Skip to content

Commit b71496c

Browse files
tvdijentvdijen
authored
Feature/standalone metadata (#21)
* Do not rely on SimpleSAMLphp for metadata-building * Fix * Introduce a clokc * Generate ID * Cleanup
1 parent 233ed25 commit b71496c

File tree

4 files changed

+358
-127
lines changed

4 files changed

+358
-127
lines changed

‎composer.json‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,8 @@
3636
"php": "^8.1",
3737
"ext-dom": "*",
3838

39+
"beste/clock": "^3.0",
40+
"psr/clock": "^1.0",
3941
"simplesamlphp/assert": "^1.1",
4042
"simplesamlphp/saml11": "^1.0",
4143
"simplesamlphp/saml2": "^5@dev",

‎src/Controller/Adfs.php‎

Lines changed: 9 additions & 126 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,11 @@
55
namespace SimpleSAML\Module\adfs\Controller;
66

77
use Exception;
8-
use SimpleSAML\Configuration;
8+
use SimpleSAML\{Configuration, IdP, Logger, Metadata, Module, Session, Utils};
99
use SimpleSAML\Error as SspError;
10-
use SimpleSAML\IdP;
11-
use SimpleSAML\Logger;
12-
use SimpleSAML\Metadata;
13-
use SimpleSAML\Module;
1410
use SimpleSAML\Module\adfs\IdP\ADFS as ADFS_IDP;
15-
use SimpleSAML\SAML2\Constants as C;
16-
use SimpleSAML\Session;
17-
use SimpleSAML\Utils;
18-
use Symfony\Component\HttpFoundation\Request;
19-
use Symfony\Component\HttpFoundation\Response;
20-
use Symfony\Component\HttpFoundation\StreamedResponse;
11+
use SimpleSAML\Module\adfs\IdP\MetadataBuilder;
12+
use Symfony\Component\HttpFoundation\{Request, Response, StreamedResponse};
2113

2214
/**
2315
* Controller class for the adfs module.
@@ -79,123 +71,14 @@ public function metadata(Request $request): Response
7971
}
8072
$idpmeta = $this->metadata->getMetaDataConfig($idpentityid, 'adfs-idp-hosted');
8173

82-
$availableCerts = [];
83-
$keys = [];
84-
$certInfo = $this->cryptoUtils->loadPublicKey($idpmeta, false, 'new_');
74+
$builder = new MetadataBuilder($this->config, $idpmeta);
8575

86-
if ($certInfo !== null) {
87-
$availableCerts['new_idp.crt'] = $certInfo;
88-
$keys[] = [
89-
'type' => 'X509Certificate',
90-
'signing' => true,
91-
'encryption' => true,
92-
'X509Certificate' => $certInfo['certData'],
93-
];
94-
$hasNewCert = true;
95-
} else {
96-
$hasNewCert = false;
97-
}
98-
99-
/** @var array $certInfo */
100-
$certInfo = $this->cryptoUtils->loadPublicKey($idpmeta, true);
101-
$availableCerts['idp.crt'] = $certInfo;
102-
$keys[] = [
103-
'type' => 'X509Certificate',
104-
'signing' => true,
105-
'encryption' => ($hasNewCert ? false : true),
106-
'X509Certificate' => $certInfo['certData'],
107-
];
108-
109-
if ($idpmeta->hasValue('https.certificate')) {
110-
/** @var array $httpsCert */
111-
$httpsCert = $this->cryptoUtils->loadPublicKey($idpmeta, true, 'https.');
112-
Assert::keyExists($httpsCert, 'certData');
113-
$availableCerts['https.crt'] = $httpsCert;
114-
$keys[] = [
115-
'type' => 'X509Certificate',
116-
'signing' => true,
117-
'encryption' => false,
118-
'X509Certificate' => $httpsCert['certData'],
119-
];
120-
}
121-
122-
$adfs_service_location = Module::getModuleURL('adfs') . '/idp/prp.php';
123-
$metaArray = [
124-
'metadata-set' => 'adfs-idp-remote',
125-
'entityid' => $idpentityid,
126-
'SingleSignOnService' => [
127-
0 => [
128-
'Binding' => C::BINDING_HTTP_REDIRECT,
129-
'Location' => $adfs_service_location,
130-
],
131-
],
132-
'SingleLogoutService' => [
133-
0 => [
134-
'Binding' => C::BINDING_HTTP_REDIRECT,
135-
'Location' => $adfs_service_location,
136-
],
137-
],
138-
];
139-
140-
if (count($keys) === 1) {
141-
$metaArray['certData'] = $keys[0]['X509Certificate'];
142-
} else {
143-
$metaArray['keys'] = $keys;
144-
}
145-
146-
$metaArray['NameIDFormat'] = $idpmeta->getOptionalString(
147-
'NameIDFormat',
148-
C::NAMEID_TRANSIENT,
149-
);
150-
151-
if ($idpmeta->hasValue('OrganizationName')) {
152-
$metaArray['OrganizationName'] = $idpmeta->getLocalizedString('OrganizationName');
153-
$metaArray['OrganizationDisplayName'] = $idpmeta->getOptionalLocalizedString(
154-
'OrganizationDisplayName',
155-
$metaArray['OrganizationName'],
156-
);
157-
158-
if (!$idpmeta->hasValue('OrganizationURL')) {
159-
throw new SspError\Exception('If OrganizationName is set, OrganizationURL must also be set.');
160-
}
161-
$metaArray['OrganizationURL'] = $idpmeta->getLocalizedString('OrganizationURL');
162-
}
163-
164-
if ($idpmeta->hasValue('scope')) {
165-
$metaArray['scope'] = $idpmeta->getArray('scope');
166-
}
167-
168-
if ($idpmeta->hasValue('EntityAttributes')) {
169-
$metaArray['EntityAttributes'] = $idpmeta->getArray('EntityAttributes');
170-
}
171-
172-
if ($idpmeta->hasValue('UIInfo')) {
173-
$metaArray['UIInfo'] = $idpmeta->getArray('UIInfo');
174-
}
175-
176-
if ($idpmeta->hasValue('DiscoHints')) {
177-
$metaArray['DiscoHints'] = $idpmeta->getArray('DiscoHints');
178-
}
179-
180-
if ($idpmeta->hasValue('RegistrationInfo')) {
181-
$metaArray['RegistrationInfo'] = $idpmeta->getArray('RegistrationInfo');
182-
}
183-
184-
$metaBuilder = new Metadata\SAMLBuilder($idpentityid);
185-
$metaBuilder->addSecurityTokenServiceType($metaArray);
186-
$metaBuilder->addOrganizationInfo($metaArray);
187-
$technicalContactEmail = $this->config->getOptionalString('technicalcontact_email', null);
188-
if ($technicalContactEmail !== null && $technicalContactEmail !== '[email protected]') {
189-
$metaBuilder->addContact(Utils\Config\Metadata::getContact([
190-
'emailAddress' => $technicalContactEmail,
191-
'givenName' => $this->config->getOptionalString('technicalcontact_name', null),
192-
'contactType' => 'technical',
193-
]));
194-
}
195-
$metaxml = $metaBuilder->getEntityDescriptorText();
76+
$document = $builder->buildDocument()->toXML();
77+
// Some products like DirX are known to break on pretty-printed XML
78+
$document->ownerDocument->formatOutput = false;
79+
$document->ownerDocument->encoding = 'UTF-8';
19680

197-
// sign the metadata if enabled
198-
$metaxml = Metadata\Signer::sign($metaxml, $idpmeta->toArray(), 'ADFS IdP');
81+
$metaxml = $document->ownerDocument->saveXML();
19982

20083
$response = new Response();
20184
$response->setEtag(hash('sha256', $metaxml));

‎src/IdP/ADFS.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@
88
use DateTimeImmutable;
99
use DateTimeZone;
1010
use Exception;
11-
use SimpleSAML\Assert\Assert;
1211
use SimpleSAML\Configuration;
1312
use SimpleSAML\Error;
1413
use SimpleSAML\IdP;

0 commit comments

Comments
 (0)