Source.php

Go to the documentation of this file.

<?php


abstract class SimpleSAML_Auth_Source
{


    protected $authId;


    public function __construct($info, &$config)
    {
        assert('is_array($info)');
        assert('is_array($config)');

        assert('array_key_exists("AuthId", $info)');
        $this->authId = $info['AuthId'];
    }


    public static function getSourcesOfType($type)
    {
        assert('is_string($type)');

        $config = SimpleSAML_Configuration::getConfig('authsources.php');

        $ret = array();

        $sources = $config->getOptions();
        foreach ($sources as $id) {
            $source = $config->getArray($id);

            self::validateSource($source, $id);

            if ($source[0] !== $type) {
                continue;
            }

            $ret[] = self::parseAuthSource($id, $source);
        }

        return $ret;
    }


    public function getAuthId()
    {
        return $this->authId;
    }


    abstract public function authenticate(&$state);


    public function reauthenticate(array &$state)
    {
        assert('isset($state["ReturnCallback"])');

        // the default implementation just copies over the previous authentication data
        $session = SimpleSAML_Session::getSessionFromRequest();
        $data = $session->getAuthState($this->authId);
        foreach ($data as $k => $v) {
            $state[$k] = $v;
        }
    }


    public static function completeAuth(&$state)
    {
        assert('is_array($state)');
        assert('array_key_exists("LoginCompletedHandler", $state)');

        SimpleSAML_Auth_State::deleteState($state);

        $func = $state['LoginCompletedHandler'];
        assert('is_callable($func)');

        call_user_func($func, $state);
        assert(false);
    }


    public function initLogin($return, $errorURL = null, array $params = array())
    {
        assert('is_string($return) || is_array($return)');
        assert('is_string($errorURL) || is_null($errorURL)');

        $state = array_merge($params, array(
            'SimpleSAML_Auth_Default.id' => $this->authId, // TODO: remove in 2.0
            'SimpleSAML_Auth_Source.id' => $this->authId,
            'SimpleSAML_Auth_Default.Return' => $return, // TODO: remove in 2.0
            'SimpleSAML_Auth_Source.Return' => $return,
            'SimpleSAML_Auth_Default.ErrorURL' => $errorURL, // TODO: remove in 2.0
            'SimpleSAML_Auth_Source.ErrorURL' => $errorURL,
            'LoginCompletedHandler' => array(get_class(), 'loginCompleted'),
            'LogoutCallback' => array(get_class(), 'logoutCallback'),
            'LogoutCallbackState' => array(
                'SimpleSAML_Auth_Default.logoutSource' => $this->authId, // TODO: remove in 2.0
                'SimpleSAML_Auth_Source.logoutSource' => $this->authId,
            ),
        ));

        if (is_string($return)) {
            $state['SimpleSAML_Auth_Default.ReturnURL'] = $return; // TODO: remove in 2.0
            $state['SimpleSAML_Auth_Source.ReturnURL'] = $return;
        }

        if ($errorURL !== null) {
            $state[SimpleSAML_Auth_State::EXCEPTION_HANDLER_URL] = $errorURL;
        }

        try {
            $this->authenticate($state);
        } catch (SimpleSAML_Error_Exception $e) {
            SimpleSAML_Auth_State::throwException($state, $e);
        } catch (Exception $e) {
            $e = new SimpleSAML_Error_UnserializableException($e);
            SimpleSAML_Auth_State::throwException($state, $e);
        }
        self::loginCompleted($state);
    }


    public static function loginCompleted($state)
    {
        assert('is_array($state)');
        assert('array_key_exists("SimpleSAML_Auth_Source.Return", $state)');
        assert('array_key_exists("SimpleSAML_Auth_Source.id", $state)');
        assert('array_key_exists("Attributes", $state)');
        assert('!array_key_exists("LogoutState", $state) || is_array($state["LogoutState"])');

        $return = $state['SimpleSAML_Auth_Source.Return'];

        // save session state
        $session = SimpleSAML_Session::getSessionFromRequest();
        $authId = $state['SimpleSAML_Auth_Source.id'];
        $session->doLogin($authId, SimpleSAML_Auth_State::getPersistentAuthData($state));

        if (is_string($return)) { // redirect...
            \SimpleSAML\Utils\HTTP::redirectTrustedURL($return);
        } else {
            call_user_func($return, $state);
        }
        assert('false');
    }


    public function logout(&$state)
    {
        assert('is_array($state)');
        // default logout handler which doesn't do anything
    }


    public static function completeLogout(&$state)
    {
        assert('is_array($state)');
        assert('array_key_exists("LogoutCompletedHandler", $state)');

        SimpleSAML_Auth_State::deleteState($state);

        $func = $state['LogoutCompletedHandler'];
        assert('is_callable($func)');

        call_user_func($func, $state);
        assert(false);
    }


    private static function parseAuthSource($authId, $config)
    {
        assert('is_string($authId)');
        assert('is_array($config)');

        self::validateSource($config, $authId);

        $className = SimpleSAML\Module::resolveClass($config[0], 'Auth_Source', 'SimpleSAML_Auth_Source');

        $info = array('AuthId' => $authId);
        unset($config[0]);
        return new $className($info, $config);
    }


    public static function getById($authId, $type = null)
    {
        assert('is_string($authId)');
        assert('is_null($type) || is_string($type)');

        // for now - load and parse config file
        $config = SimpleSAML_Configuration::getConfig('authsources.php');

        $authConfig = $config->getArray($authId, null);
        if ($authConfig === null) {
            if ($type !== null) {
                throw new SimpleSAML_Error_Exception(
                    'No authentication source with id '.
                    var_export($authId, true).' found.'
                );
            }
            return null;
        }

        $ret = self::parseAuthSource($authId, $authConfig);

        if ($type === null || $ret instanceof $type) {
            return $ret;
        }

        // the authentication source doesn't have the correct type
        throw new SimpleSAML_Error_Exception(
            'Invalid type of authentication source '.
            var_export($authId, true).'. Was '.var_export(get_class($ret), true).
            ', should be '.var_export($type, true).'.'
        );
    }


    public static function logoutCallback($state)
    {
        assert('is_array($state)');
        assert('array_key_exists("SimpleSAML_Auth_Source.logoutSource", $state)');

        $source = $state['SimpleSAML_Auth_Source.logoutSource'];

        $session = SimpleSAML_Session::getSessionFromRequest();
        if (!$session->isValid($source)) {
            SimpleSAML\Logger::warning(
                'Received logout from an invalid authentication source '.
                var_export($source, true)
            );

            return;
        }
        $session->doLogout($source);
    }


    protected function addLogoutCallback($assoc, $state)
    {
        assert('is_string($assoc)');
        assert('is_array($state)');

        if (!array_key_exists('LogoutCallback', $state)) {
            // the authentication requester doesn't have a logout callback
            return;
        }
        $callback = $state['LogoutCallback'];

        if (array_key_exists('LogoutCallbackState', $state)) {
            $callbackState = $state['LogoutCallbackState'];
        } else {
            $callbackState = array();
        }

        $id = strlen($this->authId).':'.$this->authId.$assoc;

        $data = array(
            'callback' => $callback,
            'state'    => $callbackState,
        );

        $session = SimpleSAML_Session::getSessionFromRequest();
        $session->setData(
            'SimpleSAML_Auth_Source.LogoutCallbacks',
            $id,
            $data,
            SimpleSAML_Session::DATA_TIMEOUT_SESSION_END
        );
    }


    protected function callLogoutCallback($assoc)
    {
        assert('is_string($assoc)');

        $id = strlen($this->authId).':'.$this->authId.$assoc;

        $session = SimpleSAML_Session::getSessionFromRequest();

        $data = $session->getData('SimpleSAML_Auth_Source.LogoutCallbacks', $id);
        if ($data === null) {
            // FIXME: fix for IdP-first flow (issue 397) -> reevaluate logout callback infrastructure
            $session->doLogout($this->authId);

            return;
        }

        assert('is_array($data)');
        assert('array_key_exists("callback", $data)');
        assert('array_key_exists("state", $data)');

        $callback = $data['callback'];
        $callbackState = $data['state'];

        $session->deleteData('SimpleSAML_Auth_Source.LogoutCallbacks', $id);
        call_user_func($callback, $callbackState);
    }


    public static function getSources()
    {
        $config = SimpleSAML_Configuration::getOptionalConfig('authsources.php');

        return $config->getOptions();
    }


    protected static function validateSource($source, $id)
    {
        if (!array_key_exists(0, $source) || !is_string($source[0])) {
            throw new Exception(
                'Invalid authentication source \''.$id.
                '\': First element must be a string which identifies the authentication source.'
            );
        }
    }
}