|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
/** |
|
4
|
|
|
* Copyright 2017 SURFnet B.V. |
|
5
|
|
|
* |
|
6
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
|
7
|
|
|
* you may not use this file except in compliance with the License. |
|
8
|
|
|
* You may obtain a copy of the License at |
|
9
|
|
|
* |
|
10
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0 |
|
11
|
|
|
* |
|
12
|
|
|
* Unless required by applicable law or agreed to in writing, software |
|
13
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS, |
|
14
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|
15
|
|
|
* See the License for the specific language governing permissions and |
|
16
|
|
|
* limitations under the License. |
|
17
|
|
|
*/ |
|
18
|
|
|
|
|
19
|
|
|
namespace OpenConext\ProfileBundle\Service; |
|
20
|
|
|
|
|
21
|
|
|
use Exception; |
|
22
|
|
|
use OpenConext\Profile\Entity\AuthenticatedUser; |
|
23
|
|
|
use OpenConext\Profile\Repository\AttributeAggregationRepository; |
|
24
|
|
|
use OpenConext\Profile\Value\AttributeAggregation\AttributeAggregationAttribute; |
|
25
|
|
|
use OpenConext\Profile\Value\AttributeAggregation\AttributeAggregationAttributesList; |
|
26
|
|
|
use OpenConext\Profile\Value\AttributeAggregation\AttributeAggregationEnabledAttributes; |
|
27
|
|
|
use Psr\Log\LoggerInterface; |
|
28
|
|
|
use Surfnet\SamlBundle\SAML2\Attribute\AttributeDefinition; |
|
29
|
|
|
|
|
30
|
|
|
final class AttributeAggregationService |
|
31
|
|
|
{ |
|
32
|
|
|
/** |
|
33
|
|
|
* @var AttributeAggregationRepository |
|
34
|
|
|
*/ |
|
35
|
|
|
private $repository; |
|
36
|
|
|
|
|
37
|
|
|
/** |
|
38
|
|
|
* @var AttributeAggregationEnabledAttributes |
|
39
|
|
|
*/ |
|
40
|
|
|
private $attributeAggregationEnabledAttributes; |
|
41
|
|
|
|
|
42
|
|
|
/** |
|
43
|
|
|
* @var LoggerInterface |
|
44
|
|
|
*/ |
|
45
|
|
|
private $logger; |
|
46
|
|
|
|
|
47
|
|
|
public function __construct( |
|
48
|
|
|
AttributeAggregationRepository $repository, |
|
49
|
|
|
AttributeAggregationEnabledAttributes $attributeAggregationEnabledAttributes, |
|
50
|
|
|
LoggerInterface $logger |
|
51
|
|
|
) { |
|
52
|
|
|
$this->repository = $repository; |
|
53
|
|
|
$this->attributeAggregationEnabledAttributes = $attributeAggregationEnabledAttributes; |
|
54
|
|
|
$this->logger = $logger; |
|
55
|
|
|
} |
|
56
|
|
|
|
|
57
|
|
|
/** |
|
58
|
|
|
* @param AuthenticatedUser $user |
|
59
|
|
|
* @return null|AttributeAggregationAttributesList |
|
60
|
|
|
*/ |
|
61
|
|
|
public function findByUser(AuthenticatedUser $user) |
|
62
|
|
|
{ |
|
63
|
|
|
$enabledAttributes = $this->attributeAggregationEnabledAttributes; |
|
64
|
|
|
|
|
65
|
|
|
try { |
|
66
|
|
|
$collection = []; |
|
67
|
|
|
|
|
68
|
|
|
$attributeAggregationAttributes = $this->repository->findAllFor($user->getNameId()); |
|
69
|
|
|
|
|
70
|
|
|
foreach ($enabledAttributes->getAttributes() as $enabledAttribute) { |
|
71
|
|
|
$accountType = $enabledAttribute->getAccountType(); |
|
72
|
|
|
if ($attributeAggregationAttributes->hasAttribute($accountType)) { |
|
73
|
|
|
$aaAttribute = $attributeAggregationAttributes->getAttribute($accountType); |
|
74
|
|
|
$collection[] = AttributeAggregationAttribute::fromConfig( |
|
75
|
|
|
$enabledAttribute, |
|
76
|
|
|
true, |
|
77
|
|
|
$aaAttribute->getId(), |
|
78
|
|
|
$aaAttribute->getUserNameId(), |
|
79
|
|
|
$aaAttribute->getLinkedId() |
|
80
|
|
|
); |
|
81
|
|
|
} else { |
|
82
|
|
|
$collection[] = AttributeAggregationAttribute::fromConfig($enabledAttribute, false, -1, ''); |
|
83
|
|
|
} |
|
84
|
|
|
} |
|
85
|
|
|
|
|
86
|
|
|
return new AttributeAggregationAttributesList($collection); |
|
87
|
|
|
} catch (Exception $e) { |
|
88
|
|
|
$this->logger->error( |
|
89
|
|
|
sprintf( |
|
90
|
|
|
'Error while finding AA attributes. Original error message: "%s"', |
|
91
|
|
|
$e->getMessage() |
|
92
|
|
|
) |
|
93
|
|
|
); |
|
94
|
|
|
return null; |
|
95
|
|
|
} |
|
96
|
|
|
|
|
97
|
|
|
$this->logger->notice('No enabled attribute aggregation attributes found.'); |
|
|
|
|
|
|
98
|
|
|
return null; |
|
99
|
|
|
} |
|
100
|
|
|
|
|
101
|
|
|
/** |
|
102
|
|
|
* @param AuthenticatedUser $user |
|
103
|
|
|
* @param AttributeAggregationAttribute $orcidAttribute |
|
104
|
|
|
* |
|
105
|
|
|
* @return bool returns false when deletion failed |
|
106
|
|
|
*/ |
|
107
|
|
|
public function disconnectAttributeFor(AuthenticatedUser $user, AttributeAggregationAttribute $orcidAttribute) |
|
108
|
|
|
{ |
|
109
|
|
|
if ($this->isValidRequest($user, $orcidAttribute)) { |
|
110
|
|
|
$result = $this->repository->unsubscribeAccount($orcidAttribute->getId()); |
|
111
|
|
|
if (!$result) { |
|
112
|
|
|
$this->logger->error('Error while unsubscribing the AA attribute for the authenticating user.'); |
|
113
|
|
|
} |
|
114
|
|
|
return $result; |
|
115
|
|
|
} |
|
116
|
|
|
return false; |
|
117
|
|
|
} |
|
118
|
|
|
|
|
119
|
|
|
/** |
|
120
|
|
|
* Validate the users identity matches that of the identity set on the ORCID attribute retrieved from AA. |
|
121
|
|
|
* |
|
122
|
|
|
* @param AttributeAggregationAttribute $orcidAttribute |
|
123
|
|
|
* |
|
124
|
|
|
* @return bool |
|
125
|
|
|
*/ |
|
126
|
|
|
private function isValidRequest(AuthenticatedUser $user, AttributeAggregationAttribute $orcidAttribute) |
|
127
|
|
|
{ |
|
128
|
|
|
$nameId = $user->getNameId(); |
|
129
|
|
|
|
|
130
|
|
|
if ($nameId !== $orcidAttribute->getUserNameId()) { |
|
131
|
|
|
$this->logger->error( |
|
132
|
|
|
'The users NameId associated with ORCID iD account does not match the NameId of the |
|
133
|
|
|
authenticated user.' |
|
134
|
|
|
); |
|
135
|
|
|
return false; |
|
136
|
|
|
} |
|
137
|
|
|
|
|
138
|
|
|
return true; |
|
139
|
|
|
} |
|
140
|
|
|
} |
|
141
|
|
|
|
OpenConext /
OpenConext-profile
This check looks for unreachable code. It uses sophisticated control flow analysis techniques to find statements which will never be executed.
Unreachable code is most often the result of
return,dieorexitstatements that have been added for debug purposes.In the above example, the last
return falsewill never be executed, because a return statement has already been met in every possible execution path.