Merge branch 'ivir-authncontext' of https://github.com/ivir/BookStack into ivir-ivir...

diff --combined .env.example.complete
index d243f2c1fcb9d13b52ba9dc9e55a27b07e663f79,d3f109f2f0e6e9a9e7c51ca6ac9a517e32d6f5a1..a3b0702d5b1385b9492d01d8ffe2c0a32ea4da3d
--- 1/.env.example.complete
--- 2/.env.example.complete
+++ b/.env.example.complete
@@@ -51,7 -51,7 +51,7 @@@ DB_USERNAME=database_usernam
  DB_PASSWORD=database_user_password
  
  # Mail system to use
 -# Can be 'smtp', 'mail' or 'sendmail'
 +# Can be 'smtp' or 'sendmail'
  MAIL_DRIVER=smtp
  
  # Mail sending options
@@@ -195,7 -195,6 +195,7 @@@ LDAP_DN=fals
  LDAP_PASS=false
  LDAP_USER_FILTER=false
  LDAP_VERSION=false
 +LDAP_START_TLS=false
  LDAP_TLS_INSECURE=false
  LDAP_ID_ATTRIBUTE=uid
  LDAP_EMAIL_ATTRIBUTE=mail
@@@ -223,6 -222,12 +223,12 @@@ SAML2_ONELOGIN_OVERRIDES=nul
  SAML2_DUMP_USER_DETAILS=false
  SAML2_AUTOLOAD_METADATA=false
  
+ # SAML Authentication context.
+ # Set to false and no AuthContext will be sent in the AuthNRequest,
+ # Set true and you will get an AuthContext 'exact' 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
+ # Set an array with the possible auth context values: array ('urn:oasis:names:tc:SAML:2.0:ac:classes:Password', 'urn:oasis:names:tc:SAML:2.0:ac:classes:X509'),
+ SAML2_IDP_AUTHNCONTEXT=false
+ 
  # SAML group sync configuration
  # Refer to https://www.bookstackapp.com/docs/admin/saml2-auth/
  SAML2_USER_TO_GROUPS=false
@@@ -239,36 -244,20 +245,36 @@@ DISABLE_EXTERNAL_SERVICES=fals
  # Example: AVATAR_URL=https://seccdn.libravatar.org/avatar/${hash}?s=${size}&d=identicon
  AVATAR_URL=
  
 -# Enable Draw.io integration
 +# Enable diagrams.net integration
 +# Can simply be true/false to enable/disable the integration.
 +# Alternatively, It can be URL to the diagrams.net instance you want to use.
 +# For URLs, The following URL parameters should be included: embed=1&proto=json&spin=1
  DRAWIO=true
  
  # Default item listing view
 -# Used for public visitors and user's without a preference
 -# Can be 'list' or 'grid'
 +# Used for public visitors and user's without a preference.
 +# Can be 'list' or 'grid'.
  APP_VIEWS_BOOKS=list
  APP_VIEWS_BOOKSHELVES=grid
 +APP_VIEWS_BOOKSHELF=grid
 +
 +# Use dark mode by default
 +# Will be overriden by any user/session preference.
 +APP_DEFAULT_DARK_MODE=false
  
  # Page revision limit
  # Number of page revisions to keep in the system before deleting old revisions.
  # If set to 'false' a limit will not be enforced.
  REVISION_LIMIT=50
  
 +# Recycle Bin Lifetime
 +# The number of days that content will remain in the recycle bin before
 +# being considered for auto-removal. It is not a guarantee that content will
 +# be removed after this time.
 +# Set to 0 for no recycle bin functionality.
 +# Set to -1 for unlimited recycle bin lifetime.
 +RECYCLE_BIN_LIFETIME=30
 +
  # Allow <script> tags in page content
  # Note, if set to 'true' the page editor may still escape scripts.
  ALLOW_CONTENT_SCRIPTS=false
@@@ -279,23 -268,9 +285,23 @@@
  # Contents of the robots.txt file can be overridden, making this option obsolete.
  ALLOW_ROBOTS=null
  
 +# A list of hosts that BookStack can be iframed within.
 +# Space separated if multiple. BookStack host domain is auto-inferred.
 +# For Example: ALLOWED_IFRAME_HOSTS="https://example.com https://a.example.com"
 +# Setting this option will also auto-adjust cookies to be SameSite=None.
 +ALLOWED_IFRAME_HOSTS=null
 +
  # The default and maximum item-counts for listing API requests.
  API_DEFAULT_ITEM_COUNT=100
  API_MAX_ITEM_COUNT=500
  
  # The number of API requests that can be made per minute by a single user.
  API_REQUESTS_PER_MIN=180
 +
 +# Enable the logging of failed email+password logins with the given message.
 +# The default log channel below uses the php 'error_log' function which commonly
 +# results in messages being output to the webserver error logs.
 +# The message can contain a %u parameter which will be replaced with the login
 +# user identifier (Username or email).
 +LOG_FAILED_LOGIN_MESSAGE=false
 +LOG_FAILED_LOGIN_CHANNEL=errorlog_plain_webserver

diff --combined app/Config/saml2.php
index d695abf325d1e5260b14d8325ea503c18bfe1abb,83fa4f227ff95f2d64f40adcf544fe75e7db9bc2..0e186c26937e0b97282d6e46abd5692f8b6666f3
--- 1/app/Config/saml2.php
--- 2/app/Config/saml2.php
+++ b/app/Config/saml2.php
@@@ -101,7 -101,7 +101,7 @@@ return 
                  'url' => env('SAML2_IDP_SLO', null),
                  // URL location of the IdP where the SP will send the SLO Response (ResponseLocation)
                  // if not set, url for the SLO Request will be used
 -                'responseUrl' => '',
 +                'responseUrl' => null,
                  // SAML protocol binding to be used when returning the <Response>
                  // message.  Onelogin Toolkit supports for this endpoint the
                  // HTTP-Redirect binding only
@@@ -139,6 -139,12 +139,12 @@@
              //      )
              // ),
          ],
+         'security' => [
+             // Specifies Authentication context
+             // false means that IDP choose authentication method
+             // null force Form based authentication or is possible set via array supported methods. See to onelogin/php-sampl/advance_settings
+             'requestedAuthnContext' => env('SAML2_IDP_AUTHNCONTEXT',false), 
+         ],
      ],
  
  ];