<?php
/**
 * This authentication processing filter allows you to add a second step
 * authentication against privacyIDEA
 *
 * @author Cornelius Kölbel <cornelius.koelbel@netknights.it>
 */



class privacyidea extends \SimpleSAML_Auth_ProcessingFilter
{
    /**
     * The URL of the privacyIDEA system
     *
     * @var string
     */
    private $privacyIDEA_URL;

    /**
     * Check if the hostname matches the name in the certificate
     * @var boolean
     */

    private $sslverifyhost;

    /**
     * Check if the certificate is valid, signed by a trusted CA
     * @var boolean
     */
    private $sslverifypeer;

    /**
     * The realm where the user is located in.
     * @var string
     */
    private $realm;

    /**
     * OTP Extra
     * 0: (default) one password field for PIN and OTP
     * 1: Password field for password and extra field for OTP
     * @var integer
     */
    private $otpextra;

    /**
     * Per se we do not need an attributemap, since all attributes are
     * usually set by the authsource
     */

    /**
     * privacyidea constructor.
     *
     * @param array $config The configuration of this authproc.
     * @param mixed $reserved
     *
     * @throws \SimpleSAML\Error\CriticalConfigurationError in case the configuration is wrong.
     */

     public function __construct(array $config, $reserved)
     {
        parent::__construct($config, $reserved);
        $cfg = \SimpleSAML_Configuration::loadFromArray($config, 'privacyidea:privacyidea');
        $this->privacyIDEA_URL = $cfg->getString('privacyideaserver');
        $this->sslverifyhost = $cfg->getBoolean('sslverifyhost', true);
        $this->sslverifypeer = $cfg->getBoolean('sslverifypeer', true);
        $this->realm = $cfg->getString('realm');
        $this->otpextra = int($cfg->getString('otpextra'), 0);
     }

    /**
     * Run the filter.
     *
     * @param array $state
     *
     * @throws \Exception if authentication fails
     */
    public function process(&$state)
    {
        // See: https://simplesamlphp.org/docs/stable/simplesamlphp-authproc#section_3
        // The process(&$request)-function must be implemented. If this function completes,
        // it is assumed that processing is completed, and that the $request array has been updated.
    }

    /**
     * Perform 2FA authentication given the current state and an OTP from a token managed by privacyIDEA
     * The otp is sent to the privacyidea_url.
     *
     * @param array $state The state array in the "privacyidea:privacyidea:init" stage.
     * @param string $otp A one time password generated by a yubikey.
     * @return boolean True if authentication succeeded and the key belongs to the user, false otherwise.
     *
     * @throws \InvalidArgumentException if the state array is not in a valid stage or the given OTP has incorrect
     * length.
     */

    public static function authenticate(array &$state, $otp)
    {
        // TODO
    }
}
Add the Auth Processing Filter sḱeleton
Add the Auth Processing Filter sḱeleton
