Show an error message to the user when eppn is invalid

resources/init.php

@@ -13,6 +13,8 @@
 use UnityWebPortal\lib\UnityRedis;
 use UnityWebPortal\lib\UnityWebhook;
 use UnityWebPortal\lib\UnityGithub;
+use UnityWebPortal\lib\UnitySite;
+use UnityWebPortal\lib\exceptions\SSOException;
 
 //
 // Initialize Session
@@ -92,9 +94,15 @@
 // SSO Init
 //
 
-$SSO = UnitySSO::getSSO();
-if (!is_null($SSO)) {
-    // SSO is available
+if (isset($_SERVER["REMOTE_USER"])) {  // Check if SSO is enabled on this page
+    try {
+        $SSO = UnitySSO::getSSO();
+    } catch (SSOException $e) {
+        $errorid = uniqid("sso-");
+        $eppn = $_SERVER["REMOTE_USER"];
+        UnitySite::errorLog("SSO Failure", "{$e} ($errorid)");
+        UnitySite::die("Invalid eppn: '$eppn'. Please contact {$CONFIG["mail"]["support"]} (id: $errorid)", true);
+    }
     $_SESSION["SSO"] = $SSO;
 
     $OPERATOR = new UnityUser($SSO["user"], $LDAP, $SQL, $MAILER, $REDIS, $WEBHOOK);

resources/lib/UnitySSO.php

@@ -3,6 +3,7 @@
 namespace UnityWebPortal\lib;
 
 use Exception;
+use UnityWebPortal\lib\exceptions\SSOException;
 
 class UnitySSO
 {
@@ -17,7 +18,7 @@ private static function eppnToOrg($eppn)
     {
         $parts = explode("@", $eppn);
         if (count($parts) != 2) {
-            throw new Exception("Malformed remote user detected: '$eppn'");
+            throw new SSOException("Malformed remote user detected: '$eppn'");
         }
 
         $org = $parts[1];
@@ -27,19 +28,13 @@ private static function eppnToOrg($eppn)
 
     public static function getSSO()
     {
-        if (isset($_SERVER["REMOTE_USER"])) {  // Check if SSO is enabled on this page
-            $SSO = array(
-                "user" => self::eppnToUID($_SERVER["REMOTE_USER"]),
-                "org" => self::eppnToOrg($_SERVER["REMOTE_USER"]),
-                "firstname" => $_SERVER["givenName"],
-                "lastname" => $_SERVER["sn"],
-                "name" => $_SERVER["givenName"] . " " . $_SERVER["sn"],
-                "mail" => isset($_SERVER["mail"]) ? $_SERVER["mail"] : $_SERVER["eppn"]
-            );
-
-            return $SSO;
-        }
-
-        return null;
+        return array(
+            "user" => self::eppnToUID($_SERVER["REMOTE_USER"]),
+            "org" => self::eppnToOrg($_SERVER["REMOTE_USER"]),
+            "firstname" => $_SERVER["givenName"],
+            "lastname" => $_SERVER["sn"],
+            "name" => $_SERVER["givenName"] . " " . $_SERVER["sn"],
+            "mail" => isset($_SERVER["mail"]) ? $_SERVER["mail"] : $_SERVER["eppn"]
+        );
     }
 }

resources/lib/exceptions/SSOException.php

@@ -0,0 +1,6 @@
+<?php
+namespace UnityWebPortal\lib\exceptions;
+
+class SSOException extends \Exception
+{
+}

test/functional/InvalidEPPNTest.php

@@ -0,0 +1,48 @@
+<?php
+
+use UnityWebPortal\lib\exceptions\PhpUnitNoDieException;
+use PHPUnit\Framework\TestCase;
+use PHPUnit\Framework\Attributes\DataProvider;
+
+class InvalidEPPNTest extends TestCase
+{
+    public static function provider()
+    {
+        return [
+            ["",      false],
+            ["a",     false],
+            ["a@b",   true],
+            ["a@b@c", false],
+        ];
+    }
+
+    #[DataProvider("provider")]
+    public function testInitGetSSO(string $eppn, bool $is_valid): void
+    {
+        global $SSO;
+        $original_server = $_SERVER;
+        $original_sso = $SSO;
+        if (session_status() == PHP_SESSION_ACTIVE) {
+            session_write_close();
+            session_id(uniqid());
+        }
+        if (!$is_valid) {
+            $this->expectException(PhpUnitNoDieException::class);
+            $this->expectExceptionMessageMatches("/.*Invalid eppn.*/");
+        }
+        try {
+            $_SERVER["REMOTE_USER"] = $eppn;
+            $_SERVER["REMOTE_ADDR"] = "127.0.0.1";
+            $_SERVER["eppn"] = $eppn;
+            $_SERVER["givenName"] = "foo";
+            $_SERVER["sn"] = "bar";
+            // can't use http_get because it does `require_once`
+            // won't use phpunit --process-isolation because when I try that argument all tests fail with a blank error message
+            include __DIR__ . "/../../resources/init.php";
+        } finally {
+            $_SERVER = $original_server;
+            $SSO = $original_sso;
+        }
+        $this->assertTrue(true); // if $is_valid, there are no other assertions
+    }
+}

test/phpunit-bootstrap.php

@@ -19,6 +19,7 @@
 require_once __DIR__ . "/../resources/lib/UnityRedis.php";
 require_once __DIR__ . "/../resources/lib/UnityGithub.php";
 require_once __DIR__ . "/../resources/lib/exceptions/PhpUnitNoDieException.php";
+require_once __DIR__ . "/../resources/lib/exceptions/SSOException.php";
 
 $GLOBALS["PHPUNIT_NO_DIE_PLEASE"] = true;