Skip to content

Commit 2024110

Browse files
keevankeevan
committed
feat: add fallback idp/mdl attribute mapping
Used when the primary mapping does not match against any particular user. This can be used in the case where attributes used for id management are transitioned from one field to another, and allows for a gradual non-disruptive rollover.
1 parent b622433 commit 2024110

File tree

4 files changed

+102
-22
lines changed

4 files changed

+102
-22
lines changed

‎classes/auth.php‎

Lines changed: 48 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -672,8 +672,9 @@ public function saml_login_complete($attributes) {
672672
}
673673

674674
$attr = $this->config->idpattr;
675+
$attrsecondary = $this->config->idpattrsecondary;
675676
if (empty($attributes[$attr])) {
676-
// Missing mapping IdP attribute. Login failed.
677+
// Missing mapping IdP attribute (both primary and secondary). Login failed.
677678
$event = \core\event\user_login_failed::create(['other' => ['username' => 'unknown',
678679
'reason' => AUTH_LOGIN_NOUSER]]);
679680
$event->trigger();
@@ -690,26 +691,15 @@ public function saml_login_complete($attributes) {
690691

691692
// Find Moodle user.
692693
$user = false;
693-
foreach ($attributes[$attr] as $uid) {
694-
$insensitive = false;
695-
$accentsensitive = true;
696-
if ($this->config->tolower == saml2_settings::OPTION_TOLOWER_LOWER_CASE) {
697-
$this->log(__FUNCTION__ . " to lowercase for $uid");
698-
$uid = strtolower($uid);
699-
}
700-
if ($this->config->tolower == saml2_settings::OPTION_TOLOWER_CASE_INSENSITIVE) {
701-
$this->log(__FUNCTION__ . " case insensitive compare for $uid");
702-
$insensitive = true;
703-
}
704-
if ($this->config->tolower == saml2_settings::OPTION_TOLOWER_CASE_AND_ACCENT_INSENSITIVE) {
705-
$this->log(__FUNCTION__ . " case and accent insensitive compare for $uid");
706-
$insensitive = true;
707-
$accentsensitive = false;
708-
}
709-
if ($user = user_extractor::get_user($this->config->mdlattr, $uid, $insensitive, $accentsensitive)) {
710-
// We found a user.
711-
break;
712-
}
694+
695+
// Primary IdP attribute mapping.
696+
if (!empty($attributes[$attr])) {
697+
[$user, $uid] = $this->find_user_by_attributes($attributes[$attr], $this->config->mdlattr);
698+
}
699+
700+
// Secondary IdP attribute mapping (if user not found yet).
701+
if ($user === false && !empty($attributes[$attrsecondary])) {
702+
[$user, $uid] = $this->find_user_by_attributes($attributes[$attrsecondary], $this->config->mdlattrsecondary);
713703
}
714704

715705
// Moodle Workplace - Check IdP's tenant availability, for new user pre-allocate to tenant.
@@ -1344,4 +1334,41 @@ private function execute_callback($function, $file = 'lib.php') {
13441334
}
13451335
}
13461336
}
1337+
1338+
/**
1339+
* Find and return a user matched using a list of provided attributes, against a Moodle field.
1340+
*
1341+
* Applies any case matching settings configured.
1342+
*
1343+
* @param array $idpattrs
1344+
* @param string $mdlattr
1345+
* @return array false if no user found, otherwise the user object, and the $uid of the iterated user
1346+
*/
1347+
private function find_user_by_attributes(array $idpattrs, string $mdlattr): array {
1348+
$user = false;
1349+
$uid = null;
1350+
foreach ($idpattrs as $uid) {
1351+
$insensitive = false;
1352+
$accentsensitive = true;
1353+
if ($this->config->tolower == saml2_settings::OPTION_TOLOWER_LOWER_CASE) {
1354+
$this->log(__FUNCTION__ . " to lowercase for $uid");
1355+
$uid = strtolower($uid);
1356+
}
1357+
if ($this->config->tolower == saml2_settings::OPTION_TOLOWER_CASE_INSENSITIVE) {
1358+
$this->log(__FUNCTION__ . " case insensitive compare for $uid");
1359+
$insensitive = true;
1360+
}
1361+
if ($this->config->tolower == saml2_settings::OPTION_TOLOWER_CASE_AND_ACCENT_INSENSITIVE) {
1362+
$this->log(__FUNCTION__ . " case and accent insensitive compare for $uid");
1363+
$insensitive = true;
1364+
$accentsensitive = false;
1365+
}
1366+
if ($user = user_extractor::get_user($mdlattr, $uid, $insensitive, $accentsensitive)) {
1367+
// We found a user.
1368+
break;
1369+
}
1370+
}
1371+
return [$user, $uid];
1372+
}
1373+
13471374
}

‎lang/en/auth_saml2.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,8 @@
9595
$string['flagresponsetype_help'] = 'If access is blocked based on configured group restrictions, how should Moodle respond?';
9696
$string['idpattr_help'] = 'Which IdP attribute should be matched against a Moodle user field?';
9797
$string['idpattr'] = 'Mapping IdP';
98+
$string['idpattrsecondary_help'] = 'When the primary IdP attribute does not match a user, map this field to the secondary Moodle mapped field.';
99+
$string['idpattrsecondary'] = 'Secondary Mapping IdP';
98100
$string['idpmetadata_badurl'] = 'Invalid metadata at {$a}';
99101
$string['idpmetadata_help'] = 'To use multiple IdPs enter each public metadata url on a new line.<br/>To override a name, place text before the http. eg. "Forced IdP Name http://ssp.local/simplesaml/saml2/idp/metadata.php"';
100102
$string['idpmetadata'] = 'IdP metadata xml OR public xml URL';
@@ -115,6 +117,8 @@
115117
$string['manageidpsheading'] = 'Manage available Identity Providers (IdPs)';
116118
$string['mdlattr_help'] = 'Which Moodle user field should the IdP attribute be matched to?';
117119
$string['mdlattr'] = 'Mapping Moodle';
120+
$string['mdlattrsecondary_help'] = 'Which Moodle user field should the IdP secondary attribute be matched to?';
121+
$string['mdlattrsecondary'] = 'Secondary Mapping Moodle';
118122
$string['wantassertionssigned'] = 'Want assertions signed';
119123
$string['wantassertionssigned_help'] = 'Whether assertions received by this SP must be signed';
120124
$string['assertionsconsumerservices'] = 'Assertions consumer services';

‎settings.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,20 @@
314314
saml2_settings::OPTION_TOLOWER_EXACT,
315315
$toloweroptions));
316316

317+
// IDP attribute (secondary).
318+
$settings->add(new admin_setting_configtext(
319+
'auth_saml2/idpattrsecondary',
320+
get_string('idpattrsecondary', 'auth_saml2'),
321+
get_string('idpattrsecondary_help', 'auth_saml2'),
322+
'', PARAM_TEXT));
323+
324+
// Moodle Field (secondary).
325+
$settings->add(new admin_setting_configselect(
326+
'auth_saml2/mdlattrsecondary',
327+
get_string('mdlattrsecondary', 'auth_saml2'),
328+
get_string('mdlattrsecondary_help', 'auth_saml2'),
329+
'', user_fields::get_supported_fields()));
330+
317331
// Requested Attributes.
318332
$settings->add(new admin_setting_configtextarea(
319333
'auth_saml2/requestedattributes',

‎tests/auth_test.php‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
* @copyright 2021 Moodle Pty Ltd <support@moodle.com>
2828
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
2929
*/
30-
class auth_saml2_test extends \advanced_testcase {
30+
class auth_test extends \advanced_testcase {
3131
/**
3232
* Set up
3333
*/
@@ -435,6 +435,41 @@ public function test_saml_login_complete_missing_idpattr(): void {
435435
$this->assertEquals(AUTH_LOGIN_NOUSER, $event->get_data()['other']['reason']);
436436
}
437437

438+
public function test_saml_login_complete_secondary_mapping_used(): void {
439+
global $USER;
440+
441+
$attribs = [
442+
'uid' => ['doesnotmatch'],
443+
'email' => ['anything@example.com'],
444+
'someidfield' => ['must-match-12345'],
445+
];
446+
447+
$user = $this->getDataGenerator()->create_user([
448+
'auth' => 'saml2',
449+
'email' => 'notrelevant@example.com',
450+
'idnumber' => 'must-match-12345',
451+
]);
452+
453+
// The primary was set up to fail.
454+
set_config('idpattr', 'uid', 'auth_saml2');
455+
set_config('mdlattr', 'email', 'auth_saml2');
456+
// The secondary mapping should match and map to the generated user.
457+
set_config('idpattrsecondary', 'someidfield', 'auth_saml2');
458+
set_config('mdlattrsecondary', 'idnumber', 'auth_saml2');
459+
460+
// Sanity check.
461+
$this->assertFalse(isloggedin());
462+
$this->assertNotEquals($attribs['email'][0], $user->email);
463+
464+
// Try to login, suppress output.
465+
$auth = new \auth_saml2\auth();
466+
@$auth->saml_login_complete($attribs);
467+
468+
// Check global object, make sure the created user is the one logged in, despite other non-matching attributes provided.
469+
$this->assertEquals($user->id, $USER->id);
470+
$this->assertEquals($user->username, $USER->username);
471+
}
472+
438473
public function test_saml_login_complete_group_restriction(): void {
439474
$attribs = [
440475
'uid' => ['samlu1'],

0 commit comments

Comments
 (0)