Surfnet\StepupGateway\GatewayBundle\Entity\ServiceProvider

Complexity

Total Complexity

13

Size/Duplication

Total Lines	124
Duplicated Lines	0 %

Coupling/Cohesion

Components	1
Dependencies	4

Importance

Changes

0

5 Methods

Rating	Name	Duplication	Size	Complexity
A	mayUseGateway()	0	4	1
A	mayUseSecondFactorOnly()	0	4	1
B	isAllowedToUseSecondFactorOnlyFor()	0	22	6
A	determineAcsLocation()	0	18	2
A	determineAcsLocationforAdfs()	0	17	3

<?php

/**
 * Copyright 2014 SURFnet bv
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

namespace Surfnet\StepupGateway\GatewayBundle\Entity;

use Psr\Log\LoggerInterface;
use Surfnet\SamlBundle\Entity\ServiceProvider as BaseServiceProvider;
use Surfnet\StepupGateway\GatewayBundle\Exception\InvalidArgumentException;
use Surfnet\StepupGateway\SecondFactorOnlyBundle\Adfs\Exception\AcsLocationNotAllowedException;

class ServiceProvider extends BaseServiceProvider
{
    /**
     * @return bool
     */
    public function mayUseGateway()
    {
        return !$this->mayUseSecondFactorOnly();
    }

    /**
     * @return bool
     */
    public function mayUseSecondFactorOnly()
    {
        return (bool) $this->get('secondFactorOnly', false);
    }

    /**
     * @param string $nameId
     * @return bool
     */
    public function isAllowedToUseSecondFactorOnlyFor($nameId)
    {
        if (!is_string($nameId)) {
            throw InvalidArgumentException::invalidType('string', 'nameId', $nameId);
        }

        if (empty($nameId)) {
            return false;
        }

        if (!$this->mayUseSecondFactorOnly()) {
            return false;
        }

        $nameIdPatterns = $this->get('secondFactorOnlyNameIdPatterns');
        foreach ($nameIdPatterns as $nameIdPattern) {
            if ((bool) preg_match('#^' . strtr(preg_quote($nameIdPattern, '#'), ['\*' => '.*']) . '$#', $nameId)) {
                return true;
            }
        }
        return false;
    }

    /**
     * Determine the ACS location to send the response to.
     *
     * The get getAssertionConsumerUrl() method returns a trusted ACS location
     * for this service provider. This value is set when the service provider
     * is "internal", for example when it is configured in yaml
     * configuration.
     *
     * Methods like Surfnet\SamlBundle\Http\PostBinding::processResponse use
     * this trusted value. When the ServiceProvider is external, this value is
     * empty and the ACS location found in the AuthnRequest should be used, if
     * it matches one of the configured allowed ACS locations for the service
     * provider. This methods checks if a given URL matches the allowed URLs.
     *
     * @param LoggerInterface $logger
     * @param $acsLocationInAuthnRequest
     * @return string
     */
    public function determineAcsLocation(LoggerInterface $logger, $acsLocationInAuthnRequest)
    {
        // List of allowed ACS locations configured in middleware.
        $allowedAcsLocations = $this->get('allowedAcsLocations');

        if (in_array($acsLocationInAuthnRequest, $allowedAcsLocations)) {
            return $acsLocationInAuthnRequest;
        }

        $logger->warning(
            sprintf(
                'AuthnRequest requests ACS location "%s" but it is not configured in the list of allowed ACS locations',
                $acsLocationInAuthnRequest
            )
        );

        return reset($allowedAcsLocations);
    }

    /**
     * Determine the ACS location for ADFS to send the response to.
     *
     * This method is similar to determineAcsLocation(), but does not check
     * for the requested ACS location to be identical to one of the configured
     * ACS locations, but only if matches the first part of an allowed URL.
     *
     * For example, ADFS might send an ACS location like:
     *
     *     https://example.com/consume-assertion?key=value
     *
     * Above URL is allowed if one of the configured URLs is:
     *
     *     https://example.com/consume-assertion
     *
     * Or:
     *
     *     https://example.com/consume
     *
     *
     * @param LoggerInterface $logger
     * @param $acsLocationInAuthnRequest
     * @return string
     */
    public function determineAcsLocationforAdfs(LoggerInterface $logger, $acsLocationInAuthnRequest)

The parameter $logger is not used and could be removed.

    {
        // List of allowed ACS locations configured in middleware.
        $allowedAcsLocations = $this->get('allowedAcsLocations');

        foreach ($allowedAcsLocations as $allowedAcsLocation) {
            if (strpos($acsLocationInAuthnRequest, $allowedAcsLocation) === 0) {
                return $acsLocationInAuthnRequest;
            }
        }

        // The exception listener will log relevant information to the log.

        throw new AcsLocationNotAllowedException(
            $acsLocationInAuthnRequest
        );
    }
}