GenerateGroups.php

Go to the documentation of this file.

<?php

class sspmod_core_Auth_Process_GenerateGroups extends SimpleSAML_Auth_ProcessingFilter {


        private $generateGroupsFrom;


        public function __construct($config, $reserved) {
                parent::__construct($config, $reserved);

                assert(is_array($config));

                if (count($config) === 0) {
                        // Use default groups
                        $this->generateGroupsFrom = array(
                                'eduPersonAffiliation',
                                'eduPersonOrgUnitDN',
                                'eduPersonEntitlement',
                        );

                } else {
                        // Validate configuration
                        foreach ($config as $attributeName) {
                                if (!is_string($attributeName)) {
                                        throw new Exception('Invalid attribute name for core:GenerateGroups filter: ' .
                                                var_export($attributeName, TRUE));
                                }
                        }

                        $this->generateGroupsFrom = $config;
                }
        }


        public function process(&$request) {
                assert(is_array($request));
                assert(array_key_exists('Attributes', $request));

                $groups = array();
                $attributes =& $request['Attributes'];

                $realm = self::getRealm($attributes);
                if ($realm !== NULL) {
                        $groups[] = 'realm-' . $realm;
                }


                foreach ($this->generateGroupsFrom as $name) {
                        if (!array_key_exists($name, $attributes)) {
                                SimpleSAML\Logger::debug('GenerateGroups - attribute \'' . $name . '\' not found.');
                                /* Attribute not present. */
                                continue;
                        }

                        foreach ($attributes[$name] as $value) {
                                $value = self::escapeIllegalChars($value);
                                $groups[] = $name . '-' . $value;
                                if ($realm !== NULL) {
                                        $groups[] = $name . '-' . $realm . '-' . $value;
                                }
                        }
                }

                if (count($groups) > 0) {
                        $attributes['groups'] = $groups;
                }
        }


        private static function getRealm($attributes) {
                assert(is_array($attributes));

                if (!array_key_exists('eduPersonPrincipalName', $attributes)) {
                        return NULL;
                }
                $eppn = $attributes['eduPersonPrincipalName'];

                if (count($eppn) < 1) {
                        return NULL;
                }
                $eppn = $eppn[0];

                $realm = explode('@', $eppn, 2);
                if (count($realm) < 2) {
                        return NULL;
                }
                $realm = $realm[1];

                return self::escapeIllegalChars($realm);
        }


        private static function escapeIllegalChars($string) {
                assert(is_string($string));

                return preg_replace_callback('/([^a-zA-Z0-9_@=.])/',
                        function ($m) { return sprintf("%%%02x", ord($m[1])); },
                        $string);
        }

}