diff --git a/app/Resources/SurfnetStepupBundle/views/Exception/error.html.twig b/app/Resources/SurfnetStepupBundle/views/Exception/error.html.twig index 6a008dd44..a393fb726 100644 --- a/app/Resources/SurfnetStepupBundle/views/Exception/error.html.twig +++ b/app/Resources/SurfnetStepupBundle/views/Exception/error.html.twig @@ -9,6 +9,7 @@ {{ 'ss.error.button.go_home'|trans }}
+

{{ "now"|date('Y-m-d H:i:s') }}

{{ 'ss.error.text.your_art_code'|trans }}: #{{ art }}

{{ 'ss.error.text.what_were_you_doing_well_fix_it'|trans }}

{% endblock %} diff --git a/app/Resources/SurfnetStepupBundle/views/Exception/error404.html.twig b/app/Resources/SurfnetStepupBundle/views/Exception/error404.html.twig index bc13711f8..8a8eb1b85 100644 --- a/app/Resources/SurfnetStepupBundle/views/Exception/error404.html.twig +++ b/app/Resources/SurfnetStepupBundle/views/Exception/error404.html.twig @@ -9,6 +9,7 @@ {{ 'ss.error.button.go_home'|trans }}
+

{{ "now"|date('Y-m-d H:i:s') }}

{{ 'ss.error.text.your_art_code'|trans }}: #{{ art }}

{{ 'ss.error.text.if_you_think_this_is_incorrect_report'|trans }}

{% endblock %} diff --git a/app/Resources/views/base.html.twig b/app/Resources/views/base.html.twig index b7800e196..5deab8a7e 100644 --- a/app/Resources/views/base.html.twig +++ b/app/Resources/views/base.html.twig @@ -27,7 +27,7 @@ {% if app.user %}
-
+ -
+ {% if authenticationFailed is defined %} +
{{ ('ss.registration.gssf.initiate.' ~ provider ~ '.error.authn_failed')|trans }}
+ {% endif %} + {% if proofOfPossessionFailed is defined %} +
{{ ('ss.registration.gssf.initiate.' ~ provider ~ '.error.proof_of_possession_failed')|trans }}
+ {% endif %} + {{ form(form) }} {% endblock %} diff --git a/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Authentication/SessionHandler.php b/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Authentication/SessionHandler.php index 727a24113..d73ef16f7 100644 --- a/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Authentication/SessionHandler.php +++ b/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Authentication/SessionHandler.php @@ -91,4 +91,13 @@ public function clearRequestId() { $this->session->remove(self::SAML_SESSION_KEY . 'request_id'); } + + /** + * Migrates the current session to a new session id while maintaining all + * session attributes. + */ + public function migrate() + { + $this->session->migrate(); + } } diff --git a/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Firewall/SamlListener.php b/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Firewall/SamlListener.php index 04c698c47..cb4653824 100644 --- a/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Firewall/SamlListener.php +++ b/src/Surfnet/StepupSelfService/SelfServiceBundle/Security/Firewall/SamlListener.php @@ -28,6 +28,7 @@ use Surfnet\StepupSelfService\SelfServiceBundle\Security\Authentication\Token\SamlToken; use Symfony\Component\HttpFoundation\RedirectResponse; use Symfony\Component\HttpFoundation\Response; +use Symfony\Component\HttpFoundation\Session\SessionInterface; use Symfony\Component\HttpKernel\Event\GetResponseEvent; use Symfony\Component\Security\Core\Authentication\AuthenticationManagerInterface; use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface; @@ -151,6 +152,9 @@ private function handleEvent(GetResponseEvent $event) $this->tokenStorage->setToken($authToken); + // migrate the session to prevent session hijacking + $this->sessionHandler->migrate(); + $event->setResponse(new RedirectResponse($this->sessionHandler->getCurrentRequestUri())); $logger->notice('Authentication succeeded, redirecting to original location'); diff --git a/src/Surfnet/StepupSelfService/SelfServiceBundle/Service/SecondFactorService.php b/src/Surfnet/StepupSelfService/SelfServiceBundle/Service/SecondFactorService.php index 805048151..f0a18ac87 100644 --- a/src/Surfnet/StepupSelfService/SelfServiceBundle/Service/SecondFactorService.php +++ b/src/Surfnet/StepupSelfService/SelfServiceBundle/Service/SecondFactorService.php @@ -107,6 +107,35 @@ public function doSecondFactorsExistForIdentity($identityId) $vettedSecondFactors->getTotalItems() > 0; } + public function identityHasSecondFactorOfStateWithId($identityId, $state, $secondFactorId) + { + switch ($state) { + case 'unverified': + $secondFactors = $this->findUnverifiedByIdentity($identityId); + break; + case 'verified': + $secondFactors = $this->findVerifiedByIdentity($identityId); + break; + case 'vetted': + $secondFactors = $this->findVettedByIdentity($identityId); + break; + default: + throw new \LogicException(sprintf('Invalid second factor state "%s" given.', $state)); + } + + if (count($secondFactors->getElements()) === 0) { + return false; + } + + foreach ($secondFactors->getElements() as $secondFactor) { + if ($secondFactor->id === $secondFactorId) { + return true; + } + } + + return false; + } + /** * Returns the given registrant's unverified second factors. *