SignedElementHelper.php

Go to the documentation of this file.

<?php

namespace SAML2;

use RobRichards\XMLSecLibs\XMLSecurityKey;

class SignedElementHelper implements SignedElement
{
    private $signatureKey;

    private $certificates;

    private $validators;

    protected function __construct(\DOMElement $xml = null)
    {
        $this->certificates = array();
        $this->validators = array();

        if ($xml === null) {
            return;
        }

        /* Validate the signature element of the message. */
        try {
            $sig = Utils::validateElement($xml);

            if ($sig !== false) {
                $this->certificates = $sig['Certificates'];
                $this->validators[] = array(
                    'Function' => array('\SAML2\Utils', 'validateSignature'),
                    'Data' => $sig,
                );
            }
        } catch (\Exception $e) {
            /* Ignore signature validation errors. */
        }
    }

    public function addValidator($function, $data)
    {
        assert(is_callable($function));

        $this->validators[] = array(
            'Function' => $function,
            'Data' => $data,
        );
    }

    public function validate(XMLSecurityKey $key)
    {
        if (count($this->validators) === 0) {
            return false;
        }

        $exceptions = array();

        foreach ($this->validators as $validator) {
            $function = $validator['Function'];
            $data = $validator['Data'];

            try {
                call_user_func($function, $data, $key);
                /* We were able to validate the message with this validator. */

                return true;
            } catch (\Exception $e) {
                $exceptions[] = $e;
            }
        }

        /* No validators were able to validate the message. */
        throw $exceptions[0];
    }

    public function getSignatureKey()
    {
        return $this->signatureKey;
    }

    public function setSignatureKey(XMLSecurityKey $signatureKey = null)
    {
        $this->signatureKey = $signatureKey;
    }

    public function setCertificates(array $certificates)
    {
        $this->certificates = $certificates;
    }

    public function getCertificates()
    {
        return $this->certificates;
    }

    public function getValidatingCertificates()
    {
        $ret = array();
        foreach ($this->certificates as $cert) {

            /* Construct a PEM formatted certificate */
            $pemCert = "-----BEGIN CERTIFICATE-----\n" .
                chunk_split($cert, 64) .
                "-----END CERTIFICATE-----\n";

            /* Extract the public key from the certificate for validation. */
            $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, array('type'=>'public'));
            $key->loadKey($pemCert);

            try {
                /* Check the signature. */
                if ($this->validate($key)) {
                    $ret[] = $cert;
                }
            } catch (\Exception $e) {
                /* This certificate does not sign this element. */
            }
        }

        return $ret;
    }

    protected function signElement(\DOMElement $root, \DOMElement $insertBefore = null)
    {
        if ($this->signatureKey === null) {
            /* We cannot sign this element. */

            return null;
        }

        Utils::insertSignature($this->signatureKey, $this->certificates, $root, $insertBefore);

        return $root;
    }
}