simplesamlphp · tvdijen · Jun 29, 2026 · Jun 13, 2026 · Jun 16, 2026 · Jun 17, 2026
diff --git a/composer.json b/composer.json
@@ -61,10 +61,12 @@
         "ext-SPL": "*",
         "ext-zlib": "*",
 
+        "beste/clock": "~3.0",
         "composer-runtime-api": "^2.2",
         "gettext/gettext": "~5.7",
         "gettext/php-scanner": "^2.0",
         "gettext/translator": "~1.2",
+        "nyholm/psr7": "^1.8",
         "phpmailer/phpmailer": "~7.0",
         "psr/event-dispatcher": "~1.0",
         "psr/log": "~3.0",
@@ -89,6 +91,7 @@
         "symfony/http-client-contracts": "~3.5",
         "symfony/http-foundation": "~7.4",
         "symfony/http-kernel": "~7.4",
+        "symfony/psr-http-message-bridge": "^7.4",
         "symfony/intl": "~7.4",
         "symfony/password-hasher": "~7.4",
         "symfony/polyfill-intl-icu": "~1.33",

diff --git a/composer.lock b/composer.lock
diff --git a/modules/admin/src/Controller/Config.php b/modules/admin/src/Controller/Config.php
@@ -15,6 +15,7 @@
 use SimpleSAML\Utils;
 use SimpleSAML\XHTML\Template;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpFoundation\StreamedResponse;
 use Symfony\Contracts\HttpClient\Exception\ExceptionInterface;
 
@@ -79,12 +80,14 @@ public function setAuthUtils(Utils\Auth $authUtils): void
      * Display basic diagnostic information on hostname, port and protocol.
      *
      * @param \Symfony\Component\HttpFoundation\Request $request The current request.
-     *
-     * @return \SimpleSAML\XHTML\Template
+     * @return \Symfony\Component\HttpFoundation\Response
      */
-    public function diagnostics(Request $request): Template
+    public function diagnostics(Request $request): Response
     {
-        $this->authUtils->requireAdmin();
+        $response = $this->authUtils->requireAdmin();
+        if ($response instanceof Response) {
+            return $response;
+        }
 
         $t = new Template($this->config, 'admin:diagnostics.twig');
         $t->data = [
@@ -113,12 +116,14 @@ public function diagnostics(Request $request): Template
      * Display the main admin page.
      *
      * @param \Symfony\Component\HttpFoundation\Request $request The current request.
-     *
-     * @return \SimpleSAML\XHTML\Template
+     * @return \Symfony\Component\HttpFoundation\Response
      */
-    public function main(/** @scrutinizer ignore-unused */ Request $request): Template
+    public function main(/** @scrutinizer ignore-unused */ Request $request): Response
     {
-        $this->authUtils->requireAdmin();
+        $response = $this->authUtils->requireAdmin();
+        if ($response instanceof Response) {
+            return $response;
+        }
 
         $t = new Template($this->config, 'admin:config.twig');
         $t->data = [
@@ -172,12 +177,14 @@ protected function getModuleList(): array
      * Display the output of phpinfo().
      *
      * @param \Symfony\Component\HttpFoundation\Request $request The current request.
-     *
-     * @return \Symfony\Component\HttpFoundation\StreamedResponse
+     * @return \Symfony\Component\HttpFoundation\Response
      */
-    public function phpinfo(/** @scrutinizer ignore-unused */ Request $request): StreamedResponse
+    public function phpinfo(/** @scrutinizer ignore-unused */ Request $request): Response
     {
-        $this->authUtils->requireAdmin();
+        $response = $this->authUtils->requireAdmin();
+        if ($response instanceof Response) {
+            return $response;
+        }
 
         $response = new StreamedResponse('phpinfo');
         $response->headers->set(

diff --git a/modules/admin/src/Controller/Federation.php b/modules/admin/src/Controller/Federation.php
@@ -77,7 +77,7 @@ public function __construct(
         protected Configuration $config,
     ) {
         $this->menu = new Menu();
-        $this->mdHandler = MetaDataStorageHandler::getMetadataHandler();
+        $this->mdHandler = MetaDataStorageHandler::getMetadataHandler($config);
         $this->authUtils = new Utils\Auth();
         $this->cryptoUtils = new Utils\Crypto();
     }
@@ -120,13 +120,16 @@ public function setMetadataStorageHandler(MetadataStorageHandler $mdHandler): vo
      * Display the federation page.
      *
      * @param \Symfony\Component\HttpFoundation\Request $request
-     * @return \SimpleSAML\XHTML\Template
+     * @return \Symfony\Component\HttpFoundation\Response
      * @throws \SimpleSAML\Error\Exception
      * @throws \SimpleSAML\Error\Exception
      */
-    public function main(/** @scrutinizer ignore-unused */ Request $request): Template
+    public function main(/** @scrutinizer ignore-unused */ Request $request): Response
     {
-        $this->authUtils->requireAdmin();
+        $response = $this->authUtils->requireAdmin();
+        if ($response instanceof Response) {
+            return $response;
+        }
 
         // initialize basic metadata array
         $hostedSPs = $this->getHostedSP();
@@ -507,12 +510,14 @@ public function metadataConverter(Request $request): Template
      * Download a certificate for a given entity.
      *
      * @param \Symfony\Component\HttpFoundation\Request $request The current request.
-     *
      * @return \Symfony\Component\HttpFoundation\Response PEM-encoded certificate.
      */
     public function downloadCert(Request $request): Response
     {
-        $this->authUtils->requireAdmin();
+        $response = $this->authUtils->requireAdmin();
+        if ($response instanceof Response) {
+            return $response;
+        }
 
         $set = $request->query->get('set');
         $prefix = $request->query->get('prefix', '');

diff --git a/modules/admin/src/Controller/Test.php b/modules/admin/src/Controller/Test.php
@@ -7,7 +7,6 @@
 use SimpleSAML\Assert\Assert;
 use SimpleSAML\Auth;
 use SimpleSAML\Configuration;
-use SimpleSAML\HTTP\RunnableResponse;
 use SimpleSAML\Locale\Translate;
 use SimpleSAML\Module;
 use SimpleSAML\Session;
@@ -99,11 +98,15 @@ public function setAuthState(Auth\State $authState): void
      *
      * @param \Symfony\Component\HttpFoundation\Request $request
      * @param string|null $as
-     * @return \SimpleSAML\XHTML\Template|\SimpleSAML\HTTP\RunnableResponse
+     * @return \Symfony\Component\HttpFoundation\Response
      */
     public function main(Request $request, ?string $as = null): Response
     {
-        $this->authUtils->requireAdmin();
+        $response = $this->authUtils->requireAdmin();
+        if ($response instanceof Response) {
+            return $response;
+        }
+
         if (is_null($as)) {
             $t = new Template($this->config, 'admin:authsource_list.twig');
             $t->data = [
@@ -114,7 +117,7 @@ public function main(Request $request, ?string $as = null): Response
             $authsource = new $this->authSimple($as);
 
             if (!is_null($request->query->get('logout'))) {
-                return new RunnableResponse([$authsource, 'logout'], [Module::getModuleURL('admin/logout')]);
+                return $authsource->logout(Module::getModuleURL('admin/logout'));
             } elseif (!is_null($request->query->get(Auth\State::EXCEPTION_PARAM))) {
                 // This is just a simple example of an error
                 /** @var array $state */
@@ -130,7 +133,7 @@ public function main(Request $request, ?string $as = null): Response
                     'ReturnTo' => $url,
                     Auth\State::RESTART => $url,
                 ];
-                return new RunnableResponse([$authsource, 'login'], [$params]);
+                return $authsource->login($params);
             }
 
             $attributes = $authsource->getAttributes();

diff --git a/modules/core/src/Auth/Process/Cardinality.php b/modules/core/src/Auth/Process/Cardinality.php
@@ -195,8 +195,8 @@ public function process(array &$state): void
         if (array_key_exists('core:cardinality:errorAttributes', $state)) {
             $id = Auth\State::saveState($state, 'core:cardinality');
             $url = Module::getModuleURL('core/error/cardinality');
-            $this->httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
-            return;
+            $response = $this->httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
+            $response->send();
         }
     }
 }
diff --git a/modules/core/src/Auth/Process/CardinalitySingle.php b/modules/core/src/Auth/Process/CardinalitySingle.php
@@ -122,8 +122,8 @@ public function process(array &$state): void
         if (array_key_exists('core:cardinality:errorAttributes', $state)) {
             $id = Auth\State::saveState($state, 'core:cardinality');
             $url = Module::getModuleURL('core/error/cardinality');
-            $this->httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
-            return;
+            $response = $this->httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
+            $response->send();
         }
     }
 }
diff --git a/modules/core/src/Auth/Process/WarnShortSSOInterval.php b/modules/core/src/Auth/Process/WarnShortSSOInterval.php
@@ -7,7 +7,6 @@
 use SimpleSAML\Auth;
 use SimpleSAML\Logger;
 use SimpleSAML\Module;
-use SimpleSAML\Utils;
 
 /**
  * Give a warning to the user if we receive multiple requests in a short time.
@@ -52,7 +51,9 @@ public function process(array &$state): void
         // Save state and redirect
         $id = Auth\State::saveState($state, 'core:short_sso_interval');
         $url = Module::getModuleURL('core/short_sso_interval');
+
         $httpUtils = new Utils\HTTP();
-        $httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
+        $response = $httpUtils->redirectTrustedURL($url, ['StateId' => $id]);
+        $response->send();
     }
 }