|
1 | 1 | <?php |
2 | 2 |
|
| 3 | +use OpenConext\EngineBlockBundle\Configuration\FeatureConfigurationInterface; |
| 4 | +use OpenConext\EngineBlockBundle\Exception\InvalidSbsResponseException; |
| 5 | +use OpenConext\EngineBlockBundle\Sbs\Dto\AuthzRequest; |
| 6 | +use OpenConext\EngineBlockBundle\Sbs\SbsAttributeMerger; |
| 7 | + |
3 | 8 | /** |
4 | 9 | * Copyright 2021 Stichting Kennisnet |
5 | 10 | * |
@@ -27,70 +32,72 @@ public function getResponseAttributes() |
27 | 32 | return $this->_responseAttributes; |
28 | 33 | } |
29 | 34 |
|
| 35 | + public function getResponse() |
| 36 | + { |
| 37 | + return $this->_response; |
| 38 | + } |
| 39 | + |
30 | 40 | public function execute(): void |
31 | 41 | { |
32 | | - $application = EngineBlock_ApplicationSingleton::getInstance(); |
| 42 | + if (!$this->getFeatureConfiguration()->isEnabled('eb.feature_enable_sram_interrupt')) { |
| 43 | + return; |
| 44 | + } |
33 | 45 |
|
34 | | - $sramEndpoint = $application->getDiContainer()->getSRAMEndpoint(); |
35 | | - $sramApiToken = $sramEndpoint->getApiToken(); |
36 | | - $sramAuthzLocation = $sramEndpoint->getAuthzLocation(); |
37 | | - // $sramAuthzLocation = 'http://192.168.0.1:12345/api'; |
| 46 | + if ($this->_serviceProvider->getCoins()->collabEnabled() === false) { |
| 47 | + return; |
| 48 | + } |
38 | 49 |
|
39 | | - error_log("SRAMTestFilter execute"); |
| 50 | + try { |
| 51 | + $request = $this->buildRequest(); |
40 | 52 |
|
41 | | - $attributes = $this->getResponseAttributes(); |
| 53 | + $interruptResponse = $this->getSbsClient()->authz($request); |
| 54 | + |
| 55 | + if ($interruptResponse->msg === 'interrupt') { |
| 56 | + $this->_response->setSRAMInterruptNonce($interruptResponse->nonce); |
| 57 | + } elseif ($interruptResponse->msg === 'authorized' && !empty($interruptResponse->attributes)) { |
| 58 | + $this->_responseAttributes = $this->getSbsAttributeMerger()->mergeAttributes($this->_responseAttributes, $interruptResponse->attributes); |
| 59 | + } else { |
| 60 | + throw new InvalidSbsResponseException(sprintf('Invalid SBS response received: %s', $interruptResponse->msg)); |
| 61 | + } |
| 62 | + }catch (Throwable $e){ |
| 63 | + throw new EngineBlock_Exception_SbsCheckFailed('The SBS server could not be queried: ' . $e->getMessage()); |
| 64 | + } |
| 65 | + } |
42 | 66 |
|
| 67 | + private function getSbsClient() |
| 68 | + { |
| 69 | + return EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getSbsClient(); |
| 70 | + } |
| 71 | + |
| 72 | + private function getFeatureConfiguration(): FeatureConfigurationInterface |
| 73 | + { |
| 74 | + return EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getFeatureConfiguration(); |
| 75 | + } |
| 76 | + |
| 77 | + private function getSbsAttributeMerger(): SbsAttributeMerger |
| 78 | + { |
| 79 | + return EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()->getSbsAttributeMerger(); |
| 80 | + } |
| 81 | + |
| 82 | + /** |
| 83 | + * @return AuthzRequest |
| 84 | + * @throws EngineBlock_Corto_ProxyServer_Exception |
| 85 | + */ |
| 86 | + private function buildRequest(): AuthzRequest |
| 87 | + { |
| 88 | + $attributes = $this->getResponseAttributes(); |
43 | 89 | $id = $this->_request->getId(); |
44 | 90 |
|
45 | 91 | $user_id = $attributes['urn:mace:dir:attribute-def:uid'][0]; |
46 | 92 | $continue_url = $this->_server->getUrl('SRAMInterruptService', '') . "?ID=$id"; |
47 | 93 | $service_id = $this->_serviceProvider->entityId; |
48 | | - // @TODO at the very start of this function, check if the SP has `coin:collab_enabled`, skip otherwise? |
49 | 94 | $issuer_id = $this->_identityProvider->entityId; |
50 | 95 |
|
51 | | - /*** |
52 | | - * @TODO Move all curl related things to new HttpClient. See PDPClient as an example. |
53 | | - * @TODO Make sure it has tests |
54 | | - * @TODO add tests for this Input Filter |
55 | | - */ |
56 | | - |
57 | | - $headers = array( |
58 | | - "Authorization: $sramApiToken" |
59 | | - ); |
60 | | - |
61 | | - $post = array( |
62 | | - 'user_id' => $user_id, |
63 | | - 'continue_url' => $continue_url, |
64 | | - 'service_id' => $service_id, |
65 | | - 'issuer_id' => $issuer_id |
| 96 | + return AuthzRequest::create( |
| 97 | + $user_id, |
| 98 | + $continue_url, |
| 99 | + $service_id, |
| 100 | + $issuer_id |
66 | 101 | ); |
67 | | - |
68 | | - $options = [ |
69 | | - CURLOPT_HEADER => false, |
70 | | - CURLOPT_RETURNTRANSFER => true, |
71 | | - CURLOPT_HTTPHEADER => $headers, |
72 | | - CURLOPT_POST => true, |
73 | | - CURLOPT_POSTFIELDS => $post, |
74 | | - ]; |
75 | | - |
76 | | - |
77 | | - $ch = curl_init($sramAuthzLocation); |
78 | | - curl_setopt_array($ch, $options); |
79 | | - |
80 | | - $data = curl_exec($ch); |
81 | | - curl_close($ch); |
82 | | - |
83 | | - $body = json_decode($data, false); |
84 | | - // error_log("SRAMTestFilter " . var_export($body, true)); |
85 | | - |
86 | | - // @TODO Add integration test: Assert the redirect url on the saml response is SRAM |
87 | | - |
88 | | - $msg = $body->msg; |
89 | | - if ($msg === 'interrupt') { |
90 | | - $this->_response->setSRAMInterruptNonce($body->nonce); |
91 | | - } elseif ($body->attributes) { |
92 | | - $this->_responseAttributes = array_merge_recursive($this->_responseAttributes, (array) $body->attributes); |
93 | | - } |
94 | | - |
95 | 102 | } |
96 | 103 | } |
0 commit comments