Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Terminology #1774

Open
wants to merge 20 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion UPGRADING.md
Original file line number Diff line number Diff line change
Expand Up @@ -139,7 +139,7 @@ Therefore you should push the data from Manage after you have updated the codeba
Be aware that you need to be logged in into manage to push the data after updating the codebase and database schema.

In order to let this work you need to do the following:
1. Login into manage
1. Log in to manage
1. Update codebase
1. Run migrations
1. Push metadata
Expand Down
6 changes: 3 additions & 3 deletions application/configs/attributes.json
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
"urn:mace:dir:attribute-def:eduPersonEntitlement": {
"Description": {
"en": "entitlement which decides upon your authorization within the application",
"nl": "rechtaanduiding; URI (URL of URN) dat een recht op iets aangeeft; wordt bepaald door een contract tussen dienstaanbieder en instelling"
"nl": "rechtaanduiding; URI (URL of URN) dat een recht op iets aangeeft; wordt bepaald door een contract tussen applicatieaanbieder en instelling"
},
"Name": {
"en": "Entitlement",
Expand Down Expand Up @@ -411,8 +411,8 @@
},
"urn:nl.surfconext.licenseInfo": {
"Description": {
"en": "License information for the current service",
"nl": "Licentieinformatie voor de huidige dienst"
"en": "License information for the current application",
"nl": "Licentieinformatie voor de huidige applicatie"
},
"Name": {
"en": "License information",
Expand Down
2 changes: 1 addition & 1 deletion docs/trusted_proxy.md
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ Processing of the request:
* Both the trusted proxy and the end-SP being proxied must be known to engineblock (= configured as SP entities in Manage)
* Both the trusted proxy and the end-SP being proxied must have the same workflow state

* The ACL of both the trusted proxy and the end-SP are verified. Only IdPs are allowed access to both SPs are allowed to login
* The ACL of both the trusted proxy and the end-SP are verified. Only IdPs are allowed access to both SPs are allowed to log in
* The ARPs of both the trusted proxy and the end-SP being proxied are applied. Only attributes and attribute values that are allowed by both ARP are included in the response
* The attribute manipulations (AMs) of both the trusted proxy and the end-SP are run. The AMs of the trusted proxy are run first.
* Stepup-invocation is done if configured for the end-SP.
Expand Down
86 changes: 43 additions & 43 deletions languages/messages.en.php

Large diffs are not rendered by default.

78 changes: 39 additions & 39 deletions languages/messages.nl.php

Large diffs are not rendered by default.

2 changes: 1 addition & 1 deletion languages/messages.pt.php
Original file line number Diff line number Diff line change
Expand Up @@ -159,7 +159,7 @@
'error_help_desc' => '',
'error_no_idps' => 'Erro - Não foi encontrado nenhum Fornecedor de Identidade',
'error_no_idps_desc' => 'O %spName% a que pretende ligar-se não está acessível através da %organisationNounPlural%.',
'error_no_idps_desc_no_sp_name' => 'O serviço ("Service Provider") a que pretende ligar-se não está acessível através da %organisationNounPlural%.',
'error_no_idps_desc_no_sp_name' => 'O serviço a que pretende ligar-se não está acessível através da %organisationNounPlural%.',
'error_session_lost' => 'Erro - a sua sessão foi perdida',
'error_session_lost_desc' => '<p>Esta ação requer uma sessão ativa, no entanto, não conseguimos encontrar a sessão. Está a aguardar há muito tempo? Feche o browser e tente novamente, ou tente um browser diferente.</p>',
'error_session_not_started' => 'Erro - a sua sessão não foi encontrada',
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@
use Symfony\Component\Console\Output\OutputInterface;

/**
* Dump the contents of the (fake) Service Registry
* Dump the contents of the (fake) application Registry
*/
class DumpServiceRegistryCommand extends ContainerAwareCommand
{
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ Feature:
And a Service Provider named "Stepup SelfService"
And feature "eb.run_all_manipulations_prior_to_consent" is disabled

Scenario: The Service Provider can have an attribute added
Scenario: The application can have an attribute added
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$attributes['nl:surf:test:something'] = array("arbitrary-value");
Expand All @@ -31,7 +31,7 @@ Feature:
Then the url should match "functional-testing/SP-with-Attribute-Manipulations/acs"
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="nl:surf:test:something"]/saml:AttributeValue[text()="arbitrary-value"]'

Scenario: The Service Provider can have the attributes manipulated
Scenario: The application can have the attributes manipulated
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$attributes['urn:mace:dir:attribute-def:uid'] = array("the-manipulated-value");
Expand All @@ -46,7 +46,7 @@ Feature:
Then the url should match "functional-testing/SP-with-Attribute-Manipulations/acs"
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:mace:dir:attribute-def:uid"]/saml:AttributeValue[text()="the-manipulated-value"]'

Scenario: The Service Provider can have the SubjectID manipulated
Scenario: The application can have the SubjectID manipulated
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$subjectId = '[email protected]';
Expand All @@ -63,7 +63,7 @@ Feature:
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:mace:dir:attribute-def:eduPersonTargetedID"]/saml:AttributeValue/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="[email protected]"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="[email protected]"]'

Scenario: The Service Provider cannot have the SubjectID manipulated if using a NameID format other than unspecified
Scenario: The application cannot have the SubjectID manipulated if using a NameID format other than unspecified
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$subjectId = "[email protected]";
Expand All @@ -82,7 +82,7 @@ Feature:
And the response should not match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" and text()="[email protected]"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"]'

Scenario: The Service Provider cannot have the Subject NameID manipulated by setting the IntendedNameId in the reponse as it is overwritten by the subjectId
Scenario: The application cannot have the Subject NameID manipulated by setting the IntendedNameId in the reponse as it is overwritten by the subjectId
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$response['__']['IntendedNameId'] = 'NOOT';
Expand All @@ -103,7 +103,7 @@ Feature:
And the response should not match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="NOOT"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="AAP"]'

Scenario: The Service Provider can replace the NameID by setting the CustomNameID with an array representation of the NameID
Scenario: The application can replace the NameID by setting the CustomNameID with an array representation of the NameID
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$response['__']['CustomNameId'] = array('Format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient', 'Value' => 'NOOT');
Expand All @@ -121,7 +121,7 @@ Feature:
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" and text()="NOOT"]'

# See: https://www.pivotaltracker.com/story/show/159760842
Scenario: The Service Provider can replace the NameID by setting the CustomNameID with an object representation of the NameID
Scenario: The application can replace the NameID by setting the CustomNameID with an object representation of the NameID
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$nameId = new \SAML2\XML\saml\NameID();
Expand All @@ -141,7 +141,7 @@ Feature:
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:mace:dir:attribute-def:eduPersonTargetedID"]/saml:AttributeValue/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" and text()="MIES"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" and text()="MIES"]'

Scenario: The Service Provider cannot have the SubjectID manipulated by manipulating the responseObj using the unspecified NameID Format
Scenario: The application cannot have the SubjectID manipulated by manipulating the responseObj using the unspecified NameID Format
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$responseObj->setCollabPersonId('NOOT');
Expand All @@ -160,7 +160,7 @@ Feature:
And the response should not match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="NOOT"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"]'

Scenario: The Service Provider cannot have the SubjectID manipulated by manipulating the responseObj when using a NameID Format other than unspecified
Scenario: The application cannot have the SubjectID manipulated by manipulating the responseObj when using a NameID Format other than unspecified
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$responseObj->setCollabPersonId('NOOT');
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,15 +12,15 @@ Feature:
And a Service Provider named "Dummy-SP"
And a Service Provider named "SP-with-Attribute-Manipulations"

Scenario: The Service Provider can have an attribute added
Scenario: The application can have an attribute added
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$e = new EngineBlock_Attributes_Manipulator_CustomException("AM_ERROR Authorization Incorrect _ Affilliation Incorrect", EngineBlock_Attributes_Manipulator_CustomException::CODE_NOTICE);
$e->setFeedbackTitle(array("nl" => "Autorisatie Incorrect", "en" => "Authorization Incorrect"));
$e->setFeedbackDescription(array(
"en" => 'This user does not have access to desired service. ' .
"en" => 'This user does not have access to desired application. ' .
'Contact the system administrator.',
"nl" => 'Deze gebruikersnaam heeft geen toegang tot de gewenste dienst. ' .
"nl" => 'Deze gebruikersnaam heeft geen toegang tot de gewenste applicatie. ' .
'Neem contact op met de systeem beheerder. '
));
throw $e;
Expand All @@ -31,7 +31,7 @@ throw $e;
And I pass through the IdP
And I give my consent
Then I should see "Authorization Incorrect"
And I should see "This user does not have access to desired service. Contact the system administrator."
And I should see "This user does not have access to desired application. Contact the system administrator."
And I should see "UR ID:"
And I should see "IP:"
And I should see "EC:"
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ Feature:
And a Service Provider named "SP-with-Attribute-Manipulations"
And feature "eb.run_all_manipulations_prior_to_consent" is enabled

Scenario: The Service Provider can have an attribute added
Scenario: The application can have an attribute added
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$attributes['nl:surf:test:something'] = array("arbitrary-value");
Expand All @@ -29,7 +29,7 @@ Feature:
Then the url should match "functional-testing/SP-with-Attribute-Manipulations/acs"
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="nl:surf:test:something"]/saml:AttributeValue[text()="arbitrary-value"]'

Scenario: The Service Provider can have the attributes manipulated
Scenario: The application can have the attributes manipulated
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$attributes['urn:mace:dir:attribute-def:uid'] = array("the-manipulated-value");
Expand All @@ -44,7 +44,7 @@ Feature:
Then the url should match "functional-testing/SP-with-Attribute-Manipulations/acs"
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:mace:dir:attribute-def:uid"]/saml:AttributeValue[text()="the-manipulated-value"]'

Scenario: The Service Provider can have the SubjectID manipulated
Scenario: The application can have the SubjectID manipulated
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$subjectId = '[email protected]';
Expand All @@ -61,7 +61,7 @@ Feature:
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:mace:dir:attribute-def:eduPersonTargetedID"]/saml:AttributeValue/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="[email protected]"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="[email protected]"]'

Scenario: The Service Provider cannot have the SubjectID manipulated if using a NameID format other than unspecified
Scenario: The application cannot have the SubjectID manipulated if using a NameID format other than unspecified
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$subjectId = "[email protected]";
Expand All @@ -80,7 +80,7 @@ Feature:
And the response should not match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" and text()="[email protected]"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"]'

Scenario: The Service Provider cannot have the Subject NameID manipulated by setting the IntendedNameId in the reponse as it is overwritten by the subjectId
Scenario: The application cannot have the Subject NameID manipulated by setting the IntendedNameId in the reponse as it is overwritten by the subjectId
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$response['__']['IntendedNameId'] = 'NOOT';
Expand All @@ -101,7 +101,7 @@ Feature:
And the response should not match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="NOOT"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="AAP"]'

Scenario: The Service Provider can replace the NameID by setting the CustomNameID with an array representation of the NameID
Scenario: The application can replace the NameID by setting the CustomNameID with an array representation of the NameID
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$response['__']['CustomNameId'] = array('Format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient', 'Value' => 'NOOT');
Expand All @@ -118,7 +118,7 @@ Feature:
And the response should match xpath '/samlp:Response/saml:Assertion/saml:AttributeStatement/saml:Attribute[@Name="urn:mace:dir:attribute-def:eduPersonTargetedID"]/saml:AttributeValue/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" and text()="NOOT"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" and text()="NOOT"]'

Scenario: The Service Provider cannot have the SubjectID manipulated by manipulating the responseObj using the unspecified NameID Format
Scenario: The application cannot have the SubjectID manipulated by manipulating the responseObj using the unspecified NameID Format
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$responseObj->setCollabPersonId('NOOT');
Expand All @@ -137,7 +137,7 @@ Feature:
And the response should not match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" and text()="NOOT"]'
And the response should match xpath '/samlp:Response/saml:Assertion/saml:Subject/saml:NameID[@Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"]'

Scenario: The Service Provider cannot have the SubjectID manipulated by manipulating the responseObj when using a NameID Format other than unspecified
Scenario: The application cannot have the SubjectID manipulated by manipulating the responseObj when using a NameID Format other than unspecified
Given SP "SP-with-Attribute-Manipulations" has the following Attribute Manipulation:
"""
$responseObj->setCollabPersonId('NOOT');
Expand Down
Loading
Loading