Merge branch 'main' into idp-1624

Author: briskt

composer.lock

@@ -40,4 +40,4 @@ Logs information (common name, eduPrincipalPersonalName, employee number, IdP, S
 The following config is not needed on AWS, but it is needed locally
 'DynamoEndpoint' ex. http://dynamo:8000
 
-Ensure the DYNAMO_ACCESS_KEY_ID and DYNAMO_SECRET_ACCESS_KEY environment variables are set as shown in the local.env.dist file.
+Ensure the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables are set as shown in the local.env.dist file.

docs/editing_authprocs.md

@@ -99,10 +99,10 @@ ENV_ID=
 # A valid format for 'baseurlpath' is: [(http|https)://(hostname|fqdn)[:port]]/[path/to/simplesaml/]
 BASE_URL_PATH=
 
-# DYNAMO_ACCESS_KEY_ID and DYNAMO_SECRET_ACCESS_KEY can be set to AWS IAM credentials with access
+# AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY can be set to AWS IAM credentials with access
 # to a DynamoDB table for storage of user access logs. For more information see docs/editing_authprocs.md
-DYNAMO_ACCESS_KEY_ID
-DYNAMO_SECRET_ACCESS_KEY
+AWS_ACCESS_KEY_ID
+AWS_SECRET_ACCESS_KEY
 
 # HELP_CENTER_URL can be set to a URL for an end-user support site. If provided, it will be used for a
 # link address on the IdP selection page (selectidp-links) and the IdP login page (loginuserpass).

local.env.dist

@@ -5,6 +5,7 @@
 use Aws\DynamoDb\Marshaler;
 use Aws\Sdk;
 use Exception;
+use Sil\PhpEnv\Env;
 use SimpleSAML\Auth\ProcessingFilter;
 use SimpleSAML\Error\MetadataNotFound;
 use SimpleSAML\Logger;
@@ -23,12 +24,6 @@
  */
 class LogUser extends ProcessingFilter
 {
-
-    const AWS_ACCESS_KEY_ID_ENV = "DYNAMO_ACCESS_KEY_ID";
-
-    const AWS_SECRET_ACCESS_KEY_ENV = "DYNAMO_SECRET_ACCESS_KEY";
-
-
     const IDP_KEY = "saml:sp:IdP"; // the key that points to the entity id in the state
 
     // the metadata key for the IDP's Namespace code (i.e. short name)
@@ -78,17 +73,6 @@ public function process(array &$state): void
             return;
         }
 
-        $awsKey = getenv(self::AWS_ACCESS_KEY_ID_ENV);
-        if (!$awsKey) {
-            Logger::error(self::AWS_ACCESS_KEY_ID_ENV . " environment variable is required for LogUser.");
-            return;
-        }
-        $awsSecret = getenv(self::AWS_SECRET_ACCESS_KEY_ENV);
-        if (!$awsSecret) {
-            Logger::error(self::AWS_SECRET_ACCESS_KEY_ENV . " environment variable is required for LogUser.");
-            return;
-        }
-
         assert(is_array($state));
 
         // Get the SP's entity id
@@ -99,12 +83,16 @@ public function process(array &$state): void
 
         $sdkConfig = [
             'region' => $this->dynamoRegion,
-            'version' => 'latest',
-            'credentials' => [
+        ];
+
+        $awsKey = Env::getString('AWS_ACCESS_KEY_ID', Env::getString('DYNAMO_ACCESS_KEY_ID'));
+        $awsSecret = Env::getString('AWS_SECRET_ACCESS_KEY', Env::getString('DYNAMO_SECRET_ACCESS_KEY'));
+        if (!empty($awsSecret) && !empty($awsKey)) {
+            $sdkConfig['credentials'] = [
                 'key' => $awsKey,
                 'secret' => $awsSecret,
-            ],
-        ];
+            ];
+        }
 
         if (!empty($this->dynamoEndpoint)) {
             $sdkConfig['endpoint'] = $this->dynamoEndpoint;