CILogon\Service\Content::handleGotUser()

Complexity

Conditions	19
Paths	49

Size

Total Lines	137
Code Lines	98

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	380

Importance

Changes	6
Bugs	1	Features	0

<?php
    public static function handleGotUser()
    {
        $log = new Loggit();
        $uid = Util::getSessionVar('uid');
        $status = Util::getSessionVar('status');

        // We must get and unset session vars BEFORE any HTML output since
        // a redirect may go to another site, meaning we need to update
        // the session cookie before we leave the cilogon.org domain.
        $ePPN         = Util::getSessionVar('ePPN');
        $ePTID        = Util::getSessionVar('ePTID');
        $firstname    = Util::getSessionVar('firstname');
        $lastname     = Util::getSessionVar('lastname');
        $displayname  = Util::getSessionVar('displayname');
        $emailaddr    = Util::getSessionVar('emailaddr');
        $idp          = Util::getSessionVar('idp');
        $idpname      = Util::getSessionVar('idpname');
        $affiliation  = Util::getSessionVar('affiliation');
        $ou           = Util::getSessionVar('ou');
        $memberof     = Util::getSessionVar('memberof');
        $acr          = Util::getSessionVar('acr');
        $entitlement  = Util::getSessionVar('entitlement');
        $itrustuin    = Util::getSessionVar('itrustuin');
        $subjectID    = Util::getSessionVar('subjectID');
        $pairwiseID   = Util::getSessionVar('pairwiseID');
        $clientparams = json_decode(Util::getSessionVar('clientparams'), true);
        $failureuri   = Util::getSessionVar('failureuri');

        // CIL-410 The /testidp/ flow is indicated by the presence of the
        // 'storeattributes' PHP session var. In this case, simply show
        // the main testidp page with user and IdP attributes.
        if (!empty(Util::getSessionVar('storeattributes'))) {
            printMainPage();

The function printMainPage was not found. Maybe you did not declare it correctly or list all dependencies?

            return;
        }

        // Check for OIDC redirect_uri or OAuth 1.0a failureuri.
        // If found, set 'Proceed' button redirect appropriately.
        $redirect = '';
        $redirectform = '';
        // First, check for OIDC redirect_uri, with parameters in <form>
        if (isset($clientparams['redirect_uri'])) {
            $redirect = $clientparams['redirect_uri'];
            $redirectform = '<input type="hidden" name="error" value="access_denied" />' .
                '<input type="hidden" name="error_description" value="Missing attributes" />';
            if (isset($clientparams['state'])) {
                $redirectform .= '<input type="hidden" name="state" value="' .
                    $clientparams['state'] . '" />';
            }
        }

        // Next, check for OAuth 1.0a
        if ((strlen($redirect) == 0) && (strlen($failureuri) > 0)) {
            $redirect = $failureuri . "?reason=missing_attributes";
        }

        $isEduGAINAndGetCert = Util::isEduGAINAndGetCert($idp, $idpname);

        // Check for various error conditions and print out appropriate page
        if (
            (strlen($uid) == 0) ||    // Empty uid
            (strlen($status) == 0) || // Empty status
            ($status & 1) ||          // Odd-numbered status = error
            ($isEduGAINAndGetCert)    // Not allowed
        ) {
            $log->error(
                'Failed to getuser' .
                ($isEduGAINAndGetCert ? ' due to eduGAIN IdP restriction.' : '.')
            );

            // Is this a SAML IdP?
            $idplist = Util::getIdpList();
            $samlidp = ((!empty($idp)) && (!$idplist->isOAuth2($idp)));

            // Was there a misssing parameter?
            $missingparam = ($status ==
                DBService::$STATUS['STATUS_MISSING_PARAMETER_ERROR']);

            if (($isEduGAINAndGetCert) || ($missingparam && $samlidp)) {
                static::printSAMLAttributeReleaseErrorPage(
                    $ePPN,
                    $ePTID,
                    $firstname,
                    $lastname,
                    $displayname,
                    $emailaddr,
                    $idp,
                    $idpname,
                    $affiliation,
                    $ou,
                    $memberof,
                    $acr,
                    $entitlement,
                    $itrustuin,
                    $subjectID,
                    $pairwiseID,
                    $clientparams,
                    $redirect,
                    $redirectform,
                    $isEduGAINAndGetCert
                );
            } elseif ($missingparam && (!$samlidp)) { // OAuth2 IdP
                static::printOAuth2AttributeReleaseErrorPage(
                    $idpname,
                    $redirect,
                    $redirectform
                );
            } else { // General error
                static::printGeneralErrorPage($redirect, $redirectform);
            }
        } else { // EVERYTHING IS OKAY SO FAR
            // Extra security check: Once the user has successfully
            // authenticated with an IdP, verify that the chosen IdP was
            // actually whitelisted. If not, then set error message and show
            // Select an Identity Provider page again.
            Util::getSkin()->init();  // Check for forced skin
            $idps = static::getCompositeIdPList();
            $providerId = Util::getSessionVar('idp');
            if ((strlen($providerId) > 0) && (!isset($idps[$providerId]))) {
                Util::setSessionVar(
                    'logonerror',
                    'Invalid IdP selected. Please try again.'
                );
                Util::sendErrorAlert(
                    'Authentication attempt using non-whitelisted IdP',
                    'A user successfully authenticated with an IdP,
                    however, the selected IdP was not in the list of
                    whitelisted IdPs as determined by the current skin. This
                    might indicate the user attempted to circumvent the
                    security check in "handleGotUser()" for valid IdPs for
                    the skin.'
                );
                Util::unsetCookieVar('providerId');
                Util::unsetAllUserSessionVars();
                printLogonPage();

The function printLogonPage was not found. Maybe you did not declare it correctly or list all dependencies?

            } else { // Got user successfully
                static::gotUserSuccess();
            }