SilverStripe\SAML\Control\SAMLController::acs()

Complexity

Conditions	9
Paths	10

Size

Total Lines	75
Code Lines	42

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function acs()
    {
        $auth = Injector::inst()->get(SAMLHelper::class)->getSAMLAuth();
        $auth->processResponse();

        $error = $auth->getLastErrorReason();
        if (!empty($error)) {
            $this->getLogger()->error($error);

            $this->getForm()->sessionMessage("Authentication error: '{$error}'", 'bad');
            $this->getRequest()->getSession()->save($this->getRequest());
            return $this->getRedirect();
        }

        if (!$auth->isAuthenticated()) {
            $this->getForm()->sessionMessage(_t('SilverStripe\\Security\\Member.ERRORWRONGCRED'), 'bad');
            $this->getRequest()->getSession()->save($this->getRequest());
            return $this->getRedirect();
        }

        $decodedNameId = base64_decode($auth->getNameId());
        // check that the NameID is a binary string (which signals that it is a guid
        if (ctype_print($decodedNameId)) {
            $this->getForm()->sessionMessage('Name ID provided by IdP is not a binary GUID.', 'bad');
            $this->getRequest()->getSession()->save($this->getRequest());
            return $this->getRedirect();
        }

        // transform the NameId to guid
        $helper = SAMLHelper::singleton();
        $guid = $helper->binToStrGuid($decodedNameId);
        if (!$helper->validGuid($guid)) {
            $errorMessage = "Not a valid GUID '{$guid}' recieved from server.";
            $this->getLogger()->error($errorMessage);
            $this->getForm()->sessionMessage($errorMessage, 'bad');
            $this->getRequest()->getSession()->save($this->getRequest());
            return $this->getRedirect();
        }

        // Write a rudimentary member with basic fields on every login, so that we at least have something
        // if LDAP synchronisation fails.
        $member = Member::get()->filter('GUID', $guid)->limit(1)->first();
        if (!($member && $member->exists())) {
            $member = new Member();
            $member->GUID = $guid;
        }

        $attributes = $auth->getAttributes();

        foreach ($member->config()->claims_field_mappings as $claim => $field) {
            if (!isset($attributes[$claim][0])) {
                $this->getLogger()->warning(
                    sprintf(
                        'Claim rule \'%s\' configured in LDAPMember.claims_field_mappings, ' .
                                'but wasn\'t passed through. Please check IdP claim rules.',
                        $claim
                    )
                );

                continue;
            }

            $member->$field = $attributes[$claim][0];
        }

        $member->SAMLSessionIndex = $auth->getSessionIndex();

        // This will trigger LDAP update through LDAPMemberExtension::memberLoggedIn.
        // The LDAP update will also write the Member record. We shouldn't write before
        // calling this, as any onAfterWrite hooks that attempt to update LDAP won't
        // have the Username field available yet for new Member records, and fail.
        // Both SAML and LDAP identify Members by the GUID field.
        Security::setCurrentUser($member);

        return $this->getRedirect();
    }