailed Description

Definition at line 10 of file Authorize.php.

Constructor & Destructor Documentation

__construct()

sspmod_authorize_Auth_Process_Authorize::__construct	(		$config,
			$reserved
	)

Initialize this filter.

Validate configuration parameters.

Parameters

array	$config	Configuration information about this filter.
mixed	$reserved	For future use.

Definition at line 41 of file Authorize.php.

References $config, and array.

                                                        {
                parent::__construct($config, $reserved);

                assert('is_array($config)');

                // Check for the deny option, get it and remove it
                // Must be bool specifically, if not, it might be for a attrib filter below
                if (isset($config['deny']) && is_bool($config['deny'])) {
                        $this->deny = $config['deny'];
                        unset($config['deny']);
                }

                // Check for the regex option, get it and remove it
                // Must be bool specifically, if not, it might be for a attrib filter below
                if (isset($config['regex']) && is_bool($config['regex'])) {
                        $this->regex = $config['regex'];
                        unset($config['regex']);
                }

                foreach ($config as $attribute => $values) {
                        if (is_string($values))
                                $values = array($values);
                        if (!is_array($values))
                                throw new Exception('Filter Authorize: Attribute values is neither string nor array: ' . var_export($attribute, TRUE));
                        foreach ($values as $value){
                                if(!is_string($value)) {
                                        throw new Exception('Filter Authorize: Each value should be a string for attribute: ' . var_export($attribute, TRUE) . ' value: ' . var_export($value, TRUE) . ' Config is: ' . var_export($config, TRUE));
                                }
                        }
                        $this->valid_attribute_values[$attribute] = $values;
                }
        }

Member Function Documentation

process()

sspmod_authorize_Auth_Process_Authorize::process

(

&

$request

)

Apply filter to validate attributes.

Parameters

array

&$request

The current request

Definition at line 80 of file Authorize.php.

References $attributes, $deny, $name, array, and unauthorized().

                                           {
                $authorize = $this->deny;
                assert('is_array($request)');
                assert('array_key_exists("Attributes", $request)');

                $attributes =& $request['Attributes'];

                foreach ($this->valid_attribute_values as $name => $patterns) {
                        if(array_key_exists($name, $attributes)) {
                                foreach ($patterns as $pattern){
                                        $values = $attributes[$name];
                                        if (!is_array($values))
                                                $values = array($values);
                                        foreach ($values as $value){
                                                if ($this->regex) {
                                                        $matched = preg_match($pattern, $value);
                                                } else {
                                                        $matched = ($value == $pattern);
                                                }
                                                if ($matched) {
                                                        $authorize = ($this->deny ? FALSE : TRUE);
                                                        break 3;
                                                }
                                        }
                                }
                        }
                }
                if (!$authorize){
                        $this->unauthorized($request);
                }
        }

Here is the call graph for this function:

unauthorized()

sspmod_authorize_Auth_Process_Authorize::unauthorized ( &  $request )

protected

When the process logic determines that the user is not authorized for this service, then forward the user to an 403 unauthorized page.

Separated this code into its own method so that child classes can override it and change the action. Forward thinking in case a "chained" ACL is needed, more complex permission logic.

Parameters

array

$request

Definition at line 125 of file Authorize.php.

References $id, $url, array, SimpleSAML\Module\getModuleURL(), SimpleSAML\Utils\HTTP\redirectTrustedURL(), and SimpleSAML_Auth_State\saveState().

Referenced by process().

                                                   {
                // Save state and redirect to 403 page
                $id = SimpleSAML_Auth_State::saveState($request,
                        'authorize:Authorize');
                $url = SimpleSAML\Module::getModuleURL(
                        'authorize/authorize_403.php');
                \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('StateId' => $id));
        }

Here is the call graph for this function:

Here is the caller graph for this function:

Field Documentation

$deny

sspmod_authorize_Auth_Process_Authorize::$deny = FALSE

protected

Definition at line 17 of file Authorize.php.

Referenced by process().

$regex

sspmod_authorize_Auth_Process_Authorize::$regex = TRUE

protected

Definition at line 24 of file Authorize.php.

$valid_attribute_values

sspmod_authorize_Auth_Process_Authorize::$valid_attribute_values = array()

protected

Array of valid users.

Each element is a regular expression. You should user \ to escape special chars, like '.' etc.

Definition at line 31 of file Authorize.php.

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/modules/authorize/lib/Auth/Process/Authorize.php