Skip to content

Commit 20984fa

Browse files
pitbulkpitbulk
committed
Update php-saml library to 2.10.0
1 parent b5d35c7 commit 20984fa

9 files changed

Lines changed: 474 additions & 116 deletions

File tree

‎onelogin-saml-sso/php/lib/Saml2/Auth.php‎

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,10 @@ public function getSettings()
102102
*/
103103
public function setStrict($value)
104104
{
105-
assert('is_bool($value)');
105+
if (! (is_bool($value))) {
106+
throw new Exception('Invalid value passed to setStrict()');
107+
}
108+
106109
$this->_settings->setStrict($value);
107110
}
108111

@@ -196,7 +199,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
196199

197200
$security = $this->_settings->getSecurityData();
198201
if (isset($security['logoutResponseSigned']) && $security['logoutResponseSigned']) {
199-
$signature = $this->buildResponseSignature($logoutResponse, $parameters['RelayState'], $security['signatureAlgorithm']);
202+
$signature = $this->buildResponseSignature($logoutResponse, isset($parameters['RelayState'])? $parameters['RelayState']: null, $security['signatureAlgorithm']);
200203
$parameters['SigAlg'] = $security['signatureAlgorithm'];
201204
$parameters['Signature'] = $signature;
202205
}
@@ -472,9 +475,20 @@ public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm
472475
$objKey = new XMLSecurityKey($signAlgorithm, array('type' => 'private'));
473476
$objKey->loadKey($key, false);
474477

475-
$msg = 'SAMLRequest='.urlencode($samlRequest);
476-
$msg .= '&RelayState='.urlencode($relayState);
477-
$msg .= '&SigAlg=' . urlencode($signAlgorithm);
478+
$security = $this->_settings->getSecurityData();
479+
if ($security['lowercaseUrlencoding']) {
480+
$msg = 'SAMLRequest='.rawurlencode($samlRequest);
481+
if (isset($relayState)) {
482+
$msg .= '&RelayState='.rawurlencode($relayState);
483+
}
484+
$msg .= '&SigAlg=' . rawurlencode($signAlgorithm);
485+
} else {
486+
$msg = 'SAMLRequest='.urlencode($samlRequest);
487+
if (isset($relayState)) {
488+
$msg .= '&RelayState='.urlencode($relayState);
489+
}
490+
$msg .= '&SigAlg=' . urlencode($signAlgorithm);
491+
}
478492
$signature = $objKey->signData($msg);
479493
return base64_encode($signature);
480494
}
@@ -505,9 +519,20 @@ public function buildResponseSignature($samlResponse, $relayState, $signAlgorith
505519
$objKey = new XMLSecurityKey($signAlgorithm, array('type' => 'private'));
506520
$objKey->loadKey($key, false);
507521

508-
$msg = 'SAMLResponse='.urlencode($samlResponse);
509-
$msg .= '&RelayState='.urlencode($relayState);
510-
$msg .= '&SigAlg=' . urlencode($signAlgorithm);
522+
$security = $this->_settings->getSecurityData();
523+
if ($security['lowercaseUrlencoding']) {
524+
$msg = 'SAMLResponse='.rawurlencode($samlResponse);
525+
if (isset($relayState)) {
526+
$msg .= '&RelayState='.rawurlencode($relayState);
527+
}
528+
$msg .= '&SigAlg=' . rawurlencode($signAlgorithm);
529+
} else {
530+
$msg = 'SAMLResponse='.urlencode($samlResponse);
531+
if (isset($relayState)) {
532+
$msg .= '&RelayState='.urlencode($relayState);
533+
}
534+
$msg .= '&SigAlg=' . urlencode($signAlgorithm);
535+
}
511536
$signature = $objKey->signData($msg);
512537
return base64_encode($signature);
513538
}

‎onelogin-saml-sso/php/lib/Saml2/AuthnRequest.php‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -137,12 +137,22 @@ public function __construct(OneLogin_Saml2_Settings $settings, $forceAuthn = fal
137137

138138
/**
139139
* Returns deflated, base64 encoded, unsigned AuthnRequest.
140-
*
140+
*
141+
* @param bool|null $deflate Whether or not we should 'gzdeflate' the request body before we return it.
141142
*/
142-
public function getRequest()
143+
public function getRequest($deflate = null)
143144
{
144-
$deflatedRequest = gzdeflate($this->_authnRequest);
145-
$base64Request = base64_encode($deflatedRequest);
145+
$subject = $this->_authnRequest;
146+
147+
if (is_null($deflate)) {
148+
$deflate = $this->_settings->shouldCompressRequests();
149+
}
150+
151+
if ($deflate) {
152+
$subject = gzdeflate($this->_authnRequest);
153+
}
154+
155+
$base64Request = base64_encode($subject);
146156
return $base64Request;
147157
}
148158

‎onelogin-saml-sso/php/lib/Saml2/LogoutRequest.php‎

Lines changed: 20 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ public function __construct(OneLogin_Saml2_Settings $settings, $request = null,
5555

5656
$nameIdValue = OneLogin_Saml2_Utils::generateUniqueID();
5757
$issueInstant = OneLogin_Saml2_Utils::parseTime2SAML(time());
58-
58+
5959
$cert = null;
6060
if (isset($security['nameIdEncrypted']) && $security['nameIdEncrypted']) {
6161
$cert = $idpData['x509cert'];
@@ -110,12 +110,23 @@ public function __construct(OneLogin_Saml2_Settings $settings, $request = null,
110110
/**
111111
* Returns the Logout Request defated, base64encoded, unsigned
112112
*
113+
* @param bool|null $deflate Whether or not we should 'gzdeflate' the request body before we return it.
114+
*
113115
* @return string Deflated base64 encoded Logout Request
114116
*/
115-
public function getRequest()
117+
public function getRequest($deflate = null)
116118
{
117-
$deflatedRequest = gzdeflate($this->_logoutRequest);
118-
return base64_encode($deflatedRequest);
119+
$subject = $this->_logoutRequest;
120+
121+
if (is_null($deflate)) {
122+
$deflate = $this->_settings->shouldCompressRequests();
123+
}
124+
125+
if ($deflate) {
126+
$subject = gzdeflate($this->_logoutRequest);
127+
}
128+
129+
return base64_encode($subject);
119130
}
120131

121132
/**
@@ -143,7 +154,7 @@ public static function getID($request)
143154
*
144155
* @param string|DOMDocument $request Logout Request Message
145156
* @param string|null $key The SP key
146-
*
157+
*
147158
* @return array Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
148159
*
149160
* @throws Exception
@@ -235,11 +246,11 @@ public static function getIssuer($request)
235246
/**
236247
* Gets the SessionIndexes from the Logout Request.
237248
* Notice: Our Constructor only support 1 SessionIndex but this parser
238-
* extracts an array of all the SessionIndex found on a
249+
* extracts an array of all the SessionIndex found on a
239250
* Logout Request, that could be many.
240251
*
241252
* @param string|DOMDocument $request Logout Request Message
242-
*
253+
*
243254
* @return array The SessionIndex value
244255
*/
245256
public static function getSessionIndexes($request)
@@ -283,7 +294,7 @@ public function isValid($retrieveParametersFromServer=false)
283294
throw new Exception("Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd");
284295
}
285296
}
286-
297+
287298
$currentURL = OneLogin_Saml2_Utils::getSelfRoutedURLNoQuery();
288299

289300
// Check NotOnOrAfter
@@ -375,7 +386,7 @@ public function isValid($retrieveParametersFromServer=false)
375386

376387
/* After execute a validation process, if fails this method returns the cause
377388
*
378-
* @return string Cause
389+
* @return string Cause
379390
*/
380391
public function getError()
381392
{

‎onelogin-saml-sso/php/lib/Saml2/LogoutResponse.php‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -71,13 +71,13 @@ public function getIssuer()
7171

7272
/**
7373
* Gets the Status of the Logout Response.
74-
*
74+
*
7575
* @return string The Status
7676
*/
7777
public function getStatus()
7878
{
7979
$entries = $this->_query('/samlp:LogoutResponse/samlp:Status/samlp:StatusCode');
80-
if ($entries->length == 0) {
80+
if ($entries->length != 1) {
8181
return null;
8282
}
8383
$status = $entries->item(0)->getAttribute('Value');
@@ -213,7 +213,7 @@ private function _query($query)
213213
/**
214214
* Generates a Logout Response object.
215215
*
216-
* @param string $inResponseTo InResponseTo value for the Logout Response.
216+
* @param string $inResponseTo InResponseTo value for the Logout Response.
217217
*/
218218
public function build($inResponseTo)
219219
{
@@ -244,18 +244,28 @@ public function build($inResponseTo)
244244

245245
/**
246246
* Returns a Logout Response object.
247-
*
247+
*
248+
* @param bool|null $deflate Whether or not we should 'gzdeflate' the response body before we return it.
249+
*
248250
* @return string Logout Response deflated and base64 encoded
249251
*/
250-
public function getResponse()
252+
public function getResponse($deflate = null)
251253
{
252-
$deflatedResponse = gzdeflate($this->_logoutResponse);
253-
return base64_encode($deflatedResponse);
254+
$subject = $this->_logoutResponse;
255+
256+
if (is_null($deflate)) {
257+
$deflate = $this->_settings->shouldCompressResponses();
258+
}
259+
260+
if ($deflate) {
261+
$subject = gzdeflate($this->_logoutResponse);
262+
}
263+
return base64_encode($subject);
254264
}
255265

256266
/* After execute a validation process, if fails this method returns the cause.
257267
*
258-
* @return string Cause
268+
* @return string Cause
259269
*/
260270
public function getError()
261271
{

‎onelogin-saml-sso/php/lib/Saml2/Metadata.php‎

Lines changed: 56 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?php
2-
2+
33
/**
44
* Metadata lib of OneLogin PHP Toolkit
55
*
@@ -58,6 +58,7 @@ public static function builder($sp, $authnsign = false, $wsign = false, $validUn
5858
}
5959

6060
$strOrganization = '';
61+
6162
if (!empty($organization)) {
6263
$organizationInfoNames = array();
6364
$organizationInfoDisplaynames = array();
@@ -96,6 +97,58 @@ public static function builder($sp, $authnsign = false, $wsign = false, $validUn
9697
$strContacts = "\n".implode("\n", $contactsInfo);
9798
}
9899

100+
$strAttributeConsumingService = '';
101+
if (isset($sp['attributeConsumingService'])) {
102+
$attrCsDesc = '';
103+
if (isset($sp['attributeConsumingService']['serviceDescription'])) {
104+
$attrCsDesc = sprintf(
105+
' <md:ServiceDescription xml:lang="en">%s</md:ServiceDescription>' . PHP_EOL,
106+
$sp['attributeConsumingService']['serviceDescription']
107+
);
108+
}
109+
if (!isset($sp['attributeConsumingService']['serviceName'])) {
110+
$sp['attributeConsumingService']['serviceName'] = 'Service';
111+
}
112+
$requestedAttributeData = array();
113+
foreach ($sp['attributeConsumingService']['requestedAttributes'] as $attribute) {
114+
$requestedAttributeStr = sprintf(' <md:RequestedAttribute Name="%s"', $attribute['name']);
115+
if (isset($attribute['nameFormat'])) {
116+
$requestedAttributeStr .= sprintf(' NameFormat="%s"', $attribute['nameFormat']);
117+
}
118+
if (isset($attribute['friendlyName'])) {
119+
$requestedAttributeStr .= sprintf(' FriendlyName="%s"', $attribute['friendlyName']);
120+
}
121+
if (isset($attribute['isRequired'])) {
122+
$requestedAttributeStr .= sprintf(' isRequired="%s"', $attribute['isRequired'] === true ? 'true' : 'false');
123+
}
124+
$reqAttrAuxStr = " />";
125+
126+
if (isset($attribute['attributeValue']) && !empty($attribute['attributeValue'])) {
127+
$reqAttrAuxStr = '>';
128+
if (is_string($attribute['attributeValue'])) {
129+
$attribute['attributeValue'] = array($attribute['attributeValue']);
130+
}
131+
foreach ($attribute['attributeValue'] as $attrValue) {
132+
$reqAttrAuxStr .=<<<ATTRIBUTEVALUE
133+
134+
<saml:AttributeValue xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">{$attrValue}</saml:AttributeValue>
135+
ATTRIBUTEVALUE;
136+
}
137+
$reqAttrAuxStr .= "\n </md:RequestedAttribute>";
138+
}
139+
140+
$requestedAttributeData[] = $requestedAttributeStr . $reqAttrAuxStr;
141+
}
142+
143+
$requestedAttributeStr = implode(PHP_EOL, $requestedAttributeData);
144+
$strAttributeConsumingService = <<<METADATA_TEMPLATE
145+
<md:AttributeConsumingService index="1">
146+
<md:ServiceName xml:lang="en">{$sp['attributeConsumingService']['serviceName']}</md:ServiceName>
147+
{$attrCsDesc}{$requestedAttributeStr}
148+
</md:AttributeConsumingService>
149+
METADATA_TEMPLATE;
150+
}
151+
99152
$metadata = <<<METADATA_TEMPLATE
100153
<?xml version="1.0"?>
101154
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
@@ -107,6 +160,7 @@ public static function builder($sp, $authnsign = false, $wsign = false, $validUn
107160
<md:AssertionConsumerService Binding="{$sp['assertionConsumerService']['binding']}"
108161
Location="{$sp['assertionConsumerService']['url']}"
109162
index="1" />
163+
{$strAttributeConsumingService}
110164
</md:SPSSODescriptor>{$strOrganization}{$strContacts}
111165
</md:EntityDescriptor>
112166
METADATA_TEMPLATE;
@@ -159,7 +213,7 @@ public static function addX509KeyDescriptors($metadata, $cert, $wantsEncrypted =
159213

160214
$keyInfo = $xml->createElementNS(OneLogin_Saml2_Constants::NS_DS, 'ds:KeyInfo');
161215
$keyInfo->appendChild($keyData);
162-
216+
163217
$keyDescriptor = $xml->createElementNS(OneLogin_Saml2_Constants::NS_MD, "md:KeyDescriptor");
164218

165219
$SPSSODescriptor = $xml->getElementsByTagName('SPSSODescriptor')->item(0);

0 commit comments

Comments
 (0)