From 24bdf919b2148617554b12ddb7094f454ed0f785 Mon Sep 17 00:00:00 2001
From: Dane Powell <git@danepowell.com>
Date: Thu, 15 Jun 2017 14:57:33 -0700
Subject: [PATCH] Issue #2886630 by Dane Powell: Added configurable redirect
 URL for unprovisioned users.

---
 config/install/simplesamlphp_auth.settings.yml | 1 +
 config/schema/simplesamlphp_auth.schema.yml    | 3 +++
 src/Form/BasicSettingsForm.php                 | 7 +++++++
 src/Service/SimplesamlphpDrupalAuth.php        | 3 ++-
 4 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/config/install/simplesamlphp_auth.settings.yml b/config/install/simplesamlphp_auth.settings.yml
index 0d57d52..2d370bc 100644
--- a/config/install/simplesamlphp_auth.settings.yml
+++ b/config/install/simplesamlphp_auth.settings.yml
@@ -11,6 +11,7 @@ role:
   population:
   eval_every_time: false
 register_users: true
+unprovisioned_goto_url:
 allow:
   set_drupal_pwd: true
   default_login: true
diff --git a/config/schema/simplesamlphp_auth.schema.yml b/config/schema/simplesamlphp_auth.schema.yml
index 241e859..d1382da 100644
--- a/config/schema/simplesamlphp_auth.schema.yml
+++ b/config/schema/simplesamlphp_auth.schema.yml
@@ -41,6 +41,9 @@ simplesamlphp_auth.settings:
     register_users:
       type: boolean
       label: 'Register users'
+    unprovisioned_goto_url:
+      type: string
+      label: 'Redirect unprovisioned users'
     allow:
       type: mapping
       label: 'Drupal authentication'
diff --git a/src/Form/BasicSettingsForm.php b/src/Form/BasicSettingsForm.php
index 3095fef..d276fdd 100644
--- a/src/Form/BasicSettingsForm.php
+++ b/src/Form/BasicSettingsForm.php
@@ -84,6 +84,12 @@ class BasicSettingsForm extends ConfigFormBase {
       '#default_value' => $config->get('register_users'),
       '#description' => $this->t('Determines whether or not the module should automatically create/register new Drupal accounts for users that authenticate using SimpleSAMLphp. Unless you\'ve done some custom work to provision Drupal accounts with the necessary authmap entries you will want this checked.<br /><br />NOTE: If unchecked each user must already have been provisioned a Drupal account correctly linked to the SAML authname attribute (e.g. by creating Drupal users with "Enable this user to leverage SAML authentication" checked). Otherwise they will receive a notice and be denied access.'),
     ];
+    $form['user_provisioning']['unprovisioned_goto_url'] = [
+      '#type' => 'textfield',
+      '#title' => $this->t('Redirect URL for unprovisioned users'),
+      '#default_value' => $config->get('unprovisioned_goto_url'),
+      '#description' => $this->t('Optionally, specific a URL for users to go to if their account is not provisioned'),
+    ];
 
     return parent::buildForm($form, $form_state);
   }
@@ -100,6 +106,7 @@ class BasicSettingsForm extends ConfigFormBase {
     $config->set('login_link_display_name', $form_state->getValue('login_link_display_name'));
     $config->set('debug', $form_state->getValue('debug'));
     $config->set('register_users', $form_state->getValue('register_users'));
+    $config->set('unprovisioned_goto_url', $form_state->getValue('unprovisioned_goto_url'));
     $config->set('header_no_cache', $form_state->getValue('header_no_cache'));
     $config->save();
   }
diff --git a/src/Service/SimplesamlphpDrupalAuth.php b/src/Service/SimplesamlphpDrupalAuth.php
index 4eaef22..51838c3 100644
--- a/src/Service/SimplesamlphpDrupalAuth.php
+++ b/src/Service/SimplesamlphpDrupalAuth.php
@@ -128,7 +128,8 @@ class SimplesamlphpDrupalAuth {
       // We're not allowed to register new users on the site through simpleSAML.
       // We let the user know about this and redirect to the user/login page.
       drupal_set_message(t("We are sorry. While you have successfully authenticated, you are not yet entitled to access this site. Please ask the site administrator to provision access for you."));
-      $this->simplesamlAuth->logout(base_path());
+      $logout_url = $this->config->get('unprovisioned_goto_url');
+      $this->simplesamlAuth->logout($logout_url);
 
       return FALSE;
     }
-- 
2.13.0