SignedElementHelper.php

Go to the documentation of this file.

<?php
 
namespace SAML2;
 
use RobRichards\XMLSecLibs\XMLSecurityKey;
 
class SignedElementHelper implements SignedElement
{
    private $signatureKey;
 
    private $certificates;
 
    private $validators;
 
    protected function __construct(\DOMElement $xml = null)
    {
        $this->certificates = array();
        $this->validators = array();
 
        if ($xml === null) {
            return;
        }
 
        /* Validate the signature element of the message. */
        try {
            $sig = Utils::validateElement($xml);
 
            if ($sig !== false) {
                $this->certificates = $sig['Certificates'];
                $this->validators[] = array(
                    'Function' => array('\SAML2\Utils', 'validateSignature'),
                    'Data' => $sig,
                );
            }
        } catch (\Exception $e) {
            /* Ignore signature validation errors. */
        }
    }
 
    public function addValidator($function, $data)
    {
        assert(is_callable($function));
 
        $this->validators[] = array(
            'Function' => $function,
            'Data' => $data,
        );
    }
 
    public function validate(XMLSecurityKey $key)
    {
        if (count($this->validators) === 0) {
            return false;
        }
 
        $exceptions = array();
 
        foreach ($this->validators as $validator) {
            $function = $validator['Function'];
            $data = $validator['Data'];
 
            try {
                call_user_func($function, $data, $key);
                /* We were able to validate the message with this validator. */
 
                return true;
            } catch (\Exception $e) {
                $exceptions[] = $e;
            }
        }
 
        /* No validators were able to validate the message. */
        throw $exceptions[0];
    }
 
    public function getSignatureKey()
    {
        return $this->signatureKey;
    }
 
    public function setSignatureKey(XMLSecurityKey $signatureKey = null)
    {
        $this->signatureKey = $signatureKey;
    }
 
    public function setCertificates(array $certificates)
    {
        $this->certificates = $certificates;
    }
 
    public function getCertificates()
    {
        return $this->certificates;
    }
 
    public function getValidatingCertificates()
    {
        $ret = array();
        foreach ($this->certificates as $cert) {
 
            /* Construct a PEM formatted certificate */
            $pemCert = "-----BEGIN CERTIFICATE-----\n" .
                chunk_split($cert, 64) .
                "-----END CERTIFICATE-----\n";
 
            /* Extract the public key from the certificate for validation. */
            $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type'=>'public'));
            $key->loadKey($pemCert);
 
            try {
                /* Check the signature. */
                if ($this->validate($key)) {
                    $ret[] = $cert;
                }
            } catch (\Exception $e) {
                /* This certificate does not sign this element. */
            }
        }
 
        return $ret;
    }
 
    protected function signElement(\DOMElement $root, \DOMElement $insertBefore = null)
    {
        if ($this->signatureKey === null) {
            /* We cannot sign this element. */
 
            return null;
        }
 
        Utils::insertSignature($this->signatureKey, $this->certificates, $root, $insertBefore);
 
        return $root;
    }
}