From 19b4ba611184797f0cdb5df85113cb9ea27244c6 Mon Sep 17 00:00:00 2001 From: smarcet Date: Wed, 23 Oct 2013 21:07:06 -0300 Subject: [PATCH] [smarcet] - Refs #4586- Trusted Sites management --- .idea/workspace.xml | 299 ++++++++---------- app/controllers/DiscoveryController.php | 12 +- app/controllers/HomeController.php | 6 +- app/controllers/UserController.php | 68 +++- app/filters.php | 2 +- app/libs/auth/OpenIdUser.php | 2 +- .../OpenIdAuthenticationRequestHandler.php | 16 +- .../OpenIdImmediateNegativeAssertion.php | 7 + .../OpenIdNonImmediateNegativeAssertion.php | 7 + .../openid/services/ITrustedSitesService.php | 2 + app/routes.php | 15 +- app/services/ServerConfigurationService.php | 3 +- app/services/TrustedSitesService.php | 5 + app/views/consent.blade.php | 5 +- app/views/home.blade.php | 1 + app/views/identity.blade.php | 11 +- app/views/login.blade.php | 6 +- app/views/profile.blade.php | 19 ++ 18 files changed, 289 insertions(+), 197 deletions(-) create mode 100644 app/views/profile.blade.php diff --git a/.idea/workspace.xml b/.idea/workspace.xml index ea6a66b1..eb6270d1 100644 --- a/.idea/workspace.xml +++ b/.idea/workspace.xml @@ -2,39 +2,22 @@ - - - - - - - + - - - - - + - - - - - - - - - - - - + + + + + @@ -63,91 +46,64 @@ - - + + - + - - + + - + - - + + - + - - + + - + - - + + - + - - + + - + - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - + @@ -171,22 +127,22 @@ @@ -340,11 +296,61 @@ - - - - - - - - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + + + + + + + + diff --git a/app/controllers/DiscoveryController.php b/app/controllers/DiscoveryController.php index 2f32cf00..851c3c40 100644 --- a/app/controllers/DiscoveryController.php +++ b/app/controllers/DiscoveryController.php @@ -10,15 +10,18 @@ use openid\IOpenIdProtocol; use openid\XRDS\XRDSDocumentBuilder; use \openid\services\IAuthService; +use openid\services\IServerConfigurationService; class DiscoveryController extends BaseController { private $openid_protocol; private $auth_service; + private $server_config_service; - public function __construct(IOpenIdProtocol $openid_protocol,IAuthService $auth_service ){ - $this->openid_protocol = $openid_protocol; - $this->auth_service = $auth_service; + public function __construct(IOpenIdProtocol $openid_protocol,IAuthService $auth_service, IServerConfigurationService $server_config_service){ + $this->openid_protocol = $openid_protocol; + $this->auth_service = $auth_service; + $this->server_config_service = $server_config_service; } /** @@ -48,10 +51,11 @@ class DiscoveryController extends BaseController { //This field contains a semicolon-separated list of representation schemes //which will be accepted in the response to this request. $accept = Request::header('Accept'); + $claimed_identifier = $this->server_config_service->getUserIdentityEndpointURL($identifier); $accept_values = explode(",",$accept); if(in_array(XRDSDocumentBuilder::ContentType,$accept_values)) { - $response = Response::make($this->openid_protocol->getXRDSDiscovery(IOpenIdProtocol::OpenIdXRDSModeUser), 200); + $response = Response::make($this->openid_protocol->getXRDSDiscovery(IOpenIdProtocol::OpenIdXRDSModeUser,$claimed_identifier), 200); $response->header('Content-Type', "application/xrds+xml; charset=UTF-8"); } else{ diff --git a/app/controllers/HomeController.php b/app/controllers/HomeController.php index 2871726e..b22f30ff 100644 --- a/app/controllers/HomeController.php +++ b/app/controllers/HomeController.php @@ -9,6 +9,10 @@ class HomeController extends BaseController { $accept_values = explode(",",$accept); if(in_array(XRDSDocumentBuilder::ContentType,$accept_values)) return Redirect::action('DiscoveryController@idp'); - return View::make("home"); + if(Auth::guest()) + return View::make("home"); + else{ + return Redirect::action("UserController@getProfile"); + } } } \ No newline at end of file diff --git a/app/controllers/UserController.php b/app/controllers/UserController.php index f69b8dc2..bacd56be 100644 --- a/app/controllers/UserController.php +++ b/app/controllers/UserController.php @@ -11,18 +11,27 @@ use openid\services\IAuthService; use openid\requests\OpenIdAuthenticationRequest; use openid\exceptions\InvalidRequestContextException; use openid\XRDS\XRDSDocumentBuilder; +use openid\services\IServerConfigurationService; +use openid\services\ITrustedSitesService; + class UserController extends BaseController{ private $memento_service; private $auth_service; + private $server_configuration_service; - public function __construct(IMementoOpenIdRequestService $memento_service, IAuthService $auth_service){ + public function __construct(IMementoOpenIdRequestService $memento_service, + IAuthService $auth_service, + IServerConfigurationService $server_configuration_service, + ITrustedSitesService $trusted_sites_service){ $this->memento_service = $memento_service; $this->auth_service = $auth_service; + $this->server_configuration_service = $server_configuration_service; + $this->trusted_sites_service=$trusted_sites_service; //filters $this->beforeFilter('csrf',array('only' => array('postLogin', 'postConsent'))); $this->beforeFilter('openid.save.request'); - $this->beforeFilter('openid.needs.auth.request',array('only' => array('getLogin', 'getConsent'))); + $this->beforeFilter('openid.needs.auth.request',array('only' => array('getConsent'))); } private function getViewData(){ @@ -40,8 +49,11 @@ class UserController extends BaseController{ } public function getLogin(){ - $data = $this->getViewData(); - return View::make("login",$data); + if(Auth::guest()) + return View::make("login"); + else{ + return Redirect::action("UserController@getProfile"); + } } public function postLogin(){ @@ -57,8 +69,15 @@ class UserController extends BaseController{ $username = Input::get("username"); $password = Input::get("password"); if($this->auth_service->Login($username,$password)){ - //go to authentication flow again - return Redirect::action("OpenIdProviderController@op_endpoint"); + $msg = $this->memento_service->getCurrentRequest(); + if (!is_null($msg) && $msg->IsValid()){ + //go to authentication flow again + return Redirect::action("OpenIdProviderController@op_endpoint"); + } + else{ + $user = $this->auth_service->getCurrentUser(); + return Redirect::action("UserController@getIdentity",array("identifier"=> $user->getIdentifier())); + } } return Redirect::action('UserController@getLogin')->with('flash_notice', 'Authentication Failed!'); } @@ -78,4 +97,41 @@ class UserController extends BaseController{ return Redirect::to('/accounts/openid/v2'); } } + + public function getIdentity($identifier){ + + $user = $this->auth_service->getUserByOpenId($identifier); + if(is_null($user)) + return View::make("404"); + + //This field contains a semicolon-separated list of representation schemes + //which will be accepted in the response to this request. + $accept = Request::header('Accept'); + $accept_values = explode(",",$accept); + if(in_array(XRDSDocumentBuilder::ContentType,$accept_values)) + return Redirect::action('DiscoveryController@user',array("identifier"=>$identifier)); + + if(Auth::check()){ + return View::make("identity")->with('username',$user->getFullName())->with( "identifier",$user->getIdentifier()); + } + return View::make("identity"); + } + + public function logout() + { + Auth::logout(); + return Redirect::action("UserController@getLogin"); + } + + public function getProfile(){ + $user = $this->auth_service->getCurrentUser(); + + $sites = $this->trusted_sites_service->getAllTrustedSitesByUser($user); + return View::make("profile",array( + "username"=> $user->getFullName(), + "openid_url"=>$this->server_configuration_service->getUserIdentityEndpointURL($user->getIdentifier()), + "identifier"=>$user->getIdentifier(), + "sites"=>$sites + )); + } } \ No newline at end of file diff --git a/app/filters.php b/app/filters.php index 9b9795dc..19a2b9ed 100644 --- a/app/filters.php +++ b/app/filters.php @@ -35,7 +35,7 @@ App::after(function($request, $response) Route::filter('auth', function() { - if (Auth::guest()) return Redirect::guest('login'); + if (Auth::guest()) return Redirect::action('HomeController@index'); }); diff --git a/app/libs/auth/OpenIdUser.php b/app/libs/auth/OpenIdUser.php index ff4c3326..c2b8f752 100644 --- a/app/libs/auth/OpenIdUser.php +++ b/app/libs/auth/OpenIdUser.php @@ -11,7 +11,7 @@ namespace auth; use Illuminate\Auth\UserInterface; use openid\model\IOpenIdUser; - +use \Member; class OpenIdUser extends \Eloquent implements UserInterface , IOpenIdUser{ diff --git a/app/libs/openid/handlers/OpenIdAuthenticationRequestHandler.php b/app/libs/openid/handlers/OpenIdAuthenticationRequestHandler.php index 14dc8a17..82120097 100644 --- a/app/libs/openid/handlers/OpenIdAuthenticationRequestHandler.php +++ b/app/libs/openid/handlers/OpenIdAuthenticationRequestHandler.php @@ -76,7 +76,6 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler /** * Create Positive Identity Assertion * implements http://openid.net/specs/openid-authentication-2_0.html#positive_assertions - * @param OpenIdAuthenticationRequest $request * @return OpenIdPositiveAssertionResponse */ private function doAssertion() @@ -100,7 +99,7 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler $ext->prepareResponse($this->current_request, $response, $context); } //check former assoc handle... - $assoc_handle = $request->getAssocHandle(); + $assoc_handle = $this->current_request->getAssocHandle(); $association = $this->association_service->getAssociation($assoc_handle); if (empty($assoc_handle) || is_null($association)) { // if not present or if it already void then enter on dumb mode @@ -122,8 +121,6 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler } /** - * @param OpenIdAuthenticationRequest $request - * @param RequestContext $context * @return mixed */ private function doConsentProcess(){ @@ -213,8 +210,6 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler } } /** - * @param OpenIdAuthenticationRequest $request - * @param RequestContext $context * @return OpenIdIndirectGenericErrorResponse|OpenIdNonImmediateNegativeAssertion|OpenIdPositiveAssertionResponse * @throws \Exception */ @@ -240,7 +235,6 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler } /** - * @param OpenIdAuthenticationRequest $request * @return OpenIdImmediateNegativeAssertion|OpenIdIndirectGenericErrorResponse|OpenIdPositiveAssertionResponse */ protected function doImmediateMode(){ @@ -293,7 +287,7 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler */ protected function InternalHandle(OpenIdMessage $message) { - $request = null; + $this->current_request = null; try { $this->current_request = new OpenIdAuthenticationRequest($message); @@ -302,7 +296,7 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler throw new InvalidOpenIdMessageException("OpenIdAuthenticationRequest is Invalid!"); $this->current_request_context = new RequestContext; - $mode = $request->getMode(); + $mode = $this->current_request->getMode(); switch ($mode) { case OpenIdProtocol::SetupMode: @@ -322,8 +316,8 @@ class OpenIdAuthenticationRequestHandler extends OpenIdMessageHandler } catch (InvalidOpenIdMessageException $ex) { $response = new OpenIdIndirectGenericErrorResponse($ex->getMessage()); - if(!is_null($request)){ - $return_to = $request->getReturnTo(); + if(!is_null($this->current_request)){ + $return_to = $this->current_request->getReturnTo(); if(!empty($return_to)) $response->setReturnTo($return_to); } diff --git a/app/libs/openid/responses/OpenIdImmediateNegativeAssertion.php b/app/libs/openid/responses/OpenIdImmediateNegativeAssertion.php index c13c2231..28b54dd1 100644 --- a/app/libs/openid/responses/OpenIdImmediateNegativeAssertion.php +++ b/app/libs/openid/responses/OpenIdImmediateNegativeAssertion.php @@ -12,6 +12,13 @@ namespace openid\responses; use openid\OpenIdProtocol; +/** + * Class OpenIdImmediateNegativeAssertion + * implements http://openid.net/specs/openid-authentication-2_0.html#negative_assertions + * Negative Assertions + * In Response to Immediate Requests + * @package openid\responses + */ class OpenIdImmediateNegativeAssertion extends OpenIdIndirectResponse{ public function __construct($return_url=null){ diff --git a/app/libs/openid/responses/OpenIdNonImmediateNegativeAssertion.php b/app/libs/openid/responses/OpenIdNonImmediateNegativeAssertion.php index 8110aa2a..ce5b4e72 100644 --- a/app/libs/openid/responses/OpenIdNonImmediateNegativeAssertion.php +++ b/app/libs/openid/responses/OpenIdNonImmediateNegativeAssertion.php @@ -11,6 +11,13 @@ namespace openid\responses; use openid\OpenIdProtocol; +/** + * Class OpenIdNonImmediateNegativeAssertion + * implements http://openid.net/specs/openid-authentication-2_0.html#negative_assertions + * Negative Assertions + * In Response to Non-Immediate Requests + * @package openid\responses + */ class OpenIdNonImmediateNegativeAssertion extends OpenIdIndirectResponse { public function __construct($return_url=null){ diff --git a/app/libs/openid/services/ITrustedSitesService.php b/app/libs/openid/services/ITrustedSitesService.php index 98df63ae..065859a9 100644 --- a/app/libs/openid/services/ITrustedSitesService.php +++ b/app/libs/openid/services/ITrustedSitesService.php @@ -20,4 +20,6 @@ interface ITrustedSitesService { * @return ITrustedSite */ public function getTrustedSite(IOpenIdUser $user,$realm); + + public function getAllTrustedSitesByUser(IOpenIdUser $user); } \ No newline at end of file diff --git a/app/routes.php b/app/routes.php index 96fc9fbd..20e9e9f3 100644 --- a/app/routes.php +++ b/app/routes.php @@ -13,17 +13,22 @@ Route::get('/', "HomeController@index"); Route::get('/discovery', "DiscoveryController@idp"); - +Route::get("/{identifier}","UserController@getIdentity"); +Route::get("/accounts/user/ud/{identifier}","DiscoveryController@user"); //op endpoint url Route::post('/accounts/openid/v2','OpenIdProviderController@op_endpoint'); Route::get('/accounts/openid/v2','OpenIdProviderController@op_endpoint'); //user interaction Route::get('/accounts/user/login',"UserController@getLogin"); - Route::post('/accounts/user/login',"UserController@postLogin"); -Route::get("/accounts/user/ud/{identifier}","DiscoveryController@user"); -Route::get('/accounts/user/consent',"UserController@getConsent"); -Route::post('/accounts/user/consent',"UserController@postConsent"); + +Route::group(["before" => "auth"], function() +{ + Route::get('/accounts/user/consent',"UserController@getConsent"); + Route::post('/accounts/user/consent',"UserController@postConsent"); + Route::any("/accounts/user/logout","UserController@logout"); + Route::any("/accounts/user/profile","UserController@getProfile"); +}); diff --git a/app/services/ServerConfigurationService.php b/app/services/ServerConfigurationService.php index 44785758..aaf0a209 100644 --- a/app/services/ServerConfigurationService.php +++ b/app/services/ServerConfigurationService.php @@ -12,9 +12,8 @@ use openid\services\IServerConfigurationService; class ServerConfigurationService implements IServerConfigurationService{ - public function getUserIdentityEndpointURL($identifier){ - $url = action("DiscoveryController@user",array("identifier"=>$identifier)); + $url = action("UserController@getIdentity",array("identifier"=>$identifier)); return $url; } diff --git a/app/services/TrustedSitesService.php b/app/services/TrustedSitesService.php index 3ba9005c..88bcc3d4 100644 --- a/app/services/TrustedSitesService.php +++ b/app/services/TrustedSitesService.php @@ -42,4 +42,9 @@ class TrustedSitesService implements ITrustedSitesService { $site = OpenIdTrustedSite::where("realm","=",$realm)->where("user_id","=",$user->getId())->first(); return $site; } + + public function getAllTrustedSitesByUser(IOpenIdUser $user){ + $sites = OpenIdTrustedSite::where("user_id","=",$user->getId())->get(); + return $sites; + } } \ No newline at end of file diff --git a/app/views/consent.blade.php b/app/views/consent.blade.php index 63d0dd4f..1d741880 100644 --- a/app/views/consent.blade.php +++ b/app/views/consent.blade.php @@ -1,7 +1,7 @@ @extends('layout') @section('content')
- {{ Form::open(array('url' => '/accounts/user/consent', 'method' => 'post')) }} + {{ Form::open(array('url' => '/accounts/user/consent', 'method' => 'post', "autocomplete" => "off")) }} @@ -19,5 +19,8 @@ {{ Form::submit('Ok') }} {{ Form::submit('Cancel') }} {{ Form::close() }} + @foreach ($views as $view) + {{ $view}} + @endforeach
@stop \ No newline at end of file diff --git a/app/views/home.blade.php b/app/views/home.blade.php index ec068284..56dda457 100644 --- a/app/views/home.blade.php +++ b/app/views/home.blade.php @@ -3,5 +3,6 @@

OpenstackId Idp

Welcome to OpenstackId Idp!!!

+ login
@stop \ No newline at end of file diff --git a/app/views/identity.blade.php b/app/views/identity.blade.php index 82f39621..18ba7991 100644 --- a/app/views/identity.blade.php +++ b/app/views/identity.blade.php @@ -2,6 +2,15 @@ @section('content')

OpenstackId Idp

-

Welcome to OpenstackId Idp!!!

+ @if( Auth::guest()) +

This is an OpenID Identity page. This user has chosen not to display any information on this page.

+ @else + Welcome, {{{ $username }}}. + logout +

+ This is your identity page. You are currently displaying no information on this page. You can display information such as your name, contact info, a short description of yourself, and a photo. +

+ edit your profile + @endif
@stop \ No newline at end of file diff --git a/app/views/login.blade.php b/app/views/login.blade.php index 4fe84834..20009d9d 100644 --- a/app/views/login.blade.php +++ b/app/views/login.blade.php @@ -2,7 +2,7 @@ @section('content')

Login

- {{ Form::open(array('url' => '/accounts/user/login', 'method' => 'post')) }} + {{ Form::open(array('url' => '/accounts/user/login', 'method' => 'post', "autocomplete" => "off")) }}
    @foreach($errors->all() as $message)
  • {{ $message }}
    • @@ -26,9 +26,5 @@
    {{ Session::get('flash_notice') }}
    @endif {{ Form::close() }} - @foreach ($views as $view) - {{ $view}} - @endforeach -
@stop \ No newline at end of file diff --git a/app/views/profile.blade.php b/app/views/profile.blade.php new file mode 100644 index 00000000..0f0af9e7 --- /dev/null +++ b/app/views/profile.blade.php @@ -0,0 +1,19 @@ +@extends('layout') +@section('content') +

OpenstackId Idp

+
+ Hello, {{{ $username }}}. + logout +
Your OPENID: {{$openid_url}}
+ @if (count($sites)>0) +
+

Trusted Sites

+
    + @foreach ($sites as $site) +
  • Realm {{ $site->getRealm() }} - Policy {{ $site->getAuthorizationPolicy() }} Edit Delete
    • + @endforeach +
+
+ @endif +
+@stop \ No newline at end of file