diff --git a/.env b/.env index 0f00f8c..9d208c7 100644 --- a/.env +++ b/.env @@ -74,4 +74,6 @@ AWS_ENDPOINT=https://s3.amazonaws.com AWS_S3_PORTAL_URL=https://s3.amazonaws.com/portal ###< aws/aws-sdk-php-symfony ### APP_URL='https://example.com' -APP_DOMAIN='example.com' \ No newline at end of file +APP_DOMAIN='example.com' + +EASYCHECK_URL='https://check.solutions-easy.com' \ No newline at end of file diff --git a/config/services.yaml b/config/services.yaml index e00450e..4744596 100644 --- a/config/services.yaml +++ b/config/services.yaml @@ -13,6 +13,7 @@ parameters: logos_directory: '%kernel.project_dir%/public/uploads/logos' oauth_sso_identifier: '%env(OAUTH_SSO_IDENTIFIER)%' oauth_sso_identifier_login: '%env(OAUTH_SSO_IDENTIFIER_LOGIN)%' + easycheck_url: '%env(EASYCHECK_URL)%' services: # default configuration for services in *this* file @@ -61,5 +62,7 @@ services: # please note that last definitions always *replace* previous ones App\EventListener\LogoutSubscriber: + arguments: + $easycheckUrl: '%env(EASYCHECK_URL)%' tags: - { name: kernel.event_subscriber } diff --git a/docs/SSO_SLO_Documentation.md b/docs/SSO_SLO_Documentation.md index bdf2344..9468805 100644 --- a/docs/SSO_SLO_Documentation.md +++ b/docs/SSO_SLO_Documentation.md @@ -102,7 +102,7 @@ Lorsqu'un utilisateur se déconnecte d'une application, il est **automatiquement └─> Redirection vers EasyCheck 6. EasyPortal → Redirection - └─> GET {{ easycheck_url }}/logout + └─> GET https://check.../logout 7. EasyCheck → Invalide la session └─> Session détruite, cookies supprimés @@ -133,6 +133,9 @@ OAUTH_CLIENT_SECRET='secret-key' ### EasyPortal (.env) ```bash +# URL de l'application cliente (EasyCheck) +EASYCHECK_URL='https://check.solutions-easy.moi' + # Configuration OAuth2 Server OAUTH_PRIVATE_KEY=%kernel.project_dir%/config/jwt/private.key OAUTH_PUBLIC_KEY=%kernel.project_dir%/config/jwt/public.key @@ -140,8 +143,6 @@ OAUTH_PASSPHRASE='passphrase' OAUTH_ENCRYPTION_KEY='encryption-key' ``` -**Note** : L'URL d'EasyCheck n'est plus stockée dans une variable d'environnement mais récupérée dynamiquement depuis la table `oauth2_client` en base de données. - ## Points importants ### Sécurité diff --git a/src/Entity/OAuth2Client.php b/src/Entity/OAuth2Client.php deleted file mode 100644 index ad9a3c0..0000000 --- a/src/Entity/OAuth2Client.php +++ /dev/null @@ -1,160 +0,0 @@ - false])] - private bool $allowPlainTextPkce = false; - - public function getIdentifier(): ?string - { - return $this->identifier; - } - - public function setIdentifier(string $identifier): self - { - $this->identifier = $identifier; - return $this; - } - - public function getName(): ?string - { - return $this->name; - } - - public function setName(string $name): self - { - $this->name = $name; - return $this; - } - - public function getSecret(): ?string - { - return $this->secret; - } - - public function setSecret(?string $secret): self - { - $this->secret = $secret; - return $this; - } - - public function getRedirectUris(): ?string - { - return $this->redirectUris; - } - - public function setRedirectUris(?string $redirectUris): self - { - $this->redirectUris = $redirectUris; - return $this; - } - - public function getRedirectUrisArray(): array - { - if (!$this->redirectUris) { - return []; - } - - $decoded = json_decode($this->redirectUris, true); - if (is_array($decoded)) { - return $decoded; - } - - return [$this->redirectUris]; - } - - public function getGrants(): ?string - { - return $this->grants; - } - - public function setGrants(?string $grants): self - { - $this->grants = $grants; - return $this; - } - - public function getScopes(): ?string - { - return $this->scopes; - } - - public function setScopes(?string $scopes): self - { - $this->scopes = $scopes; - return $this; - } - - public function isActive(): bool - { - return $this->active; - } - - public function setActive(bool $active): self - { - $this->active = $active; - return $this; - } - - public function isAllowPlainTextPkce(): bool - { - return $this->allowPlainTextPkce; - } - - public function setAllowPlainTextPkce(bool $allowPlainTextPkce): self - { - $this->allowPlainTextPkce = $allowPlainTextPkce; - return $this; - } - - public function getBaseUrl(): ?string - { - $uris = $this->getRedirectUrisArray(); - if (empty($uris)) { - return null; - } - - $firstUri = $uris[0]; - $parsed = parse_url($firstUri); - - if (!isset($parsed['scheme'], $parsed['host']) || !$parsed) { - return null; - } - - $baseUrl = $parsed['scheme'] . '://' . $parsed['host']; - - if (isset($parsed['port']) && !in_array($parsed['port'], [80, 443], true)) { - $baseUrl .= ':' . $parsed['port']; - } - - return $baseUrl; - } -} diff --git a/src/EventListener/LogoutSubscriber.php b/src/EventListener/LogoutSubscriber.php index 8443c42..be38ffa 100644 --- a/src/EventListener/LogoutSubscriber.php +++ b/src/EventListener/LogoutSubscriber.php @@ -2,7 +2,6 @@ namespace App\EventListener; -use App\Repository\OAuth2ClientRepository; use Psr\Log\LoggerInterface; use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\HttpFoundation\RedirectResponse; @@ -11,7 +10,7 @@ use Symfony\Component\Security\Http\Event\LogoutEvent; class LogoutSubscriber implements EventSubscriberInterface { public function __construct( - private readonly OAuth2ClientRepository $oauth2ClientRepository, + private readonly string $easycheckUrl, private readonly LoggerInterface $logger ) { } @@ -25,21 +24,7 @@ class LogoutSubscriber implements EventSubscriberInterface public function onLogout(LogoutEvent $event): void { - $easycheckClient = $this->oauth2ClientRepository->findByName('check'); - - if (!$easycheckClient) { - $this->logger->error('OAuth2 client "check" not found in database'); - return; - } - - $easycheckUrl = $easycheckClient->getBaseUrl(); - - if (!$easycheckUrl) { - $this->logger->error('Unable to determine base URL for EasyCheck client'); - return; - } - - $easycheckLogoutUrl = $easycheckUrl . '/logout'; + $easycheckLogoutUrl = $this->easycheckUrl . '/logout'; $this->logger->info('LogoutSubscriber triggered - redirecting to EasyCheck logout', [ 'easycheck_logout_url' => $easycheckLogoutUrl, diff --git a/src/Repository/OAuth2ClientRepository.php b/src/Repository/OAuth2ClientRepository.php deleted file mode 100644 index db0ef79..0000000 --- a/src/Repository/OAuth2ClientRepository.php +++ /dev/null @@ -1,34 +0,0 @@ -findOneBy(['name' => $name]); - } - - public function findByIdentifier(string $identifier): ?OAuth2Client - { - return $this->findOneBy(['identifier' => $identifier]); - } - - public function findActiveClients(): array - { - return $this->createQueryBuilder('c') - ->where('c.active = :active') - ->setParameter('active', true) - ->getQuery() - ->getResult(); - } -}