New translations entities.php (Estonian)

[bookstack] / app / Http / Controllers / Auth / Saml2Controller.php

diff --git a/app/Http/Controllers/Auth/Saml2Controller.php b/app/Http/Controllers/Auth/Saml2Controller.php
index 72cf0e01970d023b06c05bc8cae07c7e20deb131..b84483961127fb0bd5ee9bed41957499df4986f8 100644 (file)
--- a/app/Http/Controllers/Auth/Saml2Controller.php
+++ b/app/Http/Controllers/Auth/Saml2Controller.php
@@ -4,10 +4,11 @@ namespace BookStack\Http\Controllers\Auth;
 
 use BookStack\Auth\Access\Saml2Service;
 use BookStack\Http\Controllers\Controller;
 
 use BookStack\Auth\Access\Saml2Service;
 use BookStack\Http\Controllers\Controller;

+use Illuminate\Http\Request;
+use Illuminate\Support\Str;

 
 class Saml2Controller extends Controller
 {
 
 class Saml2Controller extends Controller
 {

-

     protected $samlService;
 
     /**
     protected $samlService;
 
     /**


@@ -15,18 +16,8 @@ class Saml2Controller extends Controller
      */
     public function __construct(Saml2Service $samlService)
     {
      */
     public function __construct(Saml2Service $samlService)
     {

-        parent::__construct();

         $this->samlService = $samlService;
         $this->samlService = $samlService;

-
-        // SAML2 access middleware
-        $this->middleware(function ($request, $next) {
-
-            if (config('auth.method') !== 'saml2') {
-                $this->showPermissionError();
-            }
-
-            return $next($request);
-        });
+        $this->middleware('guard:saml2');

     }
 
     /**
     }
 
     /**


@@ -45,7 +36,7 @@ class Saml2Controller extends Controller
      */
     public function logout()
     {
      */
     public function logout()
     {

-        $logoutDetails = $this->samlService->logout();
+        $logoutDetails = $this->samlService->logout(auth()->user());

 
         if ($logoutDetails['id']) {
             session()->flash('saml2_logout_request_id', $logoutDetails['id']);
 
         if ($logoutDetails['id']) {
             session()->flash('saml2_logout_request_id', $logoutDetails['id']);


@@ -60,8 +51,9 @@ class Saml2Controller extends Controller
     public function metadata()
     {
         $metaData = $this->samlService->metadata();
     public function metadata()
     {
         $metaData = $this->samlService->metadata();

+

         return response()->make($metaData, 200, [
         return response()->make($metaData, 200, [

-            'Content-Type' => 'text/xml'
+            'Content-Type' => 'text/xml',

         ]);
     }
 
         ]);
     }
 


@@ -73,25 +65,64 @@ class Saml2Controller extends Controller
     {
         $requestId = session()->pull('saml2_logout_request_id', null);
         $redirect = $this->samlService->processSlsResponse($requestId) ?? '/';
     {
         $requestId = session()->pull('saml2_logout_request_id', null);
         $redirect = $this->samlService->processSlsResponse($requestId) ?? '/';

+

         return redirect($redirect);
     }
 
     /**
         return redirect($redirect);
     }
 
     /**

-     * Assertion Consumer Service.
-     * Processes the SAML response from the IDP.
+     * Assertion Consumer Service start URL. Takes the SAMLResponse from the IDP.
+     * Due to being an external POST request, we likely won't have context of the
+     * current user session due to lax cookies. To work around this we store the
+     * SAMLResponse data and redirect to the processAcs endpoint for the actual
+     * processing of the request with proper context of the user session.

      */
      */

-    public function acs()
+    public function startAcs(Request $request)

     {
     {

+        $samlResponse = $request->get('SAMLResponse', null);
+
+        if (empty($samlResponse)) {
+            $this->showErrorNotification(trans('errors.saml_fail_authed', ['system' => config('saml2.name')]));
+
+            return redirect('/login');
+        }
+
+        $acsId = Str::random(16);
+        $cacheKey = 'saml2_acs:' . $acsId;
+        cache()->set($cacheKey, encrypt($samlResponse), 10);
+
+        return redirect()->guest('/saml2/acs?id=' . $acsId);
+    }
+
+    /**
+     * Assertion Consumer Service process endpoint.
+     * Processes the SAML response from the IDP with context of the current session.
+     * Takes the SAML request from the cache, added by the startAcs method above.
+     */
+    public function processAcs(Request $request)
+    {
+        $acsId = $request->get('id', null);
+        $cacheKey = 'saml2_acs:' . $acsId;
+        $samlResponse = null;
+
+        try {
+            $samlResponse = decrypt(cache()->pull($cacheKey));
+        } catch (\Exception $exception) {
+        }

         $requestId = session()->pull('saml2_request_id', null);
 
         $requestId = session()->pull('saml2_request_id', null);
 

-        $user = $this->samlService->processAcsResponse($requestId);
-        if ($user === null) {
+        if (empty($acsId) || empty($samlResponse)) {

             $this->showErrorNotification(trans('errors.saml_fail_authed', ['system' => config('saml2.name')]));
             $this->showErrorNotification(trans('errors.saml_fail_authed', ['system' => config('saml2.name')]));

+
+            return redirect('/login');
+        }
+
+        $user = $this->samlService->processAcsResponse($requestId, $samlResponse);
+        if (is_null($user)) {
+            $this->showErrorNotification(trans('errors.saml_fail_authed', ['system' => config('saml2.name')]));
+

             return redirect('/login');
         }
 
             return redirect('/login');
         }
 

-        session()->put('last_login_type', 'saml2');

         return redirect()->intended();
     }
         return redirect()->intended();
     }

-

 }
 }