forked from fa/breadcrumb-the-shire
500 lines
20 KiB
PHP
500 lines
20 KiB
PHP
<?php
|
|
|
|
namespace MintyPHP\Service\Auth;
|
|
|
|
use MintyPHP\Repository\Tenant\TenantMicrosoftAuthRepositoryInterface;
|
|
|
|
class TenantSsoService
|
|
{
|
|
public const PROVIDER_MICROSOFT = 'microsoft';
|
|
|
|
private const PROFILE_SYNC_FIELD_OPTIONS = [
|
|
'first_name' => 'Sync first name',
|
|
'last_name' => 'Sync last name',
|
|
'phone' => 'Sync phone',
|
|
'mobile' => 'Sync mobile',
|
|
'avatar' => 'Sync avatar image',
|
|
];
|
|
|
|
private const DEFAULT_PROFILE_SYNC_FIELDS = ['first_name', 'last_name'];
|
|
|
|
public function __construct(
|
|
private readonly AuthTenantGateway $tenantGateway,
|
|
private readonly TenantMicrosoftAuthRepositoryInterface $tenantMicrosoftAuthRepository,
|
|
private readonly AuthSettingsGateway $settingsGateway,
|
|
private readonly AuthCryptoGateway $cryptoGateway
|
|
) {
|
|
}
|
|
|
|
public function microsoftProviderKey(): string
|
|
{
|
|
return self::PROVIDER_MICROSOFT;
|
|
}
|
|
|
|
public function findTenantByLoginSlug(string $slug): ?array
|
|
{
|
|
$slug = trim(strtolower($slug));
|
|
if ($slug === '') {
|
|
return null;
|
|
}
|
|
|
|
if (preg_match('/^[a-f0-9-]{36}$/', $slug)) {
|
|
$tenant = $this->tenantGateway->findByUuid($slug);
|
|
if ($tenant && (string) ($tenant['status'] ?? 'active') === 'active') {
|
|
return $tenant;
|
|
}
|
|
}
|
|
|
|
$matches = [];
|
|
foreach ($this->tenantGateway->list() as $tenant) {
|
|
if ((string) ($tenant['status'] ?? 'active') !== 'active') {
|
|
continue;
|
|
}
|
|
if ($this->slugify((string) ($tenant['description'] ?? '')) === $slug) {
|
|
$matches[] = $tenant;
|
|
}
|
|
}
|
|
|
|
if (count($matches) !== 1) {
|
|
return null;
|
|
}
|
|
|
|
return $matches[0];
|
|
}
|
|
|
|
public function tenantLoginSlug(array $tenant): string
|
|
{
|
|
$slug = $this->slugify((string) ($tenant['description'] ?? ''));
|
|
if ($slug !== '') {
|
|
return $slug;
|
|
}
|
|
|
|
return strtolower((string) ($tenant['uuid'] ?? ''));
|
|
}
|
|
|
|
public function getTenantMicrosoftAuth(int $tenantId): array
|
|
{
|
|
$row = $this->tenantMicrosoftAuthRepository->findByTenantId($tenantId) ?? [];
|
|
$syncProfileOnLogin = !empty($row['sync_profile_on_login']);
|
|
$syncFields = $this->normalizeProfileSyncFields($row['sync_profile_fields'] ?? []);
|
|
if ($syncProfileOnLogin && !$syncFields) {
|
|
$syncFields = $this->defaultProfileSyncFields();
|
|
}
|
|
|
|
return [
|
|
'enabled' => !empty($row['enabled']),
|
|
'enforce_microsoft_login' => !empty($row['enforce_microsoft_login']),
|
|
'sync_profile_on_login' => $syncProfileOnLogin,
|
|
'sync_profile_fields' => $this->profileSyncFieldsCsv($syncFields),
|
|
'sync_profile_fields_list' => $syncFields,
|
|
'entra_tenant_id' => strtolower(trim((string) ($row['entra_tenant_id'] ?? ''))),
|
|
'allowed_domains' => $this->normalizeDomains((string) ($row['allowed_domains'] ?? '')),
|
|
'use_shared_app' => !array_key_exists('use_shared_app', $row) || !empty($row['use_shared_app']),
|
|
'client_id_override' => trim((string) ($row['client_id_override'] ?? '')),
|
|
'client_secret_override_enc' => trim((string) ($row['client_secret_override_enc'] ?? '')),
|
|
];
|
|
}
|
|
|
|
public function buildMicrosoftUiState(int $tenantId, array $input = []): array
|
|
{
|
|
$existing = $this->getTenantMicrosoftAuth($tenantId);
|
|
$state = $this->normalizeMicrosoftInputState($input, $existing);
|
|
$configState = $this->evaluateMicrosoftConfigState($state);
|
|
|
|
return [
|
|
'enabled' => $state['enabled'],
|
|
'config_complete' => !$state['enabled'] || $configState['complete'],
|
|
'config_error_code' => (string) ($configState['error_code'] ?? ''),
|
|
'config_error_label' => $this->microsoftConfigErrorLabel((string) ($configState['error_code'] ?? '')),
|
|
'password_mode' => $state['enabled'] && $state['enforce_microsoft_login']
|
|
? 'microsoft_only'
|
|
: 'local_and_microsoft',
|
|
'credential_source' => $state['use_shared_app'] ? 'shared' : 'override',
|
|
'sync_needs_graph' => $state['sync_profile_on_login']
|
|
&& $this->profileSyncFieldsRequireGraph($state['sync_profile_fields']),
|
|
];
|
|
}
|
|
|
|
public function isLocalPasswordLoginAllowed(int $tenantId): bool
|
|
{
|
|
$auth = $this->getTenantMicrosoftAuth($tenantId);
|
|
if (!$auth['enabled']) {
|
|
return true;
|
|
}
|
|
|
|
return !$auth['enforce_microsoft_login'];
|
|
}
|
|
|
|
public function resolveTenantLoginMethods(int $tenantId): array
|
|
{
|
|
$tenant = $this->tenantGateway->findById($tenantId);
|
|
if (!$tenant || (string) ($tenant['status'] ?? 'active') !== 'active') {
|
|
return [
|
|
'local' => false,
|
|
'microsoft' => false,
|
|
'microsoft_reason' => 'tenant_not_found',
|
|
];
|
|
}
|
|
|
|
$configResult = $this->getEffectiveMicrosoftProviderConfig($tenant);
|
|
|
|
return [
|
|
'local' => $this->isLocalPasswordLoginAllowed($tenantId),
|
|
'microsoft' => !empty($configResult['ok']),
|
|
'microsoft_reason' => $configResult['ok'] ?? false
|
|
? ''
|
|
: (string) ($configResult['error'] ?? 'sso_disabled'),
|
|
];
|
|
}
|
|
|
|
public function getEffectiveMicrosoftProviderConfig(array $tenant): array
|
|
{
|
|
$tenantId = (int) ($tenant['id'] ?? 0);
|
|
if ($tenantId <= 0) {
|
|
return ['ok' => false, 'error' => 'tenant_not_found'];
|
|
}
|
|
|
|
$auth = $this->getTenantMicrosoftAuth($tenantId);
|
|
if (!$auth['enabled']) {
|
|
return ['ok' => false, 'error' => 'sso_disabled'];
|
|
}
|
|
|
|
$entraTenantId = $auth['entra_tenant_id'];
|
|
if (!preg_match('/^[a-f0-9-]{36}$/', $entraTenantId)) {
|
|
return ['ok' => false, 'error' => 'tenant_id_invalid'];
|
|
}
|
|
|
|
$useSharedApp = $auth['use_shared_app'];
|
|
$clientId = '';
|
|
$clientSecret = '';
|
|
|
|
if ($useSharedApp) {
|
|
$clientId = $this->settingsGateway->getMicrosoftSharedClientId();
|
|
$clientSecret = $this->settingsGateway->getMicrosoftSharedClientSecret();
|
|
if (trim($clientId) === '' || trim($clientSecret) === '') {
|
|
return ['ok' => false, 'error' => 'shared_credentials_missing'];
|
|
}
|
|
} else {
|
|
$clientId = (string) $auth['client_id_override'];
|
|
if (trim($clientId) === '') {
|
|
return ['ok' => false, 'error' => 'client_id_override_required'];
|
|
}
|
|
if ($auth['client_secret_override_enc'] === '') {
|
|
return ['ok' => false, 'error' => 'client_secret_override_required'];
|
|
}
|
|
if ($auth['client_secret_override_enc'] !== '') {
|
|
try {
|
|
$clientSecret = $this->cryptoGateway->decryptString($auth['client_secret_override_enc']);
|
|
} catch (\Throwable $exception) {
|
|
return ['ok' => false, 'error' => 'secret_invalid'];
|
|
}
|
|
}
|
|
if (trim($clientSecret) === '') {
|
|
return ['ok' => false, 'error' => 'client_secret_override_required'];
|
|
}
|
|
}
|
|
|
|
$clientId = trim($clientId);
|
|
$clientSecret = trim($clientSecret);
|
|
|
|
return [
|
|
'ok' => true,
|
|
'config' => [
|
|
'provider' => self::PROVIDER_MICROSOFT,
|
|
'tenant_id' => $entraTenantId,
|
|
'client_id' => $clientId,
|
|
'client_secret' => $clientSecret,
|
|
'allowed_domains' => $auth['allowed_domains'],
|
|
'enforce_microsoft_login' => $auth['enforce_microsoft_login'],
|
|
'sync_profile_on_login' => $auth['sync_profile_on_login'],
|
|
'sync_profile_fields' => $auth['sync_profile_fields_list'],
|
|
'sync_profile_needs_graph' => $auth['sync_profile_on_login']
|
|
&& $this->profileSyncFieldsRequireGraph($auth['sync_profile_fields_list']),
|
|
'authority' => $this->settingsGateway->getMicrosoftAuthority(),
|
|
'use_shared_app' => $useSharedApp,
|
|
],
|
|
];
|
|
}
|
|
|
|
public function saveTenantMicrosoftAuth(int $tenantId, array $input): array
|
|
{
|
|
$tenant = $this->tenantGateway->findById($tenantId);
|
|
if (!$tenant) {
|
|
return ['ok' => false, 'errors' => [t('Tenant not found')]];
|
|
}
|
|
|
|
$enabled = !empty($input['microsoft_enabled']);
|
|
$enforce = !empty($input['enforce_microsoft_login']);
|
|
$entraTenantId = strtolower(trim((string) ($input['entra_tenant_id'] ?? '')));
|
|
$allowedDomains = $this->normalizeDomains((string) ($input['allowed_domains'] ?? ''));
|
|
$syncProfileOnLogin = !empty($input['sync_profile_on_login']);
|
|
$syncProfileFields = $this->normalizeProfileSyncFields($input['sync_profile_fields'] ?? []);
|
|
if ($syncProfileOnLogin && !$syncProfileFields) {
|
|
$syncProfileFields = $this->defaultProfileSyncFields();
|
|
}
|
|
$syncProfileFieldsCsv = $this->profileSyncFieldsCsv($syncProfileFields);
|
|
$useSharedApp = !empty($input['use_shared_app']);
|
|
$clientIdOverride = trim((string) ($input['client_id_override'] ?? ''));
|
|
$clientSecretOverride = trim((string) ($input['client_secret_override'] ?? ''));
|
|
$clearSecret = !empty($input['clear_client_secret_override']);
|
|
|
|
$errors = [];
|
|
|
|
$existing = $this->getTenantMicrosoftAuth($tenantId);
|
|
$clientSecretOverrideEnc = (string) ($existing['client_secret_override_enc'] ?? '');
|
|
if ($clearSecret) {
|
|
$clientSecretOverrideEnc = '';
|
|
} elseif ($clientSecretOverride !== '') {
|
|
if (!$this->cryptoGateway->isConfigured()) {
|
|
$errors[] = t('APP_CRYPTO_KEY is missing or invalid');
|
|
} else {
|
|
try {
|
|
$clientSecretOverrideEnc = $this->cryptoGateway->encryptString($clientSecretOverride);
|
|
} catch (\Throwable $exception) {
|
|
$errors[] = t('Client secret could not be encrypted');
|
|
}
|
|
}
|
|
}
|
|
|
|
$stateForValidation = [
|
|
'enabled' => $enabled,
|
|
'enforce_microsoft_login' => $enforce,
|
|
'sync_profile_on_login' => $syncProfileOnLogin,
|
|
'sync_profile_fields' => $syncProfileFields,
|
|
'entra_tenant_id' => $entraTenantId,
|
|
'use_shared_app' => $useSharedApp,
|
|
'client_id_override' => $clientIdOverride,
|
|
'client_secret_override_enc' => $clientSecretOverrideEnc,
|
|
];
|
|
$configState = $this->evaluateMicrosoftConfigState($stateForValidation);
|
|
if ($enabled && !($configState['complete'] ?? false)) {
|
|
$label = $this->microsoftConfigErrorLabel((string) ($configState['error_code'] ?? ''));
|
|
if ($label !== '') {
|
|
$errors[] = $label;
|
|
}
|
|
}
|
|
if ($enabled && $enforce && !($configState['complete'] ?? false)) {
|
|
$errors[] = t('Microsoft-only login requires a complete configuration');
|
|
}
|
|
|
|
if ($errors) {
|
|
return ['ok' => false, 'errors' => $errors];
|
|
}
|
|
|
|
$saved = $this->tenantMicrosoftAuthRepository->upsertByTenantId($tenantId, [
|
|
'enabled' => $enabled,
|
|
'enforce_microsoft_login' => $enabled ? $enforce : false,
|
|
'sync_profile_on_login' => $enabled ? $syncProfileOnLogin : false,
|
|
'sync_profile_fields' => $syncProfileFieldsCsv !== '' ? $syncProfileFieldsCsv : null,
|
|
'entra_tenant_id' => $enabled ? $entraTenantId : null,
|
|
'allowed_domains' => $allowedDomains === '' ? null : $allowedDomains,
|
|
'use_shared_app' => $useSharedApp,
|
|
'client_id_override' => $useSharedApp ? null : ($clientIdOverride !== '' ? $clientIdOverride : null),
|
|
'client_secret_override_enc' => $useSharedApp ? null : ($clientSecretOverrideEnc !== '' ? $clientSecretOverrideEnc : null),
|
|
]);
|
|
|
|
if (!$saved) {
|
|
return ['ok' => false, 'errors' => [t('Tenant SSO settings could not be saved')]];
|
|
}
|
|
|
|
return ['ok' => true];
|
|
}
|
|
|
|
public function isEmailDomainAllowed(string $email, array $allowedDomains): bool
|
|
{
|
|
$allowedDomains = array_values(array_filter(array_map(
|
|
static fn ($domain): string => strtolower(trim((string) $domain)),
|
|
$allowedDomains
|
|
), static fn (string $domain): bool => $domain !== ''));
|
|
|
|
if (!$allowedDomains) {
|
|
return true;
|
|
}
|
|
|
|
$parts = explode('@', strtolower(trim($email)));
|
|
if (count($parts) !== 2) {
|
|
return false;
|
|
}
|
|
|
|
return in_array($parts[1], $allowedDomains, true);
|
|
}
|
|
|
|
public function profileSyncFieldOptions(): array
|
|
{
|
|
return self::PROFILE_SYNC_FIELD_OPTIONS;
|
|
}
|
|
|
|
public function defaultProfileSyncFields(): array
|
|
{
|
|
return self::DEFAULT_PROFILE_SYNC_FIELDS;
|
|
}
|
|
|
|
public function normalizeProfileSyncFields($raw): array
|
|
{
|
|
if (is_string($raw)) {
|
|
$raw = preg_split('/[\s,;]+/', $raw) ?: [];
|
|
} elseif (!is_array($raw)) {
|
|
return [];
|
|
}
|
|
|
|
$allowed = array_fill_keys(array_keys(self::PROFILE_SYNC_FIELD_OPTIONS), true);
|
|
$normalized = [];
|
|
foreach ($raw as $item) {
|
|
$key = strtolower(trim((string) $item));
|
|
if ($key === '' || !isset($allowed[$key])) {
|
|
continue;
|
|
}
|
|
$normalized[$key] = true;
|
|
}
|
|
|
|
return array_keys($normalized);
|
|
}
|
|
|
|
public function profileSyncFieldsCsv(array $fields): string
|
|
{
|
|
$fields = $this->normalizeProfileSyncFields($fields);
|
|
return implode(',', $fields);
|
|
}
|
|
|
|
public function profileSyncFieldsRequireGraph(array $fields): bool
|
|
{
|
|
$fields = $this->normalizeProfileSyncFields($fields);
|
|
return in_array('phone', $fields, true)
|
|
|| in_array('mobile', $fields, true)
|
|
|| in_array('avatar', $fields, true);
|
|
}
|
|
|
|
private function normalizeDomains(string $raw): string
|
|
{
|
|
$parts = preg_split('/[,\n;\r]+/', $raw) ?: [];
|
|
$domains = [];
|
|
foreach ($parts as $part) {
|
|
$domain = strtolower(trim($part));
|
|
$domain = preg_replace('/^@+/', '', $domain);
|
|
if ($domain === '') {
|
|
continue;
|
|
}
|
|
if (!preg_match('/^[a-z0-9.-]+\.[a-z]{2,}$/i', $domain)) {
|
|
continue;
|
|
}
|
|
$domains[] = $domain;
|
|
}
|
|
$domains = array_values(array_unique($domains));
|
|
return implode(',', $domains);
|
|
}
|
|
|
|
private function normalizeMicrosoftInputState(array $input, array $existing): array
|
|
{
|
|
$enabled = array_key_exists('microsoft_enabled', $input)
|
|
? !empty($input['microsoft_enabled'])
|
|
: !empty($existing['enabled']);
|
|
$enforce = array_key_exists('enforce_microsoft_login', $input)
|
|
? !empty($input['enforce_microsoft_login'])
|
|
: !empty($existing['enforce_microsoft_login']);
|
|
$syncProfileOnLogin = array_key_exists('sync_profile_on_login', $input)
|
|
? !empty($input['sync_profile_on_login'])
|
|
: !empty($existing['sync_profile_on_login']);
|
|
$syncProfileFields = array_key_exists('sync_profile_fields', $input)
|
|
? $this->normalizeProfileSyncFields($input['sync_profile_fields'] ?? [])
|
|
: $this->normalizeProfileSyncFields($existing['sync_profile_fields_list'] ?? []);
|
|
if ($syncProfileOnLogin && !$syncProfileFields) {
|
|
$syncProfileFields = $this->defaultProfileSyncFields();
|
|
}
|
|
|
|
$entraTenantId = array_key_exists('entra_tenant_id', $input)
|
|
? strtolower(trim((string) ($input['entra_tenant_id'] ?? '')))
|
|
: strtolower(trim((string) ($existing['entra_tenant_id'] ?? '')));
|
|
$useSharedApp = array_key_exists('use_shared_app', $input)
|
|
? !empty($input['use_shared_app'])
|
|
: !empty($existing['use_shared_app']);
|
|
$clientIdOverride = array_key_exists('client_id_override', $input)
|
|
? trim((string) ($input['client_id_override'] ?? ''))
|
|
: trim((string) ($existing['client_id_override'] ?? ''));
|
|
|
|
$clientSecretOverrideEnc = trim((string) ($existing['client_secret_override_enc'] ?? ''));
|
|
if (array_key_exists('clear_client_secret_override', $input) && !empty($input['clear_client_secret_override'])) {
|
|
$clientSecretOverrideEnc = '';
|
|
} elseif (trim((string) ($input['client_secret_override'] ?? '')) !== '') {
|
|
// For UI status, a newly typed secret is considered present before persisting.
|
|
$clientSecretOverrideEnc = '__pending_secret__';
|
|
}
|
|
|
|
return [
|
|
'enabled' => $enabled,
|
|
'enforce_microsoft_login' => $enforce,
|
|
'sync_profile_on_login' => $syncProfileOnLogin,
|
|
'sync_profile_fields' => $syncProfileFields,
|
|
'entra_tenant_id' => $entraTenantId,
|
|
'use_shared_app' => $useSharedApp,
|
|
'client_id_override' => $clientIdOverride,
|
|
'client_secret_override_enc' => $clientSecretOverrideEnc,
|
|
];
|
|
}
|
|
|
|
private function evaluateMicrosoftConfigState(array $state): array
|
|
{
|
|
if (empty($state['enabled'])) {
|
|
return ['complete' => true, 'error_code' => ''];
|
|
}
|
|
|
|
$entraTenantId = strtolower(trim((string) ($state['entra_tenant_id'] ?? '')));
|
|
if (!preg_match('/^[a-f0-9-]{36}$/', $entraTenantId)) {
|
|
return ['complete' => false, 'error_code' => 'tenant_id_invalid'];
|
|
}
|
|
|
|
if (!empty($state['use_shared_app'])) {
|
|
$sharedClientId = trim($this->settingsGateway->getMicrosoftSharedClientId());
|
|
$sharedClientSecret = trim($this->settingsGateway->getMicrosoftSharedClientSecret());
|
|
if ($sharedClientId === '' || $sharedClientSecret === '') {
|
|
return ['complete' => false, 'error_code' => 'shared_credentials_missing'];
|
|
}
|
|
return ['complete' => true, 'error_code' => ''];
|
|
}
|
|
|
|
$clientIdOverride = trim((string) ($state['client_id_override'] ?? ''));
|
|
if ($clientIdOverride === '') {
|
|
return ['complete' => false, 'error_code' => 'client_id_override_required'];
|
|
}
|
|
|
|
$secretEnc = trim((string) ($state['client_secret_override_enc'] ?? ''));
|
|
if ($secretEnc === '') {
|
|
return ['complete' => false, 'error_code' => 'client_secret_override_required'];
|
|
}
|
|
if ($secretEnc !== '__pending_secret__') {
|
|
try {
|
|
$secret = trim($this->cryptoGateway->decryptString($secretEnc));
|
|
} catch (\Throwable $exception) {
|
|
return ['complete' => false, 'error_code' => 'secret_invalid'];
|
|
}
|
|
if ($secret === '') {
|
|
return ['complete' => false, 'error_code' => 'client_secret_override_required'];
|
|
}
|
|
}
|
|
|
|
return ['complete' => true, 'error_code' => ''];
|
|
}
|
|
|
|
private function microsoftConfigErrorLabel(string $errorCode): string
|
|
{
|
|
return match ($errorCode) {
|
|
'tenant_id_invalid' => t('Entra tenant ID is invalid'),
|
|
'shared_credentials_missing' => t('Shared credentials missing'),
|
|
'client_id_override_required' => t('Client ID override is required'),
|
|
'client_secret_override_required' => t('Client secret override is required'),
|
|
'secret_invalid' => t('Client secret override is invalid'),
|
|
'client_credentials_missing' => t('Client credentials are missing'),
|
|
default => '',
|
|
};
|
|
}
|
|
|
|
private function slugify(string $value): string
|
|
{
|
|
$value = strtolower(trim($value));
|
|
if ($value === '') {
|
|
return '';
|
|
}
|
|
$value = preg_replace('/[^a-z0-9]+/', '-', $value) ?? '';
|
|
return trim($value, '-');
|
|
}
|
|
}
|