Merge #17 Fix backchannel logout for Telekom and keep backward compatibility V31

Author: memurats

lib/Controller/LoginController.php

@@ -163,12 +163,26 @@ public function login(int $providerId, ?string $redirectUrl = null) {
 			return $this->buildErrorTemplateResponse($message, Http::STATUS_NOT_FOUND, ['reason' => 'provider unreachable']);
 		}
 
-		$state = $this->random->generate(32, ISecureRandom::CHAR_DIGITS . ISecureRandom::CHAR_UPPER);
-		$this->session->set(self::STATE, $state);
-		$this->session->set(self::REDIRECT_AFTER_LOGIN, $redirectUrl);
+		// $state = $this->random->generate(32, ISecureRandom::CHAR_DIGITS . ISecureRandom::CHAR_UPPER);
+		// $this->session->set(self::STATE, $state);
+		// $this->session->set(self::REDIRECT_AFTER_LOGIN, $redirectUrl);
 
-		$nonce = $this->random->generate(32, ISecureRandom::CHAR_DIGITS . ISecureRandom::CHAR_UPPER);
-		$this->session->set(self::NONCE, $nonce);
+		// $nonce = $this->random->generate(32, ISecureRandom::CHAR_DIGITS . ISecureRandom::CHAR_UPPER);
+		// $this->session->set(self::NONCE, $nonce);
+
+		// check if oidc state is present in session data
+		if ($this->session->exists(self::STATE)) {
+			$state = $this->session->get(self::STATE);
+			$nonce = $this->session->get(self::NONCE);
+		} else {
+			$state = $this->random->generate(32, ISecureRandom::CHAR_DIGITS . ISecureRandom::CHAR_UPPER);
+			$this->session->set(self::STATE, $state);
+			$this->session->set(self::REDIRECT_AFTER_LOGIN, $redirectUrl);
+
+			$nonce = $this->random->generate(32, ISecureRandom::CHAR_DIGITS . ISecureRandom::CHAR_UPPER);
+			$this->session->set(self::NONCE, $nonce);
+			$this->session->set(self::PROVIDERID, $providerId);
+		}
 
 		$oidcSystemConfig = $this->config->getSystemValue('user_oidc', []);
 		$isPkceSupported = in_array('S256', $discovery['code_challenge_methods_supported'] ?? [], true);
@@ -180,7 +194,7 @@ public function login(int $providerId, ?string $redirectUrl = null) {
 			$this->session->set(self::CODE_VERIFIER, $code_verifier);
 		}
 
-		$this->session->set(self::PROVIDERID, $providerId);
+		// $this->session->set(self::PROVIDERID, $providerId);
 		$this->session->close();
 
 		// get attribute mapping settings
@@ -517,14 +531,19 @@ public function code(string $state = '', string $code = '', string $scope = '',
 			$this->userSession->createRememberMeToken($user);
 		}
 
+		// remove code login session values
+		$this->session->remove(self::STATE);
+		$this->session->remove(self::NONCE);
+
 		// Set last password confirm to the future as we don't have passwords to confirm against with SSO
 		$this->session->set('last-password-confirm', strtotime('+4 year', time()));
 
 		// for backchannel logout
 		try {
 			$authToken = $this->authTokenProvider->getToken($this->session->getId());
 			$this->sessionMapper->createSession(
-				$idTokenPayload->sid ?? 'fallback-sid',
+				//$idTokenPayload->sid ?? 'fallback-sid',
+				$idTokenPayload->{'urn:telekom.com:session_token'} ?? 'fallback-sid',
 				$idTokenPayload->sub ?? 'fallback-sub',
 				$idTokenPayload->iss ?? 'fallback-iss',
 				$authToken->getId(),
@@ -599,7 +618,9 @@ public function singleLogoutService() {
 		}
 
 		// cleanup related oidc session
-		$this->sessionMapper->deleteFromNcSessionId($this->session->getId());
+		// it is not a good idea to remove the session early as some IDM send a backchannel logout also to the initiating system.
+		// This will falsely fail if already deleted. So rely always on backchannel cleanup or make this an option?
+		// $this->sessionMapper->deleteFromNcSessionId($this->session->getId());
 
 		$this->userSession->logout();
 
@@ -687,7 +708,9 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 		}
 
 		$sub = $logoutTokenPayload->sub;
-		if ($oidcSession->getSub() !== $sub) {
+		// if ($oidcSession->getSub() !== $sub) {
+		// handle sub only if it is available; session is enough to identify a logout
+		if (isset($logoutTokenPayload->sub) && ($oidcSession->getSub() !== $sub)) {
 			return $this->getBackchannelLogoutErrorResponse(
 				'invalid SUB',
 				'The sub does not match the one from the login ID token',
@@ -712,17 +735,19 @@ public function backChannelLogout(string $providerIdentifier, string $logout_tok
 			$userId = $authToken->getUID();
 			$this->authTokenProvider->invalidateTokenById($userId, $authToken->getId());
 		} catch (InvalidTokenException $e) {
-			return $this->getBackchannelLogoutErrorResponse(
-				'nc session not found',
-				'The authentication session was not found in Nextcloud',
-				['nc_auth_session_not_found' => $authTokenId]
-			);
+			// it is not a problem if the auth token is already deleted, so no error
+			// return $this->getBackchannelLogoutErrorResponse(
+			// 'nc session not found',
+			// 'The authentication session was not found in Nextcloud',
+			// ['nc_auth_session_not_found' => $authTokenId]
+			// );
 		}
 
 		// cleanup
 		$this->sessionMapper->delete($oidcSession);
 
-		return new JSONResponse([], Http::STATUS_OK);
+		// return new JSONResponse([], Http::STATUS_OK);
+		return new JSONResponse();
 	}
 
 	/**
@@ -756,4 +781,20 @@ private function toCodeChallenge(string $data): string {
 		$s = str_replace('/', '_', $s); // 63rd char of encoding
 		return $s;
 	}
+
+	/**
+	 * Backward compatible function for MagentaCLOUD to smoothly transition to new config
+	 *
+	 * @PublicPage
+	 * @NoCSRFRequired
+	 * @BruteForceProtection(action=userOidcBackchannelLogout)
+	 *
+	 * @param string $logout_token
+	 * @return JSONResponse
+	 * @throws Exception
+	 * @throws \JsonException
+	 */
+	public function telekomBackChannelLogout(string $logout_token = '') {
+		return $this->backChannelLogout('Telekom', $logout_token);
+	}
 }