1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
// error_reporting(E_ALL); ini_set('display_errors',1); |
4
|
|
|
|
5
|
|
|
require_once __DIR__ . '/../vendor/autoload.php'; |
6
|
|
|
require_once __DIR__ . '/index-functions.php'; |
7
|
|
|
|
8
|
|
|
use CILogon\Service\Util; |
9
|
|
|
use CILogon\Service\Content; |
10
|
|
|
use CILogon\Service\Loggit; |
11
|
|
|
|
12
|
|
|
Util::startPHPSession(); |
13
|
|
|
|
14
|
|
|
// Check the csrf cookie against either a hidden <form> element or a |
15
|
|
|
// PHP session variable, and get the value of the 'submit' element. |
16
|
|
|
// Note: replace CR/LF with space for 'Show/Hide Help' buttons. |
17
|
|
|
$retchars = array("\r\n","\n","\r"); |
18
|
|
|
$submit = str_replace( |
19
|
|
|
$retchars, |
20
|
|
|
" ", |
21
|
|
|
Util::getCsrf()->verifyCookieAndGetSubmit() |
22
|
|
|
); |
23
|
|
|
Util::unsetSessionVar('submit'); |
24
|
|
|
|
25
|
|
|
$log = new Loggit(); |
26
|
|
|
$log->info('submit="' . $submit . '"'); |
27
|
|
|
|
28
|
|
|
// First, check to see if the info related to the OIDC client exists |
29
|
|
|
// in the current PHP session. If so, continue processing based on the |
30
|
|
|
// 'submit' value. Otherwise, print out error message about bad or |
31
|
|
|
// missing OpenID Connect parameters. |
32
|
|
|
if (verifyOIDCParams()) { |
33
|
|
|
// Get the OIDC client parameters from the PHP session. |
34
|
|
|
$clientparams = json_decode(Util::getSessionVar('clientparams'), true); |
35
|
|
|
|
36
|
|
|
// Depending on the value of the clicked 'submit' button or the |
37
|
|
|
// equivalent PHP session variable, take action or print out HTML. |
38
|
|
|
switch ($submit) { |
39
|
|
|
case 'Log On': // Check for OpenID or InCommon usage. |
40
|
|
|
case 'Continue': // For OOI |
41
|
|
|
// Need to check for 'max_age' OIDC parameeter. If elapsed time |
42
|
|
|
// since last user authentication is greater than max_age, then |
43
|
|
|
// set 'forceauthn' session variable to force the user to |
44
|
|
|
// (re)authenticate. |
45
|
|
|
if (isset($clientparams['max_age'])) { |
46
|
|
|
$max_age = (int)$clientparams['max_age']; |
47
|
|
|
if (strlen(Util::getSessionVar('authntime')) > 0) { |
48
|
|
|
$authntime = (int)Util::getSessionVar('authntime'); |
49
|
|
|
$currtime = time(); |
50
|
|
|
if ( |
51
|
|
|
($authtime > $currtime) || // Weird error!!! |
52
|
|
|
(($currtime - $authtime) > $max_age) |
53
|
|
|
) { |
54
|
|
|
Util::setSessionVar('forceauthn', '1'); |
55
|
|
|
} |
56
|
|
|
} else { // No authntime - assume no user authentication |
57
|
|
|
Util::setSessionVar('forceauthn', '1'); |
58
|
|
|
} |
59
|
|
|
} |
60
|
|
|
Content::handleLogOnButtonClicked(); |
61
|
|
|
break; // End case 'Log On' |
62
|
|
|
|
63
|
|
|
case 'gotuser': // Return from the getuser script |
64
|
|
|
Content::handleGotUser(); |
65
|
|
|
break; // End case 'gotuser' |
66
|
|
|
|
67
|
|
|
case 'Proceed': // Proceed after 'User Changed' or Error page |
68
|
|
|
case 'Done with Two-Factor': |
69
|
|
|
Util::verifySessionAndCall('printMainPage'); |
|
|
|
|
70
|
|
|
break; // End case 'Proceed' |
71
|
|
|
|
72
|
|
|
case 'Cancel': // User denies release of attributes |
73
|
|
|
// If user clicked the 'Cancel' button, return to the |
74
|
|
|
// OIDC client with an error message. |
75
|
|
|
$redirect = 'Location: ' . $clientparams['redirect_uri'] . |
76
|
|
|
(preg_match('/\?/', $clientparams['redirect_uri']) ? '&' : '?') . |
77
|
|
|
'error=access_denied&error_description=' . |
78
|
|
|
'User%20denied%20authorization%20request' . |
79
|
|
|
((isset($clientparams['state'])) ? |
80
|
|
|
'&state=' . $clientparams['state'] : ''); |
81
|
|
|
Util::unsetAllUserSessionVars(); |
82
|
|
|
header($redirect); |
83
|
|
|
exit; // No further processing necessary |
84
|
|
|
break; // End case 'Cancel' |
85
|
|
|
|
86
|
|
|
case 'Manage Two-Factor': |
87
|
|
|
Util::verifySessionAndCall( |
88
|
|
|
'CILogon\\Service\\Content::printTwoFactorPage' |
|
|
|
|
89
|
|
|
); |
90
|
|
|
break; // End case 'Manage Two-Factor' |
91
|
|
|
|
92
|
|
|
case 'Enable': // Enable / Disable two-factor authentication |
93
|
|
|
case 'Disable': |
94
|
|
|
case 'Verify': // Log in with Google Authenticator |
95
|
|
|
case 'Disable Two-Factor': |
96
|
|
|
$enable = !preg_match('/^Disable/', $submit); |
97
|
|
|
Util::verifySessionAndCall( |
98
|
|
|
'CILogon\\Service\\Content::handleEnableDisableTwoFactor', |
|
|
|
|
99
|
|
|
array($enable) |
100
|
|
|
); |
101
|
|
|
break; // End case 'Enable' / 'Disable' |
102
|
|
|
|
103
|
|
|
case 'I Lost My Phone': |
104
|
|
|
Util::verifySessionAndCall( |
105
|
|
|
'CILogon\\Service\\Content::handleILostMyPhone' |
|
|
|
|
106
|
|
|
); |
107
|
|
|
break; // End case 'I Lost My Phone' |
108
|
|
|
|
109
|
|
|
case 'Enter': // Verify Google Authenticator one time password |
110
|
|
|
Util::verifySessionAndCall( |
111
|
|
|
'CILogon\\Service\\Content::handleGoogleAuthenticatorLogin' |
|
|
|
|
112
|
|
|
); |
113
|
|
|
break; // End case 'Enter' |
114
|
|
|
|
115
|
|
|
case 'EnterDuo': // Verify Duo Security login |
116
|
|
|
Util::verifySessionAndCall( |
117
|
|
|
'CILogon\\Service\\Content::handleDuoSecurityLogin' |
|
|
|
|
118
|
|
|
); |
119
|
|
|
break; // End case 'EnterDuo' |
120
|
|
|
|
121
|
|
|
case 'Show Help ': // Toggle showing of help text on and off |
122
|
|
|
case 'Hide Help ': |
123
|
|
|
Content::handleHelpButtonClicked(); |
124
|
|
|
break; // End case 'Show Help' / 'Hide Help' |
125
|
|
|
|
126
|
|
|
default: // No submit button clicked nor PHP session submit variable set |
127
|
|
|
Content::handleNoSubmitButtonClicked(); |
128
|
|
|
|
129
|
|
|
break; // End default case |
130
|
|
|
} // End switch ($submit) |
131
|
|
|
} else { // Failed to verify OIDC client parameters in PHP session |
132
|
|
|
printOIDCErrorPage(); |
133
|
|
|
} |
134
|
|
|
|
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: