Processor.php

Go to the documentation of this file.

<?php

namespace SAML2\Assertion;

use Psr\Log\LoggerInterface;
use SAML2\Assertion;
use SAML2\Assertion\Exception\InvalidAssertionException;
use SAML2\Assertion\Exception\InvalidSubjectConfirmationException;
use SAML2\Assertion\Transformer\Transformer;
use SAML2\Assertion\Validation\AssertionValidator;
use SAML2\Assertion\Validation\SubjectConfirmationValidator;
use SAML2\Configuration\IdentityProvider;
use SAML2\Response\Exception\InvalidSignatureException;
use SAML2\Response\Exception\UnencryptedAssertionFoundException;
use SAML2\Signature\Validator;
use SAML2\Utilities\ArrayCollection;

class Processor
{
    private $decrypter;

    private $assertionValidator;

    private $subjectConfirmationValidator;

    private $transformer;

    private $signatureValidator;

    private $identityProviderConfiguration;

    private $logger;

    public function __construct(
        Decrypter $decrypter,
        Validator $signatureValidator,
        AssertionValidator $assertionValidator,
        SubjectConfirmationValidator $subjectConfirmationValidator,
        Transformer $transformer,
        IdentityProvider $identityProviderConfiguration,
        LoggerInterface $logger
    ) {
        $this->assertionValidator            = $assertionValidator;
        $this->signatureValidator            = $signatureValidator;
        $this->decrypter                     = $decrypter;
        $this->subjectConfirmationValidator  = $subjectConfirmationValidator;
        $this->transformer                   = $transformer;
        $this->identityProviderConfiguration = $identityProviderConfiguration;
        $this->logger                        = $logger;
    }

    public function processAssertions($assertions)
    {
        $processed = new ArrayCollection();
        foreach ($assertions as $assertion) {
            $processed->add($this->process($assertion));
        }

        return $processed;
    }

    public function process($assertion)
    {
        $assertion = $this->decryptAssertion($assertion);

        if (!$assertion->getWasSignedAtConstruction()) {
            $this->logger->info(sprintf(
                'Assertion with id "%s" was not signed at construction, not verifying the signature',
                $assertion->getId()
            ));
        } else {
            $this->logger->info(sprintf('Verifying signature of Assertion with id "%s"', $assertion->getId()));

            if (!$this->signatureValidator->hasValidSignature($assertion, $this->identityProviderConfiguration)) {
                throw new InvalidSignatureException();
            }
        }

        $this->validateAssertion($assertion);

        $assertion = $this->transformAssertion($assertion);

        return $assertion;
    }

    private function decryptAssertion($assertion)
    {
        if ($this->decrypter->isEncryptionRequired() && $assertion instanceof Assertion) {
            throw new UnencryptedAssertionFoundException();
        }

        if ($assertion instanceof Assertion) {
            return $assertion;
        }

        return $this->decrypter->decrypt($assertion);
    }

    public function validateAssertion(Assertion $assertion)
    {
        $assertionValidationResult = $this->assertionValidator->validate($assertion);
        if (!$assertionValidationResult->isValid()) {
            throw new InvalidAssertionException(sprintf(
                'Invalid Assertion in SAML Response, erorrs: "%s"',
                implode('", "', $assertionValidationResult->getErrors())
            ));
        }

        foreach ($assertion->getSubjectConfirmation() as $subjectConfirmation) {
            $subjectConfirmationValidationResult = $this->subjectConfirmationValidator->validate(
                $subjectConfirmation
            );
            if (!$subjectConfirmationValidationResult->isValid()) {
                throw new InvalidSubjectConfirmationException(sprintf(
                    'Invalid SubjectConfirmation in Assertion, errors: "%s"',
                    implode('", "', $subjectConfirmationValidationResult->getErrors())
                ));
            }
        }
    }

    private function transformAssertion(Assertion $assertion)
    {
        return $this->transformer->transform($assertion);
    }
}