Add support for SSO errors coming from the API

Author: eiriksm

lib/Github/Exception/SsoRequiredException.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace Github\Exception;
+
+/**
+ * SsoRequiredException.
+ */
+class SsoRequiredException extends RuntimeException
+{
+    private $url;
+
+    public function __construct($url, $code = 0, $previous = null)
+    {
+        $this->url = $url;
+
+        parent::__construct('Resource protected by organization SAML enforcement. You must grant your personal token access to this organization.', $code, $previous);
+    }
+
+
+    public function getUrl()
+    {
+        return $this->url;
+    }
+
+}

lib/Github/HttpClient/Plugin/GithubExceptionThrower.php

@@ -5,6 +5,7 @@
 use Github\Exception\ApiLimitExceedException;
 use Github\Exception\ErrorException;
 use Github\Exception\RuntimeException;
+use Github\Exception\SsoRequiredException;
 use Github\Exception\TwoFactorAuthenticationRequiredException;
 use Github\Exception\ValidationFailedException;
 use Github\HttpClient\Message\ResponseMediator;
@@ -103,6 +104,16 @@ public function doHandleRequest(RequestInterface $request, callable $next, calla
                 throw new RuntimeException(implode(', ', $errors), 502);
             }
 
+            if ((403 === $response->getStatusCode()) && $response->hasHeader('X-GitHub-SSO') && 0 === strpos((string) ResponseMediator::getHeader($response, 'X-GitHub-SSO'), 'required;')) {
+                // The header will look something like this:
+                // required; url=https://github.com/orgs/octodocs-test/sso?authorization_request=AZSCKtL4U8yX1H3sCQIVnVgmjmon5fWxks5YrqhJgah0b2tlbl9pZM4EuMz4
+                // So we strip out the first 14 characters, leaving only the URL.
+                // @see https://developer.github.com/v3/auth/#authenticating-for-saml-sso
+                $url = substr((string) ResponseMediator::getHeader($response, 'X-GitHub-SSO'), 14);
+
+                throw new SsoRequiredException($url);
+            }
+
             throw new RuntimeException(isset($content['message']) ? $content['message'] : $content, $response->getStatusCode());
         });
     }