OpenConext /
Stepup-Gateway
Duplicate code is one of the most pungent code smells. A rule that is often used is to re-structure code once it is duplicated in three or more places.
Common duplication problems, and corresponding solutions are:
| 1 | <?php |
||
| 45 | class SamlProxyController extends Controller |
||
| 46 | { |
||
| 47 | /** |
||
| 48 | * @param string $provider |
||
| 49 | * @param Request $httpRequest |
||
| 50 | * @return \Symfony\Component\HttpFoundation\RedirectResponse|\Symfony\Component\HttpFoundation\Response |
||
| 51 | */ |
||
| 52 | public function singleSignOnAction($provider, Request $httpRequest) |
||
| 53 | { |
||
| 54 | $provider = $this->getProvider($provider); |
||
| 55 | |||
| 56 | $logger = $this->get('logger'); |
||
| 57 | $logger->notice('Received AuthnRequest, started processing'); |
||
| 58 | |||
| 59 | /** @var \Surfnet\SamlBundle\Http\RedirectBinding $redirectBinding */ |
||
| 60 | $redirectBinding = $this->get('surfnet_saml.http.redirect_binding'); |
||
| 61 | |||
| 62 | $originalRequest = $redirectBinding->processSignedRequest($httpRequest); |
||
| 63 | |||
| 64 | $originalRequestId = $originalRequest->getRequestId(); |
||
| 65 | $logger = $this->get('surfnet_saml.logger')->forAuthentication($originalRequestId); |
||
| 66 | $logger->notice(sprintf( |
||
| 67 | 'AuthnRequest processing complete, received AuthnRequest from "%s", request ID: "%s"', |
||
| 68 | $originalRequest->getServiceProvider(), |
||
| 69 | $originalRequest->getRequestId() |
||
| 70 | )); |
||
| 71 | |||
| 72 | $logger->debug('Checking if SP "%s" is supported'); |
||
| 73 | /** |
||
| 74 | * @var \Surfnet\StepupGateway\SamlStepupProviderBundle\Provider\ConnectedServiceProviders $connectedServiceProviders |
||
|
|
|||
| 75 | */ |
||
| 76 | $connectedServiceProviders = $this->get('gssp.connected_service_providers'); |
||
| 77 | if (!$connectedServiceProviders->isConnected($originalRequest->getServiceProvider())) { |
||
| 78 | $logger->warning(sprintf( |
||
| 79 | 'Received AuthnRequest from SP "%s", while SP is not allowed to use this for SSO', |
||
| 80 | $originalRequest->getServiceProvider() |
||
| 81 | )); |
||
| 82 | |||
| 83 | throw new AccessDeniedHttpException(); |
||
| 84 | } |
||
| 85 | |||
| 86 | /** @var StateHandler $stateHandler */ |
||
| 87 | $stateHandler = $provider->getStateHandler(); |
||
| 88 | |||
| 89 | // Clear the state of the previous SSO action. Request data of |
||
| 90 | // previous SSO actions should not have any effect in subsequent SSO |
||
| 91 | // actions. |
||
| 92 | $stateHandler->clear(); |
||
| 93 | |||
| 94 | $stateHandler |
||
| 95 | ->setRequestId($originalRequestId) |
||
| 96 | ->setRequestServiceProvider($originalRequest->getServiceProvider()) |
||
| 97 | ->setRequestAssertionConsumerServiceUrl($originalRequest->getAssertionConsumerServiceURL()) |
||
| 98 | ->setRelayState($httpRequest->get(AuthnRequest::PARAMETER_RELAY_STATE, '')); |
||
| 99 | |||
| 100 | $proxyRequest = AuthnRequestFactory::createNewRequest( |
||
| 101 | $provider->getServiceProvider(), |
||
| 102 | $provider->getRemoteIdentityProvider() |
||
| 103 | ); |
||
| 104 | |||
| 105 | // if a Specific subject is given to authenticate we should proxy that and verify in the response |
||
| 106 | // that that subject indeed was authenticated |
||
| 107 | $nameId = $originalRequest->getNameId(); |
||
| 108 | if ($nameId) { |
||
| 109 | $proxyRequest->setSubject($nameId, $originalRequest->getNameIdFormat()); |
||
| 110 | $stateHandler->setSubject($nameId); |
||
| 111 | } |
||
| 112 | |||
| 113 | $proxyRequest->setScoping([$originalRequest->getServiceProvider()]); |
||
| 114 | $stateHandler->setGatewayRequestId($proxyRequest->getRequestId()); |
||
| 115 | |||
| 116 | $logger->notice(sprintf( |
||
| 117 | 'Sending Proxy AuthnRequest with request ID: "%s" for original AuthnRequest "%s" to GSSP "%s" at "%s"', |
||
| 118 | $proxyRequest->getRequestId(), |
||
| 119 | $originalRequest->getRequestId(), |
||
| 120 | $provider->getName(), |
||
| 121 | $provider->getRemoteIdentityProvider()->getSsoUrl() |
||
| 122 | )); |
||
| 123 | |||
| 124 | return $redirectBinding->createResponseFor($proxyRequest); |
||
| 125 | } |
||
| 126 | |||
| 127 | public function sendSecondFactorVerificationAuthnRequestAction($provider, $subjectNameId) |
||
| 161 | |||
| 162 | /** |
||
| 163 | * @param string $provider |
||
| 164 | * @param Request $httpRequest |
||
| 165 | * @return \Symfony\Component\HttpFoundation\Response |
||
| 166 | */ |
||
| 167 | public function consumeAssertionAction($provider, Request $httpRequest) |
||
| 254 | |||
| 255 | /** |
||
| 256 | * @param string $provider |
||
| 257 | * @return XMLResponse |
||
| 258 | */ |
||
| 259 | public function metadataAction($provider) |
||
| 268 | |||
| 269 | /** |
||
| 270 | * @param string $provider |
||
| 271 | * @return \Surfnet\StepupGateway\SamlStepupProviderBundle\Provider\Provider |
||
| 272 | */ |
||
| 273 | private function getProvider($provider) |
||
| 286 | |||
| 287 | /** |
||
| 288 | * @param string $view |
||
| 289 | * @param StateHandler $stateHandler |
||
| 290 | * @param SAMLResponse $response |
||
| 291 | * @return Response |
||
| 292 | */ |
||
| 293 | View Code Duplication | public function renderSamlResponse($view, StateHandler $stateHandler, SAMLResponse $response) |
|
| 306 | |||
| 307 | /** |
||
| 308 | * @param string $view |
||
| 309 | * @param array $parameters |
||
| 310 | * @param Response $response |
||
| 311 | * @return Response |
||
| 312 | */ |
||
| 313 | public function render($view, array $parameters = array(), Response $response = null) |
||
| 321 | |||
| 322 | /** |
||
| 323 | * @param SAMLResponse $response |
||
| 324 | * @return string |
||
| 325 | */ |
||
| 326 | private function getResponseAsXML(SAMLResponse $response) |
||
| 330 | |||
| 331 | /** |
||
| 332 | * Response that indicates that an error occurred in the responder (the gateway). Used to indicate that we could |
||
| 333 | * not process the response we received from the upstream GSSP |
||
| 334 | * |
||
| 335 | * @param Provider $provider |
||
| 336 | * @return SAMLResponse |
||
| 337 | */ |
||
| 338 | private function createResponseFailureResponse(Provider $provider) |
||
| 345 | |||
| 346 | /** |
||
| 347 | * Response that indicates that the authentication could not be performed correctly. In this context it means |
||
| 348 | * that the upstream GSSP did not responsd with the same NameID as we request to authenticate in the AuthnRequest |
||
| 349 | * |
||
| 350 | * @param Provider $provider |
||
| 351 | * @return SAMLResponse |
||
| 352 | */ |
||
| 353 | private function createAuthnFailedResponse(Provider $provider) |
||
| 363 | |||
| 364 | /** |
||
| 365 | * Creates a standard response with default status Code (success) |
||
| 366 | * |
||
| 367 | * @param Provider $provider |
||
| 368 | * @return SAMLResponse |
||
| 369 | */ |
||
| 370 | private function createResponse(Provider $provider) |
||
| 382 | } |
||
| 383 |
Loading history...
Overly long lines are hard to read on any screen. Most code styles therefor impose a maximum limit on the number of characters in a line.