Skip to content

Commit 4f6df70

Browse files
pitbulkpitbulk
committed
Adapt test to the fact that unsigned SAML Responses now are invalid with strict is false
1 parent c3d1fa5 commit 4f6df70

File tree

4 files changed

+105
-51
lines changed

4 files changed

+105
-51
lines changed

‎tests/src/OneLogin/Saml2/AuthTest.php‎

Lines changed: 9 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ public function testProcessNoResponse()
9292
* @covers OneLogin_Saml2_Auth::getNameId
9393
* @covers OneLogin_Saml2_Auth::getErrors
9494
* @covers OneLogin_Saml2_Auth::getSessionIndex
95+
* @covers OneLogin_Saml2_Auth::getLastErrorReason
9596
*/
9697
public function testProcessResponseInvalid()
9798
{
@@ -106,6 +107,7 @@ public function testProcessResponseInvalid()
106107
$this->assertNull($this->_auth->getSessionIndex());
107108
$this->assertNull($this->_auth->getAttribute('uid'));
108109
$this->assertEquals($this->_auth->getErrors(), array('invalid_response'));
110+
$this->assertEquals($this->_auth->getLastErrorReason(), "Reference validation failed");
109111
}
110112

111113
/**
@@ -127,15 +129,15 @@ public function testProcessResponseInvalidRequestId()
127129
$requestId = 'invalid';
128130
$this->_auth->processResponse($requestId);
129131

130-
$this->assertEmpty($this->_auth->getErrors());
132+
$this->assertEquals("No Signature found. SAML Response rejected", $this->_auth->getLastErrorReason());
131133

132134
$this->_auth->setStrict(true);
133135
$this->_auth->processResponse($requestId);
134-
$this->assertEquals($this->_auth->getErrors(), array('invalid_response'));
136+
$this->assertEquals("The InResponseTo of the Response: _57bcbf70-7b1f-012e-c821-782bcb13bb38, does not match the ID of the AuthNRequest sent by the SP: invalid", $this->_auth->getLastErrorReason());
135137

136138
$validRequestId = '_57bcbf70-7b1f-012e-c821-782bcb13bb38';
137139
$this->_auth->processResponse($validRequestId);
138-
$this->assertEmpty($this->_auth->getErrors());
140+
$this->assertEquals("No Signature found. SAML Response rejected", $this->_auth->getLastErrorReason());
139141
}
140142

141143
/**
@@ -154,29 +156,18 @@ public function testProcessResponseInvalidRequestId()
154156
*/
155157
public function testProcessResponseValid()
156158
{
157-
$message = file_get_contents(TEST_ROOT . '/data/responses/unsigned_response.xml.base64');
158-
159-
$plainMessage = base64_decode($message);
160-
$currentURL = OneLogin_Saml2_Utils::getSelfURLNoQuery();
161-
$plainMessage = str_replace('http://stuff.com/endpoints/endpoints/acs.php', $currentURL, $plainMessage);
162-
163-
$_POST['SAMLResponse'] = base64_encode($plainMessage);
159+
$message = file_get_contents(TEST_ROOT . '/data/responses/valid_response.xml.base64');
160+
$_POST['SAMLResponse'] = $message;
164161

165162
$this->_auth->processResponse();
166-
167163
$this->assertTrue($this->_auth->isAuthenticated());
168-
$this->assertEmpty($this->_auth->getErrors());
169-
$this->assertEquals('[email protected]', $this->_auth->getNameId());
164+
$this->assertEquals('492882615acf31c8096b627245d76ae53036c090', $this->_auth->getNameId());
170165
$attributes = $this->_auth->getAttributes();
171166
$this->assertNotEmpty($attributes);
172167
$this->assertEquals($this->_auth->getAttribute('mail'), $attributes['mail']);
173168
$sessionIndex = $this->_auth->getSessionIndex();
174169
$this->assertNotNull($sessionIndex);
175-
$this->assertEquals('_51be37965feb5579d803141076936dc2e9d1d98ebf', $sessionIndex);
176-
177-
$this->_auth->setStrict(true);
178-
$this->_auth->processResponse();
179-
$this->assertEmpty($this->_auth->getErrors());
170+
$this->assertEquals('_6273d77b8cde0c333ec79d22a9fa0003b9fe2d75cb', $sessionIndex);
180171
}
181172

182173
/**

‎tests/src/OneLogin/Saml2/LogoutResponseTest.php‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,12 @@ public function testQuery()
106106
*/
107107
public function testGetError()
108108
{
109+
$message = file_get_contents(TEST_ROOT . '/data/logout_responses/logout_response_deflated.xml.base64');
110+
$requestId = 'invalid_request_id';
111+
$response = new OneLogin_Saml2_LogoutResponse($this->_settings, $message);
112+
$this->_settings->setStrict(true);
113+
$this->assertFalse($response->isValid($requestId));
114+
$this->assertEquals($response->getError(), 'The InResponseTo of the Logout Response: ONELOGIN_21584ccdfaca36a145ae990442dcd96bfe60151e, does not match the ID of the Logout request sent by the SP: invalid_request_id');
109115

110116
}
111117

‎tests/src/OneLogin/Saml2/ResponseTest.php‎

Lines changed: 62 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -532,7 +532,8 @@ public function testIsInValidEncAttrs()
532532
$xml = file_get_contents(TEST_ROOT . '/data/responses/invalids/encrypted_attrs.xml.base64');
533533
$response = new OneLogin_Saml2_Response($this->_settings, $xml);
534534

535-
$this->assertTrue($response->isValid());
535+
$this->assertFalse($response->isValid());
536+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
536537

537538
$this->_settings->setStrict(true);
538539
$response2 = new OneLogin_Saml2_Response($this->_settings, $xml);
@@ -552,7 +553,8 @@ public function testIsInValidDestination()
552553
$xml = file_get_contents(TEST_ROOT . '/data/responses/unsigned_response.xml.base64');
553554

554555
$response = new OneLogin_Saml2_Response($this->_settings, $xml);
555-
$this->assertTrue($response->isValid());
556+
$response->isValid();
557+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
556558

557559
$this->_settings->setStrict(true);
558560
$response2 = new OneLogin_Saml2_Response($this->_settings, $xml);
@@ -577,7 +579,8 @@ public function testIsInValidAudience()
577579
$message = base64_encode($plainMessage);
578580

579581
$response = new OneLogin_Saml2_Response($this->_settings, $message);
580-
$this->assertTrue($response->isValid());
582+
$response->isValid();
583+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
581584

582585
$this->_settings->setStrict(true);
583586
$response2 = new OneLogin_Saml2_Response($this->_settings, $message);
@@ -609,10 +612,12 @@ public function testIsInValidIssuer()
609612
$message2 = base64_encode($plainMessage2);
610613

611614
$response = new OneLogin_Saml2_Response($this->_settings, $message);
612-
$this->assertTrue($response->isValid());
615+
$response->isValid();
616+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
613617

614618
$response2 = new OneLogin_Saml2_Response($this->_settings, $message2);
615-
$this->assertTrue($response2->isValid());
619+
$response2->isValid();
620+
$this->assertEquals('No Signature found. SAML Response rejected', $response2->getError());
616621

617622
$this->_settings->setStrict(true);
618623
$response3 = new OneLogin_Saml2_Response($this->_settings, $message);
@@ -642,7 +647,8 @@ public function testIsInValidSessionIndex()
642647
$message = base64_encode($plainMessage);
643648

644649
$response = new OneLogin_Saml2_Response($this->_settings, $message);
645-
$this->assertTrue($response->isValid());
650+
$response->isValid();
651+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
646652

647653
$this->_settings->setStrict(true);
648654
$response2 = new OneLogin_Saml2_Response($this->_settings, $message);
@@ -692,22 +698,28 @@ public function testIsInValidSubjectConfirmation()
692698
$message6 = base64_encode($plainMessage6);
693699

694700
$response = new OneLogin_Saml2_Response($this->_settings, $message);
695-
$this->assertTrue($response->isValid());
701+
$response->isValid();
702+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
696703

697704
$response2 = new OneLogin_Saml2_Response($this->_settings, $message2);
698-
$this->assertTrue($response2->isValid());
705+
$response2->isValid();
706+
$this->assertEquals('No Signature found. SAML Response rejected', $response2->getError());
699707

700708
$response3 = new OneLogin_Saml2_Response($this->_settings, $message3);
701-
$this->assertTrue($response3->isValid());
709+
$response3->isValid();
710+
$this->assertEquals('No Signature found. SAML Response rejected', $response3->getError());
702711

703712
$response4 = new OneLogin_Saml2_Response($this->_settings, $message4);
704-
$this->assertTrue($response4->isValid());
713+
$response3->isValid();
714+
$this->assertEquals('No Signature found. SAML Response rejected', $response3->getError());
705715

706716
$response5 = new OneLogin_Saml2_Response($this->_settings, $message5);
707-
$this->assertTrue($response5->isValid());
717+
$response5->isValid();
718+
$this->assertEquals('No Signature found. SAML Response rejected', $response3->getError());
708719

709720
$response6 = new OneLogin_Saml2_Response($this->_settings, $message6);
710-
$this->assertTrue($response6->isValid());
721+
$response6->isValid();
722+
$this->assertEquals('No Signature found. SAML Response rejected', $response3->getError());
711723

712724
$this->_settings->setStrict(true);
713725

@@ -746,7 +758,8 @@ public function testDatetimeWithMiliseconds()
746758
{
747759
$xml = file_get_contents(TEST_ROOT . '/data/responses/unsigned_response_with_miliseconds.xm.base64');
748760
$response = new OneLogin_Saml2_Response($this->_settings, $xml);
749-
$this->assertTrue($response->isValid());
761+
$response->isValid();
762+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
750763

751764
$this->_settings->setStrict(true);
752765

@@ -757,7 +770,8 @@ public function testDatetimeWithMiliseconds()
757770

758771
$response2 = new OneLogin_Saml2_Response($this->_settings, $message);
759772

760-
$this->assertTrue($response2->isValid());
773+
$response2->isValid();
774+
$this->assertEquals('No Signature found. SAML Response rejected', $response2->getError());
761775
}
762776

763777
/**
@@ -778,15 +792,18 @@ public function testIsInValidRequestId()
778792
$response = new OneLogin_Saml2_Response($this->_settings, $message);
779793

780794
$requestId = 'invalid';
781-
$this->assertTrue($response->isValid($requestId));
795+
$response->isValid($requestId);
796+
$this->assertEquals('No Signature found. SAML Response rejected', $response->getError());
782797

783798
$this->_settings->setStrict(true);
784799

785-
$this->assertFalse($response->isValid($requestId));
786-
$this->assertContains('The InResponseTo of the Response', $response->getError());
800+
$response2 = new OneLogin_Saml2_Response($this->_settings, $message);
801+
$response2->isValid($requestId);
802+
$this->assertContains('The InResponseTo of the Response', $response2->getError());
787803

788804
$validRequestId = '_57bcbf70-7b1f-012e-c821-782bcb13bb38';
789-
$this->assertTrue($response->isValid($validRequestId));
805+
$response2->isValid($validRequestId);
806+
$this->assertContains('No Signature found. SAML Response rejected', $response2->getError());
790807
}
791808

792809

@@ -810,18 +827,21 @@ public function testIsInValidSignIssues()
810827
$settingsInfo['security']['wantAssertionsSigned'] = false;
811828
$settings = new OneLogin_Saml2_Settings($settingsInfo);
812829
$response = new OneLogin_Saml2_Response($settings, $message);
813-
$this->assertTrue($response->isValid());
830+
$response->isValid();
831+
$this->assertContains('No Signature found. SAML Response rejected', $response->getError());
814832

815833
$settingsInfo['security']['wantAssertionsSigned'] = true;
816834
$settings2 = new OneLogin_Saml2_Settings($settingsInfo);
817835
$response2 = new OneLogin_Saml2_Response($settings2, $message);
818-
$this->assertTrue($response2->isValid());
836+
$response2->isValid();
837+
$this->assertContains('No Signature found. SAML Response rejected', $response2->getError());
819838

820839
$settingsInfo['strict'] = true;
821840
$settingsInfo['security']['wantAssertionsSigned'] = false;
822841
$settings3 = new OneLogin_Saml2_Settings($settingsInfo);
823842
$response3 = new OneLogin_Saml2_Response($settings3, $message);
824-
$this->assertTrue($response3->isValid());
843+
$response3->isValid();
844+
$this->assertContains('No Signature found. SAML Response rejected', $response3->getError());
825845

826846
$settingsInfo['security']['wantAssertionsSigned'] = true;
827847
$settings4 = new OneLogin_Saml2_Settings($settingsInfo);
@@ -836,18 +856,21 @@ public function testIsInValidSignIssues()
836856
$settingsInfo['security']['wantMessagesSigned'] = false;
837857
$settings5 = new OneLogin_Saml2_Settings($settingsInfo);
838858
$response5 = new OneLogin_Saml2_Response($settings5, $message);
839-
$this->assertTrue($response5->isValid());
859+
$response5->isValid();
860+
$this->assertContains('No Signature found. SAML Response rejected', $response5->getError());
840861

841862
$settingsInfo['security']['wantMessagesSigned'] = true;
842863
$settings6 = new OneLogin_Saml2_Settings($settingsInfo);
843864
$response6 = new OneLogin_Saml2_Response($settings6, $message);
844-
$this->assertTrue($response6->isValid());
865+
$response6->isValid();
866+
$this->assertContains('No Signature found. SAML Response rejected', $response6->getError());
845867

846868
$settingsInfo['strict'] = true;
847869
$settingsInfo['security']['wantMessagesSigned'] = false;
848870
$settings7 = new OneLogin_Saml2_Settings($settingsInfo);
849871
$response7 = new OneLogin_Saml2_Response($settings7, $message);
850-
$this->assertTrue($response7->isValid());
872+
$response7->isValid();
873+
$this->assertContains('No Signature found. SAML Response rejected', $response7->getError());
851874

852875
$settingsInfo['security']['wantMessagesSigned'] = true;
853876
$settings8 = new OneLogin_Saml2_Settings($settingsInfo);
@@ -877,13 +900,15 @@ public function testIsInValidEncIssues()
877900
$settingsInfo['security']['wantAssertionsEncrypted'] = true;
878901
$settings = new OneLogin_Saml2_Settings($settingsInfo);
879902
$response = new OneLogin_Saml2_Response($settings, $message);
880-
$this->assertTrue($response->isValid());
903+
$response->isValid();
904+
$this->assertContains('No Signature found. SAML Response rejected', $response->getError());
881905

882906
$settingsInfo['strict'] = true;
883907
$settingsInfo['security']['wantAssertionsEncrypted'] = false;
884908
$settings = new OneLogin_Saml2_Settings($settingsInfo);
885909
$response2 = new OneLogin_Saml2_Response($settings, $message);
886-
$this->assertTrue($response2->isValid());
910+
$response2->isValid();
911+
$this->assertContains('No Signature found. SAML Response rejected', $response2->getError());
887912

888913
$settingsInfo['security']['wantAssertionsEncrypted'] = true;
889914
$settings = new OneLogin_Saml2_Settings($settingsInfo);
@@ -897,13 +922,14 @@ public function testIsInValidEncIssues()
897922
$settingsInfo['strict'] = false;
898923
$settings = new OneLogin_Saml2_Settings($settingsInfo);
899924
$response4 = new OneLogin_Saml2_Response($settings, $message);
900-
$this->assertTrue($response4->isValid());
925+
$response4->isValid();
926+
$this->assertContains('No Signature found. SAML Response rejected', $response4->getError());
901927

902928
$settingsInfo['strict'] = true;
903929
$settings = new OneLogin_Saml2_Settings($settingsInfo);
904-
$response4 = new OneLogin_Saml2_Response($settings, $message);
905-
$this->assertFalse($response4->isValid());
906-
$this->assertEquals('The NameID of the Response is not encrypted and the SP requires it', $response4->getError());
930+
$response5 = new OneLogin_Saml2_Response($settings, $message);
931+
$this->assertFalse($response5->isValid());
932+
$this->assertEquals('The NameID of the Response is not encrypted and the SP requires it', $response5->getError());
907933
}
908934

909935
/**
@@ -959,7 +985,8 @@ public function testNamespaceIsValid()
959985
$xml = file_get_contents(TEST_ROOT . '/data/responses/response_namespaces.xml.base64');
960986
$response = new OneLogin_Saml2_Response($this->_settings, $xml);
961987

962-
$this->assertTrue($response->isValid());
988+
$response->isValid();
989+
$this->assertContains('No Signature found. SAML Response rejected', $response->getError());
963990
}
964991

965992
/**
@@ -973,7 +1000,8 @@ public function testADFSValid()
9731000
$xml = file_get_contents(TEST_ROOT . '/data/responses/response_adfs1.xml.base64');
9741001
$response = new OneLogin_Saml2_Response($this->_settings, $xml);
9751002

976-
$this->assertTrue($response->isValid());
1003+
$response->isValid();
1004+
$this->assertContains('No Signature found. SAML Response rejected', $response->getError());
9771005
}
9781006

9791007

@@ -1049,7 +1077,8 @@ public function testIsValidEnc()
10491077

10501078
$response4 = new OneLogin_Saml2_Response($settings, $message4);
10511079

1052-
$this->assertTrue($response4->isValid());
1080+
$response4->isValid();
1081+
$this->assertContains('No Signature found. SAML Response rejected', $response4->getError());
10531082
}
10541083

10551084
/**

‎tests/src/OneLogin/Saml2/SettingsTest.php‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ public function testLoadSettingsFromFile()
7575
/**
7676
* Tests getCertPath method of the OneLogin_Saml2_Settings
7777
*
78+
* @covers OneLogin_Saml2_Settings::getBasePath
7879
* @covers OneLogin_Saml2_Settings::getCertPath
7980
*/
8081
public function testGetCertPath()
@@ -392,6 +393,33 @@ public function testGetSPMetadataSignedNoMetadataCert()
392393
}
393394
}
394395

396+
397+
/**
398+
* Tests the setIdPCert method of the OneLogin_Saml2_Settings
399+
*
400+
* @covers OneLogin_Saml2_Settings::setIdPCert
401+
*/
402+
public function testSetIdPCert()
403+
{
404+
$settingsDir = TEST_ROOT .'/settings/';
405+
include $settingsDir.'settings1.php';
406+
407+
$cert = $settingsInfo['idp']['x509cert'];
408+
unset($settingsInfo['idp']['x509cert']);
409+
410+
$settings = new OneLogin_Saml2_Settings($settingsInfo);
411+
$idpData = $settings->getIdPData();
412+
$this->assertEquals($idpData['x509cert'], '');
413+
414+
$settings->setIdPCert($cert);
415+
$idpData2 = $settings->getIdPData();
416+
$this->assertNotEquals($idpData2['x509cert'], '');
417+
$this->assertNotEquals($idpData2['x509cert'], $cert);
418+
419+
$formatedCert = OneLogin_Saml2_Utils::formatCert($cert);
420+
$this->assertEquals($idpData2['x509cert'], $formatedCert);
421+
}
422+
395423
/**
396424
* Tests the validateMetadata method of the OneLogin_Saml2_Settings
397425
* Case valid metadata

0 commit comments

Comments
 (0)