Skip to content

Opt in to accept empty subject confirmation data. #840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
m0ark wants to merge 8 commits into
base: master
Choose a base branch
from
+17 −8
Open

Opt in to accept empty subject confirmation data. #840

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3514483
Opt in to accept empty subject confirmation data. By default the beha…
Apr 25, 2018
408073c
Opt in to accept empty subject confirmation data. By default the beha…
Apr 25, 2018
2a0b419
Merge remote-tracking branch 'origin/opt-in-empty-scd' into opt-in-em…
Apr 25, 2018
553d25a
Avoid negative wording
May 28, 2018
da4b520
Avoid negative wording
May 28, 2018
70fcf76
Merge branch 'master' into opt-in-empty-scd
tvdijen Feb 13, 2019
d89ca06
Merge branch 'master' into opt-in-empty-scd
tvdijen Jun 6, 2019
32b50c0
Merge branch 'master' into opt-in-empty-scd
tvdijen Jun 5, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 17 additions & 8 deletions modules/saml/lib/Message.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -583,6 +583,7 @@ public static function buildLogoutResponse(
* @param \SimpleSAML\Configuration $spMetadata The metadata of the service provider.
* @param \SimpleSAML\Configuration $idpMetadata The metadata of the identity provider.
* @param \SAML2\Response $response The response.
* @param bool $allowEmptySubjectConfirmationData Whether the assertion should require SubjectConfirmationData.
*
* @return array Array with \SAML2\Assertion objects, containing valid assertions from the response.
*
Expand All @@ -592,7 +593,8 @@ public static function buildLogoutResponse(
public static function processResponse(
Configuration $spMetadata,
Configuration $idpMetadata,
Response $response
Response $response,
$allowEmptySubjectConfirmationData = false
): array {
if (!$response->isSuccess()) {
throw self::getResponseError($response);
Expand All @@ -619,7 +621,7 @@ public static function processResponse(

$ret = [];
foreach ($assertion as $a) {
$ret[] = self::processAssertion($spMetadata, $idpMetadata, $response, $a, $responseSigned);
$ret[] = self::processAssertion($spMetadata, $idpMetadata, $response, $a, $responseSigned, $allowEmptySubjectConfirmationData);
}

return $ret;
Expand All @@ -634,20 +636,22 @@ public static function processResponse(
* @param \SAML2\Response $response The response containing the assertion.
* @param \SAML2\Assertion|\SAML2\EncryptedAssertion $assertion The assertion.
* @param bool $responseSigned Whether the response is signed.
* @param bool $allowEmptySubjectConfirmationData Whether the assertion should require SubjectConfirmationData.
*
* @return \SAML2\Assertion The assertion, if it is valid.
*
* @throws \SimpleSAML\Error\Exception if an error occurs while trying to validate the assertion, or if a assertion
* is not signed and it should be, or if we are unable to decrypt the NameID due to a local failure (missing or
* invalid decryption key).
* @throws \Exception if we couldn't decrypt the NameID for unexpected reasons.
* @throws \SimpleSAML\Error\Exception if an error occurs while trying to validate the assertion, or if a assertion
* is not signed and it should be, or if we are unable to decrypt the NameID due to a local failure (missing or
* invalid decryption key).
*/
private static function processAssertion(
Configuration $spMetadata,
Configuration $idpMetadata,
Response $response,
$assertion,
bool $responseSigned
bool $responseSigned,
$allowEmptySubjectConfirmationData = false
): Assertion {
Assert::isInstanceOfAny($assertion, [\SAML2\Assertion::class, \SAML2\EncryptedAssertion::class]);

Expand Down Expand Up @@ -796,8 +800,13 @@ private static function processAssertion(

// if no SubjectConfirmationData then don't do anything.
if ($scd === null) {
$lastError = 'No SubjectConfirmationData provided';
continue;
if ($allowEmptySubjectConfirmationData) {
$found = true;
break;
} else {
$lastError = 'No SubjectConfirmationData provided';
continue;
}
}

$notBefore = $scd->getNotBefore();
Expand Down