PHP SimpleSAML_Utilities类代码示例

 /**
  * Construct
  *
  * @param array $authSourceconfig Configuration array for the selected authsource
  * @param array $writeConfig Configuration array for the selected catalogue backend
  * @param array $attributes The user attributes to be saved
  */
 public function __construct($authSourceConfig, $writeConfig, $attributes, $hashAlgo)
 {
     $asc = SimpleSAML_Configuration::loadFromArray($authSourceConfig);
     try {
         $this->dbh = new PDO($asc->getString('dsn'), $asc->getString('username'), $asc->getString('password'));
     } catch (PDOException $e) {
         throw new Exception($e->getMessage());
     }
     $driver = explode(':', $asc->getString('dsn'), 2);
     $driver = strtolower($driver[0]);
     /* Driver specific initialization. */
     switch ($driver) {
         case 'mysql':
             /* Use UTF-8. */
             $this->dbh->exec("SET NAMES utf8");
             $this->dbh->exec("SET CHARACTER SET utf8;");
             break;
         case 'pgsql':
             /* Use UTF-8. */
             $this->dbh->exec("SET NAMES 'UTF8'");
             break;
     }
     $this->dbh->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_WARNING);
     $this->attributes = $attributes;
     $this->hashAlgo = $hashAlgo;
     $this->salt = bin2hex(SimpleSAML_Utilities::generateRandomBytes(64, FALSE));
     $wc = SimpleSAML_Configuration::loadFromArray($writeConfig);
     $this->userIdAttr = $wc->getString('user.id.param');
 }

 public function __construct(Exception $original)
 {
     $msg = get_class($original) . ': ' . $original->getMessage();
     $code = $original->getCode();
     parent::__construct($msg, $code);
     $this->setBacktrace(SimpleSAML_Utilities::buildBacktrace($original));
 }

 /**
  * Apply filter to validate attributes.
  *
  * @param array &$request  The current request
  */
 public function process(&$request)
 {
     $authorize = FALSE;
     assert('is_array($request)');
     assert('array_key_exists("Attributes", $request)');
     $attributes =& $request['Attributes'];
     foreach ($this->valid_attribute_values as $name => $patterns) {
         if (array_key_exists($name, $attributes)) {
             foreach ($patterns as $pattern) {
                 $values = $attributes[$name];
                 if (!is_array($values)) {
                     $values = array($values);
                 }
                 foreach ($values as $value) {
                     if (preg_match($pattern, $value)) {
                         $authorize = TRUE;
                         break 3;
                     }
                 }
             }
         }
     }
     if (!$authorize) {
         /* Save state and redirect to 403 page. */
         $id = SimpleSAML_Auth_State::saveState($request, 'authorize:Authorize');
         $url = SimpleSAML_Module::getModuleURL('authorize/authorize_403.php');
         SimpleSAML_Utilities::redirect($url, array('StateId' => $id));
     }
 }

 function prepare()
 {
     if (!empty($_REQUEST['useridFrom']) && !empty($_REQUEST['useridTo'])) {
         $this->fdb->migrateAccount($_REQUEST['useridFrom'], $_REQUEST['useridTo']);
         SimpleSAML_Utilities::redirect('/accountmappingprepare');
     }
 }

    protected function _mailTechnicalContact($tag, sspmod_janus_Cron_Logger $logger)
    {
        $errorHtml = $this->_getHtmlForMessages($logger->getNamespacedErrors(), 'errors');
        $warningHtml = $this->_getHtmlForMessages($logger->getNamespacedWarnings(), 'warnings');
        $noticeHtml = $this->_getHtmlForMessages($logger->getNamespacedNotices(), 'notices');
        $config = SimpleSAML_Configuration::getInstance();
        $time = date(DATE_RFC822);
        $url = SimpleSAML_Utilities::selfURL();
        $message = <<<MESSAGE
<h1>Cron report</h1>
<p>Cron ran at {$time}</p>
<p>URL: <tt>{$url}</tt></p>
<p>Tag: {$tag}</p>
<h2>Errors</h2>
{$errorHtml}
<h2>Warnings</h2>
{$warningHtml}
<h2>Notices</h2>
{$noticeHtml}
MESSAGE;
        $toAddress = $config->getString('technicalcontact_email', 'na@example.org');
        if ($toAddress == 'na@example.org') {
            SimpleSAML_Logger::error('Cron - Could not send email. [technicalcontact_email] not set in config.');
        } else {
            $email = new SimpleSAML_XHTML_EMail($toAddress, 'JANUS cron report', 'no-reply@example.edu');
            $email->setBody($message);
            $email->send();
        }
    }

 protected function saveChanges()
 {
     $this->foodle->updateFromPostFixDate($this->user);
     #		echo '<pre>'; print_r($_REQUEST); print_r($this->foodle); exit;
     $this->foodle->acl($this->user, 'write');
     $this->foodle->save();
     // 		if (isset($this->user->email)) {
     // 			$this->sendMail();
     // 		}
     if (!empty($_REQUEST['send_fixdate_mail'])) {
         $responses = $this->foodle->getResponses();
         foreach ($responses as $response) {
             $user = null;
             if (!empty($response->user)) {
                 $user = $response->user;
             }
             if (empty($user)) {
                 $user = new Data_User($this->fdb);
                 $user->userid = $response->userid;
                 $user->email = $response->email;
                 $user->username = $response->username;
             }
             $this->sendFixDateMail($user, $this->foodle);
         }
     }
     $newurl = FoodleUtils::getUrl() . 'foodle/' . $this->foodle->identifier . '#distribute';
     SimpleSAML_Utilities::redirect($newurl);
     exit;
 }

 public function finalStep(&$state)
 {
     SimpleSAML_Logger::debug("oauth wrap:  Using this verification code [" . $state['authwindowslive:wrap_verification_code'] . "]");
     // Retrieve Access Token
     // Documentation at: http://msdn.microsoft.com/en-us/library/ff749686.aspx
     $postData = 'wrap_client_id=' . urlencode($this->key) . '&wrap_client_secret=' . urlencode($this->secret) . '&wrap_callback=' . urlencode(SimpleSAML_Module::getModuleUrl('authwindowslive') . '/linkback.php') . '&wrap_verification_code=' . urlencode($state['authwindowslive:wrap_verification_code']);
     $context = array('http' => array('method' => 'POST', 'header' => 'Content-type: application/x-www-form-urlencoded', 'content' => $postData));
     $result = SimpleSAML_Utilities::fetch('https://consent.live.com/AccessToken.aspx', $context);
     parse_str($result, $response);
     // error checking of $response to make sure we can proceed
     if (!array_key_exists('wrap_access_token', $response)) {
         throw new Exception('[' . $response['error_code'] . '] ' . $response['wrap_error_reason'] . "\r\nNo wrap_access_token returned - cannot proceed\r\n" . $response['internal_info']);
     }
     SimpleSAML_Logger::debug("Got an access token from the OAuth WRAP service provider [" . $response['wrap_access_token'] . "] for user [" . $response['uid'] . "]");
     // Documentation at: http://msdn.microsoft.com/en-us/library/ff751708.aspx
     $opts = array('http' => array('header' => "Accept: application/json\r\nAuthorization: WRAP access_token=" . $response['wrap_access_token'] . "\r\n"));
     $data = SimpleSAML_Utilities::fetch('https://apis.live.net/V4.1/cid-' . $response['uid'] . '/Profiles', $opts);
     $userdata = json_decode($data, TRUE);
     $attributes = array();
     $attributes['windowslive_uid'] = array($response['uid']);
     $attributes['windowslive_targetedID'] = array('http://windowslive.com!' . $response['uid']);
     $attributes['windowslive_user'] = array($response['uid'] . '@windowslive.com');
     if (array_key_exists('Entries', $userdata)) {
         foreach ($userdata['Entries'][0] as $key => $value) {
             if (is_string($value)) {
                 $attributes['windowslive.' . $key] = array((string) $value);
             }
         }
         if (array_key_exists('Emails', $userdata['Entries'][0])) {
             $attributes['windowslive_mail'] = array($userdata['Entries'][0]['Emails'][0]['Address']);
         }
     }
     SimpleSAML_Logger::debug('LiveID Returned Attributes: ' . implode(", ", array_keys($attributes)));
     $state['Attributes'] = $attributes;
 }

 /**
  * Start the logout operation.
  *
  * @param array &$state  The logout state.
  * @param string|NULL $assocId  The SP we are logging out from.
  */
 public function startLogout(array &$state, $assocId)
 {
     assert('is_string($assocId) || is_null($assocId)');
     $associations = $this->idp->getAssociations();
     if (count($associations) === 0) {
         $this->idp->finishLogout($state);
     }
     foreach ($associations as $id => &$association) {
         $idp = SimpleSAML_IdP::getByState($association);
         $association['core:Logout-IFrame:Name'] = $idp->getSPName($id);
         $association['core:Logout-IFrame:State'] = 'onhold';
     }
     $state['core:Logout-IFrame:Associations'] = $associations;
     if (!is_null($assocId)) {
         $spName = $this->idp->getSPName($assocId);
         if ($spName === NULL) {
             $spName = array('en' => $assocId);
         }
         $state['core:Logout-IFrame:From'] = $spName;
     } else {
         $state['core:Logout-IFrame:From'] = NULL;
     }
     $id = SimpleSAML_Auth_State::saveState($state, 'core:Logout-IFrame');
     $url = SimpleSAML_Module::getModuleURL('core/idp/logout-iframe.php', array('id' => $id));
     SimpleSAML_Utilities::redirect($url);
 }

 /**
  * Process a authentication response.
  *
  * This function checks how long it is since the last time the user was authenticated.
  * If it is to short a while since, we will show a warning to the user.
  *
  * @param array $state  The state of the response.
  */
 public function process(&$state)
 {
     assert('is_array($state)');
     if (!array_key_exists('PreviousSSOTimestamp', $state)) {
         /*
          * No timestamp from the previous SSO to this SP. This is the first
          * time during this session.
          */
         return;
     }
     $timeDelta = time() - $state['PreviousSSOTimestamp'];
     if ($timeDelta >= 10) {
         /* At least 10 seconds since last attempt. */
         return;
     }
     if (array_key_exists('Destination', $state) && array_key_exists('entityid', $state['Destination'])) {
         $entityId = $state['Destination']['entityid'];
     } else {
         $entityId = 'UNKNOWN';
     }
     SimpleSAML_Logger::warning('WarnShortSSOInterval: Only ' . $timeDelta . ' seconds since last SSO for this user from the SP ' . var_export($entityId, TRUE));
     /* Save state and redirect. */
     $id = SimpleSAML_Auth_State::saveState($state, 'core:short_sso_interval');
     $url = SimpleSAML_Module::getModuleURL('core/short_sso_interval.php');
     SimpleSAML_Utilities::redirectTrustedURL($url, array('StateId' => $id));
 }

 /**
  * When the process logic determines that the user is not
  * authorized for this service, then forward the user to
  * an 403 unauthorized page.
  *
  * Separated this code into its own method so that child
  * classes can override it and change the action. Forward
  * thinking in case a "chained" ACL is needed, more complex
  * permission logic.
  *
  * @param array $request
  */
 protected function unauthorized(&$request)
 {
     SimpleSAML_Logger::error('ExpectedAuthnContextClassRef: Invalid authentication context: ' . $this->AuthnContextClassRef . '. Accepted values are: ' . var_export($this->accepted, TRUE));
     $id = SimpleSAML_Auth_State::saveState($request, 'saml:ExpectedAuthnContextClassRef:unauthorized');
     $url = SimpleSAML_Module::getModuleURL('saml/sp/wrong_authncontextclassref.php');
     SimpleSAML_Utilities::redirectTrustedURL($url, array('StateId' => $id));
 }

 protected function __construct()
 {
     /* Call the parent constructor in case it should become
      * necessary in the future.
      */
     parent::__construct();
     /* Initialize the php session handling.
      *
      * If session_id() returns a blank string, then we need
      * to call session start. Otherwise the session is already
      * started, and we should avoid calling session_start().
      */
     if (session_id() === '') {
         $config = SimpleSAML_Configuration::getInstance();
         $cookiepath = $config->getBoolean('session.phpsession.limitedpath', FALSE) ? '/' . $config->getBaseURL() : '/';
         session_set_cookie_params(0, $cookiepath, NULL, SimpleSAML_Utilities::isHTTPS());
         $cookiename = $config->getString('session.phpsession.cookiename', NULL);
         if (!empty($cookiename)) {
             session_name($cookiename);
         }
         $savepath = $config->getString('session.phpsession.savepath', NULL);
         if (!empty($savepath)) {
             session_save_path($savepath);
         }
         if (!array_key_exists(session_name(), $_COOKIE)) {
             /* Session cookie unset - session id not set. Generate new (secure) session id. */
             session_id(SimpleSAML_Utilities::stringToHex(SimpleSAML_Utilities::generateRandomBytes(16)));
         }
         session_start();
     }
 }

 /**
  * Initialize an EntitiesDescriptor.
  *
  * @param DOMElement|NULL $xml  The XML element we should load.
  */
 public function __construct(DOMElement $xml = NULL)
 {
     parent::__construct($xml);
     if ($xml === NULL) {
         return;
     }
     if ($xml->hasAttribute('ID')) {
         $this->ID = $xml->getAttribute('ID');
     }
     if ($xml->hasAttribute('validUntil')) {
         $this->validUntil = SimpleSAML_Utilities::parseSAML2Time($xml->getAttribute('validUntil'));
     }
     if ($xml->hasAttribute('cacheDuration')) {
         $this->cacheDuration = $xml->getAttribute('cacheDuration');
     }
     if ($xml->hasAttribute('Name')) {
         $this->Name = $xml->getAttribute('Name');
     }
     $this->Extensions = SAML2_XML_md_Extensions::getList($xml);
     foreach (SAML2_Utils::xpQuery($xml, './saml_metadata:EntityDescriptor|./saml_metadata:EntitiesDescriptor') as $node) {
         if ($node->localName === 'EntityDescriptor') {
             $this->children[] = new SAML2_XML_md_EntityDescriptor($node);
         } else {
             $this->children[] = new SAML2_XML_md_EntitiesDescriptor($node);
         }
     }
 }

 /**
  * Get the NameID value.
  *
  * @return string|NULL  The NameID value.
  */
 protected function getValue(array &$state)
 {
     if (!isset($state['Destination']['entityid'])) {
         SimpleSAML_Logger::warning('No SP entity ID - not generating persistent NameID.');
         return NULL;
     }
     $spEntityId = $state['Destination']['entityid'];
     if (!isset($state['Source']['entityid'])) {
         SimpleSAML_Logger::warning('No IdP entity ID - not generating persistent NameID.');
         return NULL;
     }
     $idpEntityId = $state['Source']['entityid'];
     if (!isset($state['Attributes'][$this->attribute]) || count($state['Attributes'][$this->attribute]) === 0) {
         SimpleSAML_Logger::warning('Missing attribute ' . var_export($this->attribute, TRUE) . ' on user - not generating persistent NameID.');
         return NULL;
     }
     if (count($state['Attributes'][$this->attribute]) > 1) {
         SimpleSAML_Logger::warning('More than one value in attribute ' . var_export($this->attribute, TRUE) . ' on user - not generating persistent NameID.');
         return NULL;
     }
     $uid = array_values($state['Attributes'][$this->attribute]);
     /* Just in case the first index is no longer 0. */
     $uid = $uid[0];
     $secretSalt = SimpleSAML_Utilities::getSecretSalt();
     $uidData = 'uidhashbase' . $secretSalt;
     $uidData .= strlen($idpEntityId) . ':' . $idpEntityId;
     $uidData .= strlen($spEntityId) . ':' . $spEntityId;
     $uidData .= strlen($uid) . ':' . $uid;
     $uidData .= $secretSalt;
     return sha1($uidData);
 }

function handleResponse()
{
    try {
        $binding = SAML2_Binding::getCurrentBinding();
        $response = $binding->receive();
    } catch (Exception $e) {
        return;
    }
    SimpleSAML_Logger::debug('attributequery - received message.');
    if (!$response instanceof SAML2_Response) {
        throw new SimpleSAML_Error_Exception('Unexpected message received to attribute query example.');
    }
    $idpEntityId = $response->getIssuer();
    if ($idpEntityId === NULL) {
        throw new SimpleSAML_Error_Exception('Missing issuer in response.');
    }
    $idpMetadata = $GLOBALS['metadata']->getMetaDataConfig($idpEntityId, 'saml20-idp-remote');
    $spMetadata = $GLOBALS['metadata']->getMetaDataConfig($GLOBALS['spEntityId'], 'saml20-sp-hosted');
    $assertion = sspmod_saml_Message::processResponse($spMetadata, $idpMetadata, $response);
    if (count($assertion) > 1) {
        throw new SimpleSAML_Error_Exception('More than one assertion in received response.');
    }
    $assertion = $assertion[0];
    $dataId = $response->getRelayState();
    if ($dataId === NULL) {
        throw new SimpleSAML_Error_Exception('RelayState was lost during request.');
    }
    $data = $GLOBALS['session']->getData('attributequeryexample:data', $dataId);
    $data['attributes'] = $assertion->getAttributes();
    $GLOBALS['session']->setData('attributequeryexample:data', $dataId, $data, 3600);
    SimpleSAML_Utilities::redirect(SimpleSAML_Utilities::selfURLNoQuery(), array('dataId' => $dataId));
}

 /**
  * Constructor for this authentication source.
  *
  * @param array $info  Information about this authentication source.
  * @param array $config  Configuration.
  */
 public function __construct($info, $config)
 {
     assert('is_array($info)');
     assert('is_array($config)');
     /* Call the parent constructor first, as required by the interface. */
     parent::__construct($info, $config);
     $this->users = array();
     /* Validate and parse our configuration. */
     foreach ($config as $userpass => $attributes) {
         if (!is_string($userpass)) {
             throw new Exception('Invalid <username>:<passwordhash> for authentication source ' . $this->authId . ': ' . $userpass);
         }
         $userpass = explode(':', $userpass, 2);
         if (count($userpass) !== 2) {
             throw new Exception('Invalid <username>:<passwordhash> for authentication source ' . $this->authId . ': ' . $userpass[0]);
         }
         $username = $userpass[0];
         $passwordhash = $userpass[1];
         try {
             $attributes = SimpleSAML_Utilities::parseAttributes($attributes);
         } catch (Exception $e) {
             throw new Exception('Invalid attributes for user ' . $username . ' in authentication source ' . $this->authId . ': ' . $e->getMessage());
         }
         $this->users[$username . ':' . $passwordhash] = $attributes;
     }
 }