Surfnet\StepupSelfService\SelfServiceBundle\Controller\SamlController::consumeAssertionAction()

Complexity

Conditions	5
Paths	8

Size

Total Lines

59

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function consumeAssertionAction(Request $httpRequest)
    {
        $logger = $this->get('logger');

        $session = $this->get('session');
        // The test authentication IdP is also used for self vetting, a different session id is
        // used to mark a self vet command
        if ($session->has(SelfVetController::SELF_VET_SESSION_ID)) {
            /** @var SelfVetRequestId $selfVetRequestId */
            $selfVetRequestId = $session->get('second_factor_self_vet_request_id');
            $secondFactorId = $selfVetRequestId->vettingSecondFactorId();
            return $this->forward(
                'SurfnetStepupSelfServiceSelfServiceBundle:SelfVet:consumeSelfVetAssertion',
                ['secondFactorId' => $secondFactorId]
            );
        }
        if (!$session->has('second_factor_test_request_id')) {
            $logger->error(
                'Received an authentication response for testing a second factor, but no second factor test response was expected'
            );

            throw new AccessDeniedHttpException('Did not expect an authentication response');
        }

        $logger->notice('Received an authentication response for testing a second factor');

        $initiatedRequestId = $session->get('second_factor_test_request_id');

        $samlLogger = $this->get('surfnet_saml.logger')->forAuthentication($initiatedRequestId);

        $session->remove('second_factor_test_request_id');

        $postBinding = $this->get('surfnet_saml.http.post_binding');

        try {
            $assertion = $postBinding->processResponse(
                $httpRequest,
                $this->get('self_service.second_factor_test_idp'),
                $this->get('surfnet_saml.hosted.service_provider')
            );

            if (!InResponseTo::assertEquals($assertion, $initiatedRequestId)) {
                $samlLogger->error(
                    sprintf(
                        'Expected a response to the request with ID "%s", but the SAMLResponse was a response to a different request',
                        $initiatedRequestId
                    )
                );

                throw new AuthenticationException('Unexpected InResponseTo in SAMLResponse');
            }

            $session->getFlashBag()->add('success', 'ss.test_second_factor.verification_successful');
        } catch (Exception $exception) {
            $session->getFlashBag()->add('error', 'ss.test_second_factor.verification_failed');
        }

        return $this->redirectToRoute('ss_second_factor_list');
    }