Describe the bug
ADFS IdPs load available SAML IdP metadata even though they are not enabled .
In combination with the install instructions provided in the documentation, which suggests copying the whole metadata-templates/ content to metadata/, probably erroneous configuration (in my case certificates not being available as saml20-idp-hosted.php expects) is loaded.
This will only interfere when using the created associationGroup, especially during SLO requests.
|
try { |
|
// this makes the ADFS IdP use the same SP associations as the SAML 2.0 IdP |
|
$saml2EntityId = $metadata->getMetaDataCurrentEntityID('saml20-idp-hosted'); |
|
$this->associationGroup = 'saml2:' . $saml2EntityId; |
|
} catch (\Exception $e) { |
|
// probably no SAML 2 IdP configured for this host. Ignore the error |
|
} |
To Reproduce
Steps to reproduce the behavior:
- Setup SimpleSAMLphp as suggested in https://simplesamlphp.org/docs/stable/simplesamlphp-install (especially copying each and every metadata template to active configuration)
- In
config/config.php:
'enable.saml20-idp' => false,
'enable.shib13-idp' => false,
'enable.adfs-idp' => true,
- Configure
adfs-idp-hosted.php (e.g. with customized certificate location)
- Sign in using an ADFS RP
- Logout leads to an error (unconfigured certificate path of disabled
saml20-idp-hosted.php not found)
Expected behavior
SAML IdP metadata should only be loaded if it has been enabled at all ('enable.saml20-idp' => true, ).
Describe the bug
ADFS IdPs load available SAML IdP metadata even though they are not enabled .
In combination with the install instructions provided in the documentation, which suggests copying the whole
metadata-templates/content tometadata/, probably erroneous configuration (in my case certificates not being available assaml20-idp-hosted.phpexpects) is loaded.This will only interfere when using the created associationGroup, especially during SLO requests.
simplesamlphp/lib/SimpleSAML/IdP.php
Lines 94 to 100 in 43c1caf
To Reproduce
Steps to reproduce the behavior:
config/config.php:adfs-idp-hosted.php(e.g. with customized certificate location)saml20-idp-hosted.phpnot found)Expected behavior
SAML IdP metadata should only be loaded if it has been enabled at all (
'enable.saml20-idp' => true,).