Módosítások

= This page describes the features of Attribute Conversion and Filtering library for simpleSAMLphp =

== EduGAIN Introduction ==This library is intented to be configuration-compatible with the [http://edugain.org eduGAIN] uses Bridging Elements for interconnecting federations. To provide attribute translation and filtering services, an [[Attribute_Conversion_for_eduGAIN| attribute 'mangling' library]] was developed for the Java library-based bridging elements. As [http://rnd.feide. The module no/simplesamlphp/ simpleSAMLphp] can read also be used as an eduGAIN bridging element, the eduGAIN converter conversion and filter engine XML configuration and should operate the same way as the Java onefiltering library was ported to PHP.

== Configuration files ==The '''Beyond eduGAIN attribute converter and filter , you can use this module defines its own XML schema for every IdP or SP operating mode (shib13 SP/IdP, saml2 SP/IdP) of simpleSAMLphp in order to provide more powerful attribute conversion and attribute filtering purposes. See the [[Attribute_Conversion_for_eduGAIN]] page for configuration referencecapabilities.'''

== Enabling the simpleSAMLphp module Download and support ==This You can download the module from [https://www.aai.niif.hu/ssp-attributes here]. The module depends on the ''xsl'' php extensions (more specifically, the ''XSLTProcessor'' class)is in beta stage, so make sure it needs broader community review. It is properly configurednot yet recommended for production environments.

The If you have any questions regarding the module can be enabled by creating an empty file named , please write to ''modules/edugain/default-enable'aai _aT_ niif _dOt hu''.

For changelogs please visit the [https://repo.niif.hu/gitweb/gitweb.cgi?p=simplesamlphp-edugain project repository]. == Compatibility ===== eduGAIN ===This library is intended to be configuration-compatible with the [http://edugain.org eduGAIN] [[Attribute_Conversion_for_eduGAIN]] Java library. The module can read the eduGAIN converter and filter engine XML configuration files and should operate the same way as the Java one.=== Configuration files ===The eduGAIN attribute converter and filter module defines its own XML schema for attribute conversion and attribute filtering purposes. See the [[Attribute_Conversion_for_eduGAIN]] page for more information on attribute rules. == Using the module ==This module has a working name <code>edugain</code>. As this module only addresses the attribute translation part of the 'eduGAIN-problem', it might be renamed later.=== Enabling the simpleSAMLphp module ===This module depends on the '''xsl''' php extensions (more specifically, the ''XSLTProcessor'' class), so make sure it is properly configured. The module can be enabled by creating an empty file named <code>modules/edugain/default-enable</code>.=== simpleSAMLphp module configuration ===

* ''class'': defines {{INFO_EN|If either <code>converterconfig</code> or <code>filterconfig</code> is omitted, than the eduGAIN filter for simpleSAMLphp.* ''mode'': configures relevant part of the way this module operates (''idp'' conversion or ''sp''filtering respectively)is disabled. See the [[#Operating_modes]] section below for more.* Note that ''converterconfig'': configures the path of disabling filter means you let all the attribute converter configuration xml file.* 'attributes through'filterconfig'': configures the path of the attribute filter configuration xml file.* ''cache'': enables (default) or disables the internal configuration cache. See the [[#Configuration_cache]] section below for more.}}

EduGAIN module can operate in two modes, '''idp''' or '''sp'''. This mode affects two behaviors: the conversion-filtering order, and the provider matching.

* in '''idp''' mode, attribute filter is ran run '''after ''' conversion, and the RemoteProvider match is done against the SP (or R-BE in eduGAIN bridged environment) which initiated the SSO session.* in '''sp''' mode, attribute filter is ran run '''before ''' conversion, and the RemoteProvider match is done against the IdP (or H-BE in eduGAIN bridged environment) which released the attributes to our simpleSAMLphp SP.

In == Configuration file ==The simpleSAMLphp eduGAIN terms, module reads the eduGAIN XML configuration format and transforms it into php arrays using XSL transformation. The submodules (''idp'' mode is often referred as edugain:SplitMerge''home bridging element'', and ''sp'' is referred as ''remote bridging elementedugain:Filter'') are configured automatically by the edugain:Attributes class.

== Configuration reading ==The simpleSAMLphp eduGAIN module reads PHP configuration interface for these filters are not supported at the moment and may be subject to change, so please use the eduGAIN XML configuration format and transforms it into php arrays using XSL transformation. The submodules (''edugain:SplitMerge'' and ''edugain:Filter') are configured automatically by the edugain:Attributes class.

=== Configuration cache ===The ''edugain:SplitMerge'' implements XML reading is very time-consuming but conversion and filtering rules should be evaluated on every request. Because of that, the eduGAIN module can cache the ''BasicRule'', ''MergeRule''XML configuration into a serialized PHP array, which is stored locally in a directory named <code>cache</code>. If the XML file is not updated since the last cache file generation then the cache is used and ''SplitRule'' rules, the ''edugainXML parsing part is skipped. Cache file name is computed according to the following:Filter'' implements the ''FilterRule'' md5(full_configuration_file_path).cache.php

PHP configuration interface for these filters are not public and may be subject of change, so please use {{INFO_EN|Enabling the XML configurationcache is strongly recommended in production environments.}}

== Configuration cache Differences between the Java and the PHP implementations ==The XML reading * There is no '''CustomRule''' for attribute conversion. One can use simpleSAMLphp authentication processing filter API to implement arbitrary conversion rules.* '''LocalProvider''' matching is very time-consuming as every request triggers itunsupported in simpleSAMLphp. Because Unfortunately when simpleSAMLphp is in bridging mode (using the SP module to protect an IdP), the IdP processing filters do not see the peer entity of that, the eduGAIN SP module . However, you can cache achieve the correct behavior by putting one ''edugain:Attributes'' processing filter in the XML SP configuration locally and use '''RemoteProvider''' matches to filter and convert attributes there.* You don't need to use a separate attribute name mapper, because simpleSAMLphp contains built-in a directory named ''cache'name2oid''','''oid2name''', '''name2urn''' and '''urn2name'''methods, which provide the same functionality.* Regular expressions are somewhat different in PHP. The eduGAIN module uses perl-compatible regular expressions (see [http://hu.php.net/manual/en/function.preg-match.php preg_match documentation] for details).

If cache is enabled, the parsed configuration is serialized into a file (named ''md5(full_configuration_file_path).cache.php''). If the XML file modification time is older than the cache file, then the cache is used.[[Kategória: AAI]] Please note that enabling the cache is strongly recommended in production environment. == Differences between the Java and the PHP implementations ==* ''LocalProvider'' matching is unsupported in simpleSAMLphp. Unfortunately when simpleSAMLphp is in bridging mode (using the SP module to protect and IdP), the IdP processing filters do not see the peer entity of the SP module. However, you can archieve the correct behavior by putting one ''edugain[[Kategória:Attributes'' processing filter in the SP configuration and use ''RemoteProvider'' matches to filter and convert attributes there.english]]* Regular expressions are somewhat different in PHP. The eduGAIN module uses perl-compatible regular expressions (see [http[Kategória://hu.php.net/manual/en/function.preg-match.php preg_match documentationsimplesamlphp]] for details). Plus, the reading of the configuration involves ''eval'', and thus it swallows the escaping characters. So if one wants to escape something in their regular expressions, double-escaping is needed (eg. 'foo\\.bar' instead of 'foo\.bar').