1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
|
<?php
function nextTarget(array $config, string $sid): string {
if (count($config['site']['cookie-domains'] ?? []) > 0) {
$next = 'https://' . $config['site']['cookie-domains'][0] . '/continue'
. '?sid=' . urlencode($sid);
if (isset($_GET['next'])) {
$next .= '&next=' . urlencode($_GET['next']);
}
return $next;
}
if (isset($_GET['next']) && Psso\isValidRedirect($_GET['next'], $config)) {
return $_GET['next'];
}
return '/';
}
function presentChallenges(
array $config,
Psso\Session $session,
Psso\Context $context,
?string $message = null
) {
$challengeTypes = Psso\AuthFlow::nextStep($context);
if ($challengeTypes === true) {
// auth finished! all good
$session->setChallenges(null);
$session->setIdentity(Psso\Identity::fromContext($context));
header('Location: ' . nextTarget($config, $session->token));
return;
}
if (count($challengeTypes) == 0) {
throw new RuntimeException('no more challenges available!! auth fail');
}
// create challenges as indicated by the auth flow
$challenges = [];
foreach ($challengeTypes as $type) {
$c = $type::create($context);
$challenges[$c->serial] = $c;
}
// send challenges to user
$resp = new Psso\XMLResponse;
$resp->doc->addAttribute('title', L('login.title'));
$resp->doc->addAttribute('kind', 'challenges');
if (isset($message)) {
$resp->doc->addChild('challenge-message', L($message));
}
foreach ($challenges as $challenge) {
$challenge->addAsHtml($resp->doc);
}
$resp->send();
// and store the challenges (actual instances!) for next request
$session->setChallenges($challenges);
}
function GET(array $config) {
$session = Psso\Session::get();
if ($session->getIdentity() !== null) {
// already logged in
header('Location: /'); // change this to return continue page
}
$context = new Psso\Context;
presentChallenges($config, $session, $context);
}
function POST(array $config) {
$session = Psso\Session::get();
// we are receiving results of a previous challenge... load it in
$challenges = $session->getChallenges();
$answeredChallenge = $challenges[$_POST['challenge']];
// match up the given input responses to their original Inputs
$inputData = [];
foreach ($_POST as $name => $value) {
if ($name == 'challenge') continue;
$serial = explode('__', $name, 2)[1];
$input = $answeredChallenge->findInput($serial);
$inputData[$input->id] = $value;
}
// check provided inputs against the challenge, are they correct?
$providerClass = 'Psso\\AuthProvider\\' . $config['auth']['provider'];
$provider = new $providerClass($config);
$result = $answeredChallenge->validate($provider, $inputData);
// append the new result to the context so the auth flow can see it
$context = $answeredChallenge->context;
$context->addResult($result);
// also set the user and groups in context if we're able to
if ($result->successful && isset($result->user) && !isset($context->user)) {
$context->user = $result->user;
if ($provider instanceof Psso\AuthInterface\Groups) {
$context->groups = $provider->userGroups($context->user);
}
if ($provider instanceof Psso\AuthInterface\UserExtra) {
$context->extras['name'] =
$provider->userDisplayName($context->user);
$context->extras['email'] =
$provider->userEmailAddress($context->user);
}
}
presentChallenges($config, $session, $context, $result->message);
}
|
