Surfnet\StepupSelfService\SelfServiceBundle\Controller\SamlController::consumeAssertionAction()

Complexity

Conditions	6
Paths	9

Size

Total Lines	63
Code Lines	36

Duplication

Lines	0
Ratio	0 %

Importance

Changes	5
Bugs	0	Features	0

<?php
    public function consumeAssertionAction(Request $httpRequest)
    {
        $logger = $this->get('logger');

        $session = $this->get('session');
        switch (true) {
            case ($session->has(SelfVetController::SELF_VET_SESSION_ID)):
                // The test authentication IdP is also used for self vetting, a different session id is
                // used to mark a self vet command
                /** @var SelfVetRequestId $selfVetRequestId */
                $selfVetRequestId = $session->get(SelfVetController::SELF_VET_SESSION_ID);
                $secondFactorId = $selfVetRequestId->vettingSecondFactorId();
                return $this->forward(
                    'SurfnetStepupSelfServiceSelfServiceBundle:SelfVet:consumeSelfVetAssertion',
                    ['secondFactorId' => $secondFactorId]
                );
            case ($session->has(RecoveryTokenState::RECOVERY_TOKEN_STEP_UP_REQUEST_ID_IDENTIFIER)):
                // The test authentication IdP is also used for self-asserted recovery token
                // verification a different session id is used to mark the authentication.
                return $this->forward('SurfnetStepupSelfServiceSelfServiceBundle:RecoveryToken:stepUpConsumeAssertion');
            default:
                if (!$session->has('second_factor_test_request_id')) {
                    $logger->error(
                        'Received an authentication response for testing a second factor, but no second factor test response was expected'
                    );

                    throw new AccessDeniedHttpException('Did not expect an authentication response');
                }

                $logger->notice('Received an authentication response for testing a second factor');

                $initiatedRequestId = $session->get('second_factor_test_request_id');

                $samlLogger = $this->get('surfnet_saml.logger')->forAuthentication($initiatedRequestId);

                $session->remove('second_factor_test_request_id');

                $postBinding = $this->get('surfnet_saml.http.post_binding');

                try {
                    $assertion = $postBinding->processResponse(
                        $httpRequest,
                        $this->get('self_service.second_factor_test_idp'),
                        $this->get('surfnet_saml.hosted.service_provider')
                    );

                    if (!InResponseTo::assertEquals($assertion, $initiatedRequestId)) {
                        $samlLogger->error(
                            sprintf(
                                'Expected a response to the request with ID "%s", but the SAMLResponse was a response to a different request',
                                $initiatedRequestId
                            )
                        );

                        throw new AuthenticationException('Unexpected InResponseTo in SAMLResponse');
                    }

                    $session->getFlashBag()->add('success', 'ss.test_second_factor.verification_successful');
                } catch (Exception $exception) {
                    $session->getFlashBag()->add('error', 'ss.test_second_factor.verification_failed');
                }

                return $this->redirectToRoute('ss_second_factor_list');
        }