Skip to content
Snippets Groups Projects
Commit 9bc4194e authored by Martin van Es's avatar Martin van Es
Browse files

Add GenerateAffiliation Authentication Processing Filter and unittest. 

GenerateAffiliation generates an attribute with fixed values based on (multiple) values found in a source attribute.
In short: if member of group "A" create target attribute with value "student".
parent b34addd8
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
modules/core/docs/authproc_generateaffiliation.txt 0 → 100644
+ 61
− 0
View file @ 9bc4194e
`core:GenerateAffiliation`
===================
Filter that generate an attribute to the user based on value(s) in another attribute.
Default member attribute is memberOf, default target attribute is eduPersonAffiliation.
%replace can be used to replace member attribute with target attribute, otherwise both will exist
after processing filter. If the member attribute does not exist, nothing will be done or replaced.
Examples
--------
Add student affiliation based on LDAP groupmembership
Will add eduPersonAffiliation containing value "student" if memberOf attribute contains 'cn=student,o=some,o=organization,dc=org'.
'authproc' => array(
50 => array(
'class' => 'core:GenerateAffiliation',
'values' => array(
'student' => array(
'cn=student,o=some,o=organization,dc=org',
),
),
),
Add student and employee affiliation based on LDAP groupmembership
'authproc' => array(
50 => array(
'class' => 'core:GenerateAffiliation',
'values' => array(
'student' => array(
'cn=student,o=some,o=organization,dc=org',
),
'employee' => array(
'cn=employees,o=some,o=organization,dc=org',
),
),
),
Different memberof and target attributes, replace member attribute
Will add 'affiliation' containing 'student' and/or 'employee' depending on the values in 'groups' attribute and remove the latter.
'authproc' => array(
50 => array(
'class' => 'core:GenerateAffiliation',
'%replace',
'attributename' => 'affiliation',
'memberattribute' => 'groups',
'values' => array(
'student' => array(
'cn=student,o=some,o=organization,dc=org',
),
'employee' => array(
'cn=employees,o=some,o=organization,dc=org',
),
),
),
modules/core/lib/Auth/Process/GenerateAffiliation.php 0 → 100644
+ 110
− 0
View file @ 9bc4194e
<?php
/**
* Filter to generate affiliation(s) based on groupmembership attribute
*
* @author Martin van Es, m7
* @package simpleSAMLphp
*/
class sspmod_core_Auth_Process_GenerateAffiliation extends SimpleSAML_Auth_ProcessingFilter {
/**
* The attributename we should assign affiliations to (target)
*/
private $attributename = 'eduPersonAffiliation';
/**
* The attributename we should generate affiliations from
*/
private $memberattribute = 'memberOf';
/**
* The required $memberattribute values and target affiliations
*/
private $values = array();
/**
* Wether $memberattribute should be replaced by target attribute
*/
private $replace = FALSE;
/**
* Initialize this filter.
*
* @param array $config Configuration information about this filter.
* @param mixed $reserved For future use.
*/
public function __construct($config, $reserved) {
parent::__construct($config, $reserved);
assert('is_array($config)');
/* Validate configuration. */
foreach ($config as $name => $value) {
if (is_int($name)) {
// check if this is an option
if ($value === '%replace') {
$this->replace = TRUE;
} else {
throw new SimpleSAML_Error_Exception('Unknown flag : ' . var_export($value, TRUE));
}
continue;
}
// Set attributename
if ($name === 'attributename') {
$this->attributename = $value;
}
// Set memberattribute
if ($name === 'memberattribute') {
$this->memberattribute = $value;
}
// Set values
if ($name === 'values') {
$this->values = $value;
}
}
}
/**
* Apply filter to add groups attribute.
*
* @param array &$request The current request
*/
public function process(&$request) {
assert('is_array($request)');
assert('array_key_exists("Attributes", $request)');
$attributes =& $request['Attributes'];
$affiliations = array();
if (array_key_exists($this->memberattribute, $attributes)) {
$memberof = $attributes[$this->memberattribute];
if (is_array($memberof)) {
foreach ($this->values as $value => $require) {
if (count(array_intersect($require, $memberof)) > 0) {
SimpleSAML_Logger::debug('GenerateAffiliation - intersect match for ' . $value);
$affiliations[] = $value;
}
}
}
if (count($affiliations) > 0) {
$attributes[$this->attributename] = $affiliations;
}
if ($this->replace) {
unset($attributes[$this->memberattribute]);
}
} else {
SimpleSAML_Logger::warning('GenerateAffiliation - memberattribute does not exist: ' . $this->memberattribute);
}
}
}
?>
\ No newline at end of file
tests/modules/core/lib/Auth/Process/GenerateAffiliationTest.php 0 → 100644
+ 140
− 0
View file @ 9bc4194e
<?php
/**
* Test for the core:GenerateAffiliation filter.
*/
class Test_Core_Auth_Process_GenerateAffiliation extends PHPUnit_Framework_TestCase
{
/**
* Helper function to run the filter with a given configuration.
*
* @param array $config The filter configuration.
* @param array $request The request state.
* @return array The state array after processing.
*/
private static function processFilter(array $config, array $request) {
$filter = new sspmod_core_Auth_Process_GenerateAffiliation($config, NULL);
$filter->process($request);
return $request;
}
/**
* Test the most basic functionality.
*/
public function testBasic() {
$config = array(
'values' => array(
'target' => array(
'source',
),
),
);
$request = array(
'Attributes' => array(
'memberOf' => array('source'),
),
);
$result = self::processFilter($config, $request);
$attributes = $result['Attributes'];
$this->assertArrayHasKey('eduPersonAffiliation', $attributes);
$this->assertArrayHasKey('memberOf', $attributes);
$this->assertEquals($attributes['eduPersonAffiliation'], array('target'));
}
/**
* Test the %replace functionality.
*/
public function testReplace() {
$config = array(
'%replace',
'values' => array(
'target' => array(
'source',
),
),
);
$request = array(
'Attributes' => array(
'memberOf' => array('source'),
),
);
$result = self::processFilter($config, $request);
$attributes = $result['Attributes'];
$this->assertArrayHasKey('eduPersonAffiliation', $attributes);
$this->assertArrayNotHasKey('memberOf', $attributes);
$this->assertEquals($attributes['eduPersonAffiliation'], array('target'));
}
/**
* Test the different Attribute configurations.
*/
public function testAttributeConfig() {
$config = array(
'attributename' => 'affiliation',
'memberattribute' => 'group',
'values' => array(
'target' => array(
'source',
),
),
);
$request = array(
'Attributes' => array(
'group' => array('source'),
),
);
$result = self::processFilter($config, $request);
$attributes = $result['Attributes'];
$this->assertArrayHasKey('affiliation', $attributes);
$this->assertEquals($attributes['affiliation'], array('target'));
}
/**
* Test unknown flag Exception
*
* @expectedException Exception
*/
public function testUnknownFlag() {
$config = array(
'%test',
'values' => array(
'target' => array(
'source',
),
),
);
$request = array(
'Attributes' => array(
'memberOf' => array('source'),
),
);
$result = self::processFilter($config, $request);
}
/**
* Test missing member attribute
*
*/
public function testMissingMemberAttribute() {
$config = array(
'%replace',
'values' => array(
'target' => array(
'source',
),
),
);
$request = array(
'Attributes' => array(
'test' => array('source'),
),
);
$result = self::processFilter($config, $request);
$attributes = $result['Attributes'];
$this->assertArrayHasKey('test', $attributes);
$this->assertArrayNotHasKey('eduPersonAffiliation', $attributes);
$this->assertEquals($attributes['test'], array('source'));
}
}
\ No newline at end of file
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment