diff --git a/modules/core/dictionaries/short_sso_interval.php b/modules/core/dictionaries/short_sso_interval.php new file mode 100644 index 0000000000000000000000000000000000000000..e0e03a7bc960281786a6aeb092809b8f5d9174cc --- /dev/null +++ b/modules/core/dictionaries/short_sso_interval.php @@ -0,0 +1,17 @@ +<?php + +$lang = array( + 'warning' => array ( + 'en' => 'We have detected that there is only a few seconds since you last authenticated with this service provider, and therefore assume that there is a problem with this SP.', + ), + 'warning_header' => array ( + 'en' => 'To short interval between single sign on events.', + ), + 'retry' => array ( + 'en' => 'Retry login', + ), + +); + + +?> \ No newline at end of file diff --git a/modules/core/lib/Auth/Process/WarnShortSSOInterval.php b/modules/core/lib/Auth/Process/WarnShortSSOInterval.php new file mode 100644 index 0000000000000000000000000000000000000000..70ec41202ac200c811aecf83407a957e25e2b9cd --- /dev/null +++ b/modules/core/lib/Auth/Process/WarnShortSSOInterval.php @@ -0,0 +1,55 @@ +<?php + +/** + * Give a warning to the user if we receive multiple requests in a short time. + * + * @package simpleSAMLphp + * @version $Id$ + */ +class sspmod_core_Auth_Process_WarnShortSSOInterval extends SimpleSAML_Auth_ProcessingFilter { + + /** + * Process a authentication response. + * + * This function checks how long it is since the last time the user was authenticated. + * If it is to short a while since, we will show a warning to the user. + * + * @param array $state The state of the response. + */ + public function process(&$state) { + assert('is_array($state)'); + + if (!array_key_exists('PreviousSSOTimestamp', $state)) { + /* + * No timestamp from the previous SSO to this SP. This is the first + * time during this session. + */ + return; + } + + $timeDelta = time() - $state['PreviousSSOTimestamp']; + if ($timeDelta >= 10) { + /* At least 10 seconds since last attempt. */ + return; + } + + if (array_key_exists('Destination', $state) + && array_key_exists('entityid', $state['Destination'])) { + $entityId = $state['Destination']['entityid']; + } else { + $entityId = 'UNKNOWN'; + } + + SimpleSAML_Logger::warn('WarnShortSSOInterval: Only ' . $timeDelta . + ' seconds since last SSO for this user from the SP ' . + var_export($entityId, TRUE)); + + /* Save state and redirect. */ + $id = SimpleSAML_Auth_State::saveState($state, 'core:short_sso_interval'); + $url = SimpleSAML_Module::getModuleURL('core/short_sso_interval.php'); + SimpleSAML_Utilities::redirect($url, array('StateId' => $id)); + } + +} + +?> \ No newline at end of file diff --git a/modules/core/templates/short_sso_interval.php b/modules/core/templates/short_sso_interval.php new file mode 100644 index 0000000000000000000000000000000000000000..edc540a31ba9597feb7bf1e89f59143ea170c319 --- /dev/null +++ b/modules/core/templates/short_sso_interval.php @@ -0,0 +1,37 @@ +<?php +/** + * Template which is shown when there is only a short interval since the user was last authenticated. + * + * Parameters: + * - 'target': Target URL. + * - 'params': Parameters which should be included in the request. + * + * @package simpleSAMLphp + * @version $Id$ + */ + + +$this->data['header'] = $this->t('{core:short_sso_interval:warning_header}'); +$this->data['autofocus'] = 'contbutton'; + +$this->includeAtTemplateBase('includes/header.php'); +?> +<h1><?php echo $this->data['header']; ?></h1> +<form style="display: inline; margin: 0px; padding: 0px" action="<?php echo htmlspecialchars($this->data['target']); ?>"> + + <?php + // Embed hidden fields... + foreach ($this->data['params'] as $name => $value) { + echo('<input type="hidden" name="' . htmlspecialchars($name) . '" value="' . htmlspecialchars($value) . '" />'); + } + ?> + <p><?php echo $this->t('{core:short_sso_interval:warning}'); ?></p> + + <input type="submit" name="continue" id="contbutton" value="<?php echo htmlspecialchars($this->t('{core:short_sso_interval:retry}')) ?>" /> + +</form> + + +<?php +$this->includeAtTemplateBase('includes/footer.php'); +?> diff --git a/modules/core/www/short_sso_interval.php b/modules/core/www/short_sso_interval.php new file mode 100644 index 0000000000000000000000000000000000000000..5a51470a338ed201d09cadf748498443bacd56e6 --- /dev/null +++ b/modules/core/www/short_sso_interval.php @@ -0,0 +1,29 @@ +<?php +/** + * Show a warning to an user about the SP requesting SSO a short time after + * doing it previously. + * + * @package simpleSAMLphp + * @version $Id$ + */ + +if (!array_key_exists('StateId', $_REQUEST)) { + throw new SimpleSAML_Error_BadRequest('Missing required StateId query parameter.'); +} + +$id = $_REQUEST['StateId']; +$state = SimpleSAML_Auth_State::loadState($id, 'core:short_sso_interval'); + +if (array_key_exists('continue', $_REQUEST)) { + /* The user has pressed the continue/retry-button. */ + SimpleSAML_Auth_ProcessingChain::resumeProcessing($state); +} + +$globalConfig = SimpleSAML_Configuration::getInstance(); +$t = new SimpleSAML_XHTML_Template($globalConfig, 'core:short_sso_interval.php'); +$t->data['target'] = SimpleSAML_Module::getModuleURL('core/short_sso_interval.php'); +$t->data['params'] = array('StateId' => $id); +$t->show(); + + +?> \ No newline at end of file