WE2-689 Updated README

Guido Gröön · mrts · commit a5e9861bdc1e · 2022-11-25T17:51:04.000+02:00
WE2-689 Added example project
WE2-683 Added method withSecureRandom() to ChallengeNonceGeneratorBuilder
diff --git a/README.md b/README.md
diff --git a/examples/composer.json b/examples/composer.json
@@ -0,0 +1,31 @@
+{
+    "name": "demo/webeid-php",
+    "description": "Web eID PHP demo",
+    "license": "MIT",
+    "type": "library",
+    "authors": [
+        {
+            "name": "Guido Gröön",
+            "role" : "developer"
+        }
+    ],
+    "require": {
+        "php": ">=7.4",
+        "web_eid/web_eid_authtoken_validation_php": "dev-main",
+        "web_eid/ocsp_php": "dev-main",
+        "altorouter/altorouter": "1.1.0"
+    },
+    "autoload": {
+        "classmap": ["src"]
+    },
+    "repositories": [
+        {
+            "type": "vcs",
+            "url": "https://github.com/web-eid/web-eid-authtoken-validation-php.git"
+        },
+        {
+            "type": "vcs",
+            "url": "https://github.com/web-eid/ocsp-php.git"
+        }        
+    ]        
+}
diff --git a/examples/index.php b/examples/index.php
diff --git a/examples/public/.htaccess b/examples/public/.htaccess
@@ -0,0 +1,4 @@
+RewriteEngine on
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME}/ !-f
+RewriteRule . index.php [L]
diff --git a/examples/public/index.php b/examples/public/index.php
@@ -0,0 +1,13 @@
+<?php
+
+header('Content-type: text/html; charset=UTF-8');
+
+session_start();
+
+// Define the log location
+define("LOGFILE", dirname(__FILE__) . "/../log/web-eid-authtoken-validation-php.log");
+
+require __DIR__ . '/../vendor/autoload.php';
+
+$router = new Router();
+$router->init();
diff --git a/examples/public/js/errors.js b/examples/public/js/errors.js
diff --git a/examples/public/js/web-eid.js b/examples/public/js/web-eid.js
diff --git a/examples/src/Auth.php b/examples/src/Auth.php
@@ -0,0 +1,115 @@
+<?php
+
+use web_eid\web_eid_authtoken_validation_php\authtoken\WebEidAuthToken;
+use web_eid\web_eid_authtoken_validation_php\certificate\CertificateData;
+use web_eid\web_eid_authtoken_validation_php\certificate\CertificateLoader;
+use web_eid\web_eid_authtoken_validation_php\challenge\ChallengeNonceGenerator;
+use web_eid\web_eid_authtoken_validation_php\challenge\ChallengeNonceGeneratorBuilder;
+use web_eid\web_eid_authtoken_validation_php\challenge\ChallengeNonceStore;
+use web_eid\web_eid_authtoken_validation_php\exceptions\ChallengeNonceExpiredException;
+use web_eid\web_eid_authtoken_validation_php\util\Uri;
+use web_eid\web_eid_authtoken_validation_php\validator\AuthTokenValidator;
+use web_eid\web_eid_authtoken_validation_php\validator\AuthTokenValidatorBuilder;
+
+class Auth
+{
+
+    public function trustedIntermediateCACertificates(): array
+    {
+        return CertificateLoader::loadCertificatesFromResources(
+            __DIR__ . "/../certificates/esteid2018.der.crt", __DIR__ . "/../certificates/ESTEID-SK_2015.der.crt"
+        );
+    }
+
+    public function generator(): ChallengeNonceGenerator
+    {
+        return (new ChallengeNonceGeneratorBuilder())
+            ->withNonceTtl(300)
+            ->build();
+    }
+
+    public function tokenValidator(): AuthTokenValidator
+    {
+        return (new AuthTokenValidatorBuilder())
+            ->withSiteOrigin(new Uri('https://localhost:8443'))
+            ->withTrustedCertificateAuthorities(...self::trustedIntermediateCACertificates())
+            ->build();
+    }
+
+    /**
+     * Get challenge nonce
+     *
+     * @return string
+     */    
+    public function getNonce()
+    {
+        try {
+            header('Content-Type: application/json; charset=utf-8');
+            $generator = $this->generator();
+            $challengeNonce = $generator->generateAndStoreNonce();
+            $responseArr = [];
+            $responseArr["nonce"] = $challengeNonce->getBase64EncodedNonce();
+            echo json_encode($responseArr);
+        } catch (Exception $e) {
+            header("HTTP/1.0 400 Bad Request");
+            echo $e->getMessage();
+        }
+    }
+
+    /**
+     * Authenticate
+     *
+     * @return string
+     */    
+    public function validate()
+    {
+        $authToken = file_get_contents('php://input');
+
+        try {
+
+            /* Get and remove nonce from store */
+            $challengeNonce = (new ChallengeNonceStore())->getAndRemove();
+
+            try {
+
+                // Build token validator
+                $tokenValidator = $this->tokenValidator();
+
+                // Validate token
+                $cert = $tokenValidator->validate(new WebEidAuthToken($authToken), $challengeNonce->getBase64EncodedNonce());
+
+                session_regenerate_id();
+
+                $subjectName = CertificateData::getSubjectGivenName($cert) . " " . CertificateData::getSubjectSurname($cert);
+                $result = [
+                    'sub' => $subjectName
+                ];
+
+                $_SESSION["auth-user"] = $subjectName;
+
+                echo json_encode($result);
+
+            } catch (Exception $e) {
+                header("HTTP/1.0 400 Bad Request");
+                echo $e->getMessage();
+            }
+
+        } catch (ChallengeNonceExpiredException $e) {
+            header("HTTP/1.0 400 Bad Request");
+            echo $e->getMessage();
+        }
+    }
+
+    /**
+     * Logout
+     *
+     */
+    public function logout()
+    {
+        unset($_SESSION["auth-user"]);
+        session_regenerate_id();
+        // Redirect to login
+        header("location:/");
+    }
+
+}
diff --git a/examples/src/Pages.php b/examples/src/Pages.php
@@ -0,0 +1,36 @@
+<?php
+
+class Pages
+{
+    var $template;
+    var $data = [];
+
+    public function __construct()
+    {
+        $this->template = new Template();
+    }
+
+    public function login()
+    {
+        $this->data['content'] = $this->template->getHtml(__DIR__ . '/../tpl/login.phtml');
+    }
+
+    public function welcome()
+    {
+        if (!isset($_SESSION["auth-user"])) {
+            // Redirect to login
+            header("location:/");
+            return;
+        }
+
+        $data = [];
+        $data["auth_user"] = $_SESSION["auth-user"];
+        $this->data['content'] = $this->template->getHtml(__DIR__ . '/../tpl/welcome.phtml', $data);
+    }
+
+    public function __destruct()
+    {
+        echo $this->template->getHtml(__DIR__ . '/../tpl/site.phtml', $this->data);
+    }
+
+}
diff --git a/examples/src/Router.php b/examples/src/Router.php
@@ -0,0 +1,41 @@
+<?php
+/* App router */
+
+class Router
+{
+    public function init()
+    {
+
+        $router = new AltoRouter();
+        $router->setBasePath('');
+
+        // Page routes
+        $router->map('GET', '', ['controller' => 'Pages', 'method' => 'login']);
+        $router->map('GET', '/', ['controller' => 'Pages', 'method' => 'login']);
+        $router->map('GET', '/logout', ['controller' => 'Auth', 'method' => 'logout']);
+
+        // Allow route onlu for authenticated users
+        if (isset($_SESSION["auth-user"])) {
+            $router->map('GET', '/welcome', ['controller' => 'Pages', 'method' => 'welcome']);
+        }
+
+        // Web eID routes
+        $router->map('GET', '/nonce', ['controller' => 'Auth', 'method' => 'getNonce']);
+        $router->map('POST', '/validate', ['controller' => 'Auth', 'method' => 'validate']);
+        
+        $match = $router->match();
+
+        if (!$match) {
+            // Redirect to login
+            header("location:/");
+            return;
+        }
+
+
+        $controller = new $match['target']['controller'];
+        $method = $match['target']['method'];
+
+        call_user_func([$controller, $method], $match['params'], []);        
+
+    }
+}
diff --git a/examples/src/Template.php b/examples/src/Template.php
@@ -0,0 +1,21 @@
+<?php
+/* Simple template engine */
+
+class Template
+{
+
+    public function getHtml($template, $data = [])
+    {
+        if (is_file($template)) {
+            ob_start();
+            extract($data);
+            require($template);
+            $contents = ob_get_contents();
+            ob_end_clean();
+            return $contents;
+        }
+        throw new Exception("Could not load template file " . $template);
+    
+    }
+
+}
diff --git a/examples/tpl/login.phtml b/examples/tpl/login.phtml
@@ -0,0 +1,64 @@
+<h1 class="text-center mt-5">Authenticate with Web eID</h1>
+<p class="text-center mt-5"><button type="button" class="btn btn-lg btn-primary" id="webeid-auth-button">Authenticate</button></p>
+
+<div id="error-message">
+    <div class="message"></div>
+    <div class="details"></div>
+</div>
+
+<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script>
+<script type="module">
+    "use strict";
+    import * as webeid from "./js/web-eid.js";
+    import {hideErrorMessage, showErrorMessage, checkHttpError} from "./js/errors.js";
+
+    hideErrorMessage();
+
+    const authButton = document.querySelector("#webeid-auth-button");
+
+    const csrfToken = document.querySelector('#csrftoken').content;
+    const csrfHeaderName = document.querySelector('#csrfheadername').content;
+
+    const lang = new URLSearchParams(window.location.search).get("lang") || "en";
+
+    authButton.addEventListener("click", async () => {
+        hideErrorMessage();
+        authButton.disabled = true;
+
+        try {
+            const challengeResponse = await fetch("./nonce", {
+                method: "GET",
+                headers: {
+                    "Content-Type": "application/json"
+                }
+            });
+            await checkHttpError(challengeResponse);
+            const {nonce} = await challengeResponse.json();
+
+            const authToken = await webeid.authenticate(nonce, {lang});
+
+            const authTokenResponse = await fetch("./validate", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    [csrfHeaderName]: csrfToken
+                },
+                body: `${JSON.stringify(authToken)}`
+            });
+            await checkHttpError(authTokenResponse);
+            const authTokenResult = await authTokenResponse.json();
+
+            console.log("Authentication successful! Result:", authTokenResult);
+
+            window.location.href = "/welcome";
+
+        } catch (error) {
+            showErrorMessage(error);
+            throw error;
+        } finally {
+            authButton.disabled = false;
+        }
+    });
+
+    //# sourceURL=index.js
+</script>    
diff --git a/examples/tpl/site.phtml b/examples/tpl/site.phtml
@@ -0,0 +1,12 @@
+<html>
+<head>
+    <meta id="csrftoken" name="csrftoken" content="47efac03-6160-4ae2-a576-5bbf80ed77ac"/>
+    <meta id="csrfheadername" name="csrfheadername" content="X-CSRF-TOKEN"/>
+    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css" rel="stylesheet" integrity="sha384-EVSTQN3/azprG1Anm3QDgpJLIm9Nao0Yz1ztcQTwFspd3yD65VohhpuuCOmLASjC" crossorigin="anonymous">
+</head>
+<body>
+
+<?php echo $content; ?>
+
+</body>
+</html>
diff --git a/examples/tpl/welcome.phtml b/examples/tpl/welcome.phtml
@@ -0,0 +1,2 @@
+<h1 class="text-center mt-5">Hello <?php echo $auth_user;?></h1>
+<p class="text-center"><a href="./logout">Logout</a></p>
diff --git a/src/challenge/ChallengeNonceGeneratorBuilder.php b/src/challenge/ChallengeNonceGeneratorBuilder.php
@@ -59,7 +59,7 @@ public function __construct()
      * When the time-to-live passes, the nonce is considered to be expired.
      *
      * @param int $seconds - challenge nonce time-to-live duration in seconds
-     * @return current builder instance
+     * @return ChallengeNonceGeneratorBuilder builder instance
      */    
     public function withNonceTtl(int $seconds): ChallengeNonceGeneratorBuilder
     {
@@ -71,14 +71,27 @@ public function withNonceTtl(int $seconds): ChallengeNonceGeneratorBuilder
      * Sets the challenge nonce store where the generated challenge nonces will be stored.
      *
      * @param challengeNonceStore challenge nonce store
-     * @return current builder instance
+     * @return ChallengeNonceGeneratorBuilder builder instance
      */    
     public function withChallengeNonceStore(ChallengeNonceStore $challengeNonceStore): ChallengeNonceGeneratorBuilder
     {
         $this->challengeNonceStore = $challengeNonceStore;
         return $this;
     }
 
+    /**
+     * Sets the source of random bytes for the nonce.
+     *
+     * @param callable $secureRandom function which returns random bytes with number of bytes as input
+     *
+     * @return ChallengeNonceGeneratorBuilder builder instance
+     */
+    public function withSecureRandom(callable $secureRandom): ChallengeNonceGeneratorBuilder
+    {
+        $this->secureRandom = $secureRandom;
+        return $this;
+    }
+
     public function build(): ChallengeNonceGenerator
     {
         // Force to use PHP session based nounce store when store is not set
