|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace rhertogh\Yii2Oauth2Server\controllers\web\openidconnect; |
|
4
|
|
|
|
|
5
|
|
|
use Lcobucci\JWT\Encoding\JoseEncoder; |
|
6
|
|
|
use Lcobucci\JWT\Signer\Key\InMemory; |
|
7
|
|
|
use Lcobucci\JWT\Signer\Rsa\Sha256; |
|
8
|
|
|
use Lcobucci\JWT\Token\Parser; |
|
9
|
|
|
use Lcobucci\JWT\Validation\Constraint\PermittedFor; |
|
10
|
|
|
use Lcobucci\JWT\Validation\Constraint\RelatedTo; |
|
11
|
|
|
use Lcobucci\JWT\Validation\Constraint\SignedWith; |
|
12
|
|
|
use Lcobucci\JWT\Validation\Validator; |
|
13
|
|
|
use League\OAuth2\Server\RedirectUriValidators\RedirectUriValidator; |
|
14
|
|
|
use rhertogh\Yii2Oauth2Server\controllers\web\base\Oauth2BaseWebAction; |
|
15
|
|
|
use rhertogh\Yii2Oauth2Server\controllers\web\Oauth2OidcController; |
|
16
|
|
|
use rhertogh\Yii2Oauth2Server\helpers\UrlHelper; |
|
17
|
|
|
use rhertogh\Yii2Oauth2Server\interfaces\controllers\web\openidconnect\Oauth2OidcEndSessionActionInterface; |
|
18
|
|
|
use rhertogh\Yii2Oauth2Server\interfaces\components\authorization\client\Oauth2ClientAuthorizationRequestInterface; |
|
19
|
|
|
use rhertogh\Yii2Oauth2Server\interfaces\components\authorization\EndSession\Oauth2EndSessionAuthorizationRequestInterface; |
|
20
|
|
|
use rhertogh\Yii2Oauth2Server\interfaces\models\external\user\Oauth2OidcUserInterface; |
|
21
|
|
|
use rhertogh\Yii2Oauth2Server\interfaces\models\Oauth2ClientInterface; |
|
22
|
|
|
use Yii; |
|
23
|
|
|
use yii\base\InvalidConfigException; |
|
24
|
|
|
use yii\web\BadRequestHttpException; |
|
25
|
|
|
use yii\web\ForbiddenHttpException; |
|
26
|
|
|
use yii\web\NotFoundHttpException; |
|
27
|
|
|
use yii\web\Response; |
|
28
|
|
|
use yii\web\UnauthorizedHttpException; |
|
29
|
|
|
|
|
30
|
|
|
/** |
|
31
|
|
|
* @property Oauth2OidcController $controller |
|
32
|
|
|
*/ |
|
33
|
|
|
class Oauth2OidcEndSessionAction extends Oauth2BaseWebAction implements Oauth2OidcEndSessionActionInterface |
|
34
|
|
|
{ |
|
35
|
|
|
/** |
|
36
|
|
|
* @see https://openid.net/specs/openid-connect-rpinitiated-1_0.html |
|
37
|
|
|
* @return Response |
|
38
|
|
|
* @throws InvalidConfigException |
|
39
|
|
|
*/ |
|
40
|
|
|
public function run($endSessionAuthorizationRequestId = null) |
|
41
|
|
|
{ |
|
42
|
|
|
$module = $this->controller->module; |
|
43
|
|
|
$request = Yii::$app->request; |
|
|
|
|
|
|
44
|
|
|
$identity = $module->getUserIdentity(); |
|
|
|
|
|
|
45
|
|
|
|
|
46
|
|
|
if (!$module->enableOpenIdConnect) { |
|
47
|
|
|
throw new ForbiddenHttpException('OpenID Connect is disabled.'); |
|
48
|
|
|
} |
|
49
|
|
|
|
|
50
|
|
|
if ($identity && !($identity instanceof Oauth2OidcUserInterface)) { |
|
|
|
|
|
|
51
|
|
|
throw new InvalidConfigException('In order to support OpenID Connect ' |
|
52
|
|
|
. get_class($identity) . ' must implement ' . Oauth2OidcUserInterface::class); |
|
53
|
|
|
} |
|
54
|
|
|
|
|
55
|
|
|
if (empty($endSessionAuthorizationRequestId)) { |
|
56
|
|
|
/** @var Oauth2EndSessionAuthorizationRequestInterface $endSessionAuthorizationRequest */ |
|
57
|
|
|
$endSessionAuthorizationRequest = Yii::createObject([ |
|
58
|
|
|
'class' => Oauth2EndSessionAuthorizationRequestInterface::class, |
|
59
|
|
|
'module' => $module, |
|
60
|
|
|
'idTokenHint' => $this->getRequestParam($request, 'id_token_hint'), |
|
|
|
|
|
|
61
|
|
|
'clientIdentifier' => $this->getRequestParam($request, 'client_id'), |
|
62
|
|
|
'endSessionUrl' => $request->absoluteUrl, |
|
63
|
|
|
'redirectUri' => $this->getRequestParam($request, 'post_logout_redirect_uri'), |
|
64
|
|
|
'state' => $this->getRequestParam($request, 'state'), |
|
65
|
|
|
]); |
|
66
|
|
|
|
|
67
|
|
|
$endSessionAuthorizationRequest->validateRequest(); |
|
68
|
|
|
|
|
69
|
|
|
if (!$identity) { |
|
|
|
|
|
|
70
|
|
|
/** |
|
71
|
|
|
* Specified in https://openid.net/specs/openid-connect-rpinitiated-1_0.html#ValidationAndErrorHandling |
|
72
|
|
|
* "Note that because RP-Initiated Logout Requests are intended to be idempotent, |
|
73
|
|
|
* it is explicitly not an error for an RP to request that a logout be performed when the OP does not |
|
74
|
|
|
* consider that the End-User is logged in with the OP at the requesting RP." |
|
75
|
|
|
*/ |
|
76
|
|
|
return $this->controller->redirect($endSessionAuthorizationRequest->getRequestCompletedRedirectUrl(true)); |
|
77
|
|
|
} |
|
78
|
|
|
|
|
79
|
|
|
if ($endSessionAuthorizationRequest->getEndUserAuthorizationRequired()) { |
|
80
|
|
|
if ($endSessionAuthorizationRequest->isAuthorizationAllowed()) { |
|
81
|
|
|
return $module->generateEndSessionAuthReqRedirectResponse($endSessionAuthorizationRequest); |
|
82
|
|
|
} else { |
|
83
|
|
|
throw new UnauthorizedHttpException(Yii::t('oauth2', 'You are not allowed to authorize logging out.')); |
|
84
|
|
|
} |
|
85
|
|
|
} else { |
|
86
|
|
|
$endSessionAuthorizationRequest->autoApproveAndProcess(); |
|
87
|
|
|
} |
|
88
|
|
|
} else { |
|
89
|
|
|
$endSessionAuthorizationRequest = $module->getEndSessionAuthReqSession($endSessionAuthorizationRequestId); |
|
90
|
|
|
if (empty($endSessionAuthorizationRequest)) { |
|
91
|
|
|
throw new NotFoundHttpException('End Session authorization request not found.'); |
|
92
|
|
|
} |
|
93
|
|
|
} |
|
94
|
|
|
|
|
95
|
|
|
if (!$endSessionAuthorizationRequest->isCompleted()) { |
|
96
|
|
|
throw new BadRequestHttpException('End Session authorization is not completed.'); |
|
97
|
|
|
} |
|
98
|
|
|
|
|
99
|
|
|
return $this->controller->redirect($endSessionAuthorizationRequest->getRequestCompletedRedirectUrl()); |
|
100
|
|
|
} |
|
101
|
|
|
} |
|
102
|
|
|
|
rhertogh /
yii2-oauth2-server
Loading history...
Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.
For example, imagine you have a variable
$accountIdthat can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to theidproperty of an instance of theAccountclass. This class holds a proper account, so the id value must no longer be false.Either this assignment is in error or a type check should be added for that assignment.