BookStack Code Mirror - bookstack/blob - app/Access/Oidc/OidcService.php

   1 <?php
   2
   3 namespace BookStack\Access\Oidc;
   4
   5 use BookStack\Access\GroupSyncService;
   6 use BookStack\Access\LoginService;
   7 use BookStack\Access\RegistrationService;
   8 use BookStack\Exceptions\JsonDebugException;
   9 use BookStack\Exceptions\StoppedAuthenticationException;
  10 use BookStack\Exceptions\UserRegistrationException;
  11 use BookStack\Facades\Theme;
  12 use BookStack\Http\HttpRequestService;
  13 use BookStack\Theming\ThemeEvents;
  14 use BookStack\Users\Models\User;
  15 use Illuminate\Support\Arr;
  16 use Illuminate\Support\Facades\Cache;
  17 use League\OAuth2\Client\OptionProvider\HttpBasicAuthOptionProvider;
  18 use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
  19
  20 /**
  21  * Class OpenIdConnectService
  22  * Handles any app-specific OIDC tasks.
  23  */
  24 class OidcService
  25 {
  26     public function __construct(
  27         protected RegistrationService $registrationService,
  28         protected LoginService $loginService,
  29         protected HttpRequestService $http,
  30         protected GroupSyncService $groupService
  31     ) {
  32     }
  33
  34     /**
  35      * Initiate an authorization flow.
  36      *
  37      * @throws OidcException
  38      *
  39      * @return array{url: string, state: string}
  40      */
  41     public function login(): array
  42     {
  43         $settings = $this->getProviderSettings();
  44         $provider = $this->getProvider($settings);
  45         return [
  46             'url'   => $provider->getAuthorizationUrl(),
  47             'state' => $provider->getState(),
  48         ];
  49     }
  50
  51     /**
  52      * Process the Authorization response from the authorization server and
  53      * return the matching, or new if registration active, user matched to the
  54      * authorization server. Throws if the user cannot be auth if not authenticated.
  55      *
  56      * @throws JsonDebugException
  57      * @throws OidcException
  58      * @throws StoppedAuthenticationException
  59      * @throws IdentityProviderException
  60      */
  61     public function processAuthorizeResponse(?string $authorizationCode): User
  62     {
  63         $settings = $this->getProviderSettings();
  64         $provider = $this->getProvider($settings);
  65
  66         // Try to exchange authorization code for access token
  67         $accessToken = $provider->getAccessToken('authorization_code', [
  68             'code' => $authorizationCode,
  69         ]);
  70
  71         return $this->processAccessTokenCallback($accessToken, $settings);
  72     }
  73
  74     /**
  75      * @throws OidcException
  76      */
  77     protected function getProviderSettings(): OidcProviderSettings
  78     {
  79         $config = $this->config();
  80         $settings = new OidcProviderSettings([
  81             'issuer'                => $config['issuer'],
  82             'clientId'              => $config['client_id'],
  83             'clientSecret'          => $config['client_secret'],
  84             'redirectUri'           => url('/oidc/callback'),
  85             'authorizationEndpoint' => $config['authorization_endpoint'],
  86             'tokenEndpoint'         => $config['token_endpoint'],
  87             'endSessionEndpoint'    => $config['end_session_endpoint'],
  88         ]);
  89
  90         // Use keys if configured
  91         if (!empty($config['jwt_public_key'])) {
  92             $settings->keys = [$config['jwt_public_key']];
  93         }
  94
  95         // Run discovery
  96         if ($config['discover'] ?? false) {
  97             try {
  98                 $settings->discoverFromIssuer($this->http->buildClient(5), Cache::store(null), 15);
  99             } catch (OidcIssuerDiscoveryException $exception) {
 100                 throw new OidcException('OIDC Discovery Error: ' . $exception->getMessage());
 101             }
 102         }
 103
 104         // Prevent use of RP-initiated logout if specifically disabled
 105         if ($config['end_session_endpoint'] === false) {
 106             $settings->endSessionEndpoint = null;
 107         }
 108
 109         $settings->validate();
 110
 111         return $settings;
 112     }
 113
 114     /**
 115      * Load the underlying OpenID Connect Provider.
 116      */
 117     protected function getProvider(OidcProviderSettings $settings): OidcOAuthProvider
 118     {
 119         $provider = new OidcOAuthProvider($settings->arrayForProvider(), [
 120             'httpClient'     => $this->http->buildClient(5),
 121             'optionProvider' => new HttpBasicAuthOptionProvider(),
 122         ]);
 123
 124         foreach ($this->getAdditionalScopes() as $scope) {
 125             $provider->addScope($scope);
 126         }
 127
 128         return $provider;
 129     }
 130
 131     /**
 132      * Get any user-defined addition/custom scopes to apply to the authentication request.
 133      *
 134      * @return string[]
 135      */
 136     protected function getAdditionalScopes(): array
 137     {
 138         $scopeConfig = $this->config()['additional_scopes'] ?: '';
 139
 140         $scopeArr = explode(',', $scopeConfig);
 141         $scopeArr = array_map(fn (string $scope) => trim($scope), $scopeArr);
 142
 143         return array_filter($scopeArr);
 144     }
 145
 146     /**
 147      * Calculate the display name.
 148      */
 149     protected function getUserDisplayName(OidcIdToken $token, string $defaultValue): string
 150     {
 151         $displayNameAttrString = $this->config()['display_name_claims'] ?? '';
 152         $displayNameAttrs = explode('|', $displayNameAttrString);
 153
 154         $displayName = [];
 155         foreach ($displayNameAttrs as $dnAttr) {
 156             $dnComponent = $token->getClaim($dnAttr) ?? '';
 157             if ($dnComponent !== '') {
 158                 $displayName[] = $dnComponent;
 159             }
 160         }
 161
 162         if (count($displayName) == 0) {
 163             $displayName[] = $defaultValue;
 164         }
 165
 166         return implode(' ', $displayName);
 167     }
 168
 169     /**
 170      * Extract the assigned groups from the id token.
 171      *
 172      * @return string[]
 173      */
 174     protected function getUserGroups(OidcIdToken $token): array
 175     {
 176         $groupsAttr = $this->config()['groups_claim'];
 177         if (empty($groupsAttr)) {
 178             return [];
 179         }
 180
 181         $groupsList = Arr::get($token->getAllClaims(), $groupsAttr);
 182         if (!is_array($groupsList)) {
 183             return [];
 184         }
 185
 186         return array_values(array_filter($groupsList, function ($val) {
 187             return is_string($val);
 188         }));
 189     }
 190
 191     /**
 192      * Extract the details of a user from an ID token.
 193      *
 194      * @return array{name: string, email: string, external_id: string, groups: string[]}
 195      */
 196     protected function getUserDetails(OidcIdToken $token): array
 197     {
 198         $idClaim = $this->config()['external_id_claim'];
 199         $id = $token->getClaim($idClaim);
 200
 201         return [
 202             'external_id' => $id,
 203             'email'       => $token->getClaim('email'),
 204             'name'        => $this->getUserDisplayName($token, $id),
 205             'groups'      => $this->getUserGroups($token),
 206         ];
 207     }
 208
 209     /**
 210      * Processes a received access token for a user. Login the user when
 211      * they exist, optionally registering them automatically.
 212      *
 213      * @throws OidcException
 214      * @throws JsonDebugException
 215      * @throws StoppedAuthenticationException
 216      */
 217     protected function processAccessTokenCallback(OidcAccessToken $accessToken, OidcProviderSettings $settings): User
 218     {
 219         $idTokenText = $accessToken->getIdToken();
 220         $idToken = new OidcIdToken(
 221             $idTokenText,
 222             $settings->issuer,
 223             $settings->keys,
 224         );
 225
 226         session()->put("oidc_id_token", $idTokenText);
 227
 228         $returnClaims = Theme::dispatch(ThemeEvents::OIDC_ID_TOKEN_PRE_VALIDATE, $idToken->getAllClaims(), [
 229             'access_token' => $accessToken->getToken(),
 230             'expires_in' => $accessToken->getExpires(),
 231             'refresh_token' => $accessToken->getRefreshToken(),
 232         ]);
 233
 234         if (!is_null($returnClaims)) {
 235             $idToken->replaceClaims($returnClaims);
 236         }
 237
 238         if ($this->config()['dump_user_details']) {
 239             throw new JsonDebugException($idToken->getAllClaims());
 240         }
 241
 242         try {
 243             $idToken->validate($settings->clientId);
 244         } catch (OidcInvalidTokenException $exception) {
 245             throw new OidcException("ID token validate failed with error: {$exception->getMessage()}");
 246         }
 247
 248         $userDetails = $this->getUserDetails($idToken);
 249         $isLoggedIn = auth()->check();
 250
 251         if (empty($userDetails['email'])) {
 252             throw new OidcException(trans('errors.oidc_no_email_address'));
 253         }
 254
 255         if ($isLoggedIn) {
 256             throw new OidcException(trans('errors.oidc_already_logged_in'));
 257         }
 258
 259         try {
 260             $user = $this->registrationService->findOrRegister(
 261                 $userDetails['name'],
 262                 $userDetails['email'],
 263                 $userDetails['external_id']
 264             );
 265         } catch (UserRegistrationException $exception) {
 266             throw new OidcException($exception->getMessage());
 267         }
 268
 269         if ($this->shouldSyncGroups()) {
 270             $groups = $userDetails['groups'];
 271             $detachExisting = $this->config()['remove_from_groups'];
 272             $this->groupService->syncUserWithFoundGroups($user, $groups, $detachExisting);
 273         }
 274
 275         $this->loginService->login($user, 'oidc');
 276
 277         return $user;
 278     }
 279
 280     /**
 281      * Get the OIDC config from the application.
 282      */
 283     protected function config(): array
 284     {
 285         return config('oidc');
 286     }
 287
 288     /**
 289      * Check if groups should be synced.
 290      */
 291     protected function shouldSyncGroups(): bool
 292     {
 293         return $this->config()['user_to_groups'] !== false;
 294     }
 295
 296     /**
 297      * Start the RP-initiated logout flow if active, otherwise start a standard logout flow.
 298      * Returns a post-app-logout redirect URL.
 299      * Reference: https://openid.net/specs/openid-connect-rpinitiated-1_0.html
 300      * @throws OidcException
 301      */
 302     public function logout(): string
 303     {
 304         $oidcToken = session()->pull("oidc_id_token");
 305         $defaultLogoutUrl = url($this->loginService->logout());
 306         $oidcSettings = $this->getProviderSettings();
 307
 308         if (!$oidcSettings->endSessionEndpoint) {
 309             return $defaultLogoutUrl;
 310         }
 311
 312         $endpointParams = [
 313             'id_token_hint' => $oidcToken,
 314             'post_logout_redirect_uri' => $defaultLogoutUrl,
 315         ];
 316
 317         return $oidcSettings->endSessionEndpoint . '?' . http_build_query($endpointParams);
 318     }
 319 }