diff --git a/uib_feide.module b/uib_feide.module index 2c75fbd0ff127850999f179930aba3979c782be1..e99a47b5cfd87cd6351d3c809e68cb053d9e201e 100644 --- a/uib_feide.module +++ b/uib_feide.module @@ -14,16 +14,19 @@ function uib_feide_openid_connect_userinfo_alter(#[\SensitiveParameter] array &$userinfo, #[\SensitiveParameter] array $context) : void { $userinfo['preferred_username'] = $userinfo['https://n.feide.no/claims/eduPersonPrincipalName'] ?? $userinfo['email']; - /** @var GuzzleHttp\Client $response */ - $response = Drupal::service('http_client')->request( - 'GET', - 'https://api.dataporten.no/userinfo/v1/userinfo', - ['headers' => ['Authorization' => 'Bearer ' . $context['tokens']['access_token']]]); - $extUserInfo = json_decode($response->getBody(), TRUE); - $userinfo['groups'] = []; - if (count($extUserInfo) > 1 && isset($extUserInfo['eduPersonEntitlement'])) { - foreach ($extUserInfo['eduPersonEntitlement'] as $group) { - $userinfo['groups'][] = Roles::{Roles::from($group)->name}->getRole(); + $userinfo['feideGroups'] = getenv('DRUPAL_UIB_FEIDE_CLIENT_GROUPS') ?: FALSE; + if ($userinfo['feideGroups']) { + /** @var GuzzleHttp\Client $response */ + $response = Drupal::service('http_client')->request( + 'GET', + 'https://api.dataporten.no/userinfo/v1/userinfo', + ['headers' => ['Authorization' => 'Bearer ' . $context['tokens']['access_token']]]); + $extUserInfo = json_decode($response->getBody(), TRUE); + $userinfo['groups'] = []; + if (count($extUserInfo) > 1 && isset($extUserInfo['eduPersonEntitlement'])) { + foreach ($extUserInfo['eduPersonEntitlement'] as $group) { + $userinfo['groups'][] = Roles::{Roles::from($group)->name}->getRole(); + } } } } @@ -32,6 +35,9 @@ function uib_feide_openid_connect_userinfo_alter(#[\SensitiveParameter] array &$ * Implements hook_openid_connect_pre_authorize(). */ function uib_feide_openid_connect_pre_authorize($account, array $context) : bool { + if (!$context['userinfo']['feideGroups']) { + return TRUE; + } if ($account) { foreach (Roles::cases() as $role) { if ($account->hasRole(Roles::{$role->name}->getRole())) {