1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
/** |
4
|
|
|
* Copyright 2014 SURFnet bv |
5
|
|
|
* |
6
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
7
|
|
|
* you may not use this file except in compliance with the License. |
8
|
|
|
* You may obtain a copy of the License at |
9
|
|
|
* |
10
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0 |
11
|
|
|
* |
12
|
|
|
* Unless required by applicable law or agreed to in writing, software |
13
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS, |
14
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
15
|
|
|
* See the License for the specific language governing permissions and |
16
|
|
|
* limitations under the License. |
17
|
|
|
*/ |
18
|
|
|
|
19
|
|
|
namespace Surfnet\StepupRa\RaBundle\DependencyInjection; |
20
|
|
|
|
21
|
|
|
use Symfony\Component\Config\Definition\Builder\NodeBuilder; |
22
|
|
|
use Symfony\Component\Config\Definition\Builder\TreeBuilder; |
23
|
|
|
use Symfony\Component\Config\Definition\ConfigurationInterface; |
24
|
|
|
|
25
|
|
|
class Configuration implements ConfigurationInterface |
26
|
|
|
{ |
27
|
|
|
/** |
28
|
|
|
* {@inheritdoc} |
29
|
|
|
*/ |
30
|
|
|
public function getConfigTreeBuilder() |
31
|
|
|
{ |
32
|
|
|
$treeBuilder = new TreeBuilder(); |
|
|
|
|
33
|
|
|
$rootNode = $treeBuilder->root('surfnet_stepup_ra_ra'); |
|
|
|
|
34
|
|
|
|
35
|
|
|
$childNodes = $rootNode->children(); |
36
|
|
|
$this->appendLoaConfiguration($childNodes); |
37
|
|
|
$this->appendSecondFactorTypesConfiguration($childNodes); |
38
|
|
|
$this->appendSessionConfiguration($childNodes); |
39
|
|
|
$this->appendUrlConfiguration($childNodes); |
40
|
|
|
|
41
|
|
|
return $treeBuilder; |
42
|
|
|
} |
43
|
|
|
|
44
|
|
|
private function appendLoaConfiguration(NodeBuilder $childNodes) |
45
|
|
|
{ |
46
|
|
|
$childNodes |
47
|
|
|
->scalarNode('required_loa') |
48
|
|
|
->info('The required LOA to be able to log in, should match the loa defined at the gateway') |
49
|
|
|
->isRequired() |
50
|
|
|
->validate() |
51
|
|
|
->ifTrue(function ($value) { |
52
|
|
|
return !is_string($value); |
53
|
|
|
}) |
54
|
|
|
->thenInvalid('the required loa must be a string') |
55
|
|
|
->end() |
56
|
|
|
->end(); |
57
|
|
|
} |
58
|
|
|
|
59
|
|
|
/** |
60
|
|
|
* @param NodeBuilder $childNodes |
61
|
|
|
*/ |
62
|
|
|
private function appendSecondFactorTypesConfiguration(NodeBuilder $childNodes) |
63
|
|
|
{ |
64
|
|
|
$childNodes |
65
|
|
|
->arrayNode('enabled_second_factors') |
66
|
|
|
->isRequired() |
67
|
|
|
->prototype('scalar') |
68
|
|
|
->end(); |
69
|
|
|
$childNodes |
70
|
|
|
->arrayNode('enabled_generic_second_factors') |
71
|
|
|
->isRequired() |
72
|
|
|
->prototype('array') |
73
|
|
|
->children() |
74
|
|
|
->scalarNode('loa') |
75
|
|
|
->isRequired() |
76
|
|
|
->info('The lao level of the Gssf') |
77
|
|
|
->end() |
78
|
|
|
->end(); |
79
|
|
|
} |
80
|
|
|
|
81
|
|
|
/** |
82
|
|
|
* @param NodeBuilder $childNodes |
83
|
|
|
*/ |
84
|
|
|
private function appendSessionConfiguration(NodeBuilder $childNodes) |
85
|
|
|
{ |
86
|
|
|
$childNodes |
87
|
|
|
->arrayNode('session_lifetimes') |
88
|
|
|
->isRequired() |
89
|
|
|
->children() |
90
|
|
|
->integerNode('max_absolute_lifetime') |
91
|
|
|
->isRequired() |
92
|
|
|
->defaultValue(3600) |
93
|
|
|
->info('The maximum lifetime of a session regardless of interaction by the user, in seconds.') |
94
|
|
|
->example('3600 -> 1 hour * 60 minutes * 60 seconds') |
95
|
|
|
->validate() |
96
|
|
|
->ifTrue( |
97
|
|
|
function ($lifetime) { |
98
|
|
|
return !is_int($lifetime); |
99
|
|
|
} |
100
|
|
|
) |
101
|
|
|
->thenInvalid('max_absolute_lifetime must be an integer') |
102
|
|
|
->end() |
103
|
|
|
->end() |
104
|
|
|
->integerNode('max_relative_lifetime') |
105
|
|
|
->isRequired() |
106
|
|
|
->defaultValue(600) |
107
|
|
|
->info( |
108
|
|
|
'The maximum relative lifetime of a session; the maximum allowed time between two ' |
109
|
|
|
. 'interactions by the user' |
110
|
|
|
) |
111
|
|
|
->example('600 -> 10 minutes * 60 seconds') |
112
|
|
|
->validate() |
113
|
|
|
->ifTrue( |
114
|
|
|
function ($lifetime) { |
115
|
|
|
return !is_int($lifetime); |
116
|
|
|
} |
117
|
|
|
) |
118
|
|
|
->thenInvalid('max_relative_lifetime must be an integer') |
119
|
|
|
->end() |
120
|
|
|
->end() |
121
|
|
|
->end() |
122
|
|
|
->end(); |
123
|
|
|
} |
124
|
|
|
|
125
|
|
|
private function appendUrlConfiguration(NodeBuilder $childNodes) |
126
|
|
|
{ |
127
|
|
|
$childNodes |
128
|
|
|
->scalarNode('self_service_url') |
129
|
|
|
->info('The URL of Self Service, where a user can register and revoke second factors') |
130
|
|
|
->validate() |
131
|
|
|
->ifTrue( |
132
|
|
|
function ($url) { |
133
|
|
|
return filter_var($url, FILTER_VALIDATE_URL) === false; |
134
|
|
|
} |
135
|
|
|
) |
136
|
|
|
->thenInvalid('self_service_url must be a valid url') |
137
|
|
|
->end(); |
138
|
|
|
} |
139
|
|
|
} |
140
|
|
|
|
This check looks for function calls that miss required arguments.