Revision: 1805 Author: olavmrk Date: Wed Sep 30 04:04:51 2009 Log: Add multiauth module.
Add the multiauth module, which allows the user to choose the authentication source that should be used for authentication. This module was created by Lorenzo Gil. http://code.google.com/p/simplesamlphp/source/detail?r=1805 Added: /trunk/modules/multiauth /trunk/modules/multiauth/default-enable /trunk/modules/multiauth/dictionaries /trunk/modules/multiauth/dictionaries/multiauth.php /trunk/modules/multiauth/docs /trunk/modules/multiauth/docs/multiauth.txt /trunk/modules/multiauth/lib /trunk/modules/multiauth/lib/Auth /trunk/modules/multiauth/lib/Auth/Source /trunk/modules/multiauth/lib/Auth/Source/MultiAuth.php /trunk/modules/multiauth/templates /trunk/modules/multiauth/templates/selectsource.php /trunk/modules/multiauth/www /trunk/modules/multiauth/www/selectsource.php ======================================= --- /dev/null +++ /trunk/modules/multiauth/dictionaries/multiauth.php Wed Sep 30 04:04:51 2009 @@ -0,0 +1,13 @@ +<?php + +$lang = array( + 'select_source_header' => array( + 'en' => 'Select an authentication source', + 'es' => 'Seleccione una fuente de autenticación', + ), + 'select_source_text' => array( + 'en' => 'The selected authentication source will be used to authenticate you and and to create a valid session.', + 'es' => 'La fuente de autenticación seleccionada se utilizará para autenticarle y crear una sesión válida.', + ), + ); +?> ======================================= --- /dev/null +++ /trunk/modules/multiauth/docs/multiauth.txt Wed Sep 30 04:04:51 2009 @@ -0,0 +1,54 @@ +MultiAuth module +================ + +The MultiAuth module provides a method for authenticating users agains +a list of authentication sources. There is only one authentication +module: + +`multiauth:MultiAuth` +: Authenticate the user against a list of authentication sources. + + +`multiauth:MultiAuth` +--------------------- + +This module is useful when you want to let the users decide which +authentication source fits better their needs at any scenario. For +example, they can choose the `saml` authentication source in most +cases and then switch to the `admin` authentication source when +'saml' is down for some reason. + +To create a MultiAuth authentication source, open +`config/authsources.php` in a text editor, and add an entry for the +authentication source: + + 'example-multi' => array( + 'multiauth:MultiAuth', + + /* + * The available authentication sources. + * They must be defined in this authsources.php file. + */ + 'sources' => array('example-saml', 'example-admin'), + ), + + 'example-saml' => array( + 'saml:SP', + 'entityId' => 'my-entity-id', + 'idp' => 'my-idp', + ), + + 'example-admin' => array( + 'core:AdminPassword', + ), + +You should update the name of this authentication source +(`example-multi`), and the authentication sources it references, +to have a name which makes sense to your organization. + +The MultiAuth authentication sources only has an option: the +`sources` option, and it is required. It is an array of other +authentication sources defined in the `config/authsources.php` +file. The order in this array does not matter since the user +is the one that decides which one to use. + ======================================= --- /dev/null +++ /trunk/modules/multiauth/lib/Auth/Source/MultiAuth.php Wed Sep 30 04:04:51 2009 @@ -0,0 +1,151 @@ +<?php + +/** + * Authentication source which let the user chooses among a list of + * other authentication sources + * + * @author Lorenzo Gil, Yaco Sistemas S.L. + * @package simpleSAMLphp + * @version $Id$ + */ + +class sspmod_multiauth_Auth_Source_MultiAuth extends SimpleSAML_Auth_Source { + + /** + * The key of the AuthId field in the state. + */ + const AUTHID = 'sspmod_multiauth_Auth_Source_MultiAuth.AuthId'; + + /** + * The string used to identify our states. + */ + const STAGEID = 'sspmod_multiauth_Auth_Source_MultiAuth.StageId'; + + /** + * The key where the sources is saved in the state. + */ + const SOURCESID = 'sspmod_multiauth_Auth_Source_MultiAuth.SourceId'; + + /** + * The key where the selected source is saved in the session. + */ + const SESSION_SOURCE = 'multiauth:selectedSource'; + + /** + * Array of sources we let the user chooses among. + */ + private $sources; + + /** + * Constructor for this authentication source. + * + * @param array $info Information about this authentication source. + * @param array $config Configuration. + */ + public function __construct($info, $config) { + assert('is_array($info)'); + assert('is_array($config)'); + + /* Call the parent constructor first, as required by the interface. */ + parent::__construct($info, $config); + + if (!array_key_exists('sources', $config)) { + throw new Exception('The required "sources" config option was not found'); + } + + $this->sources = $config['sources']; + } + + /** + * Prompt the user with a list of authentication sources. + * + * This method saves the information about the configured sources, + * and redirects to a page where the user must select one of these + * authentication sources. + * + * This method never return. The authentication process is finished + * in the delegateAuthentication method. + * + * @param array &$state Information about the current authentication. + */ + public function authenticate(&$state) { + assert('is_array($state)'); + + $state[self::AUTHID] = $this->authId; + $state[self::SOURCESID] = $this->sources; + + /* Save the $state array, so that we can restore if after a redirect */ + $id = SimpleSAML_Auth_State::saveState($state, self::STAGEID); + + /* Redirect to the select source page. We include the identifier of the + saved state array as a parameter to the login form */ + $url = SimpleSAML_Module::getModuleURL('multiauth/selectsource.php'); + $params = array('AuthState' => $id); + SimpleSAML_Utilities::redirect($url, $params); + + /* The previous function never returns, so this code is never + executed */ + assert('FALSE'); + } + + /** + * Delegate authentication. + * + * This method is called once the user has choosen one authentication + * source. It saves the selected authentication source in the session + * to be able to logout properly. Then it calls the authenticate method + * on such selected authentication source. + * + * @param string $authId Selected authentication source + * @param array $state Information about the current authentication. + */ + public static function delegateAuthentication($authId, $state) { + assert('is_string($authId)'); + assert('is_array($state)'); + + $as = SimpleSAML_Auth_Source::getById($authId); + if ($as === NULL) { + throw new Exception('Invalid authentication source: ' . $authId); + } + + /* Save the selected authentication source for the logout process. */ + $session = SimpleSAML_Session::getInstance(); + $session->setData(self::SESSION_SOURCE, $state[self::AUTHID], $authId); + + try { + $as->authenticate($state); + } catch (SimpleSAML_Error_Exception $e) { + SimpleSAML_Auth_State::throwException($state, $e); + } catch (Exception $e) { + $e = new SimpleSAML_Error_UnserializableException($e); + SimpleSAML_Auth_State::throwException($state, $e); + } + self::loginCompleted($state); + } + + /** + * Log out from this authentication source. + * + * This method retrieves the authentication source used for this + * session and then call the logout method on it. + * + * @param array &$state Information about the current logout operation. + */ + public function logout(&$state) { + assert('is_array($state)'); + + /* Get the source that was used to authenticate */ + $session = SimpleSAML_Session::getInstance(); + $authId = $session->getData(self::SESSION_SOURCE, $this->authId); + + $source = SimpleSAML_Auth_Source::getById($authId); + if ($source === NULL) { + throw new Exception('Invalid authentication source during logout: ' . $source); + } + /* Then, do the logout on it */ + $source->logout($state); + } + +} + +?> ======================================= --- /dev/null +++ /trunk/modules/multiauth/templates/selectsource.php Wed Sep 30 04:04:51 2009 @@ -0,0 +1,22 @@ +<?php +$this->data['icon'] = 'lock.png'; +$this->data['header'] = $this->t('{multiauth:multiauth:select_source_header}'); + +$this->includeAtTemplateBase('includes/header.php'); +?> + +<h2><?php echo $this->t('{multiauth:multiauth:select_source_header}'); ?></h2> + +<p><?php echo $this->t('{multiauth:multiauth:select_source_text}'); ?></p> + +<ul> +<?php +foreach($this->data['sources'] as $source) { + echo '<li><a href="?source=' . htmlspecialchars($source) . + '&AuthState=' . htmlspecialchars($this->data['authstate']) . '">' . + htmlspecialchars($source) . '</a></li>'; +} +?> +</ul> + +<?php $this->includeAtTemplateBase('includes/footer.php'); ?> ======================================= --- /dev/null +++ /trunk/modules/multiauth/www/selectsource.php Wed Sep 30 04:04:51 2009 @@ -0,0 +1,34 @@ +<?php + +/** + * This page shows a list of authentication sources. When the user selects + * one of them if pass this information to the + * sspmod_multiauth_Auth_Source_MultiAuth class and call the + * delegateAuthentication method on it. + * + * @author Lorenzo Gil, Yaco Sistemas S.L. + * @package simpleSAMLphp + * @version $Id$ + */ + +if (!array_key_exists('AuthState', $_REQUEST)) { + throw new SimpleSAML_Error_BadRequest('Missing AuthState parameter.'); +} +$authStateId = $_REQUEST['AuthState']; + +/* Retrieve the authentication state. */ +$state = SimpleSAML_Auth_State::loadState($authStateId, sspmod_multiauth_Auth_Source_MultiAuth::STAGEID); + +if (array_key_exists('source', $_REQUEST)) { + $source = $_REQUEST['source']; + sspmod_multiauth_Auth_Source_MultiAuth::delegateAuthentication($source, $state); +} + +$globalConfig = SimpleSAML_Configuration::getInstance(); +$t = new SimpleSAML_XHTML_Template($globalConfig, 'multiauth:selectsource.php'); +$t->data['authstate'] = $authStateId; +$t->data['sources'] = $state[sspmod_multiauth_Auth_Source_MultiAuth::SOURCESID]; +$t->show(); +exit(); + +?> --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "simpleSAMLphp commits" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/simplesamlphp-commits?hl=en -~----------~----~----~----~------~----~------~--~---
