Finalisation de l'usurpation d'identité et aide de vue UserUsurpation... (f90a09b9) · Commits · Christophe Turbout / auth

config/module.config.php

+2 −1

Original line number	Diff line number	Diff line
		@@ -5,6 +5,7 @@ use UnicaenAuth\Service\ShibService;
		use UnicaenAuth\Service\ShibServiceFactory;
		use UnicaenAuth\Service\UserContextFactory;
		use UnicaenAuth\View\Helper\ShibConnectViewHelperFactory;
		use UnicaenAuth\View\Helper\UserUsurpationHelperFactory;

		$settings = [
		/**
		@@ -122,7 +123,6 @@ return [
		['controller' => 'UnicaenApp\Controller\Application', 'action' => 'informatique-et-libertes', 'roles' => []],
		['controller' => 'UnicaenApp\Controller\Application', 'action' => 'refresh-session', 'roles' => []],
		['controller' => 'UnicaenAuth\Controller\Utilisateur', 'action' => 'selectionner-profil', 'roles' => []],
		['controller' => 'UnicaenAuth\Controller\Utilisateur', 'action' => 'usurper-identite', 'roles' => []],

		['controller' => 'UnicaenAuth\Controller\Auth', 'action' => 'shibboleth', 'roles' => []],
		],
		@@ -433,6 +433,7 @@ return [
		'userInfo' => 'UnicaenAuth\View\Helper\UserInfoFactory',
		'userProfileSelect' => 'UnicaenAuth\View\Helper\UserProfileSelectFactory',
		'userProfileSelectRadioItem' => 'UnicaenAuth\View\Helper\UserProfileSelectRadioItemFactory',
		'userUsurpation' => UserUsurpationHelperFactory::class,
		'shibConnect' => ShibConnectViewHelperFactory::class,
		],
		'invokables' => [

src/UnicaenAuth/Authentication/Storage/Shib.php

+45 −3

Original line number	Diff line number	Diff line
		@@ -51,15 +51,57 @@ class Shib implements ChainableStorage, ServiceLocatorAwareInterface
		*/
		public function read(ChainEvent $e)
		{
		/** @var ShibService $shib */
		$shib = $this->getServiceLocator()->get(ShibService::class);
		$shibUser = $shib->getAuthenticatedUser();
		$shibUser = $this->getAuthenticatedUser();

		$e->addContents('shib', $shibUser);

		return $shibUser;
		}

		/**
		* @return null\|ShibUser
		*/
		private function getAuthenticatedUser()
		{
		if (! $this->isShibbolethEnabled()) {
		return null;
		}

		if (null !== $this->resolvedIdentity) {
		return $this->resolvedIdentity;
		}

		/** @var ShibService $shib */
		$shib = $this->getServiceLocator()->get(ShibService::class);

		$this->resolvedIdentity = $shib->getAuthenticatedUser();

		return $this->resolvedIdentity;
		}

		/**
		* @return bool
		*/
		private function isShibbolethEnabled()
		{
		$options = $this->getModuleOptions();
		$shibboleth = $options->getShibboleth();

		return isset($shibboleth['enable']) && (bool) $shibboleth['enable'];
		}

		/**
		* @return ModuleOptions
		*/
		private function getModuleOptions()
		{
		if (null === $this->options) {
		$this->options = $this->getServiceLocator()->get('unicaen-auth_module_options');
		}

		return $this->options;
		}

		/**
		* Writes $contents to storage
		*

src/UnicaenAuth/Controller/AuthController.php

+17 −6

Original line number	Diff line number	Diff line
		@@ -3,6 +3,7 @@
		namespace UnicaenAuth\Controller;

		use UnicaenApp\Exception\RuntimeException;
		use UnicaenAuth\Service\ShibService;
		use UnicaenAuth\Service\Traits\ShibServiceAwareTrait;
		use UnicaenAuth\Service\Traits\UserServiceAwareTrait;
		use Zend\Authentication\AuthenticationService;
		@@ -23,6 +24,16 @@ class AuthController extends AbstractActionController
		use UserServiceAwareTrait;

		/**
		* Cette action n'est exécutée qu'une fois l'authentification Shibboleth réalisée avec succès.
		*
		* Lorsque l'authentification Shibboleth est activée (unicaen-auth.shibboleth.enable === true),
		* et que la config Apache est correcte, une requête à l'adresse correspondant à cette action
		* (suite au clic sur le bouton "Authentification Shibboleth, typiquement)
		* est détournée pour réaliser l'authentification.
		* Ce n'est qu'une fois l'authentification réalisée avec succès que cette action entre en jeu.
		*
		* @see ShibService::apacheConfigSnippet()
		*
		* @return Response\|array
		*/
		public function shibbolethAction()
		@@ -36,9 +47,14 @@ class AuthController extends AbstractActionController
		$this->zfcUserAuthentication()->getAuthService()->clearIdentity();

		// déconnexion Shibboleth le cas échéant
		if ($this->shibService->isShibbolethEnable()) {
		if ($this->shibService->isShibbolethEnabled()) {
		// désactivation de l'usurpation d'identité éventuelle
		$this->shibService->deactivateUsurpation();

		// URL par défaut vers laquelle on redirige après déconnexion : accueil
		$homeUrl = $this->url()->fromRoute('home', [], ['force_canonical' => true]);
		$returnAbsoluteUrl = $this->params()->fromQuery('return', $homeUrl);

		return $this->redirect()->toUrl($this->shibService->getLogoutUrl($returnAbsoluteUrl));
		} else {
		return []; // une page d'aide s'affichera
		@@ -65,9 +81,4 @@ class AuthController extends AbstractActionController

		return $this->redirect()->toUrl($redirectUrl);
		}

		public function shibboleth()
		{

		}
		}
		No newline at end of file

src/UnicaenAuth/Controller/UtilisateurController.php

+0 −64

Original line number	Diff line number	Diff line
		@@ -2,78 +2,14 @@

		namespace UnicaenAuth\Controller;

		use UnicaenAuth\Entity\Db\UserInterface;
		use UnicaenAuth\Entity\Ldap\People;
		use UnicaenAuth\Entity\Shibboleth\ShibUser;
		use UnicaenAuth\Options\ModuleOptions;
		use Zend\Authentication\AuthenticationService;
		use Zend\Http\Request;
		use Zend\Http\Response;
		use Zend\Mvc\Controller\AbstractActionController;

		/**
		*
		*
		* @author Bertrand GAUTHIER <bertrand.gauthier at unicaen.fr>
		*/
		class UtilisateurController extends AbstractActionController
		{
		/**
		* Usurpe l'identité d'un autre utilisateur.
		*
		* @return Response
		*/
		public function usurperIdentiteAction()
		{
		$request = $this->getRequest();
		if (! $request instanceof Request) {
		exit(1);
		}

		$redirection = $this->redirect()->toRoute('home');

		$newIdentity = $request->getQuery('identity', $request->getPost('identity'));
		if (! $newIdentity) {
		return $redirection;
		}

		/** @var AuthenticationService $authenticationService */
		$authenticationService = $this->getServiceLocator()->get(AuthenticationService::class);

		/** @var ModuleOptions $options */
		$options = $this->getServiceLocator()->get('unicaen-auth_module_options');

		$currentIdentity = $authenticationService->getIdentity();
		if (! $currentIdentity) {
		return $redirection;
		}
		if (! is_array($currentIdentity)) {
		return $redirection;
		}

		if (isset($currentIdentity['shib'])) {
		/** @var ShibUser $currentIdentity */
		$currentIdentity = $currentIdentity['shib'];
		} elseif (isset($currentIdentity['ldap'])) {
		/** @var People $currentIdentity */
		$currentIdentity = $currentIdentity['ldap'];
		} elseif (isset($currentIdentity['db'])) {
		/** @var UserInterface $currentIdentity */
		$currentIdentity = $currentIdentity['db'];
		} else {
		return $redirection;
		}

		$currentIdentity = $currentIdentity->getUsername();
		if (! in_array($currentIdentity, $options->getUsurpationAllowedUsernames())) {
		return $redirection;
		}

		$authenticationService->getStorage()->write($newIdentity);

		return $redirection;
		}

		/**
		* Traite les requêtes AJAX POST de sélection d'un profil utilisateur.
		* La sélection est mémorisé en session par le service AuthUserContext.

src/UnicaenAuth/Entity/Shibboleth/ShibUser.php

+10 −0

Original line number	Diff line number	Diff line
		@@ -55,6 +55,16 @@ class ShibUser implements UserInterface
		return $this->getUsername();
		}

		/**
		* Set eduPersoPrincipalName (EPPN).
		*
		* @param string $eppn eduPersoPrincipalName (EPPN), ex: 'gauthierb@unicaen.fr'
		*/
		public function setEppn($eppn)
		{
		$this->setUsername($eppn);
		}

		/**
		* Get id.
		*