Skip to content

Commit 9347353

Browse files
MKoddeMKodde
committed
Determine authorizations based on RA listing
The institution configuration FGA auth rules are evaluated to specify which institutions the RA(A) is active at. But these rules were not matched against the actual rules accredited to the RA(A). This made it possible that a RA would be granted RAA rights even tho it had only RA rights for his/her institution(s) By evaluating the RA listing authorizations alongside the insittutional authz, we now have a realistic vision of the roles of the RA(A)
1 parent 34e089b commit 9347353

File tree

5 files changed

+90
-14
lines changed

5 files changed

+90
-14
lines changed

‎src/Surfnet/StepupMiddleware/ApiBundle/Controller/ProfileController.php

+9-1
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,14 @@
1818

1919
namespace Surfnet\StepupMiddleware\ApiBundle\Controller;
2020

21+
use Psr\Log\LoggerInterface;
2122
use Surfnet\StepupMiddleware\ApiBundle\Identity\Service\ProfileService;
2223
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
2324
use Symfony\Component\HttpFoundation\JsonResponse;
2425
use Symfony\Component\HttpFoundation\Request;
2526
use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
2627
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
28+
use function sprintf;
2729

2830
class ProfileController extends Controller
2931
{
@@ -32,10 +34,15 @@ class ProfileController extends Controller
3234
*/
3335
private $profileService;
3436

37+
/** @var LoggerInterface */
38+
private $logger;
39+
3540
public function __construct(
36-
ProfileService $profileService
41+
ProfileService $profileService,
42+
LoggerInterface $logger
3743
) {
3844
$this->profileService = $profileService;
45+
$this->logger = $logger;
3946
}
4047

4148
public function getAction(Request $request, $identityId)
@@ -47,6 +54,7 @@ public function getAction(Request $request, $identityId)
4754
if ($identityId !== $actorId) {
4855
throw new AccessDeniedHttpException("Identity and actor id should match. It is not yet allowed to view the profile of somebody else.");
4956
}
57+
$this->logger->notice(sprintf('Retrieving profile (autzh) information for IdentityId "%s"', $identityId));
5058

5159
$profile = $this->profileService->createProfile($identityId);
5260
if (!$profile) {

‎src/Surfnet/StepupMiddleware/ApiBundle/Identity/Service/IdentityService.php

+12-2
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
namespace Surfnet\StepupMiddleware\ApiBundle\Identity\Service;
2020

21+
use Psr\Log\LoggerInterface;
2122
use Surfnet\Stepup\Identity\Value\IdentityId;
2223
use Surfnet\Stepup\Identity\Value\Institution;
2324
use Surfnet\Stepup\Identity\Value\NameId;
@@ -57,16 +58,23 @@ class IdentityService extends AbstractSearchService
5758
*/
5859
private $sraaRepository;
5960

61+
/**
62+
* @var LoggerInterface
63+
*/
64+
private $logger;
65+
6066
public function __construct(
6167
IdentityRepository $repository,
6268
IdentitySelfAssertedTokenOptionsRepository $identitySelfAssertedTokenOptionsRepository,
6369
RaListingRepository $raListingRepository,
64-
SraaRepository $sraaRepository
70+
SraaRepository $sraaRepository,
71+
LoggerInterface $logger
6572
) {
6673
$this->repository = $repository;
6774
$this->identitySelfAssertedTokensOptionsRepository = $identitySelfAssertedTokenOptionsRepository;
6875
$this->raListingRepository = $raListingRepository;
6976
$this->sraaRepository = $sraaRepository;
77+
$this->logger = $logger;
7078
}
7179

7280
/**
@@ -147,11 +155,13 @@ public function findRegistrationAuthorityCredentialsByNameIdAndInstitution(NameI
147155
*/
148156
private function findRegistrationAuthorityCredentialsByIdentity(Identity $identity)
149157
{
158+
$this->logger->notice(sprintf('Getting profile for IdentityId "%s" NameId "%s"', $identity->id, $identity->nameId ));
150159
$raListing = $this->raListingRepository->findByIdentityId(new IdentityId($identity->id));
151160
$sraa = $this->sraaRepository->findByNameId($identity->nameId);
152161

153162
if (!empty($raListing)) {
154-
$credentials = RegistrationAuthorityCredentials::fromRaListings($raListing);
163+
$this->logger->notice(sprintf('RA listing(s) found for IdentityId "%s"', $identity->id));
164+
$credentials = RegistrationAuthorityCredentials::fromRaListings($raListing, $this->logger);
155165

156166
if ($sraa) {
157167
$credentials = $credentials->grantSraa();

‎src/Surfnet/StepupMiddleware/ApiBundle/Identity/Service/ProfileService.php

+64-10
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,16 @@
1818

1919
namespace Surfnet\StepupMiddleware\ApiBundle\Identity\Service;
2020

21+
use Psr\Log\LoggerInterface;
2122
use Surfnet\Stepup\Configuration\Value\InstitutionRole;
2223
use Surfnet\Stepup\Identity\Value\IdentityId;
2324
use Surfnet\StepupMiddleware\ApiBundle\Authorization\Service\AuthorizationContextService;
24-
use Surfnet\StepupMiddleware\ApiBundle\Identity\Repository\InstitutionListingRepository;
25+
use Surfnet\StepupMiddleware\ApiBundle\Identity\Entity\RaListing;
2526
use Surfnet\StepupMiddleware\ApiBundle\Identity\Repository\RaListingRepository;
27+
use Surfnet\StepupMiddleware\ApiBundle\Identity\Value\AuthorityRole;
2628
use Surfnet\StepupMiddleware\ApiBundle\Identity\Value\AuthorizedInstitutionCollection;
2729
use Surfnet\StepupMiddleware\ApiBundle\Identity\Value\Profile;
30+
use function sprintf;
2831

2932
class ProfileService extends AbstractSearchService
3033
{
@@ -43,14 +46,21 @@ class ProfileService extends AbstractSearchService
4346
*/
4447
private $authorizationService;
4548

49+
/**
50+
* @var LoggerInterface
51+
*/
52+
private $logger;
53+
4654
public function __construct(
4755
RaListingRepository $raListingRepository,
4856
IdentityService $identityService,
49-
AuthorizationContextService $institutionAuthorizationService
57+
AuthorizationContextService $institutionAuthorizationService,
58+
LoggerInterface $logger
5059
) {
5160
$this->raListingRepository = $raListingRepository;
5261
$this->identityService = $identityService;
5362
$this->authorizationService = $institutionAuthorizationService;
63+
$this->logger = $logger;
5464
}
5565

5666
/**
@@ -72,29 +82,73 @@ public function __construct(
7282
public function createProfile($identityId)
7383
{
7484
$identity = $this->identityService->find($identityId);
85+
7586
if ($identity === null) {
87+
$this->logger->notice(sprintf('No Identity found with IdentityId %s', $identityId));
7688
return null;
7789
}
90+
$this->logger->notice(sprintf('Found IdentityId "%s" NameId "%s"', $identityId, $identity->nameId ));
7891

79-
$authorizationContextRa = $this->authorizationService->buildInstitutionAuthorizationContext(
80-
new IdentityId($identityId),
81-
InstitutionRole::useRa()
92+
$raListing = $this->raListingRepository->findByIdentityId(new IdentityId($identityId));
93+
$isRa = $this->getRoleFromListing($raListing, AuthorityRole::ROLE_RA);
94+
$isRaa = $this->getRoleFromListing($raListing, AuthorityRole::ROLE_RAA);
95+
96+
$this->logger->notice(
97+
sprintf(
98+
'Based on RaListing Identity %s has roles(RA: %s, RAA: %s)',
99+
$identityId,
100+
$isRa ? "YES" : "NO",
101+
$isRaa ? "YES" : "NO"
102+
)
82103
);
83104

84-
$authorizationContextRaa = $this->authorizationService->buildInstitutionAuthorizationContext(
105+
106+
if ($raListing === null) {
107+
$this->logger->notice(sprintf('No RA listing found for IdentityId %s', $identityId));
108+
return null;
109+
}
110+
111+
$authorizationContextRa = $this->authorizationService->buildInstitutionAuthorizationContext(
85112
new IdentityId($identityId),
86-
InstitutionRole::useRaa()
113+
InstitutionRole::useRa()
87114
);
88-
89115
$authorizations = AuthorizedInstitutionCollection::from(
90-
$authorizationContextRa->getInstitutions(),
91-
$authorizationContextRaa->getInstitutions()
116+
$authorizationContextRa->getInstitutions()
92117
);
93118

119+
$this->logger->notice(sprintf('IdentityId "%s" is RA for: %s', $identityId, json_encode($authorizationContextRa->getInstitutions()->jsonSerialize())));
120+
121+
if ($isRaa) {
122+
$authorizationContextRaa = $this->authorizationService->buildInstitutionAuthorizationContext(
123+
new IdentityId($identityId),
124+
InstitutionRole::useRaa()
125+
);
126+
127+
$this->logger->notice(sprintf('IdentityId "%s" is RAA for: %s', $identityId, json_encode($authorizationContextRaa->getInstitutions()->jsonSerialize())));
128+
129+
$authorizations = AuthorizedInstitutionCollection::from(
130+
$authorizationContextRa->getInstitutions(),
131+
$authorizationContextRaa->getInstitutions()
132+
);
133+
}
134+
94135
return new Profile(
95136
$identity,
96137
$authorizations,
97138
$authorizationContextRa->isActorSraa()
98139
);
99140
}
141+
142+
/**
143+
* @param array<int, RaListing> $raListing
144+
*/
145+
private function getRoleFromListing(array $raListing, string $role): bool
146+
{
147+
foreach ($raListing as $listing) {
148+
if ($listing->role->getRole() === $role) {
149+
return true;
150+
}
151+
}
152+
return false;
153+
}
100154
}

‎src/Surfnet/StepupMiddleware/ApiBundle/Identity/Value/RegistrationAuthorityCredentials.php

+4-1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
namespace Surfnet\StepupMiddleware\ApiBundle\Identity\Value;
2020

2121
use Assert\Assertion;
22+
use Psr\Log\LoggerInterface;
2223
use Surfnet\Stepup\Identity\Value\CommonName;
2324
use Surfnet\Stepup\Identity\Value\ContactInformation;
2425
use Surfnet\Stepup\Identity\Value\Institution;
@@ -106,18 +107,20 @@ public static function fromSraa(Sraa $sraa, Identity $identity)
106107
* @param RaListing[] $raListings
107108
* @return RegistrationAuthorityCredentials
108109
*/
109-
public static function fromRaListings(array $raListings)
110+
public static function fromRaListings(array $raListings, LoggerInterface $logger)
110111
{
111112
$raListingCredentials = current($raListings);
112113
$isRa = false;
113114
$isRaa = false;
114115

115116
foreach ($raListings as $raListing) {
116117
if ($raListing->role->equals(AuthorityRole::ra())) {
118+
$logger->info(sprintf('Identity "%s" is RA, for institution "%s"', $raListing->identityId, $raListing->institution->getInstitution()));
117119
$isRa = true;
118120
}
119121

120122
if ($raListing->role->equals(AuthorityRole::raa())) {
123+
$logger->info(sprintf('Identity "%s" is RAA, for institution "%s"', $raListing->identityId, $raListing->institution->getInstitution()));
121124
$isRaa = true;
122125
}
123126
}

‎src/Surfnet/StepupMiddleware/ApiBundle/Resources/config/services.yml

+1
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,7 @@ services:
9898
- "@surfnet_stepup_middleware_api.repository.identity_self_asserted_token_options"
9999
- "@surfnet_stepup_middleware_api.repository.ra_listing"
100100
- "@surfnet_stepup_middleware_api.repository.sraa"
101+
- "@logger"
101102

102103
surfnet_stepup_middleware_api.service.ra_listing:
103104
class: Surfnet\StepupMiddleware\ApiBundle\Identity\Service\RaListingService

0 commit comments

Comments
 (0)