saml2_sls.inc

<?php
require_once SQ_INCLUDE_PATH.'/asset.inc';

class Saml2_SLS extends Asset
{


    function __construct($assetid=0)
    {
        parent::__construct($assetid);

    }//end constructor


    function _getName($short_name=FALSE)
    {
        return $this->attr('name');

    }//end _getName()


    
    protected function _createAdditional(Array &$link)
    {
        if (!parent::_createAdditional($link)) return FALSE;

        // NOTE: the main time we wont want to do this is if we are creating
        // the root folder as it is not linked anywhere
        if (empty($link)) return TRUE;

        return $this->makeAndSaveInitialWebPath(strtolower($this->attr('name')), $link);

    }//end _createAdditional()


    function printBody()
    {   

    // get the source id from parent
    $saml_account_manager_data = $GLOBALS['SQ_SYSTEM']->am->getLink($this->id, SQ_LINK_TYPE_2, 'saml_account_manager', TRUE, 'saml2_single_logout_service', 'minor');
    $saml_account_manager = $GLOBALS['SQ_SYSTEM']->am->getAsset($saml_account_manager_data['majorid']);
    
    if(!$saml_account_manager->isSimplesamlphpInstalled()) {
        echo('simplesamlphp library is not installed');
        return FALSE;
    }
    
    require_once SQ_TOOL_SIMPLESAMLPHP_PATH.'/lib/_autoload.php';
    require_once SQ_PACKAGES_PATH.'/saml/lib/saml_auth_manager.inc';
    require_once SQ_PACKAGES_PATH.'/saml/lib/saml_sp.inc';
    
    $sourceId = $saml_account_manager->attr('auth_source');
    
    $config = SimpleSAML_Configuration::getConfig('authsources.php');
    $authConfig = $config->getArray($sourceId, NULL);
    $source = new SAML_Service_Provider (Array('AuthId' => $sourceId), $authConfig);

    try {
        $binding = SAML2_Binding::getCurrentBinding();
    }
    catch (Exception $e) {
        echo($e->getMessage());
        return FALSE;
    }
    
    $binding = SAML2_Binding::getCurrentBinding();
    $message = $binding->receive();

    $idpEntityId = $message->getIssuer();
    if ($idpEntityId === NULL) {
        /* Without an issuer we have no way to respond to the message. */
        throw new SimpleSAML_Error_BadRequest('Received message on logout endpoint without issuer.');
    }

    $spEntityId = $source->getEntityId();

    $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
    $idpMetadata = $source->getIdPMetadata($idpEntityId);
    $spMetadata = $source->getMetadata();

    sspmod_saml_Message::validateMessage($idpMetadata, $spMetadata, $message);

    $destination = $message->getDestination();
    if ($destination !== NULL && $destination !== SimpleSAML_Utilities::selfURLNoQuery()) {
        throw new SimpleSAML_Error_Exception('Destination in logout message is wrong.');
    }

    if ($message instanceof SAML2_LogoutResponse) {

        $relayState = $message->getRelayState();
        if ($relayState === NULL) {
            /* Somehow, our RelayState has been lost. */
            throw new SimpleSAML_Error_BadRequest('Missing RelayState in logout response.');
        }

        if (!$message->isSuccess()) {
            SimpleSAML_Logger::warning('Unsuccessful logout. Status was: ' . sspmod_saml_Message::getResponseError($message));
        }

        $state = SimpleSAML_Auth_State::loadState($relayState, 'saml:slosent');
        $state['saml:sp:LogoutStatus'] = $message->getStatus();
        SimpleSAML_Auth_Source::completeLogout($state);

    } elseif ($message instanceof SAML2_LogoutRequest) {

        SimpleSAML_Logger::debug('SAML2 Single Logout Service: Request from ' . $idpEntityId);
        SimpleSAML_Logger::stats('saml20-idp-SLO idpinit ' . $spEntityId . ' ' . $idpEntityId);

        if ($message->isNameIdEncrypted()) {
            try {
                $keys = sspmod_saml_Message::getDecryptionKeys($idpMetadata, $spMetadata);
            } catch (Exception $e) {
                throw new SimpleSAML_Error_Exception('Error decrypting NameID: ' . $e->getMessage());
            }

            $lastException = NULL;
            foreach ($keys as $i => $key) {
                try {
                    $message->decryptNameId($key);
                    SimpleSAML_Logger::debug('Decryption with key #' . $i . ' succeeded.');
                    $lastException = NULL;
                    break;
                } catch (Exception $e) {
                    SimpleSAML_Logger::debug('Decryption with key #' . $i . ' failed with exception: ' . $e->getMessage());
                    $lastException = $e;
                }
            }
            if ($lastException !== NULL) {
                throw $lastException;
            }
        }

        $nameId = $message->getNameId();
        $sessionIndexes = $message->getSessionIndexes();

        $numLoggedOut = sspmod_saml_SP_LogoutStore::logoutSessions($sourceId, $nameId, $sessionIndexes);
        if ($numLoggedOut === FALSE) {
            /* This type of logout was unsupported. Use the old method. */
            $source->handleLogout($idpEntityId);
            $numLoggedOut = count($sessionIndexes);
        }

        /* Create an send response. */
        $lr = sspmod_saml_Message::buildLogoutResponse($spMetadata, $idpMetadata);
        $lr->setRelayState($message->getRelayState());
        $lr->setInResponseTo($message->getId());

        if ($numLoggedOut < count($sessionIndexes)) {
            SimpleSAML_Logger::warning('Logged out of ' . $numLoggedOut  . ' of ' . count($sessionIndexes) . ' sessions.');
        }

        $binding->send($lr);
    } else {
        throw new SimpleSAML_Error_BadRequest('Unknown message received on logout endpoint: ' . get_class($message));
    }


    }
    
}//end class
?>