sk-eid / smart-id-php-client Goto Github PK

View Code? Open in Web Editor NEW

18.0 18.0 13.0 287 KB

License: MIT License

PHP 100.00%

smart-id-php-client's People

Contributors

Stargazers

Watchers

Forkers

snurges elkdata donrico mikk125 k12tech andrevka markas holystix aasaru pivkdn lapiy rkaalma

smart-id-php-client's Issues

Updated examples for version 2+

The version has been updated but the examples linked to in README (in the wiki) are out of date.

Client fails authentication validation on demo environment smart id certificates

Add Test CA root certificate to project, so validation won't fail on demo environment certificates

Unable to authenticate user

I'm not even trying to get the birthdate and I get the error when trying to authenticate the client.
This is the exception that comes externally from the request to SK - "Unable get birthdate from Latvian personal code 140400-2****"

Please Update Readme for version 2.0!!!

Especially interested in checking the session in the new version?

Binding Smart-ID calls to a specific interface

Since SK uses IP whitelisting to authorize SmartID requests, it's important that in case of multiple IP addresses/interfaces on a server the request is made from the right IP.

In PHP/curl, this can be achieved by setting:
curl_setopt($ch,CURLOPT_INTERFACE,'1.2.3.4');

Would there be a possibility to add a setInterface() method to Sk\SmartId\Client that would then be passed on to the requests that set the correct interface?

Unknown property exception "serialNumberHex" thrown when trying to authenticate user.

Hi! Tring to use this library results in an "Undefined property (serialNumberHex)" exception.

Preconditions

"sk-id-solutions/smart-id-php-client": "~1.0"
php: 7.0.17

Steps to reproduce

Use test environment (https://sid.demo.sk.ee/smart-id-rp/v1/)
call SmartIdAuthenticationResponse::authenticate() having the parameters correctly set
get the "Undefined property (serialNumberHex)" exception thrown.

When SmartIdAuthenticationResponse::getCertificateInstance() is called after AuthenticationRequestBuilder::authenticate() then a new AuthenticationCertificate() is called and PropertyMapper:fromArray() tries to map serialNumberHex as a class propery whitch does not exist. I personally see two solutions to this:

Ignore attributes that does not exist in the class with a simple is_property() check
Add the missing serialNumberHex property to the AuthenticationCertificate class

Thanks in advance.

PHP 8 - Method ReflectionParameter::getClass() is deprecated

PHP 8 throws an exception:

Method ReflectionParameter::getClass() is deprecated
vendor/sk-id-solutions/smart-id-php-client/src/Sk/SmartId/Api/Data/PropertyMapper.php(134)

SID Demo SSL key pinning changes have not reached to `packagist.org`

A new release to packagist.org would be great. The SID Demo SSL key pinning changes after v1.5.1 release have not reached there. Saves the other potential integrators a lot of time. Took me few hours to find out that the packagist and github latest do not match.

Fatal error: Uncaught Sk\SmartId\Exception\UserAccountNotFoundException

Lisage example "Example of configuring the client"
rida use Sk\SmartId\Exception\SmartIdException;

Non-blocking Smart-ID polling requests

Is there a way to use Smart-ID in the same way as Mobile-ID, making polling calls from the frontend?

Mobile-ID works so that:

We make a first API call to initialize the authentication/signing, get back either an error (such as user does not have Mobile ID enabled) or the verification code + session ID
We then make polling calls via frontend every N seconds until we get back either a successful response or a final error

Currently, all examples like https://github.com/SK-EID/smart-id-php-client/wiki/Examples-of-using-it have implemented it so that the verification code is generated (and can then be shown to the user) and then a call is made to authenticate(), which ends up in SessionStatusPoller::pollForFinalSessionStatus(), which in turn implements a while loop until it gets back a success, error or a timeout.

This implementation has a dew drawbacks:

At the time of calculating and showing the verification code to the user we don't really know yet if the user has Smart-ID at all. So if we show that to user and then make a followup Ajax call to init the blocking authenticate() call, the user will falsely see a "Success, your verification code is 1234" message for a brief moment.
Since the request is sitting in a while loop, this will block the PHP default file-based session until completed, so in case the user will hit reload, the following request will wait for the session file until the authenticate() call times out.

The SessionStatusPoller has all the methods needed to implement a Mobile-ID like solution, but they are all either private or protected, so cannot be called from the client implementation.

Is this intentional?

Error! Response is not valid! Error(s): Signature verification failed.

Hello there.

So basically I use 2 calls to identify a customer

1st I call session id with startAuthenticationAndReturnSessionId and semanticsIdentifier
Then continuously i check for session with createSessionStatusFetcher but when i get response and i try to validate it with authenticationResponseValidator i get runtime exception

An uncaught Exception was encountered
Type: RuntimeException
Message: Error! Response is not valid! Error(s): Signature verification failed.

And $authenticationResponse->getDocumentNumber() is empty

Path to trusted certificates is defined and when i use authenticate method everything is working correctly

For me it seems strange when i try to validate the session no the user i get issue with this

Thanks

Add HTTPS Pinning

Smart ID documentation covers HTTPS pinning. Unfortunately it is a little bit tricky and would be nice to have in this package.

I see that @andrevka has created a pullrequest #18 to address the issue. It is create work but has one drawback. It breaks the backward compatibility. Currently package supports PHP >= 5.6 but with proposed pull request the new minimum requirement is >= 7.0.7

I had an idea how to make it work even with PHP 5.6 and created a branch for this development: https://github.com/raigu/smart-id-php-client/commits/pinning

I have a question for maintainer. Is it important to keep backward compatibility? If yes, should I continue with the referred branch?

My proposed package is not finished. I made this issue to share my thought with @andrevka and maintainer and see if we have mutual interests and can cooperate. What I have not done yet:

documentation with samples
simplified keys (currently uses PEM but I see @andrevka has used hases, it is shorter)
think through how to avoid conditional statements in end application when switching between production and demo environment
if detected PHP > 7.0.7 environment then use curl's native pinning functionality

Will wait feedback from maintainer or @andrevka. If there is interest I/we can continue.

SessionStatus - interactionFlowUsed is not set.

Hi!

I updated to version 2.2 and after some modifications I got stuck with following error:

Uncaught TypeError: Return value of Sk\SmartId\Api\Data\SessionStatus::getInteractionFlowUsed() must be of the type string, null returned in ../sk-id-solutions/smart-id-php-client/src/Sk/SmartId/Api/Data/SessionStatus.php:154

My authenticate code is as follows:

$authenticationResponse = $client->authentication()
  ->createAuthentication()
  ->withSemanticsIdentifier( $identity )
  ->withAuthenticationHash( $authenticationHash )
  ->withAllowedInteractionsOrder([Interaction::ofTypeDisplayTextAndPIN("Text and pin")])
  ->withCertificateLevel( CertificateLevelCode::QUALIFIED )
  ->authenticate();

If I add
private $interactionFlowUsed = "displayTextAndPin";
as default to SessionStatus class, it works.

isCertificateTrusted fails

not sure if this is a bug or not but when using this library against the Demo environment @ https://sid.demo.sk.ee/smart-id-rp/v1/
the method \Sk\SmartId\Api\AuthenticationResponseValidator::isCertificateTrusted will fail

when replacing this foreach loop

foreach ( $this->trustedCACertificates as $trustedCACertificate )
    {
      if ( $this->verifyTrustedCACertificate( $certificateAsResource, $trustedCACertificate ) === true )
      {
        return true;
      }
    }

with the following code, will work and return true

if ( openssl_x509_checkpurpose( $certificateAsResource, X509_PURPOSE_ANY, $this->trustedCACertificates ) === true ) {
    return true;
}

why is there a foreach loop anyway when the openssl_x509_checkpurpose can handle a path to certificates or an array of certificate paths

the certificates in use are

TEST_of_EE_Certification_Centre_Root_CA.pem.crt
TEST_of_EID-SK_2016.pem.crt
TEST_of_NQ-SK_2016.pem.crt

certificate returned from smart-id is

SemanticsIdentifier fails with LV personal code

Hi. My team is currently trying to implement SmartId authentication but he have run into a problem with SemanticsIdentifier and LV (Latvia) personal codes.
Sk\SmartId\Api\Data\SemanticsIdentifier validate function wants $semanticsIdentifier to match this regex: /^[A-Z]{5}-[a-zA-Z\d]{5,30}$/ but this regex doesn't match LV code.

For example, taking this LV code 030303-10012 (demo account code) and PNO type, validation expects PNOLV-03030310012, but in reallity it is PNOLV-030303-10012 which fails. Going with PNOLV-03030310012 is not an option as that fails later on with user not found exception (as expected).

For now we are going with extending validate on our end to match LV code, but I think this should be fixed here. Or at least some config parameter added so this regex could be overwritten without extension.