src/Controller/SsoController.php line 60

Open in your IDE?
  1. <?php
  3. namespace App\Controller;
  5. use Alancting\Microsoft\JWT\AzureAd\AzureAdConfiguration;
  6. use Alancting\Microsoft\JWT\AzureAd\AzureAdIdTokenJWT;
  7. use Firebase\JWT\JWT;
  8. use League\OAuth2\Client\Provider\GenericProvider;
  9. use PhpParser\Comment\Doc;
  10. use Pimcore\Controller\FrontendController;
  11. use Pimcore\Model\DataObject\Account;
  12. use Pimcore\Model\DataObject\Manager;
  13. use Pimcore\Model\Document;
  14. use Symfony\Component\HttpFoundation\Request;
  15. use Symfony\Component\Routing\Annotation\Route;
  16. use Symfony\Component\String\ByteString;
  17. use Pimcore\Cache;
  19. class SsoController extends FrontendController
  20. {
  21.     /**
  22.      * 跳转逻辑
  23.      * wcmManage: /sso/webLogin?app=wcm&usr=luy56&path=https://oneportalstg.medtronic.com.cn/#/login
  24.      * @Route("/sso/webLogin")
  25.      * @return
  26.      */
  27.     public function webLoginAction(Request $request) {
  28.         $app= $request->get('app');
  29.         $networkId= $request->get('usr');
  30.         $code=uniqid('em',true);
  31.         $account = Account::getByNetworkId($networkId, 1);
  32.         if(!$account) {
  33.             $data = [
  34.                 'error'=>'登录成功但用户不存在',
  35.                 'errorDetail'=>'用户邮箱不存在，请先添加用户至wcm后台'
  36.             ];
  37.             return $this->render('default/msg.html.twig', $data);
  38.         }
  40.         $data = [
  41.                 'userId'=>$account->getNetworkId(),
  42.                 'email'=>$account->getEmail(),
  43.                 'displayName'=>$account->getName(),
  44.         ];
  45.         Cache::save($data,$code,[],120);
  46.         $path="https://oneportalstg.medtronic.com.cn/#/login";
  47.         if($app="crdn_sales"){
  48.             $path="https://education-stag.medtronic-digital.com/crdn_sales/login";
  49.         }
  50.         return $this->redirect($path.'?code='.$code);
  51.     }
  52.     /**
  53.      * 微软sso登录
  54.      * ESign: /sso/login?app=esign
  55.      * wcmAR: /sso/login?app=arsp
  56.      * wcmManage: /sso/login?app=wcm
  57.      * @Route("/sso/login")
  58.      * @return
  59.      */
  60.     public function loginAction(Request $request) {
  61.         // Initialize the OAuth client
  62.         $oauthClient = new GenericProvider([
  63.             'clientId'                => OAUTH_APP_ID,
  64.             'clientSecret'            => OAUTH_APP_SECRET,
  65.             'redirectUri'             => OAUTH_REDIRECT_URI,
  66.             'urlAuthorize'            => OAUTH_AUTHORITY.OAUTH_AUTHORIZE_ENDPOINT,
  67.             'urlAccessToken'          => OAUTH_AUTHORITY.OAUTH_TOKEN_ENDPOINT,
  68.             'urlResourceOwnerDetails' => '',
  69.             'scopes'                  => OAUTH_SCOPES
  70.         ]);
  72.         $authUrl = $oauthClient->getAuthorizationUrl();
  73. //        $session = $request->getSession();
  74. //        $session->set('app', $request->get('app'));
  75. //        $session->set('oauthState', $oauthClient->getState());
  76.         setcookie('app', $request->get('app'));
  77.         $app= $request->get('app');
  78.         $state=$oauthClient->getState();
  79.         setcookie('oauthState'.'_'.$state, $oauthClient->getState());
  80.         
  81.         //2024-11-11 path parameter add.
  82.         
  83.         $path= $request->get('path');
  84.         if(isset($path)){
  85.             setcookie('oauthPath'.'_'.$state,$path);
  86.         }else{
  87.             setcookie('oauthPath'.'_'.$state,"demo");
  88.         }
  90.         setcookie($state,$request->get('app'));//新增state对应App，用于反向查找App，用于验证浏览器端存储的state是否正确。
  91. //        $data = [
  92. //            'redirectUrl' => $authUrl,
  93. //            'error' =>'<img src="/img/load.gif" loading="lazy" alt="" class="load-img">',
  94. //            'errorDetail' => '正在加载登录页面，请稍等...'
  95. //        ];
  96. //        return $this->render('default/msg.html.twig', $data);
  97.         return $this->redirect($authUrl); // 进入微软登录
  98.     }
  99.     /**
  100.      * 微软sso登录重定向
  101.      * @Route("/sso/callback")
  102.      * @return
  103.      */
  104.        public function callbackAction(Request $request)
  105.     {
  106.         $session = $request->getSession();
  107.         $state=$request->get('state');
  108.         $app = $_COOKIE[$state];//获取state对应App。
  109.         $path= $_COOKIE['oauthPath'.'_'.$state];//2024-11-11
  110.         $oauthState = $_COOKIE['oauthState'.'_'.$state];//获取App对应State；
  111.         setcookie($state,'',time()-60);//清理Cookie App
  112.         setcookie('oauthState'.'_'.$state,'',time()-60);//清理Cookie State
  114.         if(!$oauthState) {
  115.             $redirectUrl = '/sso/login?app='.$app;
  116.             $data = [
  117.             'redirectUrl' => $redirectUrl,
  118.             'error' => '重定向！',
  119.             'errorDetail' => '正在重新登录应用！'
  120.             ];
  121.             return $this->render('default/msg.html.twig', $data);
  122.         } else {
  123.             $code = $request->get('code');
  124.             $state = $request->get('state');
  125.             if (empty($state)) {
  126.                 $data = [
  127.                     'error'=>'no state',
  128.                     'errorDetail'=>'there is no expected state in the session'
  129.                 ];
  130.                 return $this->render('default/msg.html.twig', $data);
  131.             }
  133.             if ($state != $oauthState) {
  134.                 $data = [
  135.                     'error'=>'Invalid auth state',
  136.                     'errorDetail'=>'The provided auth state did not match the expected value. '.$state.' , '.$oauthState
  138.                 ];
  139.                 //ApplicationLogger::getInstance()->info('SSO State'.$state.' '.$oauthState);
  140.                 return $this->render('default/msg.html.twig', $data);
  141.             }
  143.             $redirectUrl = '/sso/redirectUrl?code='.$code;
  144.             $kname=md5($code);
  145.             
  146.             //2024-11-11 added path;
  147.             $kpath='path'.'_'.$kname;
  148.             setcookie($kpath,$path);
  149.             
  150.             setcookie($kname,$app);//新增Code对应App，用于反向查找App
  151.         }
  152.         
  153.         $data = [
  154.             'redirectUrl' => $redirectUrl,
  155.             'error' => '登录成功！',
  156.             'errorDetail' => '正在验证用户信息'
  157.         ];
  158.         return $this->render('default/msg.html.twig', $data);
  159.     }
  162.     /**
  163.      * 内部跳转一次，使session生效
  164.      * @Route("/sso/redirectUrl")
  165.      * @return
  166.      */
  167.     public function redirectUrlAction(Request $request) {
  168.         $session = $request->getSession();
  169.         $authCode = $request->get('code');
  170.         $kname=md5($authCode);
  171.         
  172.         //2024-11-11 added path
  173.         $kpath='path'.'_'.$kname;
  174.         $path =$_COOKIE[$kpath];
  175.         
  176.         $app = $_COOKIE[$kname];//更新为code绑定App。
  177.         setcookie($kname,'',time()-60);
  178.         // Authorization code should be in the "code" query param
  179.         if (!empty($authCode)) {
  180.             $oauthParams = [
  181.                 'client_id'                => OAUTH_APP_ID,
  182.                 'client_secret'            => OAUTH_APP_SECRET,
  183.                 'redirect_uri'             => OAUTH_REDIRECT_URI,
  184.                 'urlAuthorize'            => OAUTH_AUTHORITY.OAUTH_AUTHORIZE_ENDPOINT,
  185.                 'urlAccessToken'          => OAUTH_AUTHORITY.OAUTH_TOKEN_ENDPOINT,
  186.                 'urlResourceOwnerDetails' => '',
  187.                 'scopes'                  => OAUTH_SCOPES
  188.             ];
  189.             // Initialize the OAuth client
  190.             //$oauthClient = new GenericProvider($oauthParams);
  192.             try {
  193.                 // Make the token request
  194.                 //$accessToken = $oauthClient->getAccessToken('authorization_code', [
  195.                 //    'code' => $authCode
  196.                 //]);
  197.                 $authData = $this->reqData('post', OAUTH_AUTHORITY.OAUTH_TOKEN_ENDPOINT, array_merge($oauthParams, [
  198.                     'grant_type'=>'authorization_code',
  199.                     'code'=>$authCode
  200.                 ]));
  201.                 //var_dump($authData);
  202.                 $access_token = $authData['access_token'];
  203.                 $id_token = $authData['id_token'];
  204.                 // var_dump($authData);
  205.                 // echo "</br>";
  206.                 // var_dump($id_token);
  207.                 // die();
  208.                 $config_options = [
  209.                     'tenant' => OAUTH_TENANT_ID,
  210.                     'tenant_id' => OAUTH_TENANT_ID, // 租户id
  211.                     'client_id' => OAUTH_APP_ID, // appid
  212.                     'config_uri' => OAUTH_AUTHORITY.'/v2.0/.well-known/openid-configuration?appid='.OAUTH_APP_ID, // appid
  213.                     'idTokenCheck' => true
  214.                 ];
  215.                 $config = new AzureAdConfiguration($config_options);
  216.                 $id_token_jwt = new AzureAdIdTokenJWT($config, $id_token);
  218. //                print_r($id_token_jwt->getPayload());
  219. //                print_r($id_token_jwt->get('email'));
  221.                 if($id_token_jwt->isExpired()) {
  222.                     $data = [
  223.                         'error'=>'Access failed',
  224.                         'errorDetail'=>'id token 过期'
  225.                     ];
  226.                     return $this->render('default/msg.html.twig', $data);
  227.                 }
  229.                 // 解析邮箱
  230.                 $arr = explode('.', $access_token);
  231.                 $jsonData = JWT::urlsafeB64Decode($arr[1]);
  232.                 $userInfo = json_decode($jsonData, true);
  233.                 $email = $userInfo['upn'];//20250417 Modify to networkid to fix the IAM team's change
  234.                 $networkId = substr($email, 0, stripos($email, '@'));
  235.                 $azureCode = ByteString::fromRandom(32);
  236.                 
  237.                 if($app=='wcm') {
  238.                     $manager = Manager::getByAccount($email, 1);
  239.                     if(!$manager) {
  240.                         $data = [
  241.                             'error'=>'无权访问',
  242.                             'errorDetail'=>'管理员邮箱不存在'
  243.                         ];
  244.                         return $this->render('default/sso.html.twig', $data);
  245.                     }
  247.                     $manager->setSsoCode($azureCode);
  248.                     $manager->setPublished(true);
  249.                     $manager->save();
  250.                     return $this->redirect(ADMIN_DOMAIN.'#/login?code='.$azureCode);
  251.                 }elseif($app=='oneportal'){
  252.                     $code=uniqid('em',true);
  253.                     Cache::save($jsonData,$code,[],120);
  254.                     return $this->redirect('https://oneportalstg.medtronic.com.cn/#/login?code='.$code.'&user='.$jsonData);
  255.                 }elseif($app=='university'){
  256.                     $code=uniqid('em',true);
  257.                     $data = [
  258.                         'userId'=>$networkId,
  259.                         'email'=>$userInfo['unique_name'],
  260.                         'displayName'=>$userInfo['name'],
  261.                     ];
  262.                     Cache::save($data,$code,[],120);
  263.                     return $this->redirect('https://university.medtronic.com.cn/mdtuniversity/login'.'?code='.$code);
  265.                 }elseif($app=='academy'){
  266.                     $code=uniqid('em',true);
  267.                     $data = [
  268.                         'userId'=>$networkId,
  269.                         'email'=>$userInfo['unique_name'],
  270.                         'displayName'=>$userInfo['name'],
  271.                     ];
  272.                     Cache::save($data,$code,[],120);
  273.                     return $this->redirect('https://ma-wstag.medtronic.com.cn/login'.'?code='.$code);
  275.                 }elseif($app=='shapde_apv_academy_admin'){//2024-11-11
  276.                     $code=uniqid('em',true);
  277.                     $data = [
  278.                         'userId'=>$networkId,
  279.                         'email'=>$userInfo['unique_name'],
  280.                         'displayName'=>$userInfo['name'],
  281.                     ];
  282.                     Cache::save($data,$code,[],120);
  283.                     return $this->redirect('https://me.workatall.com/apv-lm/admin?role=admin&'.'code='.$code);
  285.                 }elseif($app=='shapde_apv_ academy _sales'){
  286.                     $code=uniqid('em',true);
  287.                     $data = [
  288.                         'userId'=>$networkId,
  289.                         'email'=>$userInfo['unique_name'],
  290.                         'displayName'=>$userInfo['name'],
  291.                     ];
  292.                     Cache::save($data,$code,[],120);
  293.                     return $this->redirect('https://me.workatall.com/apv-lm/login?role=sales&'.'code='.$code);
  295.                 }elseif($app=='ent_da_sales'){
  296.                     $code=uniqid('em',true);
  297.                     $data = [
  298.                         'userId'=>$networkId,
  299.                         'email'=>$userInfo['unique_name'],
  300.                         'displayName'=>$userInfo['name'],
  301.                     ];
  302.                     Cache::save($data,$code,[],120);
  303.                     return $this->redirect('https://me.workatall.com/entda/login'.'?code='.$code);
  305.                 }elseif($app=='shape_pvh_da_sales'){
  306.                     $code=uniqid('em',true);
  307.                     $data = [
  308.                         'userId'=>$networkId,
  309.                         'email'=>$userInfo['unique_name'],
  310.                         'displayName'=>$userInfo['name'],
  311.                     ];
  312.                     Cache::save($data,$code,[],120);
  313.                     return $this->redirect('https://me.workatall.com/pvh/login'.'?code='.$code);
  315.                 }elseif($app=='shape_pvh_static_sales'){
  316.                     $code=uniqid('em',true);
  317.                     $data = [
  318.                         'userId'=>$networkId,
  319.                         'email'=>$userInfo['unique_name'],
  320.                         'displayName'=>$userInfo['name'],
  321.                     ];
  322.                     Cache::save($data,$code,[],120);
  323.                     return $this->redirect('https://me.workatall.com/pvh_static/login'.'?code='.$code);
  325.                 }elseif($app=='ns_csf_da_ sales'){//2024-11-11
  326.                     $code=uniqid('em',true);
  327.                     $data = [
  328.                         'userId'=>$networkId,
  329.                         'email'=>$userInfo['unique_name'],
  330.                         'displayName'=>$userInfo['name'],
  331.                     ];
  332.                     Cache::save($data,$code,[],120);
  333.                     return $this->redirect('https://me.workatall.com/csf/login'.'?code='.$code);
  335.                 }elseif($app=='rdn'){
  336.                     $code=uniqid('em',true);
  337.                     $data = [
  338.                         'app'=>$app,
  339.                         'userId'=>$networkId,
  340.                         'email'=>$userInfo['unique_name'],
  341.                         'displayName'=>$userInfo['name']
  342.                     ];
  343.                     Cache::save($data,$code,[],120);
  344.                     return $this->redirect(APP_DOMAIN.'#/login?code='.$code);
  345.             
  346.                 }else {
  347.                     $account = Account::getByNetworkId($networkId, 1);
  348.                     if(!$account) {
  349.                         $data = [
  350.                             'error'=>'登录成功但用户不存在',
  351.                             'errorDetail'=>'用户邮箱不存在，请先添加用户至wcm后台'
  352.                         ];
  353.                         return $this->render('default/msg.html.twig', $data);
  354.                     }
  355.                     if($app=='arsp') {
  356.                         $account->setAzureCode($azureCode);
  357.                         $account->setPublished(true);
  358.                         $account->save();
  359.                         $data = [
  360.                             'email'=>$email,
  361.                             'code'=>$azureCode,
  362.                             'domain'=>APP_DOMAIN,
  363.                             'error'=>'登录成功！',
  364.                             'errorDetail'=>'即将跳转至APP'
  365.                         ];
  366.                         return $this->render('default/sso.html.twig', $data);
  367.                     } elseif($app=='esign') {
  368.                         if ($account->getisLogin() != 1) {
  369.                             return $this->render('esign/message.html.twig', ['message' => '无登录权限']);
  370.                         }
  371.                         $admin = [
  372.                             'id' => $account->getId(),
  373.                             'account' => $account->getEmail(),
  374.                             'isRemove' => $account->getIsRemove(),
  375.                             'isLogin' => $account->getIsLogin(),
  376.                             'userType' => 'eSign',
  377.                         ];
  378.                         $session->set('admin', $admin);
  379.                         return $this->redirect('/esign/inquire');
  380.                     }elseif($app=='ehs') {
  381.                         if ($account->getEHSisLogin() != 1) {
  382.                             return $this->render('esign/message.html.twig', ['message' => '无登录权限']);
  383.                         }
  384.                         $admin = [
  385.                             'id' => $account->getId(),
  386.                             'account' => $account->getEmail(),
  387.                             'isRemove' => $account->getEHSIsRemove(),
  388.                             'isLogin' => $account->getEHSIsLogin(),
  389.                             'userType' => 'ehs',
  390.                         ];
  391.                         $session->set('admin', $admin);
  392.                         return $this->redirect('/ehs/inquire');
  393.                     }elseif($app=='compliance') {
  394.                         if ($account->getcomplianceIsLogin() != 1) {
  395.                             return $this->render('esign/message.html.twig', ['message' => '无登录权限']);
  396.                         }
  397.                         $admin = [
  398.                             'id' => $account->getId(),
  399.                             'account' => $account->getEmail(),
  400.                             'isRemove' => $account->getcomplianceIsRemove(),
  401.                             'isLogin' => $account->getcomplianceIsLogin(),
  402.                             'userType' => 'compliance',
  403.                         ];
  404.                         $session->set('admin', $admin);
  405.                         return $this->redirect('/compliance/inquire');
  406.                     }elseif($app=='carelink') {
  407.                         if ($account->getcarelinkIsLogin() != 1) {
  408.                             return $this->render('carelink/message.html.twig', ['message' => '无Carelink From App登录权限']);
  409.                         }
  410.                         $account->setcarelinkToken($azureCode);
  411.                         $account->setPublished(true);
  412.                         $account->save();
  414.                         $admin = [
  415.                             'id' => $account->getId(),
  416.                             'account' => $account->getEmail(),
  417.                             'isLogin' => $account->getcarelinkIsLogin(),
  418.                             'userType' => 'carelink',
  419.                             'code'=>$azureCode,
  420.                         ];
  421.                         $session->set('admin', $admin);
  422.                         return $this->redirect('/carelink/inquire');
  423.                     }else{//2024-11-11 added
  424.                     
  425.                         $code=uniqid('em',true);
  426.                         $usr=explode('@',$userInfo['unique_name']);
  427.                         
  428.                         $data = [
  429.                             'app'=>$app,
  430.                             'userId'=>$networkId,
  431.                             'email'=>$userInfo['unique_name'],
  432.                             'displayName'=>$userInfo['name'],
  433.                         ];
  434.                         Cache::save($data,$code,[],120);
  435.                         return $this->redirect($path.'?code='.$code);
  437.                     }
  438.                     
  439.                     
  441.                 }
  442.             } catch (\League\OAuth2\Client\Provider\Exception\IdentityProviderException $e) {
  443.                 $data = [
  444.                     'error'=>'Error requesting access token',
  445.                     'errorDetail'=>json_encode($e->getResponseBody())
  446.                 ];
  447.                 return $this->render('default/sso.html.twig', $data);
  448.             }
  449.         }
  451.         $data = [
  452.             'error'=>$request->get('error'),
  453.             'errorDetail'=>$request->get('error_description')
  454.         ];
  455.         return $this->render('default/msg.html.twig', $data);
  456.     }
  458.     /**
  459.      * 退出
  460.      * @Route("/sso/logout")
  461.      * @return
  462.      */
  463.     public function logoutAction(Request $request) {
  464.         $params = $request->query->all();
  465.         $data = [
  466.             'error'=>'Logout',
  467.             'errorDetail'=>'已退出'
  468.         ];
  469.         return $this->render('default/msg.html.twig', $data);
  470.     }
  472.     public function reqData($method, $url, $data=[], $headers=[]) {
  473.         $ch = curl_init();
  474.         curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
  475.         curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  477.         curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
  478.         curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
  479.         curl_setopt($ch, CURLOPT_PROXY,MDT_CURL_PROXY);
  481.         $data = http_build_query($data);
  482.         if($method=='get') {
  483.             curl_setopt($ch, CURLOPT_POST, 0);
  484.             $url .= '?'.$data;
  485.         } else {
  486.             curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
  487.             curl_setopt($ch, CURLOPT_POST, 1);
  488.         }
  489.         curl_setopt($ch, CURLOPT_URL, $url);
  490.         $output = curl_exec($ch);
  491.         $curl_info = curl_getinfo($ch);
  492.         //var_dump($curl_info);
  493.         //var_dump($output);
  494.         curl_close($ch);
  495.         return json_decode($output, true);
  496.     }
  499.     /**
  500.      * 根据code获取sso user
  501.      * @Route("/sso/getUserByCode")
  502.      * @return
  503.      */
  504.     public function getUserByCodeAction(Request $request) {
  505.         header("Cache-Control: no-cached");
  506.         header("Access-Control-Allow-Credentials:true");
  507.         header("Content-Type: */*");
  508.         header("Access-Control-Allow-Headers: *");
  509.         header("Access-Control-Allow-Origin: *");
  510.         $code = $request->query->get('code');
  511.         $user = Cache::load($code);//2分钟销毁
  512.         return $this->json($user);
  513.     }
  516. }