Cas20.php

<?php

/*
 *    simpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a simpleSAMLphp module
 *
 *    Copyright (C) 2013  Bjorn R. Jensen
 *
 *    This library is free software; you can redistribute it and/or
 *    modify it under the terms of the GNU Lesser General Public
 *    License as published by the Free Software Foundation; either
 *    version 2.1 of the License, or (at your option) any later version.
 *
 *    This library is distributed in the hope that it will be useful,
 *    but WITHOUT ANY WARRANTY; without even the implied warranty of
 *    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 *    Lesser General Public License for more details.
 *
 *    You should have received a copy of the GNU Lesser General Public
 *    License along with this library; if not, write to the Free Software
 *    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 *
 */

declare(strict_types=1);

namespace SimpleSAML\Module\casserver\Cas\Protocol;

use Beste\Clock\LocalizedClock;
use DateTimeZone;
use SimpleSAML\Assert\AssertionFailedException;
use SimpleSAML\CAS\Type\CodeValue;
use SimpleSAML\CAS\XML\Attributes;
use SimpleSAML\CAS\XML\AuthenticationDate;
use SimpleSAML\CAS\XML\AuthenticationFailure;
use SimpleSAML\CAS\XML\AuthenticationSuccess;
use SimpleSAML\CAS\XML\IsFromNewLogin;
use SimpleSAML\CAS\XML\LongTermAuthenticationRequestTokenUsed;
use SimpleSAML\CAS\XML\ProxyFailure;
use SimpleSAML\CAS\XML\ProxyGrantingTicket;
use SimpleSAML\CAS\XML\ProxySuccess;
use SimpleSAML\CAS\XML\ProxyTicket;
use SimpleSAML\CAS\XML\ServiceResponse;
use SimpleSAML\CAS\XML\User;
use SimpleSAML\Configuration;
use SimpleSAML\Logger;
use SimpleSAML\XML\Assert\Assert;
use SimpleSAML\XML\Chunk;
use SimpleSAML\XML\DOMDocumentFactory;
use SimpleSAML\XMLSchema\Type\BooleanValue;
use SimpleSAML\XMLSchema\Type\DateTimeValue;
use SimpleSAML\XMLSchema\Type\StringValue;

use function base64_encode;
use function count;
use function is_null;
use function is_string;
use function str_replace;

class Cas20
{
    /** @var bool $sendAttributes */
    private bool $sendAttributes;

    /** @var bool $base64EncodeAttributes */
    private bool $base64EncodeAttributes;

    /** @var string|null $base64IndicatorAttribute */
    private ?string $base64IndicatorAttribute;

    /** @var array $attributes */
    private array $attributes = [];

    /** @var string|null $proxyGrantingTicketIOU */
    private ?string $proxyGrantingTicketIOU = null;


    /**
     * @param \SimpleSAML\Configuration $config
     */
    public function __construct(Configuration $config)
    {
        $this->sendAttributes = $config->getOptionalValue('attributes', false);
        $this->base64EncodeAttributes = $config->getOptionalValue('base64attributes', false);
        $this->base64IndicatorAttribute = $config->getOptionalValue('base64_attributes_indicator_attribute', null);
    }


    /**
     * @param array $attributes
     */
    public function setAttributes(array $attributes): void
    {
        $this->attributes = $attributes;
    }


    /**
     * @return array
     */
    public function getAttributes(): array
    {
        return $this->attributes;
    }


    /**
     * @param string $proxyGrantingTicketIOU
     */
    public function setProxyGrantingTicketIOU(string $proxyGrantingTicketIOU): void
    {
        $this->proxyGrantingTicketIOU = $proxyGrantingTicketIOU;
    }


    /**
     * @return string|null
     */
    public function getProxyGrantingTicketIOU(): ?string
    {
        return $this->proxyGrantingTicketIOU;
    }


    /**
     * @param string $username
     * @return \SimpleSAML\CAS\XML\ServiceResponse
     */
    public function getValidateSuccessResponse(string $username): ServiceResponse
    {
        $user = new User(StringValue::fromString($username));

        $proxyGrantingTicket = null;
        if (is_string($this->proxyGrantingTicketIOU)) {
            $proxyGrantingTicket = new ProxyGrantingTicket(StringValue::fromString($this->proxyGrantingTicketIOU));
        }

        $attr = [];
        if ($this->sendAttributes && count($this->attributes) > 0) {
            foreach ($this->attributes as $name => $values) {
                // Fix the most common cause of invalid XML elements
                $_name = str_replace(':', '_', $name);
                try {
                    Assert::validNCName($_name);
                    foreach ($values as $value) {
                        $attr[] = $this->generateCas20Attribute($_name, $value);
                    }
                } catch (AssertionFailedException) {
                    Logger::warning("DOMException creating attribute '$_name'. Continuing without attribute'");
                }
            }

            if (!is_null($this->base64IndicatorAttribute)) {
                $attr[] = $this->generateCas20Attribute(
                    $this->base64IndicatorAttribute,
                    $this->base64EncodeAttributes ? "true" : "false",
                );
            }
        }

        $systemClock = LocalizedClock::in(new DateTimeZone('Z'));
        $attributes = new Attributes(
            new AuthenticationDate(DateTimeValue::now($systemClock)),
            new LongTermAuthenticationRequestTokenUsed(BooleanValue::fromBoolean(true)),
            new IsFromNewLogin(BooleanValue::fromBoolean(true)),
            $attr,
        );

        $authenticationSuccess = new AuthenticationSuccess($user, $attributes, $proxyGrantingTicket);
        $serviceResponse = new ServiceResponse($authenticationSuccess);

        return $serviceResponse;
    }


    /**
     * @param string $errorCode
     * @param string $explanation
     * @return \SimpleSAML\CAS\XML\ServiceResponse
     */
    public function getValidateFailureResponse(string $errorCode, string $explanation): ServiceResponse
    {
        $authenticationFailure = new AuthenticationFailure(
            StringValue::fromString($explanation),
            CodeValue::fromString($errorCode),
        );
        $serviceResponse = new ServiceResponse($authenticationFailure);

        return $serviceResponse;
    }


    /**
     * @param string $proxyTicketId
     * @return \SimpleSAML\CAS\XML\ServiceResponse
     */
    public function getProxySuccessResponse(string $proxyTicketId): ServiceResponse
    {
        $proxyTicket = new ProxyTicket(StringValue::fromString($proxyTicketId));
        $proxySuccess = new ProxySuccess($proxyTicket);
        $serviceResponse = new ServiceResponse($proxySuccess);

        return $serviceResponse;
    }


    /**
     * @param string $errorCode
     * @param string $explanation
     * @return \SimpleSAML\CAS\XML\ServiceResponse
     */
    public function getProxyFailureResponse(string $errorCode, string $explanation): ServiceResponse
    {
        $proxyFailure = new ProxyFailure(
            StringValue::fromString($explanation),
            CodeValue::fromString($errorCode),
        );
        $serviceResponse = new ServiceResponse($proxyFailure);

        return $serviceResponse;
    }


    /**
     * @param string $attributeName
     * @param string $attributeValue
     * @return \SimpleSAML\XML\Chunk
     */
    private function generateCas20Attribute(
        string $attributeName,
        string $attributeValue,
    ): Chunk {
        $xmlDocument = DOMDocumentFactory::create();

        $attributeValue = $this->base64EncodeAttributes ? base64_encode($attributeValue) : $attributeValue;
        $attributeElement = $xmlDocument->createElementNS(Attributes::NS, 'cas:' . $attributeName, $attributeValue);

        return new Chunk($attributeElement);
    }
}