Não pode autenticar-se porque a %idpName% enviou um valor para AuthnContextClassRef que não é permitido.
', 'error_authn_context_class_ref_blacklisted_desc_no_idp_name' => 'Não pode autenticar-se porque a sua %organisationNoun% enviou um valor para AuthnContextClassRef que não é permitido.
', diff --git a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuard.php b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuard.php index f5292dd5ff..6cc70c1aab 100644 --- a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuard.php +++ b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuard.php @@ -34,9 +34,15 @@ final class AuthenticationLoopGuard implements AuthenticationLoopGuardInterface */ private $timeFrameForAuthenticationLoopInSeconds; + /** + * @var int + */ + private $maximumAuthenticationProceduresAllowedAll; + public function __construct( $maximumAuthenticationProceduresAllowed, - $timeFrameForAuthenticationLoopInSeconds + $timeFrameForAuthenticationLoopInSeconds, + $maximumAuthenticationProceduresAllowedAll ) { Assertion::integer( $maximumAuthenticationProceduresAllowed, @@ -46,20 +52,20 @@ public function __construct( $timeFrameForAuthenticationLoopInSeconds, 'Expected time frame for determining authentication loop in seconds to be an integer, got "%s"' ); + Assertion::integer( + $maximumAuthenticationProceduresAllowedAll, + 'Expected maximum authentication procedures allowed all to be an integer, got "%s"' + ); $this->maximumAuthenticationProceduresAllowed = $maximumAuthenticationProceduresAllowed; $this->timeFrameForAuthenticationLoopInSeconds = $timeFrameForAuthenticationLoopInSeconds; + $this->maximumAuthenticationProceduresAllowedAll = $maximumAuthenticationProceduresAllowedAll; } - /** - * @param Entity $serviceProvider - * @param AuthenticationProcedureMap $pastAuthenticationProcedures - * @return bool - */ public function detectsAuthenticationLoop( Entity $serviceProvider, AuthenticationProcedureMap $pastAuthenticationProcedures - ) { + ): bool { $now = new DateTimeImmutable; $startDate = $now->modify(sprintf('-%d seconds', $this->timeFrameForAuthenticationLoopInSeconds)); @@ -70,4 +76,19 @@ public function detectsAuthenticationLoop( return $processedLoginProcedures >= $this->maximumAuthenticationProceduresAllowed; } + + + /** + * @param AuthenticationProcedureMap $pastAuthenticationProcedures + * @return bool + */ + public function detectsAuthenticationLimit( + AuthenticationProcedureMap $pastAuthenticationProcedures + ): bool { + $processedLoginProcedures = $pastAuthenticationProcedures + ->filterProceduresNotCompleted() + ->count(); + + return $processedLoginProcedures >= $this->maximumAuthenticationProceduresAllowedAll; + } } diff --git a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuardInterface.php b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuardInterface.php index e7ea6cb38a..503247f175 100644 --- a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuardInterface.php +++ b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationLoopGuardInterface.php @@ -22,13 +22,12 @@ interface AuthenticationLoopGuardInterface { - /** - * @param Entity $serviceProvider - * @param AuthenticationProcedureMap $pastAuthenticationProcedures - * @return - */ public function detectsAuthenticationLoop( Entity $serviceProvider, AuthenticationProcedureMap $pastAuthenticationProcedures - ); + ): bool; + + public function detectsAuthenticationLimit( + AuthenticationProcedureMap $pastAuthenticationProcedures + ): bool; } diff --git a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationProcedureMap.php b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationProcedureMap.php index c13f2867a3..63ce696e73 100644 --- a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationProcedureMap.php +++ b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationProcedureMap.php @@ -91,6 +91,15 @@ public function filterProceduresCompletedAfter(DateTimeInterface $startDate): Au return new self(array_filter($this->authenticationProcedures, $filterMethod)); } + public function filterProceduresNotCompleted(): AuthenticationProcedureMap + { + $filterMethod = function (AuthenticationProcedure $authenticationProcedure) { + return !$authenticationProcedure->isCompleted(); + }; + + return new self(array_filter($this->authenticationProcedures, $filterMethod)); + } + /** * @param AuthenticationProcedure $other * @return bool diff --git a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationState.php b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationState.php index eb5aba1a98..516dbf8a11 100644 --- a/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationState.php +++ b/src/OpenConext/EngineBlockBundle/Authentication/AuthenticationState.php @@ -21,6 +21,7 @@ use Assert\AssertionFailedException; use DateTimeImmutable; use OpenConext\EngineBlock\Assert\Assertion; +use OpenConext\EngineBlockBundle\Exception\AuthenticationProceduresLimitExceededException; use OpenConext\EngineBlockBundle\Exception\LogicException; use OpenConext\EngineBlockBundle\Exception\StuckInAuthenticationLoopException; use OpenConext\Value\Saml\Entity; @@ -54,6 +55,22 @@ public function startAuthenticationOnBehalfOf(string $requestId, Entity $service Assertion::string($requestId, 'The requestId must be a string (XML ID) value'); $currentAuthenticationProcedure = AuthenticationProcedure::onBehalfOf($serviceProvider); + // total + $authenticationLimitExceeded = $this->authenticationLoopGuard->detectsAuthenticationLimit( + $this->authenticationProcedures + ); + + if ($authenticationLimitExceeded) { + session_destroy(); + + throw new AuthenticationProceduresLimitExceededException( + 'More than the configured maximum authentication procedures for the current user' + . ' the user seems to be stuck in an authentication loop. ' + . ' Aborting the current authentication procedure.' + ); + } + + // per SP $inAuthenticationLoop = $this->authenticationLoopGuard->detectsAuthenticationLoop( $serviceProvider, $this->authenticationProcedures diff --git a/src/OpenConext/EngineBlockBundle/Controller/FeedbackController.php b/src/OpenConext/EngineBlockBundle/Controller/FeedbackController.php index a41437ff95..d23687a2e9 100644 --- a/src/OpenConext/EngineBlockBundle/Controller/FeedbackController.php +++ b/src/OpenConext/EngineBlockBundle/Controller/FeedbackController.php @@ -454,6 +454,14 @@ public function stuckInAuthenticationLoopAction() ); } + public function authenticationLimitExceededAction() + { + return new Response( + $this->twig->render('@theme/Authentication/View/Feedback/authentication-limit-exceeded.html.twig'), + 429 + ); + } + /** * @return Response */ diff --git a/src/OpenConext/EngineBlockBundle/EventListener/RedirectToFeedbackPageExceptionListener.php b/src/OpenConext/EngineBlockBundle/EventListener/RedirectToFeedbackPageExceptionListener.php index aa17af6f18..b388151b2e 100644 --- a/src/OpenConext/EngineBlockBundle/EventListener/RedirectToFeedbackPageExceptionListener.php +++ b/src/OpenConext/EngineBlockBundle/EventListener/RedirectToFeedbackPageExceptionListener.php @@ -47,6 +47,7 @@ use OpenConext\EngineBlock\Exception\InvalidRequestMethodException; use OpenConext\EngineBlock\Exception\MissingParameterException; use OpenConext\EngineBlockBridge\ErrorReporter; +use OpenConext\EngineBlockBundle\Exception\AuthenticationProceduresLimitExceededException; use OpenConext\EngineBlockBundle\Exception\EntityCanNotBeFoundException; use OpenConext\EngineBlockBundle\Exception\StuckInAuthenticationLoopException; use OpenConext\EngineBlockBundle\Exception\UnknownKeyIdException; @@ -192,6 +193,9 @@ public function onKernelException(GetResponseForExceptionEvent $event) } elseif ($exception instanceof StuckInAuthenticationLoopException) { $message = 'Stuck in authentication loop'; $redirectToRoute = 'authentication_feedback_stuck_in_authentication_loop'; + } elseif ($exception instanceof AuthenticationProceduresLimitExceededException) { + $message = 'Authentication procedure limit exceeded'; + $redirectToRoute = 'authentication_feedback_authentication_limit_exceeded'; } elseif ($exception instanceof InvalidRequestMethodException || $exception instanceof InvalidBindingException || $exception instanceof MissingParameterException @@ -205,13 +209,13 @@ public function onKernelException(GetResponseForExceptionEvent $event) } elseif ($exception instanceof EngineBlock_Corto_Exception_UserCancelledStepupCallout) { $message = $exception->getMessage(); $redirectToRoute = 'authentication_feedback_stepup_callout_user_cancelled'; - } else if ($exception instanceof EngineBlock_Corto_Exception_InvalidStepupLoaLevel) { + } elseif ($exception instanceof EngineBlock_Corto_Exception_InvalidStepupLoaLevel) { $message = $exception->getMessage(); $redirectToRoute = 'authentication_feedback_stepup_callout_unmet_loa'; - } else if ($exception instanceof EngineBlock_Corto_Exception_InvalidStepupCalloutResponse) { + } elseif ($exception instanceof EngineBlock_Corto_Exception_InvalidStepupCalloutResponse) { $message = $exception->getMessage(); $redirectToRoute = 'authentication_feedback_stepup_callout_unknown'; - } else if ($exception instanceof EntityCanNotBeFoundException) { + } elseif ($exception instanceof EntityCanNotBeFoundException) { $event->getRequest()->getSession()->set('feedback_custom', $exception->getMessage()); $redirectToRoute = 'authentication_feedback_metadata_entity_not_found'; } else { diff --git a/src/OpenConext/EngineBlockBundle/Exception/AuthenticationProceduresLimitExceededException.php b/src/OpenConext/EngineBlockBundle/Exception/AuthenticationProceduresLimitExceededException.php new file mode 100644 index 0000000000..df2468b51b --- /dev/null +++ b/src/OpenConext/EngineBlockBundle/Exception/AuthenticationProceduresLimitExceededException.php @@ -0,0 +1,25 @@ +authenticationGuardFixture['maximumAuthenticationProceduresAllowed'] = $maximumAuthenticationProceduresAllowed; - $this->authenticationGuardFixture['timeFrameForAuthenticationLoopInSeconds'] - = $timeFrameForAuthenticationLoopInSeconds; + $this->authenticationGuardFixture['timeFrameForAuthenticationLoopInSeconds'] = $timeFrameForAuthenticationLoopInSeconds; + $this->authenticationGuardFixture['maximumAuthenticationProceduresAllowedAll'] = $maximumAuthenticationProceduresAllowedAll; $this->dataStore->save($this->authenticationGuardFixture); } @@ -75,13 +77,14 @@ public function saveAuthenticationLoopGuardConfiguration( public function detectsAuthenticationLoop( Entity $serviceProvider, AuthenticationProcedureMap $pastAuthenticationProcedures - ) { + ): bool { if ($this->authenticationGuardFixture === false) { $authenticationLoopGuard = $this->authenticationLoopGuard; } else { $authenticationLoopGuard = new AuthenticationLoopGuard( $this->authenticationGuardFixture['maximumAuthenticationProceduresAllowed'], - $this->authenticationGuardFixture['timeFrameForAuthenticationLoopInSeconds'] + $this->authenticationGuardFixture['timeFrameForAuthenticationLoopInSeconds'], + $this->authenticationGuardFixture['timeFrameForAuthenticationLoopInSecondsAll'] ); } @@ -96,8 +99,16 @@ public function detectsAuthenticationLoop( ) ); } + + return false; + } + + public function detectsAuthenticationLimit(AuthenticationProcedureMap $pastAuthenticationProcedures): bool + { + return false; } + public function cleanUp() { $this->authenticationGuardFixture = []; diff --git a/theme/base/templates/modules/Authentication/View/Feedback/authentication-limit-exceeded.html.twig b/theme/base/templates/modules/Authentication/View/Feedback/authentication-limit-exceeded.html.twig new file mode 100644 index 0000000000..cbb1c57e93 --- /dev/null +++ b/theme/base/templates/modules/Authentication/View/Feedback/authentication-limit-exceeded.html.twig @@ -0,0 +1,8 @@ +{% extends '@theme/Default/View/Error/error.html.twig' %} + +{% set pageTitle = 'error_authentication_limit_exceeded'|trans %} +{% block pageTitle %}{{ pageTitle }}{% endblock %} +{% block title %}{{ parent() }}{% endblock %} +{% block pageHeading %}{{ pageTitle }}{% endblock %} + +{% block errorMessage %}{{ 'error_authentication_limit_exceeded_desc'|trans }}{% endblock %}