Cadoles/hydra-sql
22
0
Fork 0
Code Issues 4 Pull Requests 2 Projects Releases Wiki Activity

fix (oidc timeout) #31: ajout d'une règle de redirection en cas de donnée de session perdue
Some checks reported warnings
Cadoles/hydra-sql/pipeline/head This commit is unstable
Details
Cadoles/hydra-sql/pipeline/pr-develop This commit is unstable
Details

Browse Source
This commit is contained in:
Rudy Masson
2024-04-18 17:13:42 +02:00
parent cd888d2080
commit bcc91a17b4
3 changed files with 37 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/Hydra/HydraService.php
View File

@ -2,6 +2,7 @@
namespace App\Hydra;
use App\Entity\User;
use App\Hydra\Exception\InvalidChallengeException;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Exception\BadRequestException;
@ -9,13 +10,14 @@ use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Session\SessionInterface;
use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
use Symfony\Component\Security\Core\Exception\AccessDeniedException;
class HydraService extends AbstractController
{
public SessionInterface $session;
public Client $client;
public TokenStorageInterface $tokenStorage;
public string $baseUrl;
private SessionInterface $session;
private Client $client;
private TokenStorageInterface $tokenStorage;
private string $baseUrl;
public function __construct(Client $client, SessionInterface $session, TokenStorageInterface $tokenStorage, string $baseUrl)
{
@ -25,7 +27,7 @@ class HydraService extends AbstractController
$this->baseUrl = $baseUrl;
}
public function handleLoginRequest(Request $request)
public function handleLoginRequest(Request $request): RedirectResponse
{
$challenge = $request->query->get('login_challenge');
// S'il n'y a pas de challenge, on déclenche une bad request
@ -37,15 +39,15 @@ class HydraService extends AbstractController
$loginRequestInfo = $res->toArray();
if (200 !== $res->getStatusCode()) {
$this->session->clear();
throw new BadRequestException('pas de code 200');
throw new BadRequestException();
}
// si le challenge est validé par hydra, on le stocke en session pour l'utiliser par la suite et on redirige vers une route interne protégée qui va déclencher l'identification FranceConnect
$this->session->set('challenge', $loginRequestInfo['challenge']);
return new RedirectResponse($this->baseUrl.'/connect/login-accept');
return new RedirectResponse($this->baseUrl . '/connect/login-accept');
}
public function handleConsentRequest(Request $request)
public function handleConsentRequest(Request $request): RedirectResponse
{
$challenge = $request->query->get('consent_challenge');
if (!$challenge) {
@ -53,8 +55,10 @@ class HydraService extends AbstractController
}
$consentRequestInfo = $this->client->fetchConsentRequestInfo($challenge)->toArray();
/** @var User */
$user = $this->getUser();
if (!$user instanceof User) {
throw new AccessDeniedException('Utilisateur non autorisé.');
}
$consentAcceptResponse = $this->client->acceptConsentRequest($consentRequestInfo['challenge'], [
'grant_scope' => $consentRequestInfo['requested_scope'],
'session' => [
@ -65,7 +69,7 @@ class HydraService extends AbstractController
return new RedirectResponse($consentAcceptResponse['redirect_to']);
}
public function handleLogoutRequest(Request $request)
public function handleLogoutRequest(Request $request): RedirectResponse
{
$logoutChallenge = $request->get('logout_challenge');
if (empty($logoutChallenge)) {