fix: CIE AuthnContextClassRef (Decreto 8 settembre 2022)

italia · May 4, 2023 · c980d34 · c980d34
1 parent 5249724
commit c980d34
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 16 deletions.
diff --git a/setup/metadata/saml20-idp-remote-cie.ptpl b/setup/metadata/saml20-idp-remote-cie.ptpl
@@ -92,7 +92,6 @@ $metadata['https://idserver.servizicie.interno.gov.it/idp/profile/SAML2/POST/SSO
     'Format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
     'AllowCreate' => true,
   ),
-  'AuthnContextClassRef' => 'https://www.spid.gov.it/SpidL3',
   'certData' => 'MIIDdTCCAl2gAwIBAgIUU79XEfveueyClDtLkqUlSPZ2o8owDQYJKoZIhvcNAQELBQAwLTErMCkGA1UEAwwiaWRzZXJ2ZXIuc2Vydml6aWNpZS5pbnRlcm5vLmdvdi5pdDAeFw0xODEwMTkwODM1MDVaFw0zODEwMTkwODM1MDVaMC0xKzApBgNVBAMMImlkc2VydmVyLnNlcnZpemljaWUuaW50ZXJuby5nb3YuaXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHraj3iOTCIILTlOzicSEuFt03kKvQDqGWRd5o7s1W7SP2EtcTmg3xron/sbrLEL/eMUQV/Biz6J4pEGoFpMZQHGxOVypmO7Nc8pkFot7yUTApr6Ikuy4cUtbx0g5fkQLNb3upIg0Vg1jSnRXEvUCygr/9EeKCUOi/2ptmOVSLad+dT7TiRsZTwY3FvRWcleDfyYwcIMgz5dLSNLMZqwzQZK1DzvWeD6aGtBKCYPRftacHoESD+6bhukHZ6w95foRMJLOaBpkp+XfugFQioYvrM0AB1YQZ5DCQRhhc8jejwdY+bOB3eZ1lJY7Oannfu6XPW2fcknelyPt7PGf22rNfAgMBAAGjgYwwgYkwHQYDVR0OBBYEFK3Ah+Do3/zB9XjZ66i4biDpUEbAMGgGA1UdEQRhMF+CImlkc2VydmVyLnNlcnZpemljaWUuaW50ZXJuby5nb3YuaXSGOWh0dHBzOi8vaWRzZXJ2ZXIuc2Vydml6aWNpZS5pbnRlcm5vLmdvdi5pdC9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEAVtpn/s+lYVf42pAtdgJnGTaSIy8KxHeZobKNYNFEY/XTaZEt9QeV5efUMBVVhxKTTHN0046DR96WFYXs4PJ9Fpyq6Hmy3k/oUdmHJ1c2bwWF/nZ82CwOO081Yg0GBcfPEmKLUGOBK8T55ncW+RSZadvWTyhTtQhLUtLKcWyzKB5aS3kEE5LSzR8sw3owln9P41Mz+QtL3WeNESRHW0qoQkFotYXXW6Rvh69+GyzJLxvq2qd7D1qoJgOMrarshBKKPk+ABaLYoEf/cru4e0RDIp2mD0jkGOGDkn9XUl+3ddALq/osTki6CEawkhiZEo6ABEAjEWNkH9W3/ZzvJnWo6Q==',
 );
 
@@ -190,6 +189,5 @@ $metadata['https://preproduzione.idserver.servizicie.interno.gov.it/idp/profile/
     'Format' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
     'AllowCreate' => true,
   ),
-  'AuthnContextClassRef' => 'https://www.spid.gov.it/SpidL3',
   'certData' => 'MIIDdTCCAl2gAwIBAgIUU79XEfveueyClDtLkqUlSPZ2o8owDQYJKoZIhvcNAQELBQAwLTErMCkGA1UEAwwiaWRzZXJ2ZXIuc2Vydml6aWNpZS5pbnRlcm5vLmdvdi5pdDAeFw0xODEwMTkwODM1MDVaFw0zODEwMTkwODM1MDVaMC0xKzApBgNVBAMMImlkc2VydmVyLnNlcnZpemljaWUuaW50ZXJuby5nb3YuaXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHraj3iOTCIILTlOzicSEuFt03kKvQDqGWRd5o7s1W7SP2EtcTmg3xron/sbrLEL/eMUQV/Biz6J4pEGoFpMZQHGxOVypmO7Nc8pkFot7yUTApr6Ikuy4cUtbx0g5fkQLNb3upIg0Vg1jSnRXEvUCygr/9EeKCUOi/2ptmOVSLad+dT7TiRsZTwY3FvRWcleDfyYwcIMgz5dLSNLMZqwzQZK1DzvWeD6aGtBKCYPRftacHoESD+6bhukHZ6w95foRMJLOaBpkp+XfugFQioYvrM0AB1YQZ5DCQRhhc8jejwdY+bOB3eZ1lJY7Oannfu6XPW2fcknelyPt7PGf22rNfAgMBAAGjgYwwgYkwHQYDVR0OBBYEFK3Ah+Do3/zB9XjZ66i4biDpUEbAMGgGA1UdEQRhMF+CImlkc2VydmVyLnNlcnZpemljaWUuaW50ZXJuby5nb3YuaXSGOWh0dHBzOi8vaWRzZXJ2ZXIuc2Vydml6aWNpZS5pbnRlcm5vLmdvdi5pdC9pZHAvc2hpYmJvbGV0aDANBgkqhkiG9w0BAQsFAAOCAQEAVtpn/s+lYVf42pAtdgJnGTaSIy8KxHeZobKNYNFEY/XTaZEt9QeV5efUMBVVhxKTTHN0046DR96WFYXs4PJ9Fpyq6Hmy3k/oUdmHJ1c2bwWF/nZ82CwOO081Yg0GBcfPEmKLUGOBK8T55ncW+RSZadvWTyhTtQhLUtLKcWyzKB5aS3kEE5LSzR8sw3owln9P41Mz+QtL3WeNESRHW0qoQkFotYXXW6Rvh69+GyzJLxvq2qd7D1qoJgOMrarshBKKPk+ABaLYoEf/cru4e0RDIp2mD0jkGOGDkn9XUl+3ddALq/osTki6CEawkhiZEo6ABEAjEWNkH9W3/ZzvJnWo6Q==',
 );
diff --git a/setup/sdk/proxy.tpl b/setup/sdk/proxy.tpl
@@ -28,6 +28,7 @@
     const TOKEN_PRIVATE_KEY = "{{SDKHOME}}/cert/spid-sp.pem";
     const TOKEN_PUBLIC_CERT = "{{SDKHOME}}/cert/spid-sp.crt";
     const DEFAULT_SPID_LEVEL = 2;
+    const DEFAULT_CIE_LEVEL = 3;
     const DEFAULT_ATCS_INDEX = 0;
     const DEFAULT_EIDAS_ATCS_INDEX = 100;
     const DEFAULT_SECRET = "";
@@ -48,8 +49,8 @@
 
         case "login":
 
-            $service = "spid";
-            if($idp=="CIE" || $idp=="CIE TEST") $service = "cie";
+            $isCIE = ($idp=="CIE" || $idp=="CIE TEST");
+            $service = $isCIE? "cie" : "spid";
         
             $spidsdk = new SPID_PHP($production, $service);
 
@@ -102,16 +103,16 @@
                         die();
 
                     } else {
-                        $spid_level = $clients[$client_id]['level'];
+                        $spidcie_level = $clients[$client_id]['level'];
                         $atcs_index = $clients[$client_id]['atcs_index'];
-                        if($spid_level==null || !in_array($spid_level, [1,2,3])) $spid_level = DEFAULT_SPID_LEVEL;
+                        if($spidcie_level==null || !in_array($spidcie_level, [1,2,3])) $spidcie_level = $isCIE? DEFAULT_CIE_LEVEL : DEFAULT_SPID_LEVEL;
                         if($atcs_index==null || !is_numeric($atcs_index)) $atcs_index = DEFAULT_ATCS_INDEX;
 
                         if($idp=="EIDAS" || $idp=="EIDAS QA") $atcs_index = DEFAULT_EIDAS_ATCS_INDEX;
 
                         $returnTo = $_SERVER['SCRIPT_URI'].'?action=login&idp='.$idp.'&client_id='.$client_id.'&redirect_uri='.$redirect_uri.'&state='.$state;
                         setcookie('SPIDPHP_PROXYRETURNTO', $returnTo, time()+60*5, '/');
-                        $spidsdk->login($idp, $spid_level, $_SERVER['SCRIPT_URI'], $atcs_index);
+                        $spidsdk->login($idp, $spidcie_level, $_SERVER['SCRIPT_URI'], $atcs_index);
                         die();
                     }
 

diff --git a/setup/sdk/spid-php.tpl b/setup/sdk/spid-php.tpl
@@ -96,22 +96,31 @@
         }
 
         public function login($idp, $l, $returnTo="", $attributeIndex=null, $post=false) {
-            // default for SPID
-            $l = ($l=="2" || $l=="3")? $l : "1";
-            $post = $post;
+            // common for SPID & CIE
             $comparison = \SAML2\Constants::COMPARISON_MINIMUM;
 
             // override for CIE
             $isCIEIdP = $this->isCIEKey($idp);
-            $l = $isCIEIdP? "3" : $l;
-            $post = $isCIEIdP? true : $post;
-            $comparison = $isCIEIdP? \SAML2\Constants::COMPARISON_EXACT : \SAML2\Constants::COMPARISON_MINIMUM;
-            
-            $spidlevel = "https://www.spid.gov.it/SpidL" . $l;
+            if($isCIEIdP) {
+                $l = ($l=="1" || $l=="2")? $l : "3";
+                $post = true;
+
+                /*
+                * Decreto 8 settembre 2022 “Modalità di impiego della carta di identità elettronica” art. 4
+                * consente l'utilizzo di CIE a livello 1 e 2
+                * impostato di default a 3 se non specificato
+                */
+                //$comparison = $isCIEIdP? \SAML2\Constants::COMPARISON_EXACT : \SAML2\Constants::COMPARISON_MINIMUM;
+
+            } else {
+                $l = ($l=="1" || $l=="3")? $l : "2";
+            }
+
+            $spidcie_level = "https://www.spid.gov.it/SpidL" . $l;
             $binding = $post? \SAML2\Constants::BINDING_HTTP_POST : \SAML2\Constants::BINDING_HTTP_REDIRECT;
 
             $config = array(
-                'saml:AuthnContextClassRef' => $spidlevel,
+                'saml:AuthnContextClassRef' => $spidcie_level,
                 'saml:AuthnContextComparison' => $comparison,
                 'saml:idp' => $this->idps[$idp],
                 'saml:NameIDPolicy' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',