Skip to content

Commit 5c77d96

Browse files
author
Boy Baukema
committed
Merge pull request #220 from OpenConext/develop
EB 4.7
2 parents d37607b + 0cabaec commit 5c77d96

File tree

83 files changed

+1320
-1402
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

83 files changed

+1320
-1402
lines changed

‎.gitignore‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,2 @@
1-
*.iml
2-
*.ipr
3-
*.iws
4-
.idea/
51
/build
62
/vendor/
7-
/www/authentication/generated/
8-
bin/ignore_me.php

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -293,3 +293,8 @@ load the required theme modules.
293293

294294
Themes can be deployed using a Grunt task, from the theme directory run `grunt theme:mythemename`, this will initiate
295295
the appropriate tasks for cleaning the previous theme and deploying the new theme on your installation.
296+
297+
The following commandline may give you all the needed dependencies and run grunt to update the installed files after changing a theme:
298+
```
299+
(cd theme && npm install && sudo npm install -g bower && bower install && grunt)
300+
```

‎application/configs/application.ini‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -210,23 +210,24 @@ serviceRegistry.caching.backend.options.file_name_prefix = "eb_sr_cache"
210210
serviceRegistry.caching.backend.options.lifetime = 1;
211211

212212
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
213-
;;;;;;;;;; API VO VALIDATION SETTINGS ;;;;;;;;;;
213+
;;;;;;;;;; EngineBlock API credentials ;;;;;;;;;
214214
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
215215

216-
; Base URL that engineblock can use to validate that a given use belongs to a given Virtual Organization.
217-
api.vovalidate.baseUrl = "https://api.demo.openconext.org"
218-
api.vovalidate.key = "oauth_key"
219-
api.vovalidate.secret = "oauth_secret"
216+
; Username and password for engine-api usage.
217+
engineApi.user = janus-ssp
218+
;engineApi.password = RANDOM PASSWORD HERE
220219

221220

222221
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
223-
;;;;;;;;;; EngineBlock API credentials ;;;;;;;;;
222+
;;;;;;;;;;;; PDP SETTINGS ;;;;;;;;;;;;;;;;;;;;;;
224223
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
225224

226-
; Username and password for engine-api usage.
227-
engineApi.user = janus-ssp
228-
;engineApi.password = RANDOM PASSWORD HERE
225+
; Location of PDP
226+
pdp.baseUrl = "https://pdp.surfconext.nl/decide/policy"
229227

228+
; PDP uses basic auth
229+
pdp.username = "pdp_admin"
230+
pdp.password = "secret"
230231

231232
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
232233
;;;;;;;;;;;; MISCELLANEOUS SETTINGS ;;;;;;;;;;;;
@@ -289,4 +290,4 @@ subjectIdAttribute = "collabpersonid"
289290
; trustedProxyIps[] = 192.168.1.1
290291

291292
; UI Options
292-
ui.return_to_sp_link.active = false
293+
ui.return_to_sp_link.active = false

‎application/modules/Authentication/Controller/Feedback.php‎

Lines changed: 30 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,77 +2,100 @@
22

33
class Authentication_Controller_Feedback extends EngineBlock_Controller_Abstract
44
{
5-
public function vomembershiprequiredAction()
5+
public function unableToReceiveMessageAction()
66
{
7-
$this->_getResponse()->setStatus(403, 'Forbidden');
7+
$this->_getResponse()->setStatus(400, 'Bad Request');
8+
session_start();
89
}
910

10-
public function unableToReceiveMessageAction()
11+
public function sessionLostAction()
1112
{
1213
$this->_getResponse()->setStatus(400, 'Bad Request');
14+
session_start();
1315
}
1416

15-
public function sessionLostAction()
17+
public function dissimilarWorkflowStatesAction()
1618
{
1719
$this->_getResponse()->setStatus(400, 'Bad Request');
20+
session_start();
1821
}
1922

2023
public function unknownIssuerAction()
2124
{
2225
$this->_getResponse()->setStatus(404, 'Not Found');
2326
$this->__set('entity-id', $this->_getRequest()->getQueryParameter('entity-id'));
2427
$this->__set('destination', $this->_getRequest()->getQueryParameter('destination'));
28+
session_start();
2529
}
2630

2731
public function unknownServiceProviderAction()
2832
{
2933
$this->_getResponse()->setStatus(400, 'Bad Request');
3034
$this->__set('entity-id', $this->_getRequest()->getQueryParameter('entity-id'));
35+
session_start();
36+
}
37+
38+
public function unknownPreselectedIdpAction()
39+
{
40+
$this->_getResponse()->setStatus(400, 'Bad Request');
41+
$this->__set('idp-hash', $this->_getRequest()->getQueryParameter('idp-hash'));
42+
session_start();
3143
}
3244

3345
public function missingRequiredFieldsAction()
3446
{
3547
$this->_getResponse()->setStatus(400, 'Bad Request');
48+
session_start();
3649
}
3750

38-
public function noConsentAction()
51+
public function authorizationPolicyViolationAction()
3952
{
53+
session_start();
54+
}
4055

56+
public function noConsentAction()
57+
{
58+
session_start();
4159
}
4260

4361
public function customAction()
4462
{
45-
$proxyServer = new EngineBlock_Corto_ProxyServer();
46-
$proxyServer->startSession();
63+
session_start();
4764
}
4865

4966
public function invalidAcsLocationAction()
5067
{
5168
$this->_getResponse()->setStatus(400, 'Bad Request');
69+
session_start();
5270
}
5371

5472
public function invalidAcsBindingAction()
5573
{
5674
// @todo Send 4xx or 5xx header depending on invalid binding came from request or configured metadata
75+
session_start();
5776
}
5877

5978
public function receivedErrorStatusCodeAction()
6079
{
6180
// @todo Send 4xx or 5xx header?
81+
session_start();
6282
}
6383

6484
public function receivedInvalidResponseAction()
6585
{
6686
// @todo Send 4xx or 5xx header?
87+
session_start();
6788
}
6889

6990
public function receivedInvalidSignedResponseAction()
7091
{
7192
// @todo Send 4xx or 5xx header?
93+
session_start();
7294
}
7395

7496
public function noIdpsAction()
7597
{
7698
// @todo Send 4xx or 5xx header?
99+
session_start();
77100
}
78101
}

‎application/modules/Authentication/Controller/IdentityProvider.php‎

Lines changed: 26 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,8 @@ protected function _singleSignOn($service = 'singleSignOn', array $arguments = a
3636

3737
$idPEntityId = NULL;
3838

39-
// Optionally allow /single-sign-on/vo:myVoId/remoteIdPHash or
40-
// /single-sign-on/remoteIdPHash/vo:myVoId/key:20140420
39+
// Optionally allow /single-sign-on/remoteIdPHash or
40+
// /single-sign-on/remoteIdPHash/key:20140420
4141
foreach ($arguments as $argument) {
4242
if (substr($argument, 0, 3) == 'vo:') {
4343
$proxyServer->setVirtualOrganisationContext(substr($argument, 3));
@@ -68,14 +68,6 @@ protected function _singleSignOn($service = 'singleSignOn', array $arguments = a
6868
$application->handleExceptionWithFeedback($e,
6969
'/authentication/feedback/unable-to-receive-message');
7070
}
71-
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
72-
$application->getLogInstance()->notice(
73-
"User is not a member",
74-
array('exception' => $e)
75-
);
76-
$application->handleExceptionWithFeedback($e,
77-
'/authentication/feedback/vomembershiprequired');
78-
}
7971
catch (EngineBlock_Corto_Module_Services_SessionLostException $e) {
8072
$application->getLogInstance()->notice(
8173
"Session lost",
@@ -99,7 +91,8 @@ protected function _singleSignOn($service = 'singleSignOn', array $arguments = a
9991
"No Identity Providers",
10092
array('exception' => $e)
10193
);
102-
$application->handleExceptionWithFeedback($e,
94+
$application->handleExceptionWithFeedback(
95+
$e,
10396
'/authentication/feedback/no-idps'
10497
);
10598
}
@@ -108,10 +101,31 @@ protected function _singleSignOn($service = 'singleSignOn', array $arguments = a
108101
"Invalid ACS location",
109102
array('exception' => $e)
110103
);
111-
$application->handleExceptionWithFeedback($e,
104+
$application->handleExceptionWithFeedback(
105+
$e,
112106
'/authentication/feedback/invalidAcsLocation'
113107
);
114108
}
109+
catch (EngineBlock_Exception_DissimilarServiceProviderWorkflowStates $e) {
110+
$application->getLogInstance()->notice(
111+
"Dissimilar Service Provider workflowstates in request chain (transparant proxying)",
112+
array('exception' => $e)
113+
);
114+
$application->handleExceptionWithFeedback(
115+
$e,
116+
'/authentication/feedback/dissimilar-workflow-states'
117+
);
118+
}
119+
catch (EngineBlock_Corto_Exception_UnknownPreselectedIdp $e) {
120+
$application->getLogInstance()->notice(
121+
$e->getMessage(),
122+
array('exception' => $e)
123+
);
124+
$application->handleExceptionWithFeedback(
125+
$e,
126+
'/authentication/feedback/unknown-preselected-idp?idp-hash=' . $e->getRemoteIdpMd5Hash()
127+
);
128+
}
115129
}
116130

117131
public function processWayfAction()
@@ -162,10 +176,6 @@ public function processConsentAction()
162176
$application->handleExceptionWithFeedback($e,
163177
'/authentication/feedback/unable-to-receive-message');
164178
}
165-
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
166-
$application->handleExceptionWithFeedback($e,
167-
'/authentication/feedback/vomembershiprequired');
168-
}
169179
catch (EngineBlock_Corto_Module_Services_SessionLostException $e) {
170180
$application->handleExceptionWithFeedback($e,
171181
'/authentication/feedback/session-lost');

‎application/modules/Authentication/Controller/Proxy.php‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -95,16 +95,6 @@ public function processedAssertionAction()
9595
$proxyServer = new EngineBlock_Corto_Adapter();
9696
$proxyServer->processedAssertionConsumer();
9797
}
98-
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
99-
$application->getLogInstance()->notice(
100-
"VO membership required",
101-
array('exception' => $e)
102-
);
103-
$application->handleExceptionWithFeedback(
104-
$e,
105-
'/authentication/feedback/vomembershiprequired'
106-
);
107-
}
10898
catch (EngineBlock_Attributes_Manipulator_CustomException $e) {
10999
$application->getLogInstance()->notice(
110100
"Custom attribute manipulator exception",

‎application/modules/Authentication/Controller/ServiceProvider.php‎

Lines changed: 22 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,14 @@ public function consumeAssertionAction()
1212
try {
1313
$proxyServer->consumeAssertion();
1414
}
15-
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
15+
catch (EngineBlock_Corto_Exception_PEPNoAccess $e) {
1616
$application->getLogInstance()->notice(
17-
"VO membership required",
17+
"PEP authorization rule violation",
1818
array('exception' => $e)
1919
);
20-
$application->handleExceptionWithFeedback(
21-
$e,
22-
'/authentication/feedback/vomembershiprequired'
23-
);
20+
$application->handleExceptionWithFeedback($e,
21+
'/authentication/feedback/authorization-policy-violation',
22+
array("error_authorization_policy_violation_name" => $e->getMessage()));
2423
}
2524
catch (EngineBlock_Corto_Module_Services_SessionLostException $e) {
2625
$application->getLogInstance()->notice(
@@ -110,6 +109,16 @@ public function consumeAssertionAction()
110109
'/authentication/feedback/received-invalid-response'
111110
);
112111
}
112+
catch (EngineBlock_Exception_DissimilarServiceProviderWorkflowStates $e) {
113+
$application->getLogInstance()->notice(
114+
"Dissimilar Service Provider workflowstates in request chain (transparant proxying)",
115+
array('exception' => $e)
116+
);
117+
$application->handleExceptionWithFeedback(
118+
$e,
119+
'/authentication/feedback/dissimilar-workflow-states'
120+
);
121+
}
113122
}
114123

115124
public function processConsentAction()
@@ -126,9 +135,14 @@ public function processConsentAction()
126135
$application->handleExceptionWithFeedback($e,
127136
'/authentication/feedback/session-lost');
128137
}
129-
catch (EngineBlock_Corto_Exception_UserNotMember $e) {
138+
catch (EngineBlock_Corto_Exception_PEPNoAccess $e) {
139+
$application->getLogInstance()->notice(
140+
"PEP authorization rule violation",
141+
array('exception' => $e)
142+
);
130143
$application->handleExceptionWithFeedback($e,
131-
'/authentication/feedback/vomembershiprequired');
144+
'/authentication/feedback/authorization-policy-violation',
145+
array("error_authorization_policy_violation_name" => $e->getMessage()));
132146
}
133147
catch (EngineBlock_Attributes_Manipulator_CustomException $e) {
134148
$_SESSION['feedback_custom'] = $e->getFeedback();

‎application/modules/Authentication/View/Feedback/AuthorizationPolicyViolation.phtml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
<?php /* This file is generated. Please edit the files of the appropriate theme in the 'theme/' directory. */ ?>
2+
<?php
3+
4+
/**
5+
* @var Zend_Layout $layout
6+
*/
7+
$layout = $this->layout();
8+
9+
// Set Layout properties
10+
$layout->title = $layout->title. ' - ' .$this->t('error_authorization_policy_violation');
11+
$layout->header = $layout->title;
12+
$layout->subheader = $this->t('error_authorization_policy_violation');
13+
$layout->wide = true;
14+
15+
?>
16+
<div class="box">
17+
<div class="mod-content">
18+
<h1><?php echo htmlentities($this->layout()->subheader, 0, "UTF-8"); ?></h1>
19+
<?= $this->t('error_authorization_policy_violation_desc');
20+
21+
require_once realpath(__DIR__ . '/../../../Default/View/Error/include/footer.php'); ?>
22+
</div>
23+
</div>

application/modules/Authentication/View/Feedback/Vomembershiprequired.phtml renamed to application/modules/Authentication/View/Feedback/DissimilarWorkflowStates.phtml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,17 +7,17 @@
77
$layout = $this->layout();
88

99
// Set Layout properties
10-
$layout->title = $layout->title. ' - ' .$this->t('error_vo_membership_required');
10+
$layout->title = $layout->title. ' - ' .$this->t('error_session');
1111
$layout->header = $layout->title;
12-
$layout->subheader = $this->t('error_vo_membership_required');
12+
$layout->subheader = $this->t('error_dissimilar_workflow_state');
1313
$layout->wide = true;
1414

1515
?>
1616
<div class="box">
1717
<div class="mod-content">
1818
<h1><?php echo htmlentities($this->layout()->subheader, 0, "UTF-8"); ?></h1>
19-
<p><?= $this->t('error_vo_membership_required_desc') ?></p>
19+
<?= $this->t('error_dissimilar_workflow_state_desc');
2020

21-
<?php require_once realpath(__DIR__ . '/../../../Default/View/Error/include/footer.php') ?>
21+
require_once realpath(__DIR__ . '/../../../Default/View/Error/include/footer.php'); ?>
2222
</div>
2323
</div>

‎application/modules/Authentication/View/Feedback/UnknownPreselectedIdp.phtml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
<?php /* This file is generated. Please edit the files of the appropriate theme in the 'theme/' directory. */ ?>
2+
<?php
3+
4+
/**
5+
* @var Zend_Layout $layout
6+
*/
7+
$layout = $this->layout();
8+
9+
// Set Layout properties
10+
$layout->title = $layout->title. ' - Error';
11+
$layout->header = $layout->title;
12+
$layout->subheader = $this->t('error_unknown_preselected_idp');
13+
$layout->wide = true;
14+
?>
15+
<div class="box">
16+
<div class="mod-content">
17+
<h1><?php echo htmlentities($this->layout()->subheader, 0, "UTF-8"); ?></h1>
18+
<?= $this->t('error_unknown_preselected_idp_desc');
19+
20+
// Add feedback info from url
21+
$customFeedbackInfo['Idp Hash'] = $this->_data['idp-hash'];
22+
if (!isset($_SESSION['feedbackInfo'])) {
23+
$_SESSION['feedbackInfo'] = array();
24+
}
25+
$_SESSION['feedbackInfo'] = array_merge($customFeedbackInfo, $_SESSION['feedbackInfo']);
26+
27+
require_once realpath(__DIR__ . '/../../../Default/View/Error/include/footer.php'); ?>
28+
</div>
29+
</div>

0 commit comments

Comments
 (0)