Route bindings do not match metadata

[johanib]

Summary

After some discussion in #493, @MKodde and I took a look at the bindings in Gateway. It seems gateway could accept POST requests, where only GET requests should be supported.
Using the POST in those scenario's is unsupported, and if it works, it might break as it has no test coverage.

Proposal: Remove POST from /authentication/single-sign-on and /second-factor-only/single-sign-on.
Let's refine. If the POST cannot be removed, add test coverage.

Details

Taking a look at the bindings specified in the various metadata endpoints:
https://sa-gw.surfconext.nl/authentication/metadata

🟢 /authentication/consume-assertion

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sa-gw.surfconext.nl/authentication/consume-assertion" index="0"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep consume-assertion
  gateway_serviceprovider_consume_assertion           POST       /authentication/consume-assertion

Issue: None

🔴 /authentication/single-sign-on

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sa-gw.surfconext.nl/authentication/single-sign-on"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep single-sign-on   
  gateway_identityprovider_sso                        GET|POST   /authentication/single-sign-on                      
  gateway_identityprovider_sso_proxy                  POST       /authentication/single-sign-on/{idpKey}
...

Issue: The api route accepts both POST and GET requests. The metadata only accepts the HTTP-Redirect (GET) binding. If POST requests were to be sent to this endpoint, the behavior is unsupported.

---

https://sa-gw.surfconext.nl/second-factor-only/metadata

🔴 /second-factor-only/single-sign-on

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sa-gw.surfconext.nl/second-factor-only/single-sign-on"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep single-sign-on   
...                 
  gateway_second_factor_only_identityprovider_sso     GET|POST   /second-factor-only/single-sign-on

Issue: The api route accepts both POST and GET requests. The metadata only accepts the HTTP-Redirect (GET) binding.

---

https://sa-gw.surfconext.nl/gssp/tiqr/metadata

🟢 /gssp/tiqr/single-sign-on

<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://sa-gw.surfconext.nl/gssp/tiqr/single-sign-on"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep gssp             
  gssp_verify                                         GET        /gssp/{provider}/single-sign-on                     

🟢 /gssp/tiqr/consume-assertion

<md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://sa-gw.surfconext.nl/gssp/tiqr/consume-assertion" index="0"/>

root@gateway:/var/www/html# ./bin/console debug:route | grep gssp             
  gssp_consume_assertion                              POST       /gssp/{provider}/consume-assertion                  

Issue: None.

---

[MKodde]

Did some quick research:

GatewayController: sso action

https://github.com/OpenConext/Stepup-Gateway/blob/fb0f9f90e8fecc4eea0390d8c1ade5eeb49dcf8c/src/Surfnet/StepupGateway/GatewayBundle/Controller/GatewayController.php#L69

Only uses redirect binding to handle a SSO request. As can be seen in this method of the underlying LoginService:

https://github.com/OpenConext/Stepup-Gateway/blob/cdd2d9b08b86127c6740539c37077a42bf3a8db4/src/Surfnet/StepupGateway/GatewayBundle/Service/Gateway/LoginService.php#L94

SecondFactorOnlyController: sso action

Stepup-Gateway/src/Surfnet/StepupGateway/SecondFactorOnlyBundle/Controller/SecondFactorOnlyController.php

Line 77 in 2712a30

$originalRequest = $secondFactorLoginService->handleBinding($httpRequest);

The SFO controller however is more flexible, and can handle both POST and Redirect binding. It uses a binding factory from the stepup saml bundle to determine what strategy to use.

https://github.com/OpenConext/Stepup-Gateway/blob/7f8abca814812e26fa3ce2b7b906d71a3d08db12/src/Surfnet/StepupGateway/SecondFactorOnlyBundle/Service/Gateway/LoginService.php#L81

Does the regular SSO action also need to work binding 'agnostic', so should it support both POST and Redirect binding?