Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OIDC 'unauthorized' failure message #1911

Open
wants to merge 1 commit into
base: qa/2.x
Choose a base branch
from
Open

Add OIDC 'unauthorized' failure message #1911

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 6 additions & 7 deletions plugins/arOidcPlugin/lib/oidcUser.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,6 @@ public function authenticate($username = null, $password = null): bool
$userMatchingSource = $this->getProviderConfigValue('user_matching_source', '');
if (!arOidc::validateUserMatchingSource($userMatchingSource)) {
$this->logger->err('OIDC user matching source is configured but is not set properly. Unable to match OIDC users to AtoM users.');
$this->logout();

return $authenticated;
}
Expand All @@ -133,7 +132,6 @@ public function authenticate($username = null, $password = null): bool
$autoCreateUser = $this->getProviderConfigValue('auto_create_atom_user', true);
if (!is_bool($autoCreateUser)) {
$this->logger->err('OIDC auto_create_atom_user is configured but is not set properly - value should be of type bool. Unable to match OIDC users to AtoM users.');
$this->logout();

return $authenticated;
}
Expand All @@ -149,15 +147,13 @@ public function authenticate($username = null, $password = null): bool
// If user is null and $autoCreateUser is true, then something failed.
if (null === $user && $autoCreateUser) {
$this->logger->err('OIDC authentication succeeded but unable to find or create user in AtoM.');
$this->logout();

return $authenticated;
}

// If user is null and $autoCreateUser is false, then user has not been previously created or matching failed.
if (null === $user && !$autoCreateUser) {
$this->logger->err('OIDC authentication succeeded but user not found and auto_create_atom_user is set to false.');
$this->logout();

return $authenticated;
}
Expand All @@ -168,7 +164,6 @@ public function authenticate($username = null, $password = null): bool
$setGroupsFromClaims = $this->getProviderConfigValue('set_groups_from_attributes', false);
if (!is_bool($setGroupsFromClaims)) {
$this->logger->err('OIDC set_groups_from_attributes is configured but is not set properly - value should be of type bool. Unable to complete authentication.');
$this->logout();

return $authenticated;
}
Expand Down Expand Up @@ -281,14 +276,18 @@ public function isAuthenticated(): bool

/**
* Logout from AtoM and the OIDC server.
*
* @param mixed $sendOidcLogout
*/
public function logout(): void
public function logout($sendOidcLogout = false): void
{
// Clean up AtoM session.
$idToken = $this->getAttribute('oidc-token', null);
$this->unsetAttributes();
$this->signOut();

if (true == $this->getProviderConfigValue('send_oidc_logout', false) && !empty($idToken)) {
// Clean up OIDC session.
if (!empty($idToken) && $sendOidcLogout) {
$logoutRedirectUrl = sfConfig::get('app_oidc_logout_redirect_url', '');
if (empty($logoutRedirectUrl)) {
$logoutRedirectUrl = null;
Expand Down
7 changes: 6 additions & 1 deletion plugins/arOidcPlugin/modules/oidc/actions/loginAction.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,12 @@ public function execute($request)
$this->context->user->validateProviderId($providerId, true);
}

$this->context->user->authenticate();
$result = $this->context->user->authenticate();
if (false == $result) {
$this->context->user->logout(false);

$this->redirect('admin/secure');
}
}

// Redirect to module/action the user was trying to reach before being redirected
Expand Down
2 changes: 1 addition & 1 deletion plugins/arOidcPlugin/modules/oidc/actions/logoutAction.class.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ class OidcLogoutAction extends sfAction
{
public function execute($request)
{
$this->getUser()->logout();
$this->getUser()->logout($this->getUser()->getProviderConfigValue('send_oidc_logout', false));
$this->redirect('@homepage');
}
}
Loading