Merge branch 'openid' of https://github.com/jasperweyne/BookStack into jasperweyne...

[bookstack] / app / Auth / Access / Saml2Service.php

diff --git a/app/Auth/Access/Saml2Service.php b/app/Auth/Access/Saml2Service.php
index 4c1fce8643184b476ae5646d0b9855894f3a911a..74e8c7726e4280e58f89af532fe9b8a29dbacdc3 100644 (file)
--- a/app/Auth/Access/Saml2Service.php
+++ b/app/Auth/Access/Saml2Service.php
@@ -1,8 +1,11 @@
-<?php namespace BookStack\Auth\Access;
+<?php
+
+namespace BookStack\Auth\Access;
 
 use BookStack\Auth\User;
 use BookStack\Exceptions\JsonDebugException;
 use BookStack\Exceptions\SamlException;
+use BookStack\Exceptions\StoppedAuthenticationException;
 use BookStack\Exceptions\UserRegistrationException;
 use Exception;
 use OneLogin\Saml2\Auth;
@@ -17,33 +20,40 @@ use OneLogin\Saml2\ValidationError;
 class Saml2Service extends ExternalAuthService
 {
     protected $config;
+    protected $registrationService;
+    protected $loginService;
 
     /**
      * Saml2Service constructor.
      */
-    public function __construct(RegistrationService $registrationService, User $user)
+    public function __construct(RegistrationService $registrationService, LoginService $loginService, User $user),
     {
         parent::__construct($registrationService, $user);
         
         $this->config = config('saml2');
+        $this->registrationService = $registrationService;
+        $this->loginService = $loginService;
     }
 
     /**
      * Initiate a login flow.
+     *
      * @throws Error
      */
     public function login(): array
     {
         $toolKit = $this->getToolkit();
         $returnRoute = url('/saml2/acs');
+
         return [
             'url' => $toolKit->login($returnRoute, [], false, false, true),
-            'id' => $toolKit->getLastRequestID(),
+            'id'  => $toolKit->getLastRequestID(),
         ];
     }
 
     /**
      * Initiate a logout flow.
+     *
      * @throws Error
      */
     public function logout(): array
@@ -71,6 +81,7 @@ class Saml2Service extends ExternalAuthService
      * Process the ACS response from the idp and return the
      * matching, or new if registration active, user matched to the idp.
      * Returns null if not authenticated.
+     *
      * @throws Error
      * @throws SamlException
      * @throws ValidationError
@@ -85,7 +96,7 @@ class Saml2Service extends ExternalAuthService
 
         if (!empty($errors)) {
             throw new Error(
-                'Invalid ACS Response: '.implode(', ', $errors)
+                'Invalid ACS Response: ' . implode(', ', $errors)
             );
         }
 
@@ -101,6 +112,7 @@ class Saml2Service extends ExternalAuthService
 
     /**
      * Process a response for the single logout service.
+     *
      * @throws Error
      */
     public function processSlsResponse(?string $requestId): ?string
@@ -112,11 +124,12 @@ class Saml2Service extends ExternalAuthService
 
         if (!empty($errors)) {
             throw new Error(
-                'Invalid SLS Response: '.implode(', ', $errors)
+                'Invalid SLS Response: ' . implode(', ', $errors)
             );
         }
 
         $this->actionLogout();
+
         return $redirect;
     }
 
@@ -131,6 +144,7 @@ class Saml2Service extends ExternalAuthService
 
     /**
      * Get the metadata for this service provider.
+     *
      * @throws Error
      */
     public function metadata(): string
@@ -142,7 +156,7 @@ class Saml2Service extends ExternalAuthService
 
         if (!empty($errors)) {
             throw new Error(
-                'Invalid SP metadata: '.implode(', ', $errors),
+                'Invalid SP metadata: ' . implode(', ', $errors),
                 Error::METADATA_SP_INVALID
             );
         }
@@ -152,6 +166,7 @@ class Saml2Service extends ExternalAuthService
 
     /**
      * Load the underlying Onelogin SAML2 toolkit.
+     *
      * @throws Error
      * @throws Exception
      */
@@ -171,6 +186,7 @@ class Saml2Service extends ExternalAuthService
 
         $spSettings = $this->loadOneloginServiceProviderDetails();
         $settings = array_replace_recursive($settings, $spSettings, $metaDataSettings, $overrides);
+
         return new Auth($settings);
     }
 
@@ -180,18 +196,18 @@ class Saml2Service extends ExternalAuthService
     protected function loadOneloginServiceProviderDetails(): array
     {
         $spDetails = [
-            'entityId' => url('/saml2/metadata'),
+            'entityId'                 => url('/saml2/metadata'),
             'assertionConsumerService' => [
                 'url' => url('/saml2/acs'),
             ],
             'singleLogoutService' => [
-                'url' => url('/saml2/sls')
+                'url' => url('/saml2/sls'),
             ],
         ];
 
         return [
             'baseurl' => url('/saml2'),
-            'sp' => $spDetails
+            'sp'      => $spDetails,
         ];
     }
 
@@ -204,7 +220,7 @@ class Saml2Service extends ExternalAuthService
     }
 
     /**
-     * Calculate the display name
+     * Calculate the display name.
      */
     protected function getUserDisplayName(array $samlAttributes, string $defaultValue): string
     {
@@ -254,9 +270,9 @@ class Saml2Service extends ExternalAuthService
 
         return [
             'external_id' => $externalId,
-            'name' => $this->getUserDisplayName($samlAttributes, $externalId),
-            'email' => $email,
-            'saml_id' => $samlID,
+            'name'        => $this->getUserDisplayName($samlAttributes, $externalId),
+            'email'       => $email,
+            'saml_id'     => $samlID,
         ];
     }
 
@@ -290,6 +306,7 @@ class Saml2Service extends ExternalAuthService
                 $data = $data[0];
                 break;
         }
+
         return $data;
     }
 
@@ -309,9 +326,11 @@ class Saml2Service extends ExternalAuthService
     /**
      * Process the SAML response for a user. Login the user when
      * they exist, optionally registering them automatically.
+     *
      * @throws SamlException
      * @throws JsonDebugException
      * @throws UserRegistrationException
+     * @throws StoppedAuthenticationException
      */
     public function processLoginCallback(string $samlID, array $samlAttributes): User
     {
@@ -320,8 +339,8 @@ class Saml2Service extends ExternalAuthService
 
         if ($this->config['dump_user_details']) {
             throw new JsonDebugException([
-                'id_from_idp' => $samlID,
-                'attrs_from_idp' => $samlAttributes,
+                'id_from_idp'         => $samlID,
+                'attrs_from_idp'      => $samlAttributes,
                 'attrs_after_parsing' => $userDetails,
             ]);
         }
@@ -344,7 +363,8 @@ class Saml2Service extends ExternalAuthService
             $this->syncWithGroups($user, $groups);
         }
 
-        auth()->login($user);
+        $this->loginService->login($user, 'saml2');
+
         return $user;
     }
 }