SimpleSAML\XML\Shib13\AuthnResponse Class Reference

Collaboration diagram for SimpleSAML\XML\Shib13\AuthnResponse:

Public Member Functions
	setMessageValidated ($messageValidated)
	Set whether this message was validated externally. More...
	setXML ($xml)
	setRelayState ($relayState)
	getRelayState ()
	validate ()
	getSessionIndex ()
	Retrieve the session index of this response. More...
	getIssuer ()
	getNameID ()
	generate (\SimpleSAML_Configuration $idp, \SimpleSAML_Configuration $sp, $shire, $attributes)
	Build a authentication response. More...

Data Fields
const	SHIB_PROTOCOL_NS = 'urn:oasis:names:tc:SAML:1.0:protocol'
const	SHIB_ASSERT_NS = 'urn:oasis:names:tc:SAML:1.0:assertion'

Static Protected Member Functions
static	checkDateConditions ($start=null, $end=null)
	Check if we are currently between the given date & time conditions. More...

Private Member Functions
	isNodeValidated ($node)
	Checks if the given node is validated by the signature on this response. More...
	doXPathQuery ($query, $node=null)
	This function runs an xPath query on this authentication response. More...
	enc_attribute ($name, $values, $base64, $scopedAttributes)
	Format a shib13 attribute. More...

Private Attributes
	$validator = null
	$messageValidated = false
	$dom
	$relayState = null

Detailed Description

Definition at line 19 of file AuthnResponse.php.

Member Function Documentation

checkDateConditions()

static SimpleSAML\XML\Shib13\AuthnResponse::checkDateConditions (   $start = null,   $end = null  )

staticprotected

Check if we are currently between the given date & time conditions.

Note that this function allows a 10-minute leap from the initial time as marked by $start.

Parameters

string | null	$start	A SAML2 timestamp marking the start of the period to check. Defaults to null, in which case there's no limitations in the past.
string | null	$end	A SAML2 timestamp marking the end of the period to check. Defaults to null, in which case there's no limitations in the future.

Returns

bool True if the current time belongs to the period specified by $start and $end. False otherwise.

See also

::xsDateTimeToTimestamp.

Author

Andreas Solberg, UNINETT AS andre.nosp@m.as.s.nosp@m.olber.nosp@m.g@un.nosp@m.inett.nosp@m..no

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 459 of file AuthnResponse.php.

References $end, time, and SAML2\Utils\xsDateTimeToTimestamp().

    {
        $currentTime = time();

        if (!empty($start)) {
            $startTime = Utils::xsDateTimeToTimestamp($start);
            // allow for a 10 minute difference in time
            if (($startTime < 0) || (($startTime - 600) > $currentTime)) {
                return false;
            }
        }
        if (!empty($end)) {
            $endTime = Utils::xsDateTimeToTimestamp($end);
            if (($endTime < 0) || ($endTime <= $currentTime)) {
                return false;
            }
        }
        return true;
    }

Here is the call graph for this function:

doXPathQuery()

SimpleSAML\XML\Shib13\AuthnResponse::doXPathQuery (   $query,   $node = null  )

private

This function runs an xPath query on this authentication response.

Parameters

string	$query	The query which should be run.
\DOMNode	$node	The node which this query is relative to. If this node is NULL (the default) then the query will be relative to the root of the response.

Returns

Definition at line 164 of file AuthnResponse.php.

References $query.

Referenced by SimpleSAML\XML\Shib13\AuthnResponse\getIssuer(), SimpleSAML\XML\Shib13\AuthnResponse\getNameID(), and SimpleSAML\XML\Shib13\AuthnResponse\getSessionIndex().

    {
        assert('is_string($query)');
        assert('$this->dom instanceof DOMDocument');

        if ($node === null) {
            $node = $this->dom->documentElement;
        }

        assert('$node instanceof DOMNode');

        $xPath = new \DOMXpath($this->dom);
        $xPath->registerNamespace('shibp', self::SHIB_PROTOCOL_NS);
        $xPath->registerNamespace('shib', self::SHIB_ASSERT_NS);

        return $xPath->query($query, $node);
    }

Here is the caller graph for this function:

enc_attribute()

SimpleSAML\XML\Shib13\AuthnResponse::enc_attribute (   $name,   $values,   $base64,   $scopedAttributes  )

private

Format a shib13 attribute.

Parameters

string	$name	Name of the attribute.
array	$values	Values of the attribute (as an array of strings).
bool	$base64	Whether the attriubte values should be base64-encoded.
array	$scopedAttributes	Array of attributes names which are scoped.

Returns

string The attribute encoded as an XML-string.

Definition at line 407 of file AuthnResponse.php.

References $name.

Referenced by SimpleSAML\XML\Shib13\AuthnResponse\generate().

    {
        assert('is_string($name)');
        assert('is_array($values)');
        assert('is_bool($base64)');
        assert('is_array($scopedAttributes)');

        if (in_array($name, $scopedAttributes, true)) {
            $scoped = true;
        } else {
            $scoped = false;
        }

        $attr = '<Attribute AttributeName="' . htmlspecialchars($name) . '" AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri">';
        foreach ($values as $value) {
            $scopePart = '';
            if ($scoped) {
                $tmp = explode('@', $value, 2);
                if (count($tmp) === 2) {
                    $value = $tmp[0];
                    $scopePart = ' Scope="' . htmlspecialchars($tmp[1]) . '"';
                }
            }

            if ($base64) {
                $value = base64_encode($value);
            }

            $attr .= '<AttributeValue' . $scopePart . '>' . htmlspecialchars($value) . '</AttributeValue>';
        }
        $attr .= '</Attribute>';

        return $attr;
    }

Here is the caller graph for this function:

generate()

SimpleSAML\XML\Shib13\AuthnResponse::generate	(	\SimpleSAML_Configuration	$idp,
		\SimpleSAML_Configuration	$sp,
			$shire,
			$attributes
	)

Build a authentication response.

Parameters

\SimpleSAML_Configuration	$idp	Metadata for the IdP the response is sent from.
\SimpleSAML_Configuration	$sp	Metadata for the SP the response is sent to.
string	$shire	The endpoint on the SP the response is sent to.
array | null	$attributes	The attributes which should be included in the response.

Returns

string The response.

Definition at line 307 of file AuthnResponse.php.

References $attributes, $id, $name, $nameid, $response, $spEntityId, array, SimpleSAML\XML\Shib13\AuthnResponse\enc_attribute(), SimpleSAML\Utils\Random\generateID(), SimpleSAML\Utils\Time\generateTimestamp(), SimpleSAML_Configuration\getArray(), SimpleSAML_Configuration\getBoolean(), SimpleSAML_Configuration\getString(), SimpleSAML_Configuration\hasValue(), and time.

    {
        assert('is_string($shire)');
        assert('$attributes === NULL || is_array($attributes)');

        if ($sp->hasValue('scopedattributes')) {
            $scopedAttributes = $sp->getArray('scopedattributes');
        } elseif ($idp->hasValue('scopedattributes')) {
            $scopedAttributes = $idp->getArray('scopedattributes');
        } else {
            $scopedAttributes = array();
        }

        $id = Random::generateID();
        
        $issueInstant = Time::generateTimestamp();
        
        // 30 seconds timeskew back in time to allow differing clocks
        $notBefore = Time::generateTimestamp(time() - 30);
        
        
        $assertionExpire = Time::generateTimestamp(time() + 60 * 5);# 5 minutes
        $assertionid = Random::generateID();

        $spEntityId = $sp->getString('entityid');

        $audience = $sp->getString('audience', $spEntityId);
        $base64 = $sp->getBoolean('base64attributes', false);

        $namequalifier = $sp->getString('NameQualifier', $spEntityId);
        $nameid = Random::generateID();
        $subjectNode =
            '<Subject>' .
            '<NameIdentifier' .
            ' Format="urn:mace:shibboleth:1.0:nameIdentifier"' .
            ' NameQualifier="' . htmlspecialchars($namequalifier) . '"' .
            '>' .
            htmlspecialchars($nameid) .
            '</NameIdentifier>' .
            '<SubjectConfirmation>' .
            '<ConfirmationMethod>' .
            'urn:oasis:names:tc:SAML:1.0:cm:bearer' .
            '</ConfirmationMethod>' .
            '</SubjectConfirmation>' .
            '</Subject>';

        $encodedattributes = '';

        if (is_array($attributes)) {
            $encodedattributes .= '<AttributeStatement>';
            $encodedattributes .= $subjectNode;

            foreach ($attributes as $name => $value) {
                $encodedattributes .= $this->enc_attribute($name, $value, $base64, $scopedAttributes);
            }

            $encodedattributes .= '</AttributeStatement>';
        }

        /*
         * The SAML 1.1 response message
         */
        $response = '<Response xmlns="urn:oasis:names:tc:SAML:1.0:protocol"
    xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" IssueInstant="' . $issueInstant. '"
    MajorVersion="1" MinorVersion="1"
    Recipient="' . htmlspecialchars($shire) . '" ResponseID="' . $id . '">
    <Status>
        <StatusCode Value="samlp:Success" />
    </Status>
    <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion"
        AssertionID="' . $assertionid . '" IssueInstant="' . $issueInstant. '"
        Issuer="' . htmlspecialchars($idp->getString('entityid')) . '" MajorVersion="1" MinorVersion="1">
        <Conditions NotBefore="' . $notBefore. '" NotOnOrAfter="'. $assertionExpire . '">
            <AudienceRestrictionCondition>
                <Audience>' . htmlspecialchars($audience) . '</Audience>
            </AudienceRestrictionCondition>
        </Conditions>
        <AuthenticationStatement AuthenticationInstant="' . $issueInstant. '"
            AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified">' .
            $subjectNode . '
        </AuthenticationStatement>
        ' . $encodedattributes . '
    </Assertion>
</Response>';

        return $response;
    }

Here is the call graph for this function:

getIssuer()

SimpleSAML\XML\Shib13\AuthnResponse::getIssuer

(

)

Definition at line 270 of file AuthnResponse.php.

References $query, and SimpleSAML\XML\Shib13\AuthnResponse\doXPathQuery().

Referenced by SimpleSAML\XML\Shib13\AuthnResponse\getSessionIndex(), and SimpleSAML\XML\Shib13\AuthnResponse\validate().

    {
        $query = '/shibp:Response/shib:Assertion/@Issuer';
        $nodelist = $this->doXPathQuery($query);

        if ($attr = $nodelist->item(0)) {
            return $attr->value;
        } else {
            throw new \Exception('Could not find Issuer field in Authentication response');
        }
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getNameID()

SimpleSAML\XML\Shib13\AuthnResponse::getNameID

(

)

Definition at line 282 of file AuthnResponse.php.

References $query, array, and SimpleSAML\XML\Shib13\AuthnResponse\doXPathQuery().

    {
        $nameID = array();

        $query = '/shibp:Response/shib:Assertion/shib:AuthenticationStatement/shib:Subject/shib:NameIdentifier';
        $nodelist = $this->doXPathQuery($query);

        if ($node = $nodelist->item(0)) {
            $nameID["Value"] = $node->nodeValue;
            $nameID["Format"] = $node->getAttribute('Format');
        }

        return $nameID;
    }

Here is the call graph for this function:

getRelayState()

SimpleSAML\XML\Shib13\AuthnResponse::getRelayState

(

)

Definition at line 78 of file AuthnResponse.php.

References SimpleSAML\XML\Shib13\AuthnResponse\$relayState.

    {
        return $this->relayState;
    }

getSessionIndex()

SimpleSAML\XML\Shib13\AuthnResponse::getSessionIndex

(

)

Retrieve the session index of this response.

Returns

string|null The session index of this response.

Definition at line 187 of file AuthnResponse.php.

References $attributes, $end, $metadata, $name, $query, array, SimpleSAML\XML\Shib13\AuthnResponse\doXPathQuery(), Monolog\Handler\error_log(), SimpleSAML\XML\Shib13\AuthnResponse\getIssuer(), SimpleSAML_Metadata_MetaDataStorageHandler\getMetadataHandler(), and SimpleSAML\XML\Shib13\AuthnResponse\isNodeValidated().

    {
        assert('$this->dom instanceof DOMDocument');

        $query = '/shibp:Response/shib:Assertion/shib:AuthnStatement';
        $nodelist = $this->doXPathQuery($query);
        if ($node = $nodelist->item(0)) {
            return $node->getAttribute('SessionIndex');
        }

        return null;
    }

Here is the call graph for this function:

isNodeValidated()

SimpleSAML\XML\Shib13\AuthnResponse::isNodeValidated (   $node )

private

Checks if the given node is validated by the signature on this response.

Parameters

\DOMElement

$node

Node to be validated.

Returns

bool TRUE if the node is validated or FALSE if not.

Definition at line 134 of file AuthnResponse.php.

Referenced by SimpleSAML\XML\Shib13\AuthnResponse\getSessionIndex().

    {
        if ($this->messageValidated) {
            // This message was validated externally
            return true;
        }

        if ($this->validator === null) {
            return false;
        }

        // Convert the node to a DOM node if it is an element from SimpleXML
        if ($node instanceof \SimpleXMLElement) {
            $node = dom_import_simplexml($node);
        }

        assert('$node instanceof DOMNode');

        return $this->validator->isNodeValidated($node);
    }

Here is the caller graph for this function:

setMessageValidated()

SimpleSAML\XML\Shib13\AuthnResponse::setMessageValidated

(

$messageValidated

)

Set whether this message was validated externally.

Parameters

bool

$messageValidated

TRUE if the message is already validated, FALSE if not.

Definition at line 54 of file AuthnResponse.php.

References SimpleSAML\XML\Shib13\AuthnResponse\$messageValidated.

    {
        assert('is_bool($messageValidated)');

        $this->messageValidated = $messageValidated;
    }

setRelayState()

SimpleSAML\XML\Shib13\AuthnResponse::setRelayState

(

$relayState

)

Definition at line 73 of file AuthnResponse.php.

References SimpleSAML\XML\Shib13\AuthnResponse\$relayState.

    {
        $this->relayState = $relayState;
    }

setXML()

SimpleSAML\XML\Shib13\AuthnResponse::setXML

(

$xml

)

Definition at line 62 of file AuthnResponse.php.

References $xml, and SAML2\DOMDocumentFactory\fromString().

    {
        assert('is_string($xml)');

        try {
            $this->dom = DOMDocumentFactory::fromString(str_replace("\r", "", $xml));
        } catch (\Exception $e) {
            throw new \Exception('Unable to parse AuthnResponse XML.');
        }
    }

Here is the call graph for this function:

validate()

SimpleSAML\XML\Shib13\AuthnResponse::validate

(

)

Definition at line 83 of file AuthnResponse.php.

References $issuer, $key, $metadata, array, SimpleSAML\Utils\Config\getCertPath(), SimpleSAML\XML\Shib13\AuthnResponse\getIssuer(), and SimpleSAML_Metadata_MetaDataStorageHandler\getMetadataHandler().

    {
        assert('$this->dom instanceof DOMDocument');

        if ($this->messageValidated) {
            // This message was validated externally
            return true;
        }

        // Validate the signature
        $this->validator = new Validator($this->dom, array('ResponseID', 'AssertionID'));

        // Get the issuer of the response
        $issuer = $this->getIssuer();

        // Get the metadata of the issuer
        $metadata = \SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
        $md = $metadata->getMetaDataConfig($issuer, 'shib13-idp-remote');

        $publicKeys = $md->getPublicKeys('signing');
        if ($publicKeys !== null) {
            $certFingerprints = array();
            foreach ($publicKeys as $key) {
                if ($key['type'] !== 'X509Certificate') {
                    continue;
                }
                $certFingerprints[] = sha1(base64_decode($key['X509Certificate']));
            }
            $this->validator->validateFingerprint($certFingerprints);
        } elseif ($md->hasValue('certFingerprint')) {
            $certFingerprints = $md->getArrayizeString('certFingerprint');

            // Validate the fingerprint
            $this->validator->validateFingerprint($certFingerprints);
        } elseif ($md->hasValue('caFile')) {
            // Validate against CA
            $this->validator->validateCA(Config::getCertPath($md->getString('caFile')));
        } else {
            throw new \SimpleSAML_Error_Exception('Missing certificate in Shibboleth 1.3 IdP Remote metadata for identity provider [' . $issuer . '].');
        }

        return true;
    }

Here is the call graph for this function:

Field Documentation

$dom

SimpleSAML\XML\Shib13\AuthnResponse::$dom

private

Definition at line 41 of file AuthnResponse.php.

$messageValidated

SimpleSAML\XML\Shib13\AuthnResponse::$messageValidated = false

private

Definition at line 31 of file AuthnResponse.php.

Referenced by SimpleSAML\XML\Shib13\AuthnResponse\setMessageValidated().

$relayState

SimpleSAML\XML\Shib13\AuthnResponse::$relayState = null

private

Definition at line 46 of file AuthnResponse.php.

Referenced by SimpleSAML\XML\Shib13\AuthnResponse\getRelayState(), and SimpleSAML\XML\Shib13\AuthnResponse\setRelayState().

$validator

SimpleSAML\XML\Shib13\AuthnResponse::$validator = null

private

Definition at line 25 of file AuthnResponse.php.

SHIB_ASSERT_NS

const SimpleSAML\XML\Shib13\AuthnResponse::SHIB_ASSERT_NS = 'urn:oasis:names:tc:SAML:1.0:assertion'

Definition at line 35 of file AuthnResponse.php.

SHIB_PROTOCOL_NS

const SimpleSAML\XML\Shib13\AuthnResponse::SHIB_PROTOCOL_NS = 'urn:oasis:names:tc:SAML:1.0:protocol'

Definition at line 34 of file AuthnResponse.php.

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/lib/SimpleSAML/XML/Shib13/AuthnResponse.php