LiveID.php

Go to the documentation of this file.

<?php
 
class sspmod_authwindowslive_Auth_Source_LiveID extends SimpleSAML_Auth_Source
{
 
    const STAGE_INIT = 'authwindowslive:init';
 
    const AUTHID = 'authwindowslive:AuthId';
 
    private $key;
    private $secret;
 
 
    public function __construct($info, $config)
    {
        assert(is_array($info));
        assert(is_array($config));
 
        // Call the parent constructor first, as required by the interface
        parent::__construct($info, $config);
 
        if (!array_key_exists('key', $config)) {
            throw new Exception('LiveID authentication source is not properly configured: missing [key]');
        }
 
        $this->key = $config['key'];
 
        if (!array_key_exists('secret', $config)) {
            throw new Exception('LiveID authentication source is not properly configured: missing [secret]');
        }
 
        $this->secret = $config['secret'];
    }
 
 
    public function authenticate(&$state)
    {
        assert(is_array($state));
 
        // we are going to need the authId in order to retrieve this authentication source later
        $state[self::AUTHID] = $this->authId;
 
        $stateID = SimpleSAML_Auth_State::saveState($state, self::STAGE_INIT);
 
        SimpleSAML\Logger::debug('authwindowslive auth state id = ' . $stateID);
 
        // authenticate the user
        // documentation at:
        // https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-protocols-oauth-code/
        $authorizeURL = 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize'
                . '?client_id=' . $this->key
                . '&response_type=code'
                . '&response_mode=query'
                . '&redirect_uri=' . urlencode(SimpleSAML\Module::getModuleUrl('authwindowslive') . '/linkback.php')
                . '&state=' . urlencode($stateID)
                . '&scope=' . urlencode('openid https://graph.microsoft.com/user.read')
        ;
 
        \SimpleSAML\Utils\HTTP::redirectTrustedURL($authorizeURL);
    }
 
 
    public function finalStep(&$state)
    {
        SimpleSAML\Logger::debug(
            "authwindowslive oauth: Using this verification code [".$state['authwindowslive:verification_code']."]"
        );
 
        // retrieve Access Token
        // documentation at:
        // https://azure.microsoft.com/en-us/documentation/articles/active-directory-v2-protocols-oauth-code/#request-an-access-token
        $postData = 'client_id=' . urlencode($this->key)
                . '&client_secret=' . urlencode($this->secret)
                . '&scope=' . urlencode('https://graph.microsoft.com/user.read')
                . '&grant_type=authorization_code'
                . '&redirect_uri=' . urlencode(SimpleSAML\Module::getModuleUrl('authwindowslive') . '/linkback.php')
                . '&code=' . urlencode($state['authwindowslive:verification_code']);
 
        $context = array(
            'http' => array(
                'method'  => 'POST',
                'header'  => 'Content-type: application/x-www-form-urlencoded',
                'content' => $postData,
            ),
        );
 
        $result = \SimpleSAML\Utils\HTTP::fetch('https://login.microsoftonline.com/common/oauth2/v2.0/token', $context);
 
        $response = json_decode($result, true);
 
        // error checking of $response to make sure we can proceed
        if (!array_key_exists('access_token', $response)) {
            throw new Exception(
                '['.$response['error'].'] '.$response['error_description'].
                "\r\nNo access_token returned - cannot proceed\r\n" . implode(', ', $response['error_codes'])
            );
        }
 
        SimpleSAML\Logger::debug(
            "authwindowslive: Got an access token from the OAuth service provider [".$response['access_token']."]"
        );
 
        // documentation at: http://graph.microsoft.io/en-us/docs/overview/call_api
        $opts = array('http' => array('header' => "Accept: application/json\r\nAuthorization: Bearer ".
                        $response['access_token']."\r\n"));
        $data = \SimpleSAML\Utils\HTTP::fetch('https://graph.microsoft.com/v1.0/me', $opts);
        $userdata = json_decode($data, true);
 
        // this is the simplest case
        if (!array_key_exists('@odata.context', $userdata) || array_key_exists('error', $userdata)) {
            throw new Exception(
                'Unable to retrieve userdata from Microsoft Graph ['.$userdata['error']['code'].'] '.
                $userdata['error']['message']
            );
        }
        $attributes = array();
        $attributes['windowslive_targetedID'] = array(
            'https://graph.microsoft.com!'.(!empty($userdata['id']) ? $userdata['id'] : 'unknown')
        );
        foreach ($userdata as $key => $value) {
            if (is_string($value)) {
                $attributes['windowslive.' . $key] = array((string)$value);
            }
        }
 
 
        SimpleSAML\Logger::debug('LiveID Returned Attributes: '. implode(", ", array_keys($attributes)));
 
        $state['Attributes'] = $attributes;
    }
}