/** * Log line. * * @param array &$state The current state. */ public function process(&$state) { assert('is_array($state)'); assert('array_key_exists("Attributes", $state)'); $logAttribute = 'NA'; $source = 'NA'; $dest = 'NA'; if (array_key_exists($this->attribute, $state['Attributes'])) { $logAttribute = $state['Attributes'][$this->attribute][0]; } if (array_key_exists('Source', $state)) { if (isset($state['Source']['core:statistics-id'])) { $source = $state['Source']['core:statistics-id']; } else { $source = $state['Source']['entityid']; } } if (array_key_exists('Destination', $state)) { if (isset($state['Destination']['core:statistics-id'])) { $dest = $state['Destination']['core:statistics-id']; } else { $dest = $state['Destination']['entityid']; } } if (!array_key_exists('PreviousSSOTimestamp', $state)) { // The user hasn't authenticated with this SP earlier in this session SimpleSAML\Logger::stats($this->typeTag . '-first ' . $dest . ' ' . $source . ' ' . $logAttribute); } SimpleSAML\Logger::stats($this->typeTag . ' ' . $dest . ' ' . $source . ' ' . $logAttribute); }
/** * Receive a logout message. * * @param SimpleSAML_IdP $idp The IdP we are receiving it for. */ public static function receiveLogoutMessage(SimpleSAML_IdP $idp) { $binding = SAML2_Binding::getCurrentBinding(); $message = $binding->receive(); $spEntityId = $message->getIssuer(); if ($spEntityId === NULL) { /* Without an issuer we have no way to respond to the message. */ throw new SimpleSAML_Error_BadRequest('Received message on logout endpoint without issuer.'); } $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler(); $idpMetadata = $idp->getConfig(); $spMetadata = $metadata->getMetaDataConfig($spEntityId, 'saml20-sp-remote'); sspmod_saml_Message::validateMessage($spMetadata, $idpMetadata, $message); if ($message instanceof SAML2_LogoutResponse) { SimpleSAML\Logger::info('Received SAML 2.0 LogoutResponse from: ' . var_export($spEntityId, TRUE)); $statsData = array('spEntityID' => $spEntityId, 'idpEntityID' => $idpMetadata->getString('entityid')); if (!$message->isSuccess()) { $statsData['error'] = $message->getStatus(); } SimpleSAML_Stats::log('saml:idp:LogoutResponse:recv', $statsData); $relayState = $message->getRelayState(); if (!$message->isSuccess()) { $logoutError = sspmod_saml_Message::getResponseError($message); SimpleSAML\Logger::warning('Unsuccessful logout. Status was: ' . $logoutError); } else { $logoutError = NULL; } $assocId = 'saml:' . $spEntityId; $idp->handleLogoutResponse($assocId, $relayState, $logoutError); } elseif ($message instanceof SAML2_LogoutRequest) { SimpleSAML\Logger::info('Received SAML 2.0 LogoutRequest from: ' . var_export($spEntityId, TRUE)); SimpleSAML_Stats::log('saml:idp:LogoutRequest:recv', array('spEntityID' => $spEntityId, 'idpEntityID' => $idpMetadata->getString('entityid'))); $spStatsId = $spMetadata->getString('core:statistics-id', $spEntityId); SimpleSAML\Logger::stats('saml20-idp-SLO spinit ' . $spStatsId . ' ' . $idpMetadata->getString('entityid')); $state = array('Responder' => array('sspmod_saml_IdP_SAML2', 'sendLogoutResponse'), 'saml:SPEntityId' => $spEntityId, 'saml:RelayState' => $message->getRelayState(), 'saml:RequestId' => $message->getId()); $assocId = 'saml:' . $spEntityId; $idp->handleLogoutRequest($state, $assocId); } else { throw new SimpleSAML_Error_BadRequest('Unknown message received on logout endpoint: ' . get_class($message)); } }
/** * Process a authentication response * * This function saves the state, and redirects the user to the page where * the user can authorize the release of the attributes. * If storage is used and the consent has already been given the user is * passed on. * * @param array &$state The state of the response. * * @return void */ public function process(&$state) { assert('is_array($state)'); assert('array_key_exists("UserID", $state)'); assert('array_key_exists("Destination", $state)'); assert('array_key_exists("entityid", $state["Destination"])'); assert('array_key_exists("metadata-set", $state["Destination"])'); assert('array_key_exists("entityid", $state["Source"])'); assert('array_key_exists("metadata-set", $state["Source"])'); $spEntityId = $state['Destination']['entityid']; $idpEntityId = $state['Source']['entityid']; $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler(); /** * If the consent module is active on a bridge $state['saml:sp:IdP'] * will contain an entry id for the remote IdP. If not, then the * consent module is active on a local IdP and nothing needs to be * done. */ if (isset($state['saml:sp:IdP'])) { $idpEntityId = $state['saml:sp:IdP']; $idpmeta = $metadata->getMetaData($idpEntityId, 'saml20-idp-remote'); $state['Source'] = $idpmeta; } $statsData = array('spEntityID' => $spEntityId); // Do not use consent if disabled if (isset($state['Source']['consent.disable']) && self::checkDisable($state['Source']['consent.disable'], $spEntityId)) { SimpleSAML\Logger::debug('Consent: Consent disabled for entity ' . $spEntityId . ' with IdP ' . $idpEntityId); SimpleSAML_Stats::log('consent:disabled', $statsData); return; } if (isset($state['Destination']['consent.disable']) && self::checkDisable($state['Destination']['consent.disable'], $idpEntityId)) { SimpleSAML\Logger::debug('Consent: Consent disabled for entity ' . $spEntityId . ' with IdP ' . $idpEntityId); SimpleSAML_Stats::log('consent:disabled', $statsData); return; } if ($this->_store !== null) { $source = $state['Source']['metadata-set'] . '|' . $idpEntityId; $destination = $state['Destination']['metadata-set'] . '|' . $spEntityId; $attributes = $state['Attributes']; // Remove attributes that do not require consent foreach ($attributes as $attrkey => $attrval) { if (in_array($attrkey, $this->_noconsentattributes)) { unset($attributes[$attrkey]); } } SimpleSAML\Logger::debug('Consent: userid: ' . $state['UserID']); SimpleSAML\Logger::debug('Consent: source: ' . $source); SimpleSAML\Logger::debug('Consent: destination: ' . $destination); $userId = self::getHashedUserID($state['UserID'], $source); $targetedId = self::getTargetedID($state['UserID'], $source, $destination); $attributeSet = self::getAttributeHash($attributes, $this->_includeValues); SimpleSAML\Logger::debug('Consent: hasConsent() [' . $userId . '|' . $targetedId . '|' . $attributeSet . ']'); try { if ($this->_store->hasConsent($userId, $targetedId, $attributeSet)) { // Consent already given SimpleSAML\Logger::stats('Consent: Consent found'); SimpleSAML_Stats::log('consent:found', $statsData); return; } SimpleSAML\Logger::stats('Consent: Consent notfound'); SimpleSAML_Stats::log('consent:notfound', $statsData); $state['consent:store'] = $this->_store; $state['consent:store.userId'] = $userId; $state['consent:store.destination'] = $targetedId; $state['consent:store.attributeSet'] = $attributeSet; } catch (Exception $e) { SimpleSAML\Logger::error('Consent: Error reading from storage: ' . $e->getMessage()); SimpleSAML\Logger::stats('Consent: Failed'); SimpleSAML_Stats::log('consent:failed', $statsData); } } else { SimpleSAML\Logger::stats('Consent: No storage'); SimpleSAML_Stats::log('consent:nostorage', $statsData); } $state['consent:focus'] = $this->_focus; $state['consent:checked'] = $this->_checked; $state['consent:hiddenAttributes'] = $this->_hiddenAttributes; $state['consent:noconsentattributes'] = $this->_noconsentattributes; $state['consent:showNoConsentAboutService'] = $this->_showNoConsentAboutService; // User interaction nessesary. Throw exception on isPassive request if (isset($state['isPassive']) && $state['isPassive'] === true) { SimpleSAML_Stats::log('consent:nopassive', $statsData); throw new SimpleSAML_Error_NoPassive('Unable to give consent on passive request.'); } // Save state and redirect $id = SimpleSAML_Auth_State::saveState($state, 'consent:request'); $url = SimpleSAML\Module::getModuleURL('consent/getconsent.php'); \SimpleSAML\Utils\HTTP::redirectTrustedURL($url, array('StateId' => $id)); }
} if ($message instanceof \SAML2\LogoutResponse) { $relayState = $message->getRelayState(); if ($relayState === NULL) { // Somehow, our RelayState has been lost. throw new SimpleSAML_Error_BadRequest('Missing RelayState in logout response.'); } if (!$message->isSuccess()) { SimpleSAML\Logger::warning('Unsuccessful logout. Status was: ' . sspmod_saml_Message::getResponseError($message)); } $state = SimpleSAML_Auth_State::loadState($relayState, 'saml:slosent'); $state['saml:sp:LogoutStatus'] = $message->getStatus(); SimpleSAML_Auth_Source::completeLogout($state); } elseif ($message instanceof \SAML2\LogoutRequest) { SimpleSAML\Logger::debug('module/saml2/sp/logout: Request from ' . $idpEntityId); SimpleSAML\Logger::stats('saml20-idp-SLO idpinit ' . $spEntityId . ' ' . $idpEntityId); if ($message->isNameIdEncrypted()) { try { $keys = sspmod_saml_Message::getDecryptionKeys($idpMetadata, $spMetadata); } catch (Exception $e) { throw new SimpleSAML_Error_Exception('Error decrypting NameID: ' . $e->getMessage()); } $blacklist = sspmod_saml_Message::getBlacklistedAlgorithms($idpMetadata, $spMetadata); $lastException = NULL; foreach ($keys as $i => $key) { try { $message->decryptNameId($key, $blacklist); SimpleSAML\Logger::debug('Decryption with key #' . $i . ' succeeded.'); $lastException = NULL; break; } catch (Exception $e) {
/* Find the status of all SPs. */ foreach ($SPs as $assocId => &$sp) { $spId = 'logout-iframe-' . sha1($assocId); if (isset($_REQUEST[$spId])) { $spStatus = $_REQUEST[$spId]; if ($spStatus === 'completed' || $spStatus === 'failed') { $sp['core:Logout-IFrame:State'] = $spStatus; } } if (!isset($associations[$assocId])) { $sp['core:Logout-IFrame:State'] = 'completed'; } } /* Terminate the associations. */ foreach ($SPs as $assocId => $sp) { if ($sp['core:Logout-IFrame:State'] === 'completed') { $idp->terminateAssociation($assocId); } else { SimpleSAML\Logger::warning('Unable to terminate association with ' . var_export($assocId, TRUE) . '.'); if (isset($sp['saml:entityID'])) { $spId = $sp['saml:entityID']; } else { $spId = $assocId; } SimpleSAML\Logger::stats('slo-iframe-fail ' . $spId); SimpleSAML_Stats::log('core:idp:logout-iframe:spfail', array('sp' => $spId)); $state['core:Failed'] = TRUE; } } /* We are done. */ $idp->finishLogout($state);
$state = SimpleSAML_Auth_State::loadState($id, 'consent:request'); if (array_key_exists('core:SP', $state)) { $spentityid = $state['core:SP']; } else { if (array_key_exists('saml:sp:State', $state)) { $spentityid = $state['saml:sp:State']['core:SP']; } else { $spentityid = 'UNKNOWN'; } } // The user has pressed the yes-button if (array_key_exists('yes', $_REQUEST)) { if (array_key_exists('saveconsent', $_REQUEST)) { SimpleSAML\Logger::stats('consentResponse remember'); } else { SimpleSAML\Logger::stats('consentResponse rememberNot'); } $statsInfo = array('remember' => array_key_exists('saveconsent', $_REQUEST)); if (isset($state['Destination']['entityid'])) { $statsInfo['spEntityID'] = $state['Destination']['entityid']; } SimpleSAML_Stats::log('consent:accept', $statsInfo); if (array_key_exists('consent:store', $state) && array_key_exists('saveconsent', $_REQUEST) && $_REQUEST['saveconsent'] === '1') { // Save consent $store = $state['consent:store']; $userId = $state['consent:store.userId']; $targetedId = $state['consent:store.destination']; $attributeSet = $state['consent:store.attributeSet']; SimpleSAML\Logger::debug('Consent - saveConsent() : [' . $userId . '|' . $targetedId . '|' . $attributeSet . ']'); try { $store->saveConsent($userId, $targetedId, $attributeSet);
<?php if (!isset($_REQUEST['id'])) { throw new SimpleSAML_Error_BadRequest('Missing required parameter: id'); } if (isset($_REQUEST['type'])) { $type = (string) $_REQUEST['type']; if (!in_array($type, array('init', 'js', 'nojs', 'embed'), TRUE)) { throw new SimpleSAML_Error_BadRequest('Invalid value for type.'); } } else { $type = 'init'; } if ($type !== 'embed' && $type !== 'async') { SimpleSAML\Logger::stats('slo-iframe ' . $type); SimpleSAML_Stats::log('core:idp:logout-iframe:page', array('type' => $type)); } $state = SimpleSAML_Auth_State::loadState($_REQUEST['id'], 'core:Logout-IFrame'); $idp = SimpleSAML_IdP::getByState($state); if ($type !== 'init') { // Update association state $associations = $idp->getAssociations(); foreach ($state['core:Logout-IFrame:Associations'] as $assocId => &$sp) { $spId = sha1($assocId); // Move SPs from 'onhold' to 'inprogress' if ($sp['core:Logout-IFrame:State'] === 'onhold') { $sp['core:Logout-IFrame:State'] = 'inprogress'; } /* Check for update through request. */ if (isset($_REQUEST[$spId])) { $s = $_REQUEST[$spId];
/** * Handle login request. * * This function is used by the login form (core/www/loginuserpass.php) when the user * enters a username and password. On success, it will not return. On wrong * username/password failure, and other errors, it will throw an exception. * * @param string $authStateId The identifier of the authentication state. * @param string $username The username the user wrote. * @param string $password The password the user wrote. */ public static function handleLogin($authStateId, $username, $password) { assert('is_string($authStateId)'); assert('is_string($username)'); assert('is_string($password)'); /* Here we retrieve the state array we saved in the authenticate-function. */ $state = SimpleSAML_Auth_State::loadState($authStateId, self::STAGEID); /* Retrieve the authentication source we are executing. */ assert('array_key_exists(self::AUTHID, $state)'); $source = SimpleSAML_Auth_Source::getById($state[self::AUTHID]); if ($source === NULL) { throw new Exception('Could not find authentication source with id ' . $state[self::AUTHID]); } /* * $source now contains the authentication source on which authenticate() * was called. We should call login() on the same authentication source. */ /* Attempt to log in. */ try { $attributes = $source->login($username, $password); } catch (Exception $e) { SimpleSAML\Logger::stats('Unsuccessful login attempt from ' . $_SERVER['REMOTE_ADDR'] . '.'); throw $e; } SimpleSAML\Logger::stats('User \'' . $username . '\' has been successfully authenticated.'); /* Save the attributes we received from the login-function in the $state-array. */ assert('is_array($attributes)'); $state['Attributes'] = $attributes; /* Return control to SimpleSAMLphp after successful authentication. */ SimpleSAML_Auth_Source::completeAuth($state); }