From 0f59f19d3bb482b571dda73bc62e4424b61c4b61 Mon Sep 17 00:00:00 2001 From: Sara Arjona Date: Tue, 26 Jan 2021 15:50:11 +0100 Subject: [PATCH] MDL-70689 oauth2: self-register IMS OBv2.1 services IMS OBv2.1 services have a registration endpoint to get client id and secret. This patch adds and implements the "register" method for the IMS Open Badges Connect discovery system, to get the proper client id and secret values. --- admin/tool/oauth2/classes/form/issuer.php | 9 ++- .../oauth2/discovery/base_definition.php | 9 +++ .../oauth2/discovery/imsbadgeconnect.php | 76 +++++++++++++++++++ .../oauth2/discovery/openidconnect.php | 10 +++ 4 files changed, 102 insertions(+), 2 deletions(-) diff --git a/admin/tool/oauth2/classes/form/issuer.php b/admin/tool/oauth2/classes/form/issuer.php index c1095eb8680..a5d6c971adc 100644 --- a/admin/tool/oauth2/classes/form/issuer.php +++ b/admin/tool/oauth2/classes/form/issuer.php @@ -103,13 +103,11 @@ class issuer extends persistent { // Client ID. $mform->addElement('text', 'clientid', get_string('issuerclientid', 'tool_oauth2')); - $mform->addRule('clientid', null, 'required', null, 'client'); $mform->addRule('clientid', get_string('maximumchars', '', 255), 'maxlength', 255, 'client'); $mform->addHelpButton('clientid', 'issuerclientid', 'tool_oauth2'); // Client Secret. $mform->addElement('text', 'clientsecret', get_string('issuerclientsecret', 'tool_oauth2')); - $mform->addRule('clientsecret', null, 'required', null, 'client'); $mform->addRule('clientsecret', get_string('maximumchars', '', 255), 'maxlength', 255, 'client'); $mform->addHelpButton('clientsecret', 'issuerclientsecret', 'tool_oauth2'); @@ -167,6 +165,13 @@ class issuer extends persistent { $mform->addHelpButton('requireconfirmation', 'issuerrequireconfirmation', 'tool_oauth2'); } + if ($this->type == 'imsobv2p1' || $issuer->get('servicetype') == 'imsobv2p1') { + $mform->addRule('baseurl', null, 'required', null, 'client'); + } else { + $mform->addRule('clientid', null, 'required', null, 'client'); + $mform->addRule('clientsecret', null, 'required', null, 'client'); + } + $mform->addElement('hidden', 'sortorder'); $mform->setType('sortorder', PARAM_INT); diff --git a/lib/classes/oauth2/discovery/base_definition.php b/lib/classes/oauth2/discovery/base_definition.php index fe02a548369..6c6286f9a78 100644 --- a/lib/classes/oauth2/discovery/base_definition.php +++ b/lib/classes/oauth2/discovery/base_definition.php @@ -58,6 +58,14 @@ abstract class base_definition { */ protected abstract static function create_field_mappings(issuer $issuer): void; + /** + * Self-register the issuer if the 'registration' endpoint exists and client id and secret aren't defined. + * + * @param issuer $issuer The OAuth issuer to register. + * @return void + */ + protected abstract static function register(issuer $issuer): void; + /** * Create endpoints for this issuer. * @@ -127,6 +135,7 @@ abstract class base_definition { static::process_configuration_json($issuer, $info); static::create_field_mappings($issuer); + static::register($issuer); return endpoint::count_records(['issuerid' => $issuer->get('id')]); } diff --git a/lib/classes/oauth2/discovery/imsbadgeconnect.php b/lib/classes/oauth2/discovery/imsbadgeconnect.php index ad2538ff49f..5d8fcfa4805 100644 --- a/lib/classes/oauth2/discovery/imsbadgeconnect.php +++ b/lib/classes/oauth2/discovery/imsbadgeconnect.php @@ -16,7 +16,9 @@ namespace core\oauth2\discovery; +use curl; use stdClass; +use moodle_exception; use core\oauth2\issuer; use core\oauth2\endpoint; @@ -92,4 +94,78 @@ class imsbadgeconnect extends base_definition { // In that case, there are no user fields to map. } + /** + * Self-register the issuer if the 'registration' endpoint exists and client id and secret aren't defined. + * + * @param issuer $issuer The OAuth issuer to register. + * @return void + */ + protected static function register(issuer $issuer): void { + global $CFG, $SITE; + + $clientid = $issuer->get('clientid'); + $clientsecret = $issuer->get('clientsecret'); + + // Registration request for getting client id and secret will be done only they are empty in the issuer. + // For now this can't be run from PHPUNIT (because IMS testing platform needs real URLs). In the future, this + // request can be moved to the moodle-exttests repository. + if (empty($clientid) && empty($clientsecret) && (!defined('PHPUNIT_TEST') || !PHPUNIT_TEST)) { + $url = $issuer->get_endpoint_url('registration'); + if ($url) { + $scopes = str_replace("\r", " ", $issuer->get('scopessupported')); + + // Add slash at the end of the site URL. + $hosturl = $CFG->wwwroot; + $hosturl .= (substr($CFG->wwwroot, -1) == '/' ? '' : '/'); + + // Create the registration request following the format defined in the IMS OBv2.1 specification. + $request = [ + 'client_name' => $SITE->fullname, + 'client_uri' => $hosturl, + 'logo_uri' => $hosturl . 'pix/f/moodle-256.png', + 'tos_uri' => $hosturl, + 'policy_uri' => $hosturl, + 'software_id' => 'moodle', + 'software_version' => $CFG->version, + 'redirect_uris' => [ + $hosturl . 'admin/oauth2callback.php' + ], + 'token_endpoint_auth_method' => 'client_secret_basic', + 'grant_types' => [ + 'authorization_code', + 'refresh_token' + ], + 'response_types' => [ + 'code' + ], + 'scope' => $scopes + ]; + $jsonrequest = json_encode($request); + + $curl = new curl(); + $curl->setHeader(['Content-type: application/json']); + $curl->setHeader(['Accept: application/json']); + + // Send the registration request. + if (!$jsonresponse = $curl->post($url, $jsonrequest)) { + $msg = 'Could not self-register identity issuer: ' . $issuer->get('name') . + ". Wrong URL or JSON data [URL: $url]"; + throw new moodle_exception($msg); + } + + // Process the response and update client id and secret if they are valid. + $response = json_decode($jsonresponse); + if (property_exists($response, 'client_id')) { + $issuer->set('clientid', $response->client_id); + $issuer->set('clientsecret', $response->client_secret); + $issuer->update(); + } else { + $msg = 'Could not self-register identity issuer: ' . $issuer->get('name') . + '. Invalid response ' . $jsonresponse; + throw new moodle_exception($msg); + } + } + } + } + } diff --git a/lib/classes/oauth2/discovery/openidconnect.php b/lib/classes/oauth2/discovery/openidconnect.php index 284f0af8aa3..f1c58631427 100644 --- a/lib/classes/oauth2/discovery/openidconnect.php +++ b/lib/classes/oauth2/discovery/openidconnect.php @@ -112,4 +112,14 @@ class openidconnect extends base_definition { } } + /** + * Self-register the issuer if the 'registration' endpoint exists and client id and secret aren't defined. + * + * @param issuer $issuer The OAuth issuer to register. + * @return void + */ + protected static function register(issuer $issuer): void { + // Registration not supported (at least for now). + } + }