Skip to content

Commit 94b4a00

Browse files
tvdijenthijskh
tvdijen
authored and
thijskh
committed
Update code for SSP 2.0
1 parent bc23672 commit 94b4a00

3 files changed

Lines changed: 71 additions & 91 deletions

File tree

‎lib/Auth/Process/SFO.php‎

Lines changed: 59 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,44 @@
11
<?php
22

3-
use \SimpleSAML_Configuration as Configuration;
3+
declare(strict_types=1);
4+
5+
namespace SimpleSAML\Module\stepup-sfo;
6+
7+
use Exception;
8+
use SAML2\AuthnRequest;
9+
use SAML2\Binding;
10+
use SAML2\Constants as C;
11+
use SAML2\XML\saml\NameID;
12+
use SimpleSAML\Auth;
13+
use SimpleSAML\Configuration;
14+
use SimpleSAML\Error;
15+
use SimpleSAML\Logger;
16+
use SimpleSAML\Metadata\MetaDataStorageHandler;
17+
use SimpleSAML\Module;
18+
use SimpleSAML\Module\saml\Message;
19+
20+
use function in_array;
21+
use function sprintf;
22+
use function substr;
23+
use function var_export;
424

525
/**
626
* @package SimpleSAMLphp
727
*/
8-
class sspmod_stepupsfo_Auth_Process_SFO extends SimpleSAML_Auth_ProcessingFilter
28+
class SFO extends Auth\ProcessingFilter
929
{
30+
/** @var array */
31+
private array $metadata;
1032

11-
private $metadata;
12-
private $idpMetadata;
33+
/** @var array */
34+
private array $idpMetadata;
35+
36+
/** @var string */
37+
private string $subjectidattribute;
38+
39+
/** @var array */
40+
private array $skipentities = [];
1341

14-
private $subjectidattribute;
15-
private $skipentities = [];
1642

1743
/**
1844
* Initialize this filter.
@@ -25,7 +51,7 @@ public function __construct(array $config, $reserved)
2551
parent::__construct($config, $reserved);
2652

2753
$this->subjectidattribute = $config['subjectattribute'];
28-
if ( isset($config['skipentities']) ) {
54+
if (isset($config['skipentities']) ) {
2955
$this->skipentities = $config['skipentities'];
3056
}
3157

@@ -35,96 +61,100 @@ public function __construct(array $config, $reserved)
3561
$this->metadata = Configuration::loadFromArray($config);
3662
}
3763

64+
3865
/**
3966
* Process an authentication response.
4067
*
4168
* @param array $state The state of the response.
4269
*/
43-
public function process(&$state)
70+
public function process(array &$state): void
4471
{
4572
foreach($this->skipentities as $skip) {
4673
if ($skip === $state['SPMetadata']['entityid'] || in_array($skip, $state['saml:RequesterID'], true)) {
47-
SimpleSAML\Logger::info('SFO - skipping SFO for entity ' . var_export($skip, true));
74+
Logger::info('SFO - skipping SFO for entity ' . var_export($skip, true));
4875
return;
4976
}
5077
}
5178

5279
$state['sfo:sp:metadata'] = $this->metadata;
5380
$state['sfo:idp:entityid'] = $this->idpMetadata->getString('entityid');
54-
$samlstateid = SimpleSAML_Auth_State::saveState($state, 'stepupsfo:pre');
81+
$samlstateid = Auth\State::saveState($state, 'stepupsfo:pre');
5582

56-
if ( empty($state['Attributes'][$this->subjectidattribute]) ) {
83+
if (empty($state['Attributes'][$this->subjectidattribute]) ) {
5784
throw new Exception("Subjectid " . $this->subjectidattribute . " not found in attributes.");
5885
}
5986

6087
$subjectid = $state['Attributes'][$this->subjectidattribute][0];
61-
if ( substr($subjectid,0,18) !== 'urn:collab:person:' ) {
88+
if (substr($subjectid,0,18) !== 'urn:collab:person:' ) {
6289
throw new Exception("Subjectid " . var_export($subjectid,true) . " does not start with urn:collab:person:");
6390
}
6491

65-
$nameid = new \SAML2\XML\saml\NameID();
92+
$nameid = new NameID();
6693
$nameid->setValue($subjectid);
6794

6895
// Start the authentication request
6996
$this->startSFO($this->idpMetadata, $nameid, $samlstateid);
7097
}
7198

99+
72100
/**
73101
* Retrieve the metadata of an IdP.
74102
*
75103
* @param string $entityId The entity id of the IdP.
76-
* @return SimpleSAML_Configuration The metadata of the IdP.
104+
* @return \SimpleSAML\Configuration The metadata of the IdP.
77105
*/
78-
public function getIdPMetadata($entityId)
106+
public function getIdPMetadata(string $entityId): Configuration
79107
{
80-
assert(is_string($entityId));
81-
82-
$metadataHandler = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
108+
$metadataHandler = MetaDataStorageHandler::getMetadataHandler();
83109

84110
try {
85111
return $metadataHandler->getMetaDataConfig($entityId, 'saml20-idp-remote');
86112
} catch (Exception $e) {
87113
/* Metadata wasn't found. */
88-
SimpleSAML\Logger::debug('getIdpMetadata: ' . $e->getMessage());
114+
Logger::debug('getIdpMetadata: ' . $e->getMessage());
89115
}
90116

91117
/* Not found. */
92-
throw new SimpleSAML_Error_Exception('Could not find the metadata of an IdP with entity ID ' .
93-
var_export($entityId, true));
118+
throw new Error\Exception(sprintf(
119+
'Could not find the metadata of an IdP with entity ID %s',
120+
var_export($entityId, true)
121+
);
94122
}
95123

124+
96125
/**
97126
* Send a SAML2 SSO request to the SFO IdP.
98127
*
99-
* @param SimpleSAML_Configuration $idpMetadata The metadata of the IdP.
128+
* @param \SimpleSAML\Configuration $idpMetadata The metadata of the IdP.
100129
* @param \SAML2\XML\saml\NameID $nameid The unspecified NameID of the principal to perform SFO for.
101130
* @param string $relay RelayState to pass
102131
*/
103-
private function startSFO(SimpleSAML_Configuration $idpMetadata, \SAML2\XML\saml\NameID $nameid, $relay)
132+
private function startSFO(Configuration $idpMetadata, NameID $nameid, $relay): void
104133
{
105-
$ar = sspmod_saml_Message::buildAuthnRequest($this->metadata, $idpMetadata);
134+
$ar = Message::buildAuthnRequest($this->metadata, $idpMetadata);
106135

107-
$ar->setAssertionConsumerServiceURL(SimpleSAML\Module::getModuleURL('stepupsfo/acs.php'));
136+
$ar->setAssertionConsumerServiceURL(Module::getModuleURL('stepupsfo/acs.php'));
108137

109138
$ar->setNameId($nameid);
110139
$ar->setRelayState($relay);
111140

112-
SimpleSAML\Logger::debug('Sending SAML 2 SFO AuthnRequest for ' . $nameid->getValue() . ' to ' .
141+
Logger::debug('Sending SAML 2 SFO AuthnRequest for ' . $nameid->getValue() . ' to ' .
113142
var_export($idpMetadata->getString('entityid'), true). ' with id ' . $ar->getId());
114143

115144
$dst = $idpMetadata->getEndpointPrioritizedByBinding('SingleSignOnService',
116-
[ \SAML2\Constants::BINDING_HTTP_REDIRECT ]
145+
[C::BINDING_HTTP_REDIRECT]
117146
);
118147

119148
$ar->setDestination($dst['Location']);
120149

121-
$b = \SAML2\Binding::getBinding($dst['Binding']);
150+
$b = Binding::getBinding($dst['Binding']);
122151

123152
$this->sendSAML2AuthnRequest($b, $ar);
124153

125154
assert(false);
126155
}
127156

157+
128158
/**
129159
* Function to actually send the authentication request.
130160
*
@@ -133,7 +163,7 @@ private function startSFO(SimpleSAML_Configuration $idpMetadata, \SAML2\XML\saml
133163
* @param \SAML2\Binding $binding The binding.
134164
* @param \SAML2\AuthnRequest $ar The authentication request.
135165
*/
136-
private function sendSAML2AuthnRequest(\SAML2\Binding $binding, \SAML2\AuthnRequest $ar)
166+
private function sendSAML2AuthnRequest(Binding $binding, AuthnRequest $ar): void
137167
{
138168
$binding->send($ar);
139169
assert(false);

‎templates/handlestatus.php‎

Lines changed: 0 additions & 47 deletions
This file was deleted.

‎www/acs.php‎

Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?php
2-
use \SimpleSAML_Configuration as Configuration;
2+
3+
use \SimpleSAML\Configuration;
34

45
/**
56
* Receive an assertion from SFO
@@ -11,9 +12,9 @@ function handleStatusResponse($exception, $selfserviceurl)
1112
{
1213
// the status of the response wasn't "success"
1314
SimpleSAML\Logger::debug('SFO - status response received, showing error page.');
14-
$config = SimpleSAML_Configuration::getInstance();
15+
$config = SimpleSAML\Configuration::getInstance();
1516

16-
$t = new SimpleSAML_XHTML_Template($config, 'stepupsfo:handlestatus.php');
17+
$t = new SimpleSAML\XHTML\Template($config, 'stepupsfo:handlestatus.php');
1718
$t->data['status'] = $exception->getStatus();
1819
$t->data['subStatus'] = $exception->getSubStatus();
1920
$t->data['statusMessage'] = $exception->getStatusMessage();
@@ -27,12 +28,12 @@ function handleStatusResponse($exception, $selfserviceurl)
2728
$b = \SAML2\Binding::getCurrentBinding();
2829

2930
if (! $b instanceof \SAML2\HTTPPost) {
30-
throw new SimpleSAML_Error_BadRequest('Only HTTP-POST binding supported for SFO.');
31+
throw new SimpleSAML\Error\BadRequest('Only HTTP-POST binding supported for SFO.');
3132
}
3233

3334
$response = $b->receive();
3435
if (!($response instanceof \SAML2\Response)) {
35-
throw new SimpleSAML_Error_BadRequest('Invalid message received to SFO AssertionConsumerService endpoint.');
36+
throw new SimpleSAML\Error\BadRequest('Invalid message received to SFO AssertionConsumerService endpoint.');
3637
}
3738

3839
$issuer = $response->getIssuer();
@@ -43,38 +44,34 @@ function handleStatusResponse($exception, $selfserviceurl)
4344
', InResponseTo = ' . var_export($inResponseTo,true));
4445
SimpleSAML\Logger::debug('SFO - received response; RelayState = ' . $relaystate);
4546

46-
$prestate = SimpleSAML_Auth_State::loadState($relaystate, 'stepupsfo:pre');
47+
$prestate = SimpleSAML\Auth\State::loadState($relaystate, 'stepupsfo:pre');
4748
$spMetadata = $prestate['sfo:sp:metadata'];
4849
$idpEntityId = $prestate['sfo:idp:entityid'];
4950

5051
// check that the issuer is the one we are expecting
5152
if ($idpEntityId !== $issuer) {
52-
throw new SimpleSAML_Error_Exception(
53+
throw new SimpleSAML\Error\Exception(
5354
'The issuer of the response does not match to the SFO identity provider ' .
5455
'we sent the request to.'
5556
);
5657
}
5758

5859
// Look up metadata for the IdP
59-
$metadataHandler = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
60+
$metadataHandler = SimpleSAML\Metadata\MetaDataStorageHandler::getMetadataHandler();
6061
try {
6162
$idpMetadata = $metadataHandler->getMetaDataConfig($idpEntityId, 'saml20-idp-remote');
6263
} catch (Exception $e) {
6364
/* Not found. */
64-
throw new SimpleSAML_Error_Exception('Could not find the metadata of SFO IdP with entity ID ' .
65+
throw new SimpleSAML\Error\Exception('Could not find the metadata of SFO IdP with entity ID ' .
6566
var_export($entityId, true));
6667
}
6768

6869
// Validate the received response
6970
try {
70-
$assertions = sspmod_saml_Message::processResponse($spMetadata, $idpMetadata, $response);
71-
} catch (sspmod_saml_Error $e) {
72-
// the status of the response wasn't "success" (SSP < 1.17)
73-
handleStatusResponse($e, $idpMetadata->getString('sfo:selfserviceUrl', ''));
71+
$assertions = \SimpleSAML\Module\sam\Message::processResponse($spMetadata, $idpMetadata, $response);
7472
} catch (SimpleSAML\Module\saml\Error $e) {
75-
// the status of the response wasn't "success" (SSP >= 1.17)
7673
handleStatusResponse($e, $idpMetadata->getString('sfo:selfserviceUrl', ''));
7774
}
7875

7976
SimpleSAML\Logger::debug('SFO - successful response received, resume processing');
80-
SimpleSAML_Auth_ProcessingChain::resumeProcessing($prestate);
77+
SimpleSAML\Auth\ProcessingChain::resumeProcessing($prestate);

0 commit comments

Comments
 (0)