Docs For Class auth

Docs For Class auth_saml

Home

Documentation home

Atk index

Docs For Class auth_saml [ package: atk ]

Class: auth_saml

Source Location: /security/class.auth_saml.inc

Class auth_saml

Class Overview

Driver for SAML authentication, for SAML based Single Sign On systems.

It uses the SimpleSAMLphp library for the actual SAML handling To use this driver you need to specify a number of config options:

Required:

$config_auth_saml_simplesaml_path = path to your simplesamlphp installation, relative to your application, with trailing slash. Example: $config_auth_saml_simplesaml_path = "../simplesamlphp/";

Optional:

$config_auth_userid_field = "uid"; The name of the field in the SSO system that contains the id of the logged in user. Defaults to 'uid'.

$config_auth_saml_authsource = "default-sp"; The name of the authsource in simplesamlphp. Defaults to 'default-sp'.

Located in /security/class.auth_saml.inc [line 41]

Wiki documentation

auth_interface
   |
   --auth_saml

Author(s):

Ivo Jansch <ivo@egeniq.com>

Information Tags:

Properties

$_samlUser

Methods

[ Top ]

Inherited from parent

Inherited Properties	Inherited Methods
Inherited From auth_interface auth_interface::$m_fatalError	Inherited From auth_interface auth_interface::allowed() Check if the currently logged-in user has a certain privilege on a node. auth_interface::attribAllowed() Check if the currently logged-in user has the right to view, edit etc. auth_interface::canMd5() Does the authentication method support md5 encoding of passwords? auth_interface::getAttribEntity() This function returns the level/group(s) that are allowed to view/edit a certain attribute of a given node. auth_interface::getEntity() This function returns the level/group(s) that are allowed to perform the given action on a node. auth_interface::getPassword() This function returns password or false, if password can't be retrieve/recreate auth_interface::getPasswordPolicy() This function returns "get password" policy for current auth method auth_interface::getUser() This function returns information about a user in an associative array with the following elements: "name" -> the userid (should normally be the same as the $user variable that gets passed to it. auth_interface::getUserList() This function returns the list of users that may login. This can be used to display a dropdown of users from which to choose. auth_interface::logout() Logout handling. The default implementation does simple session destruction and recreates a new session. auth_interface::validateUser() Authenticate a user.

Inherited Properties

Inherited Methods

Inherited From auth_interface

auth_interface::$m_fatalError

Inherited From auth_interface

auth_interface::allowed()

Check if the currently logged-in user has a certain privilege on a node.

auth_interface::attribAllowed()

Check if the currently logged-in user has the right to view, edit etc.

auth_interface::canMd5()

Does the authentication method support md5 encoding of passwords?

auth_interface::getAttribEntity()

This function returns the level/group(s) that are allowed to view/edit a certain attribute of a given node.

auth_interface::getEntity()

This function returns the level/group(s) that are allowed to perform the given action on a node.

auth_interface::getPassword()

This function returns password or false, if password can't be retrieve/recreate

auth_interface::getPasswordPolicy()

This function returns "get password" policy for current auth method

auth_interface::getUser()

This function returns information about a user in an associative array with the following elements: "name" -> the userid (should normally be the same as the $user variable that gets passed to it.

auth_interface::getUserList()

This function returns the list of users that may login. This can be used to display a dropdown of users from which to choose.

auth_interface::logout()

Logout handling. The default implementation does simple session destruction and recreates a new session.

auth_interface::validateUser()

Authenticate a user.

[ Top ]

Property Summary

static mixed

$_samlUser

[ Top ]

Method Summary

boolean	canMd5()	Does this authentication method support md5 encoding of passwords?
void	getUser()	Retrieve the user. We ignore $user since a saml user is managed in a separate system. We return the user as we retrieved it from the SSO system during login in validateUser.
void	logout()	Logout through the SSO system. The default logout handler destroys the session, but we can't do that, since simplesamlphp needs the session to be able to perform the logout.
int	validateUser()	Authenticate a user.

[ Top ]

Properties

static mixed $_samlUser = NULL [line 47]

API Tags:

Internal:	This value is static because atkSecurityManager has 2 instances of this class if authorization and authentication are both saml.
Access:	protected

[ Top ]

Methods

canMd5 [line 94]

boolean canMd5(
)

Does this authentication method support md5 encoding of passwords?

API Tags:

Return:	false
Access:	public

Redefinition of:

auth_interface::canMd5(): Does the authentication method support md5 encoding of passwords?

[ Top ]

getUser [line 106]

void getUser(

$user 
)

Retrieve the user. We ignore $user since a saml user is managed in a separate system. We return the user as we retrieved it from the SSO system during login in validateUser.

All the user data we retrieved from the SSO system is present as sub array $user["attributes"];

Parameters:

$user:

API Tags:

Access:

public

Redefinition of:

auth_interface::getUser(): This function returns information about a user in an associative array with the following elements: "name" -> the userid (should normally be the same as the $user variable that gets passed to it.

[ Top ]

logout [line 84]

void logout(

$user 
)

Logout through the SSO system. The default logout handler destroys the session, but we can't do that, since simplesamlphp needs the session to be able to perform the logout.

Parameters:

$user:

API Tags:

Access:

public

Redefinition of:

auth_interface::logout(): Logout handling. The default implementation does simple session destruction and recreates a new session.

[ Top ]

validateUser [line 58]

int validateUser(

$user, 
$passwd 
)

Authenticate a user.

$user and $passwd are ignored by the saml plugin since we perform login elsewhere (in the SSO system). Note: if the user is not logged in in the SSO system, this method will never return as we redirect to the SSO system.

Parameters:

	$user:
	$passwd:

API Tags:

Return:	AUTH_SUCCESS - Authentication succesful
Access:	public

Redefinition of:

auth_interface::validateUser(): Authenticate a user.

[ Top ]