Validation du groupe d'accès

canapGEST/API/app/Http/Controllers/AuthController.php

@@ -40,7 +40,6 @@ class AuthController extends Controller
 
   public function login()
   {
-    // TODO: Limit group access to canap-gest-users
 
     $oClient = new TequilaClient("https://tequila.epfl.ch/cgi-bin/tequila/");
     $oClient->setParam(
@@ -48,19 +47,20 @@ class AuthController extends Controller
         'urlacces'  => url("/api/auth/tequilareturn"),
         'service'   => "Canap-Gest",
         'language'  => "francais",
-        'usecookie' => "on",
-        // 'allows'    => "group=formateurs-epfl",
+        'usecookie' => "off"
       )
     );
     $oClient->setRequested(
       array(
         'request' => "name,firstname,uniqueid,group",
-        //~ 'require'   => "role-respaccred",
+        'require'    => "group=canap-gest-users"
       )
     );
 
+
     if (!empty($_GET['key'])) {
       $attributs = $oClient->checkUser($_GET['key']);
+
       if (!$attributs) {
         exit("Unknown tequila error");
       }
@@ -74,8 +74,8 @@ class AuthController extends Controller
 
   public function tequilareturn()
   {
-    // return redirect()->to("https://canap-gest-dev.local:8080/#/?key=" . $_GET["key"]);
-    return redirect()->to("https://canap-gest.epfl.ch/#/?key=" . $_GET["key"]);
+    return redirect()->to("https://canap-gest-dev.local:8080/#/?key=" . $_GET["key"]);
+    // return redirect()->to("https://canap-gest.epfl.ch/#/?key=" . $_GET["key"]); // PROD
   }
 
   public function logout()

canapGEST/API/app/Providers/TequilaClient.php

@@ -145,7 +145,7 @@ class TequilaClient {
 		// }
 		return $url;
     }
-    
+
     /**
      * Sends an authentication request to Tequila.
      */
@@ -165,18 +165,22 @@ class TequilaClient {
         if (!$response) {
             return false;
         }
-		
+
         $attributes = $this->parseAttributes($response);
-		
-		// Check required
+        // Check required
 		foreach ($this->requested as $requestedAttributes) {
 			foreach (explode(",", $requestedAttributes) as $requestedAttribute) {
-				if (!array_key_exists($requestedAttribute, $attributes)) {
+                if (strpos($requestedAttribute, 'group=') !== false) {
+                    $requested_group = str_replace('group=', '', $requestedAttribute);
+                    $user_groups = explode(',', $attributes['group']);
+                    if (!in_array($requested_group, $user_groups)) {
+                        exit("Pas d'accès");
+                    }
+                } else if (!array_key_exists($requestedAttribute, $attributes)) {
 					exit("Tequila error: missing attribute $requestedAttribute");
 				}
 			}
 		}
-		
         return $attributes;
     }