Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use configured attribute key for remote account uid #67

Open
wants to merge 2 commits into
base: 7.x-2.x
Choose a base branch
from
Open

use configured attribute key for remote account uid #67

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6888255
use configured attribute key for remote account uid
tbfisher Jan 14, 2019
9046139
delete empty sunet mapping, warn about possible mismatched user
tbfisher Jan 14, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions modules/stanford_simplesamlphp_auth/stanford_simplesamlphp_auth.inc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -621,8 +621,8 @@ function stanford_simplesamlphp_auth_get_email() {
return $attributes[variable_get('stanford_simplesamlphp_auth_mailattr', 'mail')][0];
}
// If no valid mail attribute, cheat, and look for the sunet.
elseif (isset($attributes['uid'])) {
return $attributes['uid'][0] . "@stanford.edu";
elseif (isset($attributes[variable_get('stanford_simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')])) {
return $attributes[variable_get('stanford_simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')][0] . "@stanford.edu";
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would create [email protected]@stanford.edu

}
else {
throw new Exception(t('Error in stanford_simplesamlphp_auth.module: No valid mail attribute set.'));
Expand Down
25 changes: 25 additions & 0 deletions stanford_ssp.install
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,3 +294,28 @@ function stanford_ssp_update_7207() {
// Preserve the old settings about reformatting but allow new ones to decide.
variable_set('stanford_ssp_format_entitlements', TRUE);
}

/**
* Remove sunetid mappings with empty sunet.
*/
function stanford_ssp_update_7208() {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for writing upgrade hooks!

$query = db_select('stanford_ssp_sunetid', 's')
->fields('s', ['uid'])
->condition('sunet', '');
/** @var \DatabaseStatementBase $result */
$result = $query->execute();
array_map(function ($r) {
$query = db_select('authmap', 'a')
->fields('a', ['authname']);
$query->condition('a.module', 'stanford_simplesamlphp_auth');
$query->condition('a.uid', $r->uid);
$sunet_id = $query->execute()->fetchCol();
if ($sunet_id) {
$sunet_id = reset($sunet_id);
drupal_set_message("Drupal user $r->uid may be mapped to the wrong SUNET account $sunet_id.", 'warning');
}
}, $result->fetchAll());
db_delete('stanford_ssp_sunetid')
->condition('sunet', '')
->execute();
}
10 changes: 6 additions & 4 deletions stanford_ssp.module
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -316,7 +316,7 @@ function stanford_ssp_saml_ext_user_alter(&$ext_user, array $attributes, $auth_f

// If still no user try sunet id.
if (!$ext_user) {
$sunet = $attributes["uid"];
$sunet = $attributes[variable_get('stanford_simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')];
if (is_array($sunet)) {
$sunet = array_pop($sunet);
}
Expand Down Expand Up @@ -377,17 +377,19 @@ function stanford_ssp_user_insert(&$edit, $account, $category) {
watchdog('stanford_ssp_user_insert', 'Could not load SAML information', array(), WATCHDOG_DEBUG);
}

$key = variable_get('stanford_simplesamlphp_auth_unique_id', 'eduPersonPrincipalName');

// Some SPs and users do not provide mail or email attributes. Use something
// else to try and validate that the created user is not the current user. The
// best thing we can try to use is the sunet id.
if (isset($attributes['uid'][0]) && ($attributes['uid'][0] !== str_replace("@stanford.edu", "", $account->init))) {
if (isset($attributes[$key][0]) && ($attributes[$key][0] !== str_replace("@stanford.edu", "", $account->init))) {
return FALSE;
}

// Act on the current user.
if (!empty($attributes)) {
$record = array(
'sunet' => array_pop($attributes['uid']),
'sunet' => array_pop($attributes[$key]),
'uid' => $account->uid,
);
drupal_write_record("stanford_ssp_sunetid", $record);
Expand Down Expand Up @@ -457,7 +459,7 @@ function stanford_ssp_stanford_simplesamlphp_auth_allow_login(array $attributes)
* True if sunet is in attributes;
*/
function stanford_ssp_simplesamlphp_auth_allow_login_validate_sunets(array $sunets, array $attributes) {
$sunetid = array_pop($attributes['uid']);
$sunetid = array_pop($attributes[variable_get('stanford_simplesamlphp_auth_unique_id', 'eduPersonPrincipalName')]);
return in_array($sunetid, $sunets);
}

Expand Down