IdP.php

Go to the documentation of this file.

<?php


class SimpleSAML_IdP
{

    private static $idpCache = array();


    private $id;


    private $associationGroup;


    private $config;


    private $authSource;


    private function __construct($id)
    {
        assert('is_string($id)');

        $this->id = $id;

        $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
        $globalConfig = SimpleSAML_Configuration::getInstance();

        if (substr($id, 0, 6) === 'saml2:') {
            if (!$globalConfig->getBoolean('enable.saml20-idp', false)) {
                throw new SimpleSAML_Error_Exception('enable.saml20-idp disabled in config.php.');
            }
            $this->config = $metadata->getMetaDataConfig(substr($id, 6), 'saml20-idp-hosted');
        } elseif (substr($id, 0, 6) === 'saml1:') {
            if (!$globalConfig->getBoolean('enable.shib13-idp', false)) {
                throw new SimpleSAML_Error_Exception('enable.shib13-idp disabled in config.php.');
            }
            $this->config = $metadata->getMetaDataConfig(substr($id, 6), 'shib13-idp-hosted');
        } elseif (substr($id, 0, 5) === 'adfs:') {
            if (!$globalConfig->getBoolean('enable.adfs-idp', false)) {
                throw new SimpleSAML_Error_Exception('enable.adfs-idp disabled in config.php.');
            }
            $this->config = $metadata->getMetaDataConfig(substr($id, 5), 'adfs-idp-hosted');

            try {
                // this makes the ADFS IdP use the same SP associations as the SAML 2.0 IdP
                $saml2EntityId = $metadata->getMetaDataCurrentEntityID('saml20-idp-hosted');
                $this->associationGroup = 'saml2:'.$saml2EntityId;
            } catch (Exception $e) {
                // probably no SAML 2 IdP configured for this host. Ignore the error
            }
        } else {
            assert(false);
        }

        if ($this->associationGroup === null) {
            $this->associationGroup = $this->id;
        }

        $auth = $this->config->getString('auth');
        if (SimpleSAML_Auth_Source::getById($auth) !== null) {
            $this->authSource = new \SimpleSAML\Auth\Simple($auth);
        } else {
            throw new SimpleSAML_Error_Exception('No such "'.$auth.'" auth source found.');
        }
    }


    public function getId()
    {
        return $this->id;
    }


    public static function getById($id)
    {
        assert('is_string($id)');

        if (isset(self::$idpCache[$id])) {
            return self::$idpCache[$id];
        }

        $idp = new self($id);
        self::$idpCache[$id] = $idp;
        return $idp;
    }


    public static function getByState(array &$state)
    {
        assert('isset($state["core:IdP"])');

        return self::getById($state['core:IdP']);
    }


    public function getConfig()
    {
        return $this->config;
    }


    public function getSPName($assocId)
    {
        assert('is_string($assocId)');

        $prefix = substr($assocId, 0, 4);
        $spEntityId = substr($assocId, strlen($prefix) + 1);
        $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();

        if ($prefix === 'saml') {
            try {
                $spMetadata = $metadata->getMetaDataConfig($spEntityId, 'saml20-sp-remote');
            } catch (Exception $e) {
                try {
                    $spMetadata = $metadata->getMetaDataConfig($spEntityId, 'shib13-sp-remote');
                } catch (Exception $e) {
                    return null;
                }
            }
        } else {
            if ($prefix === 'adfs') {
                $spMetadata = $metadata->getMetaDataConfig($spEntityId, 'adfs-sp-remote');
            } else {
                return null;
            }
        }

        if ($spMetadata->hasValue('name')) {
            return $spMetadata->getLocalizedString('name');
        } elseif ($spMetadata->hasValue('OrganizationDisplayName')) {
            return $spMetadata->getLocalizedString('OrganizationDisplayName');
        } else {
            return array('en' => $spEntityId);
        }
    }


    public function addAssociation(array $association)
    {
        assert('isset($association["id"])');
        assert('isset($association["Handler"])');

        $association['core:IdP'] = $this->id;

        $session = SimpleSAML_Session::getSessionFromRequest();
        $session->addAssociation($this->associationGroup, $association);
    }


    public function getAssociations()
    {
        $session = SimpleSAML_Session::getSessionFromRequest();
        return $session->getAssociations($this->associationGroup);
    }


    public function terminateAssociation($assocId)
    {
        assert('is_string($assocId)');

        $session = SimpleSAML_Session::getSessionFromRequest();
        $session->terminateAssociation($this->associationGroup, $assocId);
    }


    public function isAuthenticated()
    {
        return $this->authSource->isAuthenticated();
    }


    public static function postAuthProc(array $state)
    {
        assert('is_callable($state["Responder"])');

        if (isset($state['core:SP'])) {
            $session = SimpleSAML_Session::getSessionFromRequest();
            $session->setData(
                'core:idp-ssotime',
                $state['core:IdP'].';'.$state['core:SP'],
                time(),
                SimpleSAML_Session::DATA_TIMEOUT_SESSION_END
            );
        }

        call_user_func($state['Responder'], $state);
        assert('FALSE');
    }


    public static function postAuth(array $state)
    {
        $idp = SimpleSAML_IdP::getByState($state);

        if (!$idp->isAuthenticated()) {
            throw new SimpleSAML_Error_Exception('Not authenticated.');
        }

        $state['Attributes'] = $idp->authSource->getAttributes();

        if (isset($state['SPMetadata'])) {
            $spMetadata = $state['SPMetadata'];
        } else {
            $spMetadata = array();
        }

        if (isset($state['core:SP'])) {
            $session = SimpleSAML_Session::getSessionFromRequest();
            $previousSSOTime = $session->getData('core:idp-ssotime', $state['core:IdP'].';'.$state['core:SP']);
            if ($previousSSOTime !== null) {
                $state['PreviousSSOTimestamp'] = $previousSSOTime;
            }
        }

        $idpMetadata = $idp->getConfig()->toArray();

        $pc = new SimpleSAML_Auth_ProcessingChain($idpMetadata, $spMetadata, 'idp');

        $state['ReturnCall'] = array('SimpleSAML_IdP', 'postAuthProc');
        $state['Destination'] = $spMetadata;
        $state['Source'] = $idpMetadata;

        $pc->processState($state);

        self::postAuthProc($state);
    }


    private function authenticate(array &$state)
    {
        if (isset($state['isPassive']) && (bool) $state['isPassive']) {
            throw new SimpleSAML_Error_NoPassive('Passive authentication not supported.');
        }

        $this->authSource->login($state);
    }


    private function reauthenticate(array &$state)
    {
        $sourceImpl = $this->authSource->getAuthSource();
        if ($sourceImpl === null) {
            throw new SimpleSAML_Error_Exception('No such auth source defined.');
        }

        $sourceImpl->reauthenticate($state);
    }


    public function handleAuthenticationRequest(array &$state)
    {
        assert('isset($state["Responder"])');

        $state['core:IdP'] = $this->id;

        if (isset($state['SPMetadata']['entityid'])) {
            $spEntityId = $state['SPMetadata']['entityid'];
        } elseif (isset($state['SPMetadata']['entityID'])) {
            $spEntityId = $state['SPMetadata']['entityID'];
        } else {
            $spEntityId = null;
        }
        $state['core:SP'] = $spEntityId;

        // first, check whether we need to authenticate the user
        if (isset($state['ForceAuthn']) && (bool) $state['ForceAuthn']) {
            // force authentication is in effect
            $needAuth = true;
        } else {
            $needAuth = !$this->isAuthenticated();
        }

        $state['IdPMetadata'] = $this->getConfig()->toArray();
        $state['ReturnCallback'] = array('SimpleSAML_IdP', 'postAuth');

        try {
            if ($needAuth) {
                $this->authenticate($state);
                assert('FALSE');
            } else {
                $this->reauthenticate($state);
            }
            $this->postAuth($state);
        } catch (SimpleSAML_Error_Exception $e) {
            SimpleSAML_Auth_State::throwException($state, $e);
        } catch (Exception $e) {
            $e = new SimpleSAML_Error_UnserializableException($e);
            SimpleSAML_Auth_State::throwException($state, $e);
        }
    }


    public function getLogoutHandler()
    {
        // find the logout handler
        $logouttype = $this->getConfig()->getString('logouttype', 'traditional');
        switch ($logouttype) {
            case 'traditional':
                $handler = 'SimpleSAML\IdP\TraditionalLogoutHandler';
                break;
            case 'iframe':
                $handler = 'SimpleSAML\IdP\IFrameLogoutHandler';
                break;
            default:
                throw new SimpleSAML_Error_Exception('Unknown logout handler: '.var_export($logouttype, true));
        }

        return new $handler($this);
    }


    public function finishLogout(array &$state)
    {
        assert('isset($state["Responder"])');

        $idp = SimpleSAML_IdP::getByState($state);
        call_user_func($state['Responder'], $idp, $state);
        assert('false');
    }


    public function handleLogoutRequest(array &$state, $assocId)
    {
        assert('isset($state["Responder"])');
        assert('is_string($assocId) || is_null($assocId)');

        $state['core:IdP'] = $this->id;
        $state['core:TerminatedAssocId'] = $assocId;

        if ($assocId !== null) {
            $this->terminateAssociation($assocId);
            $session = SimpleSAML_Session::getSessionFromRequest();
            $session->deleteData('core:idp-ssotime', $this->id.':'.$state['saml:SPEntityId']);
        }

        // terminate the local session
        $id = SimpleSAML_Auth_State::saveState($state, 'core:Logout:afterbridge');
        $returnTo = SimpleSAML\Module::getModuleURL('core/idp/resumelogout.php', array('id' => $id));

        $this->authSource->logout($returnTo);

        $handler = $this->getLogoutHandler();
        $handler->startLogout($state, $assocId);
        assert('false');
    }


    public function handleLogoutResponse($assocId, $relayState, SimpleSAML_Error_Exception $error = null)
    {
        assert('is_string($assocId)');
        assert('is_string($relayState) || is_null($relayState)');

        $session = SimpleSAML_Session::getSessionFromRequest();
        $session->deleteData('core:idp-ssotime', $this->id.';'.substr($assocId, strpos($assocId, ':') + 1));

        $handler = $this->getLogoutHandler();
        $handler->onResponse($assocId, $relayState, $error);

        assert('false');
    }


    public function doLogoutRedirect($url)
    {
        assert('is_string($url)');

        $state = array(
            'Responder'       => array('SimpleSAML_IdP', 'finishLogoutRedirect'),
            'core:Logout:URL' => $url,
        );

        $this->handleLogoutRequest($state, null);
        assert('false');
    }


    public static function finishLogoutRedirect(SimpleSAML_IdP $idp, array $state)
    {
        assert('isset($state["core:Logout:URL"])');

        \SimpleSAML\Utils\HTTP::redirectTrustedURL($state['core:Logout:URL']);
        assert('false');
    }
}