diff --git a/src/app/configuration/controllers/ConfigurationController.php b/src/app/configuration/controllers/ConfigurationController.php index f3ebf8cf842d71dafc9e28229d9bfd9e2d58e423..d74db48598fa92f3401a899117e2d85210f1c8ce 100755 --- a/src/app/configuration/controllers/ConfigurationController.php +++ b/src/app/configuration/controllers/ConfigurationController.php @@ -24,7 +24,7 @@ use SrcCore\models\AuthenticationModel; class ConfigurationController { - public const CONNECTION_MODES = ['default', 'ldap', 'kerberos', 'x509']; + public const CONNECTION_MODES = ['default', 'ldap', 'kerberos', 'x509', 'azure_saml']; public function get(Request $request, Response $response) { @@ -49,10 +49,11 @@ class ConfigurationController $configurations = $configurations[0]; $configurations['value'] = json_decode($configurations['value']); $configurations['availableConnections'] = [ - ['id' => 'default', 'allowed' => true], - ['id' => 'kerberos', 'allowed' => true], - ['id' => 'x509', 'allowed' => true], - ['id' => 'ldap', 'allowed' => !empty($ldapConfigurations)] + ['id' => 'default', 'allowed' => true], + ['id' => 'kerberos', 'allowed' => true], + ['id' => 'x509', 'allowed' => true], + ['id' => 'ldap', 'allowed' => !empty($ldapConfigurations)], + ['id' => 'azure_saml', 'allowed' => true], ]; } diff --git a/src/core/controllers/AuthenticationController.php b/src/core/controllers/AuthenticationController.php index 184fd9e5e79e827b5877beaa2ca9bace851f633e..32dde88a04da6ff6514252c465a40d18c0c5adbe 100755 --- a/src/core/controllers/AuthenticationController.php +++ b/src/core/controllers/AuthenticationController.php @@ -166,6 +166,13 @@ class AuthenticationController return $response->withStatus(401)->withJson(['errors' => 'No identifier detected for kerberos']); } $authenticated = true; + } else if ($connection == 'azure_saml') { + $authenticated = AuthenticationController::azureSamlConnection(); + if (!empty($authenticated['errors'])) { + return $response->withStatus(401)->withJson(['errors' => $authenticated['errors']]); + } + $login = strtolower($authenticated['login']); + $authenticated = true; } else { $authenticated = AuthenticationModel::authentication(['login' => $login, 'password' => $body['password']]); } @@ -222,6 +229,29 @@ class AuthenticationController return $response->withStatus(204); } + private static function azureSamlConnection() + { + $libDir = CoreConfigModel::getLibrariesDirectory(); + if (!is_file($libDir . 'simplesamlphp/lib/_autoload.php')) { + return ['errors' => 'Library simplesamlphp not present']; + } + + require_once($libDir . 'simplesamlphp/lib/_autoload.php'); + $as = new \SimpleSAML\Auth\Simple('default-sp'); + $as->requireAuth([ + 'ReturnTo' => UrlController::getCoreUrl(), + 'skipRedirection' => true + ]); + + $attributes = $as->getAttributes(); + $login = $attributes['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'][0]; + if (empty($login)) { + return ['errors' => 'Authentication Failed : login not present in attributes']; + } + + return ['login' => $login]; + } + public function getRefreshedToken(Request $request, Response $response) { $queryParams = $request->getQueryParams();