blob: 2ed2a0f58bad48db8f315d9fad0d2fa574401c61 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
<?php
use League\OAuth2\Client\Provider\GenericProvider;
/**
* StudipAuthOAuth2.php - Stud.IP authentication using OAuth2
*
* @copyright 2024 Jan-Hendrik Willms <tleilax@gmail.com>
* @license GPL2 or any later version
* @since Stud.IP 6.0
*/
final class StudipAuthOAuth2 extends StudipAuthSSO
{
protected string $client_id;
protected string $client_secret;
protected string $redirect_uri;
protected string $url_authorize;
protected string $url_access_token;
protected string $url_resource_owner_details;
protected ?string $logout_url = null;
private ?GenericProvider $client = null;
private ?array $user_data = null;
public function __construct($config = [])
{
parent::__construct($config);
if (!isset($this->plugin_fullname)) {
$this->plugin_fullname = _('OAuth2');
}
}
private function getProvider(): GenericProvider
{
if ($this->client === null) {
$options = [
'clientId' => $this->client_id,
'clientSecret' => $this->client_secret,
'redirectUri' => $this->redirect_uri,
'urlAuthorize' => $this->url_authorize,
'urlAccessToken' => $this->url_access_token,
'urlResourceOwnerDetails' => $this->url_resource_owner_details,
];
if (Config::get()->getValue('HTTP_PROXY')) {
$options['proxy'] = Config::get()->getValue('HTTP_PROXY');
$options['verify'] = false;
}
$this->client = new GenericProvider($options);
}
return $this->client;
}
public function getUser()
{
return $this->getUserData($this->getUsernameKey());
}
public function verifyUsername($username)
{
if (isset($this->user_data)) {
return parent::verifyUsername($this->getUser());
}
if (!Request::get('code')) {
$authorizationUrl = $this->getProvider()->getAuthorizationUrl(['scope' => 'profile email']);
$_SESSION[self::class] = [
'state' => $this->getProvider()->getState(),
'redirect' => Request::url(),
];
page_close();
header('Location: ' . $authorizationUrl);
die;
} elseif (
!Request::get('state')
|| empty($_SESSION[self::class]['state'])
|| Request::get('state') !== $_SESSION[self::class]['state']
) {
if (isset($_SESSION[self::class])) {
unset($_SESSION[self::class]);
}
} else {
$accessToken = $this->getProvider()->getAccessToken('authorization_code', [
'code' => Request::get('code'),
]);
$resourceOwner = $this->getProvider()->getResourceOwner($accessToken);
$this->user_data = $resourceOwner->toArray();
return parent::verifyUsername($this->getUser());
}
return null;
}
/**
* Callback that can be used in user_data_mapping array.
*/
public function getUserData(string $key): ?string
{
return $this->user_data[$key];
}
/**
* Returns the key used to store the username from user_data_mapping if
* present. Defaults to 'nickname'.
*/
private function getUsernameKey(): string
{
return $this->user_data_mapping['map_args']['auth_user_md5.username'] ?? 'nickname';
}
/**
* Perform logout if a logout url has been configured
*/
public function logout(): void
{
if (!empty($this->logout_url)) {
header('Location: ' . $this->logout_url);
exit();
}
}
}
|
