forge-joniko/ldc-web
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update SAML login

Browse source
This commit is contained in:
Vincent BRIDIER 2022-09-19 13:20:19 +02:00
parent b4797d92fc
commit 746e502b49
No known key found for this signature in database
GPG key ID: 8571BFA20420D512
2 changed files with 39 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
app/Providers/EventServiceProvider.php
View file

@ -5,7 +5,6 @@ namespace App\Providers;
use Aacotroneo\Saml2\Events\Saml2LoginEvent;
use App\Models\User;
use Illuminate\Auth\Events\Registered;
use Illuminate\Auth\Listeners\SendEmailVerificationNotification;
use Illuminate\Foundation\Support\Providers\EventServiceProvider as ServiceProvider;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Event;
@ -20,7 +19,6 @@ class EventServiceProvider extends ServiceProvider
*/
protected $listen = [
Registered::class => [
SendEmailVerificationNotification::class,
],
];
@ -34,17 +32,53 @@ class EventServiceProvider extends ServiceProvider
parent::boot();
Event::listen('Aacotroneo\Saml2\Events\Saml2LoginEvent', function (Saml2LoginEvent $event) {
$messageId = $event->getSaml2Auth()->getLastMessageId();
// TODO: Add your own code preventing reuse of a $messageId to stop replay attacks.
if (class_exists('Memcached')) {
$cache = new \Memcached();
$cache->addServer(
config('cache.stores.memcached.servers.0.host'),
config('cache.stores.memcached.servers.0.port')
);
$fromCache = $cache->get(config('cache.prefix') . "_saml_message_id_" . $messageId);
if (!in_array($cache->getResultCode(), [\Memcached::RES_SUCCESS, \Memcached::RES_NOTFOUND])) {
throw new \Exception('SAML MESSAGE ID HANDLER - Memcached Error : ' . $cache->getResultCode() . " - https://www.php.net/manual/en/memcached.getresultcode.php");
}
if ($fromCache) {
logger()->error(
'SAML MESSAGE ID HANDLER',
[
'error' => 'Message ID : ' . $messageId . " replayed !"
]
);
abort(403);
} else {
// Cache for 8h.
$cache->set(config('cache.prefix') . "_saml_message_id_" . $messageId, $messageId, 28800);
if ($cache->getResultCode() === \Memcached::RES_NOTSTORED) {
throw new \Exception('SAML MESSAGE ID HANDLER - Memcached Error : NOT STORED');
}
}
} else {
throw new \Exception("SAML MESSAGE ID HANDLER - Memcached is missing");
} //end if
$user = $event->getSaml2User();
$email = $user->getNameId();
$lUser = User::where('email', '=', $email)->first();
if (!$lUser) {
abort(redirect()->route('unauthorized'));
}
session(['sessionIndex' => $user->getSessionIndex()]);
session(['nameId' => $email]);
session(['tmpUserOTP' => $lUser]);
abort(redirect()->route('auth.verify'));
});

2
resources/views/layouts/app.blade.php
View file

@ -66,7 +66,7 @@
<div class="dropdown-menu dropdown-menu-right" aria-labelledby="navbarDropdown">
<a class="dropdown-item" href="{{ route('otp-qr-code') }}">OTP QRCode</a>
<a class="dropdown-item" href="{{route('saml2_logout', 'ldc')}}?returnTo={{route('saml2_sls', 'ldc')}}&sessionIndex={{session()->get('sessionIndex')}}&nameId={{session()->get('nameId')}}">Déconnexion</a>
<a class="dropdown-item" href="{{route('saml2_logout', 'ldc')}}?returnTo={{route('saml2_sls', 'ldc')}}&sessionIndex={{session()->get('sessionIndex')}}&nameId={{auth()->user()->email}}">Déconnexion</a>
</div>
</li>
@endauth