Skip to content

Commit 2bf09d7

Browse files
pitbulkpitbulk
committed
Refactor. Fix PHPDoc
1 parent 899f7bd commit 2bf09d7

9 files changed

Lines changed: 163 additions & 103 deletions

File tree

‎certs/README‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@ Also you can use other cert to sign the metadata of the SP using the:
1010

1111
* metadata.key
1212
* metadata.crt
13+
14+
If you are using composer to install the php-saml toolkit, You should move the certs folder to vendor/onelogin/php-saml/certs

‎src/Saml2/Auth.php‎

Lines changed: 38 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,9 @@ class Auth
161161
* Initializes the SP SAML instance.
162162
*
163163
* @param array|null $settings Setting data
164+
*
165+
* @throws Exception
166+
* @throws Error
164167
*/
165168
public function __construct(array $settings = null)
166169
{
@@ -186,7 +189,7 @@ public function getSettings()
186189
*/
187190
public function setStrict($value)
188191
{
189-
if (! (is_bool($value))) {
192+
if (!is_bool($value)) {
190193
throw new Error(
191194
'Invalid value passed to setStrict()',
192195
Error::SETTINGS_INVALID_SYNTAX
@@ -202,12 +205,13 @@ public function setStrict($value)
202205
* @param string|null $requestId The ID of the AuthNRequest sent by this SP to the IdP
203206
*
204207
* @throws Error
208+
* @throws ValidationError
205209
*/
206210
public function processResponse($requestId = null)
207211
{
208212
$this->_errors = array();
209213
$this->_lastError = $this->_lastErrorException = null;
210-
if (isset($_POST) && isset($_POST['SAMLResponse'])) {
214+
if (isset($_POST['SAMLResponse'])) {
211215
// AuthnResponse -- HTTP_POST Binding
212216
$response = new Response($this->_settings, $_POST['SAMLResponse']);
213217
$this->_lastResponse = $response->getXMLDocument();
@@ -255,7 +259,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
255259
{
256260
$this->_errors = array();
257261
$this->_lastError = $this->_lastErrorException = null;
258-
if (isset($_GET) && isset($_GET['SAMLResponse'])) {
262+
if (isset($_GET['SAMLResponse'])) {
259263
$logoutResponse = new LogoutResponse($this->_settings, $_GET['SAMLResponse']);
260264
$this->_lastResponse = $logoutResponse->getXML();
261265
if (!$logoutResponse->isValid($requestId, $retrieveParametersFromServer)) {
@@ -275,7 +279,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
275279
}
276280
}
277281
}
278-
} else if (isset($_GET) && isset($_GET['SAMLRequest'])) {
282+
} else if (isset($_GET['SAMLRequest'])) {
279283
$logoutRequest = new LogoutRequest($this->_settings, $_GET['SAMLRequest']);
280284
$this->_lastRequest = $logoutRequest->getXML();
281285
if (!$logoutRequest->isValid($retrieveParametersFromServer)) {
@@ -500,6 +504,8 @@ public function getAttributeWithFriendlyName($friendlyName)
500504
* @param bool $setNameIdPolicy When true the AuthNRequest will set a nameIdPolicy element
501505
*
502506
* @return string|null If $stay is True, it return a string with the SLO URL + LogoutRequest + parameters
507+
*
508+
* @throws Error
503509
*/
504510
public function login($returnTo = null, array $parameters = array(), $forceAuthn = false, $isPassive = false, $stay = false, $setNameIdPolicy = true)
505511
{
@@ -632,33 +638,7 @@ public function getLastRequestID()
632638
*/
633639
public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA256)
634640
{
635-
$key = $this->_settings->getSPkey();
636-
if (empty($key)) {
637-
throw new Error(
638-
"Trying to sign the SAML Request but can't load the SP private key",
639-
Error::PRIVATE_KEY_NOT_FOUND
640-
);
641-
}
642-
643-
$objKey = new XMLSecurityKey($signAlgorithm, array('type' => 'private'));
644-
$objKey->loadKey($key, false);
645-
646-
$security = $this->_settings->getSecurityData();
647-
if ($security['lowercaseUrlencoding']) {
648-
$msg = 'SAMLRequest='.rawurlencode($samlRequest);
649-
if (isset($relayState)) {
650-
$msg .= '&RelayState='.rawurlencode($relayState);
651-
}
652-
$msg .= '&SigAlg=' . rawurlencode($signAlgorithm);
653-
} else {
654-
$msg = 'SAMLRequest='.urlencode($samlRequest);
655-
if (isset($relayState)) {
656-
$msg .= '&RelayState='.urlencode($relayState);
657-
}
658-
$msg .= '&SigAlg=' . urlencode($signAlgorithm);
659-
}
660-
$signature = $objKey->signData($msg);
661-
return base64_encode($signature);
641+
return $this->buildMessageSignature($samlRequest, $relayState, $signAlgorithm, "SAMLRequest");
662642
}
663643

664644
/**
@@ -674,27 +654,48 @@ public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm
674654
* @throws Error
675655
*/
676656
public function buildResponseSignature($samlResponse, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA256)
657+
{
658+
return $this->buildMessageSignature($samlResponse, $relayState, $signAlgorithm, "SAMLResponse");
659+
}
660+
661+
/**
662+
* Generates the Signature for a SAML Message
663+
*
664+
* @param string $samlMessage The SAML Message
665+
* @param string $relayState The RelayState
666+
* @param string $signAlgorithm Signature algorithm method
667+
* @param string $type "SAMLRequest" or "SAMLResponse"
668+
*
669+
* @return string A base64 encoded signature
670+
*
671+
* @throws Exception
672+
* @throws Error
673+
*/
674+
private function buildMessageSignature($samlMessage, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA256, $type="SAMLRequest")
677675
{
678676
$key = $this->_settings->getSPkey();
679677
if (empty($key)) {
680-
throw new Error(
681-
"Trying to sign the SAML Response but can't load the SP private key",
682-
Error::PRIVATE_KEY_NOT_FOUND
683-
);
678+
if ($type == "SAMLRequest") {
679+
$errorMsg = "Trying to sign the SAML Request but can't load the SP private key";
680+
} else {
681+
$errorMsg = "Trying to sign the SAML Response but can't load the SP private key";
682+
}
683+
684+
throw new Error($errorMsg, Error::PRIVATE_KEY_NOT_FOUND);
684685
}
685686

686687
$objKey = new XMLSecurityKey($signAlgorithm, array('type' => 'private'));
687688
$objKey->loadKey($key, false);
688689

689690
$security = $this->_settings->getSecurityData();
690691
if ($security['lowercaseUrlencoding']) {
691-
$msg = 'SAMLResponse='.rawurlencode($samlResponse);
692+
$msg = $type.'='.rawurlencode($samlMessage);
692693
if (isset($relayState)) {
693694
$msg .= '&RelayState='.rawurlencode($relayState);
694695
}
695696
$msg .= '&SigAlg=' . rawurlencode($signAlgorithm);
696697
} else {
697-
$msg = 'SAMLResponse='.urlencode($samlResponse);
698+
$msg = $type.'='.urlencode($samlMessage);
698699
if (isset($relayState)) {
699700
$msg .= '&RelayState='.urlencode($relayState);
700701
}

‎src/Saml2/IdPMetadataParser.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@ public static function parseFileXML($filepath, $entityId = null, $desiredNameIdF
101101
* @param string $desiredSLOBinding Parse specific binding SLO endpoint
102102
*
103103
* @return array metadata info in php-saml settings format
104+
*
104105
* @throws Exception
105106
*/
106107
public static function parseXML($xml, $entityId = null, $desiredNameIdFormat = null, $desiredSSOBinding = Constants::BINDING_HTTP_REDIRECT, $desiredSLOBinding = Constants::BINDING_HTTP_REDIRECT)

‎src/Saml2/LogoutRequest.php‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -139,7 +139,7 @@ public function __construct(\OneLogin\Saml2\Settings $settings, $request = null,
139139
} else {
140140
$logoutRequest = $decoded;
141141
}
142-
$this->id = self::getID($logoutRequest);
142+
$this->id = static::getID($logoutRequest);
143143
}
144144
$this->_logoutRequest = $logoutRequest;
145145
}
@@ -204,7 +204,9 @@ public static function getID($request)
204204
*
205205
* @return array Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
206206
*
207+
* @throws Error
207208
* @throws Exception
209+
* @throws ValidationError
208210
*/
209211
public static function getNameIdData($request, $key = null)
210212
{
@@ -265,6 +267,10 @@ public static function getNameIdData($request, $key = null)
265267
* @param string|null $key The SP key
266268
*
267269
* @return string Name ID Value
270+
*
271+
* @throws Error
272+
* @throws Exception
273+
* @throws ValidationError
268274
*/
269275
public static function getNameId($request, $key = null)
270276
{
@@ -278,6 +284,8 @@ public static function getNameId($request, $key = null)
278284
* @param string|DOMDocument $request Logout Request Message
279285
*
280286
* @return string|null $issuer The Issuer
287+
*
288+
* @throws Exception
281289
*/
282290
public static function getIssuer($request)
283291
{
@@ -305,6 +313,8 @@ public static function getIssuer($request)
305313
* @param string|DOMDocument $request Logout Request Message
306314
*
307315
* @return array The SessionIndex value
316+
*
317+
* @throws Exception
308318
*/
309319
public static function getSessionIndexes($request)
310320
{
@@ -329,6 +339,9 @@ public static function getSessionIndexes($request)
329339
* @param bool $retrieveParametersFromServer True if we want to use parameters from $_SERVER to validate the signature
330340
*
331341
* @return bool If the Logout Request is or not valid
342+
*
343+
* @throws Exception
344+
* @throws ValidationError
332345
*/
333346
public function isValid($retrieveParametersFromServer = false)
334347
{
@@ -369,34 +382,30 @@ public function isValid($retrieveParametersFromServer = false)
369382
// Check destination
370383
if ($dom->documentElement->hasAttribute('Destination')) {
371384
$destination = $dom->documentElement->getAttribute('Destination');
372-
if (!empty($destination)) {
373-
if (strpos($destination, $currentURL) === false) {
374-
throw new ValidationError(
375-
"The LogoutRequest was received at $currentURL instead of $destination",
376-
ValidationError::WRONG_DESTINATION
377-
);
378-
}
385+
if (!empty($destination) && strpos($destination, $currentURL) === false) {
386+
throw new ValidationError(
387+
"The LogoutRequest was received at $currentURL instead of $destination",
388+
ValidationError::WRONG_DESTINATION
389+
);
379390
}
380391
}
381392

382-
$nameId = $this->getNameId($dom, $this->_settings->getSPkey());
393+
$nameId = static::getNameId($dom, $this->_settings->getSPkey());
383394

384395
// Check issuer
385-
$issuer = $this->getIssuer($dom);
396+
$issuer = static::getIssuer($dom);
386397
if (!empty($issuer) && $issuer != $idPEntityId) {
387398
throw new ValidationError(
388399
"Invalid issuer in the Logout Request",
389400
ValidationError::WRONG_ISSUER
390401
);
391402
}
392403

393-
if ($security['wantMessagesSigned']) {
394-
if (!isset($_GET['Signature'])) {
395-
throw new ValidationError(
396-
"The Message of the Logout Request is not signed and the SP require it",
397-
ValidationError::NO_SIGNED_MESSAGE
398-
);
399-
}
404+
if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
405+
throw new ValidationError(
406+
"The Message of the Logout Request is not signed and the SP require it",
407+
ValidationError::NO_SIGNED_MESSAGE
408+
);
400409
}
401410
}
402411

‎src/Saml2/LogoutResponse.php‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,10 @@ class LogoutResponse
6565
*
6666
* @param Settings $settings Settings.
6767
* @param string|null $response An UUEncoded SAML Logout response from the IdP.
68+
*
69+
* @throws Error
70+
* @throws Exception
71+
*
6872
*/
6973
public function __construct(\OneLogin\Saml2\Settings $settings, $response = null)
7074
{
@@ -136,6 +140,8 @@ public function getStatus()
136140
* @param bool $retrieveParametersFromServer True if we want to use parameters from $_SERVER to validate the signature
137141
*
138142
* @return bool Returns if the SAML LogoutResponse is or not valid
143+
*
144+
* @throws ValidationError
139145
*/
140146
public function isValid($requestId = null, $retrieveParametersFromServer = false)
141147
{
@@ -182,24 +188,20 @@ public function isValid($requestId = null, $retrieveParametersFromServer = false
182188
// Check destination
183189
if ($this->document->documentElement->hasAttribute('Destination')) {
184190
$destination = $this->document->documentElement->getAttribute('Destination');
185-
if (!empty($destination)) {
186-
if (strpos($destination, $currentURL) === false) {
187-
throw new ValidationError(
188-
"The LogoutResponse was received at $currentURL instead of $destination",
189-
ValidationError::WRONG_DESTINATION
190-
);
191-
}
192-
}
193-
}
194-
195-
if ($security['wantMessagesSigned']) {
196-
if (!isset($_GET['Signature'])) {
191+
if (!empty($destination) && strpos($destination, $currentURL) === false) {
197192
throw new ValidationError(
198-
"The Message of the Logout Response is not signed and the SP requires it",
199-
ValidationError::NO_SIGNED_MESSAGE
193+
"The LogoutResponse was received at $currentURL instead of $destination",
194+
ValidationError::WRONG_DESTINATION
200195
);
201196
}
202197
}
198+
199+
if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
200+
throw new ValidationError(
201+
"The Message of the Logout Response is not signed and the SP requires it",
202+
ValidationError::NO_SIGNED_MESSAGE
203+
);
204+
}
203205
}
204206

205207
if (isset($_GET['Signature'])) {

‎src/Saml2/Metadata.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,6 +200,8 @@ public static function builder($sp, $authnsign = false, $wsign = false, $validUn
200200
* @param string $digestAlgorithm Digest algorithm method
201201
*
202202
* @return string Signed Metadata
203+
*
204+
* @throws Exception
203205
*/
204206
public static function signMetadata($metadata, $key, $cert, $signAlgorithm = XMLSecurityKey::RSA_SHA256, $digestAlgorithm = XMLSecurityDSig::SHA256)
205207
{
@@ -215,6 +217,8 @@ public static function signMetadata($metadata, $key, $cert, $signAlgorithm = XML
215217
* @param bool $wantsEncrypted Whether to include the KeyDescriptor for encryption
216218
*
217219
* @return string Metadata with KeyDescriptors
220+
*
221+
* @throws Exception
218222
*/
219223
public static function addX509KeyDescriptors($metadata, $cert, $wantsEncrypted = true)
220224
{

0 commit comments

Comments
 (0)