Skip to content

Commit f03b4f8

Browse files
pitbulkpitbulk
authored
Merge branch '4.0.0' into 3.6.0-tests
2 parents 7e625a3 + 7d42211 commit f03b4f8

9 files changed

Lines changed: 74 additions & 22 deletions

File tree

‎CHANGELOG‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
CHANGELOG
22
=========
3+
v4.0.0
4+
* Supports PHP 8.X
5+
36
v3.5.1
47
* 3.5.0 packagist/github release due a confusion were using the master (2.X branch). I'm releasing 3.5.1 to fix this issue and go back to 3.X branch
58

‎README.md‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# OneLogin's SAML PHP Toolkit Compatible with PHP 5.X & 7.X
1+
# OneLogin's SAML PHP Toolkit Compatible with PHP 7.X & 8.X
22

33
[![Build Status](https://api.travis-ci.org/onelogin/php-saml.png?branch=master)](http://travis-ci.org/onelogin/php-saml) [![Coverage Status](https://coveralls.io/repos/onelogin/php-saml/badge.png)](https://coveralls.io/r/onelogin/php-saml) [![License](https://poser.pugx.org/onelogin/php-saml/license.png)](https://packagist.org/packages/onelogin/php-saml)
44

@@ -10,15 +10,7 @@ and supported by OneLogin Inc.
1010
Warning
1111
-------
1212

13-
Version 3.4.0 introduces the 'rejectUnsolicitedResponsesWithInResponseTo' setting parameter, by default disabled, that will allow invalidate unsolicited SAMLResponse. This version as well will reject SAMLResponse if requestId was provided to the validator but the SAMLResponse does not contain a InResponseTo attribute. And an additional setting parameter 'destinationStrictlyMatches', by default disabled, that will force that the Destination URL should strictly match to the address that process the SAMLResponse.
14-
15-
Version 3.3.1 updates xmlseclibs to 3.0.4 (CVE-2019-3465), but php-saml was not directly affected since it implements additional checks that prevent to exploit that vulnerability.
16-
17-
Version 3.3.0 sets strict mode active by default
18-
19-
Update php-saml to 3.1.0, this version includes a security patch related to XEE attacks.
20-
21-
This version is compatible with PHP 7.X and does not include xmlseclibs (you will need to install it via composer, dependency described in composer.json)
13+
This version is compatible with PHP >7.1 and 8.X and does not include xmlseclibs (you will need to install it via composer, dependency described in composer.json)
2214

2315
Security Guidelines
2416
-------------------
@@ -132,7 +124,9 @@ Your settings are at risk of being deleted when updating packages using `compose
132124
Compatibility
133125
-------------
134126

135-
This 3.X.X supports PHP 7.X. but can be used with PHP >=5.4 as well (5.6.24+ recommended for security reasons).
127+
This 4.X.X supports PHP >7.1 .
128+
129+
It is not compatible with PHP5.6 or PHP7.0.
136130

137131
Namespaces
138132
----------
@@ -513,6 +507,17 @@ $advancedSettings = array(
513507
// Notice that sha1 is a deprecated algorithm and should not be used
514508
'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256',
515509

510+
// Algorithm that the toolkit will use for encryption process. Options:
511+
// 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'
512+
// 'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
513+
// 'http://www.w3.org/2001/04/xmlenc#aes192-cbc'
514+
// 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
515+
// 'http://www.w3.org/2009/xmlenc11#aes128-gcm'
516+
// 'http://www.w3.org/2009/xmlenc11#aes192-gcm'
517+
// 'http://www.w3.org/2009/xmlenc11#aes256-gcm';
518+
// Notice that aes-cbc are not consider secure anymore so should not be used
519+
'encryption_algorithm' => 'http://www.w3.org/2009/xmlenc11#aes128-gcm',
520+
516521
// ADFS URL-Encodes SAML data as lowercase, and the toolkit by default uses
517522
// uppercase. Turn it True for ADFS compatibility on signature verification
518523
'lowercaseUrlencoding' => false,

‎advanced_settings_example.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,17 @@
116116
// Notice that sha1 is a deprecated algorithm and should not be used
117117
'digestAlgorithm' => 'http://www.w3.org/2001/04/xmlenc#sha256',
118118

119+
// Algorithm that the toolkit will use for encryption process. Options:
120+
// 'http://www.w3.org/2001/04/xmlenc#tripledes-cbc'
121+
// 'http://www.w3.org/2001/04/xmlenc#aes128-cbc'
122+
// 'http://www.w3.org/2001/04/xmlenc#aes192-cbc'
123+
// 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
124+
// 'http://www.w3.org/2009/xmlenc11#aes128-gcm'
125+
// 'http://www.w3.org/2009/xmlenc11#aes192-gcm'
126+
// 'http://www.w3.org/2009/xmlenc11#aes256-gcm';
127+
// Notice that aes-cbc are not consider secure anymore so should not be used
128+
'encryption_algorithm' => 'http://www.w3.org/2009/xmlenc11#aes128-gcm',
129+
119130
// ADFS URL-Encodes SAML data as lowercase, and the toolkit by default uses
120131
// uppercase. Turn it True for ADFS compatibility on signature verification
121132
'lowercaseUrlencoding' => false,

‎composer.json‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,18 +17,19 @@
1717
"require": {
1818
"php": ">=7.1",
1919
"robrichards/xmlseclibs": ">=3.1.1",
20-
"phpunit/phpunit": "7.5.17 || ^9.5"
20+
"phpunit/phpunit": "^7.5.20 || ^9.5"
2121
},
2222
"require-dev": {
23-
"php-coveralls/php-coveralls": "^1.0.2 || ^2.0",
24-
"sebastian/phpcpd": "^2.0 || ^3.0 || ^4.0",
25-
"phploc/phploc": "^2.1 || ^3.0 || ^4.0 || ^7.0",
26-
"pdepend/pdepend": "^2.5.0",
27-
"squizlabs/php_codesniffer": "^3.1.1"
23+
"php-coveralls/php-coveralls": "^2.0",
24+
"sebastian/phpcpd": "^4.0 || ^5.0 || ^6.0 ",
25+
"phploc/phploc": "^4.0 || ^5.0 || ^6.0 || ^7.0",
26+
"pdepend/pdepend": "^2.8.0",
27+
"squizlabs/php_codesniffer": "^3.5.8"
2828
},
2929
"suggest": {
3030
"ext-openssl": "Install openssl lib in order to handle with x509 certs (require to support sign and encryption)",
3131
"ext-curl": "Install curl lib to be able to use the IdPMetadataParser for parsing remote XMLs",
32-
"ext-gettext": "Install gettext and php5-gettext libs to handle translations"
32+
"ext-dom": "Install xml lib",
33+
"ext-zlib": "Install zlib"
3334
}
3435
}

‎demo1/index.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,9 @@
7777

7878
if (!empty($errors)) {
7979
echo '<p>' . implode(', ', $errors) . '</p>';
80+
if ($auth->getSettings()->isDebugActive()) {
81+
echo '<p>'.$auth->getLastErrorReason().'</p>';
82+
}
8083
}
8184

8285
if (!$auth->isAuthenticated()) {
@@ -108,6 +111,9 @@
108111
echo '<p>Sucessfully logged out</p>';
109112
} else {
110113
echo '<p>' . implode(', ', $errors) . '</p>';
114+
if ($auth->getSettings()->isDebugActive()) {
115+
echo '<p>'.$auth->getLastErrorReason().'</p>';
116+
}
111117
}
112118
}
113119

‎src/Saml2/LogoutRequest.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,8 @@ public function __construct(\OneLogin\Saml2\Settings $settings, $request = null,
122122
$nameIdSPNameQualifier,
123123
$nameIdFormat,
124124
$cert,
125-
$nameIdNameQualifier
125+
$nameIdNameQualifier,
126+
$security['encryption_algorithm']
126127
);
127128

128129
$sessionIndexStr = isset($sessionIndex) ? "<samlp:SessionIndex>{$sessionIndex}</samlp:SessionIndex>" : "";

‎src/Saml2/Settings.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -430,6 +430,11 @@ private function _addDefaultValues()
430430
$this->_security['digestAlgorithm'] = XMLSecurityDSig::SHA256;
431431
}
432432

433+
// EncryptionAlgorithm
434+
if (!isset($this->_security['encryption_algorithm'])) {
435+
$this->_security['encryption_algorithm'] = XMLSecurityKey::AES128_CBC;
436+
}
437+
433438
if (!isset($this->_security['lowercaseUrlencoding'])) {
434439
$this->_security['lowercaseUrlencoding'] = false;
435440
}

‎src/Saml2/Utils.php‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1056,12 +1056,13 @@ public static function formatFingerPrint($fingerprint)
10561056
* @param string|null $format SP Format
10571057
* @param string|null $cert IdP Public cert to encrypt the nameID
10581058
* @param string|null $nq IdP Name Qualifier
1059+
* @param string|null $enc_alg Encryption algorithm
10591060
*
10601061
* @return string $nameIDElement DOMElement | XMLSec nameID
10611062
*
10621063
* @throws Exception
10631064
*/
1064-
public static function generateNameId($value, $spnq, $format = null, $cert = null, $nq = null)
1065+
public static function generateNameId($value, $spnq, $format = null, $cert = null, $nq = null, $enc_alg = XMLSecurityKey::AES128_CBC)
10651066
{
10661067

10671068
$doc = new DOMDocument();
@@ -1081,14 +1082,18 @@ public static function generateNameId($value, $spnq, $format = null, $cert = nul
10811082
$doc->appendChild($nameId);
10821083

10831084
if (!empty($cert)) {
1084-
$seckey = new XMLSecurityKey(XMLSecurityKey::RSA_1_5, array('type'=>'public'));
1085+
if ($enc_alg == XMLSecurityKey::AES128_CBC) {
1086+
$seckey = new XMLSecurityKey(XMLSecurityKey::RSA_1_5, array('type'=>'public'));
1087+
} else {
1088+
$seckey = new XMLSecurityKey(XMLSecurityKey::RSA_OAEP_MGF1P, array('type'=>'public'));
1089+
}
10851090
$seckey->loadKey($cert);
10861091

10871092
$enc = new XMLSecEnc();
10881093
$enc->setNode($nameId);
10891094
$enc->type = XMLSecEnc::Element;
10901095

1091-
$symmetricKey = new XMLSecurityKey(XMLSecurityKey::AES128_CBC);
1096+
$symmetricKey = new XMLSecurityKey($enc_alg);
10921097
$symmetricKey->generateSessionKey();
10931098
$enc->encryptKey($seckey, $symmetricKey);
10941099

‎tests/src/OneLogin/Saml2/UtilsTest.php‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -852,6 +852,21 @@ public function testGenerateNameIdWithSPNameQualifier()
852852
);
853853

854854
$nameidExpectedEnc = '<saml:EncryptedID><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/><xenc:CipherData><xenc:CipherValue>';
855+
856+
$this->assertStringContainsString($nameidExpectedEnc, $nameIdEnc);
857+
858+
// Check AES128_GCM support
859+
860+
$nameidExpectedEnc = '<saml:EncryptedID><xenc:EncryptedData xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" Type="http://www.w3.org/2001/04/xmlenc#Element"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2009/xmlenc11#aes128-gcm"/><dsig:KeyInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><xenc:EncryptedKey><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><xenc:CipherData><xenc:CipherValue>';
861+
862+
$nameIdEnc = Utils::generateNameId(
863+
$nameIdValue,
864+
$entityId,
865+
$nameIDFormat,
866+
$key,
867+
null,
868+
XMLSecurityKey::AES128_GCM
869+
);
855870
$this->assertStringContainsString($nameidExpectedEnc, $nameIdEnc);
856871
}
857872

0 commit comments

Comments
 (0)