Combine cas attributes roles module

+++ b/cas_attributes.admin.incundefined
@@ -69,6 +69,31 @@ function cas_attributes_admin_settings() {
+  $form['cas_attributes']['roles']['mapping'] = array(
+    '#type' => 'textarea',
+    '#title' => t('Attributes'),
+    '#description' => t('Specify a token to use to match attributes with a role. Please put one per line.'),
+    '#default_value' => $managed_roles['mapping'],

Do I need to match the role id or the role name?

+++ b/cas_attributes.moduleundefined
@@ -70,4 +70,38 @@ function cas_attributes_cas_user_presave(&$edit, $account) {
+        $total_values = token_replace('[cas:attribute:' . $name . ':count]', $data);
+        for ($i = 0; $i < $total_values; $i++) {
+          $cas_user_roles[] = token_replace('[cas:attribute:' . $name . ':value:' . $i . ']', $data);

Could this be done more simply as:
explode(SEP, token_replace(['cas:attribute:' . $name . ':join:' . SEP . ']'))
for a proper separator?

+++ b/cas_attributes.admin.incundefined
@@ -69,6 +69,31 @@ function cas_attributes_admin_settings() {
+  $roles = user_roles(TRUE);

Add

  unset($roles[DRUPAL_AUTHENTICATED_RID]);

to remove an irrelevant option.

Also access to this whole fieldset should be restricted via:

'#access' => user_access('administer permissions')

+++ b/cas_attributes.moduleundefined
@@ -70,4 +70,37 @@ function cas_attributes_cas_user_presave(&$edit, $account) {
+    // Get our attributes
+    $attributes = token_find_with_prefix($role_mapping_tokens['cas'], 'attribute');
+    $cas_user_roles = array();
+    foreach($attributes as $name => $original) {
+      // If there is no token option then assume all of them.
+      if (strpos($name, ':') === FALSE) {
+        $cas_user_roles += explode('~&', token_replace('[cas:attribute:' . $name . ':join:~&]', $data));
+      }
+      else {
+        $cas_user_roles[] = token_replace($original, $data);
+      }

Rather than this, I think we should go back and rethink the array handling. For example, maybe we should add an option to the token handler which will return the raw array? The we could do something like

$tokens = token_scan(...);
$replacements = token_generate('cas', $tokens, $cas, array('raw_array' => TRUE));

Thoughts?

This is clearly difficult to architect correctly --- in particular we're using the token system for things it is not designed to do.

I see two paths forward:

1. Avoid the token system

Instead, just provide a simple UI:

Roles to Manage:
[ ] editor
[ ] creator
... etc

CAS Attribute(s) which contain role names, one per line.
+-----------------------+
| memberOf              |
| superSecretAttribute  |
|                       |
+-----------------------+

Then just do
$attributes = cas_phpcas_attributes($cas_name);, avoiding the token system completely.

2. Use the token replacement system:

Roles to Manage:
[ ] editor
[ ] creator
... etc

Roles names, separated by pipes
To get multiple values from a single attribute, use the following join syntax: [cas:attribute:memberOf:join:|].  Make sure to separate different tokens with a pipe as well.  Extraneous whitespace will be ignored.

+-------------------------------------------------+
| [cas:attribute:memberOf:join:|]                 |
|  | [cas:attribute:superSecretAttribute:first]   |
|                                                 |
+-------------------------------------------------+

Which do you think is better?

Number 1 sounds best although it doesn't fit any of the other options on the page.

Yes, but it'd be easiest to implement on a deadline.

I'm thinking of adding a hook_cas_attributes_attribute_alter that will allow someone to manipulate the attributes returned from cas before we do the compare. So that you can return a single result only or if it's in a form of cn=tomato, ou=soup, dc=dinner, dc=food they can parse it and return soup as the group.

A few Q's regarding the hook:

(1): Would we first loop through the attributes to ensure that each one is an array?
(2): Would we have a similar hook for LDAP attributes? i.e. hook_cas_attributes_ldap_alter?

Otherwise I think this sounds brilliant!

Sorry, this totally fell off my radar. :(

Is the patch in #11 ready to go? If you think so, I'll just go ahead and commit it.

Yes. Also it'd be good if the description gave an example of the type of string by which we mean "attribute". Can you whip that up?

Could you post a more complete description of what sort of CAS response you are expecting?

For instance, it looks like you can return a set of Role Names within a single attribute as a comma separated list, but I'm not getting that to work. I am finding a reference to [cas:attribute:$name:count] which makes me think you are looking for something like

<cas:authenticationSuccess>
	<cas:user>me</cas:user>
	<cas:attributes>
		<cas:email>me@school.edu</cas:email>
		<cas:group>Group</cas:group>
		<cas:group>Other Group</cas:group>
	</cas:attributes>
</cas:authenticationSuccess>

Using MultiRowJdbcPersonAttributeDao, you should get something like this:

<cas:authenticationSuccess>
	<cas:user>me</cas:user>
	<cas:attributes>
		<cas:email>me@school.edu</cas:email>
		<cas:group>[Group, Other Group]</cas:group>
	</cas:attributes>
</cas:authenticationSuccess>

but I'm not sure what exactly you are doing, and since attributes in CAS are non-standard (unless you are using SAML, which I don't think you are) I could really use a concrete authenticationSuccess response example.

Thanks!

+++ b/cas_attributes.admin.inc
@@ -69,6 +69,33 @@ function cas_attributes_admin_settings() {
+    '#description' => t('Specify the attributes to use for roles. Please put one per line. An example would be department or affiliations.'),

I think we'll need to be clearer that it isn't the token syntax. For example.

Specify the CAS attributes to use for roles, one per line. For example, department or affiliations. Do not use token syntax, as it will not be processed.

Otherwise I think this is ready to go. Do you concur?

In the interest of moving things along I've committed the patch in #20. Put follow-up things in new issues, I'll change this issue into a potential backport to 6.x if folks are interested.

Thanks for all the hard work (and patience!).

Thanks for the report. I've committed this to 6.x-3.x.