FingerprintValidator.php

Go to the documentation of this file.

<?php
 
namespace SAML2\Signature;
 
use Psr\Log\LoggerInterface;
use SAML2\Certificate\FingerprintLoader;
use SAML2\Certificate\X509;
use SAML2\Configuration\CertificateProvider;
use SAML2\SignedElement;
 
class FingerprintValidator extends AbstractChainedValidator
{
    private $certificates;
 
    private $fingerprintLoader;
 
    public function __construct(
        LoggerInterface $logger,
        FingerprintLoader $fingerprintLoader
    ) {
        $this->fingerprintLoader = $fingerprintLoader;
 
        parent::__construct($logger);
    }
 
    public function canValidate(
        SignedElement $signedElement,
        CertificateProvider $configuration
    ) {
        if ($configuration->getCertificateFingerprints() === null) {
            $this->logger->debug(
                'Configuration does not have "certFingerprint" value, cannot validate signature with fingerprint'
            );
            return false;
        }
 
        // use internal cache to prevent doing certificate extraction twice.
        $this->certificates = $signedElement->getCertificates();
        if (empty($this->certificates)) {
            $this->logger->debug(
                'Signed element does not have certificates, cannot validate signature with fingerprint'
            );
            return false;
        }
 
        return true;
    }
 
    public function hasValidSignature(
        SignedElement $signedElement,
        CertificateProvider $configuration
    ) {
        $this->certificates = array_map(function ($certificate) {
            return X509::createFromCertificateData($certificate);
        }, $this->certificates);
 
        $fingerprintCollection = $this->fingerprintLoader->loadFromConfiguration($configuration);
 
        $pemCandidates = array();
        foreach ($this->certificates as $certificate) {
            $certificateFingerprint = $certificate->getFingerprint();
            if ($fingerprintCollection->contains($certificateFingerprint)) {
                $pemCandidates[] = $certificate;
            }
        }
 
        if (empty($pemCandidates)) {
            $this->logger->debug(
                'Unable to match a certificate of the SignedElement matching a configured fingerprint'
            );
 
            return false;
        }
 
        return $this->validateElementWithKeys($signedElement, $pemCandidates);
    }
}