sspmod_exampleauth_Auth_Source_External Class Reference

Inheritance diagram for sspmod_exampleauth_Auth_Source_External:

Collaboration diagram for sspmod_exampleauth_Auth_Source_External:

Public Member Functions
	__construct ($info, $config)
	Constructor for this authentication source. More...
	authenticate (&$state)
	Log in using an external authentication helper. More...
	logout (&$state)
	This function is called when the user start a logout operation, for example by logging out of a SP that supports single logout. More...
Public Member Functions inherited from SimpleSAML_Auth_Source
	__construct ($info, &$config)
	Constructor for an authentication source. More...
	getAuthId ()
	Retrieve the ID of this authentication source. More...
	authenticate (&$state)
	Process a request. More...
	reauthenticate (array &$state)
	Reauthenticate an user. More...
	initLogin ($return, $errorURL=null, array $params=array())
	Start authentication. More...
	logout (&$state)
	Log out from this authentication source. More...

Static Public Member Functions
static	resume ()
	Resume authentication process. More...
Static Public Member Functions inherited from SimpleSAML_Auth_Source
static	getSourcesOfType ($type)
	Get sources of a specific type. More...
static	completeAuth (&$state)
	Complete authentication. More...
static	loginCompleted ($state)
	Called when a login operation has finished. More...
static	completeLogout (&$state)
	Complete logout. More...
static	getById ($authId, $type=null)
	Retrieve authentication source. More...
static	logoutCallback ($state)
	Called when the authentication source receives an external logout request. More...
static	getSources ()
	Retrieve list of authentication sources. More...

Private Member Functions
	getUser ()
	Retrieve attributes for the user. More...

Additional Inherited Members
Protected Member Functions inherited from SimpleSAML_Auth_Source
	addLogoutCallback ($assoc, $state)
	Add a logout callback association. More...
	callLogoutCallback ($assoc)
	Call a logout callback based on association. More...
Static Protected Member Functions inherited from SimpleSAML_Auth_Source
static	validateSource ($source, $id)
	Make sure that the first element of an auth source is its identifier. More...
Protected Attributes inherited from SimpleSAML_Auth_Source
	$authId

Detailed Description

Definition at line 23 of file External.php.

Constructor & Destructor Documentation

__construct()

sspmod_exampleauth_Auth_Source_External::__construct	(		$info,
			$config
	)

Constructor for this authentication source.

Parameters

array	$info	Information about this authentication source.
array	$config	Configuration.

Definition at line 31 of file External.php.

                                                    {
                assert(is_array($info));
                assert(is_array($config));
 
                // Call the parent constructor first, as required by the interface
                parent::__construct($info, $config);
 
                // Do any other configuration we need here
        }

References $config, and $info.

Member Function Documentation

authenticate()

sspmod_exampleauth_Auth_Source_External::authenticate

(

&

$state

)

Log in using an external authentication helper.

Parameters

array

&$state

Information about the current authentication.

Reimplemented from SimpleSAML_Auth_Source.

Definition at line 92 of file External.php.

                                              {
                assert(is_array($state));
 
                $attributes = $this->getUser();
                if ($attributes !== NULL) {
                        /*
                         * The user is already authenticated.
                         *
                         * Add the users attributes to the $state-array, and return control
                         * to the authentication process.
                         */
                        $state['Attributes'] = $attributes;
                        return;
                }
 
                /*
                 * The user isn't authenticated. We therefore need to
                 * send the user to the login page.
                 */
 
                /*
                 * First we add the identifier of this authentication source
                 * to the state array, so that we know where to resume.
                 */
                $state['exampleauth:AuthID'] = $this->authId;
 
 
                /*
                 * We need to save the $state-array, so that we can resume the
                 * login process after authentication.
                 *
                 * Note the second parameter to the saveState-function. This is a
                 * unique identifier for where the state was saved, and must be used
                 * again when we retrieve the state.
                 *
                 * The reason for it is to prevent
                 * attacks where the user takes a $state-array saved in one location
                 * and restores it in another location, and thus bypasses steps in
                 * the authentication process.
                 */
                $stateId = SimpleSAML_Auth_State::saveState($state, 'exampleauth:External');
 
                /*
                 * Now we generate a URL the user should return to after authentication.
                 * We assume that whatever authentication page we send the user to has an
                 * option to return the user to a specific page afterwards.
                 */
                $returnTo = SimpleSAML\Module::getModuleURL('exampleauth/resume.php', array(
                        'State' => $stateId,
                ));
 
                /*
                 * Get the URL of the authentication page.
                 *
                 * Here we use the getModuleURL function again, since the authentication page
                 * is also part of this module, but in a real example, this would likely be
                 * the absolute URL of the login page for the site.
                 */
                $authPage = SimpleSAML\Module::getModuleURL('exampleauth/authpage.php');
 
                /*
                 * The redirect to the authentication page.
                 *
                 * Note the 'ReturnTo' parameter. This must most likely be replaced with
                 * the real name of the parameter for the login page.
                 */
                \SimpleSAML\Utils\HTTP::redirectTrustedURL($authPage, array(
                        'ReturnTo' => $returnTo,
                ));
 
                /*
                 * The redirect function never returns, so we never get this far.
                 */
                assert(false);
        }

References $attributes, SimpleSAML_Auth_Source\$authId, $returnTo, $state, $stateId, SimpleSAML\Module\getModuleURL(), getUser(), SimpleSAML\Utils\HTTP\redirectTrustedURL(), and SimpleSAML_Auth_State\saveState().

Here is the call graph for this function:

getUser()

sspmod_exampleauth_Auth_Source_External::getUser ( )

private

Retrieve attributes for the user.

Returns

array|NULL The user's attributes, or NULL if the user isn't authenticated.

Definition at line 47 of file External.php.

                                   {
 
                /*
                 * In this example we assume that the attributes are
                 * stored in the users PHP session, but this could be replaced
                 * with anything.
                 */
 
                if (!session_id()) {
                        /* session_start not called before. Do it here. */
                        session_start();
                }
 
                if (!isset($_SESSION['uid'])) {
                        /* The user isn't authenticated. */
                        return NULL;
                }
 
                /*
                 * Find the attributes for the user.
                 * Note that all attributes in SimpleSAMLphp are multivalued, so we need
                 * to store them as arrays.
                 */
 
                $attributes = array(
                        'uid' => array($_SESSION['uid']),
                        'displayName' => array($_SESSION['name']),
                        'mail' => array($_SESSION['mail']),
                );
 
                /* Here we generate a multivalued attribute based on the account type. */
                $attributes['eduPersonAffiliation'] = array(
                        $_SESSION['type'], /* In this example, either 'student' or 'employee'. */
                        'member',
                );
 
                return $attributes;
        }

References $_SESSION, and $attributes.

Referenced by authenticate().

Here is the caller graph for this function:

logout()

sspmod_exampleauth_Auth_Source_External::logout

(

&

$state

)

This function is called when the user start a logout operation, for example by logging out of a SP that supports single logout.

Parameters

array

&$state

The logout state array.

Reimplemented from SimpleSAML_Auth_Source.

Definition at line 253 of file External.php.

                                        {
                assert(is_array($state));
 
                if (!session_id()) {
                        /* session_start not called before. Do it here. */
                        session_start();
                }
 
                /*
                 * In this example we simply remove the 'uid' from the session.
                 */
                unset($_SESSION['uid']);
 
                /*
                 * If we need to do a redirect to a different page, we could do this
                 * here, but in this example we don't need to do this.
                 */
        }

References $_SESSION, and $state.

resume()

static sspmod_exampleauth_Auth_Source_External::resume ( )

static

Resume authentication process.

This function resumes the authentication process after the user has entered his or her credentials.

Parameters

array

&$state

The authentication state.

Definition at line 177 of file External.php.

                                        {
 
                /*
                 * First we need to restore the $state-array. We should have the identifier for
                 * it in the 'State' request parameter.
                 */
                if (!isset($_REQUEST['State'])) {
                        throw new SimpleSAML_Error_BadRequest('Missing "State" parameter.');
                }
 
                /*
                 * Once again, note the second parameter to the loadState function. This must
                 * match the string we used in the saveState-call above.
                 */
                $state = SimpleSAML_Auth_State::loadState($_REQUEST['State'], 'exampleauth:External');
 
                /*
                 * Now we have the $state-array, and can use it to locate the authentication
                 * source.
                 */
                $source = SimpleSAML_Auth_Source::getById($state['exampleauth:AuthID']);
                if ($source === NULL) {
                        /*
                         * The only way this should fail is if we remove or rename the authentication source
                         * while the user is at the login page.
                         */
                        throw new SimpleSAML_Error_Exception('Could not find authentication source with id ' . $state[self::AUTHID]);
                }
 
                /*
                 * Make sure that we haven't switched the source type while the
                 * user was at the authentication page. This can only happen if we
                 * change config/authsources.php while an user is logging in.
                 */
                if (! ($source instanceof self)) {
                        throw new SimpleSAML_Error_Exception('Authentication source type changed.');
                }
 
 
                /*
                 * OK, now we know that our current state is sane. Time to actually log the user in.
                 *
                 * First we check that the user is acutally logged in, and didn't simply skip the login page.
                 */
                $attributes = $source->getUser();
                if ($attributes === NULL) {
                        /*
                         * The user isn't authenticated.
                         *
                         * Here we simply throw an exception, but we could also redirect the user back to the
                         * login page.
                         */
                        throw new SimpleSAML_Error_Exception('User not authenticated after login page.');
                }
 
                /*
                 * So, we have a valid user. Time to resume the authentication process where we
                 * paused it in the authenticate()-function above.
                 */
 
                $state['Attributes'] = $attributes;
                SimpleSAML_Auth_Source::completeAuth($state);
 
                /*
                 * The completeAuth-function never returns, so we never get this far.
                 */
                assert(false);
        }

References $attributes, $source, $state, SimpleSAML_Auth_Source\completeAuth(), SimpleSAML_Auth_Source\getById(), and SimpleSAML_Auth_State\loadState().

Here is the call graph for this function:

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/modules/exampleauth/lib/Auth/Source/External.php