Feature: Add SRAM integration through SBS #1880
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add processSRAMInterrupt route Working SRAM interrupt route Manipulate attributes in interrupt Add token parameter Rename endpoints
Align EB/stub with real SBS authz parameters Use SBS api namespace
…led-services skip the IdP-SP check. I.e., if coin:collab_enabled is set, skip the check if the correct IdP is connected, and always allow the flow to continue.
Prior to this change, the test still assumed the entitlements call was used. This change adjusts the test to prime the sbs functional test endpoint for multiple calls on the authz endpoint instead.
johanib
commented
Oct 29, 2025
library/EngineBlock/Corto/Filter/Command/SRAMInterruptFilter.php
Outdated
Show resolved
Hide resolved
johanib
force-pushed
the
feature/sram-interrupt_rebase_php82
branch
from
056d93f to
11ff3d9
Compare
johanib
commented
Oct 29, 2025
src/OpenConext/EngineBlockFunctionalTestingBundle/Features/SbsFlowIntegration.feature
Outdated
Show resolved
Hide resolved
MKodde
requested changes
Oct 29, 2025
Member
MKodde
left a comment
MKodde
left a comment
There was a problem hiding this comment.
Awesome to see this PR with green builds again 👍
I have some suggestions and questions on the changes of this PR. I know this is the result of a rebase, and most of these points of feedback should be on the 'parent' PR. But still... here you go :)
library/EngineBlock/Corto/Filter/Command/SRAMInterruptFilter.php
Outdated
Show resolved
Hide resolved
library/EngineBlock/Corto/Filter/Command/SRAMInterruptFilter.php
Outdated
Show resolved
Hide resolved
library/EngineBlock/Corto/Filter/Command/SRAMInterruptFilter.php
Outdated
Show resolved
Hide resolved
src/OpenConext/EngineBlock/Exception/InvalidSramConfigurationException.php
Outdated
Show resolved
Hide resolved
tests/library/EngineBlock/Test/Corto/Filter/Command/ValidateAllowedConnectionTest.php
Outdated
Show resolved
Hide resolved
src/OpenConext/EngineBlockFunctionalTestingBundle/Features/SbsFlowIntegration.feature
Outdated
Show resolved
Hide resolved
johanib
commented
Oct 30, 2025
src/OpenConext/EngineBlockFunctionalTestingBundle/Features/SbsFlowIntegration.feature
Outdated
Show resolved
Hide resolved
johanib
commented
Oct 30, 2025
MKodde
approved these changes
Nov 3, 2025
src/OpenConext/EngineBlockFunctionalTestingBundle/Features/SbsFlowIntegration.feature
Outdated
Show resolved
Hide resolved
Prior to this change, stepup would be performed after the SRAM interrupt check. This change ensures steupup is performed first. The reason is that the SRAM callout could trigger a 2fa check in SBS. It would be weird to perform a 2fa stepup after that 2fa check. So doing the stepup first would seem better.
This was
linked to
issues
Nov 3, 2025
johanib
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Continued from #1819
In order to facilitate fine-grained access to SRAM, EB integrates with SRAM through the SBS service.
This process is only enabled if both the
feature_enable_sram_interruptfeature flag is enabled and thecollabEnabledcoin of the SP is true.If enabled, the SramInterruptFilter will call SBS with the sessionId.
If the sessionId is known in SBS, EB will merge the attributes supplied by SBS into the Auth request.
IF the sessionId is unknown, later in the Consume Assertion process, the browser will be redirected to SBS,
which will redirect back to EB after a successful check. Then the attributes from SBS will be merged after all.
See #1804 for details.