Skip to content

Commit 332c2bb

Browse files
tvdijentvdijen
committed
Merge branch 'feature/samlp_migration'
2 parents d6b52c5 + 8e056e0 commit 332c2bb

3 files changed

Lines changed: 34 additions & 15 deletions

File tree

‎modules/saml/src/Controller/ServiceProvider.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -415,7 +415,7 @@ public function assertionConsumerService(Request $request, string $sourceId): Re
415415
$state['PersistentAuthData'][] = 'saml:AuthnInstant';
416416
$state['saml:sp:SessionIndex'] = $sessionIndex;
417417
$state['PersistentAuthData'][] = 'saml:sp:SessionIndex';
418-
$state['saml:sp:AuthnContext'] = $assertion->getAuthnContextClassRef();
418+
$state['saml:sp:AuthnContext'] = $assertion->getAuthnContext()?->getAuthnContextClassRef();
419419
$state['PersistentAuthData'][] = 'saml:sp:AuthnContext';
420420

421421
if ($expire !== null) {

‎modules/saml/src/IdP/SAML2.php‎

Lines changed: 23 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,16 @@
1818
use SimpleSAML\SAML2\Constants as C;
1919
use SimpleSAML\SAML2\Exception\ArrayValidationException;
2020
use SimpleSAML\SAML2\XML\md\ContactPerson;
21-
use SimpleSAML\SAML2\XML\saml\{AttributeValue, Issuer, NameID, SubjectConfirmation, SubjectConfirmationData};
21+
use SimpleSAML\SAML2\XML\saml\{AttributeValue, Audience, Issuer, NameID, SubjectConfirmation, SubjectConfirmationData};
22+
use SimpleSAML\SAML2\XML\saml\{AuthenticatingAuthority, AuthnContext, AuthnContextClassRef}; // AuthnContext
2223
use SimpleSAML\SAML2\XML\samlp\{Status, StatusCode, StatusMessage}; // Status
2324
use SimpleSAML\XML\DOMDocumentFactory;
2425
use SimpleSAML\XMLSecurity\XML\ds\{X509Certificate, X509Data, KeyInfo};
2526
use Symfony\Bridge\PsrHttpMessage\Factory\{HttpFoundationFactory, PsrHttpFactory};
2627
use Symfony\Component\HttpFoundation\{Request, Response};
2728

2829
use function array_key_exists;
30+
use function array_map;
2931
use function array_merge;
3032
use function array_pop;
3133
use function array_unique;
@@ -86,10 +88,6 @@ public static function sendResponse(array $state): Response
8688

8789
$assertion = self::buildAssertion($idpMetadata, $spMetadata, $state);
8890

89-
if (isset($state['saml:AuthenticatingAuthority'])) {
90-
$assertion->setAuthenticatingAuthority($state['saml:AuthenticatingAuthority']);
91-
}
92-
9391
// create the session association (for logout)
9492
$association = [
9593
'id' => 'saml:' . $spEntityId,
@@ -1171,8 +1169,9 @@ private static function buildAssertion(
11711169
$issuer->setFormat(C::NAMEID_ENTITY);
11721170
$a->setIssuer($issuer);
11731171

1174-
$audience = array_merge([$spMetadata->getString('entityid')], $spMetadata->getOptionalArray('audience', []));
1175-
$a->setValidAudiences($audience);
1172+
$audiences = array_merge([$spMetadata->getString('entityid')], $spMetadata->getOptionalArray('audience', []));
1173+
$audiences = array_map(fn($audience): Audience => new Audience($audience), $audiences);
1174+
$a->setValidAudiences($audiences);
11761175

11771176
$a->setNotBefore($now - 30);
11781177

@@ -1184,16 +1183,28 @@ private static function buildAssertion(
11841183

11851184
$passAuthnContextClassRef = $config->getOptionalBoolean('proxymode.passAuthnContextClassRef', false);
11861185
if (isset($state['saml:AuthnContextClassRef'])) {
1187-
$a->setAuthnContextClassRef($state['saml:AuthnContextClassRef']);
1186+
$classRef = $state['saml:AuthnContextClassRef'];
11881187
} elseif ($passAuthnContextClassRef && isset($state['saml:sp:AuthnContext'])) {
11891188
// AuthnContext has been set by the upper IdP in front of the proxy, pass it back to the SP behind the proxy
1190-
$a->setAuthnContextClassRef($state['saml:sp:AuthnContext']);
1191-
} elseif ($httpUtils->isHTTPS()) {
1192-
$a->setAuthnContextClassRef(C::AC_PASSWORD_PROTECTED_TRANSPORT);
1189+
$classRef = $state['saml:sp:AuthnContext'];
11931190
} else {
1194-
$a->setAuthnContextClassRef(C::AC_PASSWORD);
1191+
$classRef = $httpUtils->isHTTPS() ? C::AC_PASSWORD_PROTECTED_TRANSPORT : C::AC_PASSWORD;
1192+
}
1193+
1194+
$authorities = [];
1195+
if (isset($state['saml:AuthenticatingAuthority'])) {
1196+
$authorities[] = new AuthenticatingAuthority($state['saml:AuthenticatingAuthority']);
11951197
}
11961198

1199+
$a->setAuthnContext(
1200+
new AuthnContext(
1201+
authnContextClassRef: new AuthnContextClassRef($classRef),
1202+
authnContextDecl: null,
1203+
authnContextDeclRef: null,
1204+
authenticatingAuthorities: $authorities,
1205+
)
1206+
);
1207+
11971208
$sessionStart = $now;
11981209
if (isset($state['AuthnInstant'])) {
11991210
$a->setAuthnInstant($state['AuthnInstant']);

‎modules/saml/src/Message.php‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,11 @@
1010
use SimpleSAML\Assert\Assert;
1111
use SimpleSAML\SAML2\{Assertion, EncryptedAssertion}; // Assertions
1212
use SimpleSAML\SAML2\{AuthnRequest, LogoutRequest, LogoutResponse, Response, StatusResponse}; // Messages
13-
use SimpleSAML\SAML2\XML\samlp\{StatusCode, StatusMessage}; // Status
1413
use SimpleSAML\SAML2\{Constants as C, SignedElement};
1514
use SimpleSAML\SAML2\XML\saml\Issuer;
15+
use SimpleSAML\SAML2\XML\saml\AuthnContextClassRef;
16+
use SimpleSAML\SAML2\XML\samlp\RequestedAuthnContext;
17+
use SimpleSAML\SAML2\XML\samlp\{StatusCode, StatusMessage}; // Status
1618
use SimpleSAML\XMLSecurity\XML\ds\{KeyInfo, X509Certificate, X509Data};
1719

1820
use function array_key_exists;
@@ -532,7 +534,10 @@ public static function buildAuthnRequest(
532534
C::COMPARISON_MAXIMUM,
533535
C::COMPARISON_BETTER,
534536
], C::COMPARISON_EXACT);
535-
$ar->setRequestedAuthnContext(['AuthnContextClassRef' => $accr, 'Comparison' => $comp]);
537+
538+
$ar->setRequestedAuthnContext(
539+
new RequestedAuthnContext([new AuthnContextClassRef($accr)], $comp),
540+
);
536541
}
537542

538543
self::addRedirectSign($spMetadata, $idpMetadata, $ar);
@@ -705,6 +710,9 @@ private static function processAssertion(
705710
}
706711
$validAudiences = $assertion->getValidAudiences();
707712
if ($validAudiences !== []) {
713+
// Turn array of saml:Audience objects into an array of identifiers
714+
$validAudiences = array_map(fn($audience): string => $audience->getContent(), $validAudiences);
715+
708716
$spEntityId = $spMetadata->getString('entityid');
709717
if (!in_array($spEntityId, $validAudiences, true)) {
710718
$candidates = '[' . implode('], [', $validAudiences) . ']';

0 commit comments

Comments
 (0)