From 5005ea59c829330650dbed67d161c713b1c366cb Mon Sep 17 00:00:00 2001 From: jekuaitk Date: Tue, 14 Jul 2026 15:31:22 +0200 Subject: [PATCH 1/2] Resolved configured auth provider plugin --- CHANGELOG.md | 4 ++ os2forms_nemlogin_openid_connect.services.yml | 3 +- .../OrganisationEventSubscriber.php | 24 +++++---- src/Helper/WebformHelper.php | 53 ++++++++++++++++--- 4 files changed, 66 insertions(+), 18 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f5cdf48..4f7bd44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,10 @@ and this project adheres to [Semantic Versioning](http://semver.org/). ## [Unreleased] +* Resolved auth provider plugin from webform NemID settings (`session_type`) + instead of always using the site-wide active plugin when setting + organisation user id and when checking webform access. + ## [2.5.0] 2026-07-14 * Use unique token keys for OIDC providers. diff --git a/os2forms_nemlogin_openid_connect.services.yml b/os2forms_nemlogin_openid_connect.services.yml index 089c13d..95357d0 100644 --- a/os2forms_nemlogin_openid_connect.services.yml +++ b/os2forms_nemlogin_openid_connect.services.yml @@ -9,6 +9,7 @@ services: - '@os2web_nemlogin.auth_provider' - '@messenger' - '@current_route_match' + - '@webform.request' Drupal\os2forms_nemlogin_openid_connect\Helper\Settings: arguments: @@ -16,6 +17,6 @@ services: Drupal\os2forms_nemlogin_openid_connect\EventSubscriber\OrganisationEventSubscriber: arguments: - - '@os2web_nemlogin.auth_provider' + - '@Drupal\os2forms_nemlogin_openid_connect\Helper\WebformHelper' tags: - { name: 'event_subscriber' } diff --git a/src/EventSubscriber/OrganisationEventSubscriber.php b/src/EventSubscriber/OrganisationEventSubscriber.php index 2089c82..7951975 100644 --- a/src/EventSubscriber/OrganisationEventSubscriber.php +++ b/src/EventSubscriber/OrganisationEventSubscriber.php @@ -3,8 +3,8 @@ namespace Drupal\os2forms_nemlogin_openid_connect\EventSubscriber; use Drupal\Component\Plugin\Exception\PluginException; +use Drupal\os2forms_nemlogin_openid_connect\Helper\WebformHelper; use Drupal\os2forms_organisation\Event\OrganisationUserIdEvent; -use Drupal\os2web_nemlogin\Service\AuthProviderService; use Symfony\Component\EventDispatcher\EventSubscriberInterface; /** @@ -13,17 +13,17 @@ class OrganisationEventSubscriber implements EventSubscriberInterface { /** - * The OS2Web Nemlogin authorization provider. + * The webform helper. * - * @var \Drupal\os2web_nemlogin\Service\AuthProviderService + * @var \Drupal\os2forms_nemlogin_openid_connect\Helper\WebformHelper */ - protected AuthProviderService $authProvider; + protected WebformHelper $webformHelper; /** * The constructor. */ - public function __construct(AuthProviderService $authProvider) { - $this->authProvider = $authProvider; + public function __construct(WebformHelper $webformHelper) { + $this->webformHelper = $webformHelper; } /** @@ -54,11 +54,15 @@ public function setOrganisationUserId(OrganisationUserIdEvent $event): void { } try { - $plugin = $this->authProvider->getActivePlugin(); + // Use the plugin configured on the current webform. + $plugin = $this->webformHelper->getAuthProviderPlugin(); - if ($plugin->isAuthenticated() && !empty($plugin->fetchValue('nameidentifier'))) { - /* @phpstan-ignore-next-line */ - $event->setUserId($plugin->fetchValue('nameidentifier')); + if ($plugin->isAuthenticated()) { + $userId = $plugin->fetchValue('nameidentifier'); + if (!empty($userId)) { + /* @phpstan-ignore-next-line */ + $event->setUserId($userId); + } } } catch (PluginException $exception) { diff --git a/src/Helper/WebformHelper.php b/src/Helper/WebformHelper.php index 34fea1a..5432b0c 100644 --- a/src/Helper/WebformHelper.php +++ b/src/Helper/WebformHelper.php @@ -6,9 +6,11 @@ use Drupal\Core\Messenger\MessengerInterface; use Drupal\Core\Routing\RouteMatchInterface; use Drupal\Core\StringTranslation\StringTranslationTrait; +use Drupal\os2web_nemlogin\Plugin\AuthProviderInterface; use Drupal\os2web_nemlogin\Service\AuthProviderService; use Drupal\webform\Utility\WebformFormHelper; use Drupal\webform\WebformInterface; +use Drupal\webform\WebformRequestInterface; use Drupal\webform\WebformSubmissionInterface; use Symfony\Component\Yaml\Yaml; @@ -41,13 +43,47 @@ class WebformHelper { */ private RouteMatchInterface $routeMatch; + /** + * The webform request handler. + * + * @var \Drupal\webform\WebformRequestInterface + */ + private WebformRequestInterface $webformRequest; + /** * Constructor. */ - public function __construct(AuthProviderService $authProviderService, MessengerInterface $messenger, RouteMatchInterface $routeMatch) { + public function __construct(AuthProviderService $authProviderService, MessengerInterface $messenger, RouteMatchInterface $routeMatch, WebformRequestInterface $webformRequest) { $this->authProviderService = $authProviderService; $this->messenger = $messenger; $this->routeMatch = $routeMatch; + $this->webformRequest = $webformRequest; + } + + /** + * Get auth provider plugin for a webform. + * + * Resolves the plugin from the webform's NemID settings (session_type), + * matching how os2forms_nemid resolves the plugin used for logging in, and + * falls back to the site-wide active plugin. + * + * @param \Drupal\webform\WebformInterface|null $webform + * The webform. If not set, the webform of the current request, if any, is + * used. + * + * @return \Drupal\os2web_nemlogin\Plugin\AuthProviderInterface + * The auth provider plugin. + * + * @throws \Drupal\Component\Plugin\Exception\PluginException + */ + public function getAuthProviderPlugin(?WebformInterface $webform = NULL): AuthProviderInterface { + $webform ??= $this->webformRequest->getCurrentWebform(); + $settings = $webform?->getThirdPartySetting('os2forms', 'os2forms_nemid'); + $sessionType = $settings['session_type'] ?? NULL; + + return !empty($sessionType) + ? $this->authProviderService->getPluginInstance($sessionType) + : $this->authProviderService->getActivePlugin(); } /** @@ -131,7 +167,7 @@ private function checkAccess(WebformSubmissionInterface $webformSubmission, stri $elementKey = $settings['element_key']; $userClaim = $settings['user_claim']; - $plugin = $this->authProviderService->getActivePlugin(); + $plugin = $this->getAuthProviderPlugin($webform); if (!$plugin->isAuthenticated()) { return (string) $this->t('Not authenticated'); } @@ -163,7 +199,7 @@ public function webformThirdPartySettingsFormAlter(array &$form, FormStateInterf $webform = $formObject->getEntity(); $settings = $webform->getThirdPartySetting('os2forms', 'os2forms_nemid'); - $options = $this->getUserClaimOptions(); + $options = $this->getUserClaimOptions($webform); $form['third_party_settings']['os2forms']['os2forms_nemid']['os2forms_nemlogin_openid_connect']['authentication_settings'] = [ '#type' => 'fieldset', @@ -216,16 +252,19 @@ public function webformThirdPartySettingsFormAlter(array &$form, FormStateInterf /** * Get user claim options. * + * @param \Drupal\webform\WebformInterface $webform + * The webform. + * * @return array * The user claim options. * * @phpstan-return array */ - private function getUserClaimOptions(): array { - $plugin = $this->authProviderService->getActivePlugin(); - $claims = $plugin->getConfiguration()['nemlogin_openid_connect_user_claims'] ?? ''; - + private function getUserClaimOptions(WebformInterface $webform): array { try { + $plugin = $this->getAuthProviderPlugin($webform); + $claims = $plugin->getConfiguration()['nemlogin_openid_connect_user_claims'] ?? ''; + $value = Yaml::parse($claims); if (is_array($value)) { asort($value); From b86fdd325b4979e51570ea9115e8e6dca3b98d94 Mon Sep 17 00:00:00 2001 From: jekuaitk Date: Thu, 16 Jul 2026 09:55:38 +0200 Subject: [PATCH 2/2] Release 2.5.1 --- CHANGELOG.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4f7bd44..bcb34ec 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/). ## [Unreleased] +## [2.5.1] 2026-07-16 + * Resolved auth provider plugin from webform NemID settings (`session_type`) instead of always using the site-wide active plugin when setting organisation user id and when checking webform access. @@ -57,7 +59,8 @@ and this project adheres to [Semantic Versioning](http://semver.org/). * Allowed multiple providers. -[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.0...HEAD +[Unreleased]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.1...HEAD +[2.5.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.5.0...2.5.1 [2.5.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.1...2.5.0 [2.4.1]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.4.0...2.4.1 [2.4.0]: https://github.com/itk-dev/os2forms_nemlogin_openid_connect/compare/2.3.1...2.4.0