diff --git a/lib/SimpleSAML/Auth/ProcessingChain.php b/lib/SimpleSAML/Auth/ProcessingChain.php index a3b361529f99a01251dfb017b46a405be46784ec..153190c20f4bad638b5ce77d78e1c65a1d6aa666 100644 --- a/lib/SimpleSAML/Auth/ProcessingChain.php +++ b/lib/SimpleSAML/Auth/ProcessingChain.php @@ -46,11 +46,19 @@ class SimpleSAML_Auth_ProcessingChain { * @param array $idpMetadata The metadata for the IdP. * @param array $spMetadata The metadata for the SP. */ - public function __construct($idpMetadata, $spMetadata) { + public function __construct($idpMetadata, $spMetadata, $mode = 'idp') { assert('is_array($idpMetadata)'); assert('is_array($spMetadata)'); $this->filters = array(); + + $config = SimpleSAML_Configuration::getInstance(); + $configauthproc = $config->getValue('authproc.' . $mode); + + if (!empty($configauthproc) && is_array($configauthproc)) { + $configfilters = self::parseFilterList($configauthproc); + self::addFilters($this->filters, $configfilters); + } if (array_key_exists('authproc', $idpMetadata)) { $idpFilters = self::parseFilterList($idpMetadata['authproc']); @@ -109,10 +117,10 @@ class SimpleSAML_Auth_ProcessingChain { $parsedFilters = array(); - foreach ($filterSrc as $filter) { + foreach ($filterSrc as $priority => $filter) { if (is_string($filter)) { - $filter = array($filter); + $filter = array('class' => $filter); } if (!is_array($filter)) { @@ -120,7 +128,7 @@ class SimpleSAML_Auth_ProcessingChain { 'One of the filters wasn\'t a string or an array.'); } - $parsedFilters[] = self::parseFilter($filter); + $parsedFilters[] = self::parseFilter($filter, $priority); } return $parsedFilters; @@ -130,20 +138,20 @@ class SimpleSAML_Auth_ProcessingChain { /** * Parse an authentication processing filter. * - * @param array $config Array with the authentication processing filter configuration. + * @param array $config Array with the authentication processing filter configuration. + * @param int $priority The priority of the current filter, (not included in the filter + * definition.) * @return SimpleSAML_Auth_ProcessingFilter The parsed filter. */ - private static function parseFilter($config) { + private static function parseFilter($config, $priority) { assert('is_array($config)'); - if (!array_key_exists(0, $config)) { + if (!array_key_exists('class', $config)) throw new Exception('Authentication processing filter without name given.'); - } - - $className = SimpleSAML_Module::resolveClass($config[0], 'Auth_Process', - 'SimpleSAML_Auth_ProcessingFilter'); - unset($config[0]); + $className = SimpleSAML_Module::resolveClass($config['class'], 'Auth_Process', 'SimpleSAML_Auth_ProcessingFilter'); + $config['%priority'] = $priority; + unset($config['class']); return new $className($config, NULL); } @@ -245,13 +253,12 @@ class SimpleSAML_Auth_ProcessingChain { $uid = $state['Attributes'][$attributeName]; if (count($uid) === 0) { - SimpleSAML_Logger::warning('Empty user id attribute \'' . $attributeName . '\'.'); + SimpleSAML_Logger::warning('Empty user id attribute [' . $attributeName . '].'); return; } if (count($uid) > 1) { - SimpleSAML_Logger::warning('Multiple attribute values for user id attribute \'' . - $attributeName . '\'.'); + SimpleSAML_Logger::warning('Multiple attribute values for user id attribute [' . $attributeName . '].'); } $uid = $uid[0]; diff --git a/www/saml2/idp/SSOService.php b/www/saml2/idp/SSOService.php index b145aa0d021e98b5954cfe5230e448090e0644b2..b067f9a6262a2600053d32db95cf1187c0fdd437 100644 --- a/www/saml2/idp/SSOService.php +++ b/www/saml2/idp/SSOService.php @@ -285,7 +285,7 @@ if($needAuth && !$isPassive) { } else { /* Not processed. */ - $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata); + $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata, 'idp'); $authProcState = array( 'core:saml20-idp:requestcache' => $requestcache, diff --git a/www/saml2/sp/AssertionConsumerService.php b/www/saml2/sp/AssertionConsumerService.php index 5a6823069a999eb121dd4db354b87990600d9f49..0e75027cade902fea35e5e0d6313c112af41f301 100644 --- a/www/saml2/sp/AssertionConsumerService.php +++ b/www/saml2/sp/AssertionConsumerService.php @@ -146,7 +146,7 @@ try { /* Begin module attribute processing */ - $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata); + $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata, 'sp'); $authProcState = array( 'core:saml20-sp:NameID' => $authnResponse->getNameID(), diff --git a/www/shib13/idp/SSOService.php b/www/shib13/idp/SSOService.php index 4ec9636b4eb52a514f026b7e085101f9e74bd4b5..7a5f84145c4b1bf14a6ce6ccfb8d9f084986f3de 100644 --- a/www/shib13/idp/SSOService.php +++ b/www/shib13/idp/SSOService.php @@ -202,7 +202,7 @@ if (!$session->isAuthenticated($authority) ) { } else { /* Not processed. */ - $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata); + $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata, 'idp'); $authProcState = array( 'core:shib13-idp:requestcache' => $requestcache, diff --git a/www/shib13/sp/AssertionConsumerService.php b/www/shib13/sp/AssertionConsumerService.php index 69f56786e549f104fa4edf0a90afcba9514f20fc..0631bd06c240b18c09eb456680baf7bcb6d28aff 100644 --- a/www/shib13/sp/AssertionConsumerService.php +++ b/www/shib13/sp/AssertionConsumerService.php @@ -93,7 +93,7 @@ try { $spmetadata = $metadata->getMetaData(NULL, 'shib13-sp-hosted'); /* Begin module attribute processing */ - $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata); + $pc = new SimpleSAML_Auth_ProcessingChain($idpmetadata, $spmetadata, 'sp'); $authProcState = array( 'core:shib13-sp:NameID' => $authnResponse->getNameID(),