Authorize.php

Go to the documentation of this file.

<?php

class sspmod_authorize_Auth_Process_Authorize extends SimpleSAML_Auth_ProcessingFilter {

        protected $deny = FALSE;

        protected $regex = TRUE;

        protected $valid_attribute_values = array();


        public function __construct($config, $reserved) {
                parent::__construct($config, $reserved);

                assert(is_array($config));

                // Check for the deny option, get it and remove it
                // Must be bool specifically, if not, it might be for a attrib filter below
                if (isset($config['deny']) && is_bool($config['deny'])) {
                        $this->deny = $config['deny'];
                        unset($config['deny']);
                }

                // Check for the regex option, get it and remove it
                // Must be bool specifically, if not, it might be for a attrib filter below
                if (isset($config['regex']) && is_bool($config['regex'])) {
                        $this->regex = $config['regex'];
                        unset($config['regex']);
                }

                foreach ($config as $attribute => $values) {
                        if (is_string($values))
                                $values = array($values);
                        if (!is_array($values))
                                throw new Exception('Filter Authorize: Attribute values is neither string nor array: ' . var_export($attribute, TRUE));
                        foreach ($values as $value){
                                if(!is_string($value)) {
                                        throw new Exception('Filter Authorize: Each value should be a string for attribute: ' . var_export($attribute, TRUE) . ' value: ' . var_export($value, TRUE) . ' Config is: ' . var_export($config, TRUE));
                                }
                        }
                        $this->valid_attribute_values[$attribute] = $values;
                }
        }


        public function process(&$request) {
                $authorize = $this->deny;
                assert(is_array($request));
                assert(array_key_exists('Attributes', $request));

                $attributes =& $request['Attributes'];

                foreach ($this->valid_attribute_values as $name => $patterns) {
                        if(array_key_exists($name, $attributes)) {
                                foreach ($patterns as $pattern){
                                        $values = $attributes[$name];
                                        if (!is_array($values))
                                                $values = array($values);
                                        foreach ($values as $value){
                                                if ($this->regex) {
                                                        $matched = preg_match($pattern, $value);
                                                } else {
                                                        $matched = ($value == $pattern);
                                                }
                                                if ($matched) {
                                                        $authorize = ($this->deny ? FALSE : TRUE);
                                                        break 3;
                                                }
                                        }
                                }
                        }
                }
                if (!$authorize){
                        $this->unauthorized($request);
                }
        }


        protected function unauthorized(&$request) {
                // Save state and redirect to 403 page
                $id = SimpleSAML_Auth_State::saveState($request,
                        'authorize:Authorize');
                $url = SimpleSAML\Module::getModuleURL(
                        'authorize/authorize_403.php');
                \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('StateId' => $id));
        }
}