diff --git a/modules/authorize/docs/authorize.md b/modules/authorize/docs/authorize.md index cfd25811a69616821eee19e0f16b556d66bc3d18..681a8e755e34e1909ebe210a4a641bf6582ce66b 100644 --- a/modules/authorize/docs/authorize.md +++ b/modules/authorize/docs/authorize.md @@ -22,7 +22,7 @@ This module provides a user authorization filter based on attribute matching for There are three configuration options that can be defined: `deny`, `regex`, and `reject_msg`. All other filter configuration options are considered attribute matching rules. -Unauthorized will be shown a 403 Forbidden page. +Unauthorized users will be shown a 403 Forbidden page. ### `deny` ### The default action of the filter is to authorize only if an attribute match is found (default allow). When set to TRUE, this option reverses that rule and authorizes the user unless an attribute match is found (default deny), causing an unauthorized action. @@ -53,15 +53,15 @@ Note: If regex is enabled, you must use the preg_match format, i.e. you have to To use this filter configure it in `config/config.php`: ```php 'authproc.sp' => [ - 60 => [ - 'class' => 'authorize:Authorize', - 'uid' => array( - '/.*@example.com/', - '/(user1|user2|user3)@example.edu/', - ], - 'schacUserStatus' => '@urn:mace:terena.org:userStatus:' . - 'example.org:service:active.*@', - ] + 60 => [ + 'class' => 'authorize:Authorize', + 'uid' => [ + '/.*@example.com/', + '/(user1|user2|user3)@example.edu/', + ], + 'schacUserStatus' => '@urn:mace:terena.org:userStatus:' . + 'example.org:service:active.*@', + ] ] ``` @@ -70,14 +70,14 @@ An alternate way of using this filter is to deny certain users. Or even use mult ```php 'authproc.sp' => [ - 60 => array[ - 'class' => 'authorize:Authorize', - 'deny' => TRUE, - 'uid' => [ - '/.*@students.example.edu/', - '/(stu1|stu2|stu3)@example.edu/', + 60 => array[ + 'class' => 'authorize:Authorize', + 'deny' => TRUE, + 'uid' => [ + '/.*@students.example.edu/', + '/(stu1|stu2|stu3)@example.edu/', + ] ] - ] ] ``` @@ -87,19 +87,19 @@ Additionally, some helpful instructions are shown. ```php 'authproc.sp' => [ - 60 => [ - 'class' => 'authorize:Authorize', - 'regex' => FALSE, - 'group' => [ - 'CN=SimpleSAML Students,CN=Users,DC=example,DC=edu', - 'CN=All Teachers,OU=Staff,DC=example,DC=edu', - ], - 'reject_msg' => [ - 'en' => 'This service is only available to students and teachers.' . - 'Please contact <a href="mailto:support@example.edu">support</a>.', - 'nl' => 'Deze dienst is alleen beschikbaar voor studenten en docenten.' . - 'Neem contact op met <a href="mailto:support@example.edu">support</a>.', + 60 => [ + 'class' => 'authorize:Authorize', + 'regex' => FALSE, + 'group' => [ + 'CN=SimpleSAML Students,CN=Users,DC=example,DC=edu', + 'CN=All Teachers,OU=Staff,DC=example,DC=edu', + ], + 'reject_msg' => [ + 'en' => 'This service is only available to students and teachers.' . + 'Please contact <a href="mailto:support@example.edu">support</a>.', + 'nl' => 'Deze dienst is alleen beschikbaar voor studenten en docenten.' . + 'Neem contact op met <a href="mailto:support@example.edu">support</a>.', + ] ] - ] ] ``` diff --git a/modules/authorize/lib/Auth/Process/Authorize.php b/modules/authorize/lib/Auth/Process/Authorize.php index 020040765b330bddfbb61c7f5f64993714c102d4..e40cbaf36274373fc66bb2694d84bfa79cc3ea18 100644 --- a/modules/authorize/lib/Auth/Process/Authorize.php +++ b/modules/authorize/lib/Auth/Process/Authorize.php @@ -109,7 +109,7 @@ class Authorize extends \SimpleSAML\Auth\ProcessingFilter $attributes = &$request['Attributes']; // Store the rejection message array in the $request if(!empty($this->reject_msg)) { - $request['authprocAuthorize_reject_msg'] = $this->reject_msg; + $request['authprocAuthorize_reject_msg'] = $this->reject_msg; } foreach ($this->valid_attribute_values as $name => $patterns) { diff --git a/modules/authorize/templates/authorize_403.php b/modules/authorize/templates/authorize_403.php index d00b5b68184a954152f58642293dabf951b96080..d4d5b79a09c0f49916ab6af16a9def6da26e8626 100644 --- a/modules/authorize/templates/authorize_403.php +++ b/modules/authorize/templates/authorize_403.php @@ -14,9 +14,9 @@ $this->data['403_header'] = $this->t('{authorize:Authorize:403_header}'); $this->data['403_text'] = $this->t('{authorize:Authorize:403_text}'); if (array_key_exists('reject_msg', $this->data)) { - if(isset($this->data['reject_msg'][$this->getLanguage()])) { - $this->data['403_text'] = $this->data['reject_msg'][$this->getLanguage()]; - } + if(isset($this->data['reject_msg'][$this->getLanguage()])) { + $this->data['403_text'] = $this->data['reject_msg'][$this->getLanguage()]; + } } $this->includeAtTemplateBase('includes/header.php'); diff --git a/modules/authorize/www/authorize_403.php b/modules/authorize/www/authorize_403.php index 1b49e89e5cd1c3241d4d13cc87d11c97e85875c7..032e1ecffdad1e17a4d44005b232975f023443f9 100644 --- a/modules/authorize/www/authorize_403.php +++ b/modules/authorize/www/authorize_403.php @@ -19,7 +19,7 @@ if (isset($state['Source']['auth'])) { )."&logout"; } if (isset($state['authprocAuthorize_reject_msg'])) { - $t->data['reject_msg'] = $state['authprocAuthorize_reject_msg']; + $t->data['reject_msg'] = $state['authprocAuthorize_reject_msg']; } header('HTTP/1.0 403 Forbidden'); $t->show();