Merge pull request #9 from AdactiveSAS/release/0.7.0

Release/0.7.0

Author: Moroine Bentefrit

CHANGELOG.md

@@ -0,0 +1,13 @@
+# CHANGELOG
+
+## v0.7.0
+
+### Add
+  - Default Logger into `adactive_sas_saml2_bridge.processor.hosted_idp` service
+  - ServiceProvider option `maxRetryLogin` to setup the number of login retry in case of errors. The default is `0` to 
+  keep retro-compatibility
+
+### Fix
+  - SLS initiated by IDP
+  - composer 
+

README.md

@@ -175,7 +175,7 @@ class SamlServiceProviderRepository implements ServiceProviderRepository
 }
 ```
 
-######Slack example
+###### Slack example
 ```
 $this->spMap["https://slack.com"] = new ServiceProvider(
     [
@@ -239,7 +239,7 @@ $this->spMap["https://slack.com"] = new ServiceProvider(
 );
 
 ```
-######Freshdesk example
+###### Freshdesk example
 ```
 $this->spMap["https://$freshdeskAccountName.freshdesk.com"] = new ServiceProvider(
     [

src/DependencyInjection/AdactiveSasSaml2BridgeExtension.php

@@ -91,6 +91,7 @@ private function parseHostedIdpConfiguration(array $identityProvider, ContainerB
             ]
         );
         $idpDefinition->addTag("kernel.event_subscriber");
+        $idpDefinition->addMethodCall("setLogger", [new Reference("logger")]);
         $container->setDefinition("adactive_sas_saml2_bridge.processor.hosted_idp", $idpDefinition);
     }
 }

src/Entity/ServiceProvider.php

@@ -124,4 +124,12 @@ public function getNameQualifier()
     {
         return $this->get('NameQualifier');
     }
+
+    /**
+     * @return int
+     */
+    public function getMaxRetryLogin()
+    {
+        return $this->get('maxRetryLogin', 0);
+    }
 }

src/SAML2/Binding/HttpBindingInterface.php

@@ -59,6 +59,12 @@ public function receiveSignedAuthnRequest(Request $request);
      */
     public function receiveSignedLogoutRequest(Request $request);
 
+    /**
+     * @param Request $request
+     * @return \SAML2_LogoutResponse
+     */
+    public function receiveSignedLogoutResponse(Request $request);
+
     /**
      * @param Request $request
      * @return \SAML2_AuthnRequest
@@ -71,6 +77,12 @@ public function receiveUnsignedAuthnRequest(Request $request);
      */
     public function receiveUnsignedLogoutRequest(Request $request);
 
+    /**
+     * @param Request $request
+     * @return \SAML2_LogoutResponse
+     */
+    public function receiveUnsignedLogoutResponse(Request $request);
+
     /**
      * @param Request $request
      * @return \SAML2_Message

src/SAML2/Binding/HttpPostBinding.php

@@ -127,6 +127,16 @@ public function receiveSignedLogoutRequest(Request $request)
         throw new UnsupportedBindingException("Unsupported binding: signed POST LogoutRequest is not supported at the moment");
     }
 
+    /**
+     * @param Request $request
+     * @return \SAML2_LogoutResponse
+     * @throws \AdactiveSas\Saml2BridgeBundle\SAML2\Binding\Exception\UnsupportedBindingException
+     */
+    public function receiveSignedLogoutResponse(Request $request)
+    {
+        throw new UnsupportedBindingException("Unsupported binding: signed POST LogoutResponse is not supported at the moment");
+    }
+
     /**
      * @param Request $request
      * @return \SAML2_AuthnRequest
@@ -147,6 +157,16 @@ public function receiveUnsignedLogoutRequest(Request $request)
         throw new UnsupportedBindingException("Unsupported binding: unsigned POST LogoutRequest is not supported at the moment");
     }
 
+    /**
+     * @param Request $request
+     * @return \SAML2_LogoutResponse
+     * @throws \AdactiveSas\Saml2BridgeBundle\SAML2\Binding\Exception\UnsupportedBindingException
+     */
+    public function receiveUnsignedLogoutResponse(Request $request)
+    {
+        throw new UnsupportedBindingException("Unsupported binding: unsigned POST LogoutResponse is not supported at the moment");
+    }
+
     /**
      * @param Request $request
      * @return \SAML2_Message

src/SAML2/Binding/HttpRedirectBinding.php

@@ -222,6 +222,24 @@ public function receiveSignedLogoutRequest(Request $request){
         return $message;
     }
 
+    /**
+     * @param Request $request
+     * @return \SAML2_LogoutResponse
+     * @throws \AdactiveSas\Saml2BridgeBundle\Exception\InvalidArgumentException
+     */
+    public function receiveSignedLogoutResponse(Request $request){
+        $message = $this->receiveSignedMessage($request);
+
+        if (!$message instanceof \SAML2_LogoutResponse) {
+            throw new InvalidArgumentException(sprintf(
+                'The received request is not an LogoutRequest, "%s" received instead',
+                substr(get_class($message), strrpos($message, '_') + 1)
+            ));
+        }
+
+        return $message;
+    }
+
     /**
      * @param Request $request
      * @return \SAML2_AuthnRequest
@@ -251,7 +269,25 @@ public function receiveUnsignedLogoutRequest(Request $request){
         if (!$message instanceof \SAML2_LogoutRequest) {
             throw new InvalidArgumentException(sprintf(
                 'The received request is not an LogoutRequest, "%s" received instead',
-                substr(get_class($message), strrpos($message, '_') + 1)
+                substr(get_class($message), strrpos(get_class($message), '_') + 1)
+            ));
+        }
+
+        return $message;
+    }
+
+    /**
+     * @param Request $request
+     * @return \SAML2_LogoutResponse
+     * @throws \AdactiveSas\Saml2BridgeBundle\Exception\InvalidArgumentException
+     */
+    public function receiveUnsignedLogoutResponse(Request $request){
+        $message = $this->receiveUnsignedMessage($request);
+
+        if (!$message instanceof \SAML2_LogoutResponse) {
+            throw new InvalidArgumentException(sprintf(
+                'The received request is not an LogoutRequest, "%s" received instead',
+                substr(get_class($message), strrpos(get_class($message), '_') + 1)
             ));
         }
 

src/SAML2/Provider/HostedIdentityProviderProcessor.php

@@ -188,11 +188,15 @@ public function onKernelResponse(FilterResponseEvent $event)
         if ($this->stateHandler->can(SamlStateHandler::TRANSITION_SSO_RESPOND)) {
             $event->setResponse($this->continueSingleSignOn());
             return;
+        }else{
+            $this->logger->debug("Cannot TRANSITION_SSO_RESPOND, state is ". $this->stateHandler->get()->getState());
         }
 
-        if ($this->stateHandler->can(SamlStateHandler::TRANSITION_SLS_RESPOND)) {
+        if ($this->stateHandler->can(SamlStateHandler::TRANSITION_SLS_RESPOND, false)) {
             $event->setResponse($this->continueSingleLogoutService());
             return;
+        }else{
+            $this->logger->debug("Cannot TRANSITION_SLS_RESPOND, state is ". $this->stateHandler->get()->getState());
         }
     }
 
@@ -206,6 +210,10 @@ public function onAuthenticationSuccess(CoreAuthenticationEvent $event)
             return;
         }
 
+        if($this->stateHandler->has()){
+            $this->stateHandler->get()->resetLoginRetryCount();
+        }
+
         $user = $event->getAuthenticationToken()->getUser();
         if ($this->stateHandler->has()
             && $user instanceof UserInterface && $this->stateHandler->has()) {
@@ -233,6 +241,19 @@ public function onAuthenticationFailure(CoreAuthenticationFailureEvent $event)
             return;
         }
 
+        if($this->stateHandler->has()){
+            /** @var \SAML2_AuthnRequest $authRequest */
+            $authRequest = $this->stateHandler->get()->getRequest();
+
+            $sp = $this->getServiceProvider($authRequest->getIssuer());
+
+            if($this->stateHandler->get()->getLoginRetryCount() < $sp->getMaxRetryLogin()){
+                $this->stateHandler->get()->incrementLoginRetryCount();
+                $this->logger->debug("Login failed, retrying");
+                return;
+            }
+        }
+
         $this->logger->notice("Authentication failed");
         $this->stateHandler->apply(SamlStateHandler::TRANSITION_SSO_AUTHENTICATE_FAIL);
     }
@@ -247,10 +268,7 @@ public function onLogoutSuccess(LogoutEvent $event)
             $this->stateHandler->resume(true);
             $this->stateHandler->get()->setOriginalLogoutResponse($event->getResponse());
 
-            $this->stateHandler
-                ->apply(SamlStateHandler::TRANSITION_SLS_START)
-                ->apply(SamlStateHandler::TRANSITION_SLS_START_DISPATCH)
-                ->apply(SamlStateHandler::TRANSITION_SLS_END_DISPATCH);
+            $this->stateHandler->apply(SamlStateHandler::TRANSITION_SLS_START_BY_IDP);
 
             return;
         }
@@ -291,7 +309,7 @@ public function processSingleSignOn(Request $httpRequest)
                 $authRequest = $inputBinding->receiveSignedAuthnRequest($httpRequest);
             }
 
-            $this->validateRequest($authRequest);
+            $this->validateMessage($authRequest);
 
             $event = new ReceiveAuthnRequestEvent($authRequest, $this->identityProvider, $this->stateHandler);
             $this->eventDispatcher->dispatch(Saml2Events::SSO_AUTHN_RECEIVE_REQUEST, $event);
@@ -386,12 +404,7 @@ public function processSingleLogoutService(Request $httpRequest)
         $inputBinding = $this->bindingContainer->get($this->identityProvider->getSlsBinding());
 
         try {
-            $logoutMessage = $inputBinding->receiveUnsignedLogoutRequest($httpRequest);
-            $sp = $this->getServiceProvider($logoutMessage->getIssuer());
-            if ($sp->wantSignedLogoutRequest()) {
-                $logoutMessage = $inputBinding->receiveSignedLogoutRequest($httpRequest);
-            }
-            $this->validateRequest($logoutMessage);
+            $logoutMessage = $inputBinding->receiveUnsignedMessage($httpRequest);
         } catch (\Throwable $e) {
             // handle error, apparently the request cannot be processed :(
             $msg = sprintf('Could not process Request, error: "%s"', $e->getMessage());
@@ -401,6 +414,12 @@ public function processSingleLogoutService(Request $httpRequest)
         }
 
         if ($logoutMessage instanceof \SAML2_LogoutRequest) {
+            $sp = $this->getServiceProvider($logoutMessage->getIssuer());
+            if ($sp->wantSignedLogoutRequest()) {
+                $logoutMessage = $inputBinding->receiveSignedLogoutRequest($httpRequest);
+            }
+            $this->validateMessage($logoutMessage);
+
             $this->logger->notice('Received LogoutRequest, started processing');
 
             $this->stateHandler->resume(true)->apply(SamlStateHandler::TRANSITION_SLS_START);
@@ -414,6 +433,12 @@ public function processSingleLogoutService(Request $httpRequest)
         }
 
         if ($logoutMessage instanceof \SAML2_LogoutResponse) {
+            $sp = $this->getServiceProvider($logoutMessage->getIssuer());
+            if ($sp->wantSignedLogoutResponse()) {
+                $logoutMessage = $inputBinding->receiveSignedLogoutResponse($httpRequest);
+            }
+            $this->validateMessage($logoutMessage);
+
             $this->logger->notice('Received LogoutResponse, continue processing');
             $this->stateHandler->apply(SamlStateHandler::TRANSITION_SLS_END_PROPAGATE);
 
@@ -455,6 +480,8 @@ public function continueSingleLogoutService()
 
             $outBinding = $this->bindingContainer->get($sp->getSingleLogoutBinding());
 
+            $this->logger->notice(sprintf('Propagate logout to sp %s',$sp->getSingleLogoutUrl()));
+
             if ($sp->wantSignedLogoutRequest()) {
                 $response = $outBinding->getSignedRequest($logoutRequest);
             } else {
@@ -474,6 +501,8 @@ public function continueSingleLogoutService()
             $sp = $this->getServiceProvider($logoutRequest->getIssuer());
             $outBinding = $this->bindingContainer->get($sp->getSingleLogoutBinding());
 
+            $this->logger->notice(sprintf('Logout: Respond to sp initiator %s',$sp->getEntityId()));
+
             if ($sp->wantSignedLogoutResponse()) {
                 $response = $outBinding->getSignedResponse($logoutResponse);
             } else {
@@ -498,6 +527,8 @@ public function continueSingleLogoutService()
 
         $this->stateHandler->resume();
 
+        $this->logger->notice('Saml: Logout terminated');
+
         return $response;
     }
 
@@ -682,19 +713,15 @@ protected function getIdentityProviderXmlPublicKey()
     }
 
     /**
-     * @param \SAML2_Request $request
+     * @param \SAML2_Message $message
      */
-    protected function validateRequest(\SAML2_Request $request)
+    protected function validateMessage(\SAML2_Message $message)
     {
-        if (!$this->serviceProviderRepository->hasServiceProvider($request->getIssuer())) {
-            throw new UnknownServiceProviderException($request->getIssuer());
-        }
-
-        if (!$this->identityProvider->wantSignedAuthnRequest()) {
-            return;
+        if (!$this->serviceProviderRepository->hasServiceProvider($message->getIssuer())) {
+            throw new UnknownServiceProviderException($message->getIssuer());
         }
 
-        $serviceProvider = $this->getServiceProvider($request->getIssuer());
+        $serviceProvider = $this->getServiceProvider($message->getIssuer());
 
         $this->logger->debug(sprintf('Extracting public keys for ServiceProvider "%s"', $serviceProvider->getEntityId()));
 
@@ -715,7 +742,7 @@ protected function validateRequest(\SAML2_Request $request)
             $key = new \XMLSecurityKey(\XMLSecurityKey::RSA_SHA256, array('type' => 'public'));
             $key->loadKey($x509Key->getCertificate());
 
-            $request->validate($key);
+            $message->validate($key);
         }
     }
 }

src/SAML2/State/SamlState.php

@@ -46,6 +46,11 @@ class SamlState
      */
     protected $originalLogoutResponse;
 
+    /**
+     * @var int
+     */
+    protected $loginRetryCount;
+
     /**
      * @var null|string
      */
@@ -58,6 +63,7 @@ public function __construct()
     {
         $this->state = self::STATE_INITIAL;
         $this->serviceProvidersIds = [];
+        $this->loginRetryCount = 0;
     }
 
     /**
@@ -228,4 +234,40 @@ public function setAuthnContext($authnContext)
         $this->authnContext = $authnContext;
         return $this;
     }
+
+    /**
+     * @return int
+     */
+    public function getLoginRetryCount()
+    {
+        return $this->loginRetryCount;
+    }
+
+    /**
+     * @param int $loginRetryCount
+     * @return SamlState
+     */
+    public function setLoginRetryCount($loginRetryCount)
+    {
+        $this->loginRetryCount = $loginRetryCount;
+        return $this;
+    }
+
+    /**
+     * @return SamlState
+     */
+    public function incrementLoginRetryCount()
+    {
+        $this->loginRetryCount++;
+        return $this;
+    }
+
+    /**
+     * @return SamlState
+     */
+    public function resetLoginRetryCount()
+    {
+        $this->loginRetryCount = 0;
+        return $this;
+    }
 }