Add per-SP WAYF remember-choice core

Introduce the backend core for remembering a user's chosen IdP on a
per-SP basis, gated behind two independent opt-ins: an EngineBlock-wide
config flag and the SP's own Manage metadata coin. This replaces, for
opted-in SPs, the existing single global "remember choice" cookie with
a signed-per-entry cookie keyed by SP entityId, so different SPs can
have independent (and independently expiring) remembered IdPs.

Only true/"1" values for the SP metadata coin enable the feature for
that SP; any other value (including "false" or "-1") leaves it
disabled, so a malformed Manage value can never silently turn on
choice-remembering behaviour.

- Coins/ServiceProvider/PushMetadataAssembler gain the
  wayf_remember_choice coin (metadata:coin:wayf_remember_choice),
  defaulting to false and parsed with strict true-only semantics.
- RememberedIdpCookie encodes/decodes the "rememberedidps" cookie
  (deflate + base64 JSON, one {idp, expires} entry per SP entityId),
  validates entry shape defensively, drops expired entries on every
  read, and prunes down to a configurable maximum (keeping the
  highest-expiry entries) only when a new entry is added.
- DiContainerRuntime/EngineBlockBootstrapper bridge the new cookie
  service and the per-SP feature flag into the legacy Corto layer.
- SingleSignOn bypasses WAYF using a remembered IdP when the SP has
  opted in and the choice is still valid for one of the candidate
  IdPs, preserving the existing zero/one-candidate and SSO-notification
  shortcuts; the legacy global "rememberchoice" cookie path is now
  gated off for SPs using the new per-SP mode instead of double-firing.
- ContinueToIdp persists a checked "remember this choice" selection
  into the cookie and normalizes/prunes it on every request regardless
  of whether this SP is enrolled, so stale entries age out naturally.
- The WAYF view model, Twig templates and rememberChoice.js are wired
  so the per-SP checkbox submits a hidden form field instead of writing
  a client-side cookie, leaving the legacy global-cookie behaviour
  untouched for SPs that haven't opted in.

Refs: #2065

Author: kayjoosten

config/packages/parameters.yml.dist

@@ -182,6 +182,12 @@ parameters:
 
     ## Allow users to save their selected IdP and then auto-select it on returning visits.
     wayf.remember_choice: false
+    ## Allow SPs to opt in to remembered IdP choices scoped per SP through Manage metadata.
+    wayf.remember_choice_per_idp: false
+    ## Lifetime for remembered IdP choices scoped per SP, in seconds.
+    wayf.remember_choice_per_idp_lifetime: 7776000
+    ## Maximum number of remembered IdP choice entries to retain per SP.
+    wayf.remember_choice_per_idp_max: 16
 
     ## Toggle the default IdP quick link banner on the WAYF.
     wayf.display_default_idp_banner_on_wayf: true

config/services/services.yml

@@ -15,6 +15,7 @@ services:
         autowire: true
         autoconfigure: true
         arguments:
+            $rememberChoicePerIdp: '%wayf.remember_choice_per_idp%'
             $preferredIdpEntityIds: '%wayf.preferred_idp_entity_ids%'
         tags:
             - { name: kernel.event_subscriber }
@@ -173,6 +174,15 @@ services:
 
     OpenConext\EngineBlock\Service\CookieService:
 
+    OpenConext\EngineBlock\Service\Wayf\RememberedIdpCookie:
+        autowire: true
+        arguments:
+            $lifetime: '%wayf.remember_choice_per_idp_lifetime%'
+            $maxEntries: '%wayf.remember_choice_per_idp_max%'
+            $cookieDomain: '%hostname%'
+            $cookiePath: '%cookie.path%'
+            $secure: '%cookie.secure%'
+
     OpenConext\EngineBlock\Metadata\Factory\Factory\ServiceProviderFactory:
         arguments:
             - '@engineblock.compat.metadata.definitions'

library/EngineBlock/Corto/Module/Service/ContinueToIdp.php

@@ -19,6 +19,7 @@
 use OpenConext\EngineBlock\Metadata\Entity\ServiceProvider;
 use OpenConext\EngineBlock\Metadata\Factory\Factory\ServiceProviderFactory;
 use OpenConext\EngineBlock\Metadata\X509\KeyPairFactory;
+use OpenConext\EngineBlock\Service\Wayf\RememberedIdpCookie;
 use Symfony\Component\HttpFoundation\Request;
 use Twig\Environment;
 
@@ -113,9 +114,62 @@ public function serve($serviceName, Request $httpRequest)
             $log->info('Raw HTTP request', array('http_request' => (string) $application->getHttpRequest()));
         }
 
+        $this->_persistRememberedChoice($sp, $idp, $httpRequest->request->get('rememberChoice'));
+
         $this->_server->sendAuthenticationRequest($request, $selectedIdp);
     }
 
+    /**
+     * Normalizes the 'rememberedidps' cookie and, when the checkbox was checked and the per-SP
+     * remember-choice feature is enabled for both EngineBlock and the SP, persists the (SP, IdP)
+     * choice in it.
+     *
+     * @param ServiceProvider $sp
+     * @param mixed $idp
+     * @param string|null $rememberChoice
+     */
+    private function _persistRememberedChoice(ServiceProvider $sp, $idp, $rememberChoice)
+    {
+        $application = EngineBlock_ApplicationSingleton::getInstance();
+        $container = $application->getDiContainer();
+        $runtime = $application->getDiContainerRuntime();
+        $log = $this->_server->getLogger();
+
+        $rememberedIdpCookie = $runtime->rememberedIdpCookie;
+
+        $raw = $container->getSymfonyRequest()->cookies->get(RememberedIdpCookie::NAME);
+        $entries = $rememberedIdpCookie->loadValidEntries($raw, $log);
+
+        if ($rememberChoice !== '1') {
+            return;
+        }
+
+        if (!RememberedIdpCookie::isEnabledForServiceProvider(
+            $container->getRememberChoice() === true,
+            $runtime->isRememberChoicePerIdpEnabled(),
+            $sp
+        )) {
+            return;
+        }
+
+        $result = $rememberedIdpCookie->add($entries, $sp->entityId, $idp->entityId);
+        $rememberedIdpCookie->write($result['entries'], $result['expires']);
+
+        $log->info(sprintf(
+            'WAYF-remember-my-choice set for SP %s and IdP %s and expiry %d',
+            $sp->entityId,
+            $idp->entityId,
+            $result['expires']
+        ));
+
+        if ($result['dropped'] > 0) {
+            $log->info(sprintf(
+                'WAYF-remember-my-choice %d entities dropped from cookie',
+                $result['dropped']
+            ));
+        }
+    }
+
     /**
      * @param EngineBlock_Corto_ProxyServer $proxyServer
      * @return ServiceProvider

library/EngineBlock/Corto/Module/Service/SingleSignOn.php

@@ -20,7 +20,9 @@
 use OpenConext\EngineBlock\Metadata\Factory\Factory\ServiceProviderFactory;
 use OpenConext\EngineBlock\Metadata\Discovery;
 use OpenConext\EngineBlock\Metadata\X509\KeyPairFactory;
+use OpenConext\EngineBlock\Service\Wayf\RememberedIdpCookie;
 use OpenConext\EngineBlock\Service\Wayf\WayfIdp;
+use OpenConext\EngineBlockBundle\Bridge\DiContainerRuntime;
 use OpenConext\EngineBlockBundle\Service\DiscoverySelectionService;
 use SAML2\AuthnRequest;
 use SAML2\Constants;
@@ -221,7 +223,17 @@ public function serve($serviceName, Request $httpRequest)
         }
 
         // Auto-select IdP when 'wayf.rememberChoice' feature is enabled and is allowed for the current request
-        if (($container->getRememberChoice() === true) && !($request->getForceAuthn() || $request->isDebugRequest())) {
+        $runtime = $application->getDiContainerRuntime();
+        if ($this->_sendAuthenticationRequestForRememberedIdpPerServiceProvider($request, $sp, $candidateIDPs)) {
+            return;
+        }
+
+        // Auto-select IdP when 'wayf.rememberChoice' feature is enabled and is allowed for the current request,
+        // and the per-SP remembered-choice feature is not enabled.
+        if ($container->getRememberChoice() === true
+            && $runtime->isRememberChoicePerIdpEnabled() === false
+            && !($request->getForceAuthn() || $request->isDebugRequest())
+        ) {
             $cookies = $container->getSymfonyRequest()->cookies->all();
             if (array_key_exists('rememberchoice', $cookies)) {
                 $remembered = json_decode($cookies['rememberchoice']);
@@ -457,6 +469,64 @@ protected function _limitScopeToRememberedIdp(
         return $scopedIdps;
     }
 
+    /**
+     * @param string[] $candidateIDPs
+     */
+    protected function _sendAuthenticationRequestForRememberedIdpPerServiceProvider(
+        EngineBlock_Saml2_AuthnRequestAnnotationDecorator $request,
+        ServiceProvider $sp,
+        array $candidateIDPs
+    ): bool {
+        $application = EngineBlock_ApplicationSingleton::getInstance();
+        $container = $application->getDiContainer();
+        $runtime = $application->getDiContainerRuntime();
+        $log = $this->_server->getLogger();
+
+        if (!RememberedIdpCookie::isEnabledForServiceProvider(
+            $container->getRememberChoice() === true,
+            $runtime->isRememberChoicePerIdpEnabled(),
+            $sp
+        )
+            || $request->getForceAuthn()
+            || $request->isDebugRequest()
+        ) {
+            return false;
+        }
+
+        $rememberedIdp = $this->_findRememberedIdpForServiceProvider($runtime, $sp->entityId, $candidateIDPs);
+        if ($rememberedIdp === null) {
+            return false;
+        }
+
+        $log->info(sprintf(
+            'WAYF-remember-my-choice  WAYF skipped for %s because of preselected %s',
+            $sp->entityId,
+            $rememberedIdp
+        ));
+        $this->_server->sendAuthenticationRequest($request, $rememberedIdp);
+
+        return true;
+    }
+
+    /**
+     * @param string[] $candidateIdpEntityIds
+     */
+    protected function _findRememberedIdpForServiceProvider(
+        DiContainerRuntime $runtime,
+        string $serviceProviderEntityId,
+        array $candidateIdpEntityIds
+    ): ?string {
+        $rememberedIdpCookie = $runtime->rememberedIdpCookie;
+        $log = $this->_server->getLogger();
+
+        $raw = EngineBlock_ApplicationSingleton::getInstance()->getDiContainer()
+            ->getSymfonyRequest()->cookies->get(RememberedIdpCookie::NAME);
+
+        $entries = $rememberedIdpCookie->loadValidEntries($raw, $log);
+
+        return $rememberedIdpCookie->find($entries, $serviceProviderEntityId, $candidateIdpEntityIds);
+    }
+
     protected function _showWayf(EngineBlock_Saml2_AuthnRequestAnnotationDecorator $request, array $candidateIdpEntityIds)
     {
         // Post to the 'continueToIdp' service
@@ -482,6 +552,22 @@ protected function _showWayf(EngineBlock_Saml2_AuthnRequestAnnotationDecorator $
 
         $diContainerRuntime = $application->getDiContainerRuntime();
 
+        // The per-SP remember-choice mode is only authoritative when the global feature, the
+        // EngineBlock-wide per-SP flag and the SP's own metadata coin are all enabled. Otherwise
+        // the legacy global 'rememberchoice' cookie behaviour (below) applies unchanged.
+        $isRememberChoicePerIdpEnabled = $diContainerRuntime->isRememberChoicePerIdpEnabled();
+        $rememberChoicePerIdp = RememberedIdpCookie::isEnabledForServiceProvider(
+            $container->getRememberChoice() === true,
+            $isRememberChoicePerIdpEnabled,
+            $serviceProvider
+        );
+
+        // While per-SP mode is active, an opted-out SP must not fall back to the legacy global
+        // cookie feature: rememberChoiceFeature mirrors rememberChoicePerIdp in that case.
+        $rememberChoiceFeature = $isRememberChoicePerIdpEnabled
+            ? $rememberChoicePerIdp
+            : $container->getRememberChoice();
+
         $output = $diContainerRuntime->wayfRenderer->render(
             idpList: $idpList,
             preferredIdpEntityIds: $diContainerRuntime->getPreferredIdpEntityIds(),
@@ -491,10 +577,11 @@ protected function _showWayf(EngineBlock_Saml2_AuthnRequestAnnotationDecorator $
             shouldDisplayBanner: (bool) $container->shouldDisplayDefaultIdpBannerOnWayf(),
             backLink: $container->isUiOptionReturnToSpActive(),
             cutoffPoint: $container->getCutoffPointForShowingUnfilteredIdps(),
-            rememberChoice: $container->getRememberChoice(),
+            rememberChoice: $rememberChoiceFeature,
             showRequestAccess: $serviceProvider->getCoins()->displayUnconnectedIdpsWayf(),
             requestId: $request->getId(),
             serviceProvider: $serviceProvider,
+            rememberChoicePerIdp: $rememberChoicePerIdp,
         );
         $this->_server->sendOutput($output);
     }

src/OpenConext/EngineBlock/Metadata/Coins.php

@@ -45,7 +45,8 @@ public static function createForServiceProvider(
         $additionalLogging,
         $signatureMethod,
         $stepupForceAuthn,
-        $collabEnabled
+        $collabEnabled,
+        bool $wayfRememberChoice = false
     ) {
         return new self([
             'isConsentRequired' => $isConsentRequired,
@@ -64,6 +65,7 @@ public static function createForServiceProvider(
             'stepupRequireLoa' => $stepupRequireLoa,
             'stepupForceAuthn' => $stepupForceAuthn,
             'collabEnabled' => $collabEnabled,
+            'wayfRememberChoice' => $wayfRememberChoice,
         ]);
     }
 
@@ -153,6 +155,11 @@ public function displayUnconnectedIdpsWayf()
         return $this->getValue('displayUnconnectedIdpsWayf', false);
     }
 
+    public function wayfRememberChoice(): bool
+    {
+        return $this->getValue('wayfRememberChoice', false) === true;
+    }
+
     public function termsOfServiceUrl()
     {
         return $this->getValue('termsOfServiceUrl');

src/OpenConext/EngineBlock/Metadata/Entity/Assembler/PushMetadataAssembler.php

@@ -220,6 +220,11 @@ private function assembleSp(stdClass $connection)
         $properties += $this->setPathFromObjectBool([$connection, 'metadata:coin:transparant_issuer'], 'isTransparentIssuer');
         $properties += $this->setPathFromObjectBool([$connection, 'metadata:coin:trusted_proxy'], 'isTrustedProxy');
         $properties += $this->setPathFromObjectBool([$connection, 'metadata:coin:display_unconnected_idps_wayf'], 'displayUnconnectedIdpsWayf');
+        $properties += $this->setPathFromObjectBool(
+            [$connection, 'metadata:coin:wayf_remember_choice'],
+            'wayfRememberChoice',
+            strictTrueOnly: true
+        );
 
         $properties += $this->assembleIsConsentRequired($connection);
 
@@ -450,12 +455,15 @@ private function setPathFromObjectArray(array $from, string $to): array
         return array($to => $reference);
     }
 
-    private function setPathFromObjectBool(array $from, string $to): array
+    private function setPathFromObjectBool(array $from, string $to, bool $strictTrueOnly = false): array
     {
         $reference = $this->getValueFromPath($from);
         if (is_null($reference)) {
             return array($to => null);
         }
+        if ($strictTrueOnly) {
+            return array($to => $reference === true || $reference === '1');
+        }
         return array($to => (bool)$reference);
     }
 

src/OpenConext/EngineBlock/Metadata/Entity/ServiceProvider.php

@@ -152,7 +152,8 @@ public function __construct(
         ?bool $stepupAllowNoToken = null,
         ?string $stepupRequireLoa = null,
         bool $stepupForceAuthn = false,
-        bool $collabEnabled = false
+        bool $collabEnabled = false,
+        bool $wayfRememberChoice = false
     ) {
         if (is_null($mdui)) {
             $mdui = Mdui::emptyMdui();
@@ -211,7 +212,8 @@ public function __construct(
             $additionalLogging,
             $signatureMethod,
             $stepupForceAuthn,
-            $collabEnabled
+            $collabEnabled,
+            $wayfRememberChoice
         );
     }
 

src/OpenConext/EngineBlock/Service/CookieService.php

@@ -47,6 +47,26 @@ public function setCookie(
         return setcookie($name, $value, $expire, $path, $domain, $secure, $httpOnly);
     }
 
+    public function setCookieWithSameSite(
+        string $name,
+        $value,
+        int    $expire,
+        string $path,
+        string $domain,
+        bool   $secure = true,
+        bool   $httpOnly = true,
+        string $sameSite = 'None'
+    ): bool {
+        return setcookie($name, $value, [
+            'expires' => $expire,
+            'path' => $path,
+            'domain' => $domain,
+            'secure' => $secure,
+            'httponly' => $httpOnly,
+            'samesite' => $sameSite,
+        ]);
+    }
+
     /**
      * Clears the cookie for the specified name, path and domain.
      *
@@ -66,4 +86,22 @@ public function clearCookie(
     ): bool {
         return setcookie($name, '', -1, $path, $domain, $secure, $httpOnly);
     }
+
+    public function clearCookieWithSameSite(
+        string $name,
+        string $path,
+        string $domain,
+        bool   $secure = true,
+        bool   $httpOnly = true,
+        string $sameSite = 'None'
+    ): bool {
+        return setcookie($name, '', [
+            'expires' => -1,
+            'path' => $path,
+            'domain' => $domain,
+            'secure' => $secure,
+            'httponly' => $httpOnly,
+            'samesite' => $sameSite,
+        ]);
+    }
 }