sspmod_consent_Auth_Process_Consent::process PHP Method

process() public method

This function saves the state, and redirects the user to the page where the user can authorize the release of the attributes. If storage is used and the consent has already been given the user is passed on.
public process ( &$state ) : void
return void
    public function process(&$state)
    {
        assert('is_array($state)');
        assert('array_key_exists("UserID", $state)');
        assert('array_key_exists("Destination", $state)');
        assert('array_key_exists("entityid", $state["Destination"])');
        assert('array_key_exists("metadata-set", $state["Destination"])');
        assert('array_key_exists("entityid", $state["Source"])');
        assert('array_key_exists("metadata-set", $state["Source"])');
        $spEntityId = $state['Destination']['entityid'];
        $idpEntityId = $state['Source']['entityid'];
        $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
        /**
         * If the consent module is active on a bridge $state['saml:sp:IdP']
         * will contain an entry id for the remote IdP. If not, then the
         * consent module is active on a local IdP and nothing needs to be
         * done.
         */
        if (isset($state['saml:sp:IdP'])) {
            $idpEntityId = $state['saml:sp:IdP'];
            $idpmeta = $metadata->getMetaData($idpEntityId, 'saml20-idp-remote');
            $state['Source'] = $idpmeta;
        }
        $statsData = array('spEntityID' => $spEntityId);
        // Do not use consent if disabled
        if (isset($state['Source']['consent.disable']) && self::checkDisable($state['Source']['consent.disable'], $spEntityId)) {
            SimpleSAML\Logger::debug('Consent: Consent disabled for entity ' . $spEntityId . ' with IdP ' . $idpEntityId);
            SimpleSAML_Stats::log('consent:disabled', $statsData);
            return;
        }
        if (isset($state['Destination']['consent.disable']) && self::checkDisable($state['Destination']['consent.disable'], $idpEntityId)) {
            SimpleSAML\Logger::debug('Consent: Consent disabled for entity ' . $spEntityId . ' with IdP ' . $idpEntityId);
            SimpleSAML_Stats::log('consent:disabled', $statsData);
            return;
        }
        if ($this->_store !== null) {
            $source = $state['Source']['metadata-set'] . '|' . $idpEntityId;
            $destination = $state['Destination']['metadata-set'] . '|' . $spEntityId;
            $attributes = $state['Attributes'];
            // Remove attributes that do not require consent
            foreach ($attributes as $attrkey => $attrval) {
                if (in_array($attrkey, $this->_noconsentattributes)) {
                    unset($attributes[$attrkey]);
                }
            }
            SimpleSAML\Logger::debug('Consent: userid: ' . $state['UserID']);
            SimpleSAML\Logger::debug('Consent: source: ' . $source);
            SimpleSAML\Logger::debug('Consent: destination: ' . $destination);
            $userId = self::getHashedUserID($state['UserID'], $source);
            $targetedId = self::getTargetedID($state['UserID'], $source, $destination);
            $attributeSet = self::getAttributeHash($attributes, $this->_includeValues);
            SimpleSAML\Logger::debug('Consent: hasConsent() [' . $userId . '|' . $targetedId . '|' . $attributeSet . ']');
            try {
                if ($this->_store->hasConsent($userId, $targetedId, $attributeSet)) {
                    // Consent already given
                    SimpleSAML\Logger::stats('Consent: Consent found');
                    SimpleSAML_Stats::log('consent:found', $statsData);
                    return;
                }
                SimpleSAML\Logger::stats('Consent: Consent notfound');
                SimpleSAML_Stats::log('consent:notfound', $statsData);
                $state['consent:store'] = $this->_store;
                $state['consent:store.userId'] = $userId;
                $state['consent:store.destination'] = $targetedId;
                $state['consent:store.attributeSet'] = $attributeSet;
            } catch (Exception $e) {
                SimpleSAML\Logger::error('Consent: Error reading from storage: ' . $e->getMessage());
                SimpleSAML\Logger::stats('Consent: Failed');
                SimpleSAML_Stats::log('consent:failed', $statsData);
            }
        } else {
            SimpleSAML\Logger::stats('Consent: No storage');
            SimpleSAML_Stats::log('consent:nostorage', $statsData);
        }
        $state['consent:focus'] = $this->_focus;
        $state['consent:checked'] = $this->_checked;
        $state['consent:hiddenAttributes'] = $this->_hiddenAttributes;
        $state['consent:noconsentattributes'] = $this->_noconsentattributes;
        $state['consent:showNoConsentAboutService'] = $this->_showNoConsentAboutService;
        // user interaction necessary. Throw exception on isPassive request
        if (isset($state['isPassive']) && $state['isPassive'] === true) {
            SimpleSAML_Stats::log('consent:nopassive', $statsData);
            throw new SimpleSAML_Error_NoPassive('Unable to give consent on passive request.');
        }
        // Save state and redirect
        $id = SimpleSAML_Auth_State::saveState($state, 'consent:request');
        $url = SimpleSAML\Module::getModuleURL('consent/getconsent.php');
        \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('StateId' => $id));
    }

Usage Example

コード例 #1
0
 /**
  * Helper function to run the filter with a given configuration.
  *
  * @param array $config  The filter configuration.
  * @param array $request  The request state.
  * @return array  The state array after processing.
  */
 private function processFilter(array $config, array $request)
 {
     $filter = new \sspmod_consent_Auth_Process_Consent($config, null);
     $filter->process($request);
     return $request;
 }