Skip to content

Commit 3d2cb21

Browse files
mrvanesmrvanes
committed
Refactoring attempt
1 parent e901c79 commit 3d2cb21

File tree

4 files changed

+163
-113
lines changed

4 files changed

+163
-113
lines changed

‎library/EngineBlock/Corto/Filter/Input.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,8 @@ public function getCommands()
9090
$diContainer->getAttributeAggregationClient()
9191
),
9292

93+
// Check if we need to callout to SRAM to enforce AUP's
94+
// Add SRAM attributes if not
9395
new EngineBlock_Corto_Filter_Command_SRAMInterruptFilter(),
9496

9597
// Check if the Policy Decision Point needs to be consulted for this request

‎library/EngineBlock/Corto/Module/Service/AssertionConsumer.php‎

Lines changed: 6 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -170,69 +170,18 @@ public function serve($serviceName, Request $httpRequest)
170170

171171
$this->_server->filterInputAssertionAttributes($receivedResponse, $receivedRequest);
172172

173-
// Add the consent step
174-
$currentProcessStep = $this->_processingStateHelper->addStep(
175-
$receivedRequest->getId(),
176-
ProcessingStateHelperInterface::STEP_CONSENT,
177-
$this->getEngineSpRole($this->_server),
178-
$receivedResponse
179-
);
180-
181-
// Send SRAM Interrupt call
182-
if ("" != $receivedResponse->getSRAMInterruptNonce()) {
183-
$log->info('Handle SRAM Interrupt callout');
184-
185-
// Add the SRAM step
186-
$this->_processingStateHelper->addStep(
187-
$receivedRequest->getId(),
188-
ProcessingStateHelperInterface::STEP_SRAM,
189-
$this->getEngineSpRole($this->_server),
190-
$receivedResponse
191-
);
192-
193-
// Redirect to SRAM
194-
$this->_server->sendSRAMInterruptRequest($receivedResponse, $receivedRequest);
195-
173+
//Send SRAM Interrupt call
174+
if ($this->_server->handleSRAMInterruptCallout($receivedResponse, $receivedRequest)) {
196175
return;
197176
}
198177

199-
// When dealing with an SP that acts as a trusted proxy, we should use the proxying SP and not the proxy itself.
200-
if ($sp->getCoins()->isTrustedProxy()) {
201-
// Overwrite the trusted proxy SP instance with that of the SP that uses the trusted proxy.
202-
$sp = $this->_server->findOriginalServiceProvider($receivedRequest, $log);
203-
}
204-
205-
$pdpLoas = $receivedResponse->getPdpRequestedLoas();
206-
$loaRepository = $application->getDiContainer()->getLoaRepository();
207-
$authnRequestLoas = $receivedRequest->getStepupObligations($loaRepository->getStepUpLoas());
208-
// Goto consent if no Stepup authentication is needed
209-
if (!$this->_stepupGatewayCallOutHelper->shouldUseStepup($idp, $sp, $authnRequestLoas, $pdpLoas)) {
210-
$this->_server->sendConsentAuthenticationRequest($receivedResponse, $receivedRequest, $currentProcessStep->getRole(), $this->getAuthenticationState());
178+
// Handle Consent authentication callout
179+
if ($this->_server->handleConsentAuthenticationCallout($receivedResponse, $receivedRequest)) {
211180
return;
212181
}
213182

214-
$log->info('Handle Stepup authentication callout');
215-
216-
// Add Stepup authentication step
217-
$currentProcessStep = $this->_processingStateHelper->addStep(
218-
$receivedRequest->getId(),
219-
ProcessingStateHelperInterface::STEP_STEPUP,
220-
$application->getDiContainer()->getStepupIdentityProvider($this->_server),
221-
$receivedResponse
222-
);
223-
224-
// Get mapped AuthnClassRef and get NameId
225-
$nameId = clone $receivedResponse->getNameId();
226-
$authnClassRef = $this->_stepupGatewayCallOutHelper->getStepupLoa($idp, $sp, $authnRequestLoas, $pdpLoas);
227-
228-
$this->_server->sendStepupAuthenticationRequest(
229-
$receivedRequest,
230-
$currentProcessStep->getRole(),
231-
$authnClassRef,
232-
$nameId,
233-
$sp->getCoins()->isStepupForceAuthn()
234-
);
235-
183+
// Handle Stepup authentication callout
184+
$this->_server->handleStepupAuthenticationCallout($receivedResponse, $receivedRequest);
236185
}
237186

238187
/**

‎library/EngineBlock/Corto/Module/Service/SRAMInterrupt.php‎

Lines changed: 2 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -105,56 +105,11 @@ public function serve($serviceName, Request $httpRequest)
105105
* Continue to Consent/StepUp
106106
*/
107107

108-
// Flush log if SP or IdP has additional logging enabled
109-
$issuer = $receivedResponse->getIssuer() ? $receivedResponse->getIssuer()->getValue() : '';
110-
$idp = $this->_server->getRepository()->fetchIdentityProviderByEntityId($issuer);
111-
112-
if ($receivedRequest->isDebugRequest()) {
113-
$sp = $this->_server->getEngineSpRole($this->_server);
114-
} else {
115-
$issuer = $receivedRequest->getIssuer() ? $receivedRequest->getIssuer()->getValue() : '';
116-
$sp = $this->_server->getRepository()->fetchServiceProviderByEntityId($issuer);
117-
}
118-
119-
// When dealing with an SP that acts as a trusted proxy, we should use the proxying SP and not the proxy itself.
120-
if ($sp->getCoins()->isTrustedProxy()) {
121-
// Overwrite the trusted proxy SP instance with that of the SP that uses the trusted proxy.
122-
$sp = $this->_server->findOriginalServiceProvider($receivedRequest, $this->_server->getLogger());
123-
}
124-
125-
$pdpLoas = $receivedResponse->getPdpRequestedLoas();
126-
$loaRepository = $application->getDiContainer()->getLoaRepository();
127-
$authnRequestLoas = $receivedRequest->getStepupObligations($loaRepository->getStepUpLoas());
128-
129-
$shouldUseStepup = $this->_stepupGatewayCallOutHelper->shouldUseStepup($idp, $sp, $authnRequestLoas, $pdpLoas);
130-
131-
// Goto consent if no Stepup authentication is needed
132-
if (!$shouldUseStepup) {
133-
$this->_server->sendConsentAuthenticationRequest($receivedResponse, $receivedRequest, $nextProcessStep->getRole(), $this->_authenticationStateHelper->getAuthenticationState());
108+
if ($this->_server->handleConsentAuthenticationCallout($receivedResponse, $receivedRequest)) {
134109
return;
135110
}
136111

137-
$this->_server->getLogger()->info('Handle Stepup authentication callout');
138-
139-
// Add Stepup authentication step
140-
$currentProcessStep = $this->_processingStateHelper->addStep(
141-
$receivedRequest->getId(),
142-
ProcessingStateHelperInterface::STEP_STEPUP,
143-
$application->getDiContainer()->getStepupIdentityProvider($this->_server),
144-
$receivedResponse
145-
);
146-
147-
// Get mapped AuthnClassRef and get NameId
148-
$nameId = clone $receivedResponse->getNameId();
149-
$authnClassRef = $this->_stepupGatewayCallOutHelper->getStepupLoa($idp, $sp, $authnRequestLoas, $pdpLoas);
150-
151-
$this->_server->sendStepupAuthenticationRequest(
152-
$receivedRequest,
153-
$currentProcessStep->getRole(),
154-
$authnClassRef,
155-
$nameId,
156-
$sp->getCoins()->isStepupForceAuthn()
157-
);
112+
$this->_server->handleStepupAuthenticationCallout($receivedResponse, $receivedRequest);
158113
}
159114

160115
private function getSbsClient()

‎library/EngineBlock/Corto/ProxyServer.php‎

Lines changed: 153 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,10 @@
2626
use OpenConext\EngineBlock\Metadata\MfaEntity;
2727
use OpenConext\EngineBlock\Metadata\Service;
2828
use OpenConext\EngineBlock\Metadata\TransparentMfaEntity;
29+
use OpenConext\EngineBlock\Metadata\X509\KeyPairFactory;
2930
use OpenConext\EngineBlockBundle\Authentication\AuthenticationState;
3031
use OpenConext\EngineBlockBundle\Exception\UnknownKeyIdException;
32+
use OpenConext\EngineBlock\Service\ProcessingStateHelperInterface;
3133
use OpenConext\Value\Saml\Entity;
3234
use OpenConext\Value\Saml\EntityId;
3335
use OpenConext\Value\Saml\EntityType;
@@ -126,6 +128,8 @@ class EngineBlock_Corto_ProxyServer
126128
protected $_templateSource;
127129
protected $_processingMode = false;
128130

131+
protected $_diContainer = null;
132+
129133
/**
130134
* @var EngineBlock_Saml2_AuthnRequestAnnotationDecorator
131135
*/
@@ -144,6 +148,7 @@ class EngineBlock_Corto_ProxyServer
144148
public function __construct(Twig_Environment $twig)
145149
{
146150
$this->_server = $this;
151+
$this->_diContainer = EngineBlock_ApplicationSingleton::getInstance()->getDiContainer();
147152
$this->twig = $twig;
148153
}
149154

@@ -353,6 +358,20 @@ public function getRepository()
353358
return $this->_repository;
354359
}
355360

361+
/**
362+
* @return ServiceProvider
363+
*/
364+
public function getEngineSpRole()
365+
{
366+
$keyId = $this->getKeyId();
367+
if (!$keyId) {
368+
$keyId = KeyPairFactory::DEFAULT_KEY_PAIR_IDENTIFIER;
369+
}
370+
371+
$serviceProvider = $this->_diContainer->getServiceProviderFactory()->createEngineBlockEntityFrom($keyId);
372+
return ServiceProvider::fromServiceProviderEntity($serviceProvider);
373+
}
374+
356375
//////// MAIN /////////
357376

358377
public function serve($serviceName, $remoteIdpMd5 = "")
@@ -402,6 +421,131 @@ public function setRemoteIdpMd5($remoteIdPMd5)
402421
return $this;
403422
}
404423

424+
425+
//////// CALLOUT HANDLERS ////////
426+
427+
function handleSRAMInterruptCallout(
428+
$receivedResponse,
429+
$receivedRequest
430+
) {
431+
$logger = $this->getLogger();
432+
$logger->info('Handle SRAM interrupt callout');
433+
434+
if ("" != $receivedResponse->getSRAMInterruptNonce()) {
435+
436+
// Add the SRAM step
437+
$this->_diContainer->getProcessingStateHelper()->addStep(
438+
$receivedRequest->getId(),
439+
ProcessingStateHelperInterface::STEP_SRAM,
440+
$this->getEngineSpRole(),
441+
$receivedResponse
442+
);
443+
444+
// Redirect to SRAM
445+
$this->sendSRAMInterruptRequest($receivedResponse, $receivedRequest);
446+
447+
return true;
448+
}
449+
450+
return false;
451+
}
452+
453+
function handleStepupAuthenticationCallout(
454+
$receivedResponse,
455+
$receivedRequest
456+
) {
457+
$logger = $this->getLogger();
458+
$logger->info('Handle Stepup authentication callout');
459+
460+
// Add Stepup authentication step
461+
$currentProcessStep = $this->_diContainer->getProcessingStateHelper()->addStep(
462+
$receivedRequest->getId(),
463+
ProcessingStateHelperInterface::STEP_STEPUP,
464+
$this->_diContainer->getStepupIdentityProvider($this),
465+
$receivedResponse
466+
);
467+
468+
if ($receivedRequest->isDebugRequest()) {
469+
$sp = $this->getEngineSpRole();
470+
} else {
471+
$issuer = $receivedRequest->getIssuer() ? $receivedRequest->getIssuer()->getValue() : '';
472+
$sp = $this->getRepository()->fetchServiceProviderByEntityId($issuer);
473+
}
474+
475+
$issuer = $receivedResponse->getIssuer() ? $receivedResponse->getIssuer()->getValue() : '';
476+
$idp = $this->getRepository()->fetchIdentityProviderByEntityId($issuer);
477+
478+
// When dealing with an SP that acts as a trusted proxy, we should use the proxying SP and not the proxy itself.
479+
if ($sp->getCoins()->isTrustedProxy()) {
480+
// Overwrite the trusted proxy SP instance with that of the SP that uses the trusted proxy.
481+
$sp = $this->findOriginalServiceProvider($receivedRequest, $logger);
482+
}
483+
484+
$pdpLoas = $receivedResponse->getPdpRequestedLoas();
485+
$loaRepository = $this->_diContainer->getLoaRepository();
486+
$authnRequestLoas = $receivedRequest->getStepupObligations($loaRepository->getStepUpLoas());
487+
488+
// Get mapped AuthnClassRef and get NameId
489+
$nameId = clone $receivedResponse->getNameId();
490+
$authnClassRef = $this->_diContainer->getStepupGatewayCallOutHelper()->getStepupLoa($idp, $sp, $authnRequestLoas, $pdpLoas);
491+
492+
$this->sendStepupAuthenticationRequest(
493+
$receivedRequest,
494+
$currentProcessStep->getRole(),
495+
$authnClassRef,
496+
$nameId,
497+
$sp->getCoins()->isStepupForceAuthn()
498+
);
499+
}
500+
501+
function handleConsentAuthenticationCallout(
502+
$receivedResponse,
503+
$receivedRequest
504+
// $currentProcessStep
505+
) {
506+
$logger = $this->getLogger();
507+
$logger->info('Handle Consent authentication callout');
508+
509+
// Add the consent step
510+
$currentProcessStep = $this->_diContainer->getProcessingStateHelper()->addStep(
511+
$receivedRequest->getId(),
512+
ProcessingStateHelperInterface::STEP_CONSENT,
513+
$this->getEngineSpRole(),
514+
$receivedResponse
515+
);
516+
517+
$issuer = $receivedResponse->getIssuer() ? $receivedResponse->getIssuer()->getValue() : '';
518+
$idp = $this->getRepository()->fetchIdentityProviderByEntityId($issuer);
519+
520+
if ($receivedRequest->isDebugRequest()) {
521+
$sp = $this->getEngineSpRole();
522+
} else {
523+
$issuer = $receivedRequest->getIssuer() ? $receivedRequest->getIssuer()->getValue() : '';
524+
$sp = $this->getRepository()->fetchServiceProviderByEntityId($issuer);
525+
}
526+
527+
// When dealing with an SP that acts as a trusted proxy, we should use the proxying SP and not the proxy itself.
528+
if ($sp->getCoins()->isTrustedProxy()) {
529+
// Overwrite the trusted proxy SP instance with that of the SP that uses the trusted proxy.
530+
$sp = $this->_server->findOriginalServiceProvider($receivedRequest, $this->getLogger());
531+
}
532+
533+
$pdpLoas = $receivedResponse->getPdpRequestedLoas();
534+
$loaRepository = $this->_diContainer->getLoaRepository();
535+
$authnRequestLoas = $receivedRequest->getStepupObligations($loaRepository->getStepUpLoas());
536+
537+
$shouldUseStepup = $this->_diContainer->getStepupGatewayCallOutHelper()->shouldUseStepup($idp, $sp, $authnRequestLoas, $pdpLoas);
538+
539+
// Goto consent if no Stepup authentication is needed
540+
if (!$shouldUseStepup) {
541+
$this->sendConsentAuthenticationRequest($receivedResponse, $receivedRequest, $currentProcessStep->getRole(), $this->_diContainer->getAuthenticationStateHelper()->getAuthenticationState());
542+
return true;
543+
}
544+
545+
return false;
546+
}
547+
548+
405549
//////// REQUEST HANDLING /////////
406550

407551
public function sendAuthenticationRequest(
@@ -467,7 +611,15 @@ public function sendAuthenticationRequest(
467611
$this->getBindingsModule()->send($ebRequest, $identityProvider);
468612
}
469613

470-
public function sendStepupAuthenticationRequest(
614+
function sendSRAMInterruptRequest($response, $request) {
615+
$nonce = $response->getSRAMInterruptNonce();
616+
617+
$sbsClient = EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getSbsClient();
618+
$redirect_url = $sbsClient->getInterruptLocationLink($nonce);
619+
$this->redirect($redirect_url, '');
620+
}
621+
622+
function sendStepupAuthenticationRequest(
471623
EngineBlock_Saml2_AuthnRequestAnnotationDecorator $spRequest,
472624
IdentityProvider $identityProvider,
473625
Loa $authnContextClassRef,
@@ -558,14 +710,6 @@ function sendConsentAuthenticationRequest(
558710
$this->_server->getBindingsModule()->send($newResponse, $serviceProvider);
559711
}
560712

561-
function sendSRAMInterruptRequest($response, $request) {
562-
$nonce = $response->getSRAMInterruptNonce();
563-
564-
$sbsClient = EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getSbsClient();
565-
$redirect_url = $sbsClient->getInterruptLocationLink($nonce);
566-
$this->redirect($redirect_url, '');
567-
}
568-
569713
//////// RESPONSE HANDLING ////////
570714

571715
public function createProxyCountExceededResponse(EngineBlock_Saml2_AuthnRequestAnnotationDecorator $request)

0 commit comments

Comments
 (0)