lemonldap-ng/modules/lemonldap-ng-portal/lib/Lemonldap/NG/Portal/AuthSAML.pm

## @file
# SAML Service Provider - Authentication

## @class
# SAML Service Provider - Authentication
package Lemonldap::NG::Portal::AuthSAML;

use strict;
use Lemonldap::NG::Portal::Simple;
use Lemonldap::NG::Portal::_SAML;    #inherits
use Lemonldap::NG::Common::Conf::SAML::Metadata;

our $VERSION = '0.1';

## @apmethod int authInit()
# Load Lasso and metadata
# @return Lemonldap::NG::Portal error code
sub authInit {
    my $self = shift;

    # Load Lasso
    return PE_ERROR unless $self->loadLasso();

    # Activate SOAP
    $self->abort( 'To use SAML, you must activate SOAP (Soap => 1)', 'error' )
      unless ( $self->{Soap} );

    # Check presence of private key in configuration
    unless ( $self->{samlServicePrivateKey} ) {
        $self->lmLog( "SAML private key not found in configuration", 'error' );
        return PE_ERROR;
    }

    # Get metadata from configuration
    $self->lmLog( "Get Metadata for this service", 'debug' );
    my $service_metadata = Lemonldap::NG::Common::Conf::SAML::Metadata->new();

    # Create Lasso server with service metadata
    my $server = $self->createServer(
        $service_metadata->serviceToXML(
            $ENV{DOCUMENT_ROOT} . "/skins/common/saml2-metadata.tpl", $self
        ),
        $self->{samlServicePrivateKey},
    );

    unless ($server) {
        $self->lmLog( 'Unable to create Lasso server', 'error' );
        return PE_ERROR;
    }

    $self->lmLog( "Service created", 'debug' );

    # Check presence of at least one identity provider in configuration
    unless ( $self->{samlIDPMetaData}
        and keys %{ $self->{samlIDPMetaData} } )
    {
        $self->lmLog( "No IDP found in configuration", 'error' );
        return PE_ERROR;
    }

    # Load identity provider metadata
    # IDP are listed in $self->{samlIDPMetaData}
    # Each key is the IDP name
    # Build IDP list for later use in extractFormInfo
    foreach ( keys %{ $self->{samlIDPMetaData} } ) {

        $self->lmLog( "Get Metadata for IDP $_", 'debug' );

        # Get metadata from configuration
        my $idp_metadata = Lemonldap::NG::Common::Conf::SAML::Metadata->new();
        unless (
            $idp_metadata->initializeFromConfHash(
                $self->{samlIDPMetaData}->{$_}->{samlIDPMetaDataXML}
            )
          )
        {
            $self->lmLog( "Fail to read IDP $_ Metadata from configuration",
                'error' );
            return PE_ERROR;
        }

        # Add this IDP to Lasso::Server
        my $result = $self->addIDP( $server, $idp_metadata->toXML() );

        unless ($result) {
            $self->lmLog( "Fail to use IDP $_ Metadata", 'error' );
            return PE_ERROR;
        }

        # Store IDP entityID and Organization Name
        my $entityID = $idp_metadata->{entityID};
        my $name = $self->getOrganizationName( $server, $entityID )
          || ucfirst($_);
        $self->{_idpList}->{$_}->{entityID} = $entityID;
        $self->{_idpList}->{$_}->{name}     = $name;

        $self->lmLog( "IDP $_ added", 'debug' );
    }

    # Store Lasso::Server object
    $self->{_lassoServer} = $server;

    PE_OK;
}

## @apmethod int extractFormInfo()
# Check authentication statement or create authentication request
# @return Lemonldap::NG::Portal error code
sub extractFormInfo {
    my $self   = shift;
    my $server = $self->{_lassoServer};
    my $login;
    my $idp;
    my %h;

    # 1. Get URL parameters to know if we are receving an assertion
    my $url              = $self->url();
    my $saml_acs_art_url = (
        split(
            /;/,
            $self->{samlSPSSODescriptorAssertionConsumerServiceHTTPArtifact}
        )
    )[3];
    my $saml_acs_post_url = (
        split(
            /;/, $self->{samlSPSSODescriptorAssertionConsumerServiceHTTPPost}
        )
    )[3];
    my $saml_acs_get_url = (
        split(
            /;/,
            $self->{samlSPSSODescriptorAssertionConsumerServiceHTTPRedirect}
        )
    )[3];

    if ( $url =~ /^($saml_acs_art_url|$saml_acs_post_url|$saml_acs_get_url)$/i )
    {

        $self->lmLog( "URL $url detected as an assertion consumer URL",
            'debug' );

        # Create Login object
        $login = $self->createLogin($server);

        # 1.1 HTTP REDIRECT
        if ( $url =~ /^$saml_acs_get_url$/i ) {

            # Response in query string
            my $response = $self->query_string();

            $self->lmLog( "HTTP-REDIRECT: SAML Response $response", 'debug' );

            # Process authentication response
            my $result = $self->processAuthnResponseMsg( $login, $response );

            unless ($result) {
                $self->lmLog(
                    "HTTP-REDIRECT: Fail to process authentication response",
                    'error' );
                return PE_ERROR;
            }

            $self->lmLog( "HTTP-REDIRECT: authentication response is valid",
                'debug' );
        }

        # 1.2 POST
        # TODO

        # 1.3 ARTEFACT (SOAP)
        # TODO

        # Get SAML response
        my $saml_response = $login->response();
        unless ($saml_response) {
            $self->lmLog( "No SAML response found", 'error' );
            return PE_ERROR;
        }

        # Replay protection if this is a response to a created authn request
        my $assertion_responded = $saml_response->InResponseTo;
        if ($assertion_responded) {
            my $assertion_sessions =
              $self->{globalStorage}->searchOn( $self->{globalStorageOptions},
                "ID", $assertion_responded, );

            if ( my @assertion_keys = keys %$assertion_sessions ) {

                # A session was found
                foreach (@assertion_keys) {
                    my $assertion_session = $_;

                    # Delete it
                    eval {
                        tie %h, $self->{globalStorage}, $_,
                          $self->{globalStorageOptions};
                    };
                    if ($@) {
                        $self->lmLog(
"Unable to recover assertion session $assertion_session (assertion ID $assertion_responded)",
                            'error'
                        );
                        return PE_ERROR;
                    }
                    eval { tied(%h)->delete(); };
                    if ($@) {
                        $self->lmLog(
"Unable to delete assertion session $assertion_session (assertion ID $assertion_responded)",
                            'error'
                        );
                        return PE_ERROR;
                    }
                    $self->lmLog(
"Assertion session $assertion_session (assertion ID $assertion_responded) was deleted",
                        'debug'
                    );
                }
            }
            else {

                # Assertion was already consumed or is expired
                # Force authentication replay
                $self->lmLog(
"Assertion $assertion_responded already used or expired, replay authentication",
                    'error'
                );
                delete $self->{urldc};
                $self->{mustRedirect} = 1;
                $self->{error}        = $self->_subProcess(qw(autoRedirect));
                return $self->{error};
            }
        }
        else {
            $self->lmLog(
"Assertion is not a response to a created authentication request, do not control replay",
                'debug'
            );
        }

        # Get SAML assertion
        my $assertion = $self->getAssertion($login);

        unless ($assertion) {
            $self->lmLog( "No assertion found", 'error' );
            return PE_ERROR;
        }

        # Check conditions - time and audience
        unless (
            $self->validateConditions( $assertion, $self->{samlEntityID} ) )
        {
            $self->lmLog( "Time or Audience conditions not validated",
                'error' );
            return PE_ERROR;
        }

        $self->lmLog( "Conditions validated", 'debug' );

        # Check OneTimeUse flag
        # TODO

        # Check ProxyRestriction flag
        # TODO

        #  Extract RelayState information
        if ( $self->extractRelayState($login) ) {
            $self->lmLog( "RelayState found in authentication assertion",
                'debug' );
        }

        # Check IDP from RelayState
        my $idp = $self->{_idp};
        if ($idp) {
            $self->lmLog( "IDP $idp found in RelayState", 'debug' );
        }
        else {

            # Try to recover IDP from IDP cookie
            my %cookies    = fetch CGI::Cookie;
            my $idp_cookie = $cookies{ $self->{samlIdPResolveCookie} };
            if ($idp_cookie) {
                $idp = $idp_cookie->value;
                $self->{_idp} = $idp;
                $self->lmLog( "IDP $idp found in IDP resolution cookie",
                    'debug' );
            }
            else {
                $self->lmLog(
"IDP was not found in RelayState or in IDP resolution cookie",
                    'error'
                );
                return PE_ERROR;
            }
        }

        # Force redirection to portal if no urldc found
        # (avoid displaying the whole SAML URL in user browser URL field)
        $self->{mustRedirect} = 1 unless ( $self->{urldc} );

        # Get NameID
        my $nameid = $login->nameIdentifier;

        # Set user
        my $user = $nameid->content;

        unless ($user) {
            $self->lmLog( "No NameID value found", 'error' );
            return PE_USERNOTFOUND;
        }

        $self->lmLog( "Find NameID: $user", 'debug' );
        $self->{user} = $user;

        # Store Lasso::Login object
        $self->{_lassoLogin} = $login;

        return PE_OK;
    }

    # 2. IDP resolution

    # Get IDP resolution cookie
    my %cookies    = fetch CGI::Cookie;
    my $idp_cookie = $cookies{ $self->{samlIdPResolveCookie} };
    if ($idp_cookie) {
        $idp = $idp_cookie->value;
        $self->lmLog( "IDP $idp found in IDP resolution cookie", 'debug' );
    }

    # If no IDP resolve cookie, find another way to get it
    # Case 1: IDP was choosen from portal IDP list
    $idp ||= $self->param("idp");

    # TODO - other case (IP resolution, etc.)

    # Get confirmation flag
    my $confirm_flag = $self->param("confirm");

    # If confirmation is -1, or IDP was not resolve, let the user choose its IDP
    if ( $confirm_flag == -1 or !$idp ) {
        $self->lmLog( "No IDP found, redirecting user to IDP list", 'debug' );

        # IDP list
        my $html = "<h3>"
          . &Lemonldap::NG::Portal::_i18n::msg( PM_SAML_IDPSELECT,
            $ENV{HTTP_ACCEPT_LANGUAGE} )
          . "</h3>\n<table>\n";

        foreach ( keys %{ $self->{_idpList} } ) {
            $html .=
                '<tr><td><input type="radio" name="idp" value="' 
              . $_
              . '" /></td><td>'
              . $self->{_idpList}->{$_}->{name}
              . '</td></tr>';
        }

        $html .=
'<tr><td><input type="checkbox" name="cookie_type" value="1"></td><td>'
          . &Lemonldap::NG::Portal::_i18n::msg( PM_REMEMBERCHOICE,
            $ENV{HTTP_ACCEPT_LANGUAGE} )
          . "</td></tr></table>\n"

          # Script to autoselect first choice
          . '<script>$("[type=radio]:first").attr("checked","checked");</script>';

        $self->info($html);

        # Delete existing IDP resolution cookie
        push @{ $self->{cookie} },
          $self->cookie(
            -name    => $self->{samlIdPResolveCookie},
            -value   => 0,
            -domain  => $self->{domain},
            -path    => "/",
            -secure  => 0,
            -expires => '-1d',
          );

        return PE_CONFIRM;
    }

    # If IDP is found but not confirmed, let the user confirm it
    if ( $confirm_flag != 1 ) {
        $self->lmLog( "IDP $idp selected, need user confirmation", 'debug' );

        # Choosen IDP
        my $html = '<h3>'
          . &Lemonldap::NG::Portal::_i18n::msg( PM_SAML_IDPCHOOSEN,
            $ENV{HTTP_ACCEPT_LANGUAGE} )
          . "</h3>\n"
          . "<h4>$idp</h4>\n" . "<h5>("
          . $self->{_idpList}->{$idp}->{entityID}
          . ")</h5>\n"
          . "<input type=\"hidden\" name=\"idp\" value=\"$idp\" />\n";

        $self->info($html);

        return PE_CONFIRM;
    }

    # Here confirmation is OK (confirm_flag == 1), store choosen IDP in cookie
    unless ( $idp_cookie and ( $idp eq $idp_cookie->value ) ) {
        $self->lmLog( "Build cookie to remember $idp as IDP choice", 'debug' );

        # User can choose temporary (0) or persistent cookie (1)
        my $cookie_type = $self->param("cookie_type") || "0";

        push @{ $self->{cookie} },
          $self->cookie(
            -name     => $self->{samlIdPResolveCookie},
            -value    => $idp,
            -domain   => $self->{domain},
            -path     => "/",
            -secure   => $self->{securedCookie},
            -httponly => $self->{httpOnly},
            -expires  => $cookie_type ? "+365d" : "",
          );
    }

    # 3. Build authentication request
    $self->{_idp} = $idp;
    my $IDPentityID = $self->{_idpList}->{$idp}->{entityID};
    $login = $self->createAuthnRequest( $server, $IDPentityID );

    unless ($login) {
        $self->lmLog( "Could not create authentication request on $IDPentityID",
            'error' );
        return PE_ERROR;
    }

    $self->lmLog( "Authentication request created", 'debug' );

    # Keep assertion ID in memory to prevent replay
    my $assertion_id = $login->request()->ID;
    eval {
        tie %h, $self->{globalStorage}, undef, $self->{globalStorageOptions};
    };
    if ( $@ or !$assertion_id ) {
        $self->lmLog( "Unable to store assertion ID", 'error' );
        return PE_ERROR;
    }
    $h{type}   = 'assertion';     # Session type
    $h{_utime} = time();          # Creation time
    $h{ID}     = $assertion_id;
    my $assertion_session_id = $h{_session_id};
    untie %h;

    $self->lmLog(
"Keep assertion ID $assertion_id in assertion session $assertion_session_id",
        'debug'
    );

    # Redirect user to IDP SSO URL
    # Replace urldc value by SSO URL value and call sub autoRedirect
    # TODO Manage other transport (POST, SOAP, ...)
    my $sso_url = $login->msg_url;
    $self->lmLog( "Redirect user to $sso_url", 'debug' );

    $self->{urldc} = $sso_url;
    $self->{error} = $self->_subProcess(qw(autoRedirect));

    return $self->{error};
}

## @apmethod int setAuthSessionInfo()
# Extract attributes sent in authentication statement
# @return Lemonldap::NG::Portal error code
sub setAuthSessionInfo {
    my $self   = shift;
    my $server = $self->{_lassoServer};
    my $login  = $self->{_lassoLogin};
    my $idp    = $self->{_idp};

    # Get SAML assertion
    my $assertion = $self->getAssertion($login);

    unless ($assertion) {
        $self->lmLog( "No assertion found", 'error' );
        return PE_ERROR;
    }

    # Try to get attributes if attribute statement is present in assertion
    my $attr_statement = $assertion->AttributeStatement();
    if ($attr_statement) {

        # Get attributes
        my @attributes = $attr_statement->Attribute();

        # Wanted attributes are defined in IDP configuration
        foreach ( keys %{ $self->{samlIDPMetaData}->{$idp}->{samlIDPMetaDataExportedAttr} } ) {

            # Extract fields from exportedAttr value
            my ( $mandatory, $name, $format, $friendly_name ) =
              split( /;/,
                $self->{samlIDPMetaData}->{$idp}->{samlIDPMetaDataExportedAttr}->{$_} );

            # Try to get value
            my $value =
              $self->getAttributeValue( $name, $format, $friendly_name,
                \@attributes );

            # Store value in sessionInfo
            $self->{sessionInfo}->{$_} = $value if defined $value;
        }
    }

    # Store other informations in session
    $self->{sessionInfo}->{_user} = $self->{user};
    $self->{sessionInfo}->{_idp}  = $idp;

    # TODO adapt _utime with SessionNotOnOrAfter

    PE_OK;
}

## @apmethod int authenticate()
# Accept SSO from IDP
# @return PE_OK
sub authenticate {
    my $self   = shift;
    my $server = $self->{_lassoServer};
    my $login  = $self->{_lassoLogin};

    # Accept SSO
    unless ( $self->acceptSSO($login) ) {
        $self->lmLog( "Error while accepting SSO from IDP", 'error' );
        return PE_ERROR;
    }

    # Dump Lasso objects in session
    $self->{sessionInfo}->{_lassoLoginDump} = $login->dump();

    # Set authenticationLevel
    $self->{sessionInfo}->{authenticationLevel} = 5;

    PE_OK;
}

## @apmethod void authLogout()
# Logout SP
# @return nothing
sub authLogout {
    my $self = shift;
    my %h;

    # Get Lasso Server
    unless ( $self->{_lassoServer} ) {
        $self->_sub('authInit');
    }

    my $server = $self->{_lassoServer};

    # Build Logout Request if Logout is initiated by SP
    # TODO - test logout initiater

    my $idp         = $self->{_idp};
    my $IDPentityID = $self->{_idpList}->{$idp}->{entityID};
    my $logout      = $self->createLogoutRequest( $server, $IDPentityID );
    unless ($logout) {
        $self->lmLog( "Could not create logout request on $IDPentityID",
            'error' );
        return PE_ERROR;
    }

    $self->lmLog( "Logout request created", 'debug' );

    # Keep request ID in memory to prevent replay
    my $logout_request_id = $logout->request()->ID;
    eval {
        tie %h, $self->{globalStorage}, undef, $self->{globalStorageOptions};
    };
    if ( $@ or !$logout_request_id ) {
        $self->lmLog( "Unable to store Logout request ID", 'error' );
        return PE_ERROR;
    }
    $h{type}   = 'assertion';          # Session type
    $h{_utime} = time();               # Creation time
    $h{ID}     = $logout_request_id;
    my $logout_request_session_id = $h{_session_id};
    untie %h;

    $self->lmLog(
"Keep Logout request ID $logout_request_id in assertion session $logout_request_session_id",
        'debug'
    );

    # Redirect user to IDP SLO URL
    # Replace urldc value by SLO URL value and call sub autoRedirect
    # TODO Manage other transport (POST, SOAP, ...)
    my $slo_url = $logout->msg_url;
    $self->lmLog( "Redirect user to $slo_url", 'debug' );

    $self->{urldc} = $slo_url;
    $self->{error} = $self->_subProcess(qw(autoRedirect));

    return;
}

1;
__END__

=head1 NAME

=encoding utf8

Lemonldap::NG::Portal::AuthSAML - SAML Authentication backend

=head1 SYNOPSIS

  use Lemonldap::NG::Portal::AuthSAML;

=head1 DESCRIPTION

Use SAML to authenticate users

=head1 SEE ALSO

L<Lemonldap::NG::Portal>, L<Lemonldap::NG::Portal::UserDBSAML>, L<Lemonldap::NG::Portal::_SAML>

=head1 AUTHOR

Xavier Guimard, E<lt>x.guimard@free.frE<gt>, Clement Oudot, E<lt>coudot@linagora.comE<gt>

=head1 COPYRIGHT AND LICENSE

Copyright (C) 2009 by Xavier Guimard

This library is free software; you can redistribute it and/or modify
it under the same terms as Perl itself, either Perl version 5.10.0 or,
at your option, any later version of Perl 5 you may have available.

=cut