-
Notifications
You must be signed in to change notification settings - Fork 704
Expand file tree
/
Copy pathMetadata.php
More file actions
280 lines (252 loc) · 10.2 KB
/
Copy pathMetadata.php
File metadata and controls
280 lines (252 loc) · 10.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
<?php
declare(strict_types=1);
namespace SimpleSAML\Utils\Config;
use SAML2\Constants;
use SAML2\XML\md\ContactPerson;
use SimpleSAML\Configuration;
/**
* Class with utilities to fetch different configuration objects from metadata configuration arrays.
*
* @package SimpleSAMLphp
*/
class Metadata
{
/**
* The string that identities Entity Categories.
*
* @var string
*/
public static string $ENTITY_CATEGORY = 'http://macedir.org/entity-category';
/**
* The string the identifies the REFEDS "Hide From Discovery" Entity Category.
*
* @var string
*/
public static string $HIDE_FROM_DISCOVERY = 'http://refeds.org/category/hide-from-discovery';
/**
* Valid options for the ContactPerson element
*
* The 'attributes' option isn't defined in section 2.3.2.2 of the OASIS document, but
* it is required to allow additons to the main contact person element for trust
* frameworks.
*
* @var string[] The valid configuration options for a contact configuration array.
* @see "Metadata for the OASIS Security Assertion Markup Language (SAML) V2.0", section 2.3.2.2.
*/
public static array $VALID_CONTACT_OPTIONS = [
'contactType',
'emailAddress',
'givenName',
'surName',
'telephoneNumber',
'company',
'attributes',
];
/**
* Parse and sanitize a contact from an array.
*
* Accepts an array with the following elements:
* - contactType The type of the contact (as string). Mandatory.
* - emailAddress Email address (as string), or array of email addresses. Optional.
* - telephoneNumber Telephone number of contact (as string), or array of telephone numbers. Optional.
* - surName Surname of contact (as string). Optional.
* - givenName Given name of contact (as string). Optional.
* - company Company name of contact (as string). Optional.
*
* The following values are allowed as "contactType":
* - technical
* - support
* - administrative
* - billing
* - other
*
* otherwise it will just return the name as "givenName" in the resulting array.
*
* @param array|null $contact The contact to parse and sanitize.
*
* @return array An array holding valid contact configuration options.
* @throws \InvalidArgumentException If $contact is neither an array nor null, or the contact does not conform to
* valid configuration rules for contacts.
*/
public static function getContact(?array $contact): array
{
// check the type
if (!isset($contact['contactType']) || !in_array($contact['contactType'], ContactPerson::CONTACT_TYPES, true)) {
$types = join(', ', array_map(
/**
* @param string $t
* @return string
*/
function ($t) {
return '"' . $t . '"';
},
ContactPerson::CONTACT_TYPES,
));
throw new \InvalidArgumentException('"contactType" is mandatory and must be one of ' . $types . ".");
}
// check attributes is an associative array
if (isset($contact['attributes'])) {
if (
empty($contact['attributes'])
|| !is_array($contact['attributes'])
|| count(array_filter(array_keys($contact['attributes']), 'is_string')) === 0
) {
throw new \InvalidArgumentException('"attributes" must be an array and cannot be empty.');
}
}
// check givenName
if (
isset($contact['givenName'])
&& (empty($contact['givenName']) || !is_string($contact['givenName']))
) {
throw new \InvalidArgumentException('"givenName" must be a string and cannot be empty.');
}
// check surName
if (
isset($contact['surName'])
&& (empty($contact['surName']) || !is_string($contact['surName']))
) {
throw new \InvalidArgumentException('"surName" must be a string and cannot be empty.');
}
// check company
if (
isset($contact['company'])
&& (empty($contact['company']) || !is_string($contact['company']))
) {
throw new \InvalidArgumentException('"company" must be a string and cannot be empty.');
}
// check emailAddress
if (isset($contact['emailAddress'])) {
if (
empty($contact['emailAddress'])
|| !(is_string($contact['emailAddress']) || is_array($contact['emailAddress']))
) {
throw new \InvalidArgumentException('"emailAddress" must be a string or an array and cannot be empty.');
}
if (is_array($contact['emailAddress'])) {
foreach ($contact['emailAddress'] as $address) {
if (!is_string($address) || empty($address)) {
throw new \InvalidArgumentException('Email addresses must be a string and cannot be empty.');
}
}
}
}
// check telephoneNumber
if (isset($contact['telephoneNumber'])) {
if (
empty($contact['telephoneNumber'])
|| !(is_string($contact['telephoneNumber']) || is_array($contact['telephoneNumber']))
) {
throw new \InvalidArgumentException(
'"telephoneNumber" must be a string or an array and cannot be empty.',
);
}
if (is_array($contact['telephoneNumber'])) {
foreach ($contact['telephoneNumber'] as $address) {
if (!is_string($address) || empty($address)) {
throw new \InvalidArgumentException('Telephone numbers must be a string and cannot be empty.');
}
}
}
}
// make sure only valid options are outputted
return array_intersect_key($contact, array_flip(self::$VALID_CONTACT_OPTIONS));
}
/**
* Find the default endpoint in an endpoint array.
*
* @param array $endpoints An array with endpoints.
* @param array|null $bindings An array with acceptable bindings. Can be null if any binding is allowed.
*
* @return array|null The default endpoint, or null if no acceptable endpoints are used.
*
*/
public static function getDefaultEndpoint(array $endpoints, ?array $bindings = null): ?array
{
$firstNotFalse = null;
$firstAllowed = null;
// look through the endpoint list for acceptable endpoints
foreach ($endpoints as $ep) {
if ($bindings !== null && !in_array($ep['Binding'], $bindings, true)) {
// unsupported binding, skip it
continue;
}
if (isset($ep['isDefault'])) {
if ($ep['isDefault'] === true) {
// this is the first endpoint with isDefault set to true
return $ep;
}
// isDefault is set to false, but the endpoint is still usable as a last resort
if ($firstAllowed === null) {
// this is the first endpoint that we can use
$firstAllowed = $ep;
}
} else {
if ($firstNotFalse === null) {
// this is the first endpoint without isDefault set
$firstNotFalse = $ep;
}
}
}
if ($firstNotFalse !== null) {
// we have an endpoint without isDefault set to false
return $firstNotFalse;
}
/* $firstAllowed either contains the first endpoint we can use, or it contains null if we cannot use any of the
* endpoints. Either way we return its value.
*/
return $firstAllowed;
}
/**
* Determine if an entity should be hidden in the discovery service.
*
* This method searches for the "Hide From Discovery" REFEDS Entity Category, and tells if the entity should be
* hidden or not depending on it.
*
* @see https://refeds.org/category/hide-from-discovery
*
* @param array $metadata An associative array with the metadata representing an entity.
*
* @return boolean True if the entity should be hidden, false otherwise.
*/
public static function isHiddenFromDiscovery(array $metadata): bool
{
if (!isset($metadata['EntityAttributes'][self::$ENTITY_CATEGORY])) {
return false;
}
return in_array(self::$HIDE_FROM_DISCOVERY, $metadata['EntityAttributes'][self::$ENTITY_CATEGORY], true);
}
/**
* This method parses the different possible values of the NameIDPolicy metadata configuration.
*/
public static function parseNameIdPolicy(?array $nameIdPolicy = null): array
{
if ($nameIdPolicy === null) {
// when NameIDPolicy is unset or set to null, default to transient
return ['Format' => Constants::NAMEID_TRANSIENT, 'AllowCreate' => false];
}
if ($nameIdPolicy === []) {
// empty array means not to send any NameIDPolicy element
return [];
}
// handle configurations specifying an array in the NameIDPolicy config option
$nameIdPolicy_cf = Configuration::loadFromArray($nameIdPolicy);
$format = $nameIdPolicy_cf->getOptionalString('Format', Constants::NAMEID_TRANSIENT);
$allowCreate = $nameIdPolicy_cf->getOptionalBoolean('AllowCreate', true);
// SAML Version 2.0 Errata 05 lines 252-255 (pg 12)
if ($format === Constants::NAMEID_TRANSIENT) {
if ($allowCreate) {
$allowCreate = false;
}
}
$policy = [
'Format' => $format,
'AllowCreate' => $allowCreate,
];
$spNameQualifier = $nameIdPolicy_cf->getOptionalString('SPNameQualifier', null);
if ($spNameQualifier !== null) {
$policy['SPNameQualifier'] = $spNameQualifier;
}
return $policy;
}
}