Remove Comparison atribute from RequestedAuthnContext when setting has empty value

Author: pitbulk

src/Saml2/AuthnRequest.php

@@ -127,15 +127,20 @@ public function __construct(\OneLogin\Saml2\Settings $settings, $forceAuthn = fa
                 $authnComparison = $security['requestedAuthnContextComparison'];
             }
 
+            $authnComparisonAttr = '';
+            if (!empty($authnComparison)) {
+                $authnComparisonAttr = sprintf('Comparison="%s"', $authnComparison);
+            }
+
             if ($security['requestedAuthnContext'] === true) {
                 $requestedAuthnStr = <<<REQUESTEDAUTHN
 
-    <samlp:RequestedAuthnContext Comparison="$authnComparison">
+    <samlp:RequestedAuthnContext $authnComparisonAttr>
         <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
     </samlp:RequestedAuthnContext>
 REQUESTEDAUTHN;
             } else {
-                $requestedAuthnStr .= "    <samlp:RequestedAuthnContext Comparison=\"$authnComparison\">\n";
+                $requestedAuthnStr .= "    <samlp:RequestedAuthnContext $authnComparisonAttr>\n";
                 foreach ($security['requestedAuthnContext'] as $contextValue) {
                     $requestedAuthnStr .= "        <saml:AuthnContextClassRef>".$contextValue."</saml:AuthnContextClassRef>\n";
                 }

tests/src/OneLogin/Saml2/AuthnRequestTest.php

@@ -100,6 +100,14 @@ public function testAuthNContext()
         $decoded5 = base64_decode($encodedRequest5);
         $request5 = gzinflate($decoded5);
         $this->assertContains('<samlp:RequestedAuthnContext Comparison="minimum">', $request5);
+
+        $settingsInfo['security']['requestedAuthnContextComparison'] = '';
+        $settings6 = new Settings($settingsInfo);
+        $authnRequest6 = new AuthnRequest($settings6);
+        $encodedRequest6 = $authnRequest6->getRequest();
+        $decoded6 = base64_decode($encodedRequest6);
+        $request6 = gzinflate($decoded6);
+        $this->assertContains('<samlp:RequestedAuthnContext >', $request6);
     }
 
     /**