Answer a cancelled authentication with access_denied

When the End-User cancels the authentication, the client now gets an
access_denied error at its redirect URI, with the request's state and iss,
in the request's response mode (RFC 6749 sections 4.1.2.1 and 4.2.2.1),
instead of SimpleSAMLphp's error page. A cancel is SimpleSAMLphp's
UserAborted, raised through the authentication state by an authentication
source or an authentication processing filter which lets the End-User
cancel. Every other authentication error keeps SimpleSAMLphp's handling.
The FAPI 2.0 "user rejects authentication" test of the OpenID4VCI HAIP
plan needs this (HT2 of the HAIP plan).

- Every login the module starts for an authorization request, including
  the re-authentication prompt=login or an expired max_age asks for, gets
  SimpleSAMLphp's ErrorURL (the authorization endpoint) and the redirect
  to answer the client at (AuthorizationErrorRedirect) in its state. The
  processing chain's state gets the same exception handler URL and
  redirect, and a cancel raised in-request out of processState() is
  answered directly.
- The authorization endpoint hands a request carrying SimpleSAMLphp's
  exception state id to AuthenticationService::rethrowAuthenticationException(),
  which answers a cancel with access_denied and throws anything else as
  it was raised.
- A cancel is the response to a pushed authorization request, so it
  consumes the request first, as a successful response does: one
  request_uri yields at most one response, and a request_uri consumed
  meanwhile is refused.
- An authentication handed back with an exception clears the session's
  mark that a login was performed, so that after a failed or cancelled
  re-authentication the earlier session is not taken for a fresh login.
- The redirect keeps the response mode by its value: the form_post one
  holds the services which render its page, which must not go into the
  session. ResponseModeInterface gains getMode(), and ResponseModeResolver
  finds the response mode of a value.
- The conformance image gets a test-only module, oidcconformance, whose
  authentication source extends exampleauth:UserPass: logging in as
  `cancel` cancels, since SimpleSAMLphp's login page has no cancel
  button. The proxied introspection harness mounts it too.
- Docs: the upgrade guide and the Authentication Processing filters
  section say how a cancel is answered and how a filter raises one.

Author: cicnavi

docker/Dockerfile

@@ -26,6 +26,7 @@ RUN /opt/simplesaml/staging-install.sh
 RUN /opt/simplesaml/module-setup.sh
 ADD docker/ssp/module_oidc.php /var/simplesamlphp/config/module_oidc.php
 ADD docker/ssp/authsources.php /var/simplesamlphp/config/authsources.php
+ADD docker/ssp/modules/oidcconformance /var/simplesamlphp/modules/oidcconformance
 ADD docker/ssp/config-override.php /var/simplesamlphp/config/config-override.php
 # Bring the seeded database up to the schema of the module being built. docker/conformance.sql is a dump
 # taken at some earlier schema, so the migrations it has not seen run here and a new migration needs no new

docker/docker-compose.yml

@@ -36,6 +36,7 @@ services:
       - ./:/var/simplesamlphp/staging-modules/oidc:ro
       - ./docker/ssp/module_oidc.php:/var/simplesamlphp/config/module_oidc.php:ro
       - ./docker/ssp/authsources.php:/var/simplesamlphp/config/authsources.php:ro
+      - ./docker/ssp/modules/oidcconformance:/var/simplesamlphp/modules/oidcconformance:ro
       - ./docker/ssp/config-override.php:/var/simplesamlphp/config/config-override.php:ro
       - ./docker/apache-override.cf:/etc/apache2/sites-enabled/ssp-override.cf:ro
   # Catches the mail the OP sends (docker/ssp/config-override.php) and delivers none of it. The OpenID4VCI

docker/proxied-introspection-harness/docker-compose.yml

@@ -21,6 +21,7 @@ x-op-node: &op-node
     - ./docker/proxied-introspection-harness/run-on-start.sh:/opt/simplesaml/run-on-start.sh:ro
     - ./docker/proxied-introspection-harness/module_oidc.php:/var/simplesamlphp/config/module_oidc.php:ro
     - ./docker/ssp/authsources.php:/var/simplesamlphp/config/authsources.php:ro
+    - ./docker/ssp/modules/oidcconformance:/var/simplesamlphp/modules/oidcconformance:ro
     - ./docker/ssp/config-override.php:/var/simplesamlphp/config/config-override.php:ro
     - ./docker/apache-override.cf:/etc/apache2/sites-enabled/ssp-override.cf:ro
   healthcheck:

docker/ssp/authsources.php

@@ -9,8 +9,10 @@
         'core:AdminPassword',
     ),
 
+    // exampleauth:UserPass, where logging in as `cancel` (any password) cancels the authentication, which the
+    // OIDC module answers to the client with access_denied; see docker/ssp/modules/oidcconformance.
     'example-userpass' => [
-        'exampleauth:UserPass',
+        'oidcconformance:CancellableUserPass',
         'users' => [
             'student:studentpass' => [
                 'uid' => ['student'],

docker/ssp/config-override.php

@@ -3,6 +3,8 @@
 declare(strict_types=1);
 
 $config['module.enable']['exampleauth'] = true;
+// The test-only authentication source of docker/ssp/modules/oidcconformance, which lets a login be cancelled.
+$config['module.enable']['oidcconformance'] = true;
 $config['module.enable']['oidc'] = true;
 // Have preprod warning enabled (though it may not be installed) to ease authproc redirect testing
 $config['module.enable']['preprodwarning'] = true;

docker/ssp/modules/oidcconformance/src/Auth/Source/CancellableUserPass.php

@@ -0,0 +1,38 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SimpleSAML\Module\oidcconformance\Auth\Source;
+
+use SimpleSAML\Auth\State;
+use SimpleSAML\Error\NoState;
+use SimpleSAML\Error\UserAborted;
+use SimpleSAML\Module\exampleauth\Auth\Source\UserPass;
+
+/**
+ * exampleauth:UserPass with a way to cancel, for the conformance image only: SimpleSAMLphp's login page has no
+ * cancel button, and the conformance suite's browser automation can only fill in and click what a page has. Logging
+ * in as `cancel`, with any password, stands for the End-User cancelling at the login page: the authentication ends
+ * with SimpleSAMLphp's UserAborted, raised through the state's exception handler, as an authentication source which
+ * lets the End-User cancel raises it. The OIDC module answers the client with `access_denied`; the suite's
+ * "user rejects authentication" test logs in so.
+ */
+class CancellableUserPass extends UserPass
+{
+    public const string CANCEL_USERNAME = 'cancel';
+
+
+    public static function handleLogin(string $authStateId, string $username, string $password): void
+    {
+        if ($username === self::CANCEL_USERNAME) {
+            $state = State::loadState($authStateId, self::STAGEID);
+            if ($state === null) {
+                throw new NoState();
+            }
+
+            State::throwException($state, new UserAborted());
+        }
+
+        parent::handleLogin($authStateId, $username, $password);
+    }
+}

docs/3-oidc-configuration.md

@@ -1210,6 +1210,14 @@ Additional OIDC data in the state:
 - \['Oidc'\]\['RelyingPartyMetadata'\]
 - \['Oidc'\]\['AuthorizationRequestParameters'\]
 
+A filter which lets the End-User cancel ends the authentication with
+SimpleSAMLphp's `\SimpleSAML\Error\UserAborted`: thrown from `process()`, or,
+once the filter has sent the End-User to a page of its own, passed with the
+state to `\SimpleSAML\Auth\State::throwException()`. The client is then
+answered with an `access_denied` error at its redirect URI (RFC 6749 sections
+4.1.2.1 and 4.2.2.1). An authentication source which lets the End-User cancel does the
+same. Any other exception is shown on SimpleSAMLphp's error page.
+
 Example filter configuration:
 
 ```php

docs/4-oidc-docker.md

@@ -66,6 +66,7 @@ docker run --name ssp-oidc-dev \
   -e SSP_ADMIN_PASSWORD=secret1 \
   --mount type=bind,source="$(pwd)/docker/ssp/module_oidc.php",target=/var/simplesamlphp/config/module_oidc.php,readonly \
   --mount type=bind,source="$(pwd)/docker/ssp/authsources.php",target=/var/simplesamlphp/config/authsources.php,readonly \
+  --mount type=bind,source="$(pwd)/docker/ssp/modules/oidcconformance",target=/var/simplesamlphp/modules/oidcconformance,readonly \
   --mount type=bind,source="$(pwd)/docker/ssp/config-override.php",target=/var/simplesamlphp/config/config-override.php,readonly \
   --mount type=bind,source="$(pwd)/docker/ssp/oidc_module.crt",target=/var/simplesamlphp/cert/oidc_module.crt,readonly \
   --mount type=bind,source="$(pwd)/docker/ssp/oidc_module.key",target=/var/simplesamlphp/cert/oidc_module.key,readonly \

docs/6-oidc-upgrade.md

@@ -876,6 +876,17 @@ the token endpoint),
 where its claims used to be read as parameters of the request, superseding
 those of the same name. Only the authorization endpoint and the PAR endpoint
 take a Request Object.
+- An authentication the End-User cancels is now answered to the client with an
+`access_denied` error at its redirect URI, with the request's `state` and the
+issuer (`iss`), in the request's response mode (RFC 6749 sections 4.1.2.1 and
+4.2.2.1), where SimpleSAMLphp's error page was shown before. A cancel is SimpleSAMLphp's
+`UserAborted`, which an authentication source or an Authentication Processing
+Filter raises when it lets the End-User cancel; none of the modules
+SimpleSAMLphp 2.5 ships does. This holds for the login of every flow and for
+the re-authentication `prompt=login` or an expired `max_age` asks for, which,
+cancelled, leaves the earlier session in place. Any other error of an
+authentication is shown as before. See
+[Authentication Processing filters](3-oidc-configuration.md#authentication-processing-filters-oidc).
 - The underlying `thephpleague/oauth2-server` library has been updated from
 v8 to v9
 - The requirements on packages `lcobucci/jwt` and `web-token/jwt-framework`

src/Controllers/AuthorizationController.php

@@ -9,6 +9,7 @@
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
 use SimpleSAML\Auth\ProcessingChain;
+use SimpleSAML\Auth\State;
 use SimpleSAML\Module\oidc\Bridges\PsrHttpBridge;
 use SimpleSAML\Module\oidc\Bridges\SspBridge;
 use SimpleSAML\Module\oidc\ModuleConfig;
@@ -55,6 +56,13 @@ public function __invoke(ServerRequestInterface $request): ResponseInterface
         $state = null;
         $this->loggerService->debug('AuthorizationController::invoke: Request parameters: ', $queryParameters);
 
+        if (isset($queryParameters[State::EXCEPTION_PARAM])) {
+            // An authentication which ended with an exception, handed back by SimpleSAMLphp: a cancel is answered to
+            // the client, anything else thrown as it was.
+            $this->loggerService->debug('AuthorizationController::invoke: Authentication ended with an exception.');
+            $this->authenticationService->rethrowAuthenticationException($queryParameters);
+        }
+
         if (!isset($queryParameters[ProcessingChain::AUTHPARAM])) {
             $this->loggerService->debug('AuthorizationController::invoke: No AuthProcId query param.');
             $authorizationRequest = $this->authorizationServer->validateAuthorizationRequest($request);