diff --git a/composer.json b/composer.json index 459e289..742090e 100644 --- a/composer.json +++ b/composer.json @@ -39,7 +39,8 @@ } }, "branch-alias": { - "dev-master": "2.0.x-dev", + "dev-master": "2.1.x-dev", + "dev-2.0.x": "2.0.x-dev", "dev-1.0.x": "1.0.x-dev" } } diff --git a/saml/install/config.ini b/saml/install/config.ini index e0fa216..8205b92 100644 --- a/saml/install/config.ini +++ b/saml/install/config.ini @@ -3,6 +3,7 @@ [saml] automaticAccountCreation = on allowSAMLAccountToUseLocalPassword = on +useOnlyNameIDAssertionToAuthenticate = off [saml:sp] diff --git a/saml/lib/Configuration.php b/saml/lib/Configuration.php index cbad1c1..ef8b0e7 100644 --- a/saml/lib/Configuration.php +++ b/saml/lib/Configuration.php @@ -39,6 +39,12 @@ class Configuration { */ protected $allowSAMLAccountToUseLocalPassword = true; + /** + * @var bool says if the user should be created/authenticated using only the loginAttribute property. + * attributesMapping (Login and E-Mail) will be both overwritten by the loginAttribute value + */ + protected $useOnlyNameIDAssertionToAuthenticate = false; + /** * @var array list of dao properties that can be used for mapping */ @@ -49,6 +55,12 @@ class Configuration { protected $idpLabel = ''; + /** + * @var string placeholder used to fill login field and mandatory attributes fields if the + * useOnlyNameIDAssertionToAuthenticate property is set to true + */ + protected $nameIdPlaceholder = 'NameID'; + /** * Configuration constructor. * @@ -76,6 +88,10 @@ public function __construct($checkConfig = true, $iniConfig = null) $this->allowSAMLAccountToUseLocalPassword = $iniConfig->saml['allowSAMLAccountToUseLocalPassword']; } + if (isset($iniConfig->saml['useOnlyNameIDAssertionToAuthenticate'])) { + $this->useOnlyNameIDAssertionToAuthenticate = $iniConfig->saml['useOnlyNameIDAssertionToAuthenticate']; + } + $this->fixConfigValues($iniConfig); $spConfig = $iniConfig->{'saml:sp'}; @@ -443,6 +459,15 @@ function getOrganization() return $org; } + /** + * get the nameIdPlaceholder value + * @return string + */ + function getNameIdPlaceholder() + { + return $this->nameIdPlaceholder; + } + /** * indicates if accounts should be created after authentication if they * don't exist. @@ -462,6 +487,15 @@ function isAllowingSAMLAccountToUseLocalPassword() return $this->allowSAMLAccountToUseLocalPassword; } + /** + * says if the user should be created/authenticated using only the loginAttribute property. + * attributesMapping (Login and E-Mail) will be both overwritten by the loginAttribute value + * @return bool + */ + function mustUseOnlyNameIDAssertionToAuthenticate() + { + return $this->useOnlyNameIDAssertionToAuthenticate; + } function getIdpURL() { diff --git a/saml/lib/ConfigurationModifier.php b/saml/lib/ConfigurationModifier.php index fbc1ffb..ae46f0f 100644 --- a/saml/lib/ConfigurationModifier.php +++ b/saml/lib/ConfigurationModifier.php @@ -23,6 +23,14 @@ public function __construct($iniConfig = null) parent::__construct(false, $iniConfig); } + /** + * @param bool $onlyNameID + */ + public function setUseOnlyNameIDAssertionToAuthenticate($onlyNameID) + { + $this->useOnlyNameIDAssertionToAuthenticate = !!$onlyNameID; + } + /** * @param bool $automatic */ @@ -199,6 +207,9 @@ public function save() $liveConfig->setValues($mapping, 'saml:attributes-mapping'); $appConfig->{'saml:attributes-mapping'} = $mapping; + $liveConfig->setValue('useOnlyNameIDAssertionToAuthenticate', $this->useOnlyNameIDAssertionToAuthenticate, 'saml'); + $appConfig->saml['useOnlyNameIDAssertionToAuthenticate'] = $this->useOnlyNameIDAssertionToAuthenticate; + $liveConfig->setValue('automaticAccountCreation', $this->automaticAccountCreation, 'saml'); $appConfig->saml['automaticAccountCreation'] = $this->automaticAccountCreation; diff --git a/saml/lib/Saml.php b/saml/lib/Saml.php index fd47801..f6b26b1 100644 --- a/saml/lib/Saml.php +++ b/saml/lib/Saml.php @@ -101,6 +101,13 @@ function processLoginResponse($request) $loginAttr = $this->config->getSAMLAttributeForLogin(); $attributes = $auth->getAttributes(); + + if($this->config->mustUseOnlyNameIDAssertionToAuthenticate()){ + $attributes = array(); + $loginAttr = $this->config->getNameIdPlaceholder(); + $attributes[$loginAttr] = array($auth->getNameId()); + } + if (empty($attributes)) { throw new LoginException( \jLocale::get('saml~auth.authentication.error.saml.attributes.missing', array($loginAttr)), diff --git a/samladmin/controllers/attrmapping.classic.php b/samladmin/controllers/attrmapping.classic.php index 8027a41..901a9e8 100644 --- a/samladmin/controllers/attrmapping.classic.php +++ b/samladmin/controllers/attrmapping.classic.php @@ -58,7 +58,10 @@ public function initform() $form = jForms::create('attrmapping'); $this->setupForm($form, $config); + // nameIdPlaceholder + $form->setData('nameIdPlaceholder', $config->getNameIdPlaceholder()); $form->setData('login', $config->getSAMLAttributeForLogin()); + $form->setData('useOnlyNameIDAssertionToAuthenticate', $config->mustUseOnlyNameIDAssertionToAuthenticate()); $form->setData('automaticAccountCreation', $config->isAutomaticAccountCreation()); $form->setData('allowSAMLAccountToUseLocalPassword', $config->isAllowingSAMLAccountToUseLocalPassword()); $rep = $this->getResponse('redirect'); @@ -81,7 +84,7 @@ public function edit() $tpl = new jTpl(); $tpl->assign('attrform', $form); - //$rep->addJSLink(jUrl::get('samladmin~config:asset', array('file'=>'sp.js'))); + $rep->addJSLink(jUrl::get('samladmin~config:asset', array('file'=>'attr.js'))); $rep->body->assign('MAIN', $tpl->fetch('attrmapping')); $rep->body->assign('selectedMenuItem', 'samlconfig'); return $rep; @@ -102,6 +105,17 @@ function save() $listOfField = $this->setupForm($form, $config); $form->initFromRequest(); + $daoProperties = $config->getAuthorizedDaoPropertiesForMapping(); + + if($this->request->getParam("useOnlyNameIDAssertionToAuthenticate")){ + $form->setData('login',$config->getNameIdPlaceholder()); + foreach ($form->getControls() as $name => $mctrl) { + if($mctrl->required && substr($name,0,5) == 'attr_'){ + $form->setData($name,$config->getNameIdPlaceholder()); + } + } + } + if (!$form->check()) { $rep->action = 'samladmin~attrmapping:edit'; return $rep; @@ -109,11 +123,10 @@ function save() $config = new \Jelix\Saml\ConfigurationModifier(); $config->setSAMLAttributeForLogin($form->getData('login')); + $config->setUseOnlyNameIDAssertionToAuthenticate($form->getData('useOnlyNameIDAssertionToAuthenticate')); $config->setAutomaticAccountCreation($form->getData('automaticAccountCreation')); $config->setAllowSAMLAccountToUseLocalPassword($form->getData('allowSAMLAccountToUseLocalPassword')); - $daoProperties = $config->getAuthorizedDaoPropertiesForMapping(); - /** @var jFormsControlGroup $groupCtrl */ $mapping = array(); foreach($listOfField as $ctrlRef) { diff --git a/samladmin/forms/attrmapping.form.xml b/samladmin/forms/attrmapping.form.xml index da253e7..8d85eae 100644 --- a/samladmin/forms/attrmapping.form.xml +++ b/samladmin/forms/attrmapping.form.xml @@ -1,6 +1,8 @@
+ +