Authentification Shibboleth (e3e9cf98) · Commits · Christophe Turbout / auth

composer.json

+1 −1

Original line number	Diff line number	Diff line
		@@ -4,7 +4,7 @@
		"repositories": [
		{
		"type": "composer",
		"url": "https://dev.unicaen.fr/packagist"
		"url": "https://gest.unicaen.fr/packagist"
		}
		],
		"require": {

config/module.config.php

+33 −2

Original line number	Diff line number	Diff line
		<?php

		use UnicaenAuth\Provider\Privilege\Privileges;
		use UnicaenAuth\Controller\AuthControllerFactory;
		use UnicaenAuth\Service\ShibService;
		use UnicaenAuth\Service\ShibServiceFactory;
		use UnicaenAuth\View\Helper\ShibConnectViewHelperFactory;

		$settings = [

		/**
		* Fournisseurs d'identité.
		*/
		@@ -119,6 +121,8 @@ return [
		['controller' => 'UnicaenApp\Controller\Application', 'action' => 'informatique-et-libertes', 'roles' => []],
		['controller' => 'UnicaenApp\Controller\Application', 'action' => 'refresh-session', 'roles' => []],
		['controller' => 'UnicaenAuth\Controller\Utilisateur', 'action' => 'selectionner-profil', 'roles' => []],

		['controller' => 'UnicaenAuth\Controller\Auth', 'action' => 'shibboleth', 'roles' => []],
		],
		],
		],
		@@ -167,6 +171,27 @@ return [
		],
		'router' => [
		'routes' => [
		'auth' => [
		'type' => 'Literal',
		'options' => [
		'route' => '/auth',
		'defaults' => [
		'controller' => 'UnicaenAuth\Controller\Auth',
		],
		],
		'may_terminate' => false,
		'child_routes' => [
		'shibboleth' => [
		'type' => 'Literal',
		'options' => [
		'route' => '/shibboleth',
		'defaults' => [
		'action' => 'shibboleth',
		],
		],
		],
		],
		],
		'zfcuser' => [
		'type' => 'Literal',
		'priority' => 1000,
		@@ -346,6 +371,7 @@ return [
		'invokables' => [
		'UnicaenAuth\Authentication\Storage\Db' => 'UnicaenAuth\Authentication\Storage\Db',
		'UnicaenAuth\Authentication\Storage\Ldap' => 'UnicaenAuth\Authentication\Storage\Ldap',
		'UnicaenAuth\Authentication\Storage\Shib' => 'UnicaenAuth\Authentication\Storage\Shib',
		'UnicaenAuth\View\RedirectionStrategy' => 'UnicaenAuth\View\RedirectionStrategy',
		'UnicaenAuth\Service\UserContext' => 'UnicaenAuth\Service\UserContext',
		'UnicaenAuth\Service\User' => 'UnicaenAuth\Service\User',
		@@ -369,6 +395,7 @@ return [
		'UnicaenAuth\Service\Privilege' => 'UnicaenAuth\Service\PrivilegeServiceFactory',
		'BjyAuthorize\Service\Authorize' => 'UnicaenAuth\Service\AuthorizeServiceFactory', // substituion
		'zfcuser_redirect_callback' => 'UnicaenAuth\Authentication\RedirectCallbackFactory', // substituion
		ShibService::class => ShibServiceFactory::class,
		],
		'initializers' => [
		'UnicaenAuth\Service\UserAwareInitializer',
		@@ -380,6 +407,9 @@ return [
		'UnicaenAuth\Controller\Utilisateur' => 'UnicaenAuth\Controller\UtilisateurController',
		'UnicaenAuth\Controller\Droits' => 'UnicaenAuth\Controller\DroitsController',
		],
		'factories' => [
		'UnicaenAuth\Controller\Auth' => AuthControllerFactory::class,
		],
		],

		'form_elements' => [
		@@ -397,6 +427,7 @@ return [
		'userInfo' => 'UnicaenAuth\View\Helper\UserInfoFactory',
		'userProfileSelect' => 'UnicaenAuth\View\Helper\UserProfileSelectFactory',
		'userProfileSelectRadioItem' => 'UnicaenAuth\View\Helper\UserProfileSelectRadioItemFactory',
		'shibConnect' => ShibConnectViewHelperFactory::class,
		],
		'invokables' => [
		'appConnection' => 'UnicaenAuth\View\Helper\AppConnection',

config/unicaen-auth.local.php.dist

+6 −0

Original line number	Diff line number	Diff line
		@@ -6,6 +6,12 @@
		* drop this config file in it and change the values as you wish.
		*/
		$settings = [
		/**
		* Activation ou non de l'authentification Shibboleth.
		*/
		'shibboleth' => [
		'enable' => false,
		],
		/**
		* Paramètres de connexion au serveur CAS :
		* - pour désactiver l'authentification CAS, le tableau 'cas' doit être vide.

src/UnicaenAuth/Authentication/Adapter/AbstractFactory.php

+14 −7

Original line number	Diff line number	Diff line
		<?php

		namespace UnicaenAuth\Authentication\Adapter;

		use UnicaenApp\Exception;
		use UnicaenAuth\Authentication\Adapter\Cas;
		use UnicaenAuth\Authentication\Adapter\Db;
		use UnicaenAuth\Authentication\Adapter\Ldap;
		use UnicaenApp\Exception\LogicException;
		use Zend\EventManager\EventManager;
		use Zend\EventManager\EventManagerAwareInterface;
		use Zend\ServiceManager\AbstractFactoryInterface;
		use Zend\ServiceManager\ServiceLocatorInterface;

		@@ -34,7 +34,7 @@ class AbstractFactory implements AbstractFactoryInterface
		* @param ServiceLocatorInterface $serviceLocator
		* @param $name
		* @param $requestedName
		* @return mixed
		* @return \ZfcUser\Authentication\Adapter\AbstractAdapter
		*/
		public function createServiceWithName(ServiceLocatorInterface $serviceLocator, $name, $requestedName)
		{
		@@ -48,12 +48,19 @@ class AbstractFactory implements AbstractFactoryInterface
		case __NAMESPACE__ . '\Cas':
		$adapter = new Cas();
		break;
		//
		// NB: pour faire simple, la stratégie de créer un adapter pour l'auth Shibboleth n'a pas été retenue.
		//
		// case __NAMESPACE__ . '\Shib':
		// $adapter = new Shib();
		// break;
		default:
		throw new Exception("Service demandé inattendu : '$requestedName'!");
		throw new LogicException("Service demandé inattendu : '$requestedName'!");
		break;
		}

		if ($adapter instanceof \Zend\EventManager\EventManagerAwareInterface) {
		if ($adapter instanceof EventManagerAwareInterface) {
		/** @var EventManager $eventManager */
		$eventManager = $serviceLocator->get('event_manager');
		$adapter->setEventManager($eventManager);
		$userService = $serviceLocator->get('unicaen-auth_user_service'); /* @var $userService \UnicaenAuth\Service\User */

src/UnicaenAuth/Authentication/Adapter/Ldap.php

+72 −15

Original line number	Diff line number	Diff line
		<?php

		namespace UnicaenAuth\Authentication\Adapter;

		use UnicaenApp\Exception\RuntimeException;
		use UnicaenApp\Mapper\Ldap\People as LdapPeopleMapper;
		use UnicaenAuth\Options\ModuleOptions;
		use Zend\Authentication\Exception\UnexpectedValueException;
		use Zend\Authentication\Result as AuthenticationResult;
		use UnicaenAuth\Service\User;
		use Zend\Authentication\Adapter\Ldap as LdapAuthAdapter;
		use Zend\Authentication\Exception\ExceptionInterface;
		use Zend\Authentication\Result as AuthenticationResult;
		use Zend\EventManager\EventManager;
		use Zend\EventManager\EventManagerAwareInterface;
		use Zend\EventManager\EventManagerInterface;
		@@ -38,6 +42,11 @@ class Ldap extends AbstractAdapter implements ServiceManagerAwareInterface, Even
		*/
		protected $ldapAuthAdapter;

		/**
		* @var LdapPeopleMapper
		*/
		protected $ldapPeopleMapper;

		/**
		* @var ModuleOptions
		*/
		@@ -52,13 +61,18 @@ class Ldap extends AbstractAdapter implements ServiceManagerAwareInterface, Even
		*
		* @param AuthEvent $e
		* @return boolean
		* @throws UnexpectedValueException
		* @throws \Zend\Authentication\Adapter\Exception\ExceptionInterface
		* @throws \Zend\Ldap\Exception\LdapException
		* @see ChainableAdapter
		*/
		public function authenticate(AuthEvent $e)
		{
		if ($this->isSatisfied()) {
		try {
		$storage = $this->getStorage()->read();
		} catch (ExceptionInterface $e) {
		throw new RuntimeException("Erreur de lecture du storage");
		}
		$e->setIdentity($storage['identity'])
		->setCode(AuthenticationResult::SUCCESS)
		->setMessages(['Authentication successful.']);
		@@ -78,15 +92,31 @@ class Ldap extends AbstractAdapter implements ServiceManagerAwareInterface, Even
		return false;
		}

		// recherche de l'individu dans l'annuaire LDAP
		$ldapPeople = $this->getLdapPeopleMapper()->findOneByUsername($username);
		if (!$ldapPeople) {
		$e
		->setCode(AuthenticationResult::FAILURE)
		->setMessages(['Authentication failed.']);
		$this->setSatisfied(false);
		return false;
		}

		$e->setIdentity($this->usernameUsurpe ?: $username);
		$this->setSatisfied(true);
		try {
		$storage = $this->getStorage()->read();
		$storage['identity'] = $e->getIdentity();
		$this->getStorage()->write($storage);
		} catch (ExceptionInterface $e) {
		throw new RuntimeException("Erreur de concernant le storage");
		}
		$e->setCode(AuthenticationResult::SUCCESS)
		->setMessages(['Authentication successful.']);

		$this->getEventManager()->trigger('userAuthenticated', $e);
		/* @var $userService User */
		$userService = $this->getServiceManager()->get('unicaen-auth_user_service');
		$userService->userAuthenticated($ldapPeople);
		}

		/**
		@@ -118,6 +148,8 @@ class Ldap extends AbstractAdapter implements ServiceManagerAwareInterface, Even
		* @param string $username Identifiant de connexion
		* @param string $credential Mot de passe
		* @return boolean
		* @throws \Zend\Authentication\Adapter\Exception\ExceptionInterface
		* @throws \Zend\Ldap\Exception\LdapException
		*/
		public function authenticateUsername($username, $credential)
		{
		@@ -149,6 +181,31 @@ class Ldap extends AbstractAdapter implements ServiceManagerAwareInterface, Even
		return $success;
		}

		/**
		* get ldap people mapper
		*
		* @return LdapPeopleMapper
		*/
		public function getLdapPeopleMapper()
		{
		if (null === $this->ldapPeopleMapper) {
		$this->ldapPeopleMapper = $this->getServiceManager()->get('ldap_people_mapper');
		}
		return $this->ldapPeopleMapper;
		}

		/**
		* set ldap people mapper
		*
		* @param LdapPeopleMapper $mapper
		* @return self
		*/
		public function setLdapPeopleMapper(LdapPeopleMapper $mapper)
		{
		$this->ldapPeopleMapper = $mapper;
		return $this;
		}

		/**
		* @param ModuleOptions $options
		*/