diff --git a/apps/maarch_entreprise/xml/login_method.xml b/apps/maarch_entreprise/xml/login_method.xml index 240d769031b46cae4418c1c770045e9b339c7dcb..99f4b9363d9b310a7154ea58cc6e08cbe0d71e7a 100755 --- a/apps/maarch_entreprise/xml/login_method.xml +++ b/apps/maarch_entreprise/xml/login_method.xml @@ -24,4 +24,8 @@ <ID>openam</ID> <ENABLED>false</ENABLED> </METHOD> + <METHOD> + <ID>azure_saml</ID> + <ENABLED>false</ENABLED> + </METHOD> </ROOT> diff --git a/src/core/controllers/AuthenticationController.php b/src/core/controllers/AuthenticationController.php index 2161758857965cc149ac1c90e73d2b53c70fb44a..829712c9f7823daa0559aa11a81ed854c8e45224 100755 --- a/src/core/controllers/AuthenticationController.php +++ b/src/core/controllers/AuthenticationController.php @@ -315,6 +315,15 @@ class AuthenticationController if (!AuthenticationController::isUserAuthorized(['login' => $login])) { return $response->withStatus(403)->withJson(['errors' => 'Authentication unauthorized']); } + } elseif ($loggingMethod['id'] == 'azure_saml') { + $authenticated = AuthenticationController::azureSamlConnection(); + if (!empty($authenticated['errors'])) { + return $response->withStatus(401)->withJson(['errors' => $authenticated['errors']]); + } + $login = strtolower($authenticated['login']); + if (!AuthenticationController::isUserAuthorized(['login' => $login])) { + return $response->withStatus(403)->withJson(['errors' => 'Authentication unauthorized']); + } } else { return $response->withStatus(403)->withJson(['errors' => 'Logging method unauthorized']); } @@ -635,6 +644,29 @@ class AuthenticationController return ['login' => $login]; } + private static function azureSamlConnection() + { + $libDir = CoreConfigModel::getLibrariesDirectory(); + if (!is_file($libDir . 'simplesamlphp/lib/_autoload.php')) { + return ['errors' => 'Library simplesamlphp not present']; + } + + require_once($libDir . 'simplesamlphp/lib/_autoload.php'); + $as = new \SimpleSAML\Auth\Simple('default-sp'); + $as->requireAuth([ + 'ReturnTo' => UrlController::getCoreUrl(), + 'skipRedirection' => true + ]); + + $attributes = $as->getAttributes(); + $login = $attributes['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'][0]; + if (empty($login)) { + return ['errors' => 'Authentication Failed : login not present in attributes']; + } + + return ['login' => $login]; + } + public function getRefreshedToken(Request $request, Response $response) { $queryParams = $request->getQueryParams();