1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
|
<?php
declare(strict_types=1);
namespace SimpleSAML\Module\core;
use SimpleSAML\Configuration;
use SimpleSAML\Error;
/**
* Generic library for access control lists.
*
* @package SimpleSAMLphp
*/
class ACL
{
/**
* The access control list, as an array.
*
* @var array
*/
private $acl;
/**
* Initializer for this access control list.
*
* @param array|string $acl The access control list.
*/
public function __construct($acl)
{
assert(is_string($acl) || is_array($acl));
if (is_string($acl)) {
$acl = self::getById($acl);
}
foreach ($acl as $rule) {
if (!is_array($rule)) {
throw new Error\Exception('Invalid rule in access control list: ' . var_export($rule, true));
}
if (count($rule) === 0) {
throw new Error\Exception('Empty rule in access control list.');
}
$action = array_shift($rule);
if ($action !== 'allow' && $action !== 'deny') {
throw new Error\Exception(
'Invalid action in rule in access control list: ' . var_export($action, true)
);
}
}
$this->acl = $acl;
}
/**
* Retrieve an access control list with the given id.
*
* @param string $id The id of the access control list.
* @return array The access control list array.
*/
private static function getById(string $id): array
{
$config = Configuration::getOptionalConfig('acl.php');
if (!$config->hasValue($id)) {
throw new Error\Exception('No ACL with id ' . var_export($id, true) . ' in config/acl.php.');
}
return $config->getArray($id);
}
/**
* Match the attributes against the access control list.
*
* @param array $attributes The attributes of an user.
* @return boolean TRUE if the user is allowed to access the resource, FALSE if not.
*/
public function allows(array $attributes)
{
foreach ($this->acl as $rule) {
$action = array_shift($rule);
if (!self::match($attributes, $rule)) {
continue;
}
if ($action === 'allow') {
return true;
} else {
return false;
}
}
return false;
}
/**
* Match the attributes against the given rule.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function match(array $attributes, array $rule): bool
{
$op = array_shift($rule);
if ($op === null) {
// An empty rule always matches
return true;
}
switch ($op) {
case 'and':
return self::opAnd($attributes, $rule);
case 'equals':
return self::opEquals($attributes, $rule);
case 'equals-preg':
return self::opEqualsPreg($attributes, $rule);
case 'has':
return self::opHas($attributes, $rule);
case 'has-preg':
return self::opHasPreg($attributes, $rule);
case 'not':
return !self::match($attributes, $rule);
case 'or':
return self::opOr($attributes, $rule);
default:
throw new Error\Exception('Invalid ACL operation: ' . var_export($op, true));
}
}
/**
* 'and' match operator.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function opAnd(array $attributes, array $rule): bool
{
foreach ($rule as $subRule) {
if (!self::match($attributes, $subRule)) {
return false;
}
}
// All matches
return true;
}
/**
* 'equals' match operator.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function opEquals(array $attributes, array $rule): bool
{
$attributeName = array_shift($rule);
if (!array_key_exists($attributeName, $attributes)) {
$attributeValues = [];
} else {
$attributeValues = $attributes[$attributeName];
}
foreach ($rule as $value) {
$found = false;
foreach ($attributeValues as $i => $v) {
if ($value !== $v) {
continue;
}
unset($attributeValues[$i]);
$found = true;
break;
}
if (!$found) {
return false;
}
}
if (!empty($attributeValues)) {
// One of the attribute values didn't match
return false;
}
// All the values in the attribute matched one in the rule
return true;
}
/**
* 'equals-preg' match operator.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function opEqualsPreg(array $attributes, array $rule): bool
{
$attributeName = array_shift($rule);
if (!array_key_exists($attributeName, $attributes)) {
$attributeValues = [];
} else {
$attributeValues = $attributes[$attributeName];
}
foreach ($rule as $pattern) {
$found = false;
foreach ($attributeValues as $i => $v) {
if (!preg_match($pattern, $v)) {
continue;
}
unset($attributeValues[$i]);
$found = true;
break;
}
if (!$found) {
return false;
}
}
if (!empty($attributeValues)) {
// One of the attribute values didn't match
return false;
}
// All the values in the attribute matched one in the rule
return true;
}
/**
* 'has' match operator.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function opHas(array $attributes, array $rule): bool
{
$attributeName = array_shift($rule);
if (!array_key_exists($attributeName, $attributes)) {
$attributeValues = [];
} else {
$attributeValues = $attributes[$attributeName];
}
foreach ($rule as $value) {
if (!in_array($value, $attributeValues, true)) {
return false;
}
}
// Found all values in the rule in the attribute
return true;
}
/**
* 'has-preg' match operator.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function opHasPreg(array $attributes, array $rule): bool
{
$attributeName = array_shift($rule);
if (!array_key_exists($attributeName, $attributes)) {
$attributeValues = [];
} else {
$attributeValues = $attributes[$attributeName];
}
foreach ($rule as $pattern) {
$matches = preg_grep($pattern, $attributeValues);
if (count($matches) === 0) {
return false;
}
}
// Found all values in the rule in the attribute
return true;
}
/**
* 'or' match operator.
*
* @param array $attributes The attributes of an user.
* @param array $rule The rule we should check.
* @return boolean TRUE if the rule matches, FALSE if not.
*/
private static function opOr(array $attributes, array $rule): bool
{
foreach ($rule as $subRule) {
if (self::match($attributes, $subRule)) {
return true;
}
}
// None matches
return false;
}
}
|
