|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
declare(strict_types=1); |
|
4
|
|
|
|
|
5
|
|
|
namespace SimpleSAML\Module\authorize\Controller; |
|
6
|
|
|
|
|
7
|
|
|
use SimpleSAML\Auth; |
|
8
|
|
|
use SimpleSAML\Configuration; |
|
9
|
|
|
use SimpleSAML\Error; |
|
10
|
|
|
use SimpleSAML\Module; |
|
11
|
|
|
use SimpleSAML\Session; |
|
12
|
|
|
use SimpleSAML\XHTML\Template; |
|
13
|
|
|
use Symfony\Component\HttpFoundation\Request; |
|
14
|
|
|
|
|
15
|
|
|
/** |
|
16
|
|
|
* Controller class for the authorize module. |
|
17
|
|
|
* |
|
18
|
|
|
* This class serves the different views available in the module. |
|
19
|
|
|
* |
|
20
|
|
|
* @package SimpleSAML\Module\authorize |
|
21
|
|
|
*/ |
|
22
|
|
|
class Authorize |
|
23
|
|
|
{ |
|
24
|
|
|
/** |
|
25
|
|
|
* Controller constructor. |
|
26
|
|
|
* |
|
27
|
|
|
* It initializes the global configuration and auth source configuration for the controllers implemented here. |
|
28
|
|
|
* |
|
29
|
|
|
* @param \SimpleSAML\Configuration $config The configuration to use by the controllers. |
|
30
|
|
|
* @param \SimpleSAML\Session $session The session to use by the controllers. |
|
31
|
|
|
* |
|
32
|
|
|
* @throws \Exception |
|
33
|
|
|
*/ |
|
34
|
|
|
public function __construct( |
|
35
|
|
|
protected Configuration $config, |
|
36
|
|
|
protected Session $session, |
|
37
|
|
|
) { |
|
38
|
|
|
} |
|
39
|
|
|
|
|
40
|
|
|
|
|
41
|
|
|
/** |
|
42
|
|
|
* Show a 403 Forbidden page about not authorized to access an application. |
|
43
|
|
|
* |
|
44
|
|
|
* @param \Symfony\Component\HttpFoundation\Request $request |
|
45
|
|
|
* @return \SimpleSAML\XHTML\Template |
|
46
|
|
|
*/ |
|
47
|
|
|
public function forbidden(Request $request): Template |
|
48
|
|
|
{ |
|
49
|
|
|
$stateId = $request->query->get('StateId', false); |
|
50
|
|
|
if (!is_string($stateId)) { |
|
51
|
|
|
throw new Error\BadRequest('Missing required StateId query parameter.'); |
|
52
|
|
|
} |
|
53
|
|
|
|
|
54
|
|
|
/** @var array $state */ |
|
55
|
|
|
$state = Auth\State::loadState($stateId, 'authorize:Authorize'); |
|
56
|
|
|
|
|
57
|
|
|
$t = new Template($this->config, 'authorize:authorize_403.twig'); |
|
58
|
|
|
if (isset($state['Source']['auth'])) { |
|
59
|
|
|
$t->data['source'] = $state['Source']['auth']; |
|
60
|
|
|
} |
|
61
|
|
|
if (isset($state['authprocAuthorize_reject_msg'])) { |
|
62
|
|
|
$t->data['reject_msg'] = $state['authprocAuthorize_reject_msg']; |
|
63
|
|
|
} |
|
64
|
|
|
|
|
65
|
|
|
if (isset($state['Source']['auth'])) { |
|
66
|
|
|
$t->data['LogoutURL'] = Module::getModuleURL( |
|
67
|
|
|
'core/logout/' . urlencode($state['Source']['auth']), |
|
68
|
|
|
); |
|
69
|
|
|
} |
|
70
|
|
|
if (isset($state['authprocAuthorize_user_attribute'])) { |
|
71
|
|
|
$t->data['user_attribute'] = $state['authprocAuthorize_user_attribute']; |
|
72
|
|
|
} |
|
73
|
|
|
|
|
74
|
|
|
$t->data['allow_reauthentication'] = $state['authprocAuthorize_allow_re_authenticate_on_unauthorized'] ?? false; |
|
75
|
|
|
$stateId = Auth\State::saveState($state, 'authorize:Authorize'); |
|
76
|
|
|
$t->data['url_reauthentication'] = |
|
77
|
|
|
Module::getModuleURL('authorize/error/reauthenticate', ['StateId' => $stateId]); |
|
78
|
|
|
|
|
79
|
|
|
if ( |
|
80
|
|
|
isset($state['authprocAuthorize_errorURL']) |
|
81
|
|
|
&& $state['authprocAuthorize_errorURL'] === true |
|
82
|
|
|
&& isset($state['Source']['errorURL']) |
|
83
|
|
|
) { |
|
84
|
|
|
$errorURL = $state['Source']['errorURL']; |
|
85
|
|
|
$errorURL = str_replace('ERRORURL_CODE', 'AUTHORIZATION_FAILURE', $errorURL); |
|
86
|
|
|
if (isset($state['saml:sp:State']['core:SP'])) { |
|
87
|
|
|
$errorURL = str_replace('ERRORURL_RP', urlencode($state['saml:sp:State']['core:SP']), $errorURL); |
|
88
|
|
|
} |
|
89
|
|
|
if (isset($state['saml:AuthnInstant'])) { |
|
90
|
|
|
$errorURL = str_replace('ERRORURL_TS', $state['saml:AuthnInstant'], $errorURL); |
|
91
|
|
|
} else { |
|
92
|
|
|
$errorURL = str_replace('ERRORURL_TS', strval(time()), $errorURL); |
|
93
|
|
|
} |
|
94
|
|
|
$errorURL = str_replace('ERRORURL_TID', urlencode($this->session->getTrackID()), $errorURL); |
|
95
|
|
|
if (isset($state['authprocAuthorize_ctx'])) { |
|
96
|
|
|
$errorURL = str_replace('ERRORURL_CTX', urlencode($state['authprocAuthorize_ctx']), $errorURL); |
|
97
|
|
|
} |
|
98
|
|
|
$t->data['errorURL'] = $errorURL; |
|
99
|
|
|
} |
|
100
|
|
|
|
|
101
|
|
|
$t->setStatusCode(403); |
|
102
|
|
|
return $t; |
|
103
|
|
|
} |
|
104
|
|
|
|
|
105
|
|
|
public function reauthenticate(Request $request): void |
|
106
|
|
|
{ |
|
107
|
|
|
$stateId = $request->query->get('StateId', false); |
|
108
|
|
|
if (!is_string($stateId)) { |
|
109
|
|
|
throw new Error\BadRequest('Missing required StateId query parameter.'); |
|
110
|
|
|
} |
|
111
|
|
|
/** @var array $state */ |
|
112
|
|
|
$state = Auth\State::loadState($stateId, 'authorize:Authorize'); |
|
113
|
|
|
|
|
114
|
|
|
$authSource = $state['Source']['auth']; |
|
115
|
|
|
if (empty($authSource)) { |
|
116
|
|
|
throw new Error\BadRequest('Missing required auth source.'); |
|
117
|
|
|
} |
|
118
|
|
|
$parameters = ['ForceAuthn' => true]; |
|
119
|
|
|
|
|
120
|
|
|
if (isset($state['\\SimpleSAML\\Auth\\State.restartURL'])) { |
|
121
|
|
|
$returnToUrl = $state['\\SimpleSAML\\Auth\\State.restartURL'] ; |
|
122
|
|
|
$parameters['ReturnTo'] = $returnToUrl; |
|
123
|
|
|
} |
|
124
|
|
|
|
|
125
|
|
|
$auth = new Auth\Simple($authSource); |
|
126
|
|
|
$auth->login($parameters); |
|
127
|
|
|
} |
|
128
|
|
|
} |
|
129
|
|
|
|
simplesamlphp /
simplesamlphp-module-authorize
