Revision: 1816 Author: olavmrk Date: Mon Oct 5 04:03:33 2009 Log: Add authorize-module.
This module provides a filter for doing attribute-based access control for a service provider. Thanks to Ernesto Revilla for creating this filter. http://code.google.com/p/simplesamlphp/source/detail?r=1816 Added: /trunk/modules/authorize /trunk/modules/authorize/default-enable /trunk/modules/authorize/dictionaries /trunk/modules/authorize/dictionaries/Authorize.php /trunk/modules/authorize/docs /trunk/modules/authorize/docs/authorize.txt /trunk/modules/authorize/lib /trunk/modules/authorize/lib/Auth /trunk/modules/authorize/lib/Auth/Process /trunk/modules/authorize/lib/Auth/Process/Authorize.php /trunk/modules/authorize/templates /trunk/modules/authorize/templates/authorize_403.php /trunk/modules/authorize/www /trunk/modules/authorize/www/authorize_403.php ======================================= --- /dev/null +++ /trunk/modules/authorize/dictionaries/Authorize.php Mon Oct 5 04:03:33 2009 @@ -0,0 +1,15 @@ +<?php + +$lang = array( + '403_header' => array ( + 'en' => 'Access forbidden', + 'es' => 'Acceso denegado', + ), + '403_text' => array ( + 'en' => "You don't have the needed privileges to access this application. Please contact the administrator if you find this to be incorrect.", + 'es' => "No tiene los privilegios necesarios para acceder a esta aplicación. Si considera que esto no es correcto, consulte el administrador.", + ), +); + + +?> ======================================= --- /dev/null +++ /trunk/modules/authorize/docs/authorize.txt Mon Oct 5 04:03:33 2009 @@ -0,0 +1,53 @@ +authorize Module +================ + +<!-- + This file is written in Markdown syntax. + For more information about how to use the Markdown syntax, read here: + http://daringfireball.net/projects/markdown/syntax +--> + + * Version: `$Id$` + * Author: Ernesto Revilla <[email protected]>, Yaco Sistemas + * Package simpleSAMLphp + + +This module provides an user authorization filter based on regular +expressions for those applications that do not cleanly separate +authentication from authorization and set some default permissions +for authenticated users. + + +`authorize:Authorize` +: Authorize certain users based on regular expressions. + + +`authorize:Authorize` +--------------------- + +For each attribute you can specify a regular expression +string or array of strings. If one of those attributes matches (OR operator) +one of the regular expression, the user is authorized successfully. + +You must use the preg_match format, i.e. you have to enclose it with +a delimiter that does not appear inside the regex +(e.g. slash (/), at sign (@), number sign (#) or underscore (_)). + +The users not authorized will be shown a 403 Forbidden page. + +Problems: + * Once you get the forbidden page, you can't logout at the IdP directly, + (as far as I know), you have to close the browser. + + +To use this filter configure it in `config/config.php`: + 'authproc.sp' => array( + 60 => array( + 'class' => 'authorize:Authorize', + 'uid' => array( + '/[email protected]/', + '/(user1|user2|user3)@example.edu/', + ), + 'schacUserStatus' => '@urn:mace:terena.org:userStatus:' . + 'example.org:service:active.*@', + ) ======================================= --- /dev/null +++ /trunk/modules/authorize/lib/Auth/Process/Authorize.php Mon Oct 5 04:03:33 2009 @@ -0,0 +1,86 @@ +<?php + +/** + * Filter to authorize only certain users. + * See docs directory. + * + * @author Ernesto Revilla, Yaco Sistemas SL. + * @package simpleSAMLphp + * @version $Id$ + */ +class sspmod_authorize_Auth_Process_Authorize extends SimpleSAML_Auth_ProcessingFilter { + + /** + * Array of valid users. Each element is a regular expression. You should + * user \ to escape special chars, like '.' etc. + * + */ + private $valid_attribute_values = array(); + + + /** + * Initialize this filter. + * Validate configuration parameters. + * + * @param array $config Configuration information about this filter. + * @param mixed $reserved For future use. + */ + public function __construct($config, $reserved) { + parent::__construct($config, $reserved); + + assert('is_array($config)'); + + foreach ($config as $attribute => $values) { + if (is_string($values)) + $values = array($values); + if (!is_array($values)) + throw new Exception('Filter Authorize: Attribute values is neither string nor array: ' . var_export($attribute, TRUE)); + foreach ($values as $value){ + if(!is_string($value)) { + throw new Exception('Filter Authorize: Each value should be a string for attribute: ' . var_export($attribute, TRUE) . ' value: ' . var_export($value, TRUE) . ' Config is: ' . var_export($config, TRUE)); + } + } + $this->valid_attribute_values[$attribute] = $values; + } + } + + + /** + * Apply filter to validate attributes. + * + * @param array &$request The current request + */ + public function process(&$request) { + $authorize = FALSE; + assert('is_array($request)'); + assert('array_key_exists("Attributes", $request)'); + + $attributes =& $request['Attributes']; + + foreach ($this->valid_attribute_values as $name => $patterns) { + if(array_key_exists($name, $attributes)) { + foreach ($patterns as $pattern){ + $values = $attributes[$name]; + if (!is_array($values)) + $values = array($values); + foreach ($values as $value){ + if(preg_match($pattern, $value)) { + $authorize = TRUE; + break 3; + } + } + } + } + } + if (!$authorize){ + /* Save state and redirect to 403 page. */ + $id = SimpleSAML_Auth_State::saveState($request, + 'authorize:Authorize'); + $url = SimpleSAML_Module::getModuleURL( + 'authorize/authorize_403.php'); + SimpleSAML_Utilities::redirect($url, array('StateId' => $id)); + } + } +} + +?> ======================================= --- /dev/null +++ /trunk/modules/authorize/templates/authorize_403.php Mon Oct 5 04:03:33 2009 @@ -0,0 +1,23 @@ +<?php +/** + * Template which is shown when there is only a short interval since the user was last authenticated. + * + * Parameters: + * - 'target': Target URL. + * - 'params': Parameters which should be included in the request. + * + * @package simpleSAMLphp + * @version $Id$ + */ + + +$this->data['403_header'] = $this->t('{authorize:Authorize:403_header}'); +$this->data['403_text'] = $this->t('{authorize:Authorize:403_text}'); + +$this->includeAtTemplateBase('includes/header.php'); +?> +<h1><?php echo $this->data['403_header']; ?></h1> +<p><?php echo $this->data['403_text']; ?></p> +<?php +$this->includeAtTemplateBase('includes/footer.php'); +?> ======================================= --- /dev/null +++ /trunk/modules/authorize/www/authorize_403.php Mon Oct 5 04:03:33 2009 @@ -0,0 +1,22 @@ +<?php +/** + * Show a 403 Forbidden page about not authorized to access an application. + * + * @package simpleSAMLphp + * @version $Id$ + */ + +if (!array_key_exists('StateId', $_REQUEST)) { + throw new SimpleSAML_Error_BadRequest('Missing required StateId query parameter.'); +} + +$id = $_REQUEST['StateId']; +$state = SimpleSAML_Auth_State::loadState($id, 'authorize:Authorize'); + +$globalConfig = SimpleSAML_Configuration::getInstance(); +$t = new SimpleSAML_XHTML_Template($globalConfig, 'authorize:authorize_403.php'); +header('HTTP/1.0 403 Forbidden'); +$t->show(); + + +?> --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "simpleSAMLphp commits" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/simplesamlphp-commits?hl=en -~----------~----~----~----~------~----~------~--~---
