Skip to content

Commit cfb7254

Browse files
pitbulkpitbulk
committed
Merge
1 parent ab7fff7 commit cfb7254

File tree

8 files changed

+186
-128
lines changed

8 files changed

+186
-128
lines changed

‎lib/Saml2/Auth.php‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -137,6 +137,8 @@ class OneLogin_Saml2_Auth
137137
* Initializes the SP SAML instance.
138138
*
139139
* @param array|object|null $oldSettings Setting data (You can provide a OneLogin_Saml_Settings, the settings object of the Saml folder implementation)
140+
*
141+
* @throws OneLogin_Saml2_Error
140142
*/
141143
public function __construct($oldSettings = null)
142144
{
@@ -157,11 +159,12 @@ public function getSettings()
157159
* Set the strict mode active/disable
158160
*
159161
* @param bool $value Strict parameter
162+
*
160163
* @throws OneLogin_Saml2_Error
161164
*/
162165
public function setStrict($value)
163166
{
164-
if (! (is_bool($value))) {
167+
if (!is_bool($value)) {
165168
throw new OneLogin_Saml2_Error(
166169
'Invalid value passed to setStrict()',
167170
OneLogin_Saml2_Error::SETTINGS_INVALID_SYNTAX
@@ -177,12 +180,13 @@ public function setStrict($value)
177180
* @param string|null $requestId The ID of the AuthNRequest sent by this SP to the IdP
178181
*
179182
* @throws OneLogin_Saml2_Error
183+
* @throws OneLogin_Saml2_ValidationError
180184
*/
181185
public function processResponse($requestId = null)
182186
{
183187
$this->_errors = array();
184188
$this->_errorReason = null;
185-
if (isset($_POST) && isset($_POST['SAMLResponse'])) {
189+
if (isset($_POST['SAMLResponse'])) {
186190
// AuthnResponse -- HTTP_POST Binding
187191
$response = new OneLogin_Saml2_Response($this->_settings, $_POST['SAMLResponse']);
188192
$this->_lastResponse = $response->getXMLDocument();
@@ -229,7 +233,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
229233
{
230234
$this->_errors = array();
231235
$this->_errorReason = null;
232-
if (isset($_GET) && isset($_GET['SAMLResponse'])) {
236+
if (isset($_GET['SAMLResponse'])) {
233237
$logoutResponse = new OneLogin_Saml2_LogoutResponse($this->_settings, $_GET['SAMLResponse']);
234238
$this->_lastResponse = $logoutResponse->getXML();
235239
if (!$logoutResponse->isValid($requestId, $retrieveParametersFromServer)) {
@@ -247,7 +251,7 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
247251
}
248252
}
249253
}
250-
} else if (isset($_GET) && isset($_GET['SAMLRequest'])) {
254+
} else if (isset($_GET['SAMLRequest'])) {
251255
$logoutRequest = new OneLogin_Saml2_LogoutRequest($this->_settings, $_GET['SAMLRequest']);
252256
$this->_lastRequest = $logoutRequest->getXML();
253257
if (!$logoutRequest->isValid($retrieveParametersFromServer)) {
@@ -296,10 +300,13 @@ public function processSLO($keepLocalSession = false, $requestId = null, $retrie
296300
* Redirects the user to the url past by parameter
297301
* or to the url that we defined in our SSO Request.
298302
*
299-
* @param string $url The target URL to redirect the user.
300-
* @param array $parameters Extra parameters to be passed as part of the url
301-
* @param bool $stay True if we want to stay (returns the url string) False to redirect
303+
* @param string $url The target URL to redirect the user.
304+
* @param array $parameters Extra parameters to be passed as part of the url
305+
* @param bool $stay True if we want to stay (returns the url string) False to redirect
306+
*
302307
* @return string|null
308+
*
309+
* @throws OneLogin_Saml2_Error
303310
*/
304311
public function redirectTo($url = '', $parameters = array(), $stay = false)
305312
{
@@ -452,14 +459,16 @@ public function getAttributeWithFriendlyName($friendlyName)
452459
/**
453460
* Initiates the SSO process.
454461
*
455-
* @param string|null $returnTo The target URL the user should be returned to after login.
456-
* @param array $parameters Extra parameters to be added to the GET
457-
* @param bool $forceAuthn When true the AuthNRequest will set the ForceAuthn='true'
458-
* @param bool $isPassive When true the AuthNRequest will set the Ispassive='true'
459-
* @param bool $stay True if we want to stay (returns the url string) False to redirect
460-
* @param bool $setNameIdPolicy When true the AuthNRueqest will set a nameIdPolicy element
462+
* @param string|null $returnTo The target URL the user should be returned to after login.
463+
* @param array $parameters Extra parameters to be added to the GET
464+
* @param bool $forceAuthn When true the AuthNRequest will set the ForceAuthn='true'
465+
* @param bool $isPassive When true the AuthNRequest will set the Ispassive='true'
466+
* @param bool $stay True if we want to stay (returns the url string) False to redirect
467+
* @param bool $setNameIdPolicy When true the AuthNRueqest will set a nameIdPolicy element
461468
*
462469
* @return string|null If $stay is True, it return a string with the SLO URL + LogoutRequest + parameters
470+
*
471+
* @throws OneLogin_Saml2_Error
463472
*/
464473
public function login($returnTo = null, $parameters = array(), $forceAuthn = false, $isPassive = false, $stay = false, $setNameIdPolicy = true)
465474
{
@@ -591,7 +600,6 @@ public function getLastRequestID()
591600
*
592601
* @return string A base64 encoded signature
593602
*
594-
* @throws Exception
595603
* @throws OneLogin_Saml2_Error
596604
*/
597605
public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA1)
@@ -634,7 +642,6 @@ public function buildRequestSignature($samlRequest, $relayState, $signAlgorithm
634642
*
635643
* @return string A base64 encoded signature
636644
*
637-
* @throws Exception
638645
* @throws OneLogin_Saml2_Error
639646
*/
640647
public function buildResponseSignature($samlResponse, $relayState, $signAlgorithm = XMLSecurityKey::RSA_SHA1)

‎lib/Saml2/IdPMetadataParser.php‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,8 @@ public static function parseFileXML($filepath, $entityId = null, $desiredNameIdF
8585
* @param string $desiredSLOBinding Parse specific binding SLO endpoint.
8686
*
8787
* @return array metadata info in php-saml settings format
88-
* @throws \Exception
88+
*
89+
* @throws Exception
8990
*/
9091
public static function parseXML($xml, $entityId = null, $desiredNameIdFormat = null, $desiredSSOBinding = OneLogin_Saml2_Constants::BINDING_HTTP_REDIRECT, $desiredSLOBinding = OneLogin_Saml2_Constants::BINDING_HTTP_REDIRECT)
9192
{

‎lib/Saml2/LogoutRequest.php‎

Lines changed: 34 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,14 @@ class OneLogin_Saml2_LogoutRequest
3333
/**
3434
* Constructs the Logout Request object.
3535
*
36-
* @param OneLogin_Saml2_Settings $settings Settings
37-
* @param string|null $request A UUEncoded Logout Request.
38-
* @param string|null $nameId The NameID that will be set in the LogoutRequest.
39-
* @param string|null $sessionIndex The SessionIndex (taken from the SAML Response in the SSO process).
40-
* @param string|null $nameIdFormat The NameID Format will be set in the LogoutRequest.
41-
* @param string|null $nameIdNameQualifier The NameID NameQualifier will be set in the LogoutRequest.
36+
* @param OneLogin_Saml2_Settings $settings Settings
37+
* @param string|null $request A UUEncoded Logout Request.
38+
* @param string|null $nameId The NameID that will be set in the LogoutRequest.
39+
* @param string|null $sessionIndex The SessionIndex (taken from the SAML Response in the SSO process).
40+
* @param string|null $nameIdFormat The NameID Format will be set in the LogoutRequest.
41+
* @param string|null $nameIdNameQualifier The NameID NameQualifier will be set in the LogoutRequest.
42+
*
43+
* @throws OneLogin_Saml2_Error
4244
*/
4345
public function __construct(OneLogin_Saml2_Settings $settings, $request = null, $nameId = null, $sessionIndex = null, $nameIdFormat = null, $nameIdNameQualifier = null)
4446
{
@@ -177,11 +179,12 @@ public static function getID($request)
177179
* Gets the NameID Data of the the Logout Request.
178180
*
179181
* @param string|DOMDocument $request Logout Request Message
180-
* @param string|null $key The SP key
182+
* @param string|null $key The SP key
181183
*
182184
* @return array Name ID Data (Value, Format, NameQualifier, SPNameQualifier)
183185
*
184-
* @throws Exception
186+
* @throws OneLogin_Saml2_Error
187+
* @throws OneLogin_Saml2_ValidationError
185188
*/
186189
public static function getNameIdData($request, $key = null)
187190
{
@@ -239,9 +242,12 @@ public static function getNameIdData($request, $key = null)
239242
* Gets the NameID of the Logout Request.
240243
*
241244
* @param string|DOMDocument $request Logout Request Message
242-
* @param string|null $key The SP key
245+
* @param string|null $key The SP key
243246
*
244247
* @return string Name ID Value
248+
*
249+
* @throws OneLogin_Saml2_Error
250+
* @throws OneLogin_Saml2_ValidationError
245251
*/
246252
public static function getNameId($request, $key = null)
247253
{
@@ -255,6 +261,7 @@ public static function getNameId($request, $key = null)
255261
* @param string|DOMDocument $request Logout Request Message
256262
*
257263
* @return string|null $issuer The Issuer
264+
* @throws Exception
258265
*/
259266
public static function getIssuer($request)
260267
{
@@ -282,6 +289,8 @@ public static function getIssuer($request)
282289
* @param string|DOMDocument $request Logout Request Message
283290
*
284291
* @return array The SessionIndex value
292+
*
293+
* @throws Exception
285294
*/
286295
public static function getSessionIndexes($request)
287296
{
@@ -303,6 +312,8 @@ public static function getSessionIndexes($request)
303312
/**
304313
* Checks if the Logout Request recieved is valid.
305314
*
315+
* @param bool $retrieveParametersFromServer
316+
*
306317
* @return bool If the Logout Request is or not valid
307318
*/
308319
public function isValid($retrieveParametersFromServer = false)
@@ -344,34 +355,30 @@ public function isValid($retrieveParametersFromServer = false)
344355
// Check destination
345356
if ($dom->documentElement->hasAttribute('Destination')) {
346357
$destination = $dom->documentElement->getAttribute('Destination');
347-
if (!empty($destination)) {
348-
if (strpos($destination, $currentURL) === false) {
349-
throw new OneLogin_Saml2_ValidationError(
350-
"The LogoutRequest was received at $currentURL instead of $destination",
351-
OneLogin_Saml2_ValidationError::WRONG_DESTINATION
352-
);
353-
}
358+
if (!empty($destination) && strpos($destination, $currentURL) === false) {
359+
throw new OneLogin_Saml2_ValidationError(
360+
"The LogoutRequest was received at $currentURL instead of $destination",
361+
OneLogin_Saml2_ValidationError::WRONG_DESTINATION
362+
);
354363
}
355364
}
356365

357-
$nameId = $this->getNameId($dom, $this->_settings->getSPkey());
366+
$nameId = static::getNameId($dom, $this->_settings->getSPkey());
358367

359368
// Check issuer
360-
$issuer = $this->getIssuer($dom);
369+
$issuer = static::getIssuer($dom);
361370
if (!empty($issuer) && $issuer != $idPEntityId) {
362371
throw new OneLogin_Saml2_ValidationError(
363372
"Invalid issuer in the Logout Request",
364373
OneLogin_Saml2_ValidationError::WRONG_ISSUER
365374
);
366375
}
367376

368-
if ($security['wantMessagesSigned']) {
369-
if (!isset($_GET['Signature'])) {
370-
throw new OneLogin_Saml2_ValidationError(
371-
"The Message of the Logout Request is not signed and the SP require it",
372-
OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
373-
);
374-
}
377+
if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
378+
throw new OneLogin_Saml2_ValidationError(
379+
"The Message of the Logout Request is not signed and the SP require it",
380+
OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
381+
);
375382
}
376383
}
377384

@@ -396,7 +403,8 @@ public function isValid($retrieveParametersFromServer = false)
396403
}
397404
}
398405

399-
/* After execute a validation process, if fails this method returns the cause
406+
/**
407+
* After execute a validation process, if fails this method returns the cause
400408
*
401409
* @return string Cause
402410
*/

‎lib/Saml2/LogoutResponse.php‎

Lines changed: 12 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,6 @@ public function getStatus()
115115
* @param bool $retrieveParametersFromServer
116116
*
117117
* @return bool Returns if the SAML LogoutResponse is or not valid
118-
*
119-
* @throws Exception
120118
*/
121119
public function isValid($requestId = null, $retrieveParametersFromServer = false)
122120
{
@@ -163,24 +161,20 @@ public function isValid($requestId = null, $retrieveParametersFromServer = false
163161
// Check destination
164162
if ($this->document->documentElement->hasAttribute('Destination')) {
165163
$destination = $this->document->documentElement->getAttribute('Destination');
166-
if (!empty($destination)) {
167-
if (strpos($destination, $currentURL) === false) {
168-
throw new OneLogin_Saml2_ValidationError(
169-
"The LogoutResponse was received at $currentURL instead of $destination",
170-
OneLogin_Saml2_ValidationError::WRONG_DESTINATION
171-
);
172-
}
173-
}
174-
}
175-
176-
if ($security['wantMessagesSigned']) {
177-
if (!isset($_GET['Signature'])) {
164+
if (!empty($destination) && strpos($destination, $currentURL) === false) {
178165
throw new OneLogin_Saml2_ValidationError(
179-
"The Message of the Logout Response is not signed and the SP requires it",
180-
OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
166+
"The LogoutResponse was received at $currentURL instead of $destination",
167+
OneLogin_Saml2_ValidationError::WRONG_DESTINATION
181168
);
182169
}
183170
}
171+
172+
if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
173+
throw new OneLogin_Saml2_ValidationError(
174+
"The Message of the Logout Response is not signed and the SP requires it",
175+
OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
176+
);
177+
}
184178
}
185179

186180
if (isset($_GET['Signature'])) {
@@ -270,7 +264,8 @@ public function getResponse($deflate = null)
270264
return base64_encode($subject);
271265
}
272266

273-
/* After execute a validation process, if fails this method returns the cause.
267+
/**
268+
* After execute a validation process, if fails this method returns the cause.
274269
*
275270
* @return string Cause
276271
*/

‎lib/Saml2/Metadata.php‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ class OneLogin_Saml2_Metadata
2121
* @param array $contacts Contacts info
2222
* @param array $organization Organization ingo
2323
* @param array $attributes
24+
*
2425
* @return string SAML Metadata XML
2526
*/
2627
public static function builder($sp, $authnsign = false, $wsign = false, $validUntil = null, $cacheDuration = null, $contacts = array(), $organization = array(), $attributes = array())
@@ -173,13 +174,15 @@ public static function builder($sp, $authnsign = false, $wsign = false, $validUn
173174
/**
174175
* Signs the metadata with the key/cert provided
175176
*
176-
* @param string $metadata SAML Metadata XML
177-
* @param string $key x509 key
178-
* @param string $cert x509 cert
179-
* @param string $signAlgorithm Signature algorithm method
180-
* @param string $digestAlgorithm Digest algorithm method
177+
* @param string $metadata SAML Metadata XML
178+
* @param string $key x509 key
179+
* @param string $cert x509 cert
180+
* @param string $signAlgorithm Signature algorithm method
181+
* @param string $digestAlgorithm Digest algorithm method
181182
*
182183
* @return string Signed Metadata
184+
*
185+
* @throws Exception
183186
*/
184187
public static function signMetadata($metadata, $key, $cert, $signAlgorithm = XMLSecurityKey::RSA_SHA1, $digestAlgorithm = XMLSecurityDSig::SHA1)
185188
{
@@ -190,11 +193,13 @@ public static function signMetadata($metadata, $key, $cert, $signAlgorithm = XML
190193
* Adds the x509 descriptors (sign/encriptation) to the metadata
191194
* The same cert will be used for sign/encrypt
192195
*
193-
* @param string $metadata SAML Metadata XML
194-
* @param string $cert x509 cert
195-
* @param bool $wantsEncrypted Whether to include the KeyDescriptor for encryption
196+
* @param string $metadata SAML Metadata XML
197+
* @param string $cert x509 cert
198+
* @param bool $wantsEncrypted Whether to include the KeyDescriptor for encryption
196199
*
197200
* @return string Metadata with KeyDescriptors
201+
*
202+
* @throws Exception
198203
*/
199204
public static function addX509KeyDescriptors($metadata, $cert, $wantsEncrypted = true)
200205
{

0 commit comments

Comments
 (0)