CAS SAML features (SAML 1.1)

Collaboration diagram for CAS SAML features (SAML 1.1):

Functions
	CAS_Client::validateSA (&$validate_url, &$text_response, &$tree_response, $renew=false)
	This method is used to validate a SAML TICKET; halt on failure, and sets $validate_url, $text_reponse and $tree_response on success. More...
	CAS_Client::_setSessionAttributes ($text_response)
	This method will parse the DOM and pull out the attributes from the SAML payload and put them into an array, then put the array into the session. More...

Detailed Description

Function Documentation

_setSessionAttributes()

CAS_Client::_setSessionAttributes (   $text_response )

private

This method will parse the DOM and pull out the attributes from the SAML payload and put them into an array, then put the array into the session.

Parameters

string

$text_response

the SAML payload.

Returns

bool true when successfull and false if no attributes a found

Definition at line 2222 of file Client.php.

    {
        phpCAS::traceBegin();
 
        $result = false;
 
        $attr_array = array();
 
        // create new DOMDocument Object
        $dom = new DOMDocument();
        // Fix possible whitspace problems
        $dom->preserveWhiteSpace = false;
        if (($dom->loadXML($text_response))) {
            $xPath = new DOMXpath($dom);
            $xPath->registerNamespace('samlp', 'urn:oasis:names:tc:SAML:1.0:protocol');
            $xPath->registerNamespace('saml', 'urn:oasis:names:tc:SAML:1.0:assertion');
            $nodelist = $xPath->query("//saml:Attribute");
 
            if ($nodelist) {
                foreach ($nodelist as $node) {
                    $xres = $xPath->query("saml:AttributeValue", $node);
                    $name = $node->getAttribute("AttributeName");
                    $value_array = array();
                    foreach ($xres as $node2) {
                        $value_array[] = $node2->nodeValue;
                    }
                    $attr_array[$name] = $value_array;
                }
                // UGent addition...
                foreach ($attr_array as $attr_key => $attr_value) {
                    if (count($attr_value) > 1) {
                        $this->_attributes[$attr_key] = $attr_value;
                        phpCAS::trace("* " . $attr_key . "=" . print_r($attr_value, true));
                    } else {
                        $this->_attributes[$attr_key] = $attr_value[0];
                        phpCAS::trace("* " . $attr_key . "=" . $attr_value[0]);
                    }
                }
                $result = true;
            } else {
                phpCAS::trace("SAML Attributes are empty");
                $result = false;
            }
        }
        phpCAS::traceEnd($result);
        return $result;
    }

References $name, $result, phpCAS\trace(), phpCAS\traceBegin(), and phpCAS\traceEnd().

Here is the call graph for this function:

validateSA()

CAS_Client::validateSA	(	&	$validate_url,
		&	$text_response,
		&	$tree_response,
			$renew = false
	)

This method is used to validate a SAML TICKET; halt on failure, and sets $validate_url, $text_reponse and $tree_response on success.

These parameters are used later by CAS_Client::_validatePGT() for CAS proxies.

Parameters

string	&$validate_url	reference to the the URL of the request to the CAS server.
string	&$text_response	reference to the response of the CAS server, as is (XML text).
string	&$tree_response	reference to the response of the CAS server, as a DOM XML tree.
bool	$renew	true to force the authentication with the CAS server

Returns

bool true when successfull and issue a CAS_AuthenticationException and false on an error

Definition at line 2110 of file Client.php.

    {
        phpCAS::traceBegin();
        $result = false;
        // build the URL to validate the ticket
        $validate_url = $this->getServerSamlValidateURL();
 
        if ($renew) {
            // pass the renew
            $validate_url .= '&renew=true';
        }
 
        // open and read the URL
        if (!$this->_readURL($validate_url, $headers, $text_response, $err_msg)) {
            phpCAS::trace(
                'could not open URL \'' . $validate_url . '\' to validate (' . $err_msg . ')'
            );
            throw new CAS_AuthenticationException(
                $this,
                'SA not validated',
                $validate_url,
                true/*$no_response*/
            );
        }
 
        phpCAS::trace('server version: ' . $this->getServerVersion());
 
        // analyze the result depending on the version
        switch ($this->getServerVersion()) {
        case SAML_VERSION_1_1:
            // create new DOMDocument Object
            $dom = new DOMDocument();
            // Fix possible whitspace problems
            $dom->preserveWhiteSpace = false;
            // read the response of the CAS server into a DOM object
            if (!($dom->loadXML($text_response))) {
                phpCAS::trace('dom->loadXML() failed');
                throw new CAS_AuthenticationException(
                    $this,
                    'SA not validated',
                    $validate_url,
                    false/*$no_response*/,
                    true/*$bad_response*/,
                    $text_response
                );
                $result = false;
            }
            // read the root node of the XML tree
            if (!($tree_response = $dom->documentElement)) {
                phpCAS::trace('documentElement() failed');
                throw new CAS_AuthenticationException(
                    $this,
                    'SA not validated',
                    $validate_url,
                    false/*$no_response*/,
                    true/*$bad_response*/,
                    $text_response
                );
                $result = false;
            } elseif ($tree_response->localName != 'Envelope') {
                // insure that tag name is 'Envelope'
                phpCAS::trace(
                    'bad XML root node (should be `Envelope\' instead of `'
                    . $tree_response->localName . '\''
                );
                throw new CAS_AuthenticationException(
                    $this,
                    'SA not validated',
                    $validate_url,
                    false/*$no_response*/,
                    true/*$bad_response*/,
                    $text_response
                );
                $result = false;
            } elseif ($tree_response->getElementsByTagName("NameIdentifier")->length != 0) {
                // check for the NameIdentifier tag in the SAML response
                $success_elements = $tree_response->getElementsByTagName("NameIdentifier");
                phpCAS::trace('NameIdentifier found');
                $user = trim($success_elements->item(0)->nodeValue);
                phpCAS::trace('user = `' . $user . '`');
                $this->_setUser($user);
                $this->_setSessionAttributes($text_response);
                $result = true;
            } else {
                phpCAS::trace('no <NameIdentifier> tag found in SAML payload');
                throw new CAS_AuthenticationException(
                    $this,
                    'SA not validated',
                    $validate_url,
                    false/*$no_response*/,
                    true/*$bad_response*/,
                    $text_response
                );
                $result = false;
            }
        }
        if ($result) {
            $this->_renameSession($this->getTicket());
        }
        // at this step, ST has been validated and $this->_user has been set,
        phpCAS::traceEnd($result);
        return $result;
    }

Referenced by CAS_Client\isAuthenticated().

Here is the caller graph for this function: