ACL.php

Go to the documentation of this file.

<?php

class sspmod_core_ACL {

        private $acl;


        public function __construct($acl) {
                assert(is_string($acl) || is_array($acl));

                if (is_string($acl)) {
                        $acl = self::getById($acl);
                }

                foreach ($acl as $rule) {
                        if (!is_array($rule)) {
                                throw new SimpleSAML_Error_Exception('Invalid rule in access control list: ' . var_export($rule, TRUE));
                        }
                        if (count($rule) === 0) {
                                throw new SimpleSAML_Error_Exception('Empty rule in access control list.');
                        }

                        $action = array_shift($rule);
                        if ($action !== 'allow' && $action !== 'deny') {
                                throw new SimpleSAML_Error_Exception('Invalid action in rule in access control list: ' . var_export($action, TRUE));
                        }

                }

                $this->acl = $acl;
        }


        private static function getById($id) {
                assert(is_string($id));

                $config = SimpleSAML_Configuration::getOptionalConfig('acl.php');
                if (!$config->hasValue($id)) {
                        throw new SimpleSAML_Error_Exception('No ACL with id ' . var_export($id, TRUE) . ' in config/acl.php.');
                }

                return $config->getArray($id);
        }


        public function allows(array $attributes) {

                foreach ($this->acl as $rule) {
                        $action = array_shift($rule);

                        if (!self::match($attributes, $rule)) {
                                continue;
                        }

                        if ($action === 'allow') {
                                return TRUE;
                        } else {
                                return FALSE;
                        }
                }
        }


        private static function match(array $attributes, array $rule) {

                $op = array_shift($rule);
                if ($op === NULL) {
                        // An empty rule always matches
                        return TRUE;
                }

                switch($op) {
                case 'and':
                        return self::opAnd($attributes, $rule);
                case 'equals':
                        return self::opEquals($attributes, $rule);
                case 'equals-preg':
                        return self::opEqualsPreg($attributes, $rule);
                case 'has':
                        return self::opHas($attributes, $rule);
                case 'has-preg':
                        return self::opHasPreg($attributes, $rule);
                case 'not':
                        return !self::match($attributes, $rule);
                case 'or':
                        return self::opOr($attributes, $rule);
                default:
                        throw new SimpleSAML_Error_Exception('Invalid ACL operation: ' . var_export($op, TRUE));
                }
        }


        private static function opAnd($attributes, $rule) {

                foreach ($rule as $subRule) {
                        if (!self::match($attributes, $subRule)) {
                                return FALSE;
                        }
                }

                // All matches
                return TRUE;
        }


        private static function opEquals($attributes, $rule) {

                $attributeName = array_shift($rule);

                if (!array_key_exists($attributeName, $attributes)) {
                        $attributeValues = array();
                } else {
                        $attributeValues = $attributes[$attributeName];
                }

                foreach ($rule as $value) {
                        $found = FALSE;
                        foreach ($attributeValues as $i => $v) {
                                if ($value !== $v) {
                                        continue;
                                }
                                unset($attributeValues[$i]);
                                $found = TRUE;
                                break;
                        }
                        if (!$found) {
                                return FALSE;
                        }
                }
                if (!empty($attributeValues)) {
                        /* One of the attribute values didn't match. */
                        return FALSE;
                }

                /* All the values in the attribute matched one in the rule. */
                return TRUE;
        }


        private static function opEqualsPreg($attributes, $rule) {

                $attributeName = array_shift($rule);

                if (!array_key_exists($attributeName, $attributes)) {
                        $attributeValues = array();
                } else {
                        $attributeValues = $attributes[$attributeName];
                }

                foreach ($rule as $pattern) {
                        $found = FALSE;
                        foreach ($attributeValues as $i => $v) {
                                if (!preg_match($pattern, $v)) {
                                        continue;
                                }
                                unset($attributeValues[$i]);
                                $found = TRUE;
                                break;
                        }
                        if (!$found) {
                                return FALSE;
                        }
                }

                if (!empty($attributeValues)) {
                        /* One of the attribute values didn't match. */
                        return FALSE;
                }

                /* All the values in the attribute matched one in the rule. */
                return TRUE;
        }


        private static function opHas($attributes, $rule) {

                $attributeName = array_shift($rule);

                if (!array_key_exists($attributeName, $attributes)) {
                        $attributeValues = array();
                } else {
                        $attributeValues = $attributes[$attributeName];
                }

                foreach ($rule as $value) {
                        if (!in_array($value, $attributeValues, TRUE)) {
                                return FALSE;
                        }
                }

                /* Found all values in the rule in the attribute. */
                return TRUE;
        }


        private static function opHasPreg($attributes, $rule) {

                $attributeName = array_shift($rule);

                if (!array_key_exists($attributeName, $attributes)) {
                        $attributeValues = array();
                } else {
                        $attributeValues = $attributes[$attributeName];
                }

                foreach ($rule as $pattern) {
                        $matches = preg_grep($pattern, $attributeValues);
                        if (count($matches) === 0) {
                                return FALSE;
                        }
                }

                /* Found all values in the rule in the attribute. */
                return TRUE;
        }


        private static function opOr($attributes, $rule) {

                foreach ($rule as $subRule) {
                        if (self::match($attributes, $subRule)) {
                                return TRUE;
                        }
                }

                /* None matches. */
                return FALSE;
        }

}