Completed
Push — feature/restyle-of-wayg ( a7659e...3faa0b )
by
unknown
03:35
created

GatewayController::ssoAction()   A

Complexity

Conditions 3
Paths 2

Size

Total Lines 64
Code Lines 37

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
dl 0
loc 64
rs 9.3956
c 0
b 0
f 0
cc 3
eloc 37
nc 2
nop 1

How to fix   Long Method   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

1
<?php
2
3
/**
4
 * Copyright 2014 SURFnet bv
5
 *
6
 * Licensed under the Apache License, Version 2.0 (the "License");
7
 * you may not use this file except in compliance with the License.
8
 * You may obtain a copy of the License at
9
 *
10
 *     http://www.apache.org/licenses/LICENSE-2.0
11
 *
12
 * Unless required by applicable law or agreed to in writing, software
13
 * distributed under the License is distributed on an "AS IS" BASIS,
14
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15
 * See the License for the specific language governing permissions and
16
 * limitations under the License.
17
 */
18
19
namespace Surfnet\StepupGateway\GatewayBundle\Controller;
20
21
use Exception;
22
use SAML2\Constants;
23
use SAML2\Response as SAMLResponse;
24
use Surfnet\SamlBundle\SAML2\AuthnRequest;
25
use Surfnet\SamlBundle\SAML2\AuthnRequestFactory;
26
use Surfnet\StepupGateway\GatewayBundle\Exception\RuntimeException;
27
use Surfnet\StepupGateway\GatewayBundle\Saml\AssertionAdapter;
28
use Surfnet\StepupGateway\GatewayBundle\Saml\Exception\UnknownInResponseToException;
29
use Symfony\Bundle\FrameworkBundle\Controller\Controller;
30
use Symfony\Component\HttpFoundation\Request;
31
use Symfony\Component\HttpFoundation\Response;
32
use Symfony\Component\HttpKernel\Exception\HttpException;
33
34
class GatewayController extends Controller
35
{
36
    const RESPONSE_CONTEXT_SERVICE_ID = 'gateway.proxy.response_context';
37
38
    public function ssoAction(Request $httpRequest)
39
    {
40
        /** @var \Psr\Log\LoggerInterface $logger */
41
        $logger = $this->get('logger');
42
        $logger->notice('Received AuthnRequest, started processing');
43
44
        /** @var \Surfnet\SamlBundle\Http\RedirectBinding $redirectBinding */
45
        $redirectBinding = $this->get('surfnet_saml.http.redirect_binding');
46
47
        $originalRequest = $redirectBinding->receiveSignedAuthnRequestFrom($httpRequest);
48
49
        $originalRequestId = $originalRequest->getRequestId();
50
        $logger = $this->get('surfnet_saml.logger')->forAuthentication($originalRequestId);
51
        $logger->notice(sprintf(
52
            'AuthnRequest processing complete, received AuthnRequest from "%s", request ID: "%s"',
53
            $originalRequest->getServiceProvider(),
54
            $originalRequest->getRequestId()
55
        ));
56
57
        /** @var \Surfnet\StepupGateway\GatewayBundle\Saml\Proxy\ProxyStateHandler $stateHandler */
58
        $stateHandler = $this->get('gateway.proxy.state_handler');
59
60
        // Clear the state of the previous SSO action. Request data of previous
61
        // SSO actions should not have any effect in subsequent SSO actions.
62
        $stateHandler->clear();
63
64
        $stateHandler
65
            ->setRequestId($originalRequestId)
66
            ->setRequestServiceProvider($originalRequest->getServiceProvider())
0 ignored issues
show
Bug introduced by
It seems like $originalRequest->getServiceProvider() targeting Surfnet\SamlBundle\SAML2...t::getServiceProvider() can also be of type null or object<SAML2\XML\saml\Issuer>; however, Surfnet\StepupGateway\Ga...equestServiceProvider() does only seem to accept string, maybe add an additional type check?

This check looks at variables that are passed out again to other methods.

If the outgoing method call has stricter type requirements than the method itself, an issue is raised.

An additional type check may prevent trouble.

Loading history...
67
            ->setRelayState($httpRequest->get(AuthnRequest::PARAMETER_RELAY_STATE, ''))
68
            ->setResponseAction('SurfnetStepupGatewayGatewayBundle:Gateway:respond')
69
            ->setResponseContextServiceId(static::RESPONSE_CONTEXT_SERVICE_ID);
70
71
        // check if the requested Loa is supported
72
        $requiredLoa = $originalRequest->getAuthenticationContextClassRef();
73
        if ($requiredLoa && !$this->get('surfnet_stepup.service.loa_resolution')->hasLoa($requiredLoa)) {
74
            $logger->info(sprintf(
75
                'Requested required Loa "%s" does not exist, sending response with status Requester Error',
76
                $requiredLoa
77
            ));
78
79
            $response = $this->createRequesterFailureResponse();
80
81
            return $this->renderSamlResponse('consumeAssertion', $response);
82
        }
83
84
        $stateHandler->setRequiredLoaIdentifier($requiredLoa);
85
86
        $proxyRequest = AuthnRequestFactory::createNewRequest(
87
            $this->get('surfnet_saml.hosted.service_provider'),
88
            $this->get('surfnet_saml.remote.idp')
89
        );
90
91
        $proxyRequest->setScoping([$originalRequest->getServiceProvider()]);
92
        $stateHandler->setGatewayRequestId($proxyRequest->getRequestId());
93
94
        $logger->notice(sprintf(
95
            'Sending Proxy AuthnRequest with request ID: "%s" for original AuthnRequest "%s"',
96
            $proxyRequest->getRequestId(),
97
            $originalRequest->getRequestId()
98
        ));
99
100
        return $redirectBinding->createResponseFor($proxyRequest);
101
    }
102
103
    public function proxySsoAction()
104
    {
105
        throw new HttpException(418, 'Not Yet Implemented');
106
    }
107
108
    /**
109
     * @param Request $request
110
     * @return \Symfony\Component\HttpFoundation\Response
111
     */
112
    public function consumeAssertionAction(Request $request)
113
    {
114
        $responseContext = $this->getResponseContext();
115
        $originalRequestId = $responseContext->getInResponseTo();
116
117
        /** @var \Surfnet\SamlBundle\Monolog\SamlAuthenticationLogger $logger */
118
        $logger = $this->get('surfnet_saml.logger')->forAuthentication($originalRequestId);
119
        $logger->notice('Received SAMLResponse, attempting to process for Proxy Response');
120
121
        try {
122
            /** @var \SAML2\Assertion $assertion */
123
            $assertion = $this->get('surfnet_saml.http.post_binding')->processResponse(
124
                $request,
125
                $this->get('surfnet_saml.remote.idp'),
126
                $this->get('surfnet_saml.hosted.service_provider')
127
            );
128
        } catch (Exception $exception) {
129
            $logger->error(sprintf('Could not process received Response, error: "%s"', $exception->getMessage()));
130
131
            $response = $this->createResponseFailureResponse($responseContext);
132
133
            return $this->renderSamlResponse('unprocessableResponse', $response);
134
        }
135
136
        $adaptedAssertion = new AssertionAdapter($assertion);
137
        $expectedInResponseTo = $responseContext->getExpectedInResponseTo();
138
        if (!$adaptedAssertion->inResponseToMatches($expectedInResponseTo)) {
139
            throw new UnknownInResponseToException(
140
                $adaptedAssertion->getInResponseTo(),
141
                $expectedInResponseTo
142
            );
143
        }
144
145
        $logger->notice('Successfully processed SAMLResponse');
146
147
        $responseContext->saveAssertion($assertion);
148
149
        $logger->notice(sprintf('Forwarding to second factor controller for loa determination and handling'));
150
151
        return $this->forward('SurfnetStepupGatewayGatewayBundle:SecondFactor:selectSecondFactorForVerification');
152
    }
153
154
    public function respondAction()
155
    {
156
        $responseContext = $this->getResponseContext();
157
        $originalRequestId = $responseContext->getInResponseTo();
158
159
        /** @var \Surfnet\SamlBundle\Monolog\SamlAuthenticationLogger $logger */
160
        $logger = $this->get('surfnet_saml.logger')->forAuthentication($originalRequestId);
161
        $logger->notice('Creating Response');
162
163
        $grantedLoa = null;
164
        if ($responseContext->isSecondFactorVerified()) {
165
            $secondFactor = $this->get('gateway.service.second_factor_service')->findByUuid(
166
                $responseContext->getSelectedSecondFactor()
167
            );
168
169
            $secondFactorTypeService = $this->get('surfnet_stepup.service.second_factor_type');
170
            $grantedLoa = $this->get('surfnet_stepup.service.loa_resolution')->getLoaByLevel(
171
                $secondFactor->getLoaLevel($secondFactorTypeService)
172
            );
173
        }
174
175
        /** @var \Surfnet\StepupGateway\GatewayBundle\Service\ProxyResponseService $proxyResponseService */
176
        $proxyResponseService = $this->get('gateway.service.response_proxy');
177
178
        $response = $proxyResponseService->createProxyResponse(
179
            $responseContext->reconstituteAssertion(),
180
            $responseContext->getServiceProvider(),
0 ignored issues
show
Bug introduced by
It seems like $responseContext->getServiceProvider() can be null; however, createProxyResponse() does not accept null, maybe add an additional type check?

Unless you are absolutely sure that the expression can never be null because of other conditions, we strongly recommend to add an additional type check to your code:

/** @return stdClass|null */
function mayReturnNull() { }

function doesNotAcceptNull(stdClass $x) { }

// With potential error.
function withoutCheck() {
    $x = mayReturnNull();
    doesNotAcceptNull($x); // Potential error here.
}

// Safe - Alternative 1
function withCheck1() {
    $x = mayReturnNull();
    if ( ! $x instanceof stdClass) {
        throw new \LogicException('$x must be defined.');
    }
    doesNotAcceptNull($x);
}

// Safe - Alternative 2
function withCheck2() {
    $x = mayReturnNull();
    if ($x instanceof stdClass) {
        doesNotAcceptNull($x);
    }
}
Loading history...
181
            (string)$grantedLoa
182
        );
183
184
        $responseContext->responseSent();
185
186
        $logger->notice(sprintf(
187
            'Responding to request "%s" with response based on response from the remote IdP with response "%s"',
188
            $responseContext->getInResponseTo(),
189
            $response->getId()
190
        ));
191
192
        return $this->renderSamlResponse('consumeAssertion', $response);
193
    }
194
195 View Code Duplication
    public function sendLoaCannotBeGivenAction()
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
196
    {
197
        $responseContext = $this->getResponseContext();
198
        $originalRequestId = $responseContext->getInResponseTo();
199
200
        /** @var \Surfnet\SamlBundle\Monolog\SamlAuthenticationLogger $logger */
201
        $logger = $this->get('surfnet_saml.logger')->forAuthentication($originalRequestId);
202
        $logger->notice('Loa cannot be given, creating Response with NoAuthnContext status');
203
204
        /** @var \Surfnet\StepupGateway\GatewayBundle\Saml\ResponseBuilder $responseBuilder */
205
        $responseBuilder = $this->get('gateway.proxy.response_builder');
206
207
        $response = $responseBuilder
208
            ->createNewResponse($responseContext)
209
            ->setResponseStatus(Constants::STATUS_RESPONDER, Constants::STATUS_NO_AUTHN_CONTEXT)
210
            ->get();
211
212
        $logger->notice(sprintf(
213
            'Responding to request "%s" with response based on response from the remote IdP with response "%s"',
214
            $responseContext->getInResponseTo(),
215
            $response->getId()
216
        ));
217
218
        return $this->renderSamlResponse('consumeAssertion', $response);
219
    }
220
221 View Code Duplication
    public function sendAuthenticationCancelledByUserAction()
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
222
    {
223
        $responseContext = $this->getResponseContext();
224
        $originalRequestId = $responseContext->getInResponseTo();
225
226
        /** @var \Surfnet\SamlBundle\Monolog\SamlAuthenticationLogger $logger */
227
        $logger = $this->get('surfnet_saml.logger')->forAuthentication($originalRequestId);
228
        $logger->notice('Authentication was cancelled by the user, creating Response with AuthnFailed status');
229
230
        /** @var \Surfnet\StepupGateway\GatewayBundle\Saml\ResponseBuilder $responseBuilder */
231
        $responseBuilder = $this->get('gateway.proxy.response_builder');
232
233
        $response = $responseBuilder
234
            ->createNewResponse($responseContext)
235
            ->setResponseStatus(
236
                Constants::STATUS_RESPONDER,
237
                Constants::STATUS_AUTHN_FAILED,
238
                'Authentication cancelled by user'
239
            )
240
            ->get();
241
242
        $logger->notice(sprintf(
243
            'Responding to request "%s" with response based on response from the remote IdP with response "%s"',
244
            $responseContext->getInResponseTo(),
245
            $response->getId()
246
        ));
247
248
        return $this->renderSamlResponse('consumeAssertion', $response);
249
    }
250
251
    /**
252
     * @param string         $view
253
     * @param SAMLResponse $response
254
     * @return Response
255
     */
256 View Code Duplication
    public function renderSamlResponse($view, SAMLResponse $response)
0 ignored issues
show
Duplication introduced by
This method seems to be duplicated in your project.

Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation.

You can also find more detailed suggestions in the “Code” section of your repository.

Loading history...
257
    {
258
        $responseContext = $this->getResponseContext();
259
260
        return $this->render($view, [
261
            'acu'        => $responseContext->getDestination(),
262
            'response'   => $this->getResponseAsXML($response),
263
            'relayState' => $responseContext->getRelayState()
264
        ]);
265
    }
266
267
    /**
268
     * @param string   $view
269
     * @param array    $parameters
270
     * @param Response $response
0 ignored issues
show
Documentation introduced by
Should the type for parameter $response not be null|Response?

This check looks for @param annotations where the type inferred by our type inference engine differs from the declared type.

It makes a suggestion as to what type it considers more descriptive.

Most often this is a case of a parameter that can be null in addition to its declared types.

Loading history...
271
     * @return Response
272
     */
273
    public function render($view, array $parameters = array(), Response $response = null)
274
    {
275
        return parent::render(
276
            'SurfnetStepupGatewayGatewayBundle:Gateway:' . $view . '.html.twig',
277
            $parameters,
278
            $response
279
        );
280
    }
281
282
    /**
283
     * @return \Surfnet\StepupGateway\GatewayBundle\Saml\ResponseContext
284
     */
285
    public function getResponseContext()
286
    {
287
        $stateHandler = $this->get('gateway.proxy.state_handler');
288
        $responseContextServiceId = $stateHandler->getResponseContextServiceId();
289
290
        if (!$responseContextServiceId) {
291
            return $this->get(static::RESPONSE_CONTEXT_SERVICE_ID);
292
        }
293
294
        return $this->get($responseContextServiceId);
295
    }
296
297
    /**
298
     * @param SAMLResponse $response
299
     * @return string
300
     */
301
    private function getResponseAsXML(SAMLResponse $response)
302
    {
303
        return base64_encode($response->toUnsignedXML()->ownerDocument->saveXML());
304
    }
305
306
    /**
307
     * @return SAMLResponse
308
     */
309
    private function createRequesterFailureResponse()
310
    {
311
        /** @var \Surfnet\StepupGateway\GatewayBundle\Saml\ResponseBuilder $responseBuilder */
312
        $responseBuilder = $this->get('gateway.proxy.response_builder');
313
        $context = $this->getResponseContext();
314
315
        $response = $responseBuilder
316
            ->createNewResponse($context)
317
            ->setResponseStatus(Constants::STATUS_REQUESTER, Constants::STATUS_REQUEST_UNSUPPORTED)
318
            ->get();
319
320
        return $response;
321
322
    }
323
324
    /**
325
     * @param $context
326
     * @return SAMLResponse
327
     */
328
    private function createResponseFailureResponse($context)
329
    {
330
        /** @var \Surfnet\StepupGateway\GatewayBundle\Saml\ResponseBuilder $responseBuilder */
331
        $responseBuilder = $this->get('gateway.proxy.response_builder');
332
333
        $response = $responseBuilder
334
            ->createNewResponse($context)
335
            ->setResponseStatus(Constants::STATUS_RESPONDER)
336
            ->get();
337
338
        return $response;
339
    }
340
}
341