• Resolved majagw

    (@majagw)


    We observe that the plugin has a problem with multivalued attributes used in authorisation rules.
    With following rule:
    (CAS{webadmin} -EQ “superadmin”) -OR (CAS{webadmin} -EQ “inst”)
    authorization fails when user’s attribute webadmin has more than one value, one of the values or both matching “superadmin” or “inst”.
    The code in wp_cassify_rule_solver.php seems to confirm that a left operand is assumed to be always string, not an array.
    I modified the part handling -EQ operator in solve_item function (to loop through all attributes values when left operand is array) and it helps.
    Is this problem known? or there is another way to deal with matching multivalued attributes?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Hi,

    Take a look at 2.0.8 release. I’ve added two new operator “IN” and “NOTIN” to process array attributes values.

    Best regards.

    Hi – can you please clarify the docs
    https://wpcassify.wordpress.com/wp-cassify-plugin-documentation/
    regarding multi-value attributes?

    I’ve got these CAS attributes
    <cas:eduPersonAffiliation>student</cas:eduPersonAffiliation>
    <cas:eduPersonAffiliation>employee</cas:eduPersonAffiliation>
    <cas:eduPersonAffiliation>former_employee</cas:eduPersonAffiliation>

    and want to allow if they have the employee affiliation. -CONTAINS inappropriately allows the user if they only have former_employee. I tried various combinations like:
    (CAS{eduPersonAffiliation} -IN “employee”) -AND (CAS{eduPersonAffiliation} -NOTIN “_employee”)
    (CAS{eduPersonAffiliation} -CONTAINS “employee”) -AND (CAS{eduPersonAffiliation} -NOT -CONTAINS “_employee”)
    (CAS{eduPersonAffiliation} -CONTAINS “employee”) -AND -NOT (CAS{eduPersonAffiliation} -CONTAINS “_employee”)
    (CAS{eduPersonAffiliation} -CONTAINS “employee”) -NOT (CAS{eduPersonAffiliation} -CONTAINS “_employee”)

    I’m also not clear how to test this in test.php. Here’s what I’ve got, which incorrectly yields bool(false):

    
    $mock_cas_object = array(
    	'first_name' => 'someuser',
    	'email' => '[email protected]',
    	'eduPersonAffiliation' => array('employee,student,former_employee')
    );
    ...
    $condition = '(CAS{eduPersonAffiliation} -IN "employee")';
    

    I’m using the very latest release.

    Actually nvm I figure it out looking at the code — the -IN condition checks for an exact match in that particular CAS attribute’s array of values, so
    (CAS{eduPersonAffiliation} -IN “employee”)
    will not match the <cas:eduPersonAffiliation>former_employee</cas:eduPersonAffiliation>value

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Multivalued attributes and authorization rules’ is closed to new replies.