Fixes on social and eduGAIN login (d3b51020) · Commits · IA2 / RAP

classes/login/FacebookLogin.php

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -23,7 +23,7 @@ class FacebookLogin extends LoginHandler {

	$permissions = ['email']; // Optional permissions: we need user email		$permissions = ['email']; // Optional permissions: we need user email

	$loginUrl = $helper->getLoginUrl($Facebook->callback, $permissions);		$loginUrl = $helper->getLoginUrl($this->locator->getBasePath() . $Facebook->callback, $permissions);

	return $loginUrl;		return $loginUrl;
	}		}

classes/login/LinkedInLogin.php

+40 −10

Original line number	Original line	Diff line number	Diff line
	@@ -5,7 +5,7 @@ namespace RAP;
	class LinkedInLogin extends LoginHandler {		class LinkedInLogin extends LoginHandler {

	public function __construct(Locator $locator) {		public function __construct(Locator $locator) {
	parent::__construct($locator, Identity::FACEBOOK);		parent::__construct($locator, Identity::LINKEDIN);
	}		}

	public function login(): string {		public function login(): string {
	@@ -14,9 +14,9 @@ class LinkedInLogin extends LoginHandler {

	$url = "https://www.linkedin.com/oauth/v2/authorization?response_type=code";		$url = "https://www.linkedin.com/oauth/v2/authorization?response_type=code";
	$url .= "&client_id=" . $LinkedIn->id;		$url .= "&client_id=" . $LinkedIn->id;
	$url .= "&redirect_uri=" . $LinkedIn->callback;		$url .= "&redirect_uri=" . $this->locator->getBasePath() . $LinkedIn->callback;
	$url .= "&state=789654123";		$url .= "&state=" . bin2hex(random_bytes(5));
	$url .= "&scope=r_basicprofile r_emailaddress";		$url .= "&scope=r_liteprofile%20r_emailaddress%20w_member_social";

	return $url;		return $url;
	}		}
	@@ -33,7 +33,7 @@ class LinkedInLogin extends LoginHandler {
	$post_data = array(		$post_data = array(
	'grant_type' => "authorization_code",		'grant_type' => "authorization_code",
	'code' => $_REQUEST['code'],		'code' => $_REQUEST['code'],
	'redirect_uri' => $LinkedIn->callback,		'redirect_uri' => $this->locator->getBasePath() . $LinkedIn->callback,
	'client_id' => $LinkedIn->id,		'client_id' => $LinkedIn->id,
	'client_secret' => $LinkedIn->secret		'client_secret' => $LinkedIn->secret
	);		);
	@@ -71,6 +71,7 @@ class LinkedInLogin extends LoginHandler {
	//show information regarding the error		//show information regarding the error
	$errorMessage = "Error: LinkedIn server response code: " . $info1['http_code'] . " - ";		$errorMessage = "Error: LinkedIn server response code: " . $info1['http_code'] . " - ";
	$errorMessage .= curl_error($conn1);		$errorMessage .= curl_error($conn1);
			error_log($result1);
	curl_close($conn1);		curl_close($conn1);
	http_response_code(500);		http_response_code(500);
	die($errorMessage);		die($errorMessage);
	@@ -78,7 +79,7 @@ class LinkedInLogin extends LoginHandler {

	// Call to API		// Call to API
	$conn2 = curl_init();		$conn2 = curl_init();
	curl_setopt($conn2, CURLOPT_URL, "https://api.linkedin.com/v1/people/~:(first-name,last-name,email-address,id)?format=json");		curl_setopt($conn2, CURLOPT_URL, "https://api.linkedin.com/v2/me");
	curl_setopt($conn2, CURLOPT_HTTPHEADER, array(		curl_setopt($conn2, CURLOPT_HTTPHEADER, array(
	'Authorization: Bearer ' . $access_token		'Authorization: Bearer ' . $access_token
	));		));
	@@ -99,15 +100,44 @@ class LinkedInLogin extends LoginHandler {

	$typedId = $data['id'];		$typedId = $data['id'];

	return $this->onIdentityDataReceived($typedId, function($identity) use($data) {		// Recall to API for email
	$identity->email = $data['emailAddress'];		$conn2 = curl_init();
	$identity->name = $data['firstName'];		curl_setopt($conn2, CURLOPT_URL, "https://api.linkedin.com/v2/emailAddress?q=members&projection=(elements*(handle~))");
	$identity->surname = $data['lastName'];		curl_setopt($conn2, CURLOPT_HTTPHEADER, array(
			'Authorization: Bearer ' . $access_token
			));

			curl_setopt($conn2, CURLOPT_RETURNTRANSFER, true);
			$result = curl_exec($conn2);
			$info2 = curl_getinfo($conn2);

			if ($info2['http_code'] === 200) {
			$data2 = json_decode($result, TRUE);

			curl_close($conn2);

			if (isset($data['errorCode'])) {
			$errorMessage = $data['message'];
			die($errorMessage);
			}
			} else {
			//show information regarding the error
			$errorMessage = "Error: LinkedIn server response code: " . $info2['http_code'] . " - ";
			$errorMessage = $errorMessage . curl_error($conn2);
			curl_close($conn2);
			die($errorMessage);
			}

			return $this->onIdentityDataReceived($typedId, function($identity) use($data, $data2) {
			$identity->email = $data2['elements'][0]['handle~']['emailAddress'];
			$identity->name = $data['localizedFirstName'];
			$identity->surname = $data['localizedLastName'];
	});		});
	} else {		} else {
	//show information regarding the error		//show information regarding the error
	$errorMessage = "Error: LinkedIn server response code: " . $info2['http_code'] . " - ";		$errorMessage = "Error: LinkedIn server response code: " . $info2['http_code'] . " - ";
	$errorMessage = $errorMessage . curl_error($conn2);		$errorMessage = $errorMessage . curl_error($conn2);
			error_log($result);
	curl_close($conn2);		curl_close($conn2);
	die($errorMessage);		die($errorMessage);
	}		}

classes/login/ShibbolethLogin.php

+13 −6

Original line number	Original line	Diff line number	Diff line
	@@ -9,20 +9,27 @@ class ShibbolethLogin extends LoginHandler {
	}		}

	public function login() {		public function login() {
	if (isset($_SERVER['Shib-Session-ID'])) {
			$prefix = '';

			if (isset($_SERVER['Shib-Session-ID']) \|\| $redirect = isset($_SERVER['REDIRECT_Shib-Session-ID'])) {

			if (isset($_SERVER['REDIRECT_Shib-Session-ID'])) {
			$prefix = 'REDIRECT_';
			}

	// Retrieving eduPersonPrincipalName (eppn)		// Retrieving eduPersonPrincipalName (eppn)
	$eppn = $_SERVER['eppn'];		$eppn = $_SERVER[$prefix . 'eppn'];

	// Search if the user is already registered into RAP using the eppn.		// Search if the user is already registered into RAP using the eppn.
	// The persistent id should be a more appropriate identifier, however at IA2		// The persistent id should be a more appropriate identifier, however at IA2
	// we need to import all INAF user into RAP, even if they will never register,		// we need to import all INAF user into RAP, even if they will never register,
	// and in that case we know only their eppn.		// and in that case we know only their eppn.

	$this->onIdentityDataReceived($eppn, function($identity) use($eppn) {		return $this->onIdentityDataReceived($eppn, function($identity) use($eppn, $prefix) {
	$identity->email = $_SERVER['mail'];		$identity->email = $_SERVER[$prefix . 'mail'];
	$identity->name = $_SERVER['givenName'];		$identity->name = $_SERVER[$prefix . 'givenName'];
	$identity->surname = $_SERVER['sn'];		$identity->surname = $_SERVER[$prefix . 'sn'];
	$identity->eppn = $eppn;		$identity->eppn = $eppn;
	});		});
	} else {		} else {

config-example.json

+3 −3

Original line number	Original line	Diff line number	Diff line
	@@ -24,12 +24,12 @@
	"id": "XXXXXX",		"id": "XXXXXX",
	"secret": "XXXXXX",		"secret": "XXXXXX",
	"version": "v3.0",		"version": "v3.0",
	"callback": "/auth/social/facebook_token.php"		"callback": "/auth/social/facebook/token"
	},		},
	"LinkedIn": {		"LinkedIn": {
	"id": "XXXXXX",		"id": "XXXXXX",
	"secret": "XXXXXX",		"secret": "XXXXXX",
	"callback": "/auth/social/linkedin_token.php"		"callback": "/auth/social/linkedin/token"
	},		},
	"X.509": {},		"X.509": {},
	"LocalIdP": {		"LocalIdP": {
	@@ -49,4 +49,4 @@
	"clientId": "rap",		"clientId": "rap",
	"clientSecret": "rap-secret"		"clientSecret": "rap-secret"
	}		}
	}		}
	No newline at end of file

include/front-controller.php

+1 −1

Original line number	Original line	Diff line number	Diff line
	@@ -220,7 +220,7 @@ Flight::route('/auth/eduGAIN', function() {
	session_start();		session_start();
	global $locator;		global $locator;
	$shibbolethLogin = new \RAP\ShibbolethLogin($locator);		$shibbolethLogin = new \RAP\ShibbolethLogin($locator);
	$shibbolethLogin->login();		Flight::redirect($shibbolethLogin->login());
	});		});

	Flight::route('/auth/x509', function() {		Flight::route('/auth/x509', function() {