├── .markdownlintignore
├── conformance-tests
    ├── basic-skips.json
    ├── basic-warnings.json
    ├── implicit-skips.json
    ├── implicit-warnings.json
    ├── sample-warnings.json
    ├── conformance-basic-deployed.json
    └── conformance-basic-local.json
├── .markdownlint.yml
├── docker
    ├── nginx-certs
    │   ├── expiration
    │   ├── default.key
    │   └── README.md
    ├── ssp
    │   ├── oidc_module.crt
    │   ├── config-override.php
    │   ├── oidc_module.key
    │   └── authsources.php
    ├── apache-override.cf
    ├── Dockerfile
    └── docker-compose.yml
├── docs
    ├── oidc.png
    └── 7-oidc-faq.md
├── .gitignore
├── src
    ├── Exceptions
    │   ├── OidcException.php
    │   └── AuthorizationException.php
    ├── Codebooks
    │   ├── ParametersEnum.php
    │   ├── DateFormatsEnum.php
    │   ├── LimitsEnum.php
    │   ├── RegistrationTypeEnum.php
    │   └── RoutesEnum.php
    ├── Server
    │   ├── Grants
    │   │   └── Interfaces
    │   │   │   ├── OidcCapableGrantTypeInterface.php
    │   │   │   ├── PkceEnabledGrantTypeInterface.php
    │   │   │   └── AuthorizationValidatableWithRequestRules.php
    │   ├── ResponseTypes
    │   │   └── Interfaces
    │   │   │   ├── AcrResponseTypeInterface.php
    │   │   │   ├── SessionIdResponseTypeInterface.php
    │   │   │   ├── NonceResponseTypeInterface.php
    │   │   │   └── AuthTimeResponseTypeInterface.php
    │   ├── TokenIssuers
    │   │   └── AbstractTokenIssuer.php
    │   ├── RequestRules
    │   │   ├── Interfaces
    │   │   │   ├── ResultInterface.php
    │   │   │   ├── ResultBagInterface.php
    │   │   │   └── RequestRuleInterface.php
    │   │   ├── Rules
    │   │   │   ├── AbstractRule.php
    │   │   │   ├── AddClaimsToIdTokenRule.php
    │   │   │   ├── UiLocalesRule.php
    │   │   │   ├── StateRule.php
    │   │   │   ├── ResponseTypeRule.php
    │   │   │   ├── RequiredNonceRule.php
    │   │   │   ├── RequiredOpenIdScopeRule.php
    │   │   │   ├── CodeVerifierRule.php
    │   │   │   ├── ScopeOfflineAccessRule.php
    │   │   │   └── RedirectUriRule.php
    │   │   ├── Result.php
    │   │   └── ResultBag.php
    │   └── Associations
    │   │   ├── Interfaces
    │   │       └── RelyingPartyAssociationInterface.php
    │   │   └── RelyingPartyAssociation.php
    ├── Utils
    │   ├── FederationCache.php
    │   ├── ProtocolCache.php
    │   ├── ClassInstanceBuilder.php
    │   ├── JwksResolver.php
    │   └── FingerprintGenerator.php
    ├── Bridges
    │   ├── SspBridge
    │   │   ├── Auth
    │   │   │   └── Source.php
    │   │   ├── Module
    │   │   │   └── Admin.php
    │   │   ├── Auth.php
    │   │   ├── Module.php
    │   │   └── Utils.php
    │   ├── SspBridge.php
    │   └── PsrHttpBridge.php
    ├── Entities
    │   ├── Interfaces
    │   │   ├── EntityStringRepresentationInterface.php
    │   │   ├── TokenRevokableInterface.php
    │   │   ├── AccessTokenEntityInterface.php
    │   │   ├── RefreshTokenEntityInterface.php
    │   │   ├── AuthCodeEntityInterface.php
    │   │   ├── TokenAssociatableWithAuthCodeInterface.php
    │   │   ├── ScopeInterface.php
    │   │   ├── ClaimSetInterface.php
    │   │   ├── ClaimSetEntityInterface.php
    │   │   ├── MementoInterface.php
    │   │   └── ClientEntityInterface.php
    │   ├── Traits
    │   │   ├── AssociateWithAuthCodeTrait.php
    │   │   ├── OidcAuthCodeTrait.php
    │   │   └── RevokeTokenTrait.php
    │   ├── ClaimSetEntity.php
    │   ├── ScopeEntity.php
    │   ├── RefreshTokenEntity.php
    │   └── UserEntity.php
    ├── Factories
    │   ├── Entities
    │   │   ├── ClaimSetEntityFactory.php
    │   │   ├── ScopeEntityFactory.php
    │   │   ├── UserEntityFactory.php
    │   │   └── RefreshTokenEntityFactory.php
    │   ├── CryptKeyFactory.php
    │   ├── ProcessingChainFactory.php
    │   ├── ResourceServerFactory.php
    │   ├── CoreFactory.php
    │   ├── JwksFactory.php
    │   ├── IdTokenResponseFactory.php
    │   ├── Grant
    │   │   ├── RefreshTokenGrantFactory.php
    │   │   └── ImplicitGrantFactory.php
    │   ├── FormFactory.php
    │   ├── AuthSimpleFactory.php
    │   └── FederationFactory.php
    ├── Stores
    │   └── Session
    │   │   ├── LogoutTicketStoreInterface.php
    │   │   └── LogoutTicketStoreBuilder.php
    ├── Repositories
    │   ├── Interfaces
    │   │   ├── AuthCodeRepositoryInterface.php
    │   │   ├── RefreshTokenRepositoryInterface.php
    │   │   ├── IdentityProviderInterface.php
    │   │   └── AccessTokenRepositoryInterface.php
    │   ├── AbstractDatabaseRepository.php
    │   └── CodeChallengeVerifiersRepository.php
    ├── Admin
    │   ├── Menu
    │   │   └── Item.php
    │   ├── Menu.php
    │   └── Authorization.php
    ├── Helpers
    │   ├── DateTime.php
    │   ├── Random.php
    │   ├── Str.php
    │   ├── Scope.php
    │   ├── Client.php
    │   ├── Http.php
    │   └── Arr.php
    ├── Services
    │   ├── StateService.php
    │   ├── SessionMessagesService.php
    │   ├── ErrorResponder.php
    │   └── LogoutTokenBuilder.php
    ├── Controllers
    │   ├── ConfigurationDiscoveryController.php
    │   ├── JwksController.php
    │   └── Traits
    │   │   └── RequestTrait.php
    ├── Helpers.php
    └── Forms
    │   └── Controls
    │       └── CsrfProtection.php
├── tests
    ├── unit
    │   └── src
    │   │   ├── Services
    │   │       ├── IdTokenBuilderTest.php
    │   │       ├── SessionServiceTest.php
    │   │       ├── StateServiceTest.php
    │   │       └── SessionMessagesServiceTest.php
    │   │   ├── Factories
    │   │       ├── AuthSimpleFactoryTest.php
    │   │       └── FormFactoryTest.php
    │   │   ├── Server
    │   │       ├── AuthorizationServerTest.php
    │   │       ├── RequestTypes
    │   │       │   └── AuthorizationRequestTest.php
    │   │       ├── RequestRules
    │   │       │   ├── ResultTest.php
    │   │       │   └── ResultBagTest.php
    │   │       └── Associations
    │   │       │   └── RelyingPartyAssociationTest.php
    │   │   ├── Bridges
    │   │       ├── SspBridge
    │   │       │   ├── Auth
    │   │       │   │   └── SourceTest.php
    │   │       │   ├── AuthTest.php
    │   │       │   ├── Module
    │   │       │   │   └── AdminTest.php
    │   │       │   ├── ModuleTest.php
    │   │       │   └── UtilsTest.php
    │   │       └── SspBridgeTest.php
    │   │   ├── Entities
    │   │       ├── ClaimSetEntityTest.php
    │   │       └── ScopeEntityTest.php
    │   │   ├── Codebooks
    │   │       └── RegistrationTypeEnumTest.php
    │   │   ├── Helpers
    │   │       ├── StrTest.php
    │   │       ├── RandomTest.php
    │   │       ├── DateTimeTest.php
    │   │       ├── ScopeTest.php
    │   │       └── ArrTest.php
    │   │   ├── Stores
    │   │       └── Session
    │   │       │   ├── LogoutTicketStoreBuilderTest.php
    │   │       │   └── LogoutTicketStoreDbTest.php
    │   │   ├── HelpersTest.php
    │   │   ├── Admin
    │   │       ├── Menu
    │   │       │   └── ItemTest.php
    │   │       └── MenuTest.php
    │   │   └── Repositories
    │   │       ├── CodeChallengeVerifiersRepositoryTest.php
    │   │       └── AbstractDatabaseRepositoryTest.php
    └── bootstrap.php
├── templates
    ├── includes
    │   └── menu.twig
    ├── logout.twig
    ├── clients
    │   ├── add.twig
    │   └── edit.twig
    ├── config
    │   └── migrations.twig
    └── base.twig
├── .github
    └── workflows
    │   ├── sonar.yml
    │   └── documentation.yml
├── public
    ├── jwks.php
    ├── logout.php
    ├── userinfo.php
    ├── token.php
    ├── authorize.php
    ├── openid-configuration.php
    └── assets
    │   ├── js
    │       └── src
    │       │   ├── default.js
    │       │   └── client-form.js
    │   └── css
    │       └── src
    │           └── default.css
├── README.md
├── phpunit.xml
├── phpunit.integration.xml
├── rector.php
├── bin
    └── install.php
├── LICENSE
├── phpcs.xml
├── .php_cs.dist
├── hooks
    ├── hook_federationpage.php
    └── hook_adminmenu.php
└── psalm.xml


/.markdownlintignore:
--------------------------------------------------------------------------------
1 | vendor/*


--------------------------------------------------------------------------------
/conformance-tests/basic-skips.json:
--------------------------------------------------------------------------------
1 | [
2 | ]


--------------------------------------------------------------------------------
/conformance-tests/basic-warnings.json:
--------------------------------------------------------------------------------
1 | [
2 | ]


--------------------------------------------------------------------------------
/conformance-tests/implicit-skips.json:
--------------------------------------------------------------------------------
1 | [
2 | ]


--------------------------------------------------------------------------------
/conformance-tests/implicit-warnings.json:
--------------------------------------------------------------------------------
1 | [
2 | ]


--------------------------------------------------------------------------------
/.markdownlint.yml:
--------------------------------------------------------------------------------
1 | ---
2 | default: true
3 | 
4 | MD013: false


--------------------------------------------------------------------------------
/docker/nginx-certs/expiration:
--------------------------------------------------------------------------------
1 | notAfter=Feb 28 22:58:22 2022 GMT
2 | 


--------------------------------------------------------------------------------
/docs/oidc.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/simplesamlphp/simplesamlphp-module-oidc/HEAD/docs/oidc.png


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | /build/
2 | /vendor/
3 | /.php_cs.cache
4 | /composer.lock
5 | /phpunit.yml
6 | .phpunit.result.cache
7 | /.idea/
8 | *~


--------------------------------------------------------------------------------
/src/Exceptions/OidcException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Exceptions;
 6 | 
 7 | class OidcException extends \Exception
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Codebooks/ParametersEnum.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Codebooks;
 6 | 
 7 | enum ParametersEnum: string
 8 | {
 9 |     case ClientId = 'client_id';
10 | }
11 | 


--------------------------------------------------------------------------------
/src/Codebooks/DateFormatsEnum.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Codebooks;
 6 | 
 7 | enum DateFormatsEnum: string
 8 | {
 9 |     case DB_DATETIME = 'Y-m-d H:i:s';
10 | }
11 | 


--------------------------------------------------------------------------------
/src/Codebooks/LimitsEnum.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Codebooks;
 6 | 
 7 | enum LimitsEnum: string
 8 | {
 9 |     case OneOf = 'one_of';
10 |     case AllOf = 'all_of';
11 | }
12 | 


--------------------------------------------------------------------------------
/src/Server/Grants/Interfaces/OidcCapableGrantTypeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\Grants\Interfaces;
 6 | 
 7 | interface OidcCapableGrantTypeInterface
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Server/Grants/Interfaces/PkceEnabledGrantTypeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\Grants\Interfaces;
 6 | 
 7 | interface PkceEnabledGrantTypeInterface
 8 | {
 9 | }
10 | 


--------------------------------------------------------------------------------
/src/Utils/FederationCache.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Utils;
 6 | 
 7 | use SimpleSAML\OpenID\Decorators\CacheDecorator;
 8 | 
 9 | class FederationCache extends CacheDecorator
10 | {
11 | }
12 | 


--------------------------------------------------------------------------------
/src/Utils/ProtocolCache.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Utils;
 6 | 
 7 | use SimpleSAML\OpenID\Decorators\CacheDecorator;
 8 | 
 9 | class ProtocolCache extends CacheDecorator
10 | {
11 | }
12 | 


--------------------------------------------------------------------------------
/src/Exceptions/AuthorizationException.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Exceptions;
 6 | 
 7 | use SimpleSAML\Module\oidc\Exceptions\OidcException;
 8 | 
 9 | class AuthorizationException extends OidcException
10 | {
11 | }
12 | 


--------------------------------------------------------------------------------
/docker/nginx-certs/default.key:
--------------------------------------------------------------------------------
1 | -----BEGIN PRIVATE KEY-----
2 | MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgTVrOmRapta1bw8iJ
3 | p4e0OhYa2uwz7iIiYsaGQuhqQDKhRANCAAR5+hHn4t/Fz/XNz/iPZm4JCZfb+A1r
4 | 2h49AY2zE0bQfvrjMdUt1fSjL363d1iUE2RyQua44PZvET/DHqKMwRm7
5 | -----END PRIVATE KEY-----
6 | 


--------------------------------------------------------------------------------
/src/Bridges/SspBridge/Auth/Source.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges\SspBridge\Auth;
 6 | 
 7 | class Source
 8 | {
 9 |     public function getSources(): array
10 |     {
11 |         return \SimpleSAML\Auth\Source::getSources();
12 |     }
13 | }
14 | 


--------------------------------------------------------------------------------
/src/Server/ResponseTypes/Interfaces/AcrResponseTypeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\ResponseTypes\Interfaces;
 6 | 
 7 | interface AcrResponseTypeInterface
 8 | {
 9 |     public function setAcr(?string $acr): void;
10 | 
11 |     public function getAcr(): ?string;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/Bridges/SspBridge/Module/Admin.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges\SspBridge\Module;
 6 | 
 7 | use SimpleSAML\Module\admin\Controller\Menu;
 8 | 
 9 | class Admin
10 | {
11 |     public function buildSspAdminMenu(): Menu
12 |     {
13 |         return new Menu();
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/EntityStringRepresentationInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | interface EntityStringRepresentationInterface
 8 | {
 9 |     /**
10 |      * Generate string representation of entity.
11 |      */
12 |     public function toString(): ?string;
13 | }
14 | 


--------------------------------------------------------------------------------
/src/Server/ResponseTypes/Interfaces/SessionIdResponseTypeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\ResponseTypes\Interfaces;
 6 | 
 7 | interface SessionIdResponseTypeInterface
 8 | {
 9 |     public function getSessionId(): ?string;
10 | 
11 |     public function setSessionId(?string $sessionId): void;
12 | }
13 | 


--------------------------------------------------------------------------------
/src/Bridges/SspBridge/Auth.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges\SspBridge;
 6 | 
 7 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Auth\Source;
 8 | 
 9 | class Auth
10 | {
11 |     protected static ?Source $source = null;
12 | 
13 |     public function source(): Source
14 |     {
15 |         return self::$source ??= new Source();
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Factories/Entities/ClaimSetEntityFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories\Entities;
 6 | 
 7 | use SimpleSAML\Module\oidc\Entities\ClaimSetEntity;
 8 | 
 9 | class ClaimSetEntityFactory
10 | {
11 |     public function build(string $scope, array $claims): ClaimSetEntity
12 |     {
13 |         return new ClaimSetEntity($scope, $claims);
14 |     }
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Server/TokenIssuers/AbstractTokenIssuer.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\TokenIssuers;
 6 | 
 7 | use SimpleSAML\Module\oidc\Helpers;
 8 | 
 9 | abstract class AbstractTokenIssuer
10 | {
11 |     public const MAX_RANDOM_TOKEN_GENERATION_ATTEMPTS = 5;
12 | 
13 |     public function __construct(
14 |         protected readonly Helpers $helpers,
15 |     ) {
16 |     }
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/TokenRevokableInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | interface TokenRevokableInterface
 8 | {
 9 |     /**
10 |      * Check if token is revoked.
11 |      * @return bool
12 |      */
13 |     public function isRevoked(): bool;
14 | 
15 |     /**
16 |      * Revoke token
17 |      */
18 |     public function revoke(): void;
19 | }
20 | 


--------------------------------------------------------------------------------
/src/Stores/Session/LogoutTicketStoreInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Stores\Session;
 6 | 
 7 | interface LogoutTicketStoreInterface
 8 | {
 9 |     public function add(string $sid): void;
10 |     public function getAll(): array;
11 | 
12 |     /**
13 |      * @param string[] $sids
14 |      * @return void
15 |      */
16 |     public function deleteMultiple(array $sids): void;
17 | }
18 | 


--------------------------------------------------------------------------------
/tests/unit/src/Services/IdTokenBuilderTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Services;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | 
 9 | /**
10 |  * @covers \SimpleSAML\Module\oidc\Services\IdTokenBuilder
11 |  */
12 | class IdTokenBuilderTest extends TestCase
13 | {
14 |     public function testIncomplete(): never
15 |     {
16 |         $this->markTestIncomplete();
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/tests/unit/src/Services/SessionServiceTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Services;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | 
 9 | /**
10 |  * @covers \SimpleSAML\Module\oidc\Services\SessionService
11 |  */
12 | class SessionServiceTest extends TestCase
13 | {
14 |     public function testIncomplete(): never
15 |     {
16 |         $this->markTestIncomplete();
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/tests/unit/src/Factories/AuthSimpleFactoryTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Factories;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | 
 9 | /**
10 |  * @covers \SimpleSAML\Module\oidc\Factories\AuthSimpleFactory
11 |  */
12 | class AuthSimpleFactoryTest extends TestCase
13 | {
14 |     public function testIncomplete(): never
15 |     {
16 |         $this->markTestIncomplete();
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/tests/unit/src/Server/AuthorizationServerTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Server;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | 
 9 | /**
10 |  * @covers \SimpleSAML\Module\oidc\Server\AuthorizationServer
11 |  */
12 | class AuthorizationServerTest extends TestCase
13 | {
14 |     public function testValidateLogoutRequest(): never
15 |     {
16 |         $this->markTestIncomplete();
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/Server/ResponseTypes/Interfaces/NonceResponseTypeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\ResponseTypes\Interfaces;
 6 | 
 7 | interface NonceResponseTypeInterface
 8 | {
 9 |     /**
10 |      * @param string|null $nonce
11 |      */
12 |     public function setNonce(?string $nonce): void;
13 | 
14 |     /**
15 |      * @return string|null
16 |      */
17 |     public function getNonce(): ?string;
18 | }
19 | 


--------------------------------------------------------------------------------
/src/Server/ResponseTypes/Interfaces/AuthTimeResponseTypeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\ResponseTypes\Interfaces;
 6 | 
 7 | interface AuthTimeResponseTypeInterface
 8 | {
 9 |     /**
10 |      * @param int|null $authTime
11 |      */
12 |     public function setAuthTime(?int $authTime): void;
13 | 
14 |     /**
15 |      * @return int|null
16 |      */
17 |     public function getAuthTime(): ?int;
18 | }
19 | 


--------------------------------------------------------------------------------
/templates/includes/menu.twig:
--------------------------------------------------------------------------------
 1 | {% if oidcMenu|default %}
 2 |     <div class="menu">
 3 |         <ul>
 4 |             {% for item in oidcMenu.items %}
 5 |             <li>
 6 |                 <a href="{{ item.hrefPath }}"
 7 |                    class="{{ item.hrefPath == oidcMenu.activeHrefPath ? 'active' : '' }}"
 8 |                 > {{ item.label|trans }} </a>
 9 |             </li>
10 |             {% endfor %}
11 |         </ul>
12 |     </div>
13 | 
14 | 
15 | {% endif %}


--------------------------------------------------------------------------------
/docker/ssp/oidc_module.crt:
--------------------------------------------------------------------------------
1 | -----BEGIN PUBLIC KEY-----
2 | MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq2EgIfAMG2XpfjRCAUHQ
3 | QqLAbrOL4s+JwL0X3jO2imVzbBp9MadLzGQhczyhKHM0B9YumHSwNjD5hrQQso02
4 | CaGientCzhm9PqerjffZ+0B4+FfGws0ozwyfA7hW1arhBx92D8r7Hw0HHu1QwSQ2
5 | N4zlmCea7shWTC4CoO8ECJcPDYe2/wABLCPZm0dcv/sPYln7HAiukI2fxwMpf3yQ
6 | XihcQQXdHHoOncUn7QlibUQj//Zxk0obEkJAUyqxFKa+3cuToFkfSH7bGs8YnI3q
7 | y/YzmsutI3keeEIQOTNAtLgauqZ4CW+Your+9vsUXaNjNshnObNHWLPc37DJaRyA
8 | pwIDAQAB
9 | -----END PUBLIC KEY-----


--------------------------------------------------------------------------------
/src/Entities/Interfaces/AccessTokenEntityInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | // phpcs:ignoreFile
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Entities\AccessTokenEntityInterface as OAuth2AccessTokenEntityInterface;
 8 | 
 9 | interface AccessTokenEntityInterface extends
10 |     OAuth2AccessTokenEntityInterface,
11 |     TokenAssociatableWithAuthCodeInterface,
12 |     TokenRevokableInterface,
13 |     MementoInterface
14 | {
15 | }
16 | 


--------------------------------------------------------------------------------
/tests/unit/src/Server/RequestTypes/AuthorizationRequestTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Server\RequestTypes;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | 
 9 | /**
10 |  * @covers \SimpleSAML\Module\oidc\Server\RequestTypes\AuthorizationRequest
11 |  */
12 | class AuthorizationRequestTest extends TestCase
13 | {
14 |     public function testIncomplete(): never
15 |     {
16 |         $this->markTestIncomplete();
17 |     }
18 | }
19 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/RefreshTokenEntityInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | // phpcs:ignoreFile
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Entities\RefreshTokenEntityInterface as OAuth2RefreshTokenEntityInterface;
 8 | 
 9 | interface RefreshTokenEntityInterface extends
10 |     OAuth2RefreshTokenEntityInterface,
11 |     TokenAssociatableWithAuthCodeInterface,
12 |     TokenRevokableInterface,
13 |     MementoInterface
14 | {
15 | }
16 | 


--------------------------------------------------------------------------------
/src/Entities/Traits/AssociateWithAuthCodeTrait.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Traits;
 6 | 
 7 | trait AssociateWithAuthCodeTrait
 8 | {
 9 |     protected ?string $authCodeId = null;
10 | 
11 |     public function setAuthCodeId(?string $authCodeId): void
12 |     {
13 |         $this->authCodeId = $authCodeId;
14 |     }
15 | 
16 |     public function getAuthCodeId(): ?string
17 |     {
18 |         return $this->authCodeId;
19 |     }
20 | }
21 | 


--------------------------------------------------------------------------------
/conformance-tests/sample-warnings.json:
--------------------------------------------------------------------------------
 1 | [
 2 |   {
 3 |     "test-name": "oidcc-ensure-request-with-acr-values-succeeds",
 4 |     "variant": {
 5 |       "server_metadata": "discovery",
 6 |       "client_registration": "static_client"
 7 |     },
 8 |     "configuration-filename": "*",
 9 |     "current-block": "Verify authorization endpoint response",
10 |     "condition": "ValidateIdTokenACRClaimAgainstAcrValuesRequest",
11 |     "expected-result": "warning",
12 |     "comment": "Not implemented yet"
13 |   }
14 | ]


--------------------------------------------------------------------------------
/src/Entities/Interfaces/AuthCodeEntityInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Entities\AuthCodeEntityInterface as OAuth2AuthCodeEntityInterface;
 8 | 
 9 | interface AuthCodeEntityInterface extends OAuth2AuthCodeEntityInterface
10 | {
11 |     /**
12 |      * @return string|null
13 |      */
14 |     public function getNonce(): ?string;
15 | 
16 |     public function setNonce(string $nonce): void;
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/TokenAssociatableWithAuthCodeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | interface TokenAssociatableWithAuthCodeInterface
 8 | {
 9 |     /**
10 |      * @param string|null $authCodeId Set to auth_code_id or null to unset it.
11 |      */
12 |     public function setAuthCodeId(?string $authCodeId): void;
13 | 
14 |     /**
15 |      * @return string|null
16 |      */
17 |     public function getAuthCodeId(): ?string;
18 | }
19 | 


--------------------------------------------------------------------------------
/src/Repositories/Interfaces/AuthCodeRepositoryInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Repositories\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Repositories\AuthCodeRepositoryInterface as OAuth2AuthCodeRepositoryInterface;
 8 | use SimpleSAML\Module\oidc\Entities\Interfaces\AuthCodeEntityInterface;
 9 | 
10 | interface AuthCodeRepositoryInterface extends OAuth2AuthCodeRepositoryInterface
11 | {
12 |     /**
13 |      * Creates a new AuthCode
14 |      */
15 |     public function getNewAuthCode(): AuthCodeEntityInterface;
16 | }
17 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Interfaces/ResultInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Interfaces;
 6 | 
 7 | interface ResultInterface
 8 | {
 9 |     /**
10 |      * Get result key.
11 |      * @return string
12 |      */
13 |     public function getKey(): string;
14 | 
15 |     /**
16 |      * Get result value.
17 |      * @return mixed
18 |      */
19 |     public function getValue(): mixed;
20 | 
21 |     /**
22 |      * Set (new) value.
23 |      */
24 |     public function setValue(mixed $value): void;
25 | }
26 | 


--------------------------------------------------------------------------------
/src/Codebooks/RegistrationTypeEnum.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Codebooks;
 6 | 
 7 | use SimpleSAML\Locale\Translate;
 8 | 
 9 | enum RegistrationTypeEnum: string
10 | {
11 |     case Manual = 'manual';
12 |     case FederatedAutomatic = 'federated_automatic';
13 | 
14 |     public function description(): string
15 |     {
16 |         return match ($this) {
17 |             self::Manual => Translate::noop('Manual'),
18 |             self::FederatedAutomatic => Translate::noop('Federated Automatic'),
19 |         };
20 |     }
21 | }
22 | 


--------------------------------------------------------------------------------
/docker/apache-override.cf:
--------------------------------------------------------------------------------
 1 | RewriteEngine On
 2 | RewriteRule ^/.well-known/openid-configuration(.*) /${SSP_APACHE_ALIAS}module.php/oidc/.well-known/openid-configuration$1 [PT]
 3 | RewriteRule ^/.well-known/openid-federation(.*) /${SSP_APACHE_ALIAS}module.php/oidc/.well-known/openid-federation$1 [PT]
 4 | 
 5 | # Leave Authorization header with Bearer tokens available in requests.
 6 | # Solution 1:
 7 | RewriteEngine On
 8 | RewriteCond %{HTTP:Authorization} .+
 9 | RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
10 | # Solution 2:
11 | #SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
12 | 
13 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/ScopeInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | /**
 8 |  * This file contains modified code from the 'steverhoades/oauth2-openid-connect-server' library
 9 |  * (https://github.com/steverhoades/oauth2-openid-connect-server), with original author, copyright notice and licence:
10 |  * @author Steve Rhoades <sedonami@gmail.com>
11 |  * @copyright (c) 2018 Steve Rhoades <sedonami@gmail.com>
12 |  * @license http://opensource.org/licenses/MIT MIT
13 |  */
14 | interface ScopeInterface
15 | {
16 |     public function getScope(): string;
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/ClaimSetInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | /**
 8 |  * This file contains modified code from the 'steverhoades/oauth2-openid-connect-server' library
 9 |  * (https://github.com/steverhoades/oauth2-openid-connect-server), with original author, copyright notice and licence:
10 |  * @author Steve Rhoades <sedonami@gmail.com>
11 |  * @copyright (c) 2018 Steve Rhoades <sedonami@gmail.com>
12 |  * @license http://opensource.org/licenses/MIT MIT
13 |  */
14 | interface ClaimSetInterface
15 | {
16 |     public function getClaims(): array;
17 | }
18 | 


--------------------------------------------------------------------------------
/src/Entities/Traits/OidcAuthCodeTrait.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Traits;
 6 | 
 7 | use League\OAuth2\Server\Entities\Traits\AuthCodeTrait;
 8 | 
 9 | trait OidcAuthCodeTrait
10 | {
11 |     use AuthCodeTrait;
12 | 
13 |     /**
14 |      * @var null|string
15 |      */
16 |     protected ?string $nonce = null;
17 | 
18 |     /**
19 |      * @inheritDoc
20 |      */
21 |     public function getNonce(): ?string
22 |     {
23 |         return $this->nonce;
24 |     }
25 | 
26 |     public function setNonce(string $nonce): void
27 |     {
28 |         $this->nonce = $nonce;
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/ClaimSetEntityInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | /**
 8 |  * This file contains modified code from the 'steverhoades/oauth2-openid-connect-server' library
 9 |  * (https://github.com/steverhoades/oauth2-openid-connect-server), with original author, copyright notice and licence:
10 |  * @author Steve Rhoades <sedonami@gmail.com>
11 |  * @copyright (c) 2018 Steve Rhoades <sedonami@gmail.com>
12 |  * @license http://opensource.org/licenses/MIT MIT
13 |  */
14 | interface ClaimSetEntityInterface extends ClaimSetInterface, ScopeInterface
15 | {
16 | }
17 | 


--------------------------------------------------------------------------------
/.github/workflows/sonar.yml:
--------------------------------------------------------------------------------
 1 | name: SonarQube Scan
 2 | on:
 3 |   push:
 4 |     branches:
 5 |       - master
 6 | jobs:
 7 |   sonar:
 8 |     runs-on: ubuntu-latest
 9 |     continue-on-error: true
10 |     steps:
11 |       - uses: actions/checkout@v4
12 |       - name: SonarQube Scan
13 |         uses: SonarSource/sonarqube-scan-action@v2
14 |         env:
15 |           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
16 |           SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
17 |         with:
18 |           args: >
19 |             -Dsonar.projectKey=${{ github.event.repository.name }}
20 |             -Dsonar.projectName=${{ github.event.repository.name }}


--------------------------------------------------------------------------------
/tests/unit/src/Bridges/SspBridge/Auth/SourceTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Bridges\SspBridge\Auth;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Auth\Source;
10 | 
11 | #[CoversClass(Source::class)]
12 | class SourceTest extends TestCase
13 | {
14 |     protected function sut(): Source
15 |     {
16 |         return new Source();
17 |     }
18 | 
19 |     public function testCanGetSources(): void
20 |     {
21 |         $this->assertTrue(in_array('admin', $this->sut()->getSources()));
22 |     }
23 | }
24 | 


--------------------------------------------------------------------------------
/src/Admin/Menu/Item.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Admin\Menu;
 6 | 
 7 | class Item
 8 | {
 9 |     public function __construct(
10 |         protected string $hrefPath,
11 |         protected string $label,
12 |         protected ?string $iconAssetPath = null,
13 |     ) {
14 |     }
15 | 
16 |     public function getHrefPath(): string
17 |     {
18 |         return $this->hrefPath;
19 |     }
20 | 
21 |     public function getLabel(): string
22 |     {
23 |         return $this->label;
24 |     }
25 | 
26 |     public function getIconAssetPath(): ?string
27 |     {
28 |         return $this->iconAssetPath;
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/src/Factories/Entities/ScopeEntityFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories\Entities;
 6 | 
 7 | use SimpleSAML\Module\oidc\Entities\ScopeEntity;
 8 | 
 9 | class ScopeEntityFactory
10 | {
11 |     /**
12 |      * @param string[] $claims
13 |      */
14 |     public function fromData(
15 |         string $identifier,
16 |         ?string $description = null,
17 |         ?string $icon = null,
18 |         array $claims = [],
19 |     ): ScopeEntity {
20 |         return new ScopeEntity(
21 |             $identifier,
22 |             $description,
23 |             $icon,
24 |             $claims,
25 |         );
26 |     }
27 | }
28 | 


--------------------------------------------------------------------------------
/docker/nginx-certs/README.md:
--------------------------------------------------------------------------------
 1 | # Certificates
 2 | 
 3 | Every 90 days these certificates expire. The upstream project/container
 4 | will refresh its certs occasionally, and we can sync them here.
 5 | 
 6 | ```bash
 7 | docker pull cirrusid/simplesamlphp:latest
 8 | docker run -v $PWD:/opt/tmp/certs cirrusid/simplesamlphp /bin/bash -c \
 9 | 'cp /etc/ssl/certs/${APACHE_CERT_NAME}.key /opt/tmp/certs/default.crt && 
10 | cp /etc/ssl/private/${APACHE_CERT_NAME}.key /opt/tmp/certs/default.key && 
11 | openssl x509 -noout -enddate -in /opt/tmp/certs/default.crt > 
12 | /opt/tmp/certs/expiration'
13 | ```
14 | 
15 | The file `expiration` will get updated with the current expiration date of
16 | the certificates.
17 | 


--------------------------------------------------------------------------------
/public/jwks.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Module\oidc\Controllers\JwksController;
18 | use SimpleSAML\Module\oidc\Services\RoutingService;
19 | 
20 | RoutingService::call(JwksController::class, false, true);
21 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # SimpleSAMLphp Module OIDC
 2 | 
 3 | > A SimpleSAMLphp module for OIDC OP support.
 4 | 
 5 | [![Build Status](https://github.com/simplesamlphp/simplesamlphp-module-oidc/actions/workflows/test.yaml/badge.svg)](https://github.com/simplesamlphp/simplesamlphp-module-oidc/actions/workflows/test.yaml)
 6 | [![Coverage Status](https://codecov.io/gh/simplesamlphp/simplesamlphp-module-oidc/branch/master/graph/badge.svg)](https://app.codecov.io/gh/simplesamlphp/simplesamlphp-module-oidc)
 7 | [![SimpleSAMLphp](https://img.shields.io/badge/simplesamlphp-2.3-brightgreen)](https://simplesamlphp.org/)
 8 | 
 9 | ![Main screen capture](docs/oidc.png)
10 | 
11 | To get started, refer to module [documentation](docs/1-oidc.md).
12 | 


--------------------------------------------------------------------------------
/public/logout.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Module\oidc\Controllers\EndSessionController;
18 | use SimpleSAML\Module\oidc\Services\RoutingService;
19 | 
20 | RoutingService::call(EndSessionController::class, false, true);
21 | 


--------------------------------------------------------------------------------
/public/userinfo.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Module\oidc\Controllers\UserInfoController;
18 | use SimpleSAML\Module\oidc\Services\RoutingService;
19 | 
20 | RoutingService::call(UserInfoController::class, false, true);
21 | 


--------------------------------------------------------------------------------
/src/Helpers/DateTime.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | use DateTimeImmutable;
 8 | use DateTimeZone;
 9 | 
10 | class DateTime
11 | {
12 |     public function getUtc(string $time = 'now'): DateTimeImmutable
13 |     {
14 |         return new DateTimeImmutable($time, new DateTimeZone('UTC'));
15 |     }
16 | 
17 |     public function getFromTimestamp(int $timestamp): DateTimeImmutable
18 |     {
19 |         return $this->getUtc()->setTimestamp($timestamp);
20 |     }
21 | 
22 |     public function getSecondsToExpirationTime(int $expirationTime): int
23 |     {
24 |         return $expirationTime - $this->getUtc()->getTimestamp();
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/public/token.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Module\oidc\Controllers\AccessTokenController;
18 | use SimpleSAML\Module\oidc\Services\RoutingService;
19 | 
20 | RoutingService::call(AccessTokenController::class, false, true);
21 | 


--------------------------------------------------------------------------------
/src/Server/Associations/Interfaces/RelyingPartyAssociationInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\Associations\Interfaces;
 6 | 
 7 | interface RelyingPartyAssociationInterface
 8 | {
 9 |     public function getClientId(): string;
10 |     public function setClientId(string $clientId): void;
11 |     public function getUserId(): string;
12 |     public function setUserId(string $userId): void;
13 |     public function getSessionId(): ?string;
14 |     public function setSessionId(?string $sessionId): void;
15 |     public function getBackChannelLogoutUri(): ?string;
16 |     public function setBackChannelLogoutUri(?string $backChannelLogoutUri): void;
17 | }
18 | 


--------------------------------------------------------------------------------
/public/authorize.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Module\oidc\Controllers\AuthorizationController;
18 | use SimpleSAML\Module\oidc\Services\RoutingService;
19 | 
20 | RoutingService::call(AuthorizationController::class, false, true);
21 | 


--------------------------------------------------------------------------------
/tests/unit/src/Entities/ClaimSetEntityTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Entities;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Entities\ClaimSetEntity;
10 | 
11 | #[CoversClass(ClaimSetEntity::class)]
12 | class ClaimSetEntityTest extends TestCase
13 | {
14 |     public function testCanCreateInstance(): void
15 |     {
16 |         $sut = new ClaimSetEntity('scope', ['claim']);
17 | 
18 |         $this->assertInstanceOf(ClaimSetEntity::class, $sut);
19 |         $this->assertSame('scope', $sut->getScope());
20 |         $this->assertSame(['claim'], $sut->getClaims());
21 |     }
22 | }
23 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/MementoInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
17 | 
18 | interface MementoInterface
19 | {
20 |     /**
21 |      * @return array
22 |      */
23 |     public function getState(): array;
24 | }
25 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/AbstractRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use SimpleSAML\Module\oidc\Helpers;
 8 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\RequestRuleInterface;
 9 | use SimpleSAML\Module\oidc\Utils\RequestParamsResolver;
10 | 
11 | abstract class AbstractRule implements RequestRuleInterface
12 | {
13 |     public function __construct(
14 |         protected RequestParamsResolver $requestParamsResolver,
15 |         protected Helpers $helpers,
16 |     ) {
17 |     }
18 | 
19 |     /**
20 |      * @inheritDoc
21 |      */
22 |     public function getKey(): string
23 |     {
24 |         return static::class;
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/public/openid-configuration.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Module\oidc\Controllers\ConfigurationDiscoveryController;
18 | use SimpleSAML\Module\oidc\Services\RoutingService;
19 | 
20 | RoutingService::call(ConfigurationDiscoveryController::class, false, true);
21 | 


--------------------------------------------------------------------------------
/src/Utils/ClassInstanceBuilder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Utils;
 6 | 
 7 | use ReflectionClass;
 8 | use SimpleSAML\Module\oidc\Exceptions\OidcException;
 9 | 
10 | class ClassInstanceBuilder
11 | {
12 |     /**
13 |      * @throws \SimpleSAML\Module\oidc\Exceptions\OidcException
14 |      * @throws \ReflectionException
15 |      */
16 |     public function build(string $class, array $args): mixed
17 |     {
18 |         if (!class_exists($class)) {
19 |             $message = "Error building instance: class {$class} does not exist";
20 |             throw new OidcException($message);
21 |         }
22 | 
23 |         return (new ReflectionClass($class))->newInstance(...$args);
24 |     }
25 | }
26 | 


--------------------------------------------------------------------------------
/docker/ssp/config-override.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | $config['module.enable']['exampleauth'] = true;
 6 | $config['module.enable']['oidc'] = true;
 7 | // Have preprod warning enabled (though it may not be installed) to ease authproc redirect testing
 8 | $config['module.enable']['preprodwarning'] = true;
 9 | $config = [
10 |         'secretsalt' => 'testsalt',
11 |         'database.dsn' =>  getenv('DB.DSN') ?: 'sqlite:/var/simplesamlphp/data/mydb.sq3',
12 |         'database.username' => getenv('DB.USERNAME') ?: 'user',
13 |         'database.password' => getenv('DB.PASSWORD') ?: 'password',
14 |         'language.i18n.backend' => 'gettext/gettext',
15 |         'logging.level' => 7,
16 |         'usenewui' => false,
17 |     ] + $config;


--------------------------------------------------------------------------------
/tests/unit/src/Bridges/SspBridge/AuthTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Bridges\SspBridge;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Auth;
10 | 
11 | #[CoversClass(Auth::class)]
12 | class AuthTest extends TestCase
13 | {
14 |     protected function sut(): Auth
15 |     {
16 |         return new Auth();
17 |     }
18 | 
19 |     public function testCanConstruct(): void
20 |     {
21 |         $this->assertInstanceOf(Auth::class, $this->sut());
22 |     }
23 | 
24 |     public function testCanBuildSourceInstance(): void
25 |     {
26 |         $this->assertInstanceOf(Auth\Source::class, $this->sut()->source());
27 |     }
28 | }
29 | 


--------------------------------------------------------------------------------
/src/Repositories/Interfaces/RefreshTokenRepositoryInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Repositories\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Repositories\RefreshTokenRepositoryInterface as OAuth2RefreshTokenRepositoryInterface;
 8 | use SimpleSAML\Module\oidc\Entities\Interfaces\RefreshTokenEntityInterface;
 9 | 
10 | interface RefreshTokenRepositoryInterface extends OAuth2RefreshTokenRepositoryInterface
11 | {
12 |     /**
13 |      * Revoke refresh token(s) associated with the given auth code ID.
14 |      */
15 |     public function revokeByAuthCodeId(string $authCodeId): void;
16 | 
17 |     /**
18 |      * Creates a new refresh token
19 |      */
20 |     public function getNewRefreshToken(): ?RefreshTokenEntityInterface;
21 | }
22 | 


--------------------------------------------------------------------------------
/templates/logout.twig:
--------------------------------------------------------------------------------
 1 | {% extends "@oidc/base.twig" %}
 2 | 
 3 | {% set pagetitle = 'Logout Info' | trans %}
 4 | 
 5 | {% block oidcContent %}
 6 |     <h2>
 7 |         {% if wasLogoutActionCalled %}
 8 |             {{ 'Logout Successful'|trans }}
 9 |         {% else %}
10 |             {{ 'Logout Failed'|trans }}
11 |         {% endif %}
12 |     </h2>
13 | 
14 | 
15 |     <div>
16 |         <h3>
17 |             {{ 'Info'|trans }}
18 |         </h3>
19 |         <p>
20 |             {% if wasLogoutActionCalled %}
21 |                 {{ 'You can now close this window or navigate to another page.'|trans }}
22 |             {% else %}
23 |                 {{ 'Requested session was not found or it is expired.'|trans }}
24 |             {% endif %}
25 |         </p>
26 |     </div>
27 | 
28 | {% endblock %}
29 | 


--------------------------------------------------------------------------------
/tests/unit/src/Services/StateServiceTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Services;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use SimpleSAML\Module\oidc\Services\StateService;
 9 | 
10 | /**
11 |  * @covers \SimpleSAML\Module\oidc\Services\StateService
12 |  */
13 | class StateServiceTest extends TestCase
14 | {
15 |     /**
16 |      * @return StateService
17 |      */
18 |     protected function mock(): StateService
19 |     {
20 |         return new StateService();
21 |     }
22 | 
23 |     /**
24 |      * @return void
25 |      */
26 |     public function testItIsInitializable(): void
27 |     {
28 |         $this->assertInstanceOf(
29 |             StateService::class,
30 |             $this->mock(),
31 |         );
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Result.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules;
 6 | 
 7 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
 8 | 
 9 | class Result implements ResultInterface
10 | {
11 |     /**
12 |      * Result constructor.
13 |      * @param mixed|null $value
14 |      */
15 |     public function __construct(protected string $key, protected mixed $value = null)
16 |     {
17 |     }
18 | 
19 |     public function getKey(): string
20 |     {
21 |         return $this->key;
22 |     }
23 | 
24 |     public function getValue(): mixed
25 |     {
26 |         return $this->value;
27 |     }
28 | 
29 |     public function setValue(mixed $value): void
30 |     {
31 |         $this->value = $value;
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/tests/unit/src/Codebooks/RegistrationTypeEnumTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Codebooks;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Codebooks\RegistrationTypeEnum;
10 | 
11 | #[CoversClass(RegistrationTypeEnum::class)]
12 | class RegistrationTypeEnumTest extends TestCase
13 | {
14 |     public function testCanGetDescription(): void
15 |     {
16 |         $this->assertStringContainsString(
17 |             'Manual',
18 |             RegistrationTypeEnum::Manual->description(),
19 |         );
20 | 
21 |         $this->assertStringContainsString(
22 |             'Automatic',
23 |             RegistrationTypeEnum::FederatedAutomatic->description(),
24 |         );
25 |     }
26 | }
27 | 


--------------------------------------------------------------------------------
/templates/clients/add.twig:
--------------------------------------------------------------------------------
 1 | {% set subPageTitle = 'Add Client'|trans %}
 2 | 
 3 | {% extends "@oidc/base.twig" %}
 4 | 
 5 | {% block oidcContent %}
 6 | 
 7 |     <div class="pure-g">
 8 |         <div class="pure-u-1-2">
 9 | 
10 |         </div>
11 |         <div class="pure-u-1-2">
12 |             <div class="right">
13 |                 <a class="pure-button " href="{{ routes.urlAdminClients }}">
14 |                     <i class="fa fa-chevron-left"></i>
15 |                     {{ 'Back'|trans }}
16 |                 </a>
17 |             </div>
18 |         </div>
19 |     </div>
20 | 
21 |     {% include "@oidc/clients/includes/form.twig" %}
22 | 
23 | {% endblock oidcContent -%}
24 | 
25 | {% block postload %}
26 |     {{ parent() }}
27 | 
28 |     <script src="{{ asset('js/src/client-form.js', 'oidc') }}"></script>
29 | {% endblock %}


--------------------------------------------------------------------------------
/src/Bridges/SspBridge/Module.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges\SspBridge;
 6 | 
 7 | use SimpleSAML\Module as SspModule;
 8 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Module\Admin;
 9 | 
10 | class Module
11 | {
12 |     protected static ?SspModule\oidc\Bridges\SspBridge\Module\Admin $admin = null;
13 | 
14 |     public function admin(): Admin
15 |     {
16 |         return self::$admin ??= new Admin();
17 |     }
18 | 
19 |     public function getModuleUrl(string $resource, array $parameters = []): string
20 |     {
21 |         return SspModule::getModuleURL($resource, $parameters);
22 |     }
23 | 
24 |     /**
25 |      * @throws \Exception
26 |      */
27 |     public function isModuleEnabled(string $moduleName): bool
28 |     {
29 |         return SspModule::isModuleEnabled($moduleName);
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/tests/unit/src/Bridges/SspBridge/Module/AdminTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Bridges\SspBridge\Module;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\admin\Controller\Menu;
10 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Module\Admin;
11 | 
12 | #[CoversClass(Admin::class)]
13 | class AdminTest extends TestCase
14 | {
15 |     protected function sut(): Admin
16 |     {
17 |         return new Admin();
18 |     }
19 | 
20 |     public function testCanCreateInstance(): void
21 |     {
22 |         $this->assertInstanceOf(Admin::class, $this->sut());
23 |     }
24 | 
25 |     public function testCanBuildSspAdminMenu(): void
26 |     {
27 |         $this->assertInstanceOf(Menu::class, $this->sut()->buildSspAdminMenu());
28 |     }
29 | }
30 | 


--------------------------------------------------------------------------------
/src/Repositories/Interfaces/IdentityProviderInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Repositories\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Entities\UserEntityInterface;
 8 | use League\OAuth2\Server\Repositories\RepositoryInterface;
 9 | 
10 | /**
11 |  * This file contains modified code from the 'steverhoades/oauth2-openid-connect-server' library
12 |  * (https://github.com/steverhoades/oauth2-openid-connect-server), with original author, copyright notice and licence:
13 |  * @author Steve Rhoades <sedonami@gmail.com>
14 |  * @copyright (c) 2018 Steve Rhoades <sedonami@gmail.com>
15 |  * @license http://opensource.org/licenses/MIT MIT
16 |  */
17 | interface IdentityProviderInterface extends RepositoryInterface
18 | {
19 |     public function getUserEntityByIdentifier(string $identifier): ?UserEntityInterface;
20 | }
21 | 


--------------------------------------------------------------------------------
/conformance-tests/conformance-basic-deployed.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "server": {
 3 |         "discoveryUrl": "https://oidc-conformance.uat.cirrusidentity.com/.well-known/openid-configuration"
 4 |     },
 5 |     "client": {
 6 |         "client_id": "_55a99a1d298da921cb27d700d4604352e51171ebc4",
 7 |         "client_secret": "_8967dd97d07cc59db7055e84ac00e79005157c1132"
 8 |     },
 9 |     "client_secret_post": {
10 |         "client_id": "_0afb7d18e54b2de8205a93e38ca119e62ee321d031",
11 |         "client_secret": "_944e73bbeec7850d32b68f1b5c780562c955967e4e"
12 |     },
13 |     "client2": {
14 |         "client_id": "_34efb61060172a11d62101bc804db789f8f9100b0e",
15 |         "client_secret": "_91a4607a1c10ba801268929b961b3f6c067ff82d21"
16 |     },
17 |     "alias": "simplesamlphp-module-oidc",
18 |     "description": "Testing of simplesamlphp-module-oidc running in publicly accessible location"
19 | }


--------------------------------------------------------------------------------
/conformance-tests/conformance-basic-local.json:
--------------------------------------------------------------------------------
 1 | {
 2 |     "server": {
 3 |         "discoveryUrl": "https://op.local.stack-dev.cirrusidentity.com/.well-known/openid-configuration"
 4 |     },
 5 |     "client": {
 6 |         "client_id": "_55a99a1d298da921cb27d700d4604352e51171ebc4",
 7 |         "client_secret": "_8967dd97d07cc59db7055e84ac00e79005157c1132"
 8 |     },
 9 |     "client_secret_post": {
10 |         "client_id": "_0afb7d18e54b2de8205a93e38ca119e62ee321d031",
11 |         "client_secret": "_944e73bbeec7850d32b68f1b5c780562c955967e4e"
12 |     },
13 |     "client2": {
14 |         "client_id": "_34efb61060172a11d62101bc804db789f8f9100b0e",
15 |         "client_secret": "_91a4607a1c10ba801268929b961b3f6c067ff82d21"
16 |     },
17 |     "alias": "simplesamlphp-module-oidc",
18 |     "description": "Testing of simplesamlphp-module-oidc running locally. Use with local conformance suite."
19 | }


--------------------------------------------------------------------------------
/src/Helpers/Random.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 8 | use Throwable;
 9 | 
10 | class Random
11 | {
12 |     /**
13 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException
14 |      */
15 |     public function getIdentifier(int $length = 40): string
16 |     {
17 |         if ($length < 1) {
18 |             throw OidcServerException::serverError('Random string length can not be less than 1');
19 |         }
20 | 
21 |         try {
22 |             return bin2hex(random_bytes($length));
23 |             // @codeCoverageIgnoreStart
24 |         } catch (Throwable $e) {
25 |             throw OidcServerException::serverError('Could not generate a random string', $e);
26 |         }
27 |         // @codeCoverageIgnoreEnd
28 |     }
29 | }
30 | 


--------------------------------------------------------------------------------
/templates/clients/edit.twig:
--------------------------------------------------------------------------------
 1 | {% set subPageTitle = 'Edit Client '|trans ~ originalClient.getIdentifier %}
 2 | 
 3 | {% extends "@oidc/base.twig" %}
 4 | 
 5 | {% block oidcContent %}
 6 | 
 7 |     <div class="pure-g">
 8 |         <div class="pure-u-1-2">
 9 | 
10 |         </div>
11 |         <div class="pure-u-1-2">
12 |             <div class="right">
13 |                 <a class="pure-button " href="{{ routes.urlAdminClientsShow(originalClient.getIdentifier) }}">
14 |                     <i class="fa fa-chevron-left"></i>
15 |                     {{ 'Back'|trans }}
16 |                 </a>
17 |             </div>
18 |         </div>
19 |     </div>
20 | 
21 |     {% include "@oidc/clients/includes/form.twig" %}
22 | 
23 | {% endblock oidcContent -%}
24 | 
25 | {% block postload %}
26 |     {{ parent() }}
27 | 
28 |     <script src="{{ asset('js/src/client-form.js', 'oidc') }}"></script>
29 | {% endblock %}


--------------------------------------------------------------------------------
/src/Factories/CryptKeyFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories;
 6 | 
 7 | use League\OAuth2\Server\CryptKey;
 8 | use SimpleSAML\Module\oidc\ModuleConfig;
 9 | 
10 | class CryptKeyFactory
11 | {
12 |     public function __construct(
13 |         private readonly ModuleConfig $moduleConfig,
14 |     ) {
15 |     }
16 | 
17 |     /**
18 |      * @throws \Exception
19 |      */
20 |     public function buildPrivateKey(): CryptKey
21 |     {
22 |         return new CryptKey(
23 |             $this->moduleConfig->getProtocolPrivateKeyPath(),
24 |             $this->moduleConfig->getProtocolPrivateKeyPassPhrase(),
25 |         );
26 |     }
27 | 
28 |     /**
29 |      * @throws \Exception
30 |      */
31 |     public function buildPublicKey(): CryptKey
32 |     {
33 |         return new CryptKey($this->moduleConfig->getProtocolCertPath());
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/tests/unit/src/Helpers/StrTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Helpers;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Helpers\Str;
10 | 
11 | #[CoversClass(Str::class)]
12 | class StrTest extends TestCase
13 | {
14 |     protected function sut(): Str
15 |     {
16 |         return new Str();
17 |     }
18 | 
19 |     public function testCanConvertScopesStringToArray(): void
20 |     {
21 |         $this->assertSame(
22 |             ['a', 'b'],
23 |             $this->sut()->convertScopesStringToArray('a b'),
24 |         );
25 |     }
26 | 
27 |     public function testCanConvertTextToArray(): void
28 |     {
29 |         $this->assertSame(
30 |             ['a', 'b', 'c', 'd'],
31 |             $this->sut()->convertTextToArray("a\tb\nc\rd"),
32 |         );
33 |     }
34 | }
35 | 


--------------------------------------------------------------------------------
/docs/7-oidc-faq.md:
--------------------------------------------------------------------------------
 1 | # OIDC Module - FAQ
 2 | 
 3 | A few common questions gathered from prior discussions.
 4 | 
 5 | ## Set JSON type for claims
 6 | 
 7 | You can set the type of claim by prefixing the claim name with `int:`,
 8 | `bool:` or `string:`. If no prefix is present, `string` is assumed.
 9 | 
10 | If a custom claim name starts with a prefix (example: `int:mycustomclaim`)
11 | you can add one of the type prefixes (example: `string:int:mycustomclaim`)
12 | to force the module to release a claim with the original prefix in it
13 | (example: claim `int:mycustomclaim` of type `string`).
14 | 
15 | ## Release photo
16 | 
17 | The OIDC `picture` claim is a URL, while the LDAP attribute `jpegPhoto`
18 | is often a base64 string. To use `jpegPhoto`, try an authproc filter to
19 | turn it into a data URL by adding the `data:image/jpeg;base64,` prefix.
20 | Support for data URLs varies by OIDC client, so test your clients.
21 | 


--------------------------------------------------------------------------------
/src/Helpers/Str.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | class Str
 8 | {
 9 |     /**
10 |      * Converts a scopes query string to an array to easily iterate for validation.
11 |      *
12 |      * @param non-empty-string $delimiter
13 |      * @return string[]
14 |      */
15 |     public function convertScopesStringToArray(string $scopes, string $delimiter = ' '): array
16 |     {
17 |         return array_filter(explode($delimiter, trim($scopes)), fn($scope) => !empty($scope));
18 |     }
19 | 
20 |     /**
21 |      * @param non-empty-string $pattern
22 |      * @return string[]
23 |      */
24 |     public function convertTextToArray(string $text, string $pattern = "/[\t\r\n]+/"): array
25 |     {
26 |         return array_filter(
27 |             preg_split($pattern, $text),
28 |             fn(string $line): bool => !empty(trim($line)),
29 |         );
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/Entities/Traits/RevokeTokenTrait.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | namespace SimpleSAML\Module\oidc\Entities\Traits;
17 | 
18 | trait RevokeTokenTrait
19 | {
20 |     protected bool $isRevoked = false;
21 | 
22 |     public function isRevoked(): bool
23 |     {
24 |         return $this->isRevoked;
25 |     }
26 | 
27 |     /**
28 |      * Revoke token.
29 |      */
30 |     public function revoke(): void
31 |     {
32 |         $this->isRevoked = true;
33 |     }
34 | }
35 | 


--------------------------------------------------------------------------------
/src/Helpers/Scope.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | use League\OAuth2\Server\Entities\ScopeEntityInterface;
 8 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 9 | 
10 | class Scope
11 | {
12 |     /**
13 |      * @param \League\OAuth2\Server\Entities\ScopeEntityInterface[] $scopes
14 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException
15 |      */
16 |     public function exists(array $scopes, string $scopeIdentifier): bool
17 |     {
18 |         foreach ($scopes as $scope) {
19 |             if (! $scope instanceof ScopeEntityInterface) {
20 |                 throw OidcServerException::serverError('Invalid scope element provided.');
21 |             }
22 | 
23 |             if ($scope->getIdentifier() === $scopeIdentifier) {
24 |                 return true;
25 |             }
26 |         }
27 | 
28 |         return false;
29 |     }
30 | }
31 | 


--------------------------------------------------------------------------------
/tests/unit/src/Helpers/RandomTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Helpers;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Helpers\Random;
10 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
11 | 
12 | #[CoversClass(Random::class)]
13 | class RandomTest extends TestCase
14 | {
15 |     protected function sut(): Random
16 |     {
17 |         return new Random();
18 |     }
19 |     public function testCanGetIdentifier(): void
20 |     {
21 |         $this->assertNotEmpty(
22 |             $this->sut()->getIdentifier(),
23 |         );
24 |     }
25 | 
26 |     public function testGetIdentifierThrowsOnInvalidLength(): void
27 |     {
28 |         $this->expectException(OidcServerException::class);
29 |         $this->expectExceptionMessage('Random');
30 | 
31 |         $this->sut()->getIdentifier(0);
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/src/Entities/ClaimSetEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities;
 6 | 
 7 | use SimpleSAML\Module\oidc\Entities\Interfaces\ClaimSetEntityInterface;
 8 | 
 9 | /**
10 |  * This file contains modified code from the 'steverhoades/oauth2-openid-connect-server' library
11 |  * (https://github.com/steverhoades/oauth2-openid-connect-server), with original author, copyright notice and licence:
12 |  * @author Steve Rhoades <sedonami@gmail.com>
13 |  * @copyright (c) 2018 Steve Rhoades <sedonami@gmail.com>
14 |  * @license http://opensource.org/licenses/MIT MIT
15 |  */
16 | class ClaimSetEntity implements ClaimSetEntityInterface
17 | {
18 |     public function __construct(protected string $scope, protected array $claims)
19 |     {
20 |     }
21 | 
22 |     public function getScope(): string
23 |     {
24 |         return $this->scope;
25 |     }
26 | 
27 |     public function getClaims(): array
28 |     {
29 |         return $this->claims;
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/Server/Grants/Interfaces/AuthorizationValidatableWithRequestRules.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\Grants\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\RequestTypes\AuthorizationRequest as OAuth2AuthorizationRequest;
 8 | use Psr\Http\Message\ServerRequestInterface;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
10 | 
11 | interface AuthorizationValidatableWithRequestRules
12 | {
13 |     /**
14 |      * Validate authorization request using an existing ResultBag instance (with already validated checkers).
15 |      * This is to evade usage of original validateAuthorizationRequest() method in which it is expected to
16 |      * validate client and redirect_uri (which was already validated).
17 |      */
18 |     public function validateAuthorizationRequestWithRequestRules(
19 |         ServerRequestInterface $request,
20 |         ResultBagInterface $resultBag,
21 |     ): OAuth2AuthorizationRequest;
22 | }
23 | 


--------------------------------------------------------------------------------
/public/assets/js/src/default.js:
--------------------------------------------------------------------------------
 1 | 
 2 | (function() {
 3 | 
 4 |     // Attach `confirm-action` click event to all elements with the `confirm-action` class.
 5 |     document.querySelectorAll('.confirm-action').forEach(button => {
 6 |         button.addEventListener('click', function (event) {
 7 |             // Get custom confirmation text
 8 |             const confirmText = this.getAttribute('data-confirm-text') ?? 'Are you sure?';
 9 |             // Optional: Retrieve additional data
10 |             const itemId = this.getAttribute('data-confirm-id') ?? 'N/A';
11 | 
12 |             if (!confirm(confirmText)) {
13 |                 // Prevent the default action if the user cancels
14 |                 event.preventDefault();
15 |             } else {
16 |                 // Optional: Handle confirmed action
17 |                 console.log(
18 |                     `Confirmed action "${confirmText}" for item with ID "${itemId}"`);
19 |             }
20 |         });
21 |     });
22 | })();
23 | 


--------------------------------------------------------------------------------
/tests/bootstrap.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | $projectRoot = dirname(__DIR__);
18 | require_once $projectRoot . '/vendor/autoload.php';
19 | 
20 | // Symlink module into ssp vendor lib so that templates and urls can resolve correctly
21 | $linkPath = $projectRoot . '/vendor/simplesamlphp/simplesamlphp/modules/oidc';
22 | if (false === file_exists($linkPath)) {
23 |     echo "Linking '$linkPath' to '$projectRoot'\n";
24 |     symlink($projectRoot, $linkPath);
25 | } else {
26 |     echo "'$linkPath' linked to '$projectRoot'\n";
27 | }
28 | 


--------------------------------------------------------------------------------
/src/Services/StateService.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Services;
 6 | 
 7 | use SimpleSAML\Auth\State;
 8 | 
 9 | /**
10 |  *
11 |  */
12 | class StateService
13 | {
14 |     /**
15 |      * @var State
16 |      */
17 |     private State $authState;
18 | 
19 |     /**
20 |      *
21 |      */
22 |     public function __construct()
23 |     {
24 |         $this->authState = new State();
25 |     }
26 | 
27 |     /**
28 |      * @return State
29 |      */
30 |     public function getAuthState(): State
31 |     {
32 |         return $this->authState;
33 |     }
34 | 
35 |     /**
36 |      * @param   string  $id
37 |      * @param   string  $stage
38 |      * @param   bool    $allowMissing
39 |      *
40 |      * @return array|null
41 |      * @throws \SimpleSAML\Error\NoState
42 |      */
43 |     public function loadState(string $id, string $stage, bool $allowMissing = false): ?array
44 |     {
45 |         return $this->authState::loadState($id, $stage, $allowMissing);
46 |     }
47 | }
48 | 


--------------------------------------------------------------------------------
/src/Bridges/SspBridge.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges;
 6 | 
 7 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Auth;
 8 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Module;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Utils;
10 | 
11 | /**
12 |  * SimpleSAMLphp bridge classes to make it easy to inject them as services and consequently easy unit testing.
13 |  * It is also used to cover some static method calls in SimpleSAMLphp for some classes.
14 |  */
15 | class SspBridge
16 | {
17 |     protected static ?Auth $auth = null;
18 |     protected static ?Utils $utils = null;
19 |     protected static ?Module $module = null;
20 | 
21 |     public function utils(): Utils
22 |     {
23 |         return self::$utils ??= new Utils();
24 |     }
25 | 
26 |     public function module(): Module
27 |     {
28 |         return self::$module ??= new Module();
29 |     }
30 | 
31 |     public function auth(): Auth
32 |     {
33 |         return self::$auth ??= new Auth();
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/public/assets/js/src/client-form.js:
--------------------------------------------------------------------------------
 1 | (function () {
 2 |     'use strict';
 3 | 
 4 |     // Handle enabling and disabling input for 'allowed origins', based on client type radio input.
 5 |     function toggleAllowedOrigins() {
 6 |         if (radioOptionPublic.checked) {
 7 |             inputAllowedOrigin.disabled = false; // Enable the input field
 8 |         } else if (radioOptionConfidential.checked) {
 9 |             inputAllowedOrigin.disabled = true; // Disable the input field
10 |         }
11 |     }
12 | 
13 |     // Get references to the radio buttons and the input field
14 |     const radioOptionPublic = document.getElementById("radio-option-public");
15 |     const radioOptionConfidential = document.getElementById("radio-option-confidential");
16 |     const inputAllowedOrigin = document.getElementById("frm-allowed_origin");
17 | 
18 |     radioOptionPublic.addEventListener("change", toggleAllowedOrigins);
19 |     radioOptionConfidential.addEventListener("change", toggleAllowedOrigins);
20 | 
21 |     toggleAllowedOrigins();
22 | })();
23 | 


--------------------------------------------------------------------------------
/phpunit.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 3 |          colors="true"
 4 |          bootstrap="./tests/bootstrap.php"
 5 |          xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.3/phpunit.xsd"
 6 |          cacheDirectory="./build/phpunit-cache"
 7 |          displayDetailsOnTestsThatTriggerWarnings="true"
 8 | >
 9 |   <coverage>
10 |     <report>
11 |       <php outputFile="build/logs/partial_clover/unit.cov"/>
12 |       <html outputDirectory="build/coverage/unit/html"/>
13 |     </report>
14 |   </coverage>
15 |   <testsuites>
16 |     <testsuite name="Unit">
17 |       <directory>./tests/unit</directory>
18 |     </testsuite>
19 |   </testsuites>
20 |   <logging>
21 |     <junit outputFile="build/logs/partial_junit/unit.xml"/>
22 |   </logging>
23 |   <php>
24 |     <env name="SIMPLESAMLPHP_CONFIG_DIR" value="tests/config"/>
25 |     <env name="APP_ENV" value="phpunit"/>
26 |   </php>
27 |   <source>
28 |     <include>
29 |       <directory>./src</directory>
30 |     </include>
31 |   </source>
32 | </phpunit>
33 | 


--------------------------------------------------------------------------------
/src/Stores/Session/LogoutTicketStoreBuilder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Stores\Session;
 6 | 
 7 | class LogoutTicketStoreBuilder
 8 | {
 9 |     protected static ?LogoutTicketStoreInterface $sessionLogoutTicketStore;
10 | 
11 |     public function __construct(?LogoutTicketStoreInterface $sessionLogoutTicketStore = null)
12 |     {
13 |         self::$sessionLogoutTicketStore = $sessionLogoutTicketStore ?? self::getDefaultSessionLogoutTicketStore();
14 |     }
15 | 
16 |     public function getInstance(): LogoutTicketStoreInterface
17 |     {
18 |         return self::getStaticInstance();
19 |     }
20 | 
21 |     public static function getStaticInstance(): LogoutTicketStoreInterface
22 |     {
23 |         return self::$sessionLogoutTicketStore ?? self::getDefaultSessionLogoutTicketStore();
24 |     }
25 | 
26 |     public static function getDefaultSessionLogoutTicketStore(): LogoutTicketStoreInterface
27 |     {
28 |         // For now, we only have DB version implemented...
29 |         return new LogoutTicketStoreDb();
30 |     }
31 | }
32 | 


--------------------------------------------------------------------------------
/src/Utils/JwksResolver.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Utils;
 6 | 
 7 | use SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface;
 8 | use SimpleSAML\OpenID\Jwks;
 9 | 
10 | class JwksResolver
11 | {
12 |     public function __construct(protected Jwks $jwks)
13 |     {
14 |     }
15 | 
16 |     /**
17 |      * @throws \SimpleSAML\OpenID\Exceptions\JwsException
18 |      */
19 |     public function forClient(ClientEntityInterface $client): ?array
20 |     {
21 |         if (
22 |             ($signedJwksUri = $client->getSignedJwksUri()) &&
23 |             ($federationJwks = $client->getFederationJwks())
24 |         ) {
25 |             return $this->jwks->jwksFetcher()->fromCacheOrSignedJwksUri(
26 |                 $signedJwksUri,
27 |                 $federationJwks,
28 |             )?->jsonSerialize();
29 |         }
30 | 
31 |         if (($jwksUri = $client->getJwksUri())) {
32 |             return $this->jwks->jwksFetcher()->fromCacheOrJwksUri($jwksUri)?->jsonSerialize();
33 |         }
34 | 
35 |         return $client->getJwks();
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/tests/unit/src/Bridges/SspBridgeTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Bridges;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge;
10 | 
11 | #[CoversClass(SspBridge::class)]
12 | class SspBridgeTest extends TestCase
13 | {
14 |     protected function sut(): SspBridge
15 |     {
16 |         return new SspBridge();
17 |     }
18 | 
19 |     public function testCanCreateInstance(): void
20 |     {
21 |         $this->assertInstanceOf(SspBridge::class, $this->sut());
22 |     }
23 | 
24 |     public function testCanBuildUtilsInstance(): void
25 |     {
26 |         $this->assertInstanceOf(SspBridge\Utils::class, $this->sut()->utils());
27 |     }
28 | 
29 |     public function testCanBuildModuleInstance(): void
30 |     {
31 |         $this->assertInstanceOf(SspBridge\Module::class, $this->sut()->module());
32 |     }
33 | 
34 |     public function testCanBuildAuthInstance(): void
35 |     {
36 |         $this->assertInstanceOf(SspBridge\Auth::class, $this->sut()->auth());
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/phpunit.integration.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0" encoding="UTF-8"?>
 2 | <phpunit xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 3 |          colors="true"
 4 |          bootstrap="./tests/bootstrap.php"
 5 |          xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.3/phpunit.xsd"
 6 |          cacheDirectory="./build/phpunit-cache"
 7 |          displayDetailsOnTestsThatTriggerWarnings="true"
 8 | >
 9 |   <coverage>
10 |     <report>
11 |       <php outputFile="build/logs/partial_clover/integration.cov"/>
12 |       <html outputDirectory="build/coverage/integration/html"/>
13 |     </report>
14 |   </coverage>
15 |   <testsuites>
16 |     <testsuite name="Integration">
17 |       <directory>./tests/integration</directory>
18 |     </testsuite>
19 |   </testsuites>
20 |   <logging>
21 |     <junit outputFile="build/logs/partial_junit/integration.xml"/>
22 |   </logging>
23 |   <php>
24 |     <env name="SIMPLESAMLPHP_CONFIG_DIR" value="tests/config"/>
25 |     <env name="APP_ENV" value="phpunit"/>
26 |   </php>
27 |   <source>
28 |     <include>
29 |       <directory>./src</directory>
30 |     </include>
31 |   </source>
32 | </phpunit>
33 | 


--------------------------------------------------------------------------------
/src/Controllers/ConfigurationDiscoveryController.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Controllers;
18 | 
19 | use SimpleSAML\Module\oidc\Services\OpMetadataService;
20 | use Symfony\Component\HttpFoundation\JsonResponse;
21 | 
22 | class ConfigurationDiscoveryController
23 | {
24 |     public function __construct(private readonly OpMetadataService $opMetadataService)
25 |     {
26 |     }
27 | 
28 |     public function __invoke(): JsonResponse
29 |     {
30 |         return new JsonResponse(
31 |             $this->opMetadataService->getMetadata(),
32 |             headers: ['Access-Control-Allow-Origin' => '*'],
33 |         );
34 |     }
35 | }
36 | 


--------------------------------------------------------------------------------
/rector.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | use Rector\CodeQuality\Rector\Class_\InlineConstructorDefaultToPropertyRector;
 6 | use Rector\Config\RectorConfig;
 7 | use Rector\Set\ValueObject\LevelSetList;
 8 | use Rector\TypeDeclaration\Rector\StmtsAwareInterface\DeclareStrictTypesRector;
 9 | 
10 | return static function (RectorConfig $rectorConfig): void {
11 |     $rectorConfig->importNames();
12 |     $rectorConfig->disableParallel();
13 | 
14 |     $rectorConfig->bootstrapFiles([
15 |         //__DIR__ . '/vendor/autoload.php',
16 |     ]);
17 | 
18 |     $rectorConfig->paths([
19 |         // TODO v7 mivanci also go trough commented out paths...
20 |         //__DIR__ . '/docker',
21 |         //__DIR__ . '/hooks',
22 |         //__DIR__ . '/public',
23 |         __DIR__ . '/src',
24 |         __DIR__ . '/tests',
25 |     ]);
26 | 
27 |     // register a single rule
28 |     $rectorConfig->rule(InlineConstructorDefaultToPropertyRector::class);
29 |     $rectorConfig->rule(DeclareStrictTypesRector::class);
30 | 
31 |     // define sets of rules
32 |     $rectorConfig->sets([
33 |         LevelSetList::UP_TO_PHP_81,
34 |     ]);
35 | };
36 | 


--------------------------------------------------------------------------------
/src/Bridges/SspBridge/Utils.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges\SspBridge;
 6 | 
 7 | use SimpleSAML\Utils\Attributes;
 8 | use SimpleSAML\Utils\Auth;
 9 | use SimpleSAML\Utils\Config;
10 | use SimpleSAML\Utils\HTTP;
11 | use SimpleSAML\Utils\Random;
12 | 
13 | class Utils
14 | {
15 |     protected static ?Config $config = null;
16 |     protected static ?HTTP $http = null;
17 |     protected static ?Random $random = null;
18 |     protected static ?Auth $auth = null;
19 |     protected static ?Attributes $attributes = null;
20 | 
21 |     public function config(): Config
22 |     {
23 |         return self::$config ??= new Config();
24 |     }
25 | 
26 |     public function http(): HTTP
27 |     {
28 |         return self::$http ??= new HTTP();
29 |     }
30 | 
31 |     public function random(): Random
32 |     {
33 |         return self::$random ??= new Random();
34 |     }
35 | 
36 |     public function auth(): Auth
37 |     {
38 |         return self::$auth ??= new Auth();
39 |     }
40 | 
41 |     public function attributes(): Attributes
42 |     {
43 |         return self::$attributes ??= new Attributes();
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Interfaces/ResultBagInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Interfaces;
 6 | 
 7 | interface ResultBagInterface
 8 | {
 9 |     /**
10 |      * Add result to the result bag.
11 |      */
12 |     public function add(ResultInterface $result): void;
13 | 
14 |     /**
15 |      * Get specific result or null if it doesn't exist.
16 |      */
17 |     public function get(string $key): ?ResultInterface;
18 | 
19 |     /**
20 |      * Get specific result or fail if it doesn't exits.
21 |      * @throws \Throwable If result with specific key is not present.
22 |      */
23 |     public function getOrFail(string $key): ResultInterface;
24 | 
25 |     /**
26 |      * Get all results.
27 |      * @return \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface[]
28 |      */
29 |     public function getAll(): array;
30 | 
31 |     /**
32 |      * Remove result from the result bag.
33 |      */
34 |     public function remove(string $key): void;
35 | 
36 |     /**
37 |      * Check if specific result exists in result bag.
38 |      */
39 |     public function has(string $key): bool;
40 | }
41 | 


--------------------------------------------------------------------------------
/bin/install.php:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env php
 2 | <?php
 3 | 
 4 | declare(strict_types=1);
 5 | 
 6 | /**
 7 |  * Script which can be run to do the module installation which includes running database migrations.
 8 |  */
 9 | 
10 | use SimpleSAML\Database;
11 | use SimpleSAML\Module\oidc\Services\DatabaseMigration;
12 | 
13 | // This is the base directory of the SimpleSAMLphp installation
14 | $baseDir = dirname(__FILE__, 4);
15 | 
16 | // Add library autoloader and configuration
17 | require_once $baseDir . DIRECTORY_SEPARATOR . 'src' . DIRECTORY_SEPARATOR . '_autoload.php';
18 | 
19 | echo 'Starting with module installation.' . PHP_EOL;
20 | 
21 | try {
22 |     $database = Database::getInstance();
23 |     $databaseMigration = new DatabaseMigration($database);
24 | 
25 |     if ($databaseMigration->isMigrated()) {
26 |         echo 'Database is up to date, skipping.' . PHP_EOL;
27 |         return 0;
28 |     }
29 | 
30 |     echo 'Running database migrations.' . PHP_EOL;
31 | 
32 |     $databaseMigration->migrate();
33 | 
34 |     echo 'Done running migrations.';
35 |     return 0;
36 | } catch (Throwable $exception) {
37 |     echo 'There was an error while trying run database migrations: ' . $exception->getMessage();
38 |     return 1;
39 | }
40 | 


--------------------------------------------------------------------------------
/tests/unit/src/Bridges/SspBridge/ModuleTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Bridges\SspBridge;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Module;
10 | 
11 | #[CoversClass(Module::class)]
12 | class ModuleTest extends TestCase
13 | {
14 |     protected function sut(): Module
15 |     {
16 |         return new Module();
17 |     }
18 | 
19 |     public function testCanCreateInstance(): void
20 |     {
21 |         $this->assertInstanceOf(Module::class, $this->sut());
22 |     }
23 | 
24 |     public function testCanBuildAdminInstance(): void
25 |     {
26 |         $this->assertInstanceOf(Module\Admin::class, $this->sut()->admin());
27 |     }
28 | 
29 |     public function testCanGetModuleUrl(): void
30 |     {
31 |         $this->assertStringContainsString(
32 |             'test',
33 |             $this->sut()->getModuleUrl('test'),
34 |         );
35 |     }
36 | 
37 |     public function testCanCheckIsModuleEnabled(): void
38 |     {
39 |         $this->assertFalse($this->sut()->isModuleEnabled('invalid'));
40 |         $this->assertTrue($this->sut()->isModuleEnabled('core'));
41 |     }
42 | }
43 | 


--------------------------------------------------------------------------------
/src/Helpers/Client.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface;
 9 | use SimpleSAML\Module\oidc\Exceptions\OidcException;
10 | use SimpleSAML\Module\oidc\Repositories\ClientRepository;
11 | 
12 | class Client
13 | {
14 |     public function __construct(protected Http $http)
15 |     {
16 |     }
17 | 
18 |     /**
19 |      * @throws \JsonException
20 |      * @throws \SimpleSAML\Module\oidc\Exceptions\OidcException
21 |      */
22 |     public function getFromRequest(
23 |         ServerRequestInterface $request,
24 |         ClientRepository $clientRepository,
25 |     ): ClientEntityInterface {
26 |         $params = $this->http->getAllRequestParams($request);
27 |         $clientId = empty($params['client_id']) ? null : (string)$params['client_id'];
28 | 
29 |         if (!is_string($clientId)) {
30 |             throw new OidcException('Client ID is missing.');
31 |         }
32 | 
33 |         $client = $clientRepository->findById($clientId);
34 | 
35 |         if (!$client) {
36 |             throw new OidcException('Client not found.');
37 |         }
38 | 
39 |         return $client;
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/AddClaimsToIdTokenRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
11 | use SimpleSAML\Module\oidc\Services\LoggerService;
12 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
13 | 
14 | class AddClaimsToIdTokenRule extends AbstractRule
15 | {
16 |     /**
17 |      * @inheritDoc
18 |      * @throws \Throwable
19 |      */
20 |     public function checkRule(
21 |         ServerRequestInterface $request,
22 |         ResultBagInterface $currentResultBag,
23 |         LoggerService $loggerService,
24 |         array $data = [],
25 |         bool $useFragmentInHttpErrorResponses = false,
26 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
27 |     ): ?ResultInterface {
28 |         /** @var string $responseType */
29 |         $responseType = $currentResultBag->getOrFail(ResponseTypeRule::class)->getValue();
30 | 
31 |         return new Result($this->getKey(), $responseType === "id_token");
32 |     }
33 | }
34 | 


--------------------------------------------------------------------------------
/tests/unit/src/Entities/ScopeEntityTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Entities;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use SimpleSAML\Module\oidc\Entities\ScopeEntity;
 9 | 
10 | class ScopeEntityTest extends TestCase
11 | {
12 |     protected function mock(
13 |         string $id = 'id',
14 |         string $description = 'description',
15 |         string $icon = 'icon',
16 |         array $attributes = ['attrid' => 'attrval'],
17 |     ): ScopeEntity {
18 |         return new ScopeEntity($id, $description, $icon, $attributes);
19 |     }
20 | 
21 |     public function testItIsInitializable(): void
22 |     {
23 |         $this->assertInstanceOf(
24 |             ScopeEntity::class,
25 |             $this->mock(),
26 |         );
27 |     }
28 | 
29 |     public function testCanGetProperties(): void
30 |     {
31 |         $scopeEntity = $this->mock();
32 |         $this->assertSame('id', $scopeEntity->getIdentifier());
33 |         $this->assertSame('description', $scopeEntity->getDescription());
34 |         $this->assertSame('icon', $scopeEntity->getIcon());
35 |         $this->assertSame(['attrid' => 'attrval'], $scopeEntity->getClaims());
36 |         $this->assertSame('id', $scopeEntity->jsonSerialize());
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/tests/unit/src/Stores/Session/LogoutTicketStoreBuilderTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Stores\Session;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use SimpleSAML\Configuration;
 9 | use SimpleSAML\Module\oidc\Stores\Session\LogoutTicketStoreBuilder;
10 | use SimpleSAML\Module\oidc\Stores\Session\LogoutTicketStoreInterface;
11 | 
12 | /**
13 |  * @covers \SimpleSAML\Module\oidc\Stores\Session\LogoutTicketStoreBuilder
14 |  */
15 | class LogoutTicketStoreBuilderTest extends TestCase
16 | {
17 |     public function testConstructWithDefaultStore(): void
18 |     {
19 |         $config = [
20 |             'database.dsn' => 'sqlite::memory:',
21 |             'database.username' => null,
22 |             'database.password' => null,
23 |             'database.prefix' => 'phpunit_',
24 |             'database.persistent' => true,
25 |             'database.secondaries' => [],
26 |         ];
27 | 
28 |         Configuration::loadFromArray($config, '', 'simplesaml');
29 |         $builder = new LogoutTicketStoreBuilder();
30 | 
31 |         $this->assertInstanceOf(LogoutTicketStoreInterface::class, $builder->getInstance());
32 |         $this->assertInstanceOf(LogoutTicketStoreInterface::class, $builder::getStaticInstance());
33 |     }
34 | }
35 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/UiLocalesRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
11 | use SimpleSAML\Module\oidc\Services\LoggerService;
12 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
13 | use SimpleSAML\OpenID\Codebooks\ParamsEnum;
14 | 
15 | class UiLocalesRule extends AbstractRule
16 | {
17 |     /**
18 |      * @inheritDoc
19 |      */
20 |     public function checkRule(
21 |         ServerRequestInterface $request,
22 |         ResultBagInterface $currentResultBag,
23 |         LoggerService $loggerService,
24 |         array $data = [],
25 |         bool $useFragmentInHttpErrorResponses = false,
26 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
27 |     ): ?ResultInterface {
28 |         return new Result($this->getKey(), $this->requestParamsResolver->getBasedOnAllowedMethods(
29 |             ParamsEnum::UiLocales->value,
30 |             $request,
31 |             $allowedServerRequestMethods,
32 |         ));
33 |     }
34 | }
35 | 


--------------------------------------------------------------------------------
/src/Admin/Menu.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Admin;
 6 | 
 7 | use SimpleSAML\Module\oidc\Admin\Menu\Item;
 8 | 
 9 | class Menu
10 | {
11 |     /**
12 |      * @var array<Item>
13 |      */
14 |     protected array $items = [];
15 | 
16 |     protected ?string $activeHrefPath = null;
17 | 
18 |     public function __construct(Item ...$items)
19 |     {
20 |         array_push($this->items, ...$items);
21 |     }
22 | 
23 |     public function addItem(Item $menuItem, ?int $offset = null): void
24 |     {
25 |         $offset ??= count($this->items);
26 | 
27 |         array_splice($this->items, $offset, 0, [$menuItem]);
28 |     }
29 | 
30 |     public function getItems(): array
31 |     {
32 |         return $this->items;
33 |     }
34 | 
35 |     public function setActiveHrefPath(?string $value): void
36 |     {
37 |         $this->activeHrefPath = $value;
38 |     }
39 | 
40 |     public function getActiveHrefPath(): ?string
41 |     {
42 |         return $this->activeHrefPath;
43 |     }
44 | 
45 |     /**
46 |      * Item factory method for easy injection in tests.
47 |      */
48 |     public function buildItem(string $hrefPath, string $label, ?string $iconAssetPath = null): Item
49 |     {
50 |         return new Item($hrefPath, $label, $iconAssetPath);
51 |     }
52 | }
53 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
 1 | 
 2 | The MIT License (MIT)
 3 | 
 4 | Copyright (C) 2018 by the Spanish Research and Academic Network.
 5 | 
 6 | This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
 7 | for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
 8 | 
 9 | Permission is hereby granted, free of charge, to any person obtaining a copy
10 | of this software and associated documentation files (the "Software"), to deal
11 | in the Software without restriction, including without limitation the rights
12 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
13 | copies of the Software, and to permit persons to whom the Software is
14 | furnished to do so, subject to the following conditions:
15 | 
16 | The above copyright notice and this permission notice shall be included in
17 | all copies or substantial portions of the Software.
18 | 
19 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
20 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
21 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
22 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
23 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
24 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 | THE SOFTWARE.


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/StateRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
11 | use SimpleSAML\Module\oidc\Services\LoggerService;
12 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
13 | use SimpleSAML\OpenID\Codebooks\ParamsEnum;
14 | 
15 | class StateRule extends AbstractRule
16 | {
17 |     /**
18 |      * @inheritDoc
19 |      */
20 |     public function checkRule(
21 |         ServerRequestInterface $request,
22 |         ResultBagInterface $currentResultBag,
23 |         LoggerService $loggerService,
24 |         array $data = [],
25 |         bool $useFragmentInHttpErrorResponses = false,
26 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
27 |     ): ?ResultInterface {
28 |         $state = $this->requestParamsResolver->getAsStringBasedOnAllowedMethods(
29 |             ParamsEnum::State->value,
30 |             $request,
31 |             $allowedServerRequestMethods,
32 |         );
33 | 
34 |         return new Result($this->getKey(), $state);
35 |     }
36 | }
37 | 


--------------------------------------------------------------------------------
/templates/config/migrations.twig:
--------------------------------------------------------------------------------
 1 | {% set subPageTitle = 'Database Migrations'|trans %}
 2 | 
 3 | {% extends "@oidc/base.twig" %}
 4 | 
 5 | {% block oidcContent %}
 6 | 
 7 |     {% if databaseMigration.isMigrated %}
 8 |         <p><i class="fa fa-check" title="OK"></i>{{ 'All database migrations are implemented.'|trans }}</p>
 9 |     {% else %}
10 |         <p class="red-text">
11 |             <i class="fa fa-ban" title="Not OK"></i>
12 |             {% trans %}There are database migrations that have not been implemented.
13 |                 Use the button below to run them now.{% endtrans %}
14 |         </p>
15 | 
16 |         <form method="post" class="pure-form" action="{{ routes.urlAdminMigrationsRun }}">
17 |             <input type="hidden" name="fromUi" value="1">
18 |             <input type="hidden" name="migrate" value="1">
19 |             <button class="pure-button pure-button-red ">{{ 'Run migrations'|trans }}</button>
20 |         </form>
21 |         <br>
22 |     {% endif %}
23 | 
24 |     <div class="message-box">
25 |         {{ 'Before running the migrations, make sure that the database user has proper privileges to change the scheme (for example, <kbd>alter, create, drop, index</kbd>). After running the migrations, it is a good practice to remove those privileges.'|trans }}
26 |     </div>
27 | 
28 | {% endblock oidcContent -%}
29 | 


--------------------------------------------------------------------------------
/src/Factories/ProcessingChainFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * For the full copyright and license information, please view the LICENSE
 9 |  * file that was distributed with this source code.
10 |  */
11 | 
12 | namespace SimpleSAML\Module\oidc\Factories;
13 | 
14 | use SimpleSAML\Auth\ProcessingChain;
15 | use SimpleSAML\Module\oidc\ModuleConfig;
16 | 
17 | class ProcessingChainFactory
18 | {
19 |     public function __construct(
20 |         private readonly ModuleConfig $moduleConfig,
21 |     ) {
22 |     }
23 | 
24 |     /**
25 |      * @codeCoverageIgnore
26 |      * @throws \Exception
27 |      */
28 |     public function build(array $state): ProcessingChain
29 |     {
30 |         $idpMetadata = [
31 |             'entityid' => $state['Source']['entityid'] ?? '',
32 |             // ProcessChain needs to know the list of authproc filters we defined in module_oidc configuration
33 |             'authproc' => $this->moduleConfig->getAuthProcFilters(),
34 |         ];
35 |         $spMetadata = [
36 |             'entityid' => $state['Destination']['entityid'] ?? '',
37 |         ];
38 | 
39 |         return new ProcessingChain(
40 |             $idpMetadata,
41 |             $spMetadata,
42 |             'oidc',
43 |         );
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/phpcs.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0"?>
 2 | <ruleset name="SimpleSAMLphp OIDC module ruleset">
 3 |     <config name="ignore_warnings_on_exit" value="1"/>
 4 | 
 5 |     <description>
 6 |         By default it is less stringent about long lines than other coding standards
 7 |     </description>
 8 | 
 9 |     <config name="show_progress" value="1"/>
10 |     <config name="ignore_warnings_on_exit" value="0"/>
11 | 
12 |     <file>config</file>
13 |     <file>hooks</file>
14 |     <file>src</file>
15 |     <file>tests</file>
16 |     <file>public</file>
17 |     <file>routing/routes</file>
18 | 
19 |     <!-- Use this to exclude paths. You can have multiple patterns -->
20 |     <!--<exclude-pattern>*/tests/*</exclude-pattern>-->
21 |     <!--<exclude-pattern>*/other/*</exclude-pattern>-->
22 |     <exclude-pattern>public/assets/*</exclude-pattern>
23 | 
24 |     <!-- This is the rule we inherit from. If you want to exlude some specific rules, see the docs on how to do that -->
25 |     <rule ref="PSR12"/>
26 |     <rule ref="vendor/simplesamlphp/simplesamlphp-test-framework/phpcs-simplesamlphp.xml"/>
27 | 
28 |     <rule ref="Generic.WhiteSpace.ScopeIndent">
29 |         <properties>
30 |             <property name="exact" value="true" />
31 |         </properties>
32 |     </rule>
33 |     <rule ref="Squiz.NamingConventions.ValidVariableName.NotCamelCaps"/>
34 | </ruleset>
35 | 
36 | 


--------------------------------------------------------------------------------
/docker/Dockerfile:
--------------------------------------------------------------------------------
 1 | ARG SSP_VERSION="v2.4.4"
 2 | FROM cirrusid/simplesamlphp:${SSP_VERSION}
 3 | #FROM cicnavi/simplesamlphp:${SSP_VERSION}
 4 | 
 5 | RUN apt-get update && apt-get --no-install-recommends install -y sqlite3
 6 | # Prepopulate the DB with items needed for testing
 7 | ADD docker/conformance.sql /tmp/
 8 | # Preload some clients
 9 | RUN sqlite3 /var/simplesamlphp/data/mydb.sq3  < /tmp/conformance.sql \
10 |     && chown www-data /var/simplesamlphp/data/mydb.sq3 
11 | 
12 | # --build-arg OIDC_VERSION
13 | ARG OIDC_VERSION="@dev"
14 | 
15 | ENV STAGINGCOMPOSERREPOS=oidc \
16 |     COMPOSER_REQUIRE="simplesamlphp/simplesamlphp-module-oidc:$OIDC_VERSION"
17 | ADD . /var/simplesamlphp/staging-modules/oidc
18 | 
19 | RUN /opt/simplesaml/staging-install.sh
20 | RUN /opt/simplesaml/module-setup.sh
21 | ADD docker/ssp/module_oidc.php /var/simplesamlphp/config/module_oidc.php
22 | ADD docker/ssp/authsources.php /var/simplesamlphp/config/authsources.php
23 | ADD docker/ssp/config-override.php /var/simplesamlphp/config/config-override.php
24 | ADD docker/ssp/oidc_module.crt /var/simplesamlphp/cert/oidc_module.crt
25 | ADD docker/ssp/oidc_module.key /var/simplesamlphp/cert/oidc_module.key
26 | ADD docker/apache-override.cf /etc/apache2/sites-enabled/ssp-override.cf
27 | 
28 | RUN chown www-data /var/simplesamlphp/cert/oidc* \
29 |     && chmod 660 /var/simplesamlphp/cert/oidc*
30 | 


--------------------------------------------------------------------------------
/src/Services/SessionMessagesService.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Services;
18 | 
19 | use SimpleSAML\Session;
20 | 
21 | class SessionMessagesService
22 | {
23 |     public function __construct(private readonly Session $session)
24 |     {
25 |     }
26 | 
27 |     /**
28 |      * @throws \Exception
29 |      */
30 |     public function addMessage(string $value): void
31 |     {
32 |         $this->session->setData('message', uniqid(), $value);
33 |     }
34 | 
35 |     /**
36 |      * @return array
37 |      */
38 |     public function getMessages(): array
39 |     {
40 |         /** @var array<string,string> $messages */
41 |         $messages = $this->session->getDataOfType('message');
42 | 
43 |         foreach (array_keys($messages) as $key) {
44 |             $this->session->deleteData('message', $key);
45 |         }
46 | 
47 |         return $messages;
48 |     }
49 | }
50 | 


--------------------------------------------------------------------------------
/src/Helpers/Http.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
 9 | 
10 | class Http
11 | {
12 |     public function getAllRequestParams(ServerRequestInterface $request): array
13 |     {
14 |         return array_merge(
15 |             $request->getQueryParams(),
16 |             (is_array($parsedBody = $request->getParsedBody()) ? $parsedBody : []),
17 |         );
18 |     }
19 | 
20 |     /**
21 |      * @param \Psr\Http\Message\ServerRequestInterface $request
22 |      * @param \SimpleSAML\OpenID\Codebooks\HttpMethodsEnum[] $allowedMethods
23 |      * @return ?array
24 |      */
25 |     public function getAllRequestParamsBasedOnAllowedMethods(
26 |         ServerRequestInterface $request,
27 |         array $allowedMethods,
28 |     ): ?array {
29 |         $requestMethod = HttpMethodsEnum::from(strtoupper($request->getMethod()));
30 | 
31 |         if (! in_array($requestMethod, $allowedMethods, true)) {
32 |             return null;
33 |         }
34 | 
35 |         return match ($requestMethod) {
36 |             HttpMethodsEnum::GET => $request->getQueryParams(),
37 |             HTTPMethodsEnum::POST => is_array($parsedBody = $request->getParsedBody()) ? $parsedBody : null,
38 |             default => null,
39 |         };
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/Factories/ResourceServerFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Factories;
18 | 
19 | use League\OAuth2\Server\AuthorizationValidators\AuthorizationValidatorInterface;
20 | use League\OAuth2\Server\CryptKey;
21 | use League\OAuth2\Server\ResourceServer;
22 | use SimpleSAML\Module\oidc\Repositories\AccessTokenRepository;
23 | 
24 | class ResourceServerFactory
25 | {
26 |     public function __construct(
27 |         private readonly AccessTokenRepository $accessTokenRepository,
28 |         private readonly CryptKey $publicKey,
29 |         private readonly AuthorizationValidatorInterface $authorizationValidator,
30 |     ) {
31 |     }
32 | 
33 |     public function build(): ResourceServer
34 |     {
35 |         return new ResourceServer(
36 |             $this->accessTokenRepository,
37 |             $this->publicKey,
38 |             $this->authorizationValidator,
39 |         );
40 |     }
41 | }
42 | 


--------------------------------------------------------------------------------
/src/Repositories/AbstractDatabaseRepository.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | namespace SimpleSAML\Module\oidc\Repositories;
17 | 
18 | use SimpleSAML\Database;
19 | use SimpleSAML\Module\oidc\ModuleConfig;
20 | use SimpleSAML\Module\oidc\Utils\ProtocolCache;
21 | 
22 | abstract class AbstractDatabaseRepository
23 | {
24 |     /**
25 |      * ClientRepository constructor.
26 |      * @throws \Exception
27 |      */
28 |     public function __construct(
29 |         protected readonly ModuleConfig $moduleConfig,
30 |         protected readonly Database $database,
31 |         protected readonly ?ProtocolCache $protocolCache,
32 |     ) {
33 |     }
34 | 
35 |     public function getCacheKey(string $identifier): string
36 |     {
37 |         return is_string($tableName = $this->getTableName()) ?
38 |         $tableName . '_' . $identifier :
39 |         $identifier;
40 |     }
41 | 
42 |     abstract public function getTableName(): ?string;
43 | }
44 | 


--------------------------------------------------------------------------------
/tests/unit/src/HelpersTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\Attributes\UsesClass;
 9 | use PHPUnit\Framework\TestCase;
10 | use SimpleSAML\Module\oidc\Helpers;
11 | 
12 | #[CoversClass(Helpers::class)]
13 | #[UsesClass(Helpers\Http::class)]
14 | #[UsesClass(Helpers\Client::class)]
15 | #[UsesClass(Helpers\DateTime::class)]
16 | #[UsesClass(Helpers\Str::class)]
17 | #[UsesClass(Helpers\Arr::class)]
18 | #[UsesClass(Helpers\Random::class)]
19 | #[UsesClass(Helpers\Scope::class)]
20 | class HelpersTest extends TestCase
21 | {
22 |     protected function sut(): Helpers
23 |     {
24 |         return new Helpers();
25 |     }
26 | 
27 |     public function testCanBuildHelpers(): void
28 |     {
29 |         $this->assertInstanceOf(Helpers\Http::class, $this->sut()->http());
30 |         $this->assertInstanceOf(Helpers\Client::class, $this->sut()->client());
31 |         $this->assertInstanceOf(Helpers\DateTime::class, $this->sut()->dateTime());
32 |         $this->assertInstanceOf(Helpers\Str::class, $this->sut()->str());
33 |         $this->assertInstanceOf(Helpers\Arr::class, $this->sut()->arr());
34 |         $this->assertInstanceOf(Helpers\Random::class, $this->sut()->random());
35 |         $this->assertInstanceOf(Helpers\Scope::class, $this->sut()->scope());
36 |     }
37 | }
38 | 


--------------------------------------------------------------------------------
/.php_cs.dist:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | $fileHeaderComment = <<<COMMENT
 4 | This file is part of the simplesamlphp-module-oidc.
 5 | 
 6 | Copyright (C) 2018 by the Spanish Research and Academic Network.
 7 | 
 8 | This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
 9 | for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
10 | 
11 | For the full copyright and license information, please view the LICENSE
12 | file that was distributed with this source code.
13 | COMMENT;
14 | $finder = PhpCsFixer\Finder::create()
15 |     ->in(__DIR__)
16 | ;
17 | return PhpCsFixer\Config::create()
18 |     ->setRiskyAllowed(true)
19 |     ->setRules([
20 |         '@Symfony' => true,
21 |         '@Symfony:risky' => true,
22 |         'array_syntax' => ['syntax' => 'short'],
23 |         'header_comment' => ['header' => $fileHeaderComment, 'separate' => 'both'],
24 |         'linebreak_after_opening_tag' => true,
25 |         'mb_str_functions' => true,
26 |         'no_php4_constructor' => true,
27 |         'no_unreachable_default_argument_value' => true,
28 |         'no_useless_else' => true,
29 |         'no_useless_return' => true,
30 |         'ordered_imports' => true,
31 |         'phpdoc_order' => true,
32 |         'phpdoc_to_comment' => false,
33 |         'semicolon_after_instruction' => true,
34 |         'strict_comparison' => true,
35 |         'strict_param' => true,
36 |     ])
37 |     ->setFinder($finder)
38 | ;
39 | 


--------------------------------------------------------------------------------
/tests/unit/src/Helpers/DateTimeTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Helpers;
 6 | 
 7 | use DateTimeImmutable;
 8 | use PHPUnit\Framework\Attributes\CoversClass;
 9 | use PHPUnit\Framework\TestCase;
10 | use SimpleSAML\Module\oidc\Helpers\DateTime;
11 | 
12 | #[CoversClass(DateTime::class)]
13 | class DateTimeTest extends TestCase
14 | {
15 |     protected function sut(): DateTime
16 |     {
17 |         return new DateTime();
18 |     }
19 | 
20 |     public function testCanGetUtc(): void
21 |     {
22 |         $this->assertInstanceOf(\DateTimeImmutable::class, $this->sut()->getUtc());
23 |         $this->assertSame(
24 |             'UTC',
25 |             $this->sut()->getUtc()->getTimezone()->getName(),
26 |         );
27 |     }
28 | 
29 |     public function testCanGetFromTimestamp(): void
30 |     {
31 |         $timestamp = (new DateTimeImmutable())->getTimestamp();
32 | 
33 |         $this->assertSame(
34 |             $timestamp,
35 |             $this->sut()->getFromTimestamp($timestamp)->getTimestamp(),
36 |         );
37 |     }
38 | 
39 |     public function testCanGetSecondsToExpirationTime(): void
40 |     {
41 |         $expirationTime = (new DateTimeImmutable())->getTimestamp() + 60;
42 | 
43 |         $this->assertSame(
44 |             60,
45 |             $this->sut()->getSecondsToExpirationTime($expirationTime),
46 |         );
47 |     }
48 | }
49 | 


--------------------------------------------------------------------------------
/tests/unit/src/Admin/Menu/ItemTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Admin\Menu;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Admin\Menu\Item;
10 | 
11 | #[CoversClass(Item::class)]
12 | class ItemTest extends TestCase
13 | {
14 |     protected string $hrefPath;
15 |     protected string $label;
16 |     protected string $iconAssetPath;
17 | 
18 |     protected function setUp(): void
19 |     {
20 |         $this->hrefPath = 'path';
21 |         $this->label = 'label';
22 |         $this->iconAssetPath = 'icon-path';
23 |     }
24 | 
25 |     protected function sut(
26 |         ?string $hrefPath = null,
27 |         ?string $label = null,
28 |         ?string $iconAssetPath = null,
29 |     ): Item {
30 |         $hrefPath ??= $this->hrefPath;
31 |         $label ??= $this->label;
32 |         $iconAssetPath ??= $this->iconAssetPath;
33 | 
34 |         return new Item($hrefPath, $label, $iconAssetPath);
35 |     }
36 | 
37 |     public function testCanCreateInstance(): void
38 |     {
39 |         $sut = $this->sut();
40 |         $this->assertInstanceOf(Item::class, $sut);
41 | 
42 |         $this->assertSame($sut->getHrefPath(), $this->hrefPath);
43 |         $this->assertSame($sut->getLabel(), $this->label);
44 |         $this->assertSame($sut->getIconAssetPath(), $this->iconAssetPath);
45 |     }
46 | }
47 | 


--------------------------------------------------------------------------------
/src/Factories/CoreFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories;
 6 | 
 7 | use SimpleSAML\Module\oidc\ModuleConfig;
 8 | use SimpleSAML\Module\oidc\Services\LoggerService;
 9 | use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmBag;
10 | use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
11 | use SimpleSAML\OpenID\Core;
12 | use SimpleSAML\OpenID\SupportedAlgorithms;
13 | 
14 | class CoreFactory
15 | {
16 |     public function __construct(
17 |         protected readonly ModuleConfig $moduleConfig,
18 |         protected readonly LoggerService $loggerService,
19 |     ) {
20 |     }
21 | 
22 |     /**
23 |      * @throws \ReflectionException
24 |      * @throws \SimpleSAML\Error\ConfigurationError
25 |      */
26 |     public function build(): Core
27 |     {
28 |         $supportedAlgorithms = new SupportedAlgorithms(
29 |             new SignatureAlgorithmBag(
30 |                 SignatureAlgorithmEnum::from($this->moduleConfig->getFederationSigner()->algorithmId()),
31 |                 SignatureAlgorithmEnum::RS384,
32 |                 SignatureAlgorithmEnum::RS512,
33 |                 SignatureAlgorithmEnum::ES256,
34 |                 SignatureAlgorithmEnum::ES384,
35 |                 SignatureAlgorithmEnum::ES512,
36 |             ),
37 |         );
38 | 
39 |         return new Core(
40 |             supportedAlgorithms: $supportedAlgorithms,
41 |             logger: $this->loggerService,
42 |         );
43 |     }
44 | }
45 | 


--------------------------------------------------------------------------------
/src/Repositories/Interfaces/AccessTokenRepositoryInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Repositories\Interfaces;
 6 | 
 7 | use League\OAuth2\Server\Entities\ClientEntityInterface as OAuth2ClientEntityInterface;
 8 | use League\OAuth2\Server\Repositories\AccessTokenRepositoryInterface as OAuth2AccessTokenRepositoryInterface;
 9 | use SimpleSAML\Module\oidc\Entities\Interfaces\AccessTokenEntityInterface;
10 | 
11 | interface AccessTokenRepositoryInterface extends OAuth2AccessTokenRepositoryInterface
12 | {
13 |     /**
14 |      * Revoke access token(s) associated with the given auth code ID.
15 |      */
16 |     public function revokeByAuthCodeId(string $authCodeId): void;
17 | 
18 |     /**
19 |      * Create a new access token
20 |      *
21 |      * @param \League\OAuth2\Server\Entities\ClientEntityInterface $clientEntity
22 |      * @param \League\OAuth2\Server\Entities\ScopeEntityInterface[] $scopes
23 |      * @param mixed $userIdentifier
24 |      * @param string|null $authCodeId
25 |      * @param array|null $requestedClaims Any requested claims
26 |      * @return \SimpleSAML\Module\oidc\Entities\Interfaces\AccessTokenEntityInterface
27 |      */
28 |     public function getNewToken(
29 |         OAuth2ClientEntityInterface $clientEntity,
30 |         array $scopes,
31 |         $userIdentifier = null,
32 |         ?string $authCodeId = null,
33 |         ?array $requestedClaims = null,
34 |     ): AccessTokenEntityInterface;
35 | }
36 | 


--------------------------------------------------------------------------------
/src/Services/ErrorResponder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Services;
 6 | 
 7 | use League\OAuth2\Server\Exception\OAuthServerException;
 8 | use SimpleSAML\Error\Error;
 9 | use SimpleSAML\Module\oidc\Bridges\PsrHttpBridge;
10 | use Symfony\Component\HttpFoundation\JsonResponse;
11 | use Symfony\Component\HttpFoundation\Response;
12 | use Throwable;
13 | 
14 | class ErrorResponder
15 | {
16 |     public function __construct(
17 |         private readonly PsrHttpBridge $psrHttpBridge,
18 |     ) {
19 |     }
20 | 
21 |     /**
22 |      * @throws \Throwable
23 |      * @throws \SimpleSAML\Error\Error
24 |      */
25 |     public function forException(Throwable $exception): Response
26 |     {
27 |         // We'll throw SSP Errors, so they are simply shown.
28 |         if (is_a($exception, Error::class)) {
29 |             throw $exception;
30 |         }
31 | 
32 |         if (is_a($exception, OAuthServerException::class)) {
33 |             return $this->psrHttpBridge->getHttpFoundationFactory()->createResponse(
34 |                 $exception->generateHttpResponse($this->psrHttpBridge->getResponseFactory()->createResponse()),
35 |             );
36 |         }
37 | 
38 |         return new JsonResponse(
39 |             [
40 |                 'error' => [
41 |                     'code' => 500,
42 |                     'message' => $exception->getMessage(),
43 |                 ],
44 |             ],
45 |             500,
46 |         );
47 |     }
48 | }
49 | 


--------------------------------------------------------------------------------
/src/Factories/JwksFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories;
 6 | 
 7 | use SimpleSAML\Module\oidc\ModuleConfig;
 8 | use SimpleSAML\Module\oidc\Services\LoggerService;
 9 | use SimpleSAML\Module\oidc\Utils\FederationCache;
10 | use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmBag;
11 | use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
12 | use SimpleSAML\OpenID\Jwks;
13 | use SimpleSAML\OpenID\SupportedAlgorithms;
14 | 
15 | class JwksFactory
16 | {
17 |     public function __construct(
18 |         protected readonly ModuleConfig $moduleConfig,
19 |         protected readonly LoggerService $loggerService,
20 |         protected readonly ?FederationCache $federationCache = null,
21 |     ) {
22 |     }
23 | 
24 |     /**
25 |      * @throws \ReflectionException
26 |      * @throws \SimpleSAML\Error\ConfigurationError
27 |      */
28 |     public function build(): Jwks
29 |     {
30 |         $supportedAlgorithms = new SupportedAlgorithms(
31 |             new SignatureAlgorithmBag(
32 |                 SignatureAlgorithmEnum::from($this->moduleConfig->getFederationSigner()->algorithmId()),
33 |             ),
34 |         );
35 | 
36 |         return new Jwks(
37 |             supportedAlgorithms: $supportedAlgorithms,
38 |             maxCacheDuration: $this->moduleConfig->getFederationCacheMaxDurationForFetched(),
39 |             cache: $this->federationCache?->cache,
40 |             logger: $this->loggerService,
41 |         );
42 |     }
43 | }
44 | 


--------------------------------------------------------------------------------
/src/Services/LogoutTokenBuilder.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Services;
 6 | 
 7 | use SimpleSAML\Module\oidc\Server\Associations\Interfaces\RelyingPartyAssociationInterface;
 8 | use stdClass;
 9 | 
10 | class LogoutTokenBuilder
11 | {
12 |     public function __construct(
13 |         protected JsonWebTokenBuilderService $jsonWebTokenBuilderService = new JsonWebTokenBuilderService(),
14 |     ) {
15 |     }
16 | 
17 |     /**
18 |      * @throws \Exception
19 |      * @throws \League\OAuth2\Server\Exception\OAuthServerException
20 |      * @psalm-suppress ArgumentTypeCoercion
21 |      */
22 |     public function forRelyingPartyAssociation(RelyingPartyAssociationInterface $relyingPartyAssociation): string
23 |     {
24 |         $logoutTokenBuilder = $this->jsonWebTokenBuilderService
25 |             ->getProtocolJwtBuilder()
26 |             ->withHeader('typ', 'logout+jwt')
27 |             ->permittedFor($relyingPartyAssociation->getClientId())
28 |             ->relatedTo($relyingPartyAssociation->getUserId())
29 |             ->withClaim('events', ['http://schemas.openid.net/event/backchannel-logout' => new stdClass()])
30 |         ;
31 | 
32 |         if ($relyingPartyAssociation->getSessionId() !== null) {
33 |             $logoutTokenBuilder = $logoutTokenBuilder->withClaim('sid', $relyingPartyAssociation->getSessionId());
34 |         }
35 | 
36 |         return $this->jsonWebTokenBuilderService->getSignedProtocolJwt($logoutTokenBuilder)->toString();
37 |     }
38 | }
39 | 


--------------------------------------------------------------------------------
/src/Controllers/JwksController.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Controllers;
18 | 
19 | use Laminas\Diactoros\Response\JsonResponse;
20 | use SimpleSAML\Module\oidc\Bridges\PsrHttpBridge;
21 | use SimpleSAML\Module\oidc\Services\JsonWebKeySetService;
22 | use Symfony\Component\HttpFoundation\Response;
23 | 
24 | class JwksController
25 | {
26 |     public function __construct(
27 |         private readonly JsonWebKeySetService $jsonWebKeySetService,
28 |         private readonly PsrHttpBridge $psrHttpBridge,
29 |     ) {
30 |     }
31 | 
32 |     public function __invoke(): JsonResponse
33 |     {
34 |         return new JsonResponse([
35 |             'keys' => array_values($this->jsonWebKeySetService->protocolKeys()),
36 |         ]);
37 |     }
38 | 
39 |     public function jwks(): Response
40 |     {
41 |         $response = $this->psrHttpBridge->getHttpFoundationFactory()->createResponse($this->__invoke());
42 |         $response->headers->set('Access-Control-Allow-Origin', '*');
43 |         return $response;
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/hooks/hook_federationpage.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | use SimpleSAML\Locale\Translate;
18 | use SimpleSAML\Module;
19 | use SimpleSAML\Module\oidc\ModuleConfig;
20 | use SimpleSAML\Module\oidc\Services\DatabaseMigration;
21 | use SimpleSAML\XHTML\Template;
22 | 
23 | /**
24 |  * @param \SimpleSAML\XHTML\Template $template
25 |  */
26 | function oidc_hook_federationpage(Template $template): void
27 | {
28 |     $routes = new Module\oidc\Utils\Routes(
29 |         new ModuleConfig(),
30 |         new Module\oidc\Bridges\SspBridge(),
31 |     );
32 | 
33 |     $href = $routes->urlAdminClients();
34 |     $text = Translate::noop('OIDC Client Registry');
35 | 
36 |     if (! (new DatabaseMigration())->isMigrated()) {
37 |         $href = $routes->urlAdminMigrations();
38 |         $text = Translate::noop('OIDC Installation');
39 |     }
40 | 
41 |     if (!is_array($template->data['links'])) {
42 |         $template->data['links'] = [];
43 |     }
44 | 
45 |     $template->data['links'][] = [
46 |         'href' => $href,
47 |         'text' => $text,
48 |     ];
49 | }
50 | 


--------------------------------------------------------------------------------
/src/Helpers/Arr.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Helpers;
 6 | 
 7 | class Arr
 8 | {
 9 |     /**
10 |      * Find item in array using the given callable.
11 |      *
12 |      * @return mixed|null
13 |      */
14 |     public function findByCallback(array $arr, callable $fn): mixed
15 |     {
16 |         /** @psalm-suppress MixedAssignment */
17 |         foreach ($arr as $x) {
18 |             if (call_user_func($fn, $x) === true) {
19 |                 return $x;
20 |             }
21 |         }
22 | 
23 |         return null;
24 |     }
25 | 
26 |     /**
27 |      * @param array $values
28 |      * @return string[]
29 |      */
30 |     public function ensureStringValues(array $values): array
31 |     {
32 |         return array_map(fn(mixed $value): string => (string)$value, $values);
33 |     }
34 | 
35 |     public function isValueOneOf(mixed $value, array $set): bool
36 |     {
37 |         $value = is_array($value) ? $value : [$value];
38 |         return !empty(array_intersect($value, $set));
39 |     }
40 | 
41 |     public function isValueSubsetOf(mixed $value, array $superset): bool
42 |     {
43 |         $value = is_array($value) ? $value : [$value];
44 | 
45 |         return empty(array_diff($value, $superset));
46 |     }
47 | 
48 |     public function isValueSupersetOf(mixed $value, array $subset): bool
49 |     {
50 |         $value = is_array($value) ? $value : [$value];
51 | 
52 |         // Opposite of subset...
53 |         return $this->isValueSubsetOf($subset, $value);
54 |     }
55 | }
56 | 


--------------------------------------------------------------------------------
/src/Factories/IdTokenResponseFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Factories;
18 | 
19 | use League\OAuth2\Server\CryptKey;
20 | use SimpleSAML\Module\oidc\ModuleConfig;
21 | use SimpleSAML\Module\oidc\Repositories\UserRepository;
22 | use SimpleSAML\Module\oidc\Server\ResponseTypes\IdTokenResponse;
23 | use SimpleSAML\Module\oidc\Services\IdTokenBuilder;
24 | 
25 | class IdTokenResponseFactory
26 | {
27 |     public function __construct(
28 |         private readonly ModuleConfig $moduleConfig,
29 |         private readonly UserRepository $userRepository,
30 |         private readonly IdTokenBuilder $idTokenBuilder,
31 |         private readonly CryptKey $privateKey,
32 |     ) {
33 |     }
34 | 
35 |     public function build(): IdTokenResponse
36 |     {
37 |         $idTokenResponse = new IdTokenResponse(
38 |             $this->userRepository,
39 |             $this->idTokenBuilder,
40 |             $this->privateKey,
41 |         );
42 |         $idTokenResponse->setEncryptionKey($this->moduleConfig->getEncryptionKey());
43 | 
44 |         return $idTokenResponse;
45 |     }
46 | }
47 | 


--------------------------------------------------------------------------------
/tests/unit/src/Server/RequestRules/ResultTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Server\RequestRules;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
 9 | 
10 | /**
11 |  * @covers \SimpleSAML\Module\oidc\Server\RequestRules\Result
12 |  */
13 | class ResultTest extends TestCase
14 | {
15 |     protected string $key = 'some-key';
16 |     protected string $value = 'some-value';
17 | 
18 |     public function testConstruct(): Result
19 |     {
20 |         $result = new Result($this->key, $this->value);
21 |         $this->assertInstanceOf(Result::class, $result);
22 |         return $result;
23 |     }
24 | 
25 |     public function testConstructWithoutValue(): void
26 |     {
27 |         $this->assertInstanceOf(Result::class, new Result($this->key));
28 |     }
29 | 
30 |     /**
31 |      * @depends testConstruct
32 |      */
33 |     public function testGetKey(Result $result): void
34 |     {
35 |         $this->assertSame($this->key, $result->getKey());
36 |     }
37 | 
38 |     /**
39 |      * @depends testConstruct
40 |      *
41 |      */
42 |     public function testGetValue(Result $result): void
43 |     {
44 |         $this->assertSame($this->value, $result->getValue());
45 |     }
46 | 
47 |     /**
48 |      * @depends testConstruct
49 |      */
50 |     public function testSetValue(Result $result): void
51 |     {
52 |         $newValue = 'new-value';
53 |         $result->setValue($newValue);
54 | 
55 |         $this->assertSame($newValue, $result->getValue());
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/tests/unit/src/Bridges/SspBridge/UtilsTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Bridges\SspBridge;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge\Utils;
10 | use SimpleSAML\Utils\Attributes;
11 | use SimpleSAML\Utils\Auth;
12 | use SimpleSAML\Utils\Config;
13 | use SimpleSAML\Utils\HTTP;
14 | use SimpleSAML\Utils\Random;
15 | 
16 | #[CoversClass(Utils::class)]
17 | class UtilsTest extends TestCase
18 | {
19 |     protected function sut(): Utils
20 |     {
21 |         return new Utils();
22 |     }
23 | 
24 |     public function testCanCreateInstance(): void
25 |     {
26 |         $this->assertInstanceOf(Utils::class, $this->sut());
27 |     }
28 | 
29 |     public function testCanBuildConfigInstance(): void
30 |     {
31 |         $this->assertInstanceOf(Config::class, $this->sut()->config());
32 |     }
33 | 
34 |     public function testCanBuildHttpInstance(): void
35 |     {
36 |         $this->assertInstanceOf(HTTP::class, $this->sut()->http());
37 |     }
38 | 
39 |     public function testCanBuildRandomInstance(): void
40 |     {
41 |         $this->assertInstanceOf(Random::class, $this->sut()->random());
42 |     }
43 | 
44 |     public function testCanBuildAuthInstance(): void
45 |     {
46 |         $this->assertInstanceOf(Auth::class, $this->sut()->auth());
47 |     }
48 | 
49 |     public function testCanBuileAttributesInstance(): void
50 |     {
51 |         $this->assertInstanceOf(Attributes::class, $this->sut()->attributes());
52 |     }
53 | }
54 | 


--------------------------------------------------------------------------------
/psalm.xml:
--------------------------------------------------------------------------------
 1 | <?xml version="1.0"?>
 2 | <psalm
 3 |   name="SSP OIDC"
 4 |   errorLevel="1"
 5 |   findUnusedBaselineEntry="true"
 6 |   findUnusedCode="true"
 7 |   cacheDirectory="build/psalm"
 8 |   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 9 |   xmlns="https://getpsalm.org/schema/config"
10 |   xsi:schemaLocation="https://getpsalm.org/schema/config vendor/vimeo/psalm/config.xsd"
11 | >
12 |   <projectFiles>
13 |     <directory name="config" />
14 |     <directory name="hooks" />
15 |     <directory name="src" />
16 |     <directory name="templates" />
17 |     <directory name="public" />
18 |     <directory name="routing/routes" />
19 | 
20 |     <ignoreFiles>
21 |       <directory name="vendor" />
22 |     </ignoreFiles>
23 |   </projectFiles>
24 | 
25 |   <issueHandlers>
26 |     <!-- Ignore UnresolvableInclude on CLI-scripts -->
27 |     <UnresolvableInclude>
28 |         <errorLevel type="suppress">
29 |           <file name="tests/bootstrap.php" />
30 |         </errorLevel>
31 |     </UnresolvableInclude>
32 |     <InvalidClassConstantType>
33 |       <errorLevel type="suppress">
34 |         <file name="src/Forms/Controls/CsrfProtection.php" />
35 |       </errorLevel>
36 |     </InvalidClassConstantType>
37 | 
38 |     <!-- Ignore errors related to unused classes, methods... -->
39 |     <UnusedClass errorLevel="suppress" />
40 |     <PossiblyUnusedMethod errorLevel="suppress" />
41 |     <PossiblyUnusedReturnValue errorLevel="suppress" />
42 | 
43 |     <!-- Ignore RiskyTruthyFalsyComparison -->
44 |     <RiskyTruthyFalsyComparison errorLevel="suppress" />
45 |   </issueHandlers>
46 | </psalm>
47 | 
48 | 


--------------------------------------------------------------------------------
/hooks/hook_adminmenu.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | use SimpleSAML\Locale\Translate;
 6 | use SimpleSAML\Module\oidc\Codebooks\RoutesEnum;
 7 | use SimpleSAML\Module\oidc\ModuleConfig;
 8 | use SimpleSAML\XHTML\Template;
 9 | 
10 | /** @noinspection PhpParameterByRefIsNotUsedAsReferenceInspection Reference is actually used by SimpleSAMLphp */
11 | function oidc_hook_adminmenu(Template &$template): void
12 | {
13 |     $menuKey = 'menu';
14 | 
15 |     if (!isset($template->data[$menuKey]) || !is_array($template->data[$menuKey])) {
16 |         return;
17 |     }
18 | 
19 |     $moduleConfig = new ModuleConfig();
20 | 
21 |     $oidcMenuEntry = [
22 |         ModuleConfig::MODULE_NAME => [
23 |             'url' => $moduleConfig->getModuleUrl(RoutesEnum::AdminMigrations->value),
24 |             'name' => Translate::noop('OIDC'),
25 |         ],
26 |     ];
27 | 
28 |     // Put OIDC entry before the 'Log out' entry, if it exists.
29 |     $logoutEntryKey = 'logout';
30 |     $logoutEntryValue = null;
31 |     if (
32 |         array_key_exists($logoutEntryKey, $template->data[$menuKey]) &&
33 |         is_array($template->data[$menuKey][$logoutEntryKey])
34 |     ) {
35 |         $logoutEntryValue = $template->data[$menuKey][$logoutEntryKey];
36 |         unset($template->data[$menuKey][$logoutEntryKey]);
37 |     }
38 | 
39 |     $template->data[$menuKey] += $oidcMenuEntry;
40 | 
41 |     if ($logoutEntryValue !== null) {
42 |         $template->data[$menuKey][$logoutEntryKey] = $logoutEntryValue;
43 |     }
44 | 
45 |     $template->getLocalization()->addModuleDomain(ModuleConfig::MODULE_NAME);
46 | }
47 | 


--------------------------------------------------------------------------------
/templates/base.twig:
--------------------------------------------------------------------------------
 1 | {% set showMenu = showMenu ?? false %}
 2 | {% set moduleName = 'OIDC'|trans %}
 3 | {% set subPageTitle = subPageTitle ?? '' %}
 4 | {% set pagetitle = 'OIDC' ~ (subPageTitle ? ' | ' ~ subPageTitle : '')  %}
 5 | 
 6 | {% extends "base.twig" %}
 7 | 
 8 | {% block preload %}
 9 |     <link rel="stylesheet" href="{{ asset('css/src/default.css', 'oidc') }}">
10 | {% endblock %}
11 | 
12 | {% block content %}
13 | 
14 |     {% if showMenu %}
15 |         {%- include "@admin/includes/menu.twig" %}
16 |     {% endif %}
17 | 
18 |     {% if showModuleName %}
19 |         <h2>{{ moduleName }}</h2>
20 |     {% endif %}
21 | 
22 |     <div class="oidc-container">
23 | 
24 |         {% if showMenu %}
25 |             {% include '@oidc/includes/menu.twig' %}
26 |         {% endif %}
27 | 
28 |         <div class="content">
29 |             {% if showSubpageTitle %}
30 |                 <h3>{{ subPageTitle }}</h3>
31 |             {% endif %}
32 | 
33 |             {% if sessionMessages is defined and sessionMessages is not empty %}
34 |                 <div class="message-box">
35 |                     {% for message in sessionMessages %}
36 |                         {{ message|trans }}<br>
37 |                     {% endfor %}
38 |                 </div>
39 |             {% endif %}
40 | 
41 |             {% block oidcContent %}{% endblock %}
42 |         </div>
43 |     </div>
44 | 
45 | {% endblock content -%}
46 | 
47 | {% block postload %}
48 | 
49 |     {{ parent() }}
50 | 
51 |     <script src="{{ asset('js/src/default.js', 'oidc') }}"></script>
52 | {% endblock postload %}
53 | 
54 | {% block oidcPostload %}{% endblock %}
55 | 


--------------------------------------------------------------------------------
/tests/unit/src/Repositories/CodeChallengeVerifiersRepositoryTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Repositories;
 6 | 
 7 | use League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface;
 8 | use PHPUnit\Framework\Attributes\CoversClass;
 9 | use PHPUnit\Framework\TestCase;
10 | use SimpleSAML\Module\oidc\Repositories\CodeChallengeVerifiersRepository;
11 | 
12 | #[CoversClass(CodeChallengeVerifiersRepository::class)]
13 | class CodeChallengeVerifiersRepositoryTest extends TestCase
14 | {
15 |     protected function sut(): CodeChallengeVerifiersRepository
16 |     {
17 |         return new CodeChallengeVerifiersRepository();
18 |     }
19 | 
20 |     public function testCanCreateInstance(): void
21 |     {
22 |         $this->assertInstanceOf(CodeChallengeVerifiersRepository::class, $this->sut());
23 |     }
24 | 
25 |     public function testCanGetCodeChallengeVerifier(): void
26 |     {
27 |         $this->assertInstanceOf(
28 |             CodeChallengeVerifierInterface::class,
29 |             $this->sut()->get('S256'),
30 |         );
31 |         $this->assertTrue($this->sut()->has('S256'));
32 | 
33 |         $this->assertInstanceOf(
34 |             CodeChallengeVerifierInterface::class,
35 |             $this->sut()->get('plain'),
36 |         );
37 |         $this->assertTrue($this->sut()->has('plain'));
38 | 
39 |         $this->assertNotEmpty($this->sut()->getAll());
40 |     }
41 | 
42 |     public function testReturnsNullForUnsuportedVerifier(): void
43 |     {
44 |         $this->assertNull($this->sut()->get('unsuported'));
45 |     }
46 | }
47 | 


--------------------------------------------------------------------------------
/src/Helpers.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc;
 6 | 
 7 | use SimpleSAML\Module\oidc\Helpers\Arr;
 8 | use SimpleSAML\Module\oidc\Helpers\Client;
 9 | use SimpleSAML\Module\oidc\Helpers\DateTime;
10 | use SimpleSAML\Module\oidc\Helpers\Http;
11 | use SimpleSAML\Module\oidc\Helpers\Random;
12 | use SimpleSAML\Module\oidc\Helpers\Scope;
13 | use SimpleSAML\Module\oidc\Helpers\Str;
14 | 
15 | class Helpers
16 | {
17 |     protected static ?Http $http = null;
18 |     protected static ?Client $client = null;
19 |     protected static ?DateTime $dateTIme = null;
20 |     protected static ?Str $str = null;
21 |     protected static ?Arr $arr = null;
22 |     protected static ?Random $random = null;
23 |     protected static ?Scope $scope = null;
24 | 
25 |     public function http(): Http
26 |     {
27 |         return static::$http ??= new Http();
28 |     }
29 | 
30 |     public function client(): Client
31 |     {
32 |         return static::$client ??= new Client(
33 |             $this->http(),
34 |         );
35 |     }
36 | 
37 |     public function dateTime(): DateTime
38 |     {
39 |         return static::$dateTIme ??= new DateTime();
40 |     }
41 | 
42 |     public function str(): Str
43 |     {
44 |         return static::$str ??= new Str();
45 |     }
46 | 
47 |     public function arr(): Arr
48 |     {
49 |         return static::$arr ??= new Arr();
50 |     }
51 | 
52 |     public function random(): Random
53 |     {
54 |         return static::$random ??= new Random();
55 |     }
56 | 
57 |     public function scope(): Scope
58 |     {
59 |         return static::$scope ??= new Scope();
60 |     }
61 | }
62 | 


--------------------------------------------------------------------------------
/.github/workflows/documentation.yml:
--------------------------------------------------------------------------------
 1 | ---
 2 | 
 3 | name: Documentation
 4 | 
 5 | on:  # yamllint disable-line rule:truthy
 6 |   push:
 7 |     branches: [master, simplesamlphp-*]
 8 |     paths:
 9 |       - '**.md'
10 |   pull_request:
11 |     branches: [master, simplesamlphp-*]
12 |     paths:
13 |       - '**.md'
14 |   workflow_dispatch:
15 | 
16 | jobs:
17 |   quality:
18 |     name: Quality checks
19 |     runs-on: [ubuntu-latest]
20 | 
21 |     steps:
22 |       - uses: actions/checkout@v5
23 | 
24 |       - name: Lint markdown files
25 |         uses: nosborn/github-action-markdown-cli@v3
26 |         with:
27 |           files: .
28 |           ignore_path: .markdownlintignore
29 | 
30 |       - name: Perform spell check
31 |         uses: codespell-project/actions-codespell@v2
32 |         with:
33 |           path: '**/*.md'
34 |           check_filenames: true
35 |           ignore_words_list: tekst
36 | 
37 |   build:
38 |     name: Build documentation
39 |     needs: quality
40 |     runs-on: [ubuntu-latest]
41 | 
42 |     steps:
43 |       - name: Run docs build
44 |         if: github.event_name != 'pull_request'
45 |         uses: actions/github-script@v8
46 |         with:
47 |           # Token has to be generated on a user account that controls the docs-repository.
48 |           # The _only_ scope to select is "Access public repositories", nothing more.
49 |           github-token: ${{ secrets.PAT_TOKEN }}
50 |           script: |
51 |             await github.rest.actions.createWorkflowDispatch({
52 |               owner: 'simplesamlphp',
53 |               repo: 'docs',
54 |               workflow_id: 'mk_docs.yml',
55 |               ref: 'main'
56 |             })
57 | 


--------------------------------------------------------------------------------
/src/Server/Associations/RelyingPartyAssociation.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\Associations;
 6 | 
 7 | use SimpleSAML\Module\oidc\Server\Associations\Interfaces\RelyingPartyAssociationInterface;
 8 | 
 9 | class RelyingPartyAssociation implements RelyingPartyAssociationInterface
10 | {
11 |     public function __construct(
12 |         protected string $clientId,
13 |         protected string $userId,
14 |         protected ?string $sessionId,
15 |         /**
16 |          * Registered back-channel logout URI for the client.
17 |          */
18 |         protected ?string $backChannelLogoutUri = null,
19 |     ) {
20 |     }
21 | 
22 |     public function getClientId(): string
23 |     {
24 |         return $this->clientId;
25 |     }
26 | 
27 |     public function setClientId(string $clientId): void
28 |     {
29 |         $this->clientId = $clientId;
30 |     }
31 | 
32 |     public function getUserId(): string
33 |     {
34 |         return $this->userId;
35 |     }
36 | 
37 |     public function setUserId(string $userId): void
38 |     {
39 |         $this->userId = $userId;
40 |     }
41 | 
42 |     public function getSessionId(): ?string
43 |     {
44 |         return $this->sessionId;
45 |     }
46 | 
47 |     public function setSessionId(?string $sessionId): void
48 |     {
49 |         $this->sessionId = $sessionId;
50 |     }
51 | 
52 |     public function getBackChannelLogoutUri(): ?string
53 |     {
54 |         return $this->backChannelLogoutUri;
55 |     }
56 | 
57 |     public function setBackChannelLogoutUri(?string $backChannelLogoutUri): void
58 |     {
59 |         $this->backChannelLogoutUri = $backChannelLogoutUri;
60 |     }
61 | }
62 | 


--------------------------------------------------------------------------------
/src/Entities/ScopeEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Entities;
18 | 
19 | use League\OAuth2\Server\Entities\ScopeEntityInterface;
20 | use League\OAuth2\Server\Entities\Traits\EntityTrait;
21 | 
22 | /**
23 |  * @psalm-suppress PropertyNotSetInConstructor
24 |  */
25 | class ScopeEntity implements ScopeEntityInterface
26 | {
27 |     use EntityTrait;
28 | 
29 |     /**
30 |      * @param string[] $claims
31 |      */
32 |     public function __construct(
33 |         string $identifier,
34 |         protected ?string $description = null,
35 |         protected ?string $icon = null,
36 |         protected array $claims = [],
37 |     ) {
38 |         $this->identifier = $identifier;
39 |     }
40 | 
41 |     public function getIcon(): ?string
42 |     {
43 |         return $this->icon;
44 |     }
45 | 
46 |     public function getDescription(): ?string
47 |     {
48 |         return $this->description;
49 |     }
50 | 
51 |     /**
52 |      * @return array<string>
53 |      */
54 |     public function getClaims(): array
55 |     {
56 |         return $this->claims;
57 |     }
58 | 
59 |     public function jsonSerialize(): string
60 |     {
61 |         return (string) $this->getIdentifier();
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Interfaces/RequestRuleInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Interfaces;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Services\LoggerService;
 9 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
10 | 
11 | interface RequestRuleInterface
12 | {
13 |     /**
14 |      * Get rule key, that is, rule identifier.
15 |      * @return string
16 |      */
17 |     public function getKey(): string;
18 | 
19 |     /**
20 |      * Check specific rule.
21 |      * @param \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface $currentResultBag
22 |      *   ResultBag with all results of the checks performed to current check
23 |      * @param array $data Data which will be available during check.
24 |      * @param bool $useFragmentInHttpErrorResponses Indicate that in case of HTTP error responses, params should be
25 |      *   returned in URI fragment instead of query.
26 |      * @param HttpMethodsEnum[] $allowedServerRequestMethods Indicate allowed HTTP methods used for request
27 |      * @return \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface|null Result of the specific check
28 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException If check fails
29 |      */
30 |     public function checkRule(
31 |         ServerRequestInterface $request,
32 |         ResultBagInterface $currentResultBag,
33 |         LoggerService $loggerService,
34 |         array $data = [],
35 |         bool $useFragmentInHttpErrorResponses = false,
36 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
37 |     ): ?ResultInterface;
38 | }
39 | 


--------------------------------------------------------------------------------
/src/Utils/FingerprintGenerator.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Utils;
 6 | 
 7 | use InvalidArgumentException;
 8 | 
 9 | class FingerprintGenerator
10 | {
11 |     /**
12 |      * Generate a fingerprint (hash) for a provided file.
13 |      *
14 |      * @param string $path Location of file
15 |      * @param string $algo One of the supported algorithms (see hash_algos() function)
16 |      * @return string
17 |      *
18 |      * @throws InvalidArgumentException
19 |      */
20 |     public static function forFile(string $path, string $algo = 'md5'): string
21 |     {
22 |         $fingerprint = hash_file($algo, $path);
23 | 
24 |         if (false === (bool) $fingerprint) {
25 |             throw new InvalidArgumentException(
26 |                 'Could not create a fingerprint for provided file using provided algorithm.',
27 |             );
28 |         }
29 | 
30 |         return $fingerprint;
31 |     }
32 | 
33 |     /**
34 |      * Generate a fingerprint (hash) for a provided string.
35 |      *
36 |      * @param string $content Content for which to create a fingerprint
37 |      * @param string $algo One of the supported algorithms (see hash_algos() function)
38 |      * @return string
39 |      *
40 |      * @throws \InvalidArgumentException
41 |      */
42 |     public static function forString(string $content, string $algo = 'md5'): string
43 |     {
44 |         $fingerprint = hash($algo, $content);
45 | 
46 |         if (false === (bool) $fingerprint) {
47 |             throw new InvalidArgumentException(
48 |                 'Could not create a fingerprint for provided content using provided algorithm.',
49 |             );
50 |         }
51 | 
52 |         return $fingerprint;
53 |     }
54 | }
55 | 


--------------------------------------------------------------------------------
/src/Factories/Grant/RefreshTokenGrantFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | namespace SimpleSAML\Module\oidc\Factories\Grant;
17 | 
18 | use SimpleSAML\Module\oidc\Factories\Entities\AccessTokenEntityFactory;
19 | use SimpleSAML\Module\oidc\ModuleConfig;
20 | use SimpleSAML\Module\oidc\Repositories\RefreshTokenRepository;
21 | use SimpleSAML\Module\oidc\Server\Grants\RefreshTokenGrant;
22 | use SimpleSAML\Module\oidc\Server\TokenIssuers\RefreshTokenIssuer;
23 | 
24 | class RefreshTokenGrantFactory
25 | {
26 |     public function __construct(
27 |         private readonly ModuleConfig $moduleConfig,
28 |         private readonly RefreshTokenRepository $refreshTokenRepository,
29 |         private readonly AccessTokenEntityFactory $accessTokenEntityFactory,
30 |         private readonly RefreshTokenIssuer $refreshTokenIssuer,
31 |     ) {
32 |     }
33 | 
34 |     public function build(): RefreshTokenGrant
35 |     {
36 |         $refreshTokenGrant = new RefreshTokenGrant(
37 |             $this->refreshTokenRepository,
38 |             $this->accessTokenEntityFactory,
39 |             $this->refreshTokenIssuer,
40 |         );
41 | 
42 |         $refreshTokenGrant->setRefreshTokenTTL($this->moduleConfig->getRefreshTokenDuration());
43 | 
44 |         return $refreshTokenGrant;
45 |     }
46 | }
47 | 


--------------------------------------------------------------------------------
/tests/unit/src/Admin/MenuTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Admin;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\Attributes\UsesClass;
 9 | use PHPUnit\Framework\MockObject\MockObject;
10 | use PHPUnit\Framework\TestCase;
11 | use SimpleSAML\Module\oidc\Admin\Menu;
12 | use SimpleSAML\Module\oidc\Admin\Menu\Item;
13 | 
14 | #[CoversClass(Menu::class)]
15 | #[UsesClass(Item::class)]
16 | class MenuTest extends TestCase
17 | {
18 |     protected MockObject $itemMock;
19 | 
20 |     protected function setUp(): void
21 |     {
22 |         $this->itemMock = $this->createMock(Item::class);
23 |     }
24 | 
25 |     protected function sut(
26 |         ?Item ...$items,
27 |     ): Menu {
28 |         return new Menu(...$items);
29 |     }
30 | 
31 |     public function testCanCreateInstance(): void
32 |     {
33 |         $this->assertInstanceOf(Menu::class, $this->sut());
34 |         $this->assertInstanceOf(Menu::class, $this->sut($this->itemMock));
35 |     }
36 | 
37 |     public function testCanAddGetItem(): void
38 |     {
39 |         $sut = $this->sut();
40 |         $this->assertEmpty($sut->getItems());
41 |         $sut->addItem($this->itemMock);
42 |         $this->assertCount(1, $sut->getItems());
43 |     }
44 | 
45 |     public function testCanSetGetActiveHrefPath(): void
46 |     {
47 |         $sut = $this->sut();
48 |         $this->assertNull($sut->getActiveHrefPath());
49 |         $sut->setActiveHrefPath('oidc');
50 |         $this->assertSame('oidc', $sut->getActiveHrefPath());
51 |     }
52 | 
53 |     public function testCanBuildItem(): void
54 |     {
55 |         $this->assertInstanceOf(Item::class, $this->sut()->buildItem('oidc', 'OIDC'));
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/src/Factories/FormFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Factories;
18 | 
19 | use Nette\Forms\Form;
20 | use SimpleSAML\Error\Exception;
21 | use SimpleSAML\Module\oidc\Bridges\SspBridge;
22 | use SimpleSAML\Module\oidc\Forms\Controls\CsrfProtection;
23 | use SimpleSAML\Module\oidc\Helpers;
24 | use SimpleSAML\Module\oidc\ModuleConfig;
25 | 
26 | class FormFactory
27 | {
28 |     public function __construct(
29 |         protected readonly ModuleConfig $moduleConfig,
30 |         protected readonly CsrfProtection $csrfProtection,
31 |         protected readonly SspBridge $sspBridge,
32 |         protected readonly Helpers $helpers,
33 |     ) {
34 |     }
35 | 
36 |     /**
37 |      * @param class-string $classname Form classname
38 |      *
39 |      * @throws \SimpleSAML\Error\Exception
40 |      */
41 |     public function build(string $classname): Form
42 |     {
43 |         if (!is_a($classname, Form::class, true)) {
44 |             throw new Exception("Invalid form: $classname");
45 |         }
46 | 
47 |         /** @psalm-suppress UnsafeInstantiation */
48 |         return new $classname(
49 |             $this->moduleConfig,
50 |             $this->csrfProtection,
51 |             $this->sspBridge,
52 |             $this->helpers,
53 |         );
54 |     }
55 | }
56 | 


--------------------------------------------------------------------------------
/docker/ssp/oidc_module.key:
--------------------------------------------------------------------------------
 1 | -----BEGIN RSA PRIVATE KEY-----
 2 | MIIEpQIBAAKCAQEAq2EgIfAMG2XpfjRCAUHQQqLAbrOL4s+JwL0X3jO2imVzbBp9
 3 | MadLzGQhczyhKHM0B9YumHSwNjD5hrQQso02CaGientCzhm9PqerjffZ+0B4+FfG
 4 | ws0ozwyfA7hW1arhBx92D8r7Hw0HHu1QwSQ2N4zlmCea7shWTC4CoO8ECJcPDYe2
 5 | /wABLCPZm0dcv/sPYln7HAiukI2fxwMpf3yQXihcQQXdHHoOncUn7QlibUQj//Zx
 6 | k0obEkJAUyqxFKa+3cuToFkfSH7bGs8YnI3qy/YzmsutI3keeEIQOTNAtLgauqZ4
 7 | CW+Your+9vsUXaNjNshnObNHWLPc37DJaRyApwIDAQABAoIBAE0+msARNTPILITQ
 8 | wwtUAa13M+rxjFRvnLQ9xptFjbo1Xd/U1Kbjs9ttKlKJek4EFuiNVjUrKx1R17Yq
 9 | RPhlg3y12MkB86t3mH+8DSwREbQYbC3rSlAVLpacJrQDi0gFHCYcvRcDM0rckWAU
10 | MPjM/I7vN7Dr8P49WABAILku4g+IYaEDUXMGjNnLwgbK6nXCyOn9pwKSqA0SYltI
11 | X63Ba1N13oCigR7UtHvHcRHEWzPkBJO5/pLnNfF+0Tn2z7WXVe5oxCar9nTrUfIP
12 | aspwSjGam7cFbyutnlRLX5/Rkk7r4PkXShP++08GxYTzV7nLhwpN33W0F6B8HLEH
13 | Nu56ihECgYEA20t5gbnRF6QFabJ277uTJ24jdpitB5UOIA8+K9/cPnBsSCfWjexY
14 | Nl0UYuJap3W80dL6lV8VuJZZ0ojAxE+Qwh04MZZXq/Egxn6l+6TNeUCbBHaaj1pl
15 | X0vdxIpC5BKmXhwLLtuqzVg7t3O1NK0c0tZ+kipUA7DenVT2ZHGCyA8CgYEAyBCH
16 | /GFbqsq3Oq8CURZ9osVq5eNXrXeiIp3OlbpywDYFNPLg91mck71gT6btZeuaAH7/
17 | q7unxZ007ADAoKGPvRKtGa25RB5Vy+dC7F4EDdzz/UBh+fl2zg33W7toh9Kb2OGd
18 | HycEWgU4z+ZpC5fH0v892TlAqPQTFQx+F9rx5ekCgYEAsme7qWtHjUkWUkArfKuI
19 | cyqqVUCufB2qiTB9bupHXtDNdwJaDco6lbex7yShhd1GSRmwXTcnD63Z02sIEG1+
20 | oj1tSwI5vxuDg5jjZk9UDpIdy0rGQVvUXuv0toGZG72Edcmw22VAlqByrLPIttsj
21 | OO/htv4SrZIF+c92SI8ES8cCgYEAmxktwzva69pCGE2K10A/YAv6ZoRL+aAwYvPC
22 | LxOfWGHIwZa1Tyz6lRKQcs+vZX80IcRTA1j0pN/OIlQnAaCepW6wIaMraKK30t7T
23 | ZBkyvWiZArGCA2AheXccV9I/JGTjC01FGNyPpBY+R/aRYzpk4K+dzCR1e0XU8VGB
24 | A49qTtkCgYEAhQqvYFBlPo5T/W6tWxLLcrvUXIUL2zt4qpKKvdKXTbYwWyUaVp6H
25 | Bu/fG1KQotNwpKDwgIb9Zv/obyW9wFhhNpobvvI273wyFZMps5bu50WIOggFErak
26 | GwPXiagzBlhklsfR+TpFYQ6MTo3ymhLy2+wVIOqV/tjUaRkT7kNk98U=
27 | -----END RSA PRIVATE KEY-----


--------------------------------------------------------------------------------
/src/Repositories/CodeChallengeVerifiersRepository.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Repositories;
 6 | 
 7 | use League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface;
 8 | use League\OAuth2\Server\CodeChallengeVerifiers\PlainVerifier;
 9 | use League\OAuth2\Server\CodeChallengeVerifiers\S256Verifier;
10 | 
11 | use function hash_algos;
12 | use function in_array;
13 | 
14 | class CodeChallengeVerifiersRepository
15 | {
16 |     /**
17 |      * @var \League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface[]
18 |      */
19 |     protected array $codeChallengeVerifiers = [];
20 | 
21 |     public function __construct()
22 |     {
23 |         if (in_array('sha256', hash_algos(), true)) {
24 |             $s256Verifier = new S256Verifier();
25 |             $this->codeChallengeVerifiers[$s256Verifier->getMethod()] = $s256Verifier;
26 |         }
27 | 
28 |         $plainVerifier = new PlainVerifier();
29 |         $this->codeChallengeVerifiers[$plainVerifier->getMethod()] = $plainVerifier;
30 |     }
31 | 
32 |     /**
33 |      * @return \League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface[]
34 |      */
35 |     public function getAll(): array
36 |     {
37 |         return $this->codeChallengeVerifiers;
38 |     }
39 | 
40 |     /**
41 |      * @return \League\OAuth2\Server\CodeChallengeVerifiers\CodeChallengeVerifierInterface|null
42 |      *   Verifier for the method or null if not supported.
43 |      */
44 |     public function get(string $method): ?CodeChallengeVerifierInterface
45 |     {
46 |         return $this->codeChallengeVerifiers[$method] ?? null;
47 |     }
48 | 
49 |     public function has(string $method): bool
50 |     {
51 |         return isset($this->codeChallengeVerifiers[$method]);
52 |     }
53 | }
54 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/ResponseTypeRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
11 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
12 | use SimpleSAML\Module\oidc\Services\LoggerService;
13 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
14 | use SimpleSAML\OpenID\Codebooks\ParamsEnum;
15 | 
16 | class ResponseTypeRule extends AbstractRule
17 | {
18 |     /**
19 |      * @inheritDoc
20 |      */
21 |     public function checkRule(
22 |         ServerRequestInterface $request,
23 |         ResultBagInterface $currentResultBag,
24 |         LoggerService $loggerService,
25 |         array $data = [],
26 |         bool $useFragmentInHttpErrorResponses = false,
27 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
28 |     ): ?ResultInterface {
29 |         $requestParams = $this->requestParamsResolver->getAllBasedOnAllowedMethods(
30 |             $request,
31 |             $allowedServerRequestMethods,
32 |         );
33 | 
34 |         if (
35 |             !isset($requestParams[ParamsEnum::ResponseType->value]) ||
36 |             !isset($requestParams[ParamsEnum::ClientId->value])
37 |         ) {
38 |             throw  OidcServerException::invalidRequest('Missing response_type or client_id');
39 |         }
40 | 
41 |         // TODO v7 consider checking for supported response types, for example, from configuration...
42 | 
43 |         return new Result($this->getKey(), $requestParams[ParamsEnum::ResponseType->value]);
44 |     }
45 | }
46 | 


--------------------------------------------------------------------------------
/src/Factories/AuthSimpleFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Factories;
18 | 
19 | use SimpleSAML\Auth\Simple;
20 | use SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface;
21 | use SimpleSAML\Module\oidc\ModuleConfig;
22 | 
23 | class AuthSimpleFactory
24 | {
25 |     public function __construct(
26 |         private readonly ModuleConfig $moduleConfig,
27 |     ) {
28 |     }
29 | 
30 |     /**
31 |      * @codeCoverageIgnore
32 |      * @throws \Exception
33 |      */
34 |     public function build(ClientEntityInterface $clientEntity): Simple
35 |     {
36 |         $authSourceId = $this->resolveAuthSourceId($clientEntity);
37 | 
38 |         return new Simple($authSourceId);
39 |     }
40 | 
41 |     /**
42 |      * @return Simple The default authsource
43 |      * @throws \Exception
44 |      */
45 |     public function getDefaultAuthSource(): Simple
46 |     {
47 |         return new Simple($this->moduleConfig->getDefaultAuthSourceId());
48 |     }
49 | 
50 |     /**
51 |      * Get auth source defined on the client. If not set on the client, get the default auth source defined in config.
52 |      *
53 |      * @throws \Exception
54 |      */
55 |     public function resolveAuthSourceId(ClientEntityInterface $client): string
56 |     {
57 |         return $client->getAuthSourceId() ?? $this->moduleConfig->getDefaultAuthSourceId();
58 |     }
59 | }
60 | 


--------------------------------------------------------------------------------
/tests/unit/src/Repositories/AbstractDatabaseRepositoryTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Repositories;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\MockObject\MockObject;
 9 | use PHPUnit\Framework\TestCase;
10 | use SimpleSAML\Database;
11 | use SimpleSAML\Module\oidc\ModuleConfig;
12 | use SimpleSAML\Module\oidc\Repositories\AbstractDatabaseRepository;
13 | use SimpleSAML\Module\oidc\Utils\ProtocolCache;
14 | 
15 | #[CoversClass(AbstractDatabaseRepository::class)]
16 | class AbstractDatabaseRepositoryTest extends TestCase
17 | {
18 |     protected MockObject $moduleConfigMock;
19 |     protected MockObject $databaseMock;
20 |     protected MockObject $protocolCacheMock;
21 | 
22 |     protected function setUp(): void
23 |     {
24 |         $this->moduleConfigMock = $this->createMock(ModuleConfig::class);
25 |         $this->databaseMock = $this->createMock(Database::class);
26 |         $this->protocolCacheMock = $this->createMock(ProtocolCache::class);
27 |     }
28 | 
29 |     protected function sut(
30 |         ?ModuleConfig $moduleConfig = null,
31 |         ?Database $database = null,
32 |         ?ProtocolCache $protocolCache = null,
33 |     ): AbstractDatabaseRepository {
34 |         $moduleConfig ??= $this->moduleConfigMock;
35 |         $database ??= $this->databaseMock;
36 |         $protocolCache ??= $this->protocolCacheMock;
37 | 
38 |         return new class ($moduleConfig, $database, $protocolCache) extends AbstractDatabaseRepository
39 |         {
40 |             public function getTableName(): ?string
41 |             {
42 |                 return 'sut';
43 |             }
44 |         };
45 |     }
46 | 
47 |     public function testCanGetCacheKey(): void
48 |     {
49 |         $this->assertSame('sut_something', $this->sut()->getCacheKey('something'));
50 |     }
51 | }
52 | 


--------------------------------------------------------------------------------
/src/Factories/FederationFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories;
 6 | 
 7 | use SimpleSAML\Module\oidc\ModuleConfig;
 8 | use SimpleSAML\Module\oidc\Services\LoggerService;
 9 | use SimpleSAML\Module\oidc\Utils\FederationCache;
10 | use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmBag;
11 | use SimpleSAML\OpenID\Algorithms\SignatureAlgorithmEnum;
12 | use SimpleSAML\OpenID\Federation;
13 | use SimpleSAML\OpenID\SupportedAlgorithms;
14 | 
15 | class FederationFactory
16 | {
17 |     public function __construct(
18 |         protected readonly ModuleConfig $moduleConfig,
19 |         protected readonly LoggerService $loggerService,
20 |         protected readonly ?FederationCache $federationCache = null,
21 |     ) {
22 |     }
23 | 
24 |     /**
25 |      * @throws \ReflectionException
26 |      * @throws \SimpleSAML\Error\ConfigurationError
27 |      */
28 |     public function build(): Federation
29 |     {
30 |         $supportedAlgorithms = new SupportedAlgorithms(
31 |             new SignatureAlgorithmBag(
32 |                 SignatureAlgorithmEnum::from($this->moduleConfig->getFederationSigner()->algorithmId()),
33 |                 SignatureAlgorithmEnum::RS384,
34 |                 SignatureAlgorithmEnum::RS512,
35 |                 SignatureAlgorithmEnum::ES256,
36 |                 SignatureAlgorithmEnum::ES384,
37 |                 SignatureAlgorithmEnum::ES512,
38 |             ),
39 |         );
40 | 
41 |         return new Federation(
42 |             supportedAlgorithms: $supportedAlgorithms,
43 |             maxCacheDuration: $this->moduleConfig->getFederationCacheMaxDurationForFetched(),
44 |             cache: $this->federationCache?->cache,
45 |             logger: $this->loggerService,
46 |             defaultTrustMarkStatusEndpointUsagePolicyEnum:
47 |             $this->moduleConfig->getFederationTrustMarkStatusEndpointUsagePolicy(),
48 |         );
49 |     }
50 | }
51 | 


--------------------------------------------------------------------------------
/src/Factories/Entities/UserEntityFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories\Entities;
 6 | 
 7 | use SimpleSAML\Module\oidc\Entities\UserEntity;
 8 | use SimpleSAML\Module\oidc\Helpers;
 9 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
10 | 
11 | class UserEntityFactory
12 | {
13 |     public function __construct(
14 |         protected readonly Helpers $helpers,
15 |     ) {
16 |     }
17 | 
18 |     public function fromData(string $identifier, array $claims = []): UserEntity
19 |     {
20 |         $createdAt = $updatedAt = $this->helpers->dateTime()->getUtc();
21 | 
22 |         return new UserEntity(
23 |             $identifier,
24 |             $createdAt,
25 |             $updatedAt,
26 |             $claims,
27 |         );
28 |     }
29 | 
30 |     /**
31 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException
32 |      */
33 |     public function fromState(array $state): UserEntity
34 |     {
35 |         if (
36 |             !is_string($state['id']) ||
37 |             !is_string($state['claims']) ||
38 |             !is_string($state['updated_at']) ||
39 |             !is_string($state['created_at'])
40 |         ) {
41 |             throw OidcServerException::serverError('Invalid user entity data');
42 |         }
43 | 
44 |         $identifier = $state['id'];
45 |         $claims = json_decode($state['claims'], true, 512, JSON_INVALID_UTF8_SUBSTITUTE);
46 | 
47 |         if (!is_array($claims)) {
48 |             throw OidcServerException::serverError('Invalid user entity data');
49 |         }
50 |         $updatedAt = $this->helpers->dateTime()->getUtc($state['updated_at']);
51 |         $createdAt = $this->helpers->dateTime()->getUtc($state['created_at']);
52 | 
53 |         return new UserEntity(
54 |             $identifier,
55 |             $createdAt,
56 |             $updatedAt,
57 |             $claims,
58 |         );
59 |     }
60 | }
61 | 


--------------------------------------------------------------------------------
/src/Factories/Grant/ImplicitGrantFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | namespace SimpleSAML\Module\oidc\Factories\Grant;
17 | 
18 | use SimpleSAML\Module\oidc\Factories\Entities\AccessTokenEntityFactory;
19 | use SimpleSAML\Module\oidc\ModuleConfig;
20 | use SimpleSAML\Module\oidc\Repositories\AccessTokenRepository;
21 | use SimpleSAML\Module\oidc\Server\Grants\ImplicitGrant;
22 | use SimpleSAML\Module\oidc\Server\RequestRules\RequestRulesManager;
23 | use SimpleSAML\Module\oidc\Services\IdTokenBuilder;
24 | use SimpleSAML\Module\oidc\Utils\RequestParamsResolver;
25 | 
26 | class ImplicitGrantFactory
27 | {
28 |     public function __construct(
29 |         private readonly ModuleConfig $moduleConfig,
30 |         private readonly IdTokenBuilder $idTokenBuilder,
31 |         private readonly RequestRulesManager $requestRulesManager,
32 |         private readonly AccessTokenRepository $accessTokenRepository,
33 |         private readonly RequestParamsResolver $requestParamsResolver,
34 |         private readonly AccessTokenEntityFactory $accessTokenEntityFactory,
35 |     ) {
36 |     }
37 | 
38 |     public function build(): ImplicitGrant
39 |     {
40 |         return new ImplicitGrant(
41 |             $this->idTokenBuilder,
42 |             $this->moduleConfig->getAccessTokenDuration(),
43 |             $this->accessTokenRepository,
44 |             $this->requestRulesManager,
45 |             $this->requestParamsResolver,
46 |             '#',
47 |             $this->accessTokenEntityFactory,
48 |         );
49 |     }
50 | }
51 | 


--------------------------------------------------------------------------------
/docker/docker-compose.yml:
--------------------------------------------------------------------------------
 1 | services:
 2 |   http-proxy:
 3 |     image: nginxproxy/nginx-proxy:1.2.1
 4 |     ports:
 5 |       - "443:443"
 6 |       - "80:80"
 7 |     volumes:
 8 |       - /var/run/docker.sock:/tmp/docker.sock:ro
 9 |       - ./docker/nginx-certs/:/etc/nginx/certs
10 |     links:
11 |       - oidc-op
12 | #      - oidc-rp
13 |   oidc-op:
14 |     hostname: op.local.stack-dev.cirrusidentity.com
15 |     build:
16 |       context: .
17 |       dockerfile: docker/Dockerfile
18 |       args:
19 |         SSP_VERSION: "${SSP_VERSION}"
20 |         OIDC_VERSION: "${OIDC_VERSION}"
21 |     environment:
22 |       - STAGINGCOMPOSERREPOS=oidc
23 |       - SSP_ADMIN_PASSWORD=secret1
24 |       - VIRTUAL_HOST=op.local.stack-dev.cirrusidentity.com
25 |       - VIRTUAL_PORT=443
26 |       - VIRTUAL_PROTO=https
27 |       - CERT_NAME=default
28 |     volumes:
29 |       - ./:/var/simplesamlphp/staging-modules/oidc:ro
30 |       - ./docker/ssp/module_oidc.php:/var/simplesamlphp/config/module_oidc.php:ro
31 |       - ./docker/ssp/authsources.php:/var/simplesamlphp/config/authsources.php:ro
32 |       - ./docker/ssp/config-override.php:/var/simplesamlphp/config/config-override.php:ro
33 |       - ./docker/apache-override.cf:/etc/apache2/sites-enabled/ssp-override.cf:ro
34 | # oidc-rp still need work
35 | #  oidc-rp:
36 | #    ports:
37 | #      - "12080:80"
38 | #    environment:
39 | #      - OID_DISCOVERY=https://op.local.stack-dev.cirrusidentity.com/.well-known/openid-configuration
40 | #      - OID_CLIENT_ID=replacewithclientid
41 | #      - OID_CLIENT_SECRET=replacewithclientsecret
42 | #      - PROXY_HOST=my-service
43 | #      - PROXY_PORT=443
44 | #      - PROXY_PROTOCOL=https
45 | #      - VIRTUAL_HOST=rp.local.stack-dev.cirrusidentity.com
46 | #      - VIRTUAL_PORT=80
47 | #      - VIRTUAL_PROTO=http
48 | #      - CERT_NAME=default
49 | #    image: evry/oidc-proxy
50 | 
51 | # Connect to the conformance-suite network to make it easier to communicate between components
52 | networks:
53 |   default:
54 |     name: conformance-suite_default
55 |     external: true
56 | 


--------------------------------------------------------------------------------
/tests/unit/src/Helpers/ScopeTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Helpers;
 6 | 
 7 | use League\OAuth2\Server\Entities\ScopeEntityInterface;
 8 | use PHPUnit\Framework\Attributes\CoversClass;
 9 | use PHPUnit\Framework\MockObject\Stub;
10 | use PHPUnit\Framework\TestCase;
11 | use SimpleSAML\Module\oidc\Helpers\Scope;
12 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
13 | 
14 | #[CoversClass(Scope::class)]
15 | class ScopeTest extends TestCase
16 | {
17 |     protected Stub $scopeEntityOpenIdStub;
18 |     protected Stub $scopeEntityProfileStub;
19 |     protected array $scopeEntitiesArray;
20 | 
21 |     /**
22 |      * @throws \Exception
23 |      */
24 |     protected function setUp(): void
25 |     {
26 |         $this->scopeEntityOpenIdStub = $this->createStub(ScopeEntityInterface::class);
27 |         $this->scopeEntityOpenIdStub->method('getIdentifier')->willReturn('openid');
28 |         $this->scopeEntityProfileStub = $this->createStub(ScopeEntityInterface::class);
29 |         $this->scopeEntityProfileStub->method('getIdentifier')->willReturn('profile');
30 |         $this->scopeEntitiesArray = [
31 |             $this->scopeEntityOpenIdStub,
32 |             $this->scopeEntityProfileStub,
33 |         ];
34 |     }
35 | 
36 |     protected function sut(): Scope
37 |     {
38 |         return new Scope();
39 |     }
40 | 
41 |     /**
42 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException
43 |      */
44 |     public function testCanCheckScopeExistence(): void
45 |     {
46 |         $this->assertTrue($this->sut()->exists($this->scopeEntitiesArray, 'openid'));
47 |         $this->assertTrue($this->sut()->exists($this->scopeEntitiesArray, 'profile'));
48 |         $this->assertFalse($this->sut()->exists($this->scopeEntitiesArray, 'invalid'));
49 |     }
50 | 
51 |     public function testThrowsForInvalidScopeEntity(): void
52 |     {
53 |         $this->expectException(OidcServerException::class);
54 | 
55 |         $this->sut()->exists(['invalid'], 'test');
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/src/Bridges/PsrHttpBridge.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Bridges;
 6 | 
 7 | use Psr\Http\Message\ResponseFactoryInterface;
 8 | use Psr\Http\Message\ServerRequestFactoryInterface;
 9 | use Psr\Http\Message\StreamFactoryInterface;
10 | use Psr\Http\Message\UploadedFileFactoryInterface;
11 | use Symfony\Bridge\PsrHttpMessage\Factory\HttpFoundationFactory;
12 | use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
13 | 
14 | class PsrHttpBridge
15 | {
16 |     private PsrHttpFactory $psrHttpFactory;
17 | 
18 |     public function __construct(
19 |         private readonly HttpFoundationFactory $httpFoundationFactory,
20 |         private readonly ServerRequestFactoryInterface $serverRequestFactory,
21 |         private readonly ResponseFactoryInterface $responseFactory,
22 |         private readonly StreamFactoryInterface $streamFactory,
23 |         private readonly UploadedFileFactoryInterface $uploadedFileFactory,
24 |     ) {
25 |         $this->psrHttpFactory = new PsrHttpFactory(
26 |             $this->serverRequestFactory,
27 |             $this->streamFactory,
28 |             $this->uploadedFileFactory,
29 |             $this->responseFactory,
30 |         );
31 |     }
32 | 
33 |     public function getHttpFoundationFactory(): HttpFoundationFactory
34 |     {
35 |         return $this->httpFoundationFactory;
36 |     }
37 | 
38 |     public function getServerRequestFactory(): ServerRequestFactoryInterface
39 |     {
40 |         return $this->serverRequestFactory;
41 |     }
42 | 
43 |     public function getResponseFactory(): ResponseFactoryInterface
44 |     {
45 |         return $this->responseFactory;
46 |     }
47 | 
48 |     public function getStreamFactory(): StreamFactoryInterface
49 |     {
50 |         return $this->streamFactory;
51 |     }
52 | 
53 |     public function getUploadedFileFactory(): UploadedFileFactoryInterface
54 |     {
55 |         return $this->uploadedFileFactory;
56 |     }
57 | 
58 |     public function getPsrHttpFactory(): PsrHttpFactory
59 |     {
60 |         return $this->psrHttpFactory;
61 |     }
62 | }
63 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/RequiredNonceRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
11 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
12 | use SimpleSAML\Module\oidc\Services\LoggerService;
13 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
14 | use SimpleSAML\OpenID\Codebooks\ParamsEnum;
15 | 
16 | class RequiredNonceRule extends AbstractRule
17 | {
18 |     /**
19 |      * @inheritDoc
20 |      * @throws \Throwable
21 |      */
22 |     public function checkRule(
23 |         ServerRequestInterface $request,
24 |         ResultBagInterface $currentResultBag,
25 |         LoggerService $loggerService,
26 |         array $data = [],
27 |         bool $useFragmentInHttpErrorResponses = false,
28 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
29 |     ): ?ResultInterface {
30 |         /** @var string $redirectUri */
31 |         $redirectUri = $currentResultBag->getOrFail(RedirectUriRule::class)->getValue();
32 |         /** @var string|null $state */
33 |         $state = $currentResultBag->getOrFail(StateRule::class)->getValue();
34 | 
35 |         $nonce = $this->requestParamsResolver->getAsStringBasedOnAllowedMethods(
36 |             ParamsEnum::Nonce->value,
37 |             $request,
38 |             $allowedServerRequestMethods,
39 |         );
40 | 
41 |         if ($nonce === null || $nonce === '') {
42 |             throw OidcServerException::invalidRequest(
43 |                 ParamsEnum::Nonce->value,
44 |                 'nonce is required',
45 |                 null,
46 |                 $redirectUri,
47 |                 $state,
48 |                 $useFragmentInHttpErrorResponses,
49 |             );
50 |         }
51 | 
52 |         return new Result($this->getKey(), $nonce);
53 |     }
54 | }
55 | 


--------------------------------------------------------------------------------
/tests/unit/src/Server/Associations/RelyingPartyAssociationTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Server\Associations;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use SimpleSAML\Module\oidc\Server\Associations\RelyingPartyAssociation;
 9 | 
10 | /**
11 |  * @covers \SimpleSAML\Module\oidc\Server\Associations\RelyingPartyAssociation
12 |  */
13 | class RelyingPartyAssociationTest extends TestCase
14 | {
15 |     protected string $clientId = 'client123';
16 |     protected string $userId = 'user123';
17 |     protected string $sessionId = 'session123';
18 |     protected string $backChannelLogoutUri = 'https//example.org/logout';
19 | 
20 |     public function testConstruct(): void
21 |     {
22 |         $rpAssociation = new RelyingPartyAssociation(
23 |             $this->clientId,
24 |             $this->userId,
25 |             $this->sessionId,
26 |             $this->backChannelLogoutUri,
27 |         );
28 | 
29 |         $this->assertEquals($this->clientId, $rpAssociation->getClientId());
30 |         $this->assertEquals($this->userId, $rpAssociation->getUserId());
31 |         $this->assertEquals($this->sessionId, $rpAssociation->getSessionId());
32 |         $this->assertEquals($this->backChannelLogoutUri, $rpAssociation->getBackChannelLogoutUri());
33 | 
34 |         $newClientId = 'newClient123';
35 |         $newUserId = 'newUser123';
36 |         $newSessionId = 'newSession123';
37 |         $newBackChannelLogoutUri = 'https//new.example.org/logout';
38 | 
39 |         $rpAssociation->setClientId($newClientId);
40 |         $rpAssociation->setUserId($newUserId);
41 |         $rpAssociation->setSessionId($newSessionId);
42 |         $rpAssociation->setBackChannelLogoutUri($newBackChannelLogoutUri);
43 | 
44 |         $this->assertEquals($newClientId, $rpAssociation->getClientId());
45 |         $this->assertEquals($newUserId, $rpAssociation->getUserId());
46 |         $this->assertEquals($newSessionId, $rpAssociation->getSessionId());
47 |         $this->assertEquals($newBackChannelLogoutUri, $rpAssociation->getBackChannelLogoutUri());
48 |     }
49 | }
50 | 


--------------------------------------------------------------------------------
/src/Factories/Entities/RefreshTokenEntityFactory.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Factories\Entities;
 6 | 
 7 | use DateTimeImmutable;
 8 | use SimpleSAML\Module\oidc\Entities\Interfaces\AccessTokenEntityInterface;
 9 | use SimpleSAML\Module\oidc\Entities\RefreshTokenEntity;
10 | use SimpleSAML\Module\oidc\Helpers;
11 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
12 | 
13 | class RefreshTokenEntityFactory
14 | {
15 |     public function __construct(
16 |         protected Helpers $helpers,
17 |     ) {
18 |     }
19 | 
20 |     public function fromData(
21 |         string $id,
22 |         DateTimeImmutable $expiryDateTime,
23 |         AccessTokenEntityInterface $accessTokenEntity,
24 |         ?string $authCodeId = null,
25 |         bool $isRevoked = false,
26 |     ): RefreshTokenEntity {
27 |         return new RefreshTokenEntity(
28 |             $id,
29 |             $expiryDateTime,
30 |             $accessTokenEntity,
31 |             $authCodeId,
32 |             $isRevoked,
33 |         );
34 |     }
35 | 
36 |     /**
37 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException
38 |      */
39 |     public function fromState(array $state): RefreshTokenEntity
40 |     {
41 |         if (
42 |             !is_string($state['id']) ||
43 |             !is_string($state['expires_at']) ||
44 |             !is_a($state['access_token'], AccessTokenEntityInterface::class)
45 |         ) {
46 |             throw OidcServerException::serverError('Invalid Refresh Token state');
47 |         }
48 | 
49 |         $id = $state['id'];
50 |         $expiryDateTime = $this->helpers->dateTime()->getUtc($state['expires_at']);
51 |         $accessToken = $state['access_token'];
52 |         $isRevoked = (bool) $state['is_revoked'];
53 |         $authCodeId = empty($state['auth_code_id']) ? null : (string)$state['auth_code_id'];
54 | 
55 |         return $this->fromData(
56 |             $id,
57 |             $expiryDateTime,
58 |             $accessToken,
59 |             $authCodeId,
60 |             $isRevoked,
61 |         );
62 |     }
63 | }
64 | 


--------------------------------------------------------------------------------
/tests/unit/src/Services/SessionMessagesServiceTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Services;
 6 | 
 7 | use PHPUnit\Framework\MockObject\MockObject;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Services\SessionMessagesService;
10 | use SimpleSAML\Session;
11 | 
12 | /**
13 |  * @covers \SimpleSAML\Module\oidc\Services\SessionMessagesService
14 |  */
15 | class SessionMessagesServiceTest extends TestCase
16 | {
17 |     protected MockObject $sessionMock;
18 | 
19 |     /**
20 |      * @throws \Exception
21 |      */
22 |     protected function setUp(): void
23 |     {
24 |         $this->sessionMock = $this->createMock(Session::class);
25 |     }
26 | 
27 |     public function prepareMockedInstance(): SessionMessagesService
28 |     {
29 |         return new SessionMessagesService($this->sessionMock);
30 |     }
31 | 
32 |     public function testItIsInitializable(): void
33 |     {
34 |         $this->assertInstanceOf(
35 |             SessionMessagesService::class,
36 |             $this->prepareMockedInstance(),
37 |         );
38 |     }
39 | 
40 |     /**
41 |      * @throws \Exception
42 |      */
43 |     public function testItAddsMessage(): void
44 |     {
45 |         $this->sessionMock->expects($this->once())
46 |             ->method('setData')
47 |             ->with('message', $this->anything(), 'value');
48 | 
49 |         $this->prepareMockedInstance()->addMessage('value');
50 |     }
51 | 
52 |     public function testItGetsMessages(): void
53 |     {
54 |         $this->sessionMock->expects($this->once())
55 |             ->method('getDataOfType')
56 |             ->with('message')
57 |             ->willReturn(
58 |                 [
59 |                     'msg1' => 'Message one.',
60 |                     'msg2' => 'Message two.',
61 |                 ],
62 |             );
63 | 
64 |         $this->sessionMock->expects($this->exactly(2))
65 |             ->method('deleteData')
66 |             ->with($this->callback(fn($id) => ! in_array($id, ['msg1', 'msg2'])));
67 | 
68 |         $this->prepareMockedInstance()->getMessages();
69 |     }
70 | }
71 | 


--------------------------------------------------------------------------------
/src/Controllers/Traits/RequestTrait.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Controllers\Traits;
18 | 
19 | use Psr\Http\Message\ResponseInterface;
20 | use Psr\Http\Message\ServerRequestInterface;
21 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
22 | 
23 | trait RequestTrait
24 | {
25 |     /**
26 |      * Handle CORS 'preflight' requests by checking if 'origin' is registered as allowed to make HTTP CORS requests,
27 |      * typically initiated in browser by JavaScript clients.
28 |      *
29 |      * @throws \SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException
30 |      */
31 |     protected function handleCors(ServerRequestInterface $request): ResponseInterface
32 |     {
33 |         $origin = $request->getHeaderLine('Origin');
34 | 
35 |         if (empty($origin)) {
36 |             throw OidcServerException::requestNotSupported('CORS error: no Origin header present');
37 |         }
38 | 
39 |         if (! $this->allowedOriginRepository->has($origin)) {
40 |             throw OidcServerException::accessDenied(sprintf('CORS error: origin %s is not allowed', $origin));
41 |         }
42 | 
43 |         return $this->psrHttpBridge->getResponseFactory()->createResponse(204)
44 |             ->withBody($this->psrHttpBridge->getStreamFactory()->createStream('php://memory'))
45 |             ->withHeader('Access-Control-Allow-Origin', $origin)
46 |             ->withHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
47 |             ->withHeader('Access-Control-Allow-Headers', 'Authorization, X-Requested-With')
48 |             ->withHeader('Access-Control-Allow-Credentials', 'true')
49 |         ;
50 |     }
51 | }
52 | 


--------------------------------------------------------------------------------
/src/Entities/RefreshTokenEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Entities;
18 | 
19 | use DateTimeImmutable;
20 | use League\OAuth2\Server\Entities\Traits\EntityTrait;
21 | use League\OAuth2\Server\Entities\Traits\RefreshTokenTrait;
22 | use SimpleSAML\Module\oidc\Entities\Interfaces\AccessTokenEntityInterface;
23 | use SimpleSAML\Module\oidc\Entities\Interfaces\RefreshTokenEntityInterface;
24 | use SimpleSAML\Module\oidc\Entities\Traits\AssociateWithAuthCodeTrait;
25 | use SimpleSAML\Module\oidc\Entities\Traits\RevokeTokenTrait;
26 | 
27 | class RefreshTokenEntity implements RefreshTokenEntityInterface
28 | {
29 |     use RefreshTokenTrait;
30 |     use EntityTrait;
31 |     use RevokeTokenTrait;
32 |     use AssociateWithAuthCodeTrait;
33 | 
34 |     public function __construct(
35 |         string $id,
36 |         DateTimeImmutable $expiryDateTime,
37 |         AccessTokenEntityInterface $accessTokenEntity,
38 |         ?string $authCodeId = null,
39 |         bool $isRevoked = false,
40 |     ) {
41 |         $this->setIdentifier($id);
42 |         $this->setExpiryDateTime($expiryDateTime);
43 |         $this->setAccessToken($accessTokenEntity);
44 |         $this->setAuthCodeId($authCodeId);
45 |         $this->isRevoked = $isRevoked;
46 |     }
47 | 
48 |     public function getState(): array
49 |     {
50 |         return [
51 |             'id' => $this->getIdentifier(),
52 |             'expires_at' => $this->getExpiryDateTime()->format('Y-m-d H:i:s'),
53 |             'access_token_id' => $this->getAccessToken()->getIdentifier(),
54 |             'is_revoked' => $this->isRevoked(),
55 |             'auth_code_id' => $this->getAuthCodeId(),
56 |         ];
57 |     }
58 | }
59 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/RequiredOpenIdScopeRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
11 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
12 | use SimpleSAML\Module\oidc\Services\LoggerService;
13 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
14 | 
15 | class RequiredOpenIdScopeRule extends AbstractRule
16 | {
17 |     /**
18 |      * @inheritDoc
19 |      * @throws \Throwable
20 |      */
21 |     public function checkRule(
22 |         ServerRequestInterface $request,
23 |         ResultBagInterface $currentResultBag,
24 |         LoggerService $loggerService,
25 |         array $data = [],
26 |         bool $useFragmentInHttpErrorResponses = false,
27 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
28 |     ): ?ResultInterface {
29 |         /** @var string $redirectUri */
30 |         $redirectUri = $currentResultBag->getOrFail(RedirectUriRule::class)->getValue();
31 |         /** @var string|null $state */
32 |         $state = $currentResultBag->getOrFail(StateRule::class)->getValue();
33 |         /** @var \League\OAuth2\Server\Entities\ScopeEntityInterface[] $validScopes */
34 |         $validScopes = $currentResultBag->getOrFail(ScopeRule::class)->getValue();
35 | 
36 |         $isOpenIdScopePresent = (bool) array_filter(
37 |             $validScopes,
38 |             fn($scopeEntity) => $scopeEntity->getIdentifier() === 'openid',
39 |         );
40 | 
41 |         if (! $isOpenIdScopePresent) {
42 |             throw OidcServerException::invalidRequest(
43 |                 'scope',
44 |                 'Scope openid is required',
45 |                 null,
46 |                 $redirectUri,
47 |                 $state,
48 |                 $useFragmentInHttpErrorResponses,
49 |             );
50 |         }
51 | 
52 |         return new Result($this->getKey(), true);
53 |     }
54 | }
55 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/ResultBag.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules;
 6 | 
 7 | use LogicException;
 8 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
10 | 
11 | use function sprintf;
12 | 
13 | class ResultBag implements ResultBagInterface
14 | {
15 |     /**
16 |      * @var \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface[] $results
17 |      */
18 |     protected array $results = [];
19 | 
20 |     /**
21 |      * @param \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface $result
22 |      */
23 |     public function add(ResultInterface $result): void
24 |     {
25 |         $this->results[$result->getKey()] = $result;
26 |     }
27 | 
28 |     /**
29 |      * @param string $key
30 |      * @return \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface|null
31 |      */
32 |     public function get(string $key): ?ResultInterface
33 |     {
34 |         return $this->results[$key] ?? null;
35 |     }
36 | 
37 |     /**
38 |      * @param string $key
39 |      * @return \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface
40 |      */
41 |     public function getOrFail(string $key): ResultInterface
42 |     {
43 |         $result = $this->get($key);
44 | 
45 |         if ($result === null) {
46 |             throw new LogicException(
47 |                 sprintf('Request rule error: expected existing result, but none found (%s)', $key),
48 |             );
49 |         }
50 | 
51 |         return $result;
52 |     }
53 | 
54 |     /**
55 |      * @return \SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface[]
56 |      */
57 |     public function getAll(): array
58 |     {
59 |         return $this->results;
60 |     }
61 | 
62 |     /**
63 |      * @param string $key
64 |      */
65 |     public function remove(string $key): void
66 |     {
67 |         unset($this->results[$key]);
68 |     }
69 | 
70 |     public function has(string $key): bool
71 |     {
72 |         return array_key_exists($key, $this->results);
73 |     }
74 | }
75 | 


--------------------------------------------------------------------------------
/src/Codebooks/RoutesEnum.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Codebooks;
 6 | 
 7 | enum RoutesEnum: string
 8 | {
 9 |     /*****************************************************************************************************************
10 |      * Admin area
11 |      ****************************************************************************************************************/
12 | 
13 |     case AdminConfigProtocol = 'admin/config/protocol';
14 |     case AdminConfigFederation = 'admin/config/federation';
15 |     case AdminMigrations = 'admin/migrations';
16 |     case AdminMigrationsRun = 'admin/migrations/run';
17 | 
18 |     // Client management
19 | 
20 |     case AdminClients = 'admin/clients';
21 |     case AdminClientsShow = 'admin/clients/show';
22 |     case AdminClientsEdit = 'admin/clients/edit';
23 |     case AdminClientsAdd = 'admin/clients/add';
24 |     case AdminClientsResetSecret = 'admin/clients/reset-secret';
25 |     case AdminClientsDelete = 'admin/clients/delete';
26 | 
27 |     // Testing
28 |     case AdminTestTrustChainResolution = 'admin/test/trust-chain-resolution';
29 |     case AdminTestTrustMarkValidation = 'admin/test/trust-mark-validation';
30 | 
31 | 
32 |     /*****************************************************************************************************************
33 |      * OpenID Connect
34 |      ****************************************************************************************************************/
35 | 
36 |     case Configuration = '.well-known/openid-configuration';
37 |     case Authorization = 'authorization';
38 |     case Token = 'token';
39 |     case UserInfo = 'userinfo';
40 |     case Jwks = 'jwks';
41 |     case EndSession = 'end-session';
42 | 
43 |     /*****************************************************************************************************************
44 |      * OpenID Federation
45 |      ****************************************************************************************************************/
46 | 
47 |     case FederationConfiguration = '.well-known/openid-federation';
48 |     case FederationFetch = 'federation/fetch';
49 |     case FederationList = 'federation/list';
50 | }
51 | 


--------------------------------------------------------------------------------
/tests/unit/src/Factories/FormFactoryTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Factories;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\Attributes\UsesClass;
 9 | use PHPUnit\Framework\MockObject\MockObject;
10 | use PHPUnit\Framework\TestCase;
11 | use SimpleSAML\Module\oidc\Bridges\SspBridge;
12 | use SimpleSAML\Module\oidc\Factories\FormFactory;
13 | use SimpleSAML\Module\oidc\Forms\ClientForm;
14 | use SimpleSAML\Module\oidc\Forms\Controls\CsrfProtection;
15 | use SimpleSAML\Module\oidc\Helpers;
16 | use SimpleSAML\Module\oidc\ModuleConfig;
17 | 
18 | #[CoversClass(FormFactory::class)]
19 | #[UsesClass(ClientForm::class)]
20 | class FormFactoryTest extends TestCase
21 | {
22 |     protected MockObject $moduleConfigMock;
23 |     protected MockObject $csrfProtectionMock;
24 |     protected MockObject $sspBridgeMock;
25 |     protected MockObject $helpersMock;
26 | 
27 |     protected function setUp(): void
28 |     {
29 |         $this->moduleConfigMock = $this->createMock(ModuleConfig::class);
30 |         $this->csrfProtectionMock = $this->createMock(CsrfProtection::class);
31 |         $this->sspBridgeMock = $this->createMock(SspBridge::class);
32 |         $this->helpersMock = $this->createMock(Helpers::class);
33 |     }
34 | 
35 |     protected function sut(
36 |         ?ModuleConfig $moduleConfig = null,
37 |         ?CsrfProtection $csrfProtection = null,
38 |         ?SspBridge $sspBridge = null,
39 |         ?Helpers $helpers = null,
40 |     ): FormFactory {
41 |         $moduleConfig ??= $this->moduleConfigMock;
42 |         $csrfProtection ??= $this->csrfProtectionMock;
43 |         $sspBridge ??= $this->sspBridgeMock;
44 |         $helpers ??= $this->helpersMock;
45 | 
46 |         return new FormFactory(
47 |             $moduleConfig,
48 |             $csrfProtection,
49 |             $sspBridge,
50 |             $helpers,
51 |         );
52 |     }
53 | 
54 |     public function testCanConstruct(): void
55 |     {
56 |         $this->assertInstanceOf(FormFactory::class, $this->sut());
57 |     }
58 | 
59 |     public function testCanBuildClientForm(): void
60 |     {
61 |         $this->assertInstanceOf(
62 |             ClientForm::class,
63 |             $this->sut()->build(ClientForm::class),
64 |         );
65 |     }
66 | }
67 | 


--------------------------------------------------------------------------------
/tests/unit/src/Server/RequestRules/ResultBagTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Server\RequestRules;
 6 | 
 7 | use LogicException;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\ResultBag;
11 | 
12 | /**
13 |  * @covers \SimpleSAML\Module\oidc\Server\RequestRules\ResultBag
14 |  */
15 | class ResultBagTest extends TestCase
16 | {
17 |     protected string $key = 'some-key';
18 |     protected string $value = 'some-value';
19 | 
20 |     protected Result $result;
21 | 
22 |     protected ResultBag $resultBag;
23 | 
24 |     protected function setUp(): void
25 |     {
26 |         $this->result = new Result($this->key, $this->value);
27 |         $this->resultBag = new ResultBag();
28 |     }
29 | 
30 |     public function testGetAll(): void
31 |     {
32 |         $this->assertEmpty($this->resultBag->getAll());
33 |         $this->resultBag->add($this->result);
34 |         $this->resultBag->add(new Result('second', 'second'));
35 |         $this->assertCount(2, $this->resultBag->getAll());
36 |     }
37 | 
38 |     public function testAdd(): void
39 |     {
40 |         $this->assertNull($this->resultBag->get($this->key));
41 |         $this->resultBag->add($this->result);
42 |         $this->assertInstanceOf(Result::class, $this->resultBag->get($this->key));
43 |     }
44 | 
45 |     public function testGetOrFail(): void
46 |     {
47 |         $this->resultBag->add($this->result);
48 |         $this->assertSame($this->result, $this->resultBag->getOrFail($this->key));
49 |         $this->expectException(LogicException::class);
50 |         $this->resultBag->getOrFail('non-existent');
51 |     }
52 | 
53 |     public function testGet(): void
54 |     {
55 |         $this->assertNull($this->resultBag->get($this->key));
56 |         $this->resultBag->add($this->result);
57 |         $this->assertSame($this->result, $this->resultBag->get($this->key));
58 |     }
59 | 
60 |     public function testRemove(): void
61 |     {
62 |         $this->assertNull($this->resultBag->get($this->key));
63 |         $this->resultBag->add($this->result);
64 |         $this->assertSame($this->result, $this->resultBag->get($this->key));
65 |         $this->resultBag->remove($this->key);
66 |         $this->assertNull($this->resultBag->get($this->key));
67 |     }
68 | }
69 | 


--------------------------------------------------------------------------------
/src/Admin/Authorization.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Admin;
 6 | 
 7 | use SimpleSAML\Error\Exception;
 8 | use SimpleSAML\Locale\Translate;
 9 | use SimpleSAML\Module\oidc\Bridges\SspBridge;
10 | use SimpleSAML\Module\oidc\Exceptions\AuthorizationException;
11 | use SimpleSAML\Module\oidc\Services\AuthContextService;
12 | 
13 | class Authorization
14 | {
15 |     public function __construct(
16 |         protected readonly SspBridge $sspBridge,
17 |         protected readonly AuthContextService $authContextService,
18 |     ) {
19 |     }
20 | 
21 |     public function isAdmin(): bool
22 |     {
23 |         return $this->sspBridge->utils()->auth()->isAdmin();
24 |     }
25 | 
26 |     /**
27 |      * @throws \SimpleSAML\Module\oidc\Exceptions\AuthorizationException
28 |      */
29 |     public function requireAdmin(bool $forceAdminAuthentication = false): void
30 |     {
31 |         if ($forceAdminAuthentication) {
32 |             try {
33 |                 $this->sspBridge->utils()->auth()->requireAdmin();
34 |             } catch (Exception $exception) {
35 |                 throw new AuthorizationException(
36 |                     Translate::noop('Unable to initiate SimpleSAMLphp admin authentication.'),
37 |                     $exception->getCode(),
38 |                     $exception,
39 |                 );
40 |             }
41 |         }
42 | 
43 |         if (! $this->isAdmin()) {
44 |             throw new AuthorizationException(Translate::noop('SimpleSAMLphp admin access required.'));
45 |         }
46 |     }
47 | 
48 |     /**
49 |      * @throws \SimpleSAML\Module\oidc\Exceptions\AuthorizationException
50 |      */
51 |     public function requireAdminOrUserWithPermission(string $permission): void
52 |     {
53 |         if ($this->isAdmin()) {
54 |             return;
55 |         }
56 | 
57 |         try {
58 |             $this->authContextService->requirePermission($permission);
59 |         } catch (\Exception) {
60 |             // TODO mivanci v7 log this exception
61 |         }
62 | 
63 |         // If we get here, the user does not have the required permission, or permissions are not enabled.
64 |         // Fallback to admin authentication.
65 |         $this->requireAdmin(true);
66 |     }
67 | 
68 |     public function getUserId(): string
69 |     {
70 |         return $this->authContextService->getAuthUserId();
71 |     }
72 | }
73 | 


--------------------------------------------------------------------------------
/public/assets/css/src/default.css:
--------------------------------------------------------------------------------
  1 | 
  2 | h3 {
  3 |     margin-bottom: 0.5em;
  4 |     font-size: 1.2em;
  5 |     font-weight: 600;
  6 |     color: #1c1c1c;
  7 | }
  8 | 
  9 | h4 {
 10 |     margin: 0.4em 0;
 11 |     font-size: 1.0em;
 12 |     font-weight: 600;
 13 |     color: #1c1c1c;
 14 | }
 15 | 
 16 | /* Container to hold menu and content */
 17 | .oidc-container {
 18 |     display: flex;
 19 |     max-width: inherit;
 20 |     margin: 0 auto;
 21 | }
 22 | 
 23 | /* Style for the left menu */
 24 | .menu {
 25 |     min-width: 200px;
 26 |     width: auto;
 27 | }
 28 | 
 29 | /* Style for the menu items */
 30 | .menu ul {
 31 |     list-style-type: none;
 32 |     padding: 0;
 33 | }
 34 | 
 35 | .menu ul li {
 36 |     padding: 0.25rem;
 37 | }
 38 | 
 39 | .menu ul li a {
 40 |     text-decoration: none;
 41 |     color: #333;
 42 |     display: block;
 43 |     padding: 0.5rem;
 44 | }
 45 | 
 46 | .menu ul li a:hover {
 47 |     background-color: #ddd;
 48 |     padding: 0.5rem;
 49 | }
 50 | 
 51 | .menu ul li a.active {
 52 |     background-color: #eeeeee;
 53 |     padding: 0.5rem;
 54 | }
 55 | 
 56 | /* Style for the content area */
 57 | .content {
 58 |     flex-grow: 1;
 59 |     padding-left: 20px;
 60 |     max-width: inherit;
 61 |     background-color: #fff;
 62 | }
 63 | 
 64 | ul.disc {
 65 |     list-style: disc outside none;
 66 | }
 67 | 
 68 | em {
 69 |     font-style: italic;
 70 | }
 71 | 
 72 | /* Text colors */
 73 | .black-text { color: black; }
 74 | .red-text { color: red; }
 75 | .lightcoral-text { color: lightcoral; }
 76 | .green-text { color: green; }
 77 | .yellow-text { color: yellow; }
 78 | .blue-text { color: blue; }
 79 | .magenta-text { color: magenta; }
 80 | .cyan-text { color: cyan; }
 81 | .lightcyan-text { color: lightcyan; }
 82 | .white-text { color: white; }
 83 | 
 84 | /* Button sizes */
 85 | .button-small {
 86 |     font-size: 75%;
 87 | }
 88 | 
 89 | /* Client Table */
 90 | table.client-table {
 91 |     width: 100%;
 92 | }
 93 | 
 94 | .client-col.col-info {
 95 |     width: 79%;
 96 | }
 97 | 
 98 | .client-col.col-actions {
 99 |     width: 21%;
100 | }
101 | 
102 | .client-col.col-property {
103 |     width: 25%;
104 |     font-weight: bolder;
105 | }
106 | 
107 | .confirm-action {}
108 | 
109 | form.pure-form-stacked .full-width {
110 |     width: 100%;
111 | }
112 | 


--------------------------------------------------------------------------------
/docker/ssp/authsources.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | $config = array(
 6 | 
 7 |     // This is an authentication source which handles admin authentication.
 8 |     'admin' => array(
 9 |         'core:AdminPassword',
10 |     ),
11 | 
12 |     'example-userpass' => [
13 |         'exampleauth:UserPass',
14 |         'users' => [
15 |             'student:studentpass' => [
16 |                 'uid' => ['student'],
17 |                 'eduPersonAffiliation' => ['member', 'student'],
18 |                 'eduPersonNickname' => 'Sir_Nickname',
19 |                 'displayName' => 'Some User',
20 |                 'givenName' => 'Firsty',
21 |                 'middle_name' => 'Mid',
22 |                 'sn' => 'Lasty',
23 |                 'labeledURI' => 'https://example.com/student',
24 |                 'jpegURL' => 'https://example.com/student.jpg',
25 |                 'mail' => 'something@example.com',
26 |                 'email_verified' => 'yes',
27 |                 'zoneinfo' => 'Europe/Paris',
28 |                 'updated_at' => '1621374126',
29 |                 'preferredLanguage' => 'fr-CA',
30 |                 'website' => 'https://example.com/student-blog',
31 |                 'gender' => 'female',
32 |                 'birthdate' => '1945-03-21',
33 |                 'eduPersonUniqueId' => '13579',
34 |                 'phone_number_verified' => 'yes',
35 |                 'mobile' => '+1 (604) 555-1234;ext=5678',
36 |                 'postalAddress' => ["Place Charles de Gaulle, Paris"],
37 |                 'street_address' => ['Place Charles de Gaulle'],
38 |                 'locality' => ['Paris'],
39 |                 'region' => ['Île-de-France'],
40 |                 'postal_code' => ['75008'],
41 |                 'country' => ['France'],
42 |             ],
43 |             'employee:employeepass' => [
44 |                 'uid' => ['employee'],
45 |                 'eduPersonAffiliation' => ['member', 'employee'],
46 |                 'eduPersonEntitlement' => ['urn:example:oidc:manage:client']
47 |             ],
48 |             'member:memberpass' => [
49 |                 'uid' => ['member'],
50 |                 'eduPersonAffiliation' => ['member'],
51 |                 'eduPersonEntitlement' => ['urn:example:oidc:manage:client']
52 |             ],
53 |             'minimal:minimalpass' => [
54 |                 'uid' => ['minimal'],
55 |             ],
56 |         ],
57 |     ],
58 | 
59 | 
60 | );
61 | 


--------------------------------------------------------------------------------
/src/Entities/Interfaces/ClientEntityInterface.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Entities\Interfaces;
 6 | 
 7 | use DateTimeImmutable;
 8 | use League\OAuth2\Server\Entities\ClientEntityInterface as OAuth2ClientEntityInterface;
 9 | use SimpleSAML\Module\oidc\Codebooks\RegistrationTypeEnum;
10 | 
11 | interface ClientEntityInterface extends OAuth2ClientEntityInterface, MementoInterface
12 | {
13 |     public function toArray(): array;
14 | 
15 |     public function getSecret(): string;
16 | 
17 |     public function restoreSecret(string $secret): self;
18 | 
19 |     public function getDescription(): string;
20 | 
21 |     public function getAuthSourceId(): ?string;
22 | 
23 |     /**
24 |      * @return string[]
25 |      */
26 |     public function getScopes(): array;
27 | 
28 |     public function isEnabled(): bool;
29 | 
30 |     public function getOwner(): ?string;
31 | 
32 |     /**
33 |      * @return string[]
34 |      */
35 |     public function getPostLogoutRedirectUri(): array;
36 | 
37 |     /**
38 |      * @param string[] $postLogoutRedirectUri
39 |      */
40 |     public function setPostLogoutRedirectUri(array $postLogoutRedirectUri): void;
41 | 
42 |     /**
43 |      * @return string|null
44 |      */
45 |     public function getBackChannelLogoutUri(): ?string;
46 | 
47 |     /**
48 |      * @param string|null $backChannelLogoutUri
49 |      */
50 |     public function setBackChannelLogoutUri(?string $backChannelLogoutUri): void;
51 | 
52 |     public function getEntityIdentifier(): ?string;
53 | 
54 |     /**
55 |      * @return string[]
56 |      */
57 |     public function getRedirectUris(): array;
58 | 
59 |     /**
60 |      * @return string[]
61 |      */
62 |     public function getClientRegistrationTypes(): array;
63 | 
64 |     /**
65 |      * @return array[]|null
66 |      */
67 |     public function getFederationJwks(): ?array;
68 | 
69 |     /**
70 |      * @return array[]|null
71 |      */
72 |     public function getJwks(): ?array;
73 | 
74 |     public function getJwksUri(): ?string;
75 |     public function getSignedJwksUri(): ?string;
76 |     public function getRegistrationType(): RegistrationTypeEnum;
77 |     public function getUpdatedAt(): ?DateTimeImmutable;
78 |     public function getCreatedAt(): ?DateTimeImmutable;
79 |     public function getExpiresAt(): ?DateTimeImmutable;
80 |     public function isExpired(): bool;
81 |     public function isFederated(): bool;
82 | }
83 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/CodeVerifierRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
11 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
12 | use SimpleSAML\Module\oidc\Services\LoggerService;
13 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
14 | use SimpleSAML\OpenID\Codebooks\ParamsEnum;
15 | 
16 | class CodeVerifierRule extends AbstractRule
17 | {
18 |     /**
19 |      * @inheritDoc
20 |      */
21 |     public function checkRule(
22 |         ServerRequestInterface $request,
23 |         ResultBagInterface $currentResultBag,
24 |         LoggerService $loggerService,
25 |         array $data = [],
26 |         bool $useFragmentInHttpErrorResponses = false,
27 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
28 |     ): ?ResultInterface {
29 |         /** @var \SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface $client */
30 |         $client = $currentResultBag->getOrFail(ClientIdRule::class)->getValue();
31 | 
32 |         $codeVerifier = $this->requestParamsResolver->getFromRequestBasedOnAllowedMethods(
33 |             ParamsEnum::CodeVerifier->value,
34 |             $request,
35 |             $allowedServerRequestMethods,
36 |         );
37 | 
38 |         if (is_null($codeVerifier)) {
39 |             if (!$client->isConfidential()) {
40 |                 throw OidcServerException::invalidRequest(
41 |                     'code_verifier',
42 |                     'Code Verifier must be provided for public clients.',
43 |                 );
44 |             }
45 | 
46 |             return new Result($this->getKey(), null);
47 |         }
48 | 
49 |         // Validate code_verifier according to RFC-7636
50 |         // @see: https://tools.ietf.org/html/rfc7636#section-4.1
51 |         if (preg_match('/^[A-Za-z0-9-._~]{43,128}$/', $codeVerifier) !== 1) {
52 |             throw OidcServerException::invalidRequest(
53 |                 'code_verifier',
54 |                 'Code Verifier must follow the specifications of RFC-7636.',
55 |             );
56 |         }
57 | 
58 |         return new Result($this->getKey(), $codeVerifier);
59 |     }
60 | }
61 | 


--------------------------------------------------------------------------------
/src/Entities/UserEntity.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Entities;
18 | 
19 | use DateTimeImmutable;
20 | use League\OAuth2\Server\Entities\UserEntityInterface;
21 | use SimpleSAML\Module\oidc\Entities\Interfaces\ClaimSetInterface;
22 | use SimpleSAML\Module\oidc\Entities\Interfaces\MementoInterface;
23 | 
24 | /**
25 |  * @psalm-suppress PropertyNotSetInConstructor
26 |  */
27 | class UserEntity implements UserEntityInterface, MementoInterface, ClaimSetInterface
28 | {
29 |     public function __construct(
30 |         private readonly string $identifier,
31 |         private readonly DateTimeImmutable $createdAt,
32 |         private DateTimeImmutable $updatedAt,
33 |         private array $claims = [],
34 |     ) {
35 |     }
36 | 
37 |     /**
38 |      * {@inheritdoc}
39 |      */
40 |     public function getState(): array
41 |     {
42 |         return [
43 |             'id' => $this->getIdentifier(),
44 |             'claims' => json_encode($this->getClaims(), JSON_INVALID_UTF8_SUBSTITUTE),
45 |             'updated_at' => $this->getUpdatedAt()->format('Y-m-d H:i:s'),
46 |             'created_at' => $this->getCreatedAt()->format('Y-m-d H:i:s'),
47 |         ];
48 |     }
49 | 
50 |     public function getIdentifier(): string
51 |     {
52 |         return $this->identifier;
53 |     }
54 | 
55 |     public function getClaims(): array
56 |     {
57 |         return $this->claims;
58 |     }
59 | 
60 |     public function setClaims(array $claims): self
61 |     {
62 |         $this->claims = $claims;
63 |         return $this;
64 |     }
65 | 
66 |     public function getUpdatedAt(): DateTimeImmutable
67 |     {
68 |         return $this->updatedAt;
69 |     }
70 | 
71 |     public function setUpdatedAt(DateTimeImmutable $updatedAt): self
72 |     {
73 |         $this->updatedAt = $updatedAt;
74 |         return $this;
75 |     }
76 | 
77 |     public function getCreatedAt(): DateTimeImmutable
78 |     {
79 |         return $this->createdAt;
80 |     }
81 | }
82 | 


--------------------------------------------------------------------------------
/src/Forms/Controls/CsrfProtection.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | /*
 6 |  * This file is part of the simplesamlphp-module-oidc.
 7 |  *
 8 |  * Copyright (C) 2018 by the Spanish Research and Academic Network.
 9 |  *
10 |  * This code was developed by Universidad de Córdoba (UCO https://www.uco.es)
11 |  * for the RedIRIS SIR service (SIR: http://www.rediris.es/sir)
12 |  *
13 |  * For the full copyright and license information, please view the LICENSE
14 |  * file that was distributed with this source code.
15 |  */
16 | 
17 | namespace SimpleSAML\Module\oidc\Forms\Controls;
18 | 
19 | use Nette\Forms\Controls\CsrfProtection as BaseCsrfProtection;
20 | use Nette\InvalidStateException;
21 | use Nette\Utils\Random;
22 | use SimpleSAML\Session;
23 | use Stringable;
24 | 
25 | class CsrfProtection extends BaseCsrfProtection
26 | {
27 |     final public const PROTECTION = [\SimpleSAML\Module\oidc\Forms\Controls\CsrfProtection::class, 'validateCsrf'];
28 | 
29 |     /** @noinspection PhpMissingParentConstructorInspection */
30 |     /**
31 |      * @throws \Exception
32 |      * @throws \Nette\InvalidStateException
33 |      */
34 |     public function __construct(string|Stringable|null $errorMessage, protected Session $sspSession)
35 |     {
36 |         // Instead of calling CsrfProtection parent class constructor, go to it's parent (HiddenField), and call
37 |         // its constructor. This is to avoid setting a Nette session in CsrfProtection parent, and use the SSP one.
38 |         $hiddentFieldParent = get_parent_class(get_parent_class($this));
39 | 
40 |         if (!is_string($hiddentFieldParent)) {
41 |             throw new InvalidStateException('CsrfProtection initialization error');
42 |         }
43 | 
44 |         /**
45 |          * @noinspection PhpUndefinedMethodInspection
46 |          * @psalm-suppress MixedMethodCall
47 |          */
48 |         $hiddentFieldParent::__construct();
49 | 
50 |         $this->setOmitted()
51 |             ->setRequired()
52 |             ->addRule(self::PROTECTION, $errorMessage);
53 |     }
54 | 
55 |     /**
56 |      * @throws \Exception
57 |      */
58 |     public function getToken(): string
59 |     {
60 |         $token = (string)$this->sspSession->getData('form_csrf', 'token');
61 | 
62 |         if (!$token) {
63 |             $token = Random::generate();
64 |             $this->sspSession->setData('form_csrf', 'token', $token);
65 |         }
66 | 
67 |         return $token ^ $this->sspSession->getSessionId();
68 |     }
69 | }
70 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/ScopeOfflineAccessRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use Psr\Http\Message\ServerRequestInterface;
 8 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
 9 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
10 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
11 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
12 | use SimpleSAML\Module\oidc\Services\LoggerService;
13 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
14 | 
15 | class ScopeOfflineAccessRule extends AbstractRule
16 | {
17 |     /**
18 |      * @inheritDoc
19 |      * @throws \Throwable
20 |      */
21 |     public function checkRule(
22 |         ServerRequestInterface $request,
23 |         ResultBagInterface $currentResultBag,
24 |         LoggerService $loggerService,
25 |         array $data = [],
26 |         bool $useFragmentInHttpErrorResponses = false,
27 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
28 |     ): ?ResultInterface {
29 |         /** @var string $redirectUri */
30 |         $redirectUri = $currentResultBag->getOrFail(RedirectUriRule::class)->getValue();
31 |         /** @var string|null $state */
32 |         $state = $currentResultBag->getOrFail(StateRule::class)->getValue();
33 |         /** @var \SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface $client */
34 |         $client = $currentResultBag->getOrFail(ClientIdRule::class)->getValue();
35 |         /** @var \League\OAuth2\Server\Entities\ScopeEntityInterface[] $validScopes */
36 |         $validScopes = $currentResultBag->getOrFail(ScopeRule::class)->getValue();
37 | 
38 |         // Check if offline_access scope is used. If not, we don't have to check anything else.
39 |         if (! $this->helpers->scope()->exists($validScopes, 'offline_access')) {
40 |             return new Result($this->getKey(), false);
41 |         }
42 | 
43 |         // Scope offline_access is used. Check if the client has it registered.
44 |         if (! in_array('offline_access', $client->getScopes(), true)) {
45 |             throw OidcServerException::invalidRequest(
46 |                 'scope',
47 |                 'offline_access scope is not registered for the client',
48 |                 null,
49 |                 $redirectUri,
50 |                 $state,
51 |                 $useFragmentInHttpErrorResponses,
52 |             );
53 |         }
54 | 
55 |         return new Result($this->getKey(), true);
56 |     }
57 | }
58 | 


--------------------------------------------------------------------------------
/tests/unit/src/Helpers/ArrTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Helpers;
 6 | 
 7 | use PHPUnit\Framework\Attributes\CoversClass;
 8 | use PHPUnit\Framework\TestCase;
 9 | use SimpleSAML\Module\oidc\Helpers\Arr;
10 | 
11 | #[CoversClass(Arr::class)]
12 | class ArrTest extends TestCase
13 | {
14 |     protected function sut(): Arr
15 |     {
16 |         return new Arr();
17 |     }
18 | 
19 |     public function testCanFindByCallback(): void
20 |     {
21 |         $this->assertSame(
22 |             'a',
23 |             $this->sut()->findByCallback(
24 |                 ['a', 'b', 'c'],
25 |                 fn($item): bool => $item === 'a',
26 |             ),
27 |         );
28 | 
29 |         $this->assertNull($this->sut()->findByCallback(
30 |             ['a', 'b', 'c'],
31 |             fn($item): bool => $item === 'd',
32 |         ));
33 |     }
34 | 
35 |     public function testEnsureStringValues(): void
36 |     {
37 |         $this->assertSame(
38 |             ['1', '2'],
39 |             $this->sut()->ensureStringValues([1, 2]),
40 |         );
41 |     }
42 | 
43 |     public function testIsValueOneOf(): void
44 |     {
45 |         $this->assertTrue($this->sut()->isValueOneOf('a', ['a']));
46 |         $this->assertTrue($this->sut()->isValueOneOf(['a'], ['a']));
47 |         $this->assertTrue($this->sut()->isValueOneOf(['a', 'b'], ['a']));
48 | 
49 |         $this->assertFalse($this->sut()->isValueOneOf('a', ['b']));
50 |         $this->assertFalse($this->sut()->isValueOneOf(['a'], ['b']));
51 |     }
52 | 
53 |     public function testIsValueSubsetOf(): void
54 |     {
55 |         $this->assertTrue($this->sut()->isValueSubsetOf('a', ['a', 'b', 'c']));
56 |         $this->assertTrue($this->sut()->isValueSubsetOf(['a'], ['a', 'b', 'c']));
57 |         $this->assertTrue($this->sut()->isValueSubsetOf(['a', 'b'], ['a', 'b', 'c']));
58 | 
59 |         $this->assertFalse($this->sut()->isValueSubsetOf('a', []));
60 |         $this->assertFalse($this->sut()->isValueSubsetOf('a', ['b']));
61 |         $this->assertFalse($this->sut()->isValueSubsetOf(['a', 'c'], ['b']));
62 |     }
63 | 
64 |     public function testIsValueSupersetOf(): void
65 |     {
66 |         $this->assertTrue($this->sut()->isValueSupersetOf('a', ['a']));
67 |         $this->assertTrue($this->sut()->isValueSupersetOf(['a'], ['a']));
68 |         $this->assertTrue($this->sut()->isValueSupersetOf(['a', 'b'], ['a']));
69 | 
70 |         $this->assertFalse($this->sut()->isValueSupersetOf('a', ['b']));
71 |         $this->assertFalse($this->sut()->isValueSupersetOf(['a'], ['b']));
72 |     }
73 | }
74 | 


--------------------------------------------------------------------------------
/tests/unit/src/Stores/Session/LogoutTicketStoreDbTest.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Test\Module\oidc\unit\Stores\Session;
 6 | 
 7 | use PHPUnit\Framework\TestCase;
 8 | use SimpleSAML\Configuration;
 9 | use SimpleSAML\Module\oidc\Services\DatabaseMigration;
10 | use SimpleSAML\Module\oidc\Stores\Session\LogoutTicketStoreDb;
11 | 
12 | /**
13 |  * @covers \SimpleSAML\Module\oidc\Stores\Session\LogoutTicketStoreDb
14 |  */
15 | class LogoutTicketStoreDbTest extends TestCase
16 | {
17 |     public static function setUpBeforeClass(): void
18 |     {
19 |         $config = [
20 |             'database.dsn' => 'sqlite::memory:',
21 |             'database.username' => null,
22 |             'database.password' => null,
23 |             'database.prefix' => 'phpunit_',
24 |             'database.persistent' => true,
25 |             'database.secondaries' => [],
26 |         ];
27 | 
28 |         Configuration::loadFromArray($config, '', 'simplesaml');
29 |         (new DatabaseMigration())->migrate();
30 |     }
31 | 
32 |     /**
33 |      * @throws \Exception
34 |      */
35 |     public function testCanAddAndDeleteTickets(): void
36 |     {
37 |         $store = new LogoutTicketStoreDb();
38 |         $sid = 'sid123';
39 |         $store->add($sid);
40 |         $allSids = $store->getAll();
41 |         $this->assertNotEmpty($allSids);
42 |         $this->assertSame($sid, $allSids[0]['sid']);
43 | 
44 |         $store->delete($sid);
45 | 
46 |         $this->assertEmpty($store->getAll());
47 |     }
48 | 
49 |     /**
50 |      * @throws \Exception
51 |      */
52 |     public function testCanDeleteMultipleTickets(): void
53 |     {
54 |         $sid1 = 'sid1';
55 |         $sid2 = 'sid2';
56 |         $sid3 = 'sid3';
57 | 
58 |         $store = new LogoutTicketStoreDb();
59 |         $store->add($sid1);
60 |         $store->add($sid2);
61 |         $store->add($sid3);
62 | 
63 |         $this->assertSame(3, count($store->getAll()));
64 | 
65 |         $store->deleteMultiple([]);
66 | 
67 |         $this->assertSame(3, count($store->getAll()));
68 | 
69 |         $store->deleteMultiple([$sid1, $sid2]);
70 | 
71 |         $this->assertSame(1, count($store->getAll()));
72 | 
73 |         $store->delete($sid3);
74 | 
75 |         $this->assertEmpty($store->getAll());
76 |     }
77 | 
78 |     /**
79 |      * @throws \Exception
80 |      */
81 |     public function testCanDeleteExpiredTickets(): void
82 |     {
83 |         $store = new LogoutTicketStoreDb(null, 0);
84 |         $sid = 'sid123';
85 |         $store->add($sid);
86 |         $this->assertEmpty($store->getAll());
87 |     }
88 | }
89 | 


--------------------------------------------------------------------------------
/src/Server/RequestRules/Rules/RedirectUriRule.php:
--------------------------------------------------------------------------------
 1 | <?php
 2 | 
 3 | declare(strict_types=1);
 4 | 
 5 | namespace SimpleSAML\Module\oidc\Server\RequestRules\Rules;
 6 | 
 7 | use LogicException;
 8 | use Psr\Http\Message\ServerRequestInterface;
 9 | use SimpleSAML\Module\oidc\Entities\Interfaces\ClientEntityInterface;
10 | use SimpleSAML\Module\oidc\Server\Exceptions\OidcServerException;
11 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultBagInterface;
12 | use SimpleSAML\Module\oidc\Server\RequestRules\Interfaces\ResultInterface;
13 | use SimpleSAML\Module\oidc\Server\RequestRules\Result;
14 | use SimpleSAML\Module\oidc\Services\LoggerService;
15 | use SimpleSAML\OpenID\Codebooks\HttpMethodsEnum;
16 | use SimpleSAML\OpenID\Codebooks\ParamsEnum;
17 | 
18 | class RedirectUriRule extends AbstractRule
19 | {
20 |     /**
21 |      * @inheritDoc
22 |      * @throws \Throwable
23 |      */
24 |     public function checkRule(
25 |         ServerRequestInterface $request,
26 |         ResultBagInterface $currentResultBag,
27 |         LoggerService $loggerService,
28 |         array $data = [],
29 |         bool $useFragmentInHttpErrorResponses = false,
30 |         array $allowedServerRequestMethods = [HttpMethodsEnum::GET],
31 |     ): ?ResultInterface {
32 |         $client = $currentResultBag->getOrFail(ClientIdRule::class)->getValue();
33 |         if (! $client instanceof ClientEntityInterface) {
34 |             throw new LogicException('Can not check redirect_uri, client is not ClientEntityInterface.');
35 |         }
36 | 
37 |         $redirectUri = $this->requestParamsResolver->getAsStringBasedOnAllowedMethods(
38 |             ParamsEnum::RedirectUri->value,
39 |             $request,
40 |             $allowedServerRequestMethods,
41 |         );
42 | 
43 |         // On OAuth2 redirect_uri is optional if there is only one registered, however we will always require it
44 |         // since this is OIDC oriented package and in OIDC this parameter is required.
45 |         if ($redirectUri === null) {
46 |             throw OidcServerException::invalidRequest(ParamsEnum::RedirectUri->value);
47 |         }
48 | 
49 |         $clientRedirectUri = $client->getRedirectUri();
50 |         if (is_string($clientRedirectUri) && (strcmp($clientRedirectUri, $redirectUri) !== 0)) {
51 |             throw OidcServerException::invalidClient($request);
52 |         } elseif (
53 |             is_array($clientRedirectUri) &&
54 |             in_array($redirectUri, $clientRedirectUri, true) === false
55 |         ) {
56 |             throw OidcServerException::invalidRequest(ParamsEnum::RedirectUri->value);
57 |         }
58 | 
59 |         return new Result($this->getKey(), $redirectUri);
60 |     }
61 | }
62 | 


--------------------------------------------------------------------------------