ServiceProvider::isAllowedToUseSecondFactorOnlyFor() - Code Metrics - Inspection of "Address some remaining SSO on 2FA issues" - OpenConext/Stepup-Gateway - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Pull Request — develop (#295)

by Peter

created 2023-09-07 06:58 UTC

isAllowedToUseSecondFactorOnlyFor() A

↳ Parent: ServiceProvider

Complexity

Conditions	6
Paths	6

Size

Total Lines	21
Code Lines	11

Duplication

Lines	0
Ratio	0 %

Importance

Changes

Metric	Value
cc	6
eloc	11
nc	6
nop	1
dl	0
loc	21
rs	9.2222
c	0
b	0
f	0

<?php

/**
 * Copyright 2014 SURFnet bv
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */


namespace Surfnet\StepupGateway\GatewayBundle\Entity;

use Psr\Log\LoggerInterface;
use Surfnet\SamlBundle\Entity\ServiceProvider as BaseServiceProvider;
use Surfnet\StepupGateway\GatewayBundle\Exception\InvalidArgumentException;
use Surfnet\StepupGateway\SecondFactorOnlyBundle\Adfs\Exception\AcsLocationNotAllowedException;

class ServiceProvider extends BaseServiceProvider

{
    /**

     * @return bool
     */
    public function mayUseGateway()
    {
        return !$this->mayUseSecondFactorOnly();
    }

    /**

     * @return bool
     */
    public function mayUseSecondFactorOnly()
    {
        return (bool) $this->get('secondFactorOnly', false);
    }

    /**

     * @param string $nameId

     * @return bool

     */
    public function isAllowedToUseSecondFactorOnlyFor($nameId)
    {
        if (!is_string($nameId)) {

            throw InvalidArgumentException::invalidType('string', 'nameId', $nameId);
        }

        if (empty($nameId)) {
            return false;
        }

        if (!$this->mayUseSecondFactorOnly()) {
            return false;
        }

        $nameIdPatterns = $this->get('secondFactorOnlyNameIdPatterns');
        foreach ($nameIdPatterns as $nameIdPattern) {
            if ((bool) preg_match('#^' . strtr(preg_quote($nameIdPattern, '#'), ['\*' => '.*']) . '$#', $nameId)) {
                return true;
            }
        }
        return false;
    }

    /**
     * Determine the ACS location to send the response to.
     *
     * The get getAssertionConsumerUrl() method returns a trusted ACS location
     * for this service provider. This value is set when the service provider
     * is "internal", for example when it is configured in yaml
     * configuration.
     *
     * Methods like Surfnet\SamlBundle\Http\PostBinding::processResponse use
     * this trusted value. When the ServiceProvider is external, this value is
     * empty and the ACS location found in the AuthnRequest should be used, if
     * it matches one of the configured allowed ACS locations for the service
     * provider. This methods checks if a given URL matches the allowed URLs.
     *
     * @param $acsLocationInAuthnRequest

     * @param LoggerInterface $logger Optional

     * @return string

     */
    public function determineAcsLocation($acsLocationInAuthnRequest, LoggerInterface $logger = null)
    {
        // List of allowed ACS locations configured in middleware.
        $allowedAcsLocations = $this->get('allowedAcsLocations');

        if (in_array($acsLocationInAuthnRequest, $allowedAcsLocations)) {
        if (in_array($acsLocationInAuthnRequest, /** @scrutinizer ignore-type */ $allowedAcsLocations)) {
            return $acsLocationInAuthnRequest;
        }

        if ($logger !== null) {
            $logger->warning(
                sprintf(
                    'AuthnRequest requests ACS location "%s" but it is not configured in the list of allowed ACS ' .
                    'locations, allowed locations include: [%s]',
                    $acsLocationInAuthnRequest,
                    implode($allowedAcsLocations, ', ')
                    implode($allowedAcsLocations, /** @scrutinizer ignore-type */ ', ')
                )
            );
        }

        return reset($allowedAcsLocations);
        return reset(/** @scrutinizer ignore-type */ $allowedAcsLocations);
    }

    /**
     * Determine the ACS location for ADFS to send the response to.
     *
     * This method is similar to determineAcsLocation(), but does not check
     * for the requested ACS location to be identical to one of the configured
     * ACS locations, but only if matches the first part of an allowed URL.
     *
     * For example, ADFS might send an ACS location like:
     *
     *     https://example.com/consume-assertion?key=value
     *
     * Above URL is allowed if one of the configured URLs is:
     *
     *     https://example.com/consume-assertion
     *
     * Or:
     *
     *     https://example.com/consume
     *
     *
     * @param $acsLocationInAuthnRequest

     * @return string

     */
    public function determineAcsLocationForAdfs($acsLocationInAuthnRequest)
    {
        // List of allowed ACS locations configured in middleware.
        $allowedAcsLocations = $this->get('allowedAcsLocations');

        foreach ($allowedAcsLocations as $allowedAcsLocation) {
            if (strpos($acsLocationInAuthnRequest, $allowedAcsLocation) === 0) {
                return $acsLocationInAuthnRequest;
            }
        }

        // The exception listener will log relevant information to the log.

        throw new AcsLocationNotAllowedException(
            $acsLocationInAuthnRequest
        );
    }

    public function allowSsoOn2fa(): bool

    {
        return $this->get('allowSsoOn2fa');
    }

    public function allowedToSetSsoCookieOn2fa(): bool

    {
        return $this->get('setSsoCookieOn2fa');
    }
}


OpenConext / Stepup-Gateway

Pull Request — develop (#295)

isAllowedToUseSecondFactorOnlyFor() A

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like