entrouvert
/
simplesamlphp
Archived
17
0
Fork 0
Code Issues Pull Requests Releases Activity

New add_candidate option when configuring SmartID, to allow the user to decide whether to prepend or not the candidate attribute name to the resulting value. Issue #605. 

git-svn-id: http://simplesamlphp.googlecode.com/svn/trunk@3318 44740490-163a-0410-bde0-09ae8108e29a
This commit is contained in:
jaimepc@gmail.com 2014-01-06 20:11:58 +00:00
parent 9966d7997c
commit 50124908f8
2 changed files with 40 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
modules/smartattributes/docs/smartattributes.txt
View File

@ -1,17 +1,17 @@
SmartAttributes module
======================
The SmartAttributes module provides authentication processing filters that add attributes.
The logic in these filters exceeds what is possible with the standard filters such as [`core:AttributeAdd`], [`core:AttributeAlter`], and [`core:AttributeMap`].
The SmartAttributes module provides authentication processing filters to add attributes.
The logic in this filter exceeds what is possible with the standard filters such, as [`core:AttributeAdd`], [`core:AttributeAlter`], and [`core:AttributeMap`].
`smartattributes:SmartID`
=========================
Filter to add an identifier attribute, based on the first non-empty attribute from a given list of attribute names.
This is usefull when there are multiple SAML IdPs configured, and there is no common identifier among them.
For example some IdPs sent eduPersonPrincipalName, while others sent eduPersonTargetedID. If any of the social network are configured as authsource, they will sent yet another identifier.
A filter to add an identifier attribute, based on the first non-empty attribute from a given list of attribute names.
This is useful when there are multiple SAML IdPs configured, and there is no common identifier among them.
For example some IdPs send eduPersonPrincipalName, while others send eduPersonTargetedID. If any of the social networks are configured as an authsource, they will send yet another identifier.
The filter has the following configuration options:
* `candidates`. An array of attributes names to consider as the identifier attribute. Defaults to:
@ -24,9 +24,10 @@ The filter has the following configuration options:
* myspace_targetedID
* linkedin_targetedID
* `id_attribute`. A string to use as the name of the newly added attribute. Defaults to `smart_id`.
* `add_authority`. A boolean to indicate whether or not to append the SAML AuthenticatingAuthority to the resulting identifier. This can be useful to indicate what SAML IdP was used, in case the original identifier is not scoped. Defaults to `true`.
* `add_authority`. A boolean to indicate whether or not to append the SAML AuthenticatingAuthority to the resulting identifier. This can be useful to indicate what SAML IdP was used, in case the original identifier is not scoped. Defaults to `TRUE`.
* `add_candidate`. A boolean to indicate whether or not to prepend the candidate attribute name to the resulting identifier. This can be useful to indicate the attribute originating the identifier. Defaults to `TRUE`.
The generated identifiers have the form:
The generated identifiers have the following form:
`AttributeName:AttributeValue!AuthenticatingAuthority`
@ -46,11 +47,10 @@ Without any configuration:
),
This will add an attribute called `smart_id` with this value:
This will add an attribute called `smart_id` with a value looking like, for example:
`eduPersonTargetedID:c4bcbe7ca8eac074f65291fd5524caa88f3115c8!https://login.terena.org/idp/saml2/idp/metadata.php`
Custom configuration:
'authproc' => array(
@ -58,11 +58,26 @@ Custom configuration:
'class' => 'smartattributes:SmartID',
'candidates' => array('eduPersonTargetedID', 'eduPersonPrincipalName'),
'id_attribute' => 'FooUniversityLocalID',
'add_authority' => false
'add_authority' => FALSE,
),
),
This will add an attribute called `FooUniversityLocalID` with this value:
This will add an attribute called `FooUniversityLocalID` with a value like:
`eduPersonTargetedID:c4bcbe7ca8eac074f65291fd5524caa88f3115c8`
If you also want to remove the name of the originating attribute, you could configure it like this:
'authproc' => array(
50 => array(
'class' => 'smartattributes:SmartID',
'candidates' => array('eduPersonTargetedID', 'eduPersonPrincipalName'),
'id_attribute' => 'FooUniversityLocalID',
'add_authority' => FALSE,
'add_candidate' => FALSE,
),
),
Resulting in:
`c4bcbe7ca8eac074f65291fd5524caa88f3115c8`

16
modules/smartattributes/lib/Auth/Process/SmartID.php
View File

@ -31,6 +31,11 @@ class sspmod_smartattributes_Auth_Process_SmartID extends SimpleSAML_Auth_Proces
*/
private $_add_authority = true;
/**
* Whether to prepend the CandidateID, separated by ':'
*/
private $_add_candidate = true;
/**
* Attributes which should be added/appended.
*
@ -65,15 +70,22 @@ class sspmod_smartattributes_Auth_Process_SmartID extends SimpleSAML_Auth_Proces
}
}
if (array_key_exists('add_candidate', $config)) {
$this->_add_candidate = $config['add_candidate'];
if (!is_bool($this->_add_candidate)) {
throw new Exception('SmartID authproc configuration error: \'add_candidate\' should be a boolean.');
}
}
}
private function addID($attributes, $request) {
foreach ($this->_candidates as $idCandidate) {
if (isset($attributes[$idCandidate][0])) {
if(($this->_add_authority) && (isset($request['saml:AuthenticatingAuthority'][0]))) {
return $idCandidate.':'.$attributes[$idCandidate][0] . '!' . $request['saml:AuthenticatingAuthority'][0];
return ($this->_add_candidate ? $idCandidate.':' : '').$attributes[$idCandidate][0] . '!' . $request['saml:AuthenticatingAuthority'][0];
} else {
return $idCandidate.':'.$attributes[$idCandidate][0];
return ($this->_add_candidate ? $idCandidate.':' : '').$attributes[$idCandidate][0];
}
}
}