diff --git a/composer.json b/composer.json index 21ce11f..73fde25 100644 --- a/composer.json +++ b/composer.json @@ -6,7 +6,7 @@ "authors": [ { "name": "Ralph Schindler", - "email": "ralph_schindler@ziffdavis.com" + "email": "ralph.schindler@ziffmedia.com" } ], "require": { diff --git a/config/onelogin.php b/config/onelogin.php index bf565f7..52f3d06 100644 --- a/config/onelogin.php +++ b/config/onelogin.php @@ -65,7 +65,14 @@ * handler will attempt to redirect to /auth, which the laravel-onelogin package can now handle for you. */ 'autologin' => false, - ] + ], + + /** + * In certain circumstances (such as using cloudflare edge auth), the initial ACS POST request is + * inadvertantly turned into a GET request to the ACS route. Enabling this will make sure that GET + * requests are also redirected back to the onelogin SAML flow + */ + 'enable_acs_redirect_for_get' => false, ], /** diff --git a/src/Controllers/LocalController.php b/src/Controllers/LocalController.php index b7fb4a1..b853f10 100644 --- a/src/Controllers/LocalController.php +++ b/src/Controllers/LocalController.php @@ -3,14 +3,8 @@ namespace ZiffDavis\Laravel\Onelogin\Controllers; use Illuminate\Auth\AuthManager; -use Illuminate\Contracts\Auth\Authenticatable; use Illuminate\Http\Request; use Illuminate\Routing\Controller; -use Illuminate\Support\Facades\Event; -use OneLogin\Saml2\Auth; -use OneLogin\Saml2\Error; -use ZiffDavis\Laravel\Onelogin\Events\OneloginLoginEvent; -use ZiffDavis\Laravel\User\Auth\OneLoginEloquentUserProvider; class LocalController extends Controller { diff --git a/src/Controllers/OneloginController.php b/src/Controllers/OneloginController.php index 1f334e1..8dac942 100644 --- a/src/Controllers/OneloginController.php +++ b/src/Controllers/OneloginController.php @@ -14,7 +14,7 @@ use OneLogin\Saml2\ValidationError; use ZiffDavis\Laravel\Onelogin\Events\OneloginLoginEvent; -class OneLoginController extends Controller +class OneloginController extends Controller { use HasRedirector; @@ -70,6 +70,17 @@ public function login(Request $request) public function acs(Request $request, AuthManager $auth) { + /** + * Support GET requests only when configured to respond, in those cases redirect to onelogin + */ + if ($request->isMethod('GET')) { + abort_if(!config('onelogin.routing.enable_acs_redirect_for_get', false), 405); + + return redirect( + $this->oneLogin->login($this->getRedirectUrl($request), [], false, false, true) + ); + } + try { $this->oneLogin->processResponse(); $error = $this->oneLogin->getLastErrorReason(); diff --git a/src/Middleware/OneloginCsrfDisablerMiddleware.php b/src/Middleware/OneloginCsrfDisablerMiddleware.php index f34717f..9bc3cfc 100644 --- a/src/Middleware/OneloginCsrfDisablerMiddleware.php +++ b/src/Middleware/OneloginCsrfDisablerMiddleware.php @@ -6,10 +6,11 @@ use Illuminate\Contracts\Container\Container; use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken; use Illuminate\Routing\Router; +use Illuminate\Support\Arr; class OneloginCsrfDisablerMiddleware { - /** @var \Illuminate\Routing\Router */ + /** @var Router */ protected $router; protected $container; @@ -35,4 +36,4 @@ public function __invoke($request, \Closure $next) return $next($request); } -} \ No newline at end of file +} diff --git a/src/OneloginServiceProvider.php b/src/OneloginServiceProvider.php index 4ee18e7..49a8eb1 100644 --- a/src/OneloginServiceProvider.php +++ b/src/OneloginServiceProvider.php @@ -2,9 +2,8 @@ namespace ZiffDavis\Laravel\Onelogin; -use Illuminate\Support\Arr; -use Illuminate\Auth\AuthManager; use Illuminate\Routing\Router; +use Illuminate\Support\Arr; use Illuminate\Support\ServiceProvider; use OneLogin\Saml2; @@ -12,7 +11,7 @@ class OneloginServiceProvider extends ServiceProvider { protected $defer = false; - public function boot(AuthManager $auth, Router $router) + public function boot(Router $router) { $configSourcePath = realpath(__DIR__ . '/../config/onelogin.php'); @@ -20,17 +19,18 @@ public function boot(AuthManager $auth, Router $router) $middlewares = Arr::wrap(config('onelogin.routing.middleware')); - $router->group([ + $routeGroupParams = [ 'namespace' => 'ZiffDavis\Laravel\Onelogin\Controllers', 'as' => 'onelogin.', 'prefix' => 'onelogin/', 'middleware' => array_merge(['onelogin'], $middlewares), - ], function () use ($router) { + ]; + + // @todo implement SSO routes at /logout + $router->group($routeGroupParams, function () use ($router) { $router->get('/metadata', 'OneloginController@metadata')->name('metadata'); $router->get('/login', 'OneloginController@login')->name('login'); - // @todo implement SSO - // $router->get('/logout', 'OneloginController@logout')->name('logout'); - $router->post('/acs', 'OneloginController@acs')->name('acs'); + $router->match(['get', 'post'], '/acs', 'OneloginController@acs')->name('acs'); }); if (config('onelogin.routing.root_routes.enable')) {