IdTokenVerifier::validateUserinfoToken() - Code Metrics - Inspection of "New implementation" - thomasvargiu/php-openid-client - Measure and Improve Code Quality continuously with Scrutinizer

Passed

Push — master ( 898cc7...450add )

by Thomas Mauro

created 2019-07-08 11:59 UTC

IdTokenVerifier::validateUserinfoToken() A

↳ Parent: IdTokenVerifier

Complexity

Conditions	1
Paths	1

Size

Total Lines	7
Code Lines	1

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	2

Importance

Changes	1
Bugs	0	Features	0

Metric	Value
cc	1
eloc	1
nc	1
nop	4
dl	0
loc	7
ccs	0
cts	7
cp	0
crap	2
rs	10
c	1
b	0
f	0

<?php

declare(strict_types=1);

namespace TMV\OpenIdClient\Token;

use Jose\Component\Checker\AudienceChecker;
use Jose\Component\Checker\ClaimCheckerManager;
use Jose\Component\Checker\ExpirationTimeChecker;
use Jose\Component\Checker\IssuedAtChecker;
use Jose\Component\Checker\IssuerChecker;
use Jose\Component\Checker\NotBeforeChecker;
use Jose\Component\Core\AlgorithmManager;
use Jose\Component\Core\JWKSet;
use Jose\Component\Signature\Algorithm\RS256;
use Jose\Component\Signature\JWSVerifier;
use Jose\Component\Signature\Serializer\CompactSerializer;
use function TMV\OpenIdClient\base64url_decode;
use TMV\OpenIdClient\ClaimChecker\AuthTimeChecker;
use TMV\OpenIdClient\ClaimChecker\AzpChecker;
use TMV\OpenIdClient\ClaimChecker\NonceChecker;
use TMV\OpenIdClient\ClientInterface;
use TMV\OpenIdClient\Exception\InvalidArgumentException;
use TMV\OpenIdClient\Exception\RuntimeException;
use function TMV\OpenIdClient\jose_secret_key;
use TMV\OpenIdClient\Model\AuthSessionInterface;

class IdTokenVerifier implements IdTokenVerifierInterface
{
    /** @var AlgorithmManager */
    private $algorithmManager;

    /** @var bool */
    private $aadIssValidation;

    /** @var int */
    private $clockTolerance = 0;

    /**
     * IdTokenVerifier constructor.
     *
     * @param null|AlgorithmManager $algorithmManager
     * @param bool $aadIssValidation
     * @param int $clockTolerance
     */
    public function __construct(
        ?AlgorithmManager $algorithmManager = null,
        bool $aadIssValidation = false,
        int $clockTolerance = 0
    ) {
        $this->algorithmManager = $algorithmManager ?: new AlgorithmManager([new RS256()]);
        $this->aadIssValidation = $aadIssValidation;
        $this->clockTolerance = $clockTolerance;
    }

    public function validateUserinfoToken(
        ClientInterface $client,
        string $idToken,
        ?AuthSessionInterface $authSession = null,
        ?int $maxAge = null
    ): array {
        return $this->validate($client, $idToken, $authSession, true, $maxAge);
    }

    public function validateIdToken(
        ClientInterface $client,
        string $idToken,
        ?AuthSessionInterface $authSession = null,
        ?int $maxAge = null
    ): array {
        return $this->validate($client, $idToken, $authSession, false, $maxAge);
    }

    private function validate(
        ClientInterface $client,
        string $idToken,
        ?AuthSessionInterface $authSession = null,
        bool $fromUserInfo = false,
        ?int $maxAge = null
    ): array {
        $metadata = $client->getMetadata();
        $expectedAlg = $fromUserInfo
            ? $metadata->getUserinfoSignedResponseAlg()
            : $metadata->getIdTokenSignedResponseAlg();

        if (! $expectedAlg) {
            throw new RuntimeException('Unable to verify id_token without an alg value');
        }

        $header = \json_decode(base64url_decode(\explode('.', $idToken)[0] ?? '{}'), true);

        if ($expectedAlg !== ($header['alg'] ?? '')) {
            throw new RuntimeException(\sprintf('Unexpected JWE alg received, expected %s, got: %s', $expectedAlg, $header['alg'] ?? ''));
        }

        $payload = \json_decode(base64url_decode(\explode('.', $idToken)[1] ?? '{}'), true);

        if (! \is_array($payload)) {
            throw new InvalidArgumentException('Unable to decode token payload');
        }

        $expectedIssuer = $client->getIssuer()->getMetadata()->getIssuer();

        if ($this->aadIssValidation) {
            $expectedIssuer = \str_replace('{tenantid}', $payload['tid'] ?? '', $expectedIssuer);
        }

        $nonce = $authSession ? $authSession->getNonce() : null;

        $claimCheckers = [
            new IssuerChecker([$expectedIssuer]),
            new IssuedAtChecker($this->clockTolerance),
            new AudienceChecker($metadata->getClientId()),
            new ExpirationTimeChecker($this->clockTolerance),
            new NotBeforeChecker($this->clockTolerance),
            new AzpChecker($metadata->getClientId()),
            $maxAge ? new AuthTimeChecker($maxAge, $this->clockTolerance) : null,
            $nonce ? new NonceChecker($nonce) : null,
        ];

        $requiredClaims = [];

        if (! $fromUserInfo) {
            $requiredClaims = ['iss', 'sub', 'aud', 'exp', 'iat'];
        }

        if ($maxAge || (null !== $maxAge && $metadata->get('require_auth_time'))) {
0   == false // true
0   == null  // true
123 == false // false
123 == null  // false

// It is often better to use strict comparison
0 === false // false
0 === null  // false
            $requiredClaims[] = 'auth_time';
        }

        $claimCheckerManager = new ClaimCheckerManager(\array_filter($claimCheckers));

        $claimCheckerManager->check($payload, \array_filter($requiredClaims));

        if ('none' === $expectedAlg) {
            return $payload;
        }

        $serializer = new CompactSerializer();
        $jws = $serializer->unserialize($idToken);

        $jwsVerifier = new JWSVerifier(
            $this->algorithmManager
        );

        if (0 === \strpos($expectedAlg, 'HS')) {
            $clientSecret = $metadata->getClientSecret();

            if (! $clientSecret) {
                throw new RuntimeException('Unable to verify token without client_secret');
            }

            $jwks = new JWKSet([jose_secret_key($clientSecret)]);
        } else {
            $jwks = $client->getIssuer()->getJwks();
        }

        if (! $jwsVerifier->verifyWithKeySet($jws, $jwks, 0)) {
            throw new InvalidArgumentException('Failed to validate JWT signature');
        }

        return $payload;
    }
}


1			<?php
2
3			declare(strict_types=1);
4
5			namespace TMV\OpenIdClient\Token;
6
7			use Jose\Component\Checker\AudienceChecker;
8			use Jose\Component\Checker\ClaimCheckerManager;
9			use Jose\Component\Checker\ExpirationTimeChecker;
10			use Jose\Component\Checker\IssuedAtChecker;
11			use Jose\Component\Checker\IssuerChecker;
12			use Jose\Component\Checker\NotBeforeChecker;
13			use Jose\Component\Core\AlgorithmManager;
14			use Jose\Component\Core\JWKSet;
15			use Jose\Component\Signature\Algorithm\RS256;
16			use Jose\Component\Signature\JWSVerifier;
17			use Jose\Component\Signature\Serializer\CompactSerializer;
18			use function TMV\OpenIdClient\base64url_decode;
19			use TMV\OpenIdClient\ClaimChecker\AuthTimeChecker;
20			use TMV\OpenIdClient\ClaimChecker\AzpChecker;
21			use TMV\OpenIdClient\ClaimChecker\NonceChecker;
22			use TMV\OpenIdClient\ClientInterface;
23			use TMV\OpenIdClient\Exception\InvalidArgumentException;
24			use TMV\OpenIdClient\Exception\RuntimeException;
25			use function TMV\OpenIdClient\jose_secret_key;
26			use TMV\OpenIdClient\Model\AuthSessionInterface;
27
28			class IdTokenVerifier implements IdTokenVerifierInterface
29			{
30			/** @var AlgorithmManager */
31			private $algorithmManager;
32
33			/** @var bool */
34			private $aadIssValidation;
35
36			/** @var int */
37			private $clockTolerance = 0;
38
39			/**
40			* IdTokenVerifier constructor.
41			*
42			* @param null\|AlgorithmManager $algorithmManager
43			* @param bool $aadIssValidation
44			* @param int $clockTolerance
45			*/
46			public function __construct(
47			?AlgorithmManager $algorithmManager = null,
48			bool $aadIssValidation = false,
49			int $clockTolerance = 0
50			) {
51			$this->algorithmManager = $algorithmManager ?: new AlgorithmManager([new RS256()]);
52			$this->aadIssValidation = $aadIssValidation;
53			$this->clockTolerance = $clockTolerance;
54			}
55
56			public function validateUserinfoToken(
57			ClientInterface $client,
58			string $idToken,
59			?AuthSessionInterface $authSession = null,
60			?int $maxAge = null
61			): array {
62			return $this->validate($client, $idToken, $authSession, true, $maxAge);
63			}
64
65			public function validateIdToken(
66			ClientInterface $client,
67			string $idToken,
68			?AuthSessionInterface $authSession = null,
69			?int $maxAge = null
70			): array {
71			return $this->validate($client, $idToken, $authSession, false, $maxAge);
72			}
73
74			private function validate(
75			ClientInterface $client,
76			string $idToken,
77			?AuthSessionInterface $authSession = null,
78			bool $fromUserInfo = false,
79			?int $maxAge = null
80			): array {
81			$metadata = $client->getMetadata();
82			$expectedAlg = $fromUserInfo
83			? $metadata->getUserinfoSignedResponseAlg()
84			: $metadata->getIdTokenSignedResponseAlg();
85
86			if (! $expectedAlg) {
87			throw new RuntimeException('Unable to verify id_token without an alg value');
88			}
89
90			$header = \json_decode(base64url_decode(\explode('.', $idToken)[0] ?? '{}'), true);
91
92			if ($expectedAlg !== ($header['alg'] ?? '')) {
93			throw new RuntimeException(\sprintf('Unexpected JWE alg received, expected %s, got: %s', $expectedAlg, $header['alg'] ?? ''));
94			}
95
96			$payload = \json_decode(base64url_decode(\explode('.', $idToken)[1] ?? '{}'), true);
97
98			if (! \is_array($payload)) {
99			throw new InvalidArgumentException('Unable to decode token payload');
100			}
101
102			$expectedIssuer = $client->getIssuer()->getMetadata()->getIssuer();
103
104			if ($this->aadIssValidation) {
105			$expectedIssuer = \str_replace('{tenantid}', $payload['tid'] ?? '', $expectedIssuer);
106			}
107
108			$nonce = $authSession ? $authSession->getNonce() : null;
109
110			$claimCheckers = [
111			new IssuerChecker([$expectedIssuer]),
112			new IssuedAtChecker($this->clockTolerance),
113			new AudienceChecker($metadata->getClientId()),
114			new ExpirationTimeChecker($this->clockTolerance),
115			new NotBeforeChecker($this->clockTolerance),
116			new AzpChecker($metadata->getClientId()),
117			$maxAge ? new AuthTimeChecker($maxAge, $this->clockTolerance) : null,
118			$nonce ? new NonceChecker($nonce) : null,
119			];
120
121			$requiredClaims = [];
122
123			if (! $fromUserInfo) {
124			$requiredClaims = ['iss', 'sub', 'aud', 'exp', 'iat'];
125			}
126
127			if ($maxAge \|\| (null !== $maxAge && $metadata->get('require_auth_time'))) {
			0 ignored issues – show Bug Best Practice introduced 2019-07-08 12:02 UTC by Report Bug Copy Issue Report The expression `$maxAge` of type `integer\|null` is loosely compared to `true`; this is ambiguous if the integer can be 0. You might want to explicitly use `!== null` instead. In PHP, under loose comparison (like `==`, or `!=`, or `switch` conditions), values of different types might be equal. For `integer` values, zero is a special case, in particular the following results might be unexpected: 0 == false // true 0 == null // true 123 == false // false 123 == null // false // It is often better to use strict comparison 0 === false // false 0 === null // false Loading history...
128			$requiredClaims[] = 'auth_time';
129			}
130
131			$claimCheckerManager = new ClaimCheckerManager(\array_filter($claimCheckers));
132
133			$claimCheckerManager->check($payload, \array_filter($requiredClaims));
134
135			if ('none' === $expectedAlg) {
136			return $payload;
137			}
138
139			$serializer = new CompactSerializer();
140			$jws = $serializer->unserialize($idToken);
141
142			$jwsVerifier = new JWSVerifier(
143			$this->algorithmManager
144			);
145
146			if (0 === \strpos($expectedAlg, 'HS')) {
147			$clientSecret = $metadata->getClientSecret();
148
149			if (! $clientSecret) {
150			throw new RuntimeException('Unable to verify token without client_secret');
151			}
152
153			$jwks = new JWKSet([jose_secret_key($clientSecret)]);
154			} else {
155			$jwks = $client->getIssuer()->getJwks();
156			}
157
158			if (! $jwsVerifier->verifyWithKeySet($jws, $jwks, 0)) {
159			throw new InvalidArgumentException('Failed to validate JWT signature');
160			}
161
162			return $payload;
163			}
164			}
165

thomasvargiu / php-openid-client

Push — master ( 898cc7...450add )

IdTokenVerifier::validateUserinfoToken() A

Complexity

Size

Duplication

Code Coverage

Importance

Duplication Side-by-Side

Filter issues like