ExpectedAuthnContextClassRef.php

Go to the documentation of this file.

<?php


class sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef extends SimpleSAML_Auth_ProcessingFilter
{

    private $accepted;


    private $AuthnContextClassRef;


    public function __construct($config, $reserved)
    {
        parent::__construct($config, $reserved);

        assert(is_array($config));
        if (empty($config['accepted'])) {
            SimpleSAML\Logger::error(
                'ExpectedAuthnContextClassRef: Configuration error. There is no accepted AuthnContextClassRef.'
            );
            throw new SimpleSAML_Error_Exception(
                'ExpectedAuthnContextClassRef: Configuration error. There is no accepted AuthnContextClassRef.'
            );
        }
        $this->accepted = $config['accepted'];
    }


    public function process(&$request)
    {
        assert(is_array($request));
        assert(array_key_exists('Attributes', $request));

        $this->AuthnContextClassRef = $request['saml:sp:State']['saml:sp:AuthnContext'];

        if (!in_array($this->AuthnContextClassRef, $this->accepted, true)) {
            $this->unauthorized($request);
        }
    }


    protected function unauthorized(&$request)
    {
        SimpleSAML\Logger::error(
            'ExpectedAuthnContextClassRef: Invalid authentication context: '.$this->AuthnContextClassRef.
            '. Accepted values are: '.var_export($this->accepted, true)
        );

        $id = SimpleSAML_Auth_State::saveState($request, 'saml:ExpectedAuthnContextClassRef:unauthorized');
        $url = SimpleSAML\Module::getModuleURL(
            'saml/sp/wrong_authncontextclassref.php'
        );
        \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('StateId' => $id));
    }
}