Skip to content

Commit 708e1ae

Browse files
pitbulkpitbulk
committed
Fix SAML-Toolkits#76. Now the SP is able to add signatures using DSA_SHA1, RSA_SHA1,RSA_SHA256, RSA_SHA384 or RSA_SHA512
1 parent 6c07e5b commit 708e1ae

File tree

10 files changed

+53
-29
lines changed

10 files changed

+53
-29
lines changed

‎README.md‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,14 @@ $advancedSettings = array (
411411
// Indicates if the SP will validate all received xmls.
412412
// (In order to validate the xml, 'strict' and 'wantXMLValidation' must be true).
413413
'wantXMLValidation' => true,
414+
415+
// Algorithm that the toolkit will use on signing process. Options:
416+
// 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
417+
// 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
418+
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
419+
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
420+
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
421+
'signatureAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
414422
),
415423

416424
// Contact information template, it is recommended to suply a
@@ -778,8 +786,8 @@ if (!OneLogin_Saml2_LogoutRequest::isValid($this->_settings, $request)) {
778786

779787
$security = $this->_settings->getSecurityData();
780788
if (isset($security['logoutResponseSigned']) && $security['logoutResponseSigned']) {
781-
$signature = $this->buildResponseSignature($logoutResponse, $parameters['RelayState']);
782-
$parameters['SigAlg'] = XMLSecurityKey::RSA_SHA1;
789+
$signature = $this->buildResponseSignature($logoutResponse, $parameters['RelayState'], $security['signatureAlgorithm']);
790+
$parameters['SigAlg'] = $security['signatureAlgorithm'];
783791
$parameters['Signature'] = $signature;
784792
}
785793

‎advanced_settings_example.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,14 @@
5555
// Indicates if the SP will validate all received xmls.
5656
// (In order to validate the xml, 'strict' and 'wantXMLValidation' must be true).
5757
'wantXMLValidation' => true,
58+
59+
// Algorithm that the toolkit will use on signing process. Options:
60+
// 'http://www.w3.org/2000/09/xmldsig#rsa-sha1'
61+
// 'http://www.w3.org/2000/09/xmldsig#dsa-sha1'
62+
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'
63+
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha384'
64+
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
65+
'signatureAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
5866
),
5967

6068
// Contact information template, it is recommended to suply a technical and support contacts

‎lib/Saml2/Auth.php‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -161,8 +161,8 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
161161

162162
$security = $this->_settings->getSecurityData();
163163
if (isset($security['logoutResponseSigned']) && $security['logoutResponseSigned']) {
164-
$signature = $this->buildResponseSignature($logoutResponse, $parameters['RelayState']);
165-
$parameters['SigAlg'] = XMLSecurityKey::RSA_SHA1;
164+
$signature = $this->buildResponseSignature($logoutResponse, $parameters['RelayState'], $security['signatureAlgorithm']);
165+
$parameters['SigAlg'] = $security['signatureAlgorithm'];
166166
$parameters['Signature'] = $signature;
167167
}
168168

@@ -300,8 +300,8 @@ public function login($returnTo = null, $parameters = array(), $forceAuthn = fal
300300

301301
$security = $this->_settings->getSecurityData();
302302
if (isset($security['authnRequestsSigned']) && $security['authnRequestsSigned']) {
303-
$signature = $this->buildRequestSignature($samlRequest, $parameters['RelayState']);
304-
$parameters['SigAlg'] = XMLSecurityKey::RSA_SHA1;
303+
$signature = $this->buildRequestSignature($samlRequest, $parameters['RelayState'], $security['signatureAlgorithm']);
304+
$parameters['SigAlg'] = $security['signatureAlgorithm'];
305305
$parameters['Signature'] = $signature;
306306
}
307307
$this->redirectTo($this->getSSOurl(), $parameters);
@@ -344,8 +344,8 @@ public function logout($returnTo = null, $parameters = array(), $nameId = null,
344344

345345
$security = $this->_settings->getSecurityData();
346346
if (isset($security['logoutRequestSigned']) && $security['logoutRequestSigned']) {
347-
$signature = $this->buildRequestSignature($samlRequest, $parameters['RelayState']);
348-
$parameters['SigAlg'] = XMLSecurityKey::RSA_SHA1;
347+
$signature = $this->buildRequestSignature($samlRequest, $parameters['RelayState'], $security['signatureAlgorithm']);
348+
$parameters['SigAlg'] = $security['signatureAlgorithm'];
349349
$parameters['Signature'] = $signature;
350350
}
351351

@@ -381,12 +381,13 @@ public function getSLOurl()
381381
/**
382382
* Generates the Signature for a SAML Request
383383
*
384-
* @param string $samlRequest The SAML Request
385-
* @param string $relayState The RelayState
384+
* @param string $samlRequest The SAML Request
385+
* @param string $relayState The RelayState
386+
* @param string $sign_algorithm Signature algorithm method
386387
*
387388
* @return string A base64 encoded signature
388389
*/
389-
public function buildRequestSignature($samlRequest, $relayState)
390+
public function buildRequestSignature($samlRequest, $relayState, $sign_algorithm = XMLSecurityKey::RSA_SHA1)
390391
{
391392
if (!$this->_settings->checkSPCerts()) {
392393
throw new OneLogin_Saml2_Error(
@@ -397,25 +398,26 @@ public function buildRequestSignature($samlRequest, $relayState)
397398

398399
$key = $this->_settings->getSPkey();
399400

400-
$objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
401+
$objKey = new XMLSecurityKey($sign_algorithm, array('type' => 'private'));
401402
$objKey->loadKey($key, false);
402403

403404
$msg = 'SAMLRequest='.urlencode($samlRequest);
404405
$msg .= '&RelayState='.urlencode($relayState);
405-
$msg .= '&SigAlg=' . urlencode(XMLSecurityKey::RSA_SHA1);
406+
$msg .= '&SigAlg=' . urlencode($sign_algorithm);
406407
$signature = $objKey->signData($msg);
407408
return base64_encode($signature);
408409
}
409410

410411
/**
411412
* Generates the Signature for a SAML Response
412413
*
413-
* @param string $samlResponse The SAML Response
414-
* @param string $relayState The RelayState
414+
* @param string $samlResponse The SAML Response
415+
* @param string $relayState The RelayState
416+
* @param string $sign_algorithm Signature algorithm method
415417
*
416418
* @return string A base64 encoded signature
417419
*/
418-
public function buildResponseSignature($samlResponse, $relayState)
420+
public function buildResponseSignature($samlResponse, $relayState, $sign_algorithm = XMLSecurityKey::RSA_SHA1)
419421
{
420422
if (!$this->_settings->checkSPCerts()) {
421423
throw new OneLogin_Saml2_Error(
@@ -426,12 +428,12 @@ public function buildResponseSignature($samlResponse, $relayState)
426428

427429
$key = $this->_settings->getSPkey();
428430

429-
$objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
431+
$objKey = new XMLSecurityKey($sign_algorithm, array('type' => 'private'));
430432
$objKey->loadKey($key, false);
431433

432434
$msg = 'SAMLResponse='.urlencode($samlResponse);
433435
$msg .= '&RelayState='.urlencode($relayState);
434-
$msg .= '&SigAlg=' . urlencode(XMLSecurityKey::RSA_SHA1);
436+
$msg .= '&SigAlg=' . urlencode($sign_algorithm);
435437
$signature = $objKey->signData($msg);
436438
return base64_encode($signature);
437439
}

‎lib/Saml2/LogoutRequest.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class OneLogin_Saml2_LogoutRequest
2323
* SAML Logout Request
2424
* @var string
2525
*/
26-
private $_logoutRequest;
26+
protected $_logoutRequest;
2727

2828
/**
2929
* After execute a validation process, this var contains the cause

‎lib/Saml2/LogoutResponse.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ class OneLogin_Saml2_LogoutResponse
1717
* The decoded, unprocessed XML response provided to the constructor.
1818
* @var string
1919
*/
20-
private $_logoutResponse;
20+
protected $_logoutResponse;
2121

2222
/**
2323
* A DOMDocument class loaded from the SAML LogoutResponse.

‎lib/Saml2/Metadata.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,9 @@ public static function builder($sp, $authnsign = false, $wsign = false, $validUn
113113
*
114114
* @return string Signed Metadata
115115
*/
116-
public static function signMetadata($metadata, $key, $cert)
116+
public static function signMetadata($metadata, $key, $cert, $sign_algorithm = XMLSecurityKey::RSA_SHA1)
117117
{
118-
return OneLogin_Saml2_Utils::addSign($metadata, $key, $cert);
118+
return OneLogin_Saml2_Utils::addSign($metadata, $key, $cert, $sign_algorithm);
119119
}
120120

121121
/**

‎lib/Saml2/Response.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -548,7 +548,7 @@ public function validateSignedElements($signedElements)
548548
* @throws Exception
549549
* @return DOMNodeList The queried node
550550
*/
551-
private function _queryAssertion($assertionXpath)
551+
protected function _queryAssertion($assertionXpath)
552552
{
553553
if ($this->encrypted) {
554554
$xpath = new DOMXPath($this->decryptedDocument);

‎lib/Saml2/Settings.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,11 @@ private function _addDefaultValues()
334334
$this->_security['wantXMLValidation'] = true;
335335
}
336336

337+
// Algorithm
338+
if (!isset($this->_security['signatureAlgorithm'])) {
339+
$this->_security['signatureAlgorithm'] = XMLSecurityKey::RSA_SHA1;
340+
}
341+
337342
// Certificates / Private key /Fingerprint
338343
if (!isset($this->_idp['x509cert'])) {
339344
$this->_idp['x509cert'] = '';

‎lib/Saml2/Utils.php‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -908,11 +908,12 @@ public static function castKey(XMLSecurityKey $key, $algorithm, $type = 'public'
908908
/**
909909
* Adds signature key and senders certificate to an element (Message or Assertion).
910910
*
911-
* @param string|DomDocument $xml The element we should sign
912-
* @param string $key The private key
913-
* @param string $cert The public
911+
* @param string|DomDocument $xml The element we should sign
912+
* @param string $key The private key
913+
* @param string $cert The public
914+
* @param string $sign_algorithm Signature algorithm method
914915
*/
915-
public static function addSign($xml, $key, $cert)
916+
public static function addSign($xml, $key, $cert, $sign_algorithm = XMLSecurityKey::RSA_SHA1)
916917
{
917918
if ($xml instanceof DOMDocument) {
918919
$dom = $xml;
@@ -925,7 +926,7 @@ public static function addSign($xml, $key, $cert)
925926
}
926927

927928
/* Load the private key. */
928-
$objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
929+
$objKey = new XMLSecurityKey($sign_algorithm, array('type' => 'private'));
929930
$objKey->loadKey($key, false);
930931

931932
/* Get the EntityDescriptor node we should sign. */

‎settings_example.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
// Specifies constraints on the name identifier to be used to
3838
// represent the requested subject.
3939
// Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported
40-
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
40+
'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified',
4141

4242
// Usually x509cert and privateKey of the SP are provided by files placed at
4343
// the certs folder. But we can also provide them with the following parameters

0 commit comments

Comments
 (0)