Auth: Use Auth_State::RESTART to handle session lost events.

This allows all authentication modules which uses the Auth_State class
for saving and restoring the state to handle session lost events.


git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@1287 44740490-163a-0410-bde0-09ae8108e29a

lib/SimpleSAML/Auth/Default.php

@@ -49,8 +49,9 @@ class SimpleSAML_Auth_Default {
 		if (array_key_exists('IdPMetadata', $hints)) {
 			$state['IdPMetadata'] = $hints['IdPMetadata'];
 		}
-		if (array_key_exists('SessionLostURL', $hints)) {
-			$state['SessionLostURL'] = $hints['SessionLostURL'];
+
+		if (array_key_exists(SimpleSAML_Auth_State::RESTART, $hints)) {
+			$state[SimpleSAML_Auth_State::RESTART] = $hints[SimpleSAML_Auth_State::RESTART];
 		}
 
 		$as = SimpleSAML_Auth_Source::getById($authId);

modules/core/lib/Auth/UserPassBase.php

@@ -61,8 +61,6 @@ abstract class sspmod_core_Auth_UserPassBase extends SimpleSAML_Auth_Source {
 
 		$url = SimpleSAML_Module::getModuleURL('core/loginuserpass.php');
 		$params = array('AuthState' => $id);
-		if (array_key_exists('SessionLostURL', $state))
-			$params['SessionLostURL'] = $state['SessionLostURL'];
 		SimpleSAML_Utilities::redirect($url, $params);
 	}
 
@@ -101,17 +99,9 @@ abstract class sspmod_core_Auth_UserPassBase extends SimpleSAML_Auth_Source {
 		assert('is_string($username)');
 		assert('is_string($password)');
 
-		try {
-			/* Retrieve the authentication state. */
-			$state = SimpleSAML_Auth_State::loadState($authStateId, self::STAGEID);
-		} catch(Exception $e) {
-			if (array_key_exists('SessionLostURL', $_REQUEST)) {
-				SimpleSAML_Utilities::redirect($_REQUEST['SessionLostURL']);
-			} else {
-				throw $e;
-			}
-		}
-		
+		/* Retrieve the authentication state. */
+		$state = SimpleSAML_Auth_State::loadState($authStateId, self::STAGEID);
+
 		/* Find authentication source. */
 		assert('array_key_exists(self::AUTHID, $state)');
 		$source = SimpleSAML_Auth_Source::getById($state[self::AUTHID]);

modules/core/templates/loginuserpass.php

@@ -29,14 +29,6 @@ if ($this->data['errorcode'] !== NULL) {
 	<p><?php echo $this->t('{login:user_pass_text}'); ?></p>
 
 	<form action="?" method="post" name="f">
-<?php
-
-if (array_key_exists('SessionLostURL', $this->data)) {
-	echo('<input type="hidden" name="SessionLostURL" value="' . $this->data['SessionLostURL'] . '" />');
-}
-
-
-?>
 	<table>
 		<tr>
 			<td rowspan="2"><img src="/<?php echo $this->data['baseurlpath']; ?>resources/icons/pencil.png" alt="" /></td>

modules/core/www/loginuserpass.php

@@ -15,14 +15,8 @@ if (!array_key_exists('AuthState', $_REQUEST)) {
 }
 $authStateId = $_REQUEST['AuthState'];
 
-try {
-	/* Retrieve the authentication state. */
-	$state = SimpleSAML_Auth_State::loadState($authStateId, sspmod_core_Auth_UserPassBase::STAGEID);
-} catch(Exception $e) {
-	if (array_key_exists('SessionLostURL', $_REQUEST)) {
-		SimpleSAML_Utilities::redirect($_REQUEST['SessionLostURL']);
-	}
-}
+/* Retrieve the authentication state. */
+$state = SimpleSAML_Auth_State::loadState($authStateId, sspmod_core_Auth_UserPassBase::STAGEID);
 
 if (array_key_exists('username', $_REQUEST)) {
 	$username = $_REQUEST['username'];
@@ -48,8 +42,6 @@ $t = new SimpleSAML_XHTML_Template($globalConfig, 'core:loginuserpass.php');
 $t->data['stateparams'] = array('AuthState' => $authStateId);
 $t->data['username'] = $username;
 $t->data['errorcode'] = $errorCode;
-if (array_key_exists('SessionLostURL', $_REQUEST)) 
-	$t->data['SessionLostURL'] = $_REQUEST['SessionLostURL'];
 $t->show();
 exit();
 

www/saml2/idp/SSOService.php

@@ -212,15 +212,22 @@ if($needAuth && !$isPassive) {
 
 	if($authSource) {
 		/* Authenticate with an AuthSource. */
+
+		/* The user will be redirected to this URL if the session is lost. This will cause an
+		 * unsoliced authentication response to be sent to the SP.
+		 */
+		$sessionLostURL = SimpleSAML_Utilities::addURLparameter(
+			$metadata->getGenerated('SingleSignOnService', 'saml20-idp-hosted'),
+			array(
+				'spentityid' => $requestcache['Issuer'],
+			));
+
 		$hints = array(
 			'SPMetadata' => $metadata->getMetaData($requestcache['Issuer'], 'saml20-sp-remote'),
 			'IdPMetadata' => $idpmetadata,
+			SimpleSAML_Auth_State::RESTART => $sessionLostURL,
 		);
-		$hints['SessionLostURL'] = SimpleSAML_Utilities::addURLparameter(
-			$metadata->getGenerated('SingleSignOnService', 'saml20-idp-hosted'), array(
-				'spentityid' => $requestcache['Issuer'],
-			)
-		);
+
 		SimpleSAML_Auth_Default::initLogin($idpmetadata['auth'], $redirectTo, NULL, $hints);
 	} else {
 		$authurl = '/' . $config->getBaseURL() . $idpmetadata['auth'];