SAML2\HTTPRedirect Class Reference

Inheritance diagram for SAML2\HTTPRedirect:

Collaboration diagram for SAML2\HTTPRedirect:

Public Member Functions
	getRedirectURL (Message $message)
	Create the redirect URL for a message. More...
	send (Message $message)
	Send a SAML 2 message using the HTTP-Redirect binding. More...
	receive ()
	Receive a SAML 2 message sent using the HTTP-Redirect binding. More...
Public Member Functions inherited from SAML2\Binding
	getDestination ()
	Retrieve the destination of a message. More...
	setDestination ($destination)
	Override the destination of a message. More...
	send (Message $message)
	Send a SAML 2 message. More...
	receive ()
	Receive a SAML 2 message. More...

Static Public Member Functions
static	validateSignature (array $data, XMLSecurityKey $key)
	Validate the signature on a HTTP-Redirect message. More...
Static Public Member Functions inherited from SAML2\Binding
static	getBinding ($urn)
	Retrieve a binding with the given URN. More...
static	getCurrentBinding ()
	Guess the current binding. More...

Data Fields
const	DEFLATE = 'urn:oasis:names:tc:SAML:2.0:bindings:URL-Encoding:DEFLATE'

Static Private Member Functions
static	parseQuery ()
	Helper function to parse query data. More...

Additional Inherited Members
Protected Attributes inherited from SAML2\Binding
	$destination
	The destination of messages. More...

Detailed Description

Definition at line 12 of file HTTPRedirect.php.

Member Function Documentation

getRedirectURL()

SAML2\HTTPRedirect::getRedirectURL

(

Message

$message

)

Create the redirect URL for a message.

Parameters

\SAML2\Message

$message

The message.

Returns

string The URL the user should be redirected to in order to send a message.

Definition at line 22 of file HTTPRedirect.php.

    {
        if ($this->destination === null) {
            $destination = $message->getDestination();
        } else {
            $destination = $this->destination;
        }
 
        $relayState = $message->getRelayState();
 
        $key = $message->getSignatureKey();
 
        $msgStr = $message->toUnsignedXML();
        $msgStr = $msgStr->ownerDocument->saveXML($msgStr);
 
        Utils::getContainer()->debugMessage($msgStr, 'out');
 
        $msgStr = gzdeflate($msgStr);
        $msgStr = base64_encode($msgStr);
 
        /* Build the query string. */
 
        if ($message instanceof Request) {
            $msg = 'SAMLRequest=';
        } else {
            $msg = 'SAMLResponse=';
        }
        $msg .= urlencode($msgStr);
 
        if ($relayState !== null) {
            $msg .= '&RelayState=' . urlencode($relayState);
        }
 
        if ($key !== null) {
            /* Add the signature. */
            $msg .= '&SigAlg=' . urlencode($key->type);
 
            $signature = $key->signData($msg);
            $msg .= '&Signature=' . urlencode(base64_encode($signature));
        }
 
        if (strpos($destination, '?') === false) {
            $destination .= '?' . $msg;
        } else {
            $destination .= '&' . $msg;
        }
 
        return $destination;
    }

References $destination, $key, $message, and $relayState.

parseQuery()

static SAML2\HTTPRedirect::parseQuery ( )

staticprivate

Helper function to parse query data.

This function returns the query string split into key=>value pairs. It also adds a new parameter, SignedQuery, which contains the data that is signed.

Returns

string The query data that is signed.

Definition at line 159 of file HTTPRedirect.php.

    {
        /*
         * Parse the query string. We need to do this ourself, so that we get access
         * to the raw (urlencoded) values. This is required because different software
         * can urlencode to different values.
         */
        $data = array();
        $relayState = '';
        $sigAlg = '';
        $sigQuery = '';
        foreach (explode('&', $_SERVER['QUERY_STRING']) as $e) {
            $tmp = explode('=', $e, 2);
            $name = $tmp[0];
            if (count($tmp) === 2) {
                $value = $tmp[1];
            } else {
                /* No value for this parameter. */
                $value = '';
            }
            $name = urldecode($name);
            $data[$name] = urldecode($value);
 
            switch ($name) {
                case 'SAMLRequest':
                case 'SAMLResponse':
                    $sigQuery = $name . '=' . $value;
                    break;
                case 'RelayState':
                    $relayState = '&RelayState=' . $value;
                    break;
                case 'SigAlg':
                    $sigAlg = '&SigAlg=' . $value;
                    break;
            }
        }
 
        $data['SignedQuery'] = $sigQuery . $relayState . $sigAlg;
 
        return $data;
    }

References $_SERVER, $data, $name, and $relayState.

receive()

SAML2\HTTPRedirect::receive

(

)

Receive a SAML 2 message sent using the HTTP-Redirect binding.

Throws an exception if it is unable receive the message.

Returns

\SAML2\Message The received message.

Exceptions

Exception

NPath is currently too high but solving that just moves code around. @SuppressWarnings(PHPMD.NPathComplexity)

Reimplemented from SAML2\Binding.

Definition at line 97 of file HTTPRedirect.php.

    {
        $data = self::parseQuery();
        if (array_key_exists('SAMLRequest', $data)) {
            $message = $data['SAMLRequest'];
        } elseif (array_key_exists('SAMLResponse', $data)) {
            $message = $data['SAMLResponse'];
        } else {
            throw new \Exception('Missing SAMLRequest or SAMLResponse parameter.');
        }
 
        if (isset($data['SAMLEncoding']) && $data['SAMLEncoding'] !== self::DEFLATE) {
            throw new \Exception('Unknown SAMLEncoding: ' . var_export($data['SAMLEncoding'], true));
        }
 
        $message = base64_decode($message);
        if ($message === false) {
            throw new \Exception('Error while base64 decoding SAML message.');
        }
 
        $message = gzinflate($message);
        if ($message === false) {
            throw new \Exception('Error while inflating SAML message.');
        }
 
        Utils::getContainer()->debugMessage($message, 'in');
        $document = DOMDocumentFactory::fromString($message);
        $xml      = $document->firstChild;
        $message  = Message::fromXML($xml);
 
        if (array_key_exists('RelayState', $data)) {
            $message->setRelayState($data['RelayState']);
        }
 
        if (!array_key_exists('Signature', $data)) {
            return $message;
        }
 
        if (!array_key_exists('SigAlg', $data)) {
            throw new \Exception('Missing signature algorithm.');
        }
 
        $signData = array(
            'Signature' => $data['Signature'],
            'SigAlg'    => $data['SigAlg'],
            'Query'     => $data['SignedQuery'],
        );
 
        $message->addValidator(array(get_class($this), 'validateSignature'), $signData);
 
        return $message;
    }

References $data, $message, and $xml.

send()

SAML2\HTTPRedirect::send

(

Message

$message

)

Send a SAML 2 message using the HTTP-Redirect binding.

Note: This function never returns.

Parameters

\SAML2\Message

$message

The message we should send.

Reimplemented from SAML2\Binding.

Definition at line 79 of file HTTPRedirect.php.

    {
        $destination = $this->getRedirectURL($message);
        Utils::getContainer()->getLogger()->debug('Redirect to ' . strlen($destination) . ' byte URL: ' . $destination);
        Utils::getContainer()->redirect($destination);
    }

References $destination, and $message.

validateSignature()

static SAML2\HTTPRedirect::validateSignature ( array  $data, XMLSecurityKey  $key  )

static

Validate the signature on a HTTP-Redirect message.

Throws an exception if we are unable to validate the signature.

Parameters

array	$data	The data we need to validate the query string.
XMLSecurityKey	$key	The key we should validate the query against.

Exceptions

Exception

Definition at line 210 of file HTTPRedirect.php.

    {
        assert(array_key_exists("Query", $data));
        assert(array_key_exists("SigAlg", $data));
        assert(array_key_exists("Signature", $data));
 
        $query = $data['Query'];
        $sigAlg = $data['SigAlg'];
        $signature = $data['Signature'];
 
        $signature = base64_decode($signature);
 
        if ($key->type !== XMLSecurityKey::RSA_SHA256) {
            throw new \Exception('Invalid key type for validating signature on query string.');
        }
        if ($key->type !== $sigAlg) {
            $key = Utils::castKey($key, $sigAlg);
        }
 
        if ($key->verifySignature($query, $signature) !== 1) {
            throw new \Exception('Unable to validate signature on query string.');
        }
    }

References $data, $key, and $query.

Field Documentation

DEFLATE

const SAML2\HTTPRedirect::DEFLATE = 'urn:oasis:names:tc:SAML:2.0:bindings:URL-Encoding:DEFLATE'

Definition at line 14 of file HTTPRedirect.php.

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/saml2/src/SAML2/HTTPRedirect.php