|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace Surfnet\StepupGateway\SamlStepupProviderBundle\Service\Gateway; |
|
4
|
|
|
|
|
5
|
|
|
use Surfnet\SamlBundle\Monolog\SamlAuthenticationLogger; |
|
6
|
|
|
use Surfnet\SamlBundle\SAML2\AuthnRequest; |
|
7
|
|
|
use Surfnet\SamlBundle\SAML2\AuthnRequestFactory; |
|
8
|
|
|
use Surfnet\StepupGateway\GatewayBundle\Saml\ResponseContext; |
|
9
|
|
|
use Surfnet\StepupGateway\SamlStepupProviderBundle\Provider\Provider; |
|
10
|
|
|
|
|
11
|
|
|
class SecondFactorVerificationService |
|
12
|
|
|
{ |
|
13
|
|
|
/** @var SamlAuthenticationLogger */ |
|
14
|
|
|
private $samlLogger; |
|
15
|
|
|
|
|
16
|
|
|
/** @var ResponseContext */ |
|
17
|
|
|
private $responseContext; |
|
18
|
|
|
|
|
19
|
|
|
/** |
|
20
|
|
|
* SecondFactorVerificationService constructor. |
|
21
|
|
|
* @param SamlAuthenticationLogger $samlLogger |
|
22
|
|
|
* @param ResponseContext $responseContext |
|
23
|
|
|
*/ |
|
24
|
|
|
public function __construct(SamlAuthenticationLogger $samlLogger, ResponseContext $responseContext) |
|
25
|
|
|
{ |
|
26
|
|
|
$this->samlLogger = $samlLogger; |
|
27
|
|
|
$this->responseContext = $responseContext; |
|
28
|
|
|
} |
|
29
|
|
|
|
|
30
|
|
|
/** |
|
31
|
|
|
* Proxy a GSSP authentication request for use in the remote GSSP SSO endpoint. |
|
32
|
|
|
* |
|
33
|
|
|
* The user is about to be sent to the remote GSSP application for |
|
34
|
|
|
* registration. Verification is not initiated with a SAML AUthnRequest, |
|
35
|
|
|
* |
|
36
|
|
|
* The service provider in this context is SelfService (when registering |
|
37
|
|
|
* a token) or RA (when vetting a token). |
|
38
|
|
|
* |
|
39
|
|
|
* @param Provider $provider |
|
40
|
|
|
* @param string $subjectNameId |
|
41
|
|
|
* @return AuthnRequest |
|
42
|
|
|
*/ |
|
43
|
|
|
public function sendSecondFactorVerificationAuthnRequest(Provider $provider, $subjectNameId) |
|
44
|
|
|
{ |
|
45
|
|
|
$stateHandler = $provider->getStateHandler(); |
|
46
|
|
|
|
|
47
|
|
|
$originalRequestId = $this->responseContext->getInResponseTo(); |
|
48
|
|
|
|
|
49
|
|
|
$authnRequest = AuthnRequestFactory::createNewRequest( |
|
50
|
|
|
$provider->getServiceProvider(), |
|
51
|
|
|
$provider->getRemoteIdentityProvider() |
|
52
|
|
|
); |
|
53
|
|
|
$authnRequest->setSubject($subjectNameId); |
|
54
|
|
|
|
|
55
|
|
|
$stateHandler |
|
56
|
|
|
->setRequestId($originalRequestId) |
|
57
|
|
|
->setGatewayRequestId($authnRequest->getRequestId()) |
|
58
|
|
|
->setSubject($subjectNameId) |
|
59
|
|
|
->markRequestAsSecondFactorVerification(); |
|
60
|
|
|
|
|
61
|
|
|
/** @var \Surfnet\SamlBundle\Monolog\SamlAuthenticationLogger $logger */ |
|
62
|
|
|
$logger = $this->samlLogger->forAuthentication($originalRequestId); |
|
63
|
|
|
$logger->notice(sprintf( |
|
64
|
|
|
'Sending AuthnRequest to verify Second Factor with request ID: "%s" to GSSP "%s" at "%s" for subject "%s"', |
|
65
|
|
|
$authnRequest->getRequestId(), |
|
66
|
|
|
$provider->getName(), |
|
67
|
|
|
$provider->getRemoteIdentityProvider()->getSsoUrl(), |
|
68
|
|
|
$subjectNameId |
|
69
|
|
|
)); |
|
70
|
|
|
|
|
71
|
|
|
return $authnRequest; |
|
72
|
|
|
} |
|
73
|
|
|
} |
|
74
|
|
|
|
OpenConext /
Stepup-Gateway
