SP.php

Go to the documentation of this file.

<?php

class sspmod_saml_Auth_Source_SP extends SimpleSAML_Auth_Source
{
    private $entityId;

    private $metadata;

    private $idp;

    private $discoURL;

    public function __construct($info, $config)
    {
        assert(is_array($info));
        assert(is_array($config));

        // Call the parent constructor first, as required by the interface
        parent::__construct($info, $config);

        if (!isset($config['entityID'])) {
            $config['entityID'] = $this->getMetadataURL();
        }

        /* For compatibility with code that assumes that $metadata->getString('entityid')
         * gives the entity id. */
        $config['entityid'] = $config['entityID'];

        $this->metadata = SimpleSAML_Configuration::loadFromArray($config,
            'authsources[' . var_export($this->authId, true) . ']');
        $this->entityId = $this->metadata->getString('entityID');
        $this->idp = $this->metadata->getString('idp', null);
        $this->discoURL = $this->metadata->getString('discoURL', null);

        if (empty($this->discoURL) && SimpleSAML\Module::isModuleEnabled('discojuice')) {
            $this->discoURL = SimpleSAML\Module::getModuleURL('discojuice/central.php');
        }
    }

    public function getMetadataURL()
    {
        return SimpleSAML\Module::getModuleURL('saml/sp/metadata.php/' . urlencode($this->authId));
    }

    public function getEntityId()
    {
        return $this->entityId;
    }

    public function getMetadata()
    {
        return $this->metadata;
    }

    public function getIdPMetadata($entityId)
    {
        assert(is_string($entityId));

        if ($this->idp !== null && $this->idp !== $entityId) {
            throw new SimpleSAML_Error_Exception('Cannot retrieve metadata for IdP ' .
                var_export($entityId, true) .
                ' because it isn\'t a valid IdP for this SP.');
        }

        $metadataHandler = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();

        // First, look in saml20-idp-remote.
        try {
            return $metadataHandler->getMetaDataConfig($entityId, 'saml20-idp-remote');
        } catch (Exception $e) {
            /* Metadata wasn't found. */
            SimpleSAML\Logger::debug('getIdpMetadata: ' . $e->getMessage());
        }

        /* Not found in saml20-idp-remote, look in shib13-idp-remote. */
        try {
            return $metadataHandler->getMetaDataConfig($entityId, 'shib13-idp-remote');
        } catch (Exception $e) {
            /* Metadata wasn't found. */
            SimpleSAML\Logger::debug('getIdpMetadata: ' . $e->getMessage());
        }

        /* Not found. */
        throw new SimpleSAML_Error_Exception('Could not find the metadata of an IdP with entity ID ' .
            var_export($entityId, true));
    }

    private function startSSO1(SimpleSAML_Configuration $idpMetadata, array $state)
    {
        $idpEntityId = $idpMetadata->getString('entityid');

        $state['saml:idp'] = $idpEntityId;

        $ar = new \SimpleSAML\XML\Shib13\AuthnRequest();
        $ar->setIssuer($this->entityId);

        $id = SimpleSAML_Auth_State::saveState($state, 'saml:sp:sso');
        $ar->setRelayState($id);

        $useArtifact = $idpMetadata->getBoolean('saml1.useartifact', null);
        if ($useArtifact === null) {
            $useArtifact = $this->metadata->getBoolean('saml1.useartifact', false);
        }

        if ($useArtifact) {
            $shire = SimpleSAML\Module::getModuleURL('saml/sp/saml1-acs.php/' . $this->authId . '/artifact');
        } else {
            $shire = SimpleSAML\Module::getModuleURL('saml/sp/saml1-acs.php/' . $this->authId);
        }

        $url = $ar->createRedirect($idpEntityId, $shire);

        SimpleSAML\Logger::debug('Starting SAML 1 SSO to ' . var_export($idpEntityId, true) .
            ' from ' . var_export($this->entityId, true) . '.');
        \SimpleSAML\Utils\HTTP::redirectTrustedURL($url);
    }

    private function startSSO2(SimpleSAML_Configuration $idpMetadata, array $state)
    {
        if (isset($state['saml:ProxyCount']) && $state['saml:ProxyCount'] < 0) {
            SimpleSAML_Auth_State::throwException(
                $state,
                new \SimpleSAML\Module\saml\Error\ProxyCountExceeded(\SAML2\Constants::STATUS_RESPONDER)
            );
        }

        $ar = sspmod_saml_Message::buildAuthnRequest($this->metadata, $idpMetadata);

                // ilias-patch: begin
                // see: https://bugs.launchpad.net/mahara/+bug/1689685
                // see: https://github.com/simplesamlphp/simplesamlphp/issues/503
                //$ar->setAssertionConsumerServiceURL(SimpleSAML\Module::getModuleURL('saml/sp/saml2-acs.php/' . $this->authId));
                $ar->setAssertionConsumerServiceURL(ILIAS_HTTP_PATH . '/Services/Saml/lib/saml2-acs.php/default-sp/' . CLIENT_ID);
                // ilias-patch: end

        if (isset($state['SimpleSAML_Auth_Source.ReturnURL'])) {
            $ar->setRelayState($state['SimpleSAML_Auth_Source.ReturnURL']);
        }

        if (isset($state['saml:AuthnContextClassRef'])) {
            $accr = SimpleSAML\Utils\Arrays::arrayize($state['saml:AuthnContextClassRef']);
            $comp = SAML2\Constants::COMPARISON_EXACT;
            if (isset($state['saml:AuthnContextComparison']) && in_array($state['AuthnContextComparison'], array(
                        SAML2\Constants::COMPARISON_EXACT,
                        SAML2\Constants::COMPARISON_MINIMUM,
                        SAML2\Constants::COMPARISON_MAXIMUM,
                        SAML2\Constants::COMPARISON_BETTER,
            ), true)) {
                $comp = $state['saml:AuthnContextComparison'];
            }
            $ar->setRequestedAuthnContext(array('AuthnContextClassRef' => $accr, 'Comparison' => $comp));
        }

        if (isset($state['ForceAuthn'])) {
            $ar->setForceAuthn((bool)$state['ForceAuthn']);
        }

        if (isset($state['isPassive'])) {
            $ar->setIsPassive((bool)$state['isPassive']);
        }

        if (isset($state['saml:NameID'])) {
            if (!is_array($state['saml:NameID']) && !is_a($state['saml:NameID'], '\SAML2\XML\saml\NameID')) {
                throw new SimpleSAML_Error_Exception('Invalid value of $state[\'saml:NameID\'].');
            }
            $ar->setNameId($state['saml:NameID']);
        }

        if (isset($state['saml:NameIDPolicy'])) {
            if (is_string($state['saml:NameIDPolicy'])) {
                $policy = array(
                    'Format' => (string)$state['saml:NameIDPolicy'],
                    'AllowCreate' => true,
                );
            } elseif (is_array($state['saml:NameIDPolicy'])) {
                $policy = $state['saml:NameIDPolicy'];
            } else {
                throw new SimpleSAML_Error_Exception('Invalid value of $state[\'saml:NameIDPolicy\'].');
            }
            $ar->setNameIdPolicy($policy);
        }

        if (isset($state['saml:IDPList'])) {
            $IDPList = $state['saml:IDPList'];
        } else {
            $IDPList = array();
        }

        $ar->setIDPList(array_unique(array_merge($this->metadata->getArray('IDPList', array()), 
                                                $idpMetadata->getArray('IDPList', array()),
                                                (array) $IDPList)));

        if (isset($state['saml:ProxyCount']) && $state['saml:ProxyCount'] !== null) {
            $ar->setProxyCount($state['saml:ProxyCount']);
        } elseif ($idpMetadata->getInteger('ProxyCount', null) !== null) {
            $ar->setProxyCount($idpMetadata->getInteger('ProxyCount', null));
        } elseif ($this->metadata->getInteger('ProxyCount', null) !== null) {
            $ar->setProxyCount($this->metadata->getInteger('ProxyCount', null));
        }

        $requesterID = array();
        if (isset($state['saml:RequesterID'])) {
            $requesterID = $state['saml:RequesterID'];
        }

        if (isset($state['core:SP'])) {
            $requesterID[] = $state['core:SP'];
        }

        $ar->setRequesterID($requesterID);

        if (isset($state['saml:Extensions'])) {
            $ar->setExtensions($state['saml:Extensions']);
        }

        // save IdP entity ID as part of the state
        $state['ExpectedIssuer'] = $idpMetadata->getString('entityid');

        $id = SimpleSAML_Auth_State::saveState($state, 'saml:sp:sso', true);
        $ar->setId($id);

        SimpleSAML\Logger::debug('Sending SAML 2 AuthnRequest to ' .
            var_export($idpMetadata->getString('entityid'), true));

        /* Select appropriate SSO endpoint */
        if ($ar->getProtocolBinding() === \SAML2\Constants::BINDING_HOK_SSO) {
            $dst = $idpMetadata->getDefaultEndpoint('SingleSignOnService', array(
                \SAML2\Constants::BINDING_HOK_SSO)
            );
        } else {
            $dst = $idpMetadata->getEndpointPrioritizedByBinding('SingleSignOnService', [
                \SAML2\Constants::BINDING_HTTP_REDIRECT,
                \SAML2\Constants::BINDING_HTTP_POST,
            ]);
        }
        $ar->setDestination($dst['Location']);

        $b = \SAML2\Binding::getBinding($dst['Binding']);

        $this->sendSAML2AuthnRequest($state, $b, $ar);

        assert(false);
    }

    public function sendSAML2AuthnRequest(array &$state, \SAML2\Binding $binding, \SAML2\AuthnRequest $ar)
    {
        $binding->send($ar);
        assert(false);
    }

    public function startSSO($idp, array $state)
    {
        assert(is_string($idp));

        $idpMetadata = $this->getIdPMetadata($idp);

        $type = $idpMetadata->getString('metadata-set');
        switch ($type) {
        case 'shib13-idp-remote':
            $this->startSSO1($idpMetadata, $state);
            assert(false); /* Should not return. */
        case 'saml20-idp-remote':
            $this->startSSO2($idpMetadata, $state);
            assert(false); /* Should not return. */
        default:
            /* Should only be one of the known types. */
            assert(false);
        }
    }

    private function startDisco(array $state)
    {
        $id = SimpleSAML_Auth_State::saveState($state, 'saml:sp:sso');

        $discoURL = $this->discoURL;
        if ($discoURL === null) {
            /* Fallback to internal discovery service. */
            $discoURL = SimpleSAML\Module::getModuleURL('saml/disco.php');
        }

        $returnTo = SimpleSAML\Module::getModuleURL('saml/sp/discoresp.php', array('AuthID' => $id));

        $params = array(
            'entityID' => $this->entityId,
            'return' => $returnTo,
            'returnIDParam' => 'idpentityid'
        );

        if(isset($state['saml:IDPList'])) {
            $params['IDPList'] = $state['saml:IDPList'];
        }

        if (isset($state['isPassive']) && $state['isPassive']) {
            $params['isPassive'] = 'true';
        }

        \SimpleSAML\Utils\HTTP::redirectTrustedURL($discoURL, $params);
    }

    public function authenticate(&$state)
    {
        assert(is_array($state));

        /* We are going to need the authId in order to retrieve this authentication source later. */
        $state['saml:sp:AuthId'] = $this->authId;

        $idp = $this->idp;

        if (isset($state['saml:idp'])) {
            $idp = (string)$state['saml:idp'];
        }

        if (isset($state['saml:IDPList']) && sizeof($state['saml:IDPList']) > 0) {
            // we have a SAML IDPList (we are a proxy): filter the list of IdPs available
            $mdh = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
            $known_idps = $mdh->getList();
            $intersection = array_intersect($state['saml:IDPList'], array_keys($known_idps));

            if (empty($intersection)) {
                // all requested IdPs are unknown
                throw new SimpleSAML\Module\saml\Error\NoSupportedIDP(
                    \SAML2\Constants::STATUS_REQUESTER,
                    'None of the IdPs requested are supported by this proxy.'
                );
            }

            if (!is_null($idp) && !in_array($idp, $intersection, true)) {
                // the IdP is enforced but not in the IDPList
                throw new SimpleSAML\Module\saml\Error\NoAvailableIDP(
                    \SAML2\Constants::STATUS_REQUESTER,
                    'None of the IdPs requested are available to this proxy.'
                );
            }

            if (is_null($idp) && sizeof($intersection) === 1) {
                // only one IdP requested or valid
                $idp = current($state['saml:IDPList']);
            }
        }

        if ($idp === null) {
            $this->startDisco($state);
            assert(false);
        }

        $this->startSSO($idp, $state);
        assert(false);
    }

    public function reauthenticate(array &$state)
    {
        assert(is_array($state));

        $session = SimpleSAML_Session::getSessionFromRequest();
        $data = $session->getAuthState($this->authId);
        foreach ($data as $k => $v) {
            $state[$k] = $v;
        }

        // check if we have an IDPList specified in the request
        if (isset($state['saml:IDPList']) && sizeof($state['saml:IDPList']) > 0 &&
            !in_array($state['saml:sp:IdP'], $state['saml:IDPList'], true))
        {
            /*
             * The user has an existing, valid session. However, the SP
             * provided a list of IdPs it accepts for authentication, and
             * the IdP the existing session is related to is not in that list.
             *
             * First, check if we recognize any of the IdPs requested.
             */

            $mdh = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
            $known_idps = $mdh->getList();
            $intersection = array_intersect($state['saml:IDPList'], array_keys($known_idps));

            if (empty($intersection)) {
                // all requested IdPs are unknown
                throw new SimpleSAML\Module\saml\Error\NoSupportedIDP(
                    \SAML2\Constants::STATUS_REQUESTER,
                    'None of the IdPs requested are supported by this proxy.'
                );
            }

            /*
             * We have at least one IdP in the IDPList that we recognize, and
             * it's not the one currently in use. Let's see if this proxy
             * enforces the use of one single IdP.
             */
            if (!is_null($this->idp) && !in_array($this->idp, $intersection, true)) {
                // an IdP is enforced but not requested
                throw new SimpleSAML\Module\saml\Error\NoAvailableIDP(
                    \SAML2\Constants::STATUS_REQUESTER,
                    'None of the IdPs requested are available to this proxy.'
                );
            }

            /*
             * We need to inform the user, and ask whether we should logout before
             * starting the authentication process again with a different IdP, or
             * cancel the current SSO attempt.
             */
            SimpleSAML\Logger::warning(
                "Reauthentication after logout is needed. The IdP '${state['saml:sp:IdP']}' is not in the IDPList ".
                "provided by the Service Provider '${state['core:SP']}'."
            );

            $state['saml:sp:IdPMetadata'] = $this->getIdPMetadata($state['saml:sp:IdP']);
            $state['saml:sp:AuthId'] = $this->authId;
            self::askForIdPChange($state);
        }
    }


    public static function askForIdPChange(array &$state)
    {
        assert(array_key_exists('saml:sp:IdPMetadata', $state));
        assert(array_key_exists('saml:sp:AuthId', $state));
        assert(array_key_exists('core:IdP', $state));
        assert(array_key_exists('SPMetadata', $state));

        if (isset($state['isPassive']) && (bool)$state['isPassive']) {
            // passive request, we cannot authenticate the user
            throw new SimpleSAML\Module\saml\Error\NoPassive(
                    \SAML2\Constants::STATUS_REQUESTER,
                    'Reauthentication required'
            );
        }

        // save the state WITHOUT a restart URL, so that we don't try an IdP-initiated login if something goes wrong
        $id = SimpleSAML_Auth_State::saveState($state, 'saml:proxy:invalid_idp', true);
        $url = SimpleSAML\Module::getModuleURL('saml/proxy/invalid_session.php');
        SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('AuthState' => $id));
        assert(false);
    }

    public static function reauthLogout(array $state)
    {
        SimpleSAML\Logger::debug('Proxy: logging the user out before re-authentication.');

        if (isset($state['Responder'])) {
            $state['saml:proxy:reauthLogout:PrevResponder'] = $state['Responder'];
        }
        $state['Responder'] = array('sspmod_saml_Auth_Source_SP', 'reauthPostLogout');

        $idp = SimpleSAML_IdP::getByState($state);
        $idp->handleLogoutRequest($state, null);
        assert(false);
    }

    public static function reauthPostLogin(array $state)
    {
        assert(isset($state['ReturnCallback']));

        // Update session state
        $session = SimpleSAML_Session::getSessionFromRequest();
        $authId = $state['saml:sp:AuthId'];
        $session->doLogin($authId, SimpleSAML_Auth_State::getPersistentAuthData($state));

        // resume the login process
        call_user_func($state['ReturnCallback'], $state);
        assert(false);
    }

    public static function reauthPostLogout(SimpleSAML_IdP $idp, array $state)
    {
        assert(isset($state['saml:sp:AuthId']));

        SimpleSAML\Logger::debug('Proxy: logout completed.');

        if (isset($state['saml:proxy:reauthLogout:PrevResponder'])) {
            $state['Responder'] = $state['saml:proxy:reauthLogout:PrevResponder'];
        }

        $sp = SimpleSAML_Auth_Source::getById($state['saml:sp:AuthId'], 'sspmod_saml_Auth_Source_SP');
        SimpleSAML\Logger::debug('Proxy: logging in again.');
        $sp->authenticate($state);
        assert(false);
    }

    public function startSLO2(&$state)
    {
        assert(is_array($state));
        assert(array_key_exists('saml:logout:IdP', $state));
        assert(array_key_exists('saml:logout:NameID', $state));
        assert(array_key_exists('saml:logout:SessionIndex', $state));

        $id = SimpleSAML_Auth_State::saveState($state, 'saml:slosent');

        $idp = $state['saml:logout:IdP'];
        $nameId = $state['saml:logout:NameID'];
        $sessionIndex = $state['saml:logout:SessionIndex'];

        $idpMetadata = $this->getIdPMetadata($idp);

        $endpoint = $idpMetadata->getEndpointPrioritizedByBinding('SingleLogoutService', array(
            \SAML2\Constants::BINDING_HTTP_REDIRECT,
            \SAML2\Constants::BINDING_HTTP_POST), false);
        if ($endpoint === false) {
            SimpleSAML\Logger::info('No logout endpoint for IdP ' . var_export($idp, true) . '.');
            return;
        }

        $lr = sspmod_saml_Message::buildLogoutRequest($this->metadata, $idpMetadata);
        $lr->setNameId($nameId);
        $lr->setSessionIndex($sessionIndex);
        $lr->setRelayState($id);
        $lr->setDestination($endpoint['Location']);

        $encryptNameId = $idpMetadata->getBoolean('nameid.encryption', null);
        if ($encryptNameId === null) {
            $encryptNameId = $this->metadata->getBoolean('nameid.encryption', false);
        }
        if ($encryptNameId) {
            $lr->encryptNameId(sspmod_saml_Message::getEncryptionKey($idpMetadata));
        }

        $b = \SAML2\Binding::getBinding($endpoint['Binding']);
        $b->send($lr);

        assert(false);
    }

    public function logout(&$state)
    {
        assert(is_array($state));
        assert(array_key_exists('saml:logout:Type', $state));

        $logoutType = $state['saml:logout:Type'];
        switch ($logoutType) {
        case 'saml1':
            /* Nothing to do. */
            return;
        case 'saml2':
            $this->startSLO2($state);
            return;
        default:
            /* Should never happen. */
            assert(false);
        }
    }

    public function handleResponse(array $state, $idp, array $attributes)
    {
        assert(is_string($idp));
        assert(array_key_exists('LogoutState', $state));
        assert(array_key_exists('saml:logout:Type', $state['LogoutState']));

        $idpMetadata = $this->getIdpMetadata($idp);

        $spMetadataArray = $this->metadata->toArray();
        $idpMetadataArray = $idpMetadata->toArray();

        /* Save the IdP in the state array. */
        $state['saml:sp:IdP'] = $idp;
        $state['PersistentAuthData'][] = 'saml:sp:IdP';

        $authProcState = array(
            'saml:sp:IdP' => $idp,
            'saml:sp:State' => $state,
            'ReturnCall' => array('sspmod_saml_Auth_Source_SP', 'onProcessingCompleted'),

            'Attributes' => $attributes,
            'Destination' => $spMetadataArray,
            'Source' => $idpMetadataArray,
        );

        if (isset($state['saml:sp:NameID'])) {
            $authProcState['saml:sp:NameID'] = $state['saml:sp:NameID'];
        }
        if (isset($state['saml:sp:SessionIndex'])) {
            $authProcState['saml:sp:SessionIndex'] = $state['saml:sp:SessionIndex'];
        }

        $pc = new SimpleSAML_Auth_ProcessingChain($idpMetadataArray, $spMetadataArray, 'sp');
        $pc->processState($authProcState);

        self::onProcessingCompleted($authProcState);
    }

    public function handleLogout($idpEntityId)
    {
        assert(is_string($idpEntityId));

        /* Call the logout callback we registered in onProcessingCompleted(). */
        $this->callLogoutCallback($idpEntityId);
    }

    public static function handleUnsolicitedAuth($authId, array $state, $redirectTo)
    {
        assert(is_string($authId));
        assert(is_string($redirectTo));

        $session = SimpleSAML_Session::getSessionFromRequest();
        $session->doLogin($authId, SimpleSAML_Auth_State::getPersistentAuthData($state));

        \SimpleSAML\Utils\HTTP::redirectUntrustedURL($redirectTo);
    }

    public static function onProcessingCompleted(array $authProcState)
    {
        assert(array_key_exists('saml:sp:IdP', $authProcState));
        assert(array_key_exists('saml:sp:State', $authProcState));
        assert(array_key_exists('Attributes', $authProcState));

        $idp = $authProcState['saml:sp:IdP'];
        $state = $authProcState['saml:sp:State'];

        $sourceId = $state['saml:sp:AuthId'];
        $source = SimpleSAML_Auth_Source::getById($sourceId);
        if ($source === null) {
            throw new Exception('Could not find authentication source with id ' . $sourceId);
        }

        /* Register a callback that we can call if we receive a logout request from the IdP. */
        $source->addLogoutCallback($idp, $state);

        $state['Attributes'] = $authProcState['Attributes'];

        if (isset($state['saml:sp:isUnsolicited']) && (bool)$state['saml:sp:isUnsolicited']) {
            if (!empty($state['saml:sp:RelayState'])) {
                $redirectTo = $state['saml:sp:RelayState'];
            } else {
                $redirectTo = $source->getMetadata()->getString('RelayState', '/');
            }
            self::handleUnsolicitedAuth($sourceId, $state, $redirectTo);
        }

        SimpleSAML_Auth_Source::completeAuth($state);
    }
}