Inheritance diagram for sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef:

Collaboration diagram for sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef:

Public Member Functions
	__construct ($config, $reserved)
	Initialize this filter, parse configuration. More...

	process (&$request)

Public Member Functions inherited from SimpleSAML_Auth_ProcessingFilter
	__construct (&$config, $reserved)
	Constructor for a processing filter. More...

	process (&$request)
	Process a request. More...

Protected Member Functions
	unauthorized (&$request)
	When the process logic determines that the user is not authorized for this service, then forward the user to an 403 unauthorized page. More...

Private Attributes
	$accepted

	$AuthnContextClassRef

Additional Inherited Members
Data Fields inherited from SimpleSAML_Auth_ProcessingFilter
	$priority = 50
	Priority of this filter. More...

Detailed Description

Definition at line 19 of file ExpectedAuthnContextClassRef.php.

Constructor & Destructor Documentation

◆ __construct()

sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef::__construct	(	$config,
		$reserved
	)

Initialize this filter, parse configuration.

Parameters

array	$config	Configuration information about this filter.
mixed	$reserved	For future use.

Exceptions

SimpleSAML_Error_Exception if the mandatory 'accepted' configuration option is missing.

Definition at line 44 of file ExpectedAuthnContextClassRef.php.

    {
        parent::__construct($config, $reserved);
 
        assert(is_array($config));
        if (empty($config['accepted'])) {
            SimpleSAML\Logger::error(
                'ExpectedAuthnContextClassRef: Configuration error. There is no accepted AuthnContextClassRef.'
            );
            throw new SimpleSAML_Error_Exception(
                'ExpectedAuthnContextClassRef: Configuration error. There is no accepted AuthnContextClassRef.'
            );
        }
        $this->accepted = $config['accepted'];
    }

References $config, and SimpleSAML\Logger\error().

Here is the call graph for this function:

Member Function Documentation

◆ process()

sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef::process ( & $request )

Parameters

array &$request The current request

Reimplemented from SimpleSAML_Auth_ProcessingFilter.

Definition at line 65 of file ExpectedAuthnContextClassRef.php.

    {
        assert(is_array($request));
        assert(array_key_exists('Attributes', $request));
 
        $this->AuthnContextClassRef = $request['saml:sp:State']['saml:sp:AuthnContext'];
 
        if (!in_array($this->AuthnContextClassRef, $this->accepted, true)) {
            $this->unauthorized($request);
        }
    }

References $request, and unauthorized().

Here is the call graph for this function:

◆ unauthorized()

sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef::unauthorized ( & $request )

protected

When the process logic determines that the user is not authorized for this service, then forward the user to an 403 unauthorized page.

Separated this code into its own method so that child classes can override it and change the action. Forward thinking in case a "chained" ACL is needed, more complex permission logic.

Parameters

array $request

Definition at line 90 of file ExpectedAuthnContextClassRef.php.

    {
        SimpleSAML\Logger::error(
            'ExpectedAuthnContextClassRef: Invalid authentication context: '.$this->AuthnContextClassRef.
            '. Accepted values are: '.var_export($this->accepted, true)
        );
 
        $id = SimpleSAML_Auth_State::saveState($request, 'saml:ExpectedAuthnContextClassRef:unauthorized');
        $url = SimpleSAML\Module::getModuleURL(
            'saml/sp/wrong_authncontextclassref.php'
        );
        \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('StateId' => $id));
    }