Skip to content

Commit 694c0b2

Browse files
Sae126VSae126V
committed
Update code to improve local_info schema
1 parent e91226c commit 694c0b2

File tree

4 files changed

+65
-25
lines changed

4 files changed

+65
-25
lines changed

‎config/local_info.xml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,9 @@
186186
<provider>
187187
<idp>aai.egi.eu/auth/realms/egi</idp>
188188
<name>EGI Proxy</name>
189+
<authentication_realms>
190+
<shib_realm_name>EGI Proxy IdP</shib_realm_name>
191+
</authentication_realms>
189192
<required_groups>
190193
<group>urn:mace:egi.eu:res:gocdb#aai.egi.eu</group>
191194
</required_groups>
@@ -194,9 +197,13 @@
194197
<provider>
195198
<idp>aai-demo.egi.eu/auth/realms/egi</idp>
196199
<name>EGI Demo Proxy</name>
200+
<authentication_realms>
201+
<shib_realm_name>EGI Proxy IdP</shib_realm_name>
202+
</authentication_realms>
197203
<required_groups>
198204
<group>urn:mace:egi.eu:res:gocdb#aai.egi.eu</group>
199205
</required_groups>
206+
<help_url>https://docs.egi.eu/internal/configuration-database/access/#using-institutional-account-via-egi-check-in</help_url>
200207
</provider>
201208
</identity_providers>
202209

‎config/local_info.xsd

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -125,19 +125,26 @@
125125
<xs:element name="identity_providers" minOccurs="0">
126126
<xs:complexType>
127127
<xs:sequence>
128-
<xs:element name="provider" minOccurs="1">
128+
<xs:element name="provider" minOccurs="1" maxOccurs="unbounded">
129129
<xs:complexType>
130130
<xs:sequence>
131-
<xs:element name="idp" type="xs:string"/>
132-
<xs:element name="name" type="xs:string"/>
131+
<xs:element name="idp" type="xs:string" minOccurs="1" maxOccurs="1"/>
132+
<xs:element name="name" type="xs:string" minOccurs="1" maxOccurs="1"/>
133+
<xs:element name="authentication_realms" minOccurs="1" maxOccurs="1">
134+
<xs:complexType>
135+
<xs:sequence>
136+
<xs:element name="shib_realm_name" type="xs:string" minOccurs="1" maxOccurs="unbounded"/>
137+
</xs:sequence>
138+
</xs:complexType>
139+
</xs:element>
133140
<xs:element name="required_groups" minOccurs="0">
134141
<xs:complexType>
135142
<xs:sequence>
136143
<xs:element name="group" type="xs:string" minOccurs="1" maxOccurs="unbounded"/>
137144
</xs:sequence>
138145
</xs:complexType>
139146
</xs:element>
140-
<xs:element name="help_url" type="xs:string" minOccurs="0"/>
147+
<xs:element name="help_url" type="xs:string" minOccurs="1" maxOccurs="1"/>
141148
</xs:sequence>
142149
</xs:complexType>
143150
</xs:element>

‎lib/Authentication/AuthTokens/ShibAuthToken.php

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ private function getAttributesInitToken(){
8585
// specify location of the Shib Logout handler
8686
\Factory::$properties['LOGOUTURL'] = 'https://'.$hostname.'/Shibboleth.sso/Logout';
8787
$idp = isset($_SERVER['Shib-Identity-Provider']) ? $_SERVER['Shib-Identity-Provider'] : '';
88+
8889
if ($idp == 'https://unity.eudat-aai.fz-juelich.de:8443/saml-idp/metadata'
8990
&& $_SERVER['distinguishedName'] != null){
9091
$this->principal = $_SERVER['distinguishedName'];
@@ -103,38 +104,42 @@ private function getAttributesInitToken(){
103104
foreach ($identityProviders as $provider) {
104105
if ($provider['idp'] === $idp) {
105106
$name = $provider['name'];
106-
$helpUrl = $provider['help_url'] ?? '#';
107+
$helpUrl = $provider['help_url'];
107108

108109
if (empty($_SERVER['voPersonID'])) {
109110
die(
110-
"Did not receive required attributes from the IDP $name to "
111-
. "complete authentication. Please contact gocdb-admins."
111+
"Did not receive required attributes from the "
112+
. "IDP $name to complete authentication. "
113+
. "Please contact gocdb-admins."
112114
);
113115
}
114116

115117
if (empty($_SERVER['entitlement'])) {
116118
die(
117-
"Did not receive the required entitlement attribute from "
118-
. "the IDP $name. Please contact gocdb-admins."
119+
"Did not receive the required entitlement "
120+
. "attribute from the IDP $name. "
121+
. "Please contact gocdb-admins."
119122
);
120123
}
121124

122125
if (!empty($provider['required_groups'])) {
123-
$entitlementValues = explode(
124-
';', $_SERVER['entitlement']
125-
);
126-
127-
if (!array_intersect(
128-
$entitlementValues, $provider['required_groups']
129-
)) {
126+
$entitlementValues = explode(';', $_SERVER['entitlement']);
127+
128+
if (
129+
!array_intersect(
130+
$entitlementValues,
131+
$provider['required_groups']
132+
)
133+
) {
130134
$HTML = "<ul>"
131135
. "<li>Login requires the entitlement "
132136
. "which was not provided for the IDP $name.</li>"
133137
. "<li>Please see here for more information: "
134-
. "<a href='$helpUrl' target='_blank'>$helpUrl</a>.</li>"
135-
. "<li>Logout or restart your "
136-
. "browser and attempt to login again using an IDP that "
137-
. "provides a GOCDB entitlement.</li>"
138+
. "<a href='$helpUrl' target='_blank'>"
139+
. "$helpUrl</a>.</li>"
140+
. "<li>Logout or restart your browser"
141+
. "and attempt to login again using an IDP "
142+
. "that provides a GOCDB entitlement.</li>"
138143
. "</ul>";
139144
$HTML .= "<div style='text-align: center;'>";
140145
$HTML .= "<a href=\""
@@ -147,7 +152,9 @@ private function getAttributesInitToken(){
147152
}
148153

149154
$this->principal = $_SERVER['voPersonID'];
150-
$this->userDetails = ['AuthenticationRealm' => [$provider['idp']]];
155+
$this->userDetails = [
156+
'AuthenticationRealm' => $provider['authenticationRealms']
157+
];
151158

152159
return;
153160
}

‎lib/Gocdb_Services/Config.php

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -574,27 +574,46 @@ public function getIdentityProvidersInfo(): array
574574
$identityProviders = [];
575575

576576
if (!empty($localInfo->identity_providers->provider)) {
577-
foreach ($localInfo->identity_providers->provider as $providerDetails) {
577+
foreach (
578+
$localInfo
579+
->identity_providers
580+
->provider as $providerDetails
581+
) {
578582
/** idp */
579583
$idp = (string) $providerDetails->idp;
580584

581585
/** name */
582586
$name = (string) $providerDetails->name;
583587

588+
/** authentication_realms */
589+
$authenticationRealms = [];
590+
if ($providerDetails->authentication_realms) {
591+
foreach (
592+
$providerDetails
593+
->authentication_realms
594+
->shib_realm_name as $shibRealmName
595+
) {
596+
$authenticationRealms[] = (string) $shibRealmName;
597+
}
598+
}
599+
584600
/** required_groups */
585601
$requiredGroups = [];
586-
if ($providerDetails->required_groups->group) {
587-
foreach($providerDetails->required_groups->group as $group) {
602+
if ($providerDetails->required_groups) {
603+
foreach (
604+
$providerDetails->required_groups->group as $group
605+
) {
588606
$requiredGroups[] = (string) $group;
589607
}
590608
}
591609

592610
/** help_url */
593-
$helpURL = $providerDetails->help_url ?? null;
611+
$helpURL = (string) $providerDetails->help_url;
594612

595613
$identityProviders[] = [
596614
'idp' => $idp,
597615
'name' => $name,
616+
'authenticationRealms' => $authenticationRealms,
598617
'requiredGroups' => $requiredGroups,
599618
'helpURL', $helpURL
600619
];

0 commit comments

Comments
 (0)