ProcessingChain.php

Go to the documentation of this file.

<?php

class SimpleSAML_Auth_ProcessingChain
{


    const FILTERS_INDEX = 'SimpleSAML_Auth_ProcessingChain.filters';


    const COMPLETED_STAGE = 'SimpleSAML_Auth_ProcessingChain.completed';


    const AUTHPARAM = 'AuthProcId';


    private $filters;


    public function __construct($idpMetadata, $spMetadata, $mode = 'idp')
    {
        assert(is_array($idpMetadata));
        assert(is_array($spMetadata));

        $this->filters = array();

        $config = SimpleSAML_Configuration::getInstance();
        $configauthproc = $config->getArray('authproc.' . $mode, null);

        if (!empty($configauthproc)) {
            $configfilters = self::parseFilterList($configauthproc);
            self::addFilters($this->filters, $configfilters);
        }

        if (array_key_exists('authproc', $idpMetadata)) {
            $idpFilters = self::parseFilterList($idpMetadata['authproc']);
            self::addFilters($this->filters, $idpFilters);
        }

        if (array_key_exists('authproc', $spMetadata)) {
            $spFilters = self::parseFilterList($spMetadata['authproc']);
            self::addFilters($this->filters, $spFilters);
        }


        SimpleSAML\Logger::debug('Filter config for ' . $idpMetadata['entityid'] . '->' .
            $spMetadata['entityid'] . ': ' . str_replace("\n", '', var_export($this->filters, true)));
    }


    private static function addFilters(&$target, $src)
    {
        assert(is_array($target));
        assert(is_array($src));

        foreach ($src as $filter) {
            $fp = $filter->priority;

            // Find insertion position for filter
            for ($i = count($target)-1; $i >= 0; $i--) {
                if ($target[$i]->priority <= $fp) {
                    // The new filter should be inserted after this one
                    break;
                }
            }
            /* $i now points to the filter which should preceede the current filter. */
            array_splice($target, $i+1, 0, array($filter));
        }
    }


    private static function parseFilterList($filterSrc)
    {
        assert(is_array($filterSrc));

        $parsedFilters = array();

        foreach ($filterSrc as $priority => $filter) {
            if (is_string($filter)) {
                $filter = array('class' => $filter);
            }

            if (!is_array($filter)) {
                throw new Exception('Invalid authentication processing filter configuration: ' .
                    'One of the filters wasn\'t a string or an array.');
            }

            $parsedFilters[] = self::parseFilter($filter, $priority);
        }

        return $parsedFilters;
    }


    private static function parseFilter($config, $priority)
    {
        assert(is_array($config));

        if (!array_key_exists('class', $config)) {
            throw new Exception('Authentication processing filter without name given.');
        }

        $className = SimpleSAML\Module::resolveClass($config['class'], 'Auth_Process', 'SimpleSAML_Auth_ProcessingFilter');
        $config['%priority'] = $priority;
        unset($config['class']);
        return new $className($config, null);
    }


    public function processState(&$state)
    {
        assert(is_array($state));
        assert(array_key_exists('ReturnURL', $state) || array_key_exists('ReturnCall', $state));
        assert(!array_key_exists('ReturnURL', $state) || !array_key_exists('ReturnCall', $state));

        $state[self::FILTERS_INDEX] = $this->filters;

        try {
            // TODO: remove this in SSP 2.0
            if (!array_key_exists('UserID', $state)) {
                // No unique user ID present. Attempt to add one.
                self::addUserID($state);
            }

            while (count($state[self::FILTERS_INDEX]) > 0) {
                $filter = array_shift($state[self::FILTERS_INDEX]);
                $filter->process($state);
            }
        } catch (SimpleSAML_Error_Exception $e) {
            // No need to convert the exception
            throw $e;
        } catch (Exception $e) {
            /*
                         * To be consistent with the exception we return after an redirect,
                         * we convert this exception before returning it.
                         */
            throw new SimpleSAML_Error_UnserializableException($e);
        }

        // Completed
    }


    public static function resumeProcessing($state)
    {
        assert(is_array($state));

        while (count($state[self::FILTERS_INDEX]) > 0) {
            $filter = array_shift($state[self::FILTERS_INDEX]);
            try {
                $filter->process($state);
            } catch (SimpleSAML_Error_Exception $e) {
                SimpleSAML_Auth_State::throwException($state, $e);
            } catch (Exception $e) {
                $e = new SimpleSAML_Error_UnserializableException($e);
                SimpleSAML_Auth_State::throwException($state, $e);
            }
        }

        // Completed

        assert(array_key_exists('ReturnURL', $state) || array_key_exists('ReturnCall', $state));
        assert(!array_key_exists('ReturnURL', $state) || !array_key_exists('ReturnCall', $state));


        if (array_key_exists('ReturnURL', $state)) {
            /*
                         * Save state information, and redirect to the URL specified
                         * in $state['ReturnURL'].
                         */
            $id = SimpleSAML_Auth_State::saveState($state, self::COMPLETED_STAGE);
            \SimpleSAML\Utils\HTTP::redirectTrustedURL($state['ReturnURL'], array(self::AUTHPARAM => $id));
        } else {
            /* Pass the state to the function defined in $state['ReturnCall']. */

            // We are done with the state array in the session. Delete it.
            SimpleSAML_Auth_State::deleteState($state);

            $func = $state['ReturnCall'];
            assert(is_callable($func));

            call_user_func($func, $state);
            assert(false);
        }
    }


    public function processStatePassive(&$state)
    {
        assert(is_array($state));
        // Should not be set when calling this method
        assert(!array_key_exists('ReturnURL', $state));

        // Notify filters about passive request
        $state['isPassive'] = true;

        $state[self::FILTERS_INDEX] = $this->filters;

        // TODO: remove this in SSP 2.0
        if (!array_key_exists('UserID', $state)) {
            // No unique user ID present. Attempt to add one.
            self::addUserID($state);
        }

        while (count($state[self::FILTERS_INDEX]) > 0) {
            $filter = array_shift($state[self::FILTERS_INDEX]);
            try {
                $filter->process($state);
            // Ignore SimpleSAML_Error_NoPassive exceptions
            } catch (SimpleSAML_Error_NoPassive $e) {
                // @deprecated will be removed in 2.0
                // Ignore \SimpleSAML\Error\NoPassive exceptions
            } catch (\SimpleSAML\Module\saml\Error\NoPassive $e) {
                // Ignore \SimpleSAML\Module\saml\Error\NoPassive exceptions
            }
        }
    }

    public static function fetchProcessedState($id)
    {
        assert(is_string($id));

        return SimpleSAML_Auth_State::loadState($id, self::COMPLETED_STAGE);
    }


    private static function addUserID(&$state)
    {
        assert(is_array($state));
        assert(array_key_exists('Attributes', $state));

        if (isset($state['Destination']['userid.attribute'])) {
            $attributeName = $state['Destination']['userid.attribute'];
            SimpleSAML\Logger::warning("The 'userid.attribute' option has been deprecated.");
        } elseif (isset($state['Source']['userid.attribute'])) {
            $attributeName = $state['Source']['userid.attribute'];
            SimpleSAML\Logger::warning("The 'userid.attribute' option has been deprecated.");
        } else {
            // Default attribute
            $attributeName = 'eduPersonPrincipalName';
        }

        if (!array_key_exists($attributeName, $state['Attributes'])) {
            return;
        }

        $uid = $state['Attributes'][$attributeName];
        if (count($uid) === 0) {
            SimpleSAML\Logger::warning('Empty user id attribute [' . $attributeName . '].');
            return;
        }

        if (count($uid) > 1) {
            SimpleSAML\Logger::warning('Multiple attribute values for user id attribute [' . $attributeName . '].');
            return;
        }

        // TODO: the attribute value should be trimmed
        $uid = $uid[0];

        if (empty($uid)) {
            SimpleSAML\Logger::warning('Empty value in attribute '.$attributeName.". on user. Cannot set UserID.");
            return;
        }
        $state['UserID'] = $uid;
    }
}