").append(m.parseHTML(a)).find(d):a)}).complete(c&&function(a,b){g.each(c,e||[a.responseText,b,a])}),this},m.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(a,b){m.fn[b]=function(a){return this.on(b,a)}}),m.expr.filters.animated=function(a){return m.grep(m.timers,function(b){return a===b.elem}).length};var cc=a.document.documentElement;function dc(a){return m.isWindow(a)?a:9===a.nodeType?a.defaultView||a.parentWindow:!1}m.offset={setOffset:function(a,b,c){var d,e,f,g,h,i,j,k=m.css(a,"position"),l=m(a),n={};"static"===k&&(a.style.position="relative"),h=l.offset(),f=m.css(a,"top"),i=m.css(a,"left"),j=("absolute"===k||"fixed"===k)&&m.inArray("auto",[f,i])>-1,j?(d=l.position(),g=d.top,e=d.left):(g=parseFloat(f)||0,e=parseFloat(i)||0),m.isFunction(b)&&(b=b.call(a,c,h)),null!=b.top&&(n.top=b.top-h.top+g),null!=b.left&&(n.left=b.left-h.left+e),"using"in b?b.using.call(a,n):l.css(n)}},m.fn.extend({offset:function(a){if(arguments.length)return void 0===a?this:this.each(function(b){m.offset.setOffset(this,a,b)});var b,c,d={top:0,left:0},e=this[0],f=e&&e.ownerDocument;if(f)return b=f.documentElement,m.contains(b,e)?(typeof e.getBoundingClientRect!==K&&(d=e.getBoundingClientRect()),c=dc(f),{top:d.top+(c.pageYOffset||b.scrollTop)-(b.clientTop||0),left:d.left+(c.pageXOffset||b.scrollLeft)-(b.clientLeft||0)}):d},position:function(){if(this[0]){var a,b,c={top:0,left:0},d=this[0];return"fixed"===m.css(d,"position")?b=d.getBoundingClientRect():(a=this.offsetParent(),b=this.offset(),m.nodeName(a[0],"html")||(c=a.offset()),c.top+=m.css(a[0],"borderTopWidth",!0),c.left+=m.css(a[0],"borderLeftWidth",!0)),{top:b.top-c.top-m.css(d,"marginTop",!0),left:b.left-c.left-m.css(d,"marginLeft",!0)}}},offsetParent:function(){return this.map(function(){var a=this.offsetParent||cc;while(a&&!m.nodeName(a,"html")&&"static"===m.css(a,"position"))a=a.offsetParent;return a||cc})}}),m.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(a,b){var c=/Y/.test(b);m.fn[a]=function(d){return V(this,function(a,d,e){var f=dc(a);return void 0===e?f?b in f?f[b]:f.document.documentElement[d]:a[d]:void(f?f.scrollTo(c?m(f).scrollLeft():e,c?e:m(f).scrollTop()):a[d]=e)},a,d,arguments.length,null)}}),m.each(["top","left"],function(a,b){m.cssHooks[b]=La(k.pixelPosition,function(a,c){return c?(c=Ja(a,b),Ha.test(c)?m(a).position()[b]+"px":c):void 0})}),m.each({Height:"height",Width:"width"},function(a,b){m.each({padding:"inner"+a,content:b,"":"outer"+a},function(c,d){m.fn[d]=function(d,e){var f=arguments.length&&(c||"boolean"!=typeof d),g=c||(d===!0||e===!0?"margin":"border");return V(this,function(b,c,d){var e;return m.isWindow(b)?b.document.documentElement["client"+a]:9===b.nodeType?(e=b.documentElement,Math.max(b.body["scroll"+a],e["scroll"+a],b.body["offset"+a],e["offset"+a],e["client"+a])):void 0===d?m.css(b,c,g):m.style(b,c,d,g)},b,f?d:void 0,f,null)}})}),m.fn.size=function(){return this.length},m.fn.andSelf=m.fn.addBack,"function"==typeof define&&define.amd&&define("jquery",[],function(){return m});var ec=a.jQuery,fc=a.$;return m.noConflict=function(b){return a.$===m&&(a.$=fc),b&&a.jQuery===m&&(a.jQuery=ec),m},typeof b===K&&(a.jQuery=a.$=m),m});
diff --git a/www/saml/container.php b/www/saml/container.php
new file mode 100644
index 00000000..9e50e515
--- /dev/null
+++ b/www/saml/container.php
@@ -0,0 +1,54 @@
+logger = $logger;
+ }
+
+ /**
+ * @return LoggerInterface
+ */
+ public function getLogger()
+ {
+ return $this->logger;
+ }
+
+ /**
+ * Generate a random identifier for identifying SAML2 documents.
+ */
+ public function generateId()
+ {
+ return '_' . base64_encode(openssl_random_pseudo_bytes(30));
+ }
+
+ public function debugMessage($message, $type)
+ {
+ $this->logger->debug($message, ['type' => $type]);
+ }
+
+ public function redirect($url, $data = array())
+ {
+ // dummy method
+ throw new Exception("unexpected invocation of Saml2Container::redirect method");
+ }
+
+ /**
+ * @param string $url
+ * @param array $data
+ */
+ public function postRedirect($url, $data = array())
+ {
+ throw Exception("unexpected invocation of Saml2Container::postRedirect method");
+ }
+}
diff --git a/www/saml/index.php b/www/saml/index.php
index 14964131..c80951dd 100644
--- a/www/saml/index.php
+++ b/www/saml/index.php
@@ -3,32 +3,55 @@
include_once './../../config.php';
include_once './../../options.php';
-require_once 'saml.php';
+require_once 'container.php';
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
-
-function newid($length = 42) {
+function newID($length = 42) {
$id = '_';
for ($i = 0; $i < $length; $i++ ) $id .= dechex( rand(0,15) );
return $id;
}
+function sign($response, $keyfile, $certfile)
+{
+ $document = new DOMDocument();
+ $previous = libxml_disable_entity_loader(true);
+ $document->loadXML($response);
+ libxml_disable_entity_loader($previous);
+ $xml = $document->firstChild;
+ $r = SAML2_Message::fromXML($xml);
+ $algo = XMLSecurityKey::RSA_SHA256;
+ $privateKey = new XMLSecurityKey($algo, array('type' => 'private'));
+ $privateKey->loadKey($keyfile, true);
+ $r->setSignatureKey($privateKey);
+ $cert = file_get_contents($certfile);
+ $r->setCertificates(array($cert));
+ return $r->toSignedXML()->ownerDocument->saveXML();
+}
+
+// TODO: move
date_default_timezone_set('Europe/Amsterdam');
$app = new Silex\Application();
-$app['debug'] = true;
+$app['debug'] = $options['debug'];
-$app->register(new Silex\Provider\SessionServiceProvider());
+$app->register(new Silex\Provider\SessionServiceProvider(), array(
+ 'session.storage.options' => array(
+ 'cookie_secure' => isset($_SERVER['HTTPS']),
+ 'cookie_httponly' => true,
+ ),
+));
$app->register(new Silex\Provider\TwigServiceProvider(), array(
'twig.path' => __DIR__.'/views',
));
$app->register(new Silex\Provider\MonologServiceProvider(), array(
- 'monolog.logfile' => __DIR__.'/../../saml.log',
- ));
+ 'monolog.handler' => $options['loghandler'],
+ 'monolog.name' => 'saml',
+));
########## SAML ##########
@@ -37,8 +60,9 @@ function newid($length = 42) {
return "This is a SAML endpoint
See also the SAML 2.0
Metadata ";
});
-# SAML 2.0 Metadata
-
+/*
+ * SAML 2.0 IDP Metadata
+ */
$app->get('/metadata', function (Request $request) use ($app, $config) {
$loader = new Twig_Loader_Filesystem('views');
$twig = new Twig_Environment($loader, array(
@@ -55,170 +79,152 @@ function newid($length = 42) {
return $response;
});
-# send SAML request (SP initiated SAML Web SSO) - builtin SP for testing purposes
-
-$app->get('/login/{nameid}', function (Request $request, $nameid) use ($config, $app) {
- $base = $request->getUriForPath('/');
- # remote IDP
- $sso_url = $base . "sso"; // default
+/*
+ * IDP: receive SAML request
+ * Not a compliant SAML implementation: designed to work with stepup-gateway
+ */
+$app->get('/sso', function (Request $request) use ($config, $app) {
- $loader = new Twig_Loader_Filesystem('views');
- $twig = new Twig_Environment($loader, array(
- 'debug' => true,
+ SAML2_Compat_ContainerSingleton::setContainer(new Saml2Container(
+ $app['monolog']
));
- $request = $twig->render('AuthnRequest.xml', array(
- 'ID' => newid(),
- 'Issuer' => $base . 'metadata', // convention
- 'IssueInstant' => gmdate("Y-m-d\TH:i:s\Z", time()),
- 'Destination' => $sso_url,
- 'AssertionConsumerServiceURL' => $base . 'acs',
- 'NameID' => $nameid,
- ));
- # use HTTP-Redirect binding
- $query = 'SAMLRequest=' . urlencode(base64_encode(gzdeflate($request)));
- $query .= "&RelayState=$base"."session";
- $key = $config['keyfile']; // reuse key
- $location = $sso_url . '?' . saml20_sign_query($query, $key);
- return $app->redirect($location);
-})->value('nameid', ''); // default nameid is empty, i.e. do not send a NameID in the request
+ // make sure external entities are disabled
+ $previous = libxml_disable_entity_loader(true);
+ // Make sure we're dealing with an AuthN request
+ $binding = SAML2_Binding::getCurrentBinding();
+ $samlrequest = $binding->receive();
+ libxml_disable_entity_loader($previous);
-# receive SAML request (IDP)
+ if (!($samlrequest instanceof SAML2_AuthnRequest)) {
+ throw new Exception('Message received on authentication request endpoint wasn\'t an authentication request.');
+ }
-$app->get('/sso', function (Request $request) use ($config, $app) {
+ $request_data = array(
+ 'relaystate' => $samlrequest->getRelayState(),
+ );
- $relayState = $request->get('RelayState');
- $app['session']->set('RelayState', $relayState);
-
- # TODO: check request contents, etc
- $samlrequest = $request->get('SAMLRequest');
- $samlrequest = gzinflate(base64_decode($samlrequest));
- $dom = new DOMDocument();
- $dom->loadXML($samlrequest);
-
- if ($dom->getElementsByTagName('AuthnRequest')->length === 0) {
- throw new Exception('Unknown request on saml20 endpoint!');
- }
-
- $requestor = $dom->getElementsByTagName('Issuer')->item(0)->textContent;
- $app['monolog']->addInfo(sprintf("Requestor is '%s' .", $requestor));
-
- $md = $config['sp'][$requestor];
- if( !$md )
- throw new Exception("Unknown SP with entityID $requestor");
-
- // verify signature
- if( ($md['certfile']))
- saml20_verify_request($_SERVER['QUERY_STRING'], $config['certfile']); // use raw QS instead of normalized version!
-
- $xpath = new DOMXPath($dom);
- $xpath->registerNamespace('samlp', "urn:oasis:names:tc:SAML:2.0:protocol" );
- $xpath->registerNamespace('saml', "urn:oasis:names:tc:SAML:2.0:assertion" );
- $query = "string(//saml:Subject/saml:NameID)";
- $nameid = $xpath->evaluate($query, $dom);
- $app['session']->set('RequestedSubject', $nameid);
-
- $authnrequest = $dom->getElementsByTagName('AuthnRequest')->item(0);
- $sprequestid = $authnrequest->getAttribute('ID');
- $app['session']->set('Requestor', $requestor);
- $app['session']->set('RequestID', $sprequestid);
- $url = $request->getUriForPath('/') . 'sso_return';
- if( $nameid ) { // login
- return $app->redirect("/tiqr/login?return=$url");
- } else {
- return $app->redirect("/tiqr/enrol?return=$url");
+ // Check for known issuer
+ $issuer = $samlrequest->getIssuer();
+ if ($issuer === NULL) {
+ throw new Exception('Received message on authentication request endpoint without issuer.');
+ }
+ if( !array_key_exists( $issuer, $config['sp']) ) {
+ throw new Exception("Unknown SP with entityID '$issuer'");
+ }
+ $md = $config['sp'][$issuer];
+ $app['monolog']->addInfo(sprintf("Issuer is '%s' .", $issuer));
+ $request_data['issuer'] = $issuer;
+
+ // verify signature
+ if( file_exists($md['certfile']))
+ {
+ if( $request->get('Signature') == null) {
+ throw new Exception("SAML Authnrequest must be signed");
}
-// return $app->redirect("/authn/login?return=$url");
+ $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'public'));
+ $key->loadKey($md['certfile'], true, true);
+ $res = $samlrequest->validate($key);
+ if(!$res)
+ throw new Exception( "invalid signature" );
+ } else {
+ throw new Exception("Cannot load certificate from file " . $md['certfile']);
+ }
+
+ $nameid = $samlrequest->getNameId();
+ $request_data['nameid'] = $nameid['Value'];
+
+ $request_data['id'] = $samlrequest->getId();
+
+ // save state for later when generating a response
+ $app['session']->set('Request', $request_data );
+
+ $url = $request->getUriForPath('/') . 'sso_return';
+// return $app->redirect("/authn/login?return=$url");
+ if( $nameid ) { // login
+ return $app->redirect("/tiqr/login?return=$url");
+ } else {
+ return $app->redirect("/tiqr/enrol?return=$url");
+ }
});
+/*
+ * IDP: Finish SSO
+ * Assumes saved request is validated
+ */
+
$app->get('/sso_return', function (Request $request) use ($config, $app) {
- $relayState = $app['session']->get('RelayState');
- $authn = $app['session']->get('authn');
- $username = $authn['username'];
- $app['session']->set('authn', null);
- $expected = $app['session']->get('RequestedSubject');
- if( $expected and $username != $app['session']->get('RequestedSubject') ) {
- throw new Exception("Authentication requested for '$expected', but authenticated user is '$username'.");
- }
+ SAML2_Compat_ContainerSingleton::setContainer(new Saml2Container(
+ $app['monolog']
+ ));
- $app['session']->set('RequestedSubject', null);
+ $request_data = $app['session']->get('Request');
+
+ $rsp_params = array(
+ 'ResponseID' => newID(),
+ 'AssertionID' => newID(),
+ 'IssueInstant' => gmdate("Y-m-d\TH:i:s\Z", time() ),
+ 'NotBefore' => gmdate("Y-m-d\TH:i:s\Z", time() - 30),
+ 'NotOnOrAfter' => gmdate("Y-m-d\TH:i:s\Z", time() + 60 * 5),
+ );
+
+ // determine ACS URL from requestor
+ $requestor = $request_data['issuer'];
+ $app['monolog']->addInfo(sprintf("Requestor was '%s' .", $requestor));
+ $rsp_params['Audience'] = $requestor;
+
+ $acs_url = $config['sp'][$requestor]['acs'];
+ $app['monolog']->addInfo(sprintf("ACS URL is '%s' .", $acs_url));
+ $rsp_params['Destination'] = $acs_url;
+
+ // check username of authenticated user
+ $authn = $app['session']->get('authn');
+ $username = $authn['username'];
+ $nameid = $request_data['nameid'];
+ if( $nameid and $username != $nameid ) {
+ throw new Exception("Authentication requested for '$nameid', but authenticated user is '$username'.");
+ }
+ $rsp_params['NameID'] = $username;
- $attrnameformat = NULL;
- # assume solicited responses
- $requestor = $app['session']->get('Requestor');
- $inResponseTo = htmlspecialchars( $app['session']->get('RequestID') );
- $app['session']->set('Requestor', null);
- $app['session']->set('RequestID', null);
+ # assume solicited responses
+ $inResponseTo = htmlspecialchars( $request_data['id'] );
+ $rsp_params['InResponseTo'] = $inResponseTo;
- $base = $request->getUriForPath('/');
- $issuer = $base . 'metadata'; // convention
- $app['monolog']->addInfo(sprintf("Requestor was '%s' .", $requestor));
- if( !array_key_exists( $requestor, $config['sp']) ) {
- throw new Exception("Unknown SP with entityID '$requestor'");
- }
- $acs_url = $config['sp'][$requestor]['acs'];
- $app['monolog']->addInfo(sprintf("ACS URL is '%s' .", $acs_url));
-
- $loader = new Twig_Loader_Filesystem('views');
- $twig = new Twig_Environment($loader, array(
- 'debug' => true,
- ));
- $response = $twig->render('Response.xml', array(
- 'ResponseID' => newID(),
- 'AssertionID' => newID(),
- 'Audience' => $requestor,
- 'Destination' => $acs_url,
- 'InResponseTo' => $inResponseTo,
- 'Issuer' => $issuer,
- 'IssueInstant' => gmdate("Y-m-d\TH:i:s\Z", time() ),
- 'NotBefore' => gmdate("Y-m-d\TH:i:s\Z", time() - 30),
- 'NotOnOrAfter' => gmdate("Y-m-d\TH:i:s\Z", time() + 60 * 5),
- 'NameID' => $username,
- ));
-
- # sign
- $dom = new DOMDocument();
- $dom->preserveWhiteSpace = FALSE;
- $dom->loadXML($response);
- $dom->formatOutput = TRUE;
- // sign the assertion
- // do not add certificate
- $dom = utils_xml_sign($dom, $config['keyfile'], $config['certfile']);
- $response = $dom->saveXML();
-
- # use POST binding
- $params = array(
- 'Destination' => $acs_url,
- 'SAMLResponse' => base64_encode($response),
- );
- if ($relayState !== NULL) {
- $params['RelayState'] = $relayState;
- }
- $app['session']->set('RelayState', null);
- $app['session']->set('authn', null); // disable SSO TODO re-enable
+ $base = $request->getUriForPath('/');
+ $issuer = $base . 'metadata'; // by convention
+ $rsp_params['Issuer'] = $issuer;
- return $twig->render('autosubmit.html', $params);
+ // render SAML response message
+ $loader = new Twig_Loader_Filesystem('views');
+ $twig = new Twig_Environment($loader);
+ $response = $twig->render('Response.xml', $rsp_params);
- });
+// # sign
-# receive SAML response (SP)
-
-$app->post('/acs', function (Request $request) use ($app) {
- # TODO: check signature, response, etc
- $response = $request->get('SAMLResponse');
- $response = base64_decode($response);
- $dom = new DOMDocument();
- $dom->loadXML($response);
- $xpath = new DOMXPath($dom);
- $xpath->registerNamespace('saml', "urn:oasis:names:tc:SAML:2.0:assertion" );
- $query = "string(//saml:Assertion[1]/saml:Subject/saml:NameID)";
- $nameid = $xpath->evaluate($query, $dom);
- if (!$nameid) {
- throw new Exception('Could not locate nameid element.');
+ if( !file_exists( $config['keyfile']) ) {
+ $app['monolog']->addWarning(sprintf("Cannot read key from file '%s' - sending Response unsigned", $config['keyfile']));
+ } else {
+ $response = sign($response, $config['keyfile'], $config['certfile']);
}
- $location = $request->getUriForPath('/') . 'login/' . $nameid;
- return "
$nameid ";
+
+ # use POST binding
+ $params = array(
+ 'Destination' => $acs_url,
+ 'SAMLResponse' => base64_encode($response),
+ );
+
+ // restore relayState
+ $relayState = $request_data['relaystate'];
+ if ($relayState !== NULL) {
+ $params['RelayState'] = $relayState;
+ }
+
+ $app['session']->set('authn', null); // no SSO
+ $app['session']->set('Request', null);
+
+ return $twig->render('autosubmit.html', $params);
+
});
$app->run();
\ No newline at end of file
diff --git a/www/saml/saml.php b/www/saml/saml.php
deleted file mode 100644
index 0143dc18..00000000
--- a/www/saml/saml.php
+++ /dev/null
@@ -1,139 +0,0 @@
-preserveWhiteSpace = $preserveWhiteSpace;
- $dom->loadXML($xml);
- $dom->formatOutput = TRUE;
- return $dom;
-}
-
-function utils_xml_sign($dom, $keyfile, $certfile) {
- // remove whitespace without breaking signature
- $dom = utils_xml_create($dom->saveXML(), TRUE);
- $dsig = new XMLSecurityDSig();
- $dsig->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);
- $root = $dom->getElementsByTagName('Assertion')->item(0);
- assert('$root instanceof DOMElement');
- $insert_into = $dom->getElementsByTagName('Assertion')->item(0);
- $insert_before = $insert_into->getElementsByTagName('Subject')->item(0);
- $dsig->addReferenceList(array($root), XMLSecurityDSig::SHA1,
- array('http://www.w3.org/2000/09/xmldsig#enveloped-signature', XMLSecurityDSig::EXC_C14N),
- array('id_name' => 'ID'));
- $objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'private'));
- $objKey->loadKey($keyfile, TRUE);
- $dsig->sign($objKey);
- $cert = $certfile;
- $contents = file_get_contents($cert);
- $dsig->add509Cert($contents, TRUE);
- $dsig->insertSignature($insert_into, $insert_before);
- return $dom;
-}
-
-function utils_xml_sign_generic($dom, $key, $id_name, $root_name, $insert_into_name = NULL, $insert_before_name = NULL, $cert = NULL) {
- // remove whitespace without breaking signature
- $dom = utils_xml_create($dom->saveXML(), TRUE);
- $dsig = new XMLSecurityDSig();
- $dsig->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);
- $root = $dom->getElementsByTagName($root_name)->item(0);
- assert('$root instanceof DOMElement');
- $insert_into = isset($insert_into_name) ? $dom->getElementsByTagName($insert_into_name)->item(0) : NULL;
- if (isset($insert_into)) {
- assert('$insert_into instanceof DOMElement');
- $insert_before = isset($insert_before_name) ? $insert_into->getElementsByTagName($insert_before_name)->item(0) : $insert_into->firstChild;
- } else {
- $insert_into = $root;
- $insert_before = NULL;
- }
- $dsig->addReferenceList(array($root), XMLSecurityDSig::SHA1,
- array('http://www.w3.org/2000/09/xmldsig#enveloped-signature', XMLSecurityDSig::EXC_C14N),
- array('id_name' => $id_name));
- $objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'private'));
- $objKey->loadKey($key, TRUE);
- $dsig->sign($objKey);
- if (isset($cert)) {
- if (is_array($cert)) $cert = $cert[0];
- $contents = file_get_contents($cert);
- if ($contents === FALSE) {
- throw new Exception('Could not read certificate file: ' . $cert);
- }
- $dsig->add509Cert($contents, TRUE);
- }
- $dsig->insertSignature($insert_into, $insert_before);
- return $dom;
-}
-
-function saml20_sign_query($query, $key) {
- $algURI = XMLSecurityKey::RSA_SHA256;
- $query = $query . "&" . "SigAlg=" . urlencode($algURI);
- $xmlseckey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'private'));
- $xmlseckey->loadKey($key, TRUE);
- $signature = $xmlseckey->signData($query);
- $query = $query . "&" . "Signature=" . urlencode(base64_encode($signature));
- return $query;
-}
-
-/**
- * Verify a SAML 2.0 redirect request (authn, logout) by checking the optional signature.
- *
- * @param string querystring the query string containing all relevant signing parameters
- * @param string $cert the filename of the certificate with the public key used for verifying the signature
- */
-function saml20_verify_request($querystring, $certs) {
- $relayState = ''; $sigAlg = ''; $signedQuery = ''; $signature = ''; $sigQuery = ''; $algorithm = NULL;
-
- foreach (explode('&', $querystring) as $e) {
- list($name, $value) = explode('=', $e, 2);
- switch ($name) {
- case 'SAMLRequest':
- case 'SAMLResponse':
- $sigQuery = $name . '=' . $value;
- break;
- case 'Signature':
- $signature = base64_decode(urldecode($value));
- break;
- case 'RelayState':
- $relayState = '&RelayState=' . $value;
- break;
- case 'SigAlg':
- $algorithm = urldecode($value);
- $sigAlg = '&SigAlg=' . $value;
- break;
- }
- }
-
- if ($algorithm == NULL ) {
- throw new Exception('Request should be signed but no signature was found!');
- }
-
- $signedQuery = $sigQuery . $relayState . $sigAlg;
-
- if (!is_array($certs)) $certs = array($certs);
- $result = FALSE;
- foreach ($certs as $cert) {
- if (!file_exists($cert)) {
- throw new Exception('Could not find verification certificate file: ' . $cert);
- }
-
- $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'public'));
- $key->loadKey($cert, TRUE, TRUE);
-
- switch ($algorithm) {
- case XMLSecurityKey::RSA_SHA256:
- if ($key->type !== XMLSecurityKey::RSA_SHA1) {
- throw new Exception('Invalid key type for validating signature on query string.');
- }
- $result = ($key->verifySignature($signedQuery, $signature) == 1);
- break;
- default:
- throw new Exception('Unknown signature algorithm: ' . var_export($algorithm, TRUE));
- }
-
- if ($result === TRUE) break;
- }
- if ($result === FALSE) {
- throw new Exception('Unable to validate Signature on query string.');
- }
-}
\ No newline at end of file
diff --git a/www/saml/views/post.html b/www/saml/views/post.html
new file mode 100644
index 00000000..60678e7e
--- /dev/null
+++ b/www/saml/views/post.html
@@ -0,0 +1,15 @@
+
+
+
+
\ No newline at end of file
diff --git a/www/sp/container.php b/www/sp/container.php
new file mode 100644
index 00000000..9e50e515
--- /dev/null
+++ b/www/sp/container.php
@@ -0,0 +1,54 @@
+logger = $logger;
+ }
+
+ /**
+ * @return LoggerInterface
+ */
+ public function getLogger()
+ {
+ return $this->logger;
+ }
+
+ /**
+ * Generate a random identifier for identifying SAML2 documents.
+ */
+ public function generateId()
+ {
+ return '_' . base64_encode(openssl_random_pseudo_bytes(30));
+ }
+
+ public function debugMessage($message, $type)
+ {
+ $this->logger->debug($message, ['type' => $type]);
+ }
+
+ public function redirect($url, $data = array())
+ {
+ // dummy method
+ throw new Exception("unexpected invocation of Saml2Container::redirect method");
+ }
+
+ /**
+ * @param string $url
+ * @param array $data
+ */
+ public function postRedirect($url, $data = array())
+ {
+ throw Exception("unexpected invocation of Saml2Container::postRedirect method");
+ }
+}
diff --git a/www/sp/index.php b/www/sp/index.php
new file mode 100644
index 00000000..62e3723f
--- /dev/null
+++ b/www/sp/index.php
@@ -0,0 +1,85 @@
+register(new Silex\Provider\SessionServiceProvider());
+
+$app->register(new Silex\Provider\MonologServiceProvider(), array(
+ 'monolog.handler' => new Monolog\Handler\SyslogHandler('stepup-tiqr'),
+ 'monolog.name' => 'saml-sp',
+));
+
+########## SAML ##########
+
+$app->get('/', function (Request $request) use ($app) {
+ $url = $request->getUriForPath('/') . 'metadata';
+ return "This is a SAML endpoint
Testing only! ";
+ });
+
+/*
+ * SP: Generate SAML AuthnRequest (for testing purposes)
+ */
+$app->get('/login/{nameid}', function (Request $request, $nameid) use ($config, $app)
+{
+ SAML2_Compat_ContainerSingleton::setContainer(new Saml2Container(
+ $app['monolog']
+ ));
+ $base = $request->getUriForPath('/');
+ $saml_request = new SAML2_AuthnRequest();
+ $saml_request->setIssuer($base . 'metadata');
+ $saml_request->setDestination($base . "../saml/sso");
+ $saml_request->setAssertionConsumerServiceURL($base . 'acs');
+ $saml_request->setRelayState($base . "session");
+ if( $nameid )
+ $saml_request->setNameId(array('Value' => $nameid, 'Format' => SAML2_Const::NAMEID_UNSPECIFIED));
+ // Sign request
+ $keyfile = $config['keyfile']; // reuse key
+ if( !file_exists($keyfile) ) {
+ $app['monolog']->addWarning("Cannot read key from file $keyfile - sending unsigned SAML AuthnRequest");
+ } else {
+ $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, ['type' => 'private']);
+ $key->loadKey($keyfile, true);
+ $saml_request->setSignatureKey($key);
+ }
+ // Use Redirect binding regardless of what the SP asked for
+ $binding = new SAML2_HTTPRedirect();
+ $destination = $binding->getRedirectURL($saml_request);
+ $app['monolog']->addDebug('Redirect to ' . $destination);
+ return $app->redirect($destination);
+})->value('nameid', ''); // default nameid is empty, i.e. do not send a NameID in the request
+
+
+/*
+ * SP: receive SAML response
+ */
+
+$app->post('/acs', function (Request $request) use ($app) {
+ # TODO: check signature, response, etc
+ $response = $request->get('SAMLResponse');
+ $response = base64_decode($response);
+ $dom = new DOMDocument();
+ $dom->loadXML($response);
+ $xpath = new DOMXPath($dom);
+ $xpath->registerNamespace('saml', "urn:oasis:names:tc:SAML:2.0:assertion" );
+ $query = "string(//saml:Assertion[1]/saml:Subject/saml:NameID)";
+ $nameid = $xpath->evaluate($query, $dom);
+ if (!$nameid) {
+ throw new Exception('Could not locate nameid element.');
+ }
+ $location = $request->getUriForPath('/') . 'login/' . $nameid;
+ return "
$nameid ";
+});
+
+$app->run();
\ No newline at end of file
diff --git a/www/tiqr/index.php b/www/tiqr/index.php
index a82c71d2..3f73a270 100644
--- a/www/tiqr/index.php
+++ b/www/tiqr/index.php
@@ -4,119 +4,133 @@
include('../../options.php');
+# todo i18n options data (eg SP displayname)
+
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
-
-// use Symfony\Component\Translation\Loader\YamlFileLoader;
+use Symfony\Component\Translation\Loader\YamlFileLoader;
date_default_timezone_set('Europe/Amsterdam');
$app = new Silex\Application();
-$app['debug'] = true;
-$app->register(new Silex\Provider\SessionServiceProvider());
+$app['debug'] = $options['debug'];
+
+$app->register(new Silex\Provider\SessionServiceProvider(), array(
+ 'session.storage.options' => array(
+ 'cookie_secure' => isset($_SERVER['HTTPS']),
+ 'cookie_httponly' => true,
+ ),
+));
+
$app->register(new Silex\Provider\TwigServiceProvider(), array(
'twig.path' => __DIR__.'/views',
));
+
$app->register(new Silex\Provider\MonologServiceProvider(), array(
- 'monolog.logfile' => __DIR__.'/../../authn.log',
- ));
+ 'monolog.handler' => $options['loghandler'],
+ 'monolog.name' => 'authn',
+));
+
+// Set locale
+if (!$locale = $app['session']->get('locale')) $locale = $options['default_locale'];
$app->register(new Silex\Provider\TranslationServiceProvider(), array(
'locale_fallbacks' => array('nl'),
+ 'locale' => $locale,
));
-$app['translator.domains'] = array(
- 'messages' => array(
- 'en' => array(
- 'enrol' => 'New Account',
- 'idle' => 'Timeout',
- 'timeout_alert' => "Timeout. Please try again by refreshing this page.",
- 'initialized' => "Scan the code with the tiqr app on your phone to create a tiqr account.",
- 'retrieved' => "Acticate your account on your phone.",
- 'processed' => "",
- 'finalized' => "Your account is ready for use.",
-
- 'hello' => 'Hello %name%',
- 'goodbye' => 'Goodbye %name%',
- 'enrol' => 'Enrol',
- 'timeout' => 'Timeout. Please try again by refreshing this page',
+$app['translator']->addLoader('yaml', new YamlFileLoader());
+$app['translator']->addResource('yaml', __DIR__.'/locales/en.yml', 'en');
+$app['translator']->addResource('yaml', __DIR__.'/locales/nl.yml', 'nl');
- ),
- 'nl' => array(
- 'enrol' => 'Nieuw Account',
- 'idle' => 'Timeout',
- 'timeout_alert' => "Timeout. Probeer nogmaals door deze pagina te verversen.",
- 'initialized' => "Scan de code met de tiqr app op uw telefoon om een tiqr account aan te maken.",
- 'retrieved' => "Activeer uw account op uw telefoon.",
- 'processed' => "",
- 'finalized' => "Uw account is gereed voor gebruik.",
- 'hello' => 'Hallo %name%',
- 'goodbye' => 'Dag %name%',
- 'enrol' => 'Aanmaken',
- 'timeout' => 'Timeout. Probeer nogmaals door deze pagina te verversen.',
- ),
- ),
- 'validators' => array(
- 'nl' => array(
- 'This value should be a valid number.' => 'Deze waarde moet numeriek zijn.',
- ),
- ),
-);
-
-$app->before(function ($request) {
+$app->before(function (Request $request) {
$request->getSession()->start();
});
$tiqr = new Tiqr_Service($options);
-$app->get('/login', function (Request $request) use ($app, $tiqr, $options) {
- $base = $request->getUriForPath('/');
- if( null === $return = $request->get('return') ) {
- $return = $base;
- }
- $sid = $app['session']->getId();
- $userdata = $tiqr->getAuthenticatedUser($sid);
- $app['monolog']->addInfo(sprintf("[%s] userdata '%s'", $sid, $userdata));
- if( !is_null($userdata) ) {
- $app['session']->set('authn', array('username' => $userdata));
- return $app->redirect($return);
- }
- $id = $app['session']->get('RequestedSubject');
- if( $id === '' ) $id = null;
+### tiqr Authentication ###
+$app->get('/login', function (Request $request) use ($app, $tiqr, $options) {
+ $locale = $app['translator']->getLocale();
+ $locales = array_keys($options['translation']);
+ $here = urlencode($app['request']->getUri()); // Is this allways correct?
+
+ $sid = $app['session']->getId();
+
+ $base = $request->getUriForPath('/');
+ $return = stripslashes(filter_var($request->get('return'),FILTER_VALIDATE_URL));
+ if( $return == false ) {
+ $return = $base;
+ }
+ if(strpos($return, $request->getSchemeAndHttpHost() . '/') !== 0) {
+ $app['monolog']->addInfo(sprintf("[%s] illegal return URL '%s'", $sid, $return));
+ $return = $base;
+ }
+
+ $userdata = $tiqr->getAuthenticatedUser($sid);
+ $app['monolog']->addInfo(sprintf("[%s] userdata '%s'", $sid, $userdata));
+ if (!is_null($userdata)) {
+ $app['session']->set('authn', array('username' => $userdata)); // logged in!
+ return $app->redirect($return);
+ }
+
+ // not logged in...
+ $request_data = $app['session']->get('Request');
+ $id = $request_data['nameid']; // do we need to log in some specific user?
+ if ($id === '') $id = null;
+
+ if (!$app['session']->get('keepSessionKey') || !$sessionKey = $app['session']->get('sessionKey')) {
$sessionKey = $tiqr->startAuthenticationSession($id,$sid); // prepares the tiqr library for authentication
- $app['monolog']->addInfo(sprintf("[%s] started new login session, session key = '%s", $sid, $sessionKey));
-
- $userStorage = Tiqr_UserStorage::getStorage($options['userstorage']['type'], $options['userstorage']);
- if( $id ) {
- $notificationType = $userStorage->getNotificationType($id);
- $notificationAddress = $userStorage->getNotificationAddress($id);
- error_log("type [$notificationType], address [$notificationAddress]");
- $translatedAddress = $tiqr->translateNotificationAddress($notificationType, $notificationAddress);
- error_log("translated address [$translatedAddress]");
- $msg = "A push notification was sent to your phone";
- if ($translatedAddress) {
- $tiqr->sendAuthNotification($sessionKey, $notificationType, $translatedAddress);
+ $app['session']->set('sessionKey', $sessionKey);
+ }
+ $app['monolog']->addInfo(sprintf("[%s] started new login session, session key = '%s", $sid, $sessionKey));
+
+ $authUrl = $tiqr->generateAuthURL($sessionKey);
+// $authUrl = $tiqr->generateAuthURL($sessionKey).'?return='.urlencode($return);
+
+ return $app['twig']->render('index.html', array(
+ 'self' => $base,
+ 'return_url' => $return,
+ 'id' => $id,
+ 'authUrl' => $authUrl,
+ 'sessionKey' => $sessionKey,
+ 'here' => $here,
+ 'locale' => $locale,
+ 'locales' => $locales,
+ ));
+});
+
+$app->get('/qr', function (Request $request) use ($app, $tiqr, $options) {
+
+ $sid = $app['session']->getId();
+
+ $request_data = $app['session']->get('Request');
+ $id = $request_data['nameid']; // do we need to log in some specific user?
+ if ($id === '') $id = null;
+
+ $sessionKey = $app['session']->get('sessionKey');
+ $app['monolog']->addInfo(sprintf("[%s] picked-up login session, session key = '%s'", $sid, $sessionKey));
+
+ $userStorage = Tiqr_UserStorage::getStorage($options['userstorage']['type'], $options['userstorage']);
+ if( $id ) {
+ $notificationType = $userStorage->getNotificationType($id);
+ $notificationAddress = $userStorage->getNotificationAddress($id);
+ $app['monolog']->addInfo(sprintf("client has notification type [%s], address [%s]", $notificationType, $notificationAddress));
+ $translatedAddress = $tiqr->translateNotificationAddress($notificationType, $notificationAddress);
+ $app['monolog']->addInfo(sprintf("client translated address is [%s]", $translatedAddress));
+ if ($translatedAddress) {
+ $result = $tiqr->sendAuthNotification($sessionKey, $notificationType, $translatedAddress);
+ if( $result ) {
+ $app['monolog']->addInfo(sprintf("sent push notification to [%s]", $translatedAddress));
} else {
- $msg = "No $notificationType translated address available for [$notificationAddress]" ;
+ $app['monolog']->addWarning(sprintf("Failure sending push notification to [%s]", $translatedAddress));
}
+ } else {
+ $app['monolog']->addWarning(sprintf("No %s translated address available for [%s]", $notificationType, $notificationAddress));
}
-
- $url = $tiqr->generateAuthURL($sessionKey);
- error_log($url);
- $qr = "https://chart.googleapis.com/chart?chs=300x300&cht=qr&chl=" . $url;
- $loader = new Twig_Loader_Filesystem('views');
- $twig = new Twig_Environment($loader, array(
- 'debug' => true,
- ));
- $login = $twig->render('index.html', array(
- 'qr' => $qr,
- 'self' => $base,
- 'return_url' => $return,
- 'id' => $id,
-// 'msg' => $msg,
- ));
- $response = new Response($login);
- return $response;
+ }
+ $tiqr->generateAuthQR($sessionKey);
+ return "";
});
$app->get('/verify', function (Request $request) use ($app, $tiqr) {
@@ -124,6 +138,7 @@
$userdata = $tiqr->getAuthenticatedUser($sid);
if( isset($userdata) ) {
$app['session']->set('authn', array('username' => $userdata));
+ $app['session']->remove('sessionKey');
$tiqr->logout($sid);
$app['monolog']->addInfo(sprintf("[%s] verified authenticated user '%s'", $sid, $userdata));
}
@@ -144,13 +159,6 @@
}
});
-/*
-// simple test for translations:
-$app->get('/x/{name}', function ($name) use ($app) {
- return $app['translator']->trans('enrol', array('%name%' => $name),'messages','nl');
- });
-*/
-
$app->get('/logout', function (Request $request) use ($app, $tiqr) {
$sid = $app['session']->getId();
$tiqr->logout($sid);
@@ -158,57 +166,83 @@
return "You are logged out";
});
-##########
+### tiqr Enrolment ###
+
+$app->get('/enrol', function (Request $request) use ($app, $tiqr, $options) {
+ $locale = $app['translator']->getLocale();
+ $locales = array_keys($options['translation']);
+ $here = urlencode($app['request']->getUri()); // Is this allways correct?
+
+ $base = $request->getUriForPath('/');
+ $return = stripslashes(filter_var($request->get('return'),FILTER_VALIDATE_URL));
+ if( $return == false ) {
+ $return = $base;
+ }
+ if(strpos($return, $request->getSchemeAndHttpHost() . '/') !== 0) {
+ $app['monolog']->addInfo(sprintf("illegal return URL '%s'", $return));
+ $return = $base;
+ }
+
+ return $app['twig']->render('enrol.html', array(
+ 'self' => $base,
+ 'return_url' => $return,
+ 'here' => $here,
+ 'locale' => $locale,
+ 'locales' => $locales,
+ ));
+});
-$app->get('/enrol', function (Request $request) use ($app, $tiqr) {
- $base = $request->getUriForPath('/');
- if( null === $return = $request->get('return') ) {
- $return = $base;
- }
- // starting a new enrollment session
- $sid = $app['session']->getId();
- $uid = generate_id(); // TODO uniqueness
- $app['session']->set('authn', array('username' => $uid)); // TODO check
- $displayName = "Stepup User"; # TODO
- $app['monolog']->addInfo(sprintf("[%s] enrol uid '%s' (%s).", $sid, $uid, $displayName));
- $key = $tiqr->startEnrollmentSession($uid, $displayName, $sid);
- $app['monolog']->addInfo(sprintf("[%s] start enrol uid '%s' with session key '%s'.", $sid, $uid, $key));
-// $metadataURL = base() . "/tiqr/tiqr.php?key=$key"; # TODO
- $metadataURL = $base . "/tiqr.php?key=$key"; # TODO
- $app['monolog']->addInfo(sprintf("[%s] metadata URL for uid '%s' is '%s'.", $sid, $uid, $metadataURL));
- $url = $tiqr->generateEnrollString($metadataURL);
- # TODO: use js qr lib
- $qr = "https://chart.googleapis.com/chart?chs=300x300&cht=qr&chl=" . $url;
-
- $loader = new Twig_Loader_Filesystem('views');
- $twig = new Twig_Environment($loader, array(
- 'debug' => true,
- ));
- $enrol = $twig->render('enrol.html', array(
- 'self' => $base,
- 'qr' => $qr,
-// 'return_url' => $base . 'login?return=' . $return,
- 'return_url' => $return,
- ));
- $response = new Response($enrol);
- return $response;
- });
+$app->get('/qr_enrol', function (Request $request) use ($app, $tiqr) {
+ $base = $request->getUriForPath('/');
+ // starting a new enrollment session
+ $sid = $app['session']->getId();
+ $uid = generate_id(); // TODO uniqueness
+ $app['session']->set('authn', array('username' => $uid)); // TODO check
+ $displayName = "SURFconext";
+ $app['monolog']->addInfo(sprintf("[%s] enrol uid '%s' (%s).", $sid, $uid, $displayName));
+ $key = $tiqr->startEnrollmentSession($uid, $displayName, $sid);
+ $app['monolog']->addInfo(sprintf("[%s] start enrol uid '%s' with session key '%s'.", $sid, $uid, $key));
+ $metadataURL = $base . "tiqr.php?key=$key";
+ $app['monolog']->addInfo(sprintf("[%s] metadata URL for uid '%s' is '%s'.", $sid, $uid, $metadataURL));
+ $tiqr->generateEnrollmentQR($metadataURL);
+ return "";
+});
### status
$app->get('/status', function (Request $request) use ($app, $tiqr) {
$sid = $app['session']->getId();
$status = $tiqr->getEnrollmentStatus($sid);
- error_log("[$sid] status is $status");
+ $app['monolog']->addInfo(sprintf("[%s] status is %d", $sid, $status));
return $status;
- });
+});
$app->get('/done', function (Request $request) use ($app, $tiqr) {
$sid = $app['session']->getId();
$tiqr->resetEnrollmentSession($sid);
- error_log("[$sid] reset enrollment");
+ $app['monolog']->addInfo(sprintf("[%s] reset enrollment", $sid));
return "done";
- });
-
+});
+### housekeeping
+$app->post('/switch-locale', function (Request $request) use ($app, $options) {
+ $return = stripslashes(filter_var($request->get('return_url'), FILTER_VALIDATE_URL));
+ if(strpos($return, $request->getSchemeAndHttpHost() . '/') !== 0) {
+ $app['monolog']->addInfo(sprintf("illegal return URL '%s'", $return));
+ $return = $request->getBaseUrl();
+ }
+
+ $opt = array(
+ 'options' => array(
+ 'default' => 'en',
+ 'regexp' => '/^[a-z]{2}$/',
+ ),
+ );
+ $locale = filter_var($request->get('tiqr_switch_locale'), FILTER_VALIDATE_REGEXP, $opt);
+ if (array_key_exists($locale, $options['translation'])) {
+ $app['session']->set('locale', $locale);
+ }
+ return $app->redirect($return);
+});
+
$app->run();
diff --git a/www/tiqr/locales/en.yml b/www/tiqr/locales/en.yml
new file mode 100644
index 00000000..c2e8e57d
--- /dev/null
+++ b/www/tiqr/locales/en.yml
@@ -0,0 +1,35 @@
+en: English
+nl: Nederlands
+login:
+ title: Login with Tiqr
+ timeout: Login timeout. Please refresh this page and try again.
+ push:
+ message: You will receive a push notification on your phone.
+ instructions.1: Please click on 'OK' to proceed.
+ instructions.2: Enter your PIN and click on 'OK'. You will be logged in.
+ fail: Did you not receive a push notification? Click %link_start%here%link_end% and scan the QR code with your Tiqr app.
+ qr:
+ message: Scan or tap the code with the Tiqr app on your phone to login.
+ manual:
+ message: If the instructions on your phone instruct you to login manually, click %link_start%here%link_end%.
+ userid: User ID
+ otp: One time password
+ button: Go
+ no_account: No account yet? Please create a new account %link_start%here%link_end%.
+ cancel: Cancel
+enrol:
+ title: Register new Tiqr account
+ status:
+ idle.1: Your session has expired.
+ idle.2: Refresh the page and try again.
+ idle.3: Or click 'Cancel' to return to Home
+ initialized.1: Open the Tiqr app on your phone.
+ initialized.2: Scan the QR code with the Tiqr app.
+ retrieved.1: The 'Account activation' page will appear on your phone.
+ retrieved.2: Click 'OK' in the Tiqr app to activate your account.
+ retrieved.3: Create a PIN for your Tiqr account
Please memorise your PIN, this PIN cannot be changed later.
+ retrieved.4: After entering your PIN in the Tiqr app you will proceed to the next step automatically.
+ processed: One moment please...
+ finalized: Your account is ready for use.
+ download: Download Tiqr for
iOS /
Android
+ cancel: Cancel
diff --git a/www/tiqr/locales/nl.yml b/www/tiqr/locales/nl.yml
new file mode 100644
index 00000000..f7e067b3
--- /dev/null
+++ b/www/tiqr/locales/nl.yml
@@ -0,0 +1,35 @@
+en: Engels
+nl: Nederlands
+login:
+ title: Inloggen met Tiqr
+ timeout: Login timeout. Ververs de pagina om nogmaals te proberen.
+ push:
+ message: Je ontvangt een pushnotificatie op je telefoon.
+ instructions.1: Klik op 'OK' om verder te gaan
+ instructions.2: Voer je PIN in en klik op 'OK'. Je wordt nu ingelogd.
+ fail: Geen pushnotificatie ontvangen? Klik %link_start%hier%link_end% en scan de QR-code met je Tiqr-app.
+ qr:
+ message: Scan of tap de code met de Tiqr-app op je telefoon om in te loggen.
+ manual:
+ message: Krijg je een melding op je telefoon om handmatig in te loggen? Klik dan %link_start%hier%link_end%.
+ userid: User ID
+ otp: One time password
+ button: Go
+ no_account: Geen account? Maak er dan %link_start%hier%link_end% eerst een aan.
+ cancel: Annuleren
+enrol:
+ title: Registreer nieuw Tiqr-account
+ status:
+ idle.1: Je sessie is verlopen.
+ idle.2: Ververs de pagina om nogmaals te proberen.
+ idle.3: Of klik op 'Annuleren' om terug te keren naar het beginscherm.
+ initialized.1: Open de Tiqr-app op je telefoon.
+ initialized.2: Scan de QR code met de Tiqr-app.
+ retrieved.1: Op je telefoon verschijnt het scherm 'Account Activatie'.
+ retrieved.2: Klik in de app op 'OK' om je account te activeren.
+ retrieved.3: Bedenk een PIN voor je Tiqr-account
Let op! Onthoud deze PIN goed, deze PIN kun je niet meer wijzigen.
+ retrieved.4: Na het invoeren van je PIN in de Tiqr-app ga je automatisch door naar de volgende stap.
+ processed: Een ogenblik geduld a.u.b.
+ finalized: Je account is gereed voor gebruik.
+ download: Download de Tiqr-app voor
iOS /
Android
+ cancel: Annuleren
diff --git a/www/tiqr/tiqr.php b/www/tiqr/tiqr.php
index 6eab2b85..bc7a8320 100644
--- a/www/tiqr/tiqr.php
+++ b/www/tiqr/tiqr.php
@@ -6,8 +6,21 @@
include('../../options.php');
+$logger = null;
+
+function logger() {
+ global $logger, $options ;
+ if( $logger )
+ return $logger;
+ $logger = new Monolog\Logger('tiqr');
+ $logger->pushHandler(new Monolog\Handler\SyslogHandler('stepup-tiqr'));
+ return $logger;
+}
+
function base() {
- $proto = "on" === $_SERVER['HTTPS'] ? "https://" : "http://";
+ $proto = "http://";
+ if( array_key_exists('HTTPS', $_SERVER))
+ $proto = "on" === $_SERVER['HTTPS'] ? "https://" : "http://";
/** @var $baseUrl string */
return $proto . $_SERVER['HTTP_HOST'];
}
@@ -18,7 +31,6 @@ function metadata($key)
$tiqr = new Tiqr_Service($options);
// exchange the key submitted by the phone for a new, unique enrollment secret
$enrollmentSecret = $tiqr->getEnrollmentSecret($key);
- error_log("enrolment secret for key $key is $enrollmentSecret");
// $enrollmentSecret is a one time password that the phone is going to use later to post the shared secret of the user account on the phone.
$enrollmentUrl = base() . "/tiqr/tiqr.php?otp=$enrollmentSecret"; // todo
$authenticationUrl = base() . "/tiqr/tiqr.php";
@@ -64,7 +76,7 @@ function register( $enrollmentSecret, $secret, $notificationType, $notificationA
$tiqr = new Tiqr_Service($options);
// note: userid is never sent together with the secret! userid is retrieved from session
$userid = $tiqr->validateEnrollmentSecret($enrollmentSecret); // or false if invalid
- error_log("storing new entry $userid:$secret");
+ logger()->addDebug(sprintf("storing new entry for user '%s'", $userid));
$userStorage->createUser($userid,"anonymous"); // TODO displayName
$userStorage->setSecret($userid,$secret);
$userStorage->setNotificationType($userid, $notificationType);
@@ -76,46 +88,45 @@ function register( $enrollmentSecret, $secret, $notificationType, $notificationA
switch( $_SERVER['REQUEST_METHOD'] ) {
case "GET":
// metadata request
- //error_log("received GET request\n" . print_r($_GET,true));
// retrieve the temporary reference to the user identity
- $key = $_GET['key'];
- error_log("received metadata request (key=$key)");
+ $key = preg_replace("/[^a-zA-Z0-9]+/", "", $_GET['key']);
+
+ logger()->addInfo(sprintf("received metadata request (key='%s')", $key));
$metadata = metadata($key);
if( $metadata == false)
- error_log("ERROR: empty metadata - metadata was either lost or destroyed after retrieval");
- else
- error_log("sending metadata:\n" . print_r($metadata,true));
+ logger()->addError("ERROR: empty metadata - metadata was either lost or destroyed after retrieval");
+
Header("Content-Type: application/json");
echo json_encode($metadata);
+ logger()->addInfo("sent metadata");
break;
case "POST":
- error_log("tiqr client version is " . $_SERVER['HTTP_X_TIQR_PROTOCOL_VERSION']);
- error_log("received POST request\n" . print_r($_POST,true));
- $operation = $_POST['operation'];
-// $version = $_POST['version'];
- $notificationType = $_POST['notificationType'];
- $notificationAddress = $_POST['notificationAddress'];
-// $language = $_POST['language'];
+ $version = array_key_exists('HTTP_X_TIQR_PROTOCOL_VERSION', $_SERVER) ? $_SERVER['HTTP_X_TIQR_PROTOCOL_VERSION'] : "1";
+ logger()->addDebug(sprintf("Received POST request from tiqr client version %s", $version));
+ $operation = preg_replace("/[^a-z]+/", "", $_POST['operation']);
+ logger()->addInfo(sprintf("received operation '%s'", $operation));
+ $notificationType = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['notificationType']);
+ $notificationAddress = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['notificationAddress']);
switch( $operation ) {
case "register":
- $enrollmentSecret = $_GET['otp']; // enrollmentsecret relayed by tiqr app
- error_log("enrollmentSecret is $enrollmentSecret");
- $secret = $_POST['secret'];
+ $enrollmentSecret = preg_replace("/[^a-zA-Z0-9]+/", "", $_GET['otp']); // enrollmentsecret relayed by tiqr app
+ logger()->addDebug("received enrollmentSecret");
+ $secret = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['secret']);
$result = register( $enrollmentSecret, $secret, $notificationType, $notificationAddress );
echo $result;
break;
case "login":
- $sessionKey = $_POST['sessionKey'];
- $userId = $_POST['userId'];
- $response = $_POST['response'];
- error_log("received authentication response ($response) from user $userId for session $sessionKey");
+ $sessionKey = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['sessionKey']);
+ $userId = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['userId']);
+ $response = preg_replace("/[^a-zA-Z0-9]+/", "", $_POST['response']);
+ logger()->addInfo(sprintf("received authentication response (%s) from user '%s' for session '%s'", $response, $userId, $sessionKey));
$result = login( $sessionKey, $userId, $response );
- error_log("response $result");
+ logger()->addInfo(sprintf("Authentication response is '%d'", $result));
echo $result;
break;
default:
- error_log("ERROR: unknown operation ($operation) in POST request");
+ logger()->addError(sprintf("ERROR: unknown operation (%s) in POST request", $operation));
break;
}
break;
diff --git a/www/tiqr/views/enrol.html b/www/tiqr/views/enrol.html
index 64894a66..99be1618 100644
--- a/www/tiqr/views/enrol.html
+++ b/www/tiqr/views/enrol.html
@@ -2,10 +2,10 @@
Registreer nieuw tiqr account
-
+
-
-
+
+
- Download tiqr voor
-
iOS /
Android
+ {{ 'enrol.download' | trans | raw }}