SAML2\Assertion Class Reference

Inheritance diagram for SAML2\Assertion:

Collaboration diagram for SAML2\Assertion:

Public Member Functions
	__construct (\DOMElement $xml=null)
	Constructor for SAML 2 assertions. More...
	validate (XMLSecurityKey $key)
	Validate this assertion against a public key. More...
	getId ()
	Retrieve the identifier of this assertion. More...
	setId ($id)
	Set the identifier of this assertion. More...
	getIssueInstant ()
	Retrieve the issue timestamp of this assertion. More...
	setIssueInstant ($issueInstant)
	Set the issue timestamp of this assertion. More...
	getIssuer ()
	Retrieve the issuer if this assertion. More...
	setIssuer ($issuer)
	Set the issuer of this message. More...
	getNameId ()
	Retrieve the NameId of the subject in the assertion. More...
	setNameId ($nameId)
	Set the NameId of the subject in the assertion. More...
	isNameIdEncrypted ()
	Check whether the NameId is encrypted. More...
	encryptNameId (XMLSecurityKey $key)
	Encrypt the NameID in the Assertion. More...
	decryptNameId (XMLSecurityKey $key, array $blacklist=array())
	Decrypt the NameId of the subject in the assertion. More...
	hasEncryptedAttributes ()
	Did this Assertion contain encrypted Attributes? More...
	decryptAttributes (XMLSecurityKey $key, array $blacklist=array())
	Decrypt the assertion attributes. More...
	getNotBefore ()
	Retrieve the earliest timestamp this assertion is valid. More...
	setNotBefore ($notBefore)
	Set the earliest timestamp this assertion can be used. More...
	getNotOnOrAfter ()
	Retrieve the expiration timestamp of this assertion. More...
	setNotOnOrAfter ($notOnOrAfter)
	Set the expiration timestamp of this assertion. More...
	setEncryptedAttributes ($ea)
	Set $EncryptedAttributes if attributes will send encrypted. More...
	getValidAudiences ()
	Retrieve the audiences that are allowed to receive this assertion. More...
	setValidAudiences (array $validAudiences=null)
	Set the audiences that are allowed to receive this assertion. More...
	getAuthnInstant ()
	Retrieve the AuthnInstant of the assertion. More...
	setAuthnInstant ($authnInstant)
	Set the AuthnInstant of the assertion. More...
	getSessionNotOnOrAfter ()
	Retrieve the session expiration timestamp. More...
	setSessionNotOnOrAfter ($sessionNotOnOrAfter)
	Set the session expiration timestamp. More...
	getSessionIndex ()
	Retrieve the session index of the user at the IdP. More...
	setSessionIndex ($sessionIndex)
	Set the session index of the user at the IdP. More...
	getAuthnContext ()
	Retrieve the authentication method used to authenticate the user. More...
	setAuthnContext ($authnContext)
	Set the authentication method used to authenticate the user. More...
	getAuthnContextClassRef ()
	Retrieve the authentication method used to authenticate the user. More...
	setAuthnContextClassRef ($authnContextClassRef)
	Set the authentication method used to authenticate the user. More...
	setAuthnContextDecl (Chunk $authnContextDecl)
	Set the authentication context declaration. More...
	getAuthnContextDecl ()
	Get the authentication context declaration. More...
	setAuthnContextDeclRef ($authnContextDeclRef)
	Set the authentication context declaration reference. More...
	getAuthnContextDeclRef ()
	Get the authentication context declaration reference. More...
	getAuthenticatingAuthority ()
	Retrieve the AuthenticatingAuthority. More...
	setAuthenticatingAuthority ($authenticatingAuthority)
	Set the AuthenticatingAuthority. More...
	getAttributes ()
	Retrieve all attributes. More...
	setAttributes (array $attributes)
	Replace all attributes. More...
	getAttributesValueTypes ()
	Retrieve all attributes value types. More...
	setAttributesValueTypes (array $attributesValueTypes)
	Replace all attributes value types. More...
	getAttributeNameFormat ()
	Retrieve the NameFormat used on all attributes. More...
	setAttributeNameFormat ($nameFormat)
	Set the NameFormat used on all attributes. More...
	getSubjectConfirmation ()
	Retrieve the SubjectConfirmation elements we have in our Subject element. More...
	setSubjectConfirmation (array $SubjectConfirmation)
	Set the SubjectConfirmation elements that should be included in the assertion. More...
	getSignatureKey ()
	Retrieve the private key we should use to sign the assertion. More...
	setSignatureKey (XMLSecurityKey $signatureKey=null)
	Set the private key we should use to sign the assertion. More...
	getEncryptionKey ()
	Return the key we should use to encrypt the assertion. More...
	setEncryptionKey (XMLSecurityKey $Key=null)
	Set the private key we should use to encrypt the attributes. More...
	setCertificates (array $certificates)
	Set the certificates that should be included in the assertion. More...
	getCertificates ()
	Retrieve the certificates that are included in the assertion. More...
	getWasSignedAtConstruction ()
	getSignatureMethod ()
	toXML (\DOMNode $parentElement=null)
	Convert this assertion to an XML element. More...

Protected Attributes
	$wasSignedAtConstruction = false

Private Member Functions
	parseSubject (\DOMElement $xml)
	Parse subject in assertion. More...
	parseConditions (\DOMElement $xml)
	Parse conditions in assertion. More...
	parseAuthnStatement (\DOMElement $xml)
	Parse AuthnStatement in assertion. More...
	parseAuthnContext (\DOMElement $authnStatementEl)
	Parse AuthnContext in AuthnStatement. More...
	parseAttributes (\DOMElement $xml)
	Parse attribute statements in assertion. More...
	parseEncryptedAttributes (\DOMElement $xml)
	Parse encrypted attribute statements in assertion. More...
	addSubject (\DOMElement $root)
	Add a Subject-node to the assertion. More...
	addConditions (\DOMElement $root)
	Add a Conditions-node to the assertion. More...
	addAuthnStatement (\DOMElement $root)
	Add a AuthnStatement-node to the assertion. More...
	addAttributeStatement (\DOMElement $root)
	Add an AttributeStatement-node to the assertion. More...
	addEncryptedAttributeStatement (\DOMElement $root)
	Add an EncryptedAttribute Statement-node to the assertion. More...

Private Attributes
	$id
	$issueInstant
	$issuer
	$nameId
	$encryptedNameId
	$encryptedAttributes
	$encryptionKey
	$notBefore
	$notOnOrAfter
	$validAudiences
	$sessionNotOnOrAfter
	$sessionIndex
	$authnInstant
	$authnContextClassRef
	$authnContextDecl
	$authnContextDeclRef
	$AuthenticatingAuthority
	$attributes
	$attributesValueTypes
	$nameFormat
	$signatureKey
	$certificates
	$signatureData
	$requiredEncAttributes
	$SubjectConfirmation
	$signatureMethod

Detailed Description

Definition at line 17 of file Assertion.php.

Constructor & Destructor Documentation

__construct()

SAML2\Assertion::__construct

(

\DOMElement

$xml = null

)

Constructor for SAML 2 assertions.

Parameters

\DOMElement | null

$xml

The input assertion.

Exceptions

Definition at line 257 of file Assertion.php.

References $issuer, and $xml.

    {
        $this->id = Utils::getContainer()->generateId();
        $this->issueInstant = Temporal::getTime();
        $this->issuer = '';
        $this->authnInstant = Temporal::getTime();
        $this->attributes = array();
        $this->nameFormat = Constants::NAMEFORMAT_UNSPECIFIED;
        $this->certificates = array();
        $this->AuthenticatingAuthority = array();
        $this->SubjectConfirmation = array();
        $this->requiredEncAttributes = false;

        if ($xml === null) {
            return;
        }

        if (!$xml->hasAttribute('ID')) {
            throw new \Exception('Missing ID attribute on SAML assertion.');
        }
        $this->id = $xml->getAttribute('ID');

        if ($xml->getAttribute('Version') !== '2.0') {
            /* Currently a very strict check. */
            throw new \Exception('Unsupported version: ' . $xml->getAttribute('Version'));
        }

        $this->issueInstant = Utils::xsDateTimeToTimestamp($xml->getAttribute('IssueInstant'));

        $issuer = Utils::xpQuery($xml, './saml_assertion:Issuer');
        if (empty($issuer)) {
            throw new \Exception('Missing <saml:Issuer> in assertion.');
        }
        $this->issuer = new XML\saml\Issuer($issuer[0]);
        if ($this->issuer->Format === Constants::NAMEID_ENTITY) {
            $this->issuer = $this->issuer->value;
        }

        $this->parseSubject($xml);
        $this->parseConditions($xml);
        $this->parseAuthnStatement($xml);
        $this->parseAttributes($xml);
        $this->parseEncryptedAttributes($xml);
        $this->parseSignature($xml);
    }

Member Function Documentation

addAttributeStatement()

SAML2\Assertion::addAttributeStatement ( \DOMElement  $root )

private

Add an AttributeStatement-node to the assertion.

Parameters

\DOMElement

$root

The assertion element we should add the subject to.

Definition at line 1537 of file Assertion.php.

References $i, $name, $type, and $values.

    {
        if (empty($this->attributes)) {
            return;
        }

        $document = $root->ownerDocument;

        $attributeStatement = $document->createElementNS(Constants::NS_SAML, 'saml:AttributeStatement');
        $root->appendChild($attributeStatement);

        foreach ($this->attributes as $name => $values) {
            $attribute = $document->createElementNS(Constants::NS_SAML, 'saml:Attribute');
            $attributeStatement->appendChild($attribute);
            $attribute->setAttribute('Name', $name);

            if ($this->nameFormat !== Constants::NAMEFORMAT_UNSPECIFIED) {
                $attribute->setAttribute('NameFormat', $this->nameFormat);
            }

            // make sure eduPersonTargetedID can be handled properly as a NameID
            if ($name === Constants::EPTI_URN_MACE || $name === Constants::EPTI_URN_OID) {
                foreach ($values as $eptiValue) {
                    $attributeValue = $document->createElementNS(Constants::NS_SAML, 'saml:AttributeValue');
                    $attribute->appendChild($attributeValue);
                    if ($eptiValue instanceof XML\saml\NameID) {
                        $eptiValue->toXML($attributeValue);
                    } elseif ($eptiValue instanceof \DOMNodeList) {
                        $node = $root->ownerDocument->importNode($eptiValue->item(0), true);
                        $attributeValue->appendChild($node);
                    } else {
                        $attributeValue->textContent = $eptiValue;
                    }
                }

                continue;
            }

            // get value type(s) for the current attribute
            if (is_array($this->attributesValueTypes) && array_key_exists($name, $this->attributesValueTypes)) {
                $valueTypes = $this->attributesValueTypes[$name];
                if (is_array($valueTypes) && count($valueTypes) != count($values)) {
                    throw new \Exception('Array of value types and array of values have different size for attribute '. var_export($name, true));
                }
            } else {
                // if no type(s), default behaviour
                $valueTypes = null;
            }

            $vidx = -1;
            foreach ($values as $value) {
                $vidx++;

                // try to get type from current types
                $type = null;
                if (!is_null($valueTypes)) {
                    if (is_array($valueTypes)) {
                        $type = $valueTypes[$vidx];
                    } else {
                        $type = $valueTypes;
                    }
                }

                // if no type get from types, use default behaviour
                if (is_null($type)) {
                    if (is_string($value)) {
                        $type = 'xs:string';
                    } elseif (is_int($value)) {
                        $type = 'xs:integer';
                    } else {
                        $type = null;
                    }
                }

                $attributeValue = $document->createElementNS(Constants::NS_SAML, 'saml:AttributeValue');
                $attribute->appendChild($attributeValue);
                if ($type !== null) {
                    $attributeValue->setAttributeNS(Constants::NS_XSI, 'xsi:type', $type);
                }
                if (is_null($value)) {
                    $attributeValue->setAttributeNS(Constants::NS_XSI, 'xsi:nil', 'true');
                }

                if ($value instanceof \DOMNodeList) {
                    for ($i = 0; $i < $value->length; $i++) {
                        $node = $document->importNode($value->item($i), true);
                        $attributeValue->appendChild($node);
                    }
                } else {
                    $attributeValue->appendChild($document->createTextNode($value));
                }
            }
        }
    }

addAuthnStatement()

SAML2\Assertion::addAuthnStatement ( \DOMElement  $root )

private

Add a AuthnStatement-node to the assertion.

Parameters

\DOMElement

$root

The assertion element we should add the authentication statement to.

Definition at line 1471 of file Assertion.php.

    {
        if ($this->authnInstant === null ||
            (
                $this->authnContextClassRef === null &&
                $this->authnContextDecl === null &&
                $this->authnContextDeclRef === null
            )
        ) {
            /* No authentication context or AuthnInstant => no authentication statement. */

            return;
        }

        $document = $root->ownerDocument;

        $authnStatementEl = $document->createElementNS(Constants::NS_SAML, 'saml:AuthnStatement');
        $root->appendChild($authnStatementEl);

        $authnStatementEl->setAttribute('AuthnInstant', gmdate('Y-m-d\TH:i:s\Z', $this->authnInstant));

        if ($this->sessionNotOnOrAfter !== null) {
            $authnStatementEl->setAttribute('SessionNotOnOrAfter', gmdate('Y-m-d\TH:i:s\Z', $this->sessionNotOnOrAfter));
        }
        if ($this->sessionIndex !== null) {
            $authnStatementEl->setAttribute('SessionIndex', $this->sessionIndex);
        }

        $authnContextEl = $document->createElementNS(Constants::NS_SAML, 'saml:AuthnContext');
        $authnStatementEl->appendChild($authnContextEl);

        if (!empty($this->authnContextClassRef)) {
            Utils::addString(
                $authnContextEl,
                Constants::NS_SAML,
                'saml:AuthnContextClassRef',
                $this->authnContextClassRef
            );
        }
        if (!empty($this->authnContextDecl)) {
            $this->authnContextDecl->toXML($authnContextEl);
        }
        if (!empty($this->authnContextDeclRef)) {
            Utils::addString(
                $authnContextEl,
                Constants::NS_SAML,
                'saml:AuthnContextDeclRef',
                $this->authnContextDeclRef
            );
        }

        Utils::addStrings(
            $authnContextEl,
            Constants::NS_SAML,
            'saml:AuthenticatingAuthority',
            false,
            $this->AuthenticatingAuthority
        );
    }

addConditions()

SAML2\Assertion::addConditions ( \DOMElement  $root )

private

Add a Conditions-node to the assertion.

Parameters

\DOMElement

$root

The assertion element we should add the conditions to.

Definition at line 1443 of file Assertion.php.

    {
        $document = $root->ownerDocument;

        $conditions = $document->createElementNS(Constants::NS_SAML, 'saml:Conditions');
        $root->appendChild($conditions);

        if ($this->notBefore !== null) {
            $conditions->setAttribute('NotBefore', gmdate('Y-m-d\TH:i:s\Z', $this->notBefore));
        }
        if ($this->notOnOrAfter !== null) {
            $conditions->setAttribute('NotOnOrAfter', gmdate('Y-m-d\TH:i:s\Z', $this->notOnOrAfter));
        }

        if ($this->validAudiences !== null) {
            $ar = $document->createElementNS(Constants::NS_SAML, 'saml:AudienceRestriction');
            $conditions->appendChild($ar);

            Utils::addStrings($ar, Constants::NS_SAML, 'saml:Audience', false, $this->validAudiences);
        }
    }

addEncryptedAttributeStatement()

SAML2\Assertion::addEncryptedAttributeStatement ( \DOMElement  $root )

private

Add an EncryptedAttribute Statement-node to the assertion.

Parameters

\DOMElement

$root

The assertion element we should add the Encrypted Attribute Statement to.

Definition at line 1638 of file Assertion.php.

References $i, $n, $name, $type, and $values.

    {
        if ($this->requiredEncAttributes === false) {
            return;
        }

        $document = $root->ownerDocument;

        $attributeStatement = $document->createElementNS(Constants::NS_SAML, 'saml:AttributeStatement');
        $root->appendChild($attributeStatement);

        foreach ($this->attributes as $name => $values) {
            $document2 = DOMDocumentFactory::create();
            $attribute = $document2->createElementNS(Constants::NS_SAML, 'saml:Attribute');
            $attribute->setAttribute('Name', $name);
            $document2->appendChild($attribute);

            if ($this->nameFormat !== Constants::NAMEFORMAT_UNSPECIFIED) {
                $attribute->setAttribute('NameFormat', $this->nameFormat);
            }

            foreach ($values as $value) {
                if (is_string($value)) {
                    $type = 'xs:string';
                } elseif (is_int($value)) {
                    $type = 'xs:integer';
                } else {
                    $type = null;
                }

                $attributeValue = $document2->createElementNS(Constants::NS_SAML, 'saml:AttributeValue');
                $attribute->appendChild($attributeValue);
                if ($type !== null) {
                    $attributeValue->setAttributeNS(Constants::NS_XSI, 'xsi:type', $type);
                }

                if ($value instanceof \DOMNodeList) {
                    for ($i = 0; $i < $value->length; $i++) {
                        $node = $document2->importNode($value->item($i), true);
                        $attributeValue->appendChild($node);
                    }
                } else {
                    $attributeValue->appendChild($document2->createTextNode($value));
                }
            }
            /*Once the attribute nodes are built, the are encrypted*/
            $EncAssert = new XMLSecEnc();
            $EncAssert->setNode($document2->documentElement);
            $EncAssert->type = 'http://www.w3.org/2001/04/xmlenc#Element';
            /*
             * Attributes are encrypted with a session key and this one with
             * $EncryptionKey
             */
            $symmetricKey = new XMLSecurityKey(XMLSecurityKey::AES256_CBC);
            $symmetricKey->generateSessionKey();
            $EncAssert->encryptKey($this->encryptionKey, $symmetricKey);
            $EncrNode = $EncAssert->encryptNode($symmetricKey);

            $EncAttribute = $document->createElementNS(Constants::NS_SAML, 'saml:EncryptedAttribute');
            $attributeStatement->appendChild($EncAttribute);
            $n = $document->importNode($EncrNode, true);
            $EncAttribute->appendChild($n);
        }
    }

addSubject()

SAML2\Assertion::addSubject ( \DOMElement  $root )

private

Add a Subject-node to the assertion.

Parameters

\DOMElement

$root

The assertion element we should add the subject to.

Definition at line 1413 of file Assertion.php.

References $sc.

    {
        if ($this->nameId === null && $this->encryptedNameId === null) {
            /* We don't have anything to create a Subject node for. */

            return;
        }

        $subject = $root->ownerDocument->createElementNS(Constants::NS_SAML, 'saml:Subject');
        $root->appendChild($subject);

        if ($this->encryptedNameId === null) {
            $this->nameId->toXML($subject);
        } else {
            $eid = $subject->ownerDocument->createElementNS(Constants::NS_SAML, 'saml:' . 'EncryptedID');
            $subject->appendChild($eid);
            $eid->appendChild($subject->ownerDocument->importNode($this->encryptedNameId, true));
        }

        foreach ($this->SubjectConfirmation as $sc) {
            $sc->toXML($subject);
        }
    }

decryptAttributes()

SAML2\Assertion::decryptAttributes	(	XMLSecurityKey	$key,
		array	$blacklist = array()
	)

Decrypt the assertion attributes.

Parameters

XMLSecurityKey	$key
array	$blacklist

Exceptions

Definition at line 835 of file Assertion.php.

References $attributes, $key, and $name.

    {
        if (!$this->hasEncryptedAttributes()) {
            return;
        }
        $firstAttribute = true;
        $attributes = $this->encryptedAttributes;
        foreach ($attributes as $attributeEnc) {
            /*Decrypt node <EncryptedAttribute>*/
            $attribute = Utils::decryptElement(
                $attributeEnc->getElementsByTagName('EncryptedData')->item(0),
                $key,
                $blacklist
            );

            if (!$attribute->hasAttribute('Name')) {
                throw new \Exception('Missing name on <saml:Attribute> element.');
            }
            $name = $attribute->getAttribute('Name');

            if ($attribute->hasAttribute('NameFormat')) {
                $nameFormat = $attribute->getAttribute('NameFormat');
            } else {
                $nameFormat = Constants::NAMEFORMAT_UNSPECIFIED;
            }

            if ($firstAttribute) {
                $this->nameFormat = $nameFormat;
                $firstAttribute = false;
            } else {
                if ($this->nameFormat !== $nameFormat) {
                    $this->nameFormat = Constants::NAMEFORMAT_UNSPECIFIED;
                }
            }

            if (!array_key_exists($name, $this->attributes)) {
                $this->attributes[$name] = array();
            }

            $this->parseAttributeValue($attribute, $name);
        }
    }

decryptNameId()

SAML2\Assertion::decryptNameId	(	XMLSecurityKey	$key,
		array	$blacklist = array()
	)

Decrypt the NameId of the subject in the assertion.

Parameters

XMLSecurityKey	$key	The decryption key.
array	$blacklist	Blacklisted decryption algorithms.

Definition at line 803 of file Assertion.php.

References $nameId.

Referenced by SAML2\Assertion\Transformer\NameIdDecryptionTransformer\transform().

    {
        if ($this->encryptedNameId === null) {
            /* No NameID to decrypt. */

            return;
        }

        $nameId = Utils::decryptElement($this->encryptedNameId, $key, $blacklist);
        Utils::getContainer()->debugMessage($nameId, 'decrypt');
        $this->nameId = new XML\saml\NameID($nameId);

        $this->encryptedNameId = null;
    }

Here is the caller graph for this function:

encryptNameId()

SAML2\Assertion::encryptNameId

(

XMLSecurityKey

$key

)

Encrypt the NameID in the Assertion.

Parameters

XMLSecurityKey

$key

The encryption key.

Definition at line 771 of file Assertion.php.

References $nameId, and $root.

    {
        /* First create a XML representation of the NameID. */
        $doc = DOMDocumentFactory::create();
        $root = $doc->createElement('root');
        $doc->appendChild($root);
        $this->nameId->toXML($root);
        $nameId = $root->firstChild;

        Utils::getContainer()->debugMessage($nameId, 'encrypt');

        /* Encrypt the NameID. */
        $enc = new XMLSecEnc();
        $enc->setNode($nameId);
        // @codingStandardsIgnoreStart
        $enc->type = XMLSecEnc::Element;
        // @codingStandardsIgnoreEnd

        $symmetricKey = new XMLSecurityKey(XMLSecurityKey::AES128_CBC);
        $symmetricKey->generateSessionKey();
        $enc->encryptKey($key, $symmetricKey);

        $this->encryptedNameId = $enc->encryptNode($symmetricKey);
        $this->nameId = null;
    }

getAttributeNameFormat()

SAML2\Assertion::getAttributeNameFormat

(

)

Retrieve the NameFormat used on all attributes.

If more than one NameFormat is used in the received attributes, this returns the unspecified NameFormat.

Returns

string The NameFormat used on all attributes.

Definition at line 1238 of file Assertion.php.

    {
        return $this->nameFormat;
    }

getAttributes()

SAML2\Assertion::getAttributes

(

)

Retrieve all attributes.

Returns

array All attributes, as an associative array.

Definition at line 1195 of file Assertion.php.

References $attributes.

Referenced by SAML2\Assertion\Transformer\DecodeBase64Transformer\transform().

    {
        return $this->attributes;
    }

Here is the caller graph for this function:

getAttributesValueTypes()

SAML2\Assertion::getAttributesValueTypes

(

)

Retrieve all attributes value types.

Returns

array All attributes value types, as an associative array.

Definition at line 1215 of file Assertion.php.

    {
        return $this->attributesValueTypes;
    }

getAuthenticatingAuthority()

SAML2\Assertion::getAuthenticatingAuthority

(

)

Retrieve the AuthenticatingAuthority.

Returns

array

Definition at line 1174 of file Assertion.php.

    {
        return $this->AuthenticatingAuthority;
    }

getAuthnContext()

SAML2\Assertion::getAuthnContext

(

)

Retrieve the authentication method used to authenticate the user.

This will return null if no authentication statement was included in the assertion.

Note that this returns either the AuthnContextClassRef or the AuthnConextDeclRef, whose definition overlaps but is slightly different (consult the specification for more information). This was done to work around an old bug of Shibboleth ( https://bugs.internet2.edu/jira/browse/SIDP-187 ). Should no longer be required, please use either getAuthnConextClassRef or getAuthnContextDeclRef.

Deprecated:

use getAuthnContextClassRef

Returns

string|null The authentication method.

Definition at line 1055 of file Assertion.php.

    {
        if (!empty($this->authnContextClassRef)) {
            return $this->authnContextClassRef;
        }
        if (!empty($this->authnContextDeclRef)) {
            return $this->authnContextDeclRef;
        }
        return null;
    }

getAuthnContextClassRef()

SAML2\Assertion::getAuthnContextClassRef

(

)

Retrieve the authentication method used to authenticate the user.

This will return null if no authentication statement was included in the assertion.

Returns

string|null The authentication method.

Definition at line 1088 of file Assertion.php.

    {
        return $this->authnContextClassRef;
    }

getAuthnContextDecl()

SAML2\Assertion::getAuthnContextDecl

(

)

Get the authentication context declaration.

See: http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf

Returns

|null

Definition at line 1133 of file Assertion.php.

    {
        return $this->authnContextDecl;
    }

getAuthnContextDeclRef()

SAML2\Assertion::getAuthnContextDeclRef

(

)

Get the authentication context declaration reference.

URI reference that identifies an authentication context declaration.

The URI reference MAY directly resolve into an XML document containing the referenced declaration.

Returns

string

Definition at line 1163 of file Assertion.php.

    {
        return $this->authnContextDeclRef;
    }

getAuthnInstant()

SAML2\Assertion::getAuthnInstant

(

)

Retrieve the AuthnInstant of the assertion.

Returns

int|null The timestamp the user was authenticated, or NULL if the user isn't authenticated.

Definition at line 971 of file Assertion.php.

    {
        return $this->authnInstant;
    }

getCertificates()

SAML2\Assertion::getCertificates

(

)

Retrieve the certificates that are included in the assertion.

Returns

array An array of certificates.

Implements SAML2\SignedElement.

Definition at line 1335 of file Assertion.php.

References $certificates.

    {
        return $this->certificates;
    }

getEncryptionKey()

SAML2\Assertion::getEncryptionKey

(

)

Return the key we should use to encrypt the assertion.

Returns

XMLSecurityKey|null The key, or NULL if no key is specified..

Definition at line 1303 of file Assertion.php.

    {
        return $this->encryptionKey;
    }

getId()

SAML2\Assertion::getId

(

)

Retrieve the identifier of this assertion.

Returns

string The identifier of this assertion.

Definition at line 661 of file Assertion.php.

References $id.

    {
        return $this->id;
    }

getIssueInstant()

SAML2\Assertion::getIssueInstant

(

)

Retrieve the issue timestamp of this assertion.

Returns

int The issue timestamp of this assertion, as an UNIX timestamp.

Definition at line 683 of file Assertion.php.

    {
        return $this->issueInstant;
    }

getIssuer()

SAML2\Assertion::getIssuer

(

)

Retrieve the issuer if this assertion.

Returns

string| The issuer of this assertion.

Definition at line 705 of file Assertion.php.

References $issuer.

    {
        return $this->issuer;
    }

getNameId()

SAML2\Assertion::getNameId

(

)

Retrieve the NameId of the subject in the assertion.

Returns

|null The name identifier of the assertion.

Exceptions

Definition at line 728 of file Assertion.php.

References $nameId.

    {
        if ($this->encryptedNameId !== null) {
            throw new \Exception('Attempted to retrieve encrypted NameID without decrypting it first.');
        }

        return $this->nameId;
    }

getNotBefore()

SAML2\Assertion::getNotBefore

(

)

Retrieve the earliest timestamp this assertion is valid.

This function returns null if there are no restrictions on how early the assertion can be used.

Returns

int|null The earliest timestamp this assertion is valid.

Definition at line 886 of file Assertion.php.

Referenced by SAML2\Assertion\Validation\ConstraintValidator\NotBefore\validate().

    {
        return $this->notBefore;
    }

Here is the caller graph for this function:

getNotOnOrAfter()

SAML2\Assertion::getNotOnOrAfter

(

)

Retrieve the expiration timestamp of this assertion.

This function returns null if there are no restrictions on how late the assertion can be used.

Returns

int|null The latest timestamp this assertion is valid.

Definition at line 913 of file Assertion.php.

Referenced by SAML2\Assertion\Validation\ConstraintValidator\NotOnOrAfter\validate().

    {
        return $this->notOnOrAfter;
    }

Here is the caller graph for this function:

getSessionIndex()

SAML2\Assertion::getSessionIndex

(

)

Retrieve the session index of the user at the IdP.

Returns

string|null The session index of the user at the IdP.

Definition at line 1021 of file Assertion.php.

References $sessionIndex.

    {
        return $this->sessionIndex;
    }

getSessionNotOnOrAfter()

SAML2\Assertion::getSessionNotOnOrAfter

(

)

Retrieve the session expiration timestamp.

This function returns null if there are no restrictions on the session lifetime.

Returns

int|null The latest timestamp this session is valid.

Definition at line 997 of file Assertion.php.

Referenced by SAML2\Assertion\Validation\ConstraintValidator\SessionNotOnOrAfter\validate().

    {
        return $this->sessionNotOnOrAfter;
    }

Here is the caller graph for this function:

getSignatureKey()

SAML2\Assertion::getSignatureKey

(

)

Retrieve the private key we should use to sign the assertion.

Returns

XMLSecurityKey|null The key, or NULL if no key is specified.

Implements SAML2\SignedElement.

Definition at line 1280 of file Assertion.php.

    {
        return $this->signatureKey;
    }

getSignatureMethod()

SAML2\Assertion::getSignatureMethod

(

)

Returns

null|string

Definition at line 1351 of file Assertion.php.

    {
        return $this->signatureMethod;
    }

getSubjectConfirmation()

SAML2\Assertion::getSubjectConfirmation

(

)

Retrieve the SubjectConfirmation elements we have in our Subject element.

Returns

array Array of elements.

Definition at line 1260 of file Assertion.php.

Referenced by SAML2\Assertion\Processor\validateAssertion().

    {
        return $this->SubjectConfirmation;
    }

Here is the caller graph for this function:

getValidAudiences()

SAML2\Assertion::getValidAudiences

(

)

Retrieve the audiences that are allowed to receive this assertion.

This may be null, in which case all audiences are allowed.

Returns

array|null The allowed audiences.

Definition at line 949 of file Assertion.php.

Referenced by SAML2\Assertion\Validation\ConstraintValidator\SpIsValidAudience\validate().

    {
        return $this->validAudiences;
    }

Here is the caller graph for this function:

getWasSignedAtConstruction()

SAML2\Assertion::getWasSignedAtConstruction

(

)

Returns

bool

Definition at line 1343 of file Assertion.php.

    {
        return $this->wasSignedAtConstruction;
    }

hasEncryptedAttributes()

SAML2\Assertion::hasEncryptedAttributes

(

)

Did this Assertion contain encrypted Attributes?

Returns

bool

Definition at line 823 of file Assertion.php.

    {
        return $this->encryptedAttributes !== [];
    }

isNameIdEncrypted()

SAML2\Assertion::isNameIdEncrypted

(

)

Check whether the NameId is encrypted.

Returns

true if the NameId is encrypted, false if not.

Definition at line 761 of file Assertion.php.

Referenced by SAML2\Assertion\Transformer\NameIdDecryptionTransformer\transform().

    {
        return $this->encryptedNameId !== null;
    }

Here is the caller graph for this function:

parseAttributes()

SAML2\Assertion::parseAttributes ( \DOMElement  $xml )

private

Parse attribute statements in assertion.

Parameters

\DOMElement

$xml

The XML element with the assertion.

Exceptions

Definition at line 510 of file Assertion.php.

References $attributes, $index, $name, $type, and $values.

    {
        $firstAttribute = true;
        $attributes = Utils::xpQuery($xml, './saml_assertion:AttributeStatement/saml_assertion:Attribute');
        foreach ($attributes as $attribute) {
            if (!$attribute->hasAttribute('Name')) {
                throw new \Exception('Missing name on <saml:Attribute> element.');
            }
            $name = $attribute->getAttribute('Name');

            if ($attribute->hasAttribute('NameFormat')) {
                $nameFormat = $attribute->getAttribute('NameFormat');
            } else {
                $nameFormat = Constants::NAMEFORMAT_UNSPECIFIED;
            }

            if ($firstAttribute) {
                $this->nameFormat = $nameFormat;
                $firstAttribute = false;
            } else {
                if ($this->nameFormat !== $nameFormat) {
                    $this->nameFormat = Constants::NAMEFORMAT_UNSPECIFIED;
                }
            }

            if (!array_key_exists($name, $this->attributes)) {
                $this->attributes[$name] = array();
                $this->attributesValueTypes[$name] = array();
            }

            $this->parseAttributeValue($attribute, $name);
        }
    }

parseAuthnContext()

SAML2\Assertion::parseAuthnContext ( \DOMElement  $authnStatementEl )

private

Parse AuthnContext in AuthnStatement.

Parameters

\DOMElement

$authnStatementEl

Exceptions

Definition at line 451 of file Assertion.php.

    {
        // Get the AuthnContext element
        $authnContexts = Utils::xpQuery($authnStatementEl, './saml_assertion:AuthnContext');
        if (count($authnContexts) > 1) {
            throw new \Exception('More than one <saml:AuthnContext> in <saml:AuthnStatement>.');
        } elseif (empty($authnContexts)) {
            throw new \Exception('Missing required <saml:AuthnContext> in <saml:AuthnStatement>.');
        }
        $authnContextEl = $authnContexts[0];

        // Get the AuthnContextDeclRef (if available)
        $authnContextDeclRefs = Utils::xpQuery($authnContextEl, './saml_assertion:AuthnContextDeclRef');
        if (count($authnContextDeclRefs) > 1) {
            throw new \Exception(
                'More than one <saml:AuthnContextDeclRef> found?'
            );
        } elseif (count($authnContextDeclRefs) === 1) {
            $this->setAuthnContextDeclRef(trim($authnContextDeclRefs[0]->textContent));
        }

        // Get the AuthnContextDecl (if available)
        $authnContextDecls = Utils::xpQuery($authnContextEl, './saml_assertion:AuthnContextDecl');
        if (count($authnContextDecls) > 1) {
            throw new \Exception(
                'More than one <saml:AuthnContextDecl> found?'
            );
        } elseif (count($authnContextDecls) === 1) {
            $this->setAuthnContextDecl(new Chunk($authnContextDecls[0]));
        }

        // Get the AuthnContextClassRef (if available)
        $authnContextClassRefs = Utils::xpQuery($authnContextEl, './saml_assertion:AuthnContextClassRef');
        if (count($authnContextClassRefs) > 1) {
            throw new \Exception('More than one <saml:AuthnContextClassRef> in <saml:AuthnContext>.');
        } elseif (count($authnContextClassRefs) === 1) {
            $this->setAuthnContextClassRef(trim($authnContextClassRefs[0]->textContent));
        }

        // Constraint from XSD: MUST have one of the three
        if (empty($this->authnContextClassRef) && empty($this->authnContextDecl) && empty($this->authnContextDeclRef)) {
            throw new \Exception(
                'Missing either <saml:AuthnContextClassRef> or <saml:AuthnContextDeclRef> or <saml:AuthnContextDecl>'
            );
        }

        $this->AuthenticatingAuthority = Utils::extractStrings(
            $authnContextEl,
            Constants::NS_SAML,
            'AuthenticatingAuthority'
        );
    }

parseAuthnStatement()

SAML2\Assertion::parseAuthnStatement ( \DOMElement  $xml )

private

Parse AuthnStatement in assertion.

Parameters

\DOMElement

$xml

The assertion XML element.

Exceptions

Definition at line 417 of file Assertion.php.

    {
        $authnStatements = Utils::xpQuery($xml, './saml_assertion:AuthnStatement');
        if (empty($authnStatements)) {
            $this->authnInstant = null;

            return;
        } elseif (count($authnStatements) > 1) {
            throw new \Exception('More than one <saml:AuthnStatement> in <saml:Assertion> not supported.');
        }
        $authnStatement = $authnStatements[0];

        if (!$authnStatement->hasAttribute('AuthnInstant')) {
            throw new \Exception('Missing required AuthnInstant attribute on <saml:AuthnStatement>.');
        }
        $this->authnInstant = Utils::xsDateTimeToTimestamp($authnStatement->getAttribute('AuthnInstant'));

        if ($authnStatement->hasAttribute('SessionNotOnOrAfter')) {
            $this->sessionNotOnOrAfter = Utils::xsDateTimeToTimestamp($authnStatement->getAttribute('SessionNotOnOrAfter'));
        }

        if ($authnStatement->hasAttribute('SessionIndex')) {
            $this->sessionIndex = $authnStatement->getAttribute('SessionIndex');
        }

        $this->parseAuthnContext($authnStatement);
    }

parseConditions()

SAML2\Assertion::parseConditions ( \DOMElement  $xml )

private

Parse conditions in assertion.

Parameters

\DOMElement

$xml

The assertion XML element.

Exceptions

Definition at line 353 of file Assertion.php.

    {
        $conditions = Utils::xpQuery($xml, './saml_assertion:Conditions');
        if (empty($conditions)) {
            /* No <saml:Conditions> node. */

            return;
        } elseif (count($conditions) > 1) {
            throw new \Exception('More than one <saml:Conditions> in <saml:Assertion>.');
        }
        $conditions = $conditions[0];

        if ($conditions->hasAttribute('NotBefore')) {
            $notBefore = Utils::xsDateTimeToTimestamp($conditions->getAttribute('NotBefore'));
            if ($this->notBefore === null || $this->notBefore < $notBefore) {
                $this->notBefore = $notBefore;
            }
        }
        if ($conditions->hasAttribute('NotOnOrAfter')) {
            $notOnOrAfter = Utils::xsDateTimeToTimestamp($conditions->getAttribute('NotOnOrAfter'));
            if ($this->notOnOrAfter === null || $this->notOnOrAfter > $notOnOrAfter) {
                $this->notOnOrAfter = $notOnOrAfter;
            }
        }

        for ($node = $conditions->firstChild; $node !== null; $node = $node->nextSibling) {
            if ($node instanceof \DOMText) {
                continue;
            }
            if ($node->namespaceURI !== Constants::NS_SAML) {
                throw new \Exception('Unknown namespace of condition: ' . var_export($node->namespaceURI, true));
            }
            switch ($node->localName) {
                case 'AudienceRestriction':
                    $audiences = Utils::extractStrings($node, Constants::NS_SAML, 'Audience');
                    if ($this->validAudiences === null) {
                        /* The first (and probably last) AudienceRestriction element. */
                        $this->validAudiences = $audiences;
                    } else {
                        /*
                         * The set of AudienceRestriction are ANDed together, so we need
                         * the subset that are present in all of them.
                         */
                        $this->validAudiences = array_intersect($this->validAudiences, $audiences);
                    }
                    break;
                case 'OneTimeUse':
                    /* Currently ignored. */
                    break;
                case 'ProxyRestriction':
                    /* Currently ignored. */
                    break;
                default:
                    throw new \Exception('Unknown condition: ' . var_export($node->localName, true));
            }
        }
    }

parseEncryptedAttributes()

SAML2\Assertion::parseEncryptedAttributes ( \DOMElement  $xml )

private

Parse encrypted attribute statements in assertion.

Parameters

\DOMElement

$xml

The XML element with the assertion.

Definition at line 605 of file Assertion.php.

References $xml.

    {
        $this->encryptedAttributes = Utils::xpQuery(
            $xml,
            './saml_assertion:AttributeStatement/saml_assertion:EncryptedAttribute'
        );
    }

parseSubject()

SAML2\Assertion::parseSubject ( \DOMElement  $xml )

private

Parse subject in assertion.

Parameters

\DOMElement

$xml

The assertion XML element.

Exceptions

Definition at line 309 of file Assertion.php.

References $nameId, and $sc.

    {
        $subject = Utils::xpQuery($xml, './saml_assertion:Subject');
        if (empty($subject)) {
            /* No Subject node. */

            return;
        } elseif (count($subject) > 1) {
            throw new \Exception('More than one <saml:Subject> in <saml:Assertion>.');
        }
        $subject = $subject[0];

        $nameId = Utils::xpQuery(
            $subject,
            './saml_assertion:NameID | ./saml_assertion:EncryptedID/xenc:EncryptedData'
        );
        if (count($nameId) > 1) {
            throw new \Exception('More than one <saml:NameID> or <saml:EncryptedID> in <saml:Subject>.');
        } elseif (!empty($nameId)) {
            $nameId = $nameId[0];
            if ($nameId->localName === 'EncryptedData') {
                /* The NameID element is encrypted. */
                $this->encryptedNameId = $nameId;
            } else {
                $this->nameId = new XML\saml\NameID($nameId);
            }
        }

        $subjectConfirmation = Utils::xpQuery($subject, './saml_assertion:SubjectConfirmation');
        if (empty($subjectConfirmation) && empty($nameId)) {
            throw new \Exception('Missing <saml:SubjectConfirmation> in <saml:Subject>.');
        }

        foreach ($subjectConfirmation as $sc) {
            $this->SubjectConfirmation[] = new SubjectConfirmation($sc);
        }
    }

setAttributeNameFormat()

SAML2\Assertion::setAttributeNameFormat

(

$nameFormat

)

Set the NameFormat used on all attributes.

Parameters

string

$nameFormat

The NameFormat used on all attributes.

Definition at line 1248 of file Assertion.php.

    {
        assert(is_string($nameFormat));

        $this->nameFormat = $nameFormat;
    }

setAttributes()

SAML2\Assertion::setAttributes

(

array

$attributes

)

Replace all attributes.

Parameters

array

$attributes

All new attributes, as an associative array.

Definition at line 1205 of file Assertion.php.

References $attributes.

Referenced by SAML2\Assertion\Transformer\DecodeBase64Transformer\transform().

    {
        $this->attributes = $attributes;
    }

Here is the caller graph for this function:

setAttributesValueTypes()

SAML2\Assertion::setAttributesValueTypes

(

array

$attributesValueTypes

)

Replace all attributes value types.

Parameters

array

$attributesValueTypes

All new attribute value types, as an associative array.

Definition at line 1225 of file Assertion.php.

    {
        $this->attributesValueTypes = $attributesValueTypes;
    }

setAuthenticatingAuthority()

SAML2\Assertion::setAuthenticatingAuthority

(

$authenticatingAuthority

)

Set the AuthenticatingAuthority.

Parameters

array.

Definition at line 1185 of file Assertion.php.

References $authenticatingAuthority.

    {
        $this->AuthenticatingAuthority = $authenticatingAuthority;
    }

setAuthnContext()

SAML2\Assertion::setAuthnContext

(

$authnContext

)

Set the authentication method used to authenticate the user.

If this is set to null, no authentication statement will be included in the assertion. The default is null.

Deprecated:

use setAuthnContextClassRef

Parameters

string | null

$authnContext

The authentication method.

Definition at line 1075 of file Assertion.php.

    {
        $this->setAuthnContextClassRef($authnContext);
    }

setAuthnContextClassRef()

SAML2\Assertion::setAuthnContextClassRef

(

$authnContextClassRef

)

Set the authentication method used to authenticate the user.

If this is set to null, no authentication statement will be included in the assertion. The default is null.

Parameters

string | null

$authnContextClassRef

The authentication method.

Definition at line 1101 of file Assertion.php.

    {
        assert(is_string($authnContextClassRef) || is_null($authnContextClassRef));

        $this->authnContextClassRef = $authnContextClassRef;
    }

setAuthnContextDecl()

SAML2\Assertion::setAuthnContextDecl

(

Chunk

$authnContextDecl

)

Set the authentication context declaration.

Parameters

\SAML2\XML\Chunk

$authnContextDecl

Exceptions

Definition at line 1114 of file Assertion.php.

    {
        if (!empty($this->authnContextDeclRef)) {
            throw new \Exception(
                'AuthnContextDeclRef is already registered! May only have either a Decl or a DeclRef, not both!'
            );
        }

        $this->authnContextDecl = $authnContextDecl;
    }

setAuthnContextDeclRef()

SAML2\Assertion::setAuthnContextDeclRef

(

$authnContextDeclRef

)

Set the authentication context declaration reference.

Parameters

string

$authnContextDeclRef

Exceptions

Definition at line 1144 of file Assertion.php.

    {
        if (!empty($this->authnContextDecl)) {
            throw new \Exception(
                'AuthnContextDecl is already registered! May only have either a Decl or a DeclRef, not both!'
            );
        }

        $this->authnContextDeclRef = $authnContextDeclRef;
    }

setAuthnInstant()

SAML2\Assertion::setAuthnInstant

(

$authnInstant

)

Set the AuthnInstant of the assertion.

Parameters

int | null

$authnInstant

Timestamp the user was authenticated, or NULL if we don't want an AuthnStatement.

Definition at line 982 of file Assertion.php.

    {
        assert(is_int($authnInstant) || is_null($authnInstant));

        $this->authnInstant = $authnInstant;
    }

setCertificates()

SAML2\Assertion::setCertificates

(

array

$certificates

)

Set the certificates that should be included in the assertion.

The certificates should be strings with the PEM encoded data.

Parameters

array

$certificates

An array of certificates.

Implements SAML2\SignedElement.

Definition at line 1325 of file Assertion.php.

References $certificates.

    {
        $this->certificates = $certificates;
    }

setEncryptedAttributes()

SAML2\Assertion::setEncryptedAttributes

(

$ea

)

Set $EncryptedAttributes if attributes will send encrypted.

Parameters

boolean

$ea

true to encrypt attributes in the assertion.

Definition at line 937 of file Assertion.php.

    {
        $this->requiredEncAttributes = $ea;
    }

setEncryptionKey()

SAML2\Assertion::setEncryptionKey

(

XMLSecurityKey

$Key = null

)

Set the private key we should use to encrypt the attributes.

Parameters

XMLSecurityKey | null

$Key

Definition at line 1313 of file Assertion.php.

    {
        $this->encryptionKey = $Key;
    }

setId()

SAML2\Assertion::setId

(

$id

)

Set the identifier of this assertion.

Parameters

string

$id

The new identifier of this assertion.

Definition at line 671 of file Assertion.php.

References $id.

    {
        assert(is_string($id));

        $this->id = $id;
    }

setIssueInstant()

SAML2\Assertion::setIssueInstant

(

$issueInstant

)

Set the issue timestamp of this assertion.

Parameters

int

$issueInstant

The new issue timestamp of this assertion, as an UNIX timestamp.

Definition at line 693 of file Assertion.php.

    {
        assert(is_int($issueInstant));

        $this->issueInstant = $issueInstant;
    }

setIssuer()

SAML2\Assertion::setIssuer

(

$issuer

)

Set the issuer of this message.

Parameters

string | \SAML2\XML\saml\Issuer

$issuer

The new issuer of this assertion.

Definition at line 715 of file Assertion.php.

References $issuer.

    {
        assert(is_string($issuer) || $issuer instanceof XML\saml\Issuer);

        $this->issuer = $issuer;
    }

setNameId()

SAML2\Assertion::setNameId

(

$nameId

)

Set the NameId of the subject in the assertion.

The NameId must be a object or an array in the format accepted by ::addNameId() (an array, deprecated).

See also

::addNameId()

Parameters

\SAML2\XML\saml\NameID | array | null

$nameId

The name identifier of the assertion.

Definition at line 746 of file Assertion.php.

References $nameId.

    {
        assert(is_array($nameId) || is_null($nameId) || $nameId instanceof XML\saml\NameID);

        if (is_array($nameId)) {
            $nameId = XML\saml\NameID::fromArray($nameId);
        }
        $this->nameId = $nameId;
    }

setNotBefore()

SAML2\Assertion::setNotBefore

(

$notBefore

)

Set the earliest timestamp this assertion can be used.

Set this to null if no limit is required.

Parameters

int | null

$notBefore

The earliest timestamp this assertion is valid.

Definition at line 898 of file Assertion.php.

    {
        assert(is_int($notBefore) || is_null($notBefore));

        $this->notBefore = $notBefore;
    }

setNotOnOrAfter()

SAML2\Assertion::setNotOnOrAfter

(

$notOnOrAfter

)

Set the expiration timestamp of this assertion.

Set this to null if no limit is required.

Parameters

int | null

$notOnOrAfter

The latest timestamp this assertion is valid.

Definition at line 925 of file Assertion.php.

    {
        assert(is_int($notOnOrAfter) || is_null($notOnOrAfter));

        $this->notOnOrAfter = $notOnOrAfter;
    }

setSessionIndex()

SAML2\Assertion::setSessionIndex

(

$sessionIndex

)

Set the session index of the user at the IdP.

Note that the authentication context must be set before the session index can be inluded in the assertion.

Parameters

string | null

$sessionIndex

The session index of the user at the IdP.

Definition at line 1034 of file Assertion.php.

References $sessionIndex.

    {
        assert(is_string($sessionIndex) || is_null($sessionIndex));

        $this->sessionIndex = $sessionIndex;
    }

setSessionNotOnOrAfter()

SAML2\Assertion::setSessionNotOnOrAfter

(

$sessionNotOnOrAfter

)

Set the session expiration timestamp.

Set this to null if no limit is required.

Parameters

int | null

$sessionNotOnOrAfter

The latest timestamp this session is valid.

Definition at line 1009 of file Assertion.php.

    {
        assert(is_int($sessionNotOnOrAfter) || is_null($sessionNotOnOrAfter));

        $this->sessionNotOnOrAfter = $sessionNotOnOrAfter;
    }

setSignatureKey()

SAML2\Assertion::setSignatureKey

(

XMLSecurityKey

$signatureKey = null

)

Set the private key we should use to sign the assertion.

If the key is null, the assertion will be sent unsigned.

Parameters

XMLSecurityKey | null

$signatureKey

Implements SAML2\SignedElement.

Definition at line 1292 of file Assertion.php.

    {
        $this->signatureKey = $signatureKey;
    }

setSubjectConfirmation()

SAML2\Assertion::setSubjectConfirmation

(

array

$SubjectConfirmation

)

Set the SubjectConfirmation elements that should be included in the assertion.

Parameters

array

$SubjectConfirmation

Array of elements.

Definition at line 1270 of file Assertion.php.

    {
        $this->SubjectConfirmation = $SubjectConfirmation;
    }

setValidAudiences()

SAML2\Assertion::setValidAudiences

(

array

$validAudiences = null

)

Set the audiences that are allowed to receive this assertion.

This may be null, in which case all audiences are allowed.

Parameters

array | null

$validAudiences

The allowed audiences.

Definition at line 961 of file Assertion.php.

    {
        $this->validAudiences = $validAudiences;
    }

toXML()

SAML2\Assertion::toXML

(

\DOMNode

$parentElement = null

)

Convert this assertion to an XML element.

Parameters

\DOMNode | null

$parentElement

The DOM node the assertion should be created in.

Returns

This assertion.

Definition at line 1362 of file Assertion.php.

References $issuer, and $root.

Referenced by SAML2\EncryptedAssertion\setAssertion().

    {
        if ($parentElement === null) {
            $document = DOMDocumentFactory::create();
            $parentElement = $document;
        } else {
            $document = $parentElement->ownerDocument;
        }

        $root = $document->createElementNS(Constants::NS_SAML, 'saml:' . 'Assertion');
        $parentElement->appendChild($root);

        /* Ugly hack to add another namespace declaration to the root element. */
        $root->setAttributeNS(Constants::NS_SAMLP, 'samlp:tmp', 'tmp');
        $root->removeAttributeNS(Constants::NS_SAMLP, 'tmp');
        $root->setAttributeNS(Constants::NS_XSI, 'xsi:tmp', 'tmp');
        $root->removeAttributeNS(Constants::NS_XSI, 'tmp');
        $root->setAttributeNS(Constants::NS_XS, 'xs:tmp', 'tmp');
        $root->removeAttributeNS(Constants::NS_XS, 'tmp');

        $root->setAttribute('ID', $this->id);
        $root->setAttribute('Version', '2.0');
        $root->setAttribute('IssueInstant', gmdate('Y-m-d\TH:i:s\Z', $this->issueInstant));

        if (is_string($this->issuer)) {
            $issuer = Utils::addString($root, Constants::NS_SAML, 'saml:Issuer', $this->issuer);
        } elseif ($this->issuer instanceof XML\saml\Issuer) {
            $issuer = $this->issuer->toXML($root);
        }

        $this->addSubject($root);
        $this->addConditions($root);
        $this->addAuthnStatement($root);
        if ($this->requiredEncAttributes === false) {
            $this->addAttributeStatement($root);
        } else {
            $this->addEncryptedAttributeStatement($root);
        }

        if ($this->signatureKey !== null) {
            Utils::insertSignature($this->signatureKey, $this->certificates, $root, $issuer->nextSibling);
        }

        return $root;
    }

Here is the caller graph for this function:

validate()

SAML2\Assertion::validate

(

XMLSecurityKey

$key

)

Validate this assertion against a public key.

If no signature was present on the assertion, we will return false. Otherwise, true will be returned. An exception is thrown if the signature validation fails.

Parameters

XMLSecurityKey

$key

The key we should check against.

Returns

boolean true if successful, false if it is unsigned.

Implements SAML2\SignedElement.

Definition at line 643 of file Assertion.php.

    {
        assert($key->type === \RobRichards\XMLSecLibs\XMLSecurityKey::RSA_SHA256);

        if ($this->signatureData === null) {
            return false;
        }

        Utils::validateSignature($this->signatureData, $key);

        return true;
    }

Field Documentation

$attributes

SAML2\Assertion::$attributes

private

Definition at line 174 of file Assertion.php.

Referenced by SAML2\Assertion\Transformer\DecodeBase64Transformer\transform().

$attributesValueTypes

SAML2\Assertion::$attributesValueTypes

private

Definition at line 191 of file Assertion.php.

$AuthenticatingAuthority

SAML2\Assertion::$AuthenticatingAuthority

private

Definition at line 156 of file Assertion.php.

$authnContextClassRef

SAML2\Assertion::$authnContextClassRef

private

Definition at line 130 of file Assertion.php.

$authnContextDecl

SAML2\Assertion::$authnContextDecl

private

Definition at line 140 of file Assertion.php.

$authnContextDeclRef

SAML2\Assertion::$authnContextDeclRef

private

Definition at line 149 of file Assertion.php.

$authnInstant

SAML2\Assertion::$authnInstant

private

Definition at line 123 of file Assertion.php.

$certificates

SAML2\Assertion::$certificates

private

Definition at line 217 of file Assertion.php.

$encryptedAttributes

SAML2\Assertion::$encryptedAttributes

private

Definition at line 68 of file Assertion.php.

$encryptedNameId

SAML2\Assertion::$encryptedNameId

private

Definition at line 59 of file Assertion.php.

$encryptionKey

SAML2\Assertion::$encryptionKey

private

Definition at line 75 of file Assertion.php.

$id

SAML2\Assertion::$id

private

Definition at line 24 of file Assertion.php.

$issueInstant

SAML2\Assertion::$issueInstant

private

Definition at line 31 of file Assertion.php.

$issuer

SAML2\Assertion::$issuer

private

Definition at line 41 of file Assertion.php.

$nameFormat

SAML2\Assertion::$nameFormat

private

Definition at line 201 of file Assertion.php.

$nameId

SAML2\Assertion::$nameId

private

Definition at line 50 of file Assertion.php.

$notBefore

SAML2\Assertion::$notBefore

private

Definition at line 82 of file Assertion.php.

Referenced by SAML2\Assertion\Validation\ConstraintValidator\SubjectConfirmationNotBefore\validate().

$notOnOrAfter

SAML2\Assertion::$notOnOrAfter

private

Definition at line 89 of file Assertion.php.

Referenced by SAML2\Assertion\Validation\ConstraintValidator\SubjectConfirmationNotOnOrAfter\validate().

$requiredEncAttributes

SAML2\Assertion::$requiredEncAttributes

private

Definition at line 232 of file Assertion.php.

$sessionIndex

SAML2\Assertion::$sessionIndex

private

Definition at line 116 of file Assertion.php.

$sessionNotOnOrAfter

SAML2\Assertion::$sessionNotOnOrAfter

private

Definition at line 107 of file Assertion.php.

$signatureData

SAML2\Assertion::$signatureData

private

Definition at line 224 of file Assertion.php.

$signatureKey

SAML2\Assertion::$signatureKey

private

Definition at line 210 of file Assertion.php.

$signatureMethod

SAML2\Assertion::$signatureMethod

private

Definition at line 249 of file Assertion.php.

$SubjectConfirmation

SAML2\Assertion::$SubjectConfirmation

private

Definition at line 239 of file Assertion.php.

$validAudiences

SAML2\Assertion::$validAudiences

private

Definition at line 100 of file Assertion.php.

$wasSignedAtConstruction

SAML2\Assertion::$wasSignedAtConstruction = false

protected

Definition at line 244 of file Assertion.php.

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/saml2/src/SAML2/Assertion.php