SAMLParser.php

Go to the documentation of this file.

<?php
 
class SimpleSAML_Metadata_SAMLParser
{
    private static $SAML1xProtocols = array(
        'urn:oasis:names:tc:SAML:1.0:protocol',
        'urn:oasis:names:tc:SAML:1.1:protocol',
    );
 
    private static $SAML20Protocols = array(
        'urn:oasis:names:tc:SAML:2.0:protocol',
    );
 
    private $entityId;
 
    private $spDescriptors;
 
    private $idpDescriptors;
 
    private $attributeAuthorityDescriptors = array();
 
    private $organizationName = array();
 
    private $organizationDisplayName = array();
 
    private $organizationURL = array();
 
    private $contacts = array();
 
    private $scopes;
 
    private $entityAttributes;
 
    private $registrationInfo;
 
    private $tags;
 
    private $validators = array();
 
    private $entityDescriptor;
 
    private function __construct(
        \SAML2\XML\md\EntityDescriptor $entityElement,
        $maxExpireTime,
        array $validators = array(),
        array $parentExtensions = array()
    ) {
        assert($maxExpireTime === null || is_int($maxExpireTime));
 
        $this->spDescriptors = array();
        $this->idpDescriptors = array();
 
        $e = $entityElement->toXML();
        $e = $e->ownerDocument->saveXML($e);
        $this->entityDescriptor = base64_encode($e);
        $this->entityId = $entityElement->entityID;
 
        $expireTime = self::getExpireTime($entityElement, $maxExpireTime);
 
        $this->validators = $validators;
        $this->validators[] = $entityElement;
 
        // process Extensions element, if it exists
        $ext = self::processExtensions($entityElement, $parentExtensions);
        $this->scopes = $ext['scope'];
        $this->tags = $ext['tags'];
        $this->entityAttributes = $ext['EntityAttributes'];
        $this->registrationInfo = $ext['RegistrationInfo'];
 
        // look over the RoleDescriptors
        foreach ($entityElement->RoleDescriptor as $child) {
            if ($child instanceof \SAML2\XML\md\SPSSODescriptor) {
                $this->processSPSSODescriptor($child, $expireTime);
            } elseif ($child instanceof \SAML2\XML\md\IDPSSODescriptor) {
                $this->processIDPSSODescriptor($child, $expireTime);
            } elseif ($child instanceof \SAML2\XML\md\AttributeAuthorityDescriptor) {
                $this->processAttributeAuthorityDescriptor($child, $expireTime);
            }
        }
 
        if ($entityElement->Organization) {
            $this->processOrganization($entityElement->Organization);
        }
 
        if (!empty($entityElement->ContactPerson)) {
            foreach ($entityElement->ContactPerson as $contact) {
                $this->processContactPerson($contact);
            }
        }
    }
 
 
    public static function parseFile($file)
    {
        $data = \SimpleSAML\Utils\HTTP::fetch($file);
 
        try {
            $doc = \SAML2\DOMDocumentFactory::fromString($data);
        } catch (\Exception $e) {
            throw new Exception('Failed to read XML from file: '.$file);
        }
 
        return self::parseDocument($doc);
    }
 
 
    public static function parseString($metadata)
    {
        try {
            $doc = \SAML2\DOMDocumentFactory::fromString($metadata);
        } catch (\Exception $e) {
            throw new Exception('Failed to parse XML string.');
        }
 
        return self::parseDocument($doc);
    }
 
 
    public static function parseDocument($document)
    {
        assert($document instanceof DOMDocument);
 
        $entityElement = self::findEntityDescriptor($document);
 
        return self::parseElement($entityElement);
    }
 
 
    public static function parseElement($entityElement)
    {
        assert($entityElement instanceof \SAML2\XML\md\EntityDescriptor);
        return new SimpleSAML_Metadata_SAMLParser($entityElement, null, array());
    }
 
 
    public static function parseDescriptorsFile($file)
    {
        if ($file === null) {
            throw new Exception('Cannot open file NULL. File name not specified.');
        }
 
        $data = \SimpleSAML\Utils\HTTP::fetch($file);
 
        try {
            $doc = \SAML2\DOMDocumentFactory::fromString($data);
        } catch (\Exception $e) {
            throw new Exception('Failed to read XML from file: '.$file);
        }
 
        if ($doc->documentElement === null) {
            throw new Exception('Opened file is not an XML document: '.$file);
        }
 
        return self::parseDescriptorsElement($doc->documentElement);
    }
 
 
    public static function parseDescriptorsString($string)
    {
        try {
            $doc = \SAML2\DOMDocumentFactory::fromString($string);
        } catch (\Exception $e) {
            throw new Exception('Failed to parse XML string.');
        }
 
        return self::parseDescriptorsElement($doc->documentElement);
    }
 
 
    public static function parseDescriptorsElement(DOMElement $element = null)
    {
        if ($element === null) {
            throw new Exception('Document was empty.');
        }
 
        if (SimpleSAML\Utils\XML::isDOMNodeOfType($element, 'EntityDescriptor', '@md') === true) {
            return self::processDescriptorsElement(new \SAML2\XML\md\EntityDescriptor($element));
        } elseif (SimpleSAML\Utils\XML::isDOMNodeOfType($element, 'EntitiesDescriptor', '@md') === true) {
            return self::processDescriptorsElement(new \SAML2\XML\md\EntitiesDescriptor($element));
        } else {
            throw new Exception('Unexpected root node: ['.$element->namespaceURI.']:'.$element->localName);
        }
    }
 
 
    private static function processDescriptorsElement(
        $element,
        $maxExpireTime = null,
        array $validators = array(),
        array $parentExtensions = array()
    ) {
        assert($maxExpireTime === null || is_int($maxExpireTime));
 
        if ($element instanceof \SAML2\XML\md\EntityDescriptor) {
            $ret = new SimpleSAML_Metadata_SAMLParser($element, $maxExpireTime, $validators, $parentExtensions);
            $ret = array($ret->getEntityId() => $ret);
            return $ret;
        }
 
        assert($element instanceof \SAML2\XML\md\EntitiesDescriptor);
 
        $extensions = self::processExtensions($element, $parentExtensions);
        $expTime = self::getExpireTime($element, $maxExpireTime);
 
        $validators[] = $element;
 
        $ret = array();
        foreach ($element->children as $child) {
            $ret += self::processDescriptorsElement($child, $expTime, $validators, $extensions);
        }
 
        return $ret;
    }
 
 
    private static function getExpireTime($element, $maxExpireTime)
    {
        // validUntil may be null
        $expire = $element->validUntil;
 
        if ($maxExpireTime !== null && ($expire === null || $maxExpireTime < $expire)) {
            $expire = $maxExpireTime;
        }
 
        return $expire;
    }
 
 
    public function getEntityId()
    {
        return $this->entityId;
    }
 
 
    private function getMetadataCommon()
    {
        $ret = array();
        $ret['entityid'] = $this->entityId;
        $ret['entityDescriptor'] = $this->entityDescriptor;
 
        // add organizational metadata
        if (!empty($this->organizationName)) {
            $ret['description'] = $this->organizationName;
            $ret['OrganizationName'] = $this->organizationName;
        }
        if (!empty($this->organizationDisplayName)) {
            $ret['name'] = $this->organizationDisplayName;
            $ret['OrganizationDisplayName'] = $this->organizationDisplayName;
        }
        if (!empty($this->organizationURL)) {
            $ret['url'] = $this->organizationURL;
            $ret['OrganizationURL'] = $this->organizationURL;
        }
 
        //add contact metadata
        $ret['contacts'] = $this->contacts;
 
        return $ret;
    }
 
 
    private function addExtensions(array &$metadata, array $roleDescriptor)
    {
        assert(array_key_exists('scope', $roleDescriptor));
        assert(array_key_exists('tags', $roleDescriptor));
 
        $scopes = array_merge($this->scopes, array_diff($roleDescriptor['scope'], $this->scopes));
        if (!empty($scopes)) {
            $metadata['scope'] = $scopes;
        }
 
        $tags = array_merge($this->tags, array_diff($roleDescriptor['tags'], $this->tags));
        if (!empty($tags)) {
            $metadata['tags'] = $tags;
        }
 
 
        if (!empty($this->registrationInfo)) {
            $metadata['RegistrationInfo'] = $this->registrationInfo;
        }
 
        if (!empty($this->entityAttributes)) {
            $metadata['EntityAttributes'] = $this->entityAttributes;
 
            // check for entity categories
            if (SimpleSAML\Utils\Config\Metadata::isHiddenFromDiscovery($metadata)) {
                $metadata['hide.from.discovery'] = true;
            }
        }
 
        if (!empty($roleDescriptor['UIInfo'])) {
            $metadata['UIInfo'] = $roleDescriptor['UIInfo'];
        }
 
        if (!empty($roleDescriptor['DiscoHints'])) {
            $metadata['DiscoHints'] = $roleDescriptor['DiscoHints'];
        }
    }
 
 
    public function getMetadata1xSP()
    {
        $ret = $this->getMetadataCommon();
        $ret['metadata-set'] = 'shib13-sp-remote';
 
 
        // find SP information which supports one of the SAML 1.x protocols
        $spd = $this->getSPDescriptors(self::$SAML1xProtocols);
        if (count($spd) === 0) {
            return null;
        }
 
        // we currently only look at the first SPDescriptor which supports SAML 1.x
        $spd = $spd[0];
 
        // add expire time to metadata
        if (array_key_exists('expire', $spd)) {
            $ret['expire'] = $spd['expire'];
        }
 
        // find the assertion consumer service endpoints
        $ret['AssertionConsumerService'] = $spd['AssertionConsumerService'];
 
        // add the list of attributes the SP should receive
        if (array_key_exists('attributes', $spd)) {
            $ret['attributes'] = $spd['attributes'];
        }
        if (array_key_exists('attributes.required', $spd)) {
            $ret['attributes.required'] = $spd['attributes.required'];
        }
        if (array_key_exists('attributes.NameFormat', $spd)) {
            $ret['attributes.NameFormat'] = $spd['attributes.NameFormat'];
        }
 
        // add name & description
        if (array_key_exists('name', $spd)) {
            $ret['name'] = $spd['name'];
        }
        if (array_key_exists('description', $spd)) {
            $ret['description'] = $spd['description'];
        }
 
        // add public keys
        if (!empty($spd['keys'])) {
            $ret['keys'] = $spd['keys'];
        }
 
        // add extensions
        $this->addExtensions($ret, $spd);
 
        // prioritize mdui:DisplayName as the name if available
        if (!empty($ret['UIInfo']['DisplayName'])) {
            $ret['name'] = $ret['UIInfo']['DisplayName'];
        }
 
        return $ret;
    }
 
 
    public function getMetadata1xIdP()
    {
        $ret = $this->getMetadataCommon();
        $ret['metadata-set'] = 'shib13-idp-remote';
 
        // find IdP information which supports the SAML 1.x protocol
        $idp = $this->getIdPDescriptors(self::$SAML1xProtocols);
        if (count($idp) === 0) {
            return null;
        }
 
        // we currently only look at the first IDP descriptor which supports SAML 1.x
        $idp = $idp[0];
 
        // fdd expire time to metadata
        if (array_key_exists('expire', $idp)) {
            $ret['expire'] = $idp['expire'];
        }
 
        // find the SSO service endpoints
        $ret['SingleSignOnService'] = $idp['SingleSignOnService'];
 
        // find the ArtifactResolutionService endpoint
        $ret['ArtifactResolutionService'] = $idp['ArtifactResolutionService'];
 
        // add public keys
        if (!empty($idp['keys'])) {
            $ret['keys'] = $idp['keys'];
        }
 
        // add extensions
        $this->addExtensions($ret, $idp);
 
        // prioritize mdui:DisplayName as the name if available
        if (!empty($ret['UIInfo']['DisplayName'])) {
            $ret['name'] = $ret['UIInfo']['DisplayName'];
        }
 
        return $ret;
    }
 
 
    public function getMetadata20SP()
    {
        $ret = $this->getMetadataCommon();
        $ret['metadata-set'] = 'saml20-sp-remote';
 
        // find SP information which supports the SAML 2.0 protocol
        $spd = $this->getSPDescriptors(self::$SAML20Protocols);
        if (count($spd) === 0) {
            return null;
        }
 
        // we currently only look at the first SPDescriptor which supports SAML 2.0
        $spd = $spd[0];
 
        // add expire time to metadata
        if (array_key_exists('expire', $spd)) {
            $ret['expire'] = $spd['expire'];
        }
 
        // find the assertion consumer service endpoints
        $ret['AssertionConsumerService'] = $spd['AssertionConsumerService'];
 
 
        // find the single logout service endpoint
        $ret['SingleLogoutService'] = $spd['SingleLogoutService'];
 
 
        // find the NameIDFormat. This may not exist
        if (count($spd['nameIDFormats']) > 0) {
            // SimpleSAMLphp currently only supports a single NameIDFormat pr. SP. We use the first one
            $ret['NameIDFormat'] = $spd['nameIDFormats'][0];
        }
 
        // add the list of attributes the SP should receive
        if (array_key_exists('attributes', $spd)) {
            $ret['attributes'] = $spd['attributes'];
        }
        if (array_key_exists('attributes.required', $spd)) {
            $ret['attributes.required'] = $spd['attributes.required'];
        }
        if (array_key_exists('attributes.NameFormat', $spd)) {
            $ret['attributes.NameFormat'] = $spd['attributes.NameFormat'];
        }
        if (array_key_exists('attributes.index', $spd)) {
            $ret['attributes.index'] = $spd['attributes.index'];
        }
        if (array_key_exists('attributes.isDefault', $spd)) {
            $ret['attributes.isDefault'] = $spd['attributes.isDefault'];
        }
 
        // add name & description
        if (array_key_exists('name', $spd)) {
            $ret['name'] = $spd['name'];
        }
        if (array_key_exists('description', $spd)) {
            $ret['description'] = $spd['description'];
        }
 
        // add public keys
        if (!empty($spd['keys'])) {
            $ret['keys'] = $spd['keys'];
        }
 
        // add validate.authnrequest
        if (array_key_exists('AuthnRequestsSigned', $spd)) {
            $ret['validate.authnrequest'] = $spd['AuthnRequestsSigned'];
        }
 
        // add saml20.sign.assertion
        if (array_key_exists('WantAssertionsSigned', $spd)) {
            $ret['saml20.sign.assertion'] = $spd['WantAssertionsSigned'];
        }
 
        // add extensions
        $this->addExtensions($ret, $spd);
 
        // prioritize mdui:DisplayName as the name if available
        if (!empty($ret['UIInfo']['DisplayName'])) {
            $ret['name'] = $ret['UIInfo']['DisplayName'];
        }
 
        return $ret;
    }
 
 
    public function getMetadata20IdP()
    {
        $ret = $this->getMetadataCommon();
        $ret['metadata-set'] = 'saml20-idp-remote';
 
        // find IdP information which supports the SAML 2.0 protocol
        $idp = $this->getIdPDescriptors(self::$SAML20Protocols);
        if (count($idp) === 0) {
            return null;
        }
 
        // we currently only look at the first IDP descriptor which supports SAML 2.0
        $idp = $idp[0];
 
        // add expire time to metadata
        if (array_key_exists('expire', $idp)) {
            $ret['expire'] = $idp['expire'];
        }
 
        // enable redirect.sign if WantAuthnRequestsSigned is enabled
        if ($idp['WantAuthnRequestsSigned']) {
            $ret['sign.authnrequest'] = true;
        }
 
        // find the SSO service endpoint
        $ret['SingleSignOnService'] = $idp['SingleSignOnService'];
 
        // find the single logout service endpoint
        $ret['SingleLogoutService'] = $idp['SingleLogoutService'];
 
        // find the ArtifactResolutionService endpoint
        $ret['ArtifactResolutionService'] = $idp['ArtifactResolutionService'];
 
        // add supported nameIDFormats
        $ret['NameIDFormats'] = $idp['nameIDFormats'];
 
        // add public keys
        if (!empty($idp['keys'])) {
            $ret['keys'] = $idp['keys'];
        }
 
        // add extensions
        $this->addExtensions($ret, $idp);
 
        // prioritize mdui:DisplayName as the name if available
        if (!empty($ret['UIInfo']['DisplayName'])) {
            $ret['name'] = $ret['UIInfo']['DisplayName'];
        }
 
        return $ret;
    }
 
 
    public function getAttributeAuthorities()
    {
        return $this->attributeAuthorityDescriptors;
    }
 
 
    private static function parseRoleDescriptorType(\SAML2\XML\md\RoleDescriptor $element, $expireTime)
    {
        assert($expireTime === null || is_int($expireTime));
 
        $ret = array();
 
        $expireTime = self::getExpireTime($element, $expireTime);
 
        if ($expireTime !== null) {
            // we got an expired timestamp, either from this element or one of the parent elements
            $ret['expire'] = $expireTime;
        }
 
        $ret['protocols'] = $element->protocolSupportEnumeration;
 
        // process KeyDescriptor elements
        $ret['keys'] = array();
        foreach ($element->KeyDescriptor as $kd) {
            $key = self::parseKeyDescriptor($kd);
            if ($key !== null) {
                $ret['keys'][] = $key;
            }
        }
 
        $ext = self::processExtensions($element);
        $ret['scope'] = $ext['scope'];
        $ret['tags'] = $ext['tags'];
        $ret['EntityAttributes'] = $ext['EntityAttributes'];
        $ret['UIInfo'] = $ext['UIInfo'];
        $ret['DiscoHints'] = $ext['DiscoHints'];
 
        return $ret;
    }
 
 
    private static function parseSSODescriptor(\SAML2\XML\md\SSODescriptorType $element, $expireTime)
    {
        assert($expireTime === null || is_int($expireTime));
 
        $sd = self::parseRoleDescriptorType($element, $expireTime);
 
        // find all SingleLogoutService elements
        $sd['SingleLogoutService'] = self::extractEndpoints($element->SingleLogoutService);
 
        // find all ArtifactResolutionService elements
        $sd['ArtifactResolutionService'] = self::extractEndpoints($element->ArtifactResolutionService);
 
 
        // process NameIDFormat elements
        $sd['nameIDFormats'] = $element->NameIDFormat;
 
        return $sd;
    }
 
 
    private function processSPSSODescriptor(\SAML2\XML\md\SPSSODescriptor $element, $expireTime)
    {
        assert($expireTime === null || is_int($expireTime));
 
        $sp = self::parseSSODescriptor($element, $expireTime);
 
        // find all AssertionConsumerService elements
        $sp['AssertionConsumerService'] = self::extractEndpoints($element->AssertionConsumerService);
 
        // find all the attributes and SP name...
        $attcs = $element->AttributeConsumingService;
        if (count($attcs) > 0) {
            self::parseAttributeConsumerService($attcs[0], $sp);
        }
 
        // check AuthnRequestsSigned
        if ($element->AuthnRequestsSigned !== null) {
            $sp['AuthnRequestsSigned'] = $element->AuthnRequestsSigned;
        }
 
        // check WantAssertionsSigned
        if ($element->WantAssertionsSigned !== null) {
            $sp['WantAssertionsSigned'] = $element->WantAssertionsSigned;
        }
 
        $this->spDescriptors[] = $sp;
    }
 
 
    private function processIDPSSODescriptor(\SAML2\XML\md\IDPSSODescriptor $element, $expireTime)
    {
        assert($expireTime === null || is_int($expireTime));
 
        $idp = self::parseSSODescriptor($element, $expireTime);
 
        // find all SingleSignOnService elements
        $idp['SingleSignOnService'] = self::extractEndpoints($element->SingleSignOnService);
 
        if ($element->WantAuthnRequestsSigned) {
            $idp['WantAuthnRequestsSigned'] = true;
        } else {
            $idp['WantAuthnRequestsSigned'] = false;
        }
 
        $this->idpDescriptors[] = $idp;
    }
 
 
    private function processAttributeAuthorityDescriptor(
        \SAML2\XML\md\AttributeAuthorityDescriptor $element,
        $expireTime
    ) {
        assert($expireTime === null || is_int($expireTime));
 
        $aad = self::parseRoleDescriptorType($element, $expireTime);
        $aad['entityid'] = $this->entityId;
        $aad['metadata-set'] = 'attributeauthority-remote';
 
        $aad['AttributeService'] = self::extractEndpoints($element->AttributeService);
        $aad['AssertionIDRequestService'] = self::extractEndpoints($element->AssertionIDRequestService);
        $aad['NameIDFormat'] = $element->NameIDFormat;
 
        $this->attributeAuthorityDescriptors[] = $aad;
    }
 
 
    private static function processExtensions($element, $parentExtensions = array())
    {
        $ret = array(
            'scope'            => array(),
            'tags'             => array(),
            'EntityAttributes' => array(),
            'RegistrationInfo' => array(),
            'UIInfo'           => array(),
            'DiscoHints'       => array(),
        );
 
        // Some extensions may get inherited from a parent element
        if (($element instanceof \SAML2\XML\md\EntityDescriptor || $element instanceof \SAML2\XML\md\EntitiesDescriptor)
                && !empty($parentExtensions['RegistrationInfo'])) {
            $ret['RegistrationInfo'] = $parentExtensions['RegistrationInfo'];
        }
 
        foreach ($element->Extensions as $e) {
            if ($e instanceof \SAML2\XML\shibmd\Scope) {
                $ret['scope'][] = $e->scope;
                continue;
            }
 
            // Entity Attributes are only allowed at entity level extensions and not at RoleDescriptor level
            if ($element instanceof \SAML2\XML\md\EntityDescriptor ||
                $element instanceof \SAML2\XML\md\EntitiesDescriptor) {
                if ($e instanceof \SAML2\XML\mdrpi\RegistrationInfo) {
                    // Registration Authority cannot be overridden (warn only if override attempts to change the value)
                    if (isset($ret['RegistrationInfo']['registrationAuthority'])
                        && $ret['RegistrationInfo']['registrationAuthority'] !== $e->registrationAuthority) {
                        SimpleSAML\Logger::warning('Invalid attempt to override registrationAuthority \''
                          . $ret['RegistrationInfo']['registrationAuthority'] . "' with '{$e->registrationAuthority}'");
                    } else {
                        $ret['RegistrationInfo']['registrationAuthority'] = $e->registrationAuthority;
                    }
                }
                if ($e instanceof \SAML2\XML\mdattr\EntityAttributes && !empty($e->children)) {
                    foreach ($e->children as $attr) {
                        // only saml:Attribute are currently supported here. The specifications also allows
                        // saml:Assertions, which more complex processing
                        if ($attr instanceof \SAML2\XML\saml\Attribute) {
                            if (empty($attr->Name) || empty($attr->AttributeValue)) {
                                continue;
                            }
 
                            // attribute names that is not URI is prefixed as this: '{nameformat}name'
                            $name = $attr->Name;
                            if (empty($attr->NameFormat)) {
                                $name = '{'.\SAML2\Constants::NAMEFORMAT_UNSPECIFIED.'}'.$attr->Name;
                            } elseif ($attr->NameFormat !== 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri') {
                                $name = '{'.$attr->NameFormat.'}'.$attr->Name;
                            }
 
                            $values = array();
                            foreach ($attr->AttributeValue as $attrvalue) {
                                $values[] = $attrvalue->getString();
                            }
 
                            $ret['EntityAttributes'][$name] = $values;
                        }
                    }
                }
            }
 
            // UIInfo elements are only allowed at RoleDescriptor level extensions
            if ($element instanceof \SAML2\XML\md\RoleDescriptor) {
                if ($e instanceof \SAML2\XML\mdui\UIInfo) {
                    $ret['UIInfo']['DisplayName'] = $e->DisplayName;
                    $ret['UIInfo']['Description'] = $e->Description;
                    $ret['UIInfo']['InformationURL'] = $e->InformationURL;
                    $ret['UIInfo']['PrivacyStatementURL'] = $e->PrivacyStatementURL;
 
                    foreach ($e->Keywords as $uiItem) {
                        if (!($uiItem instanceof \SAML2\XML\mdui\Keywords)
                            || empty($uiItem->Keywords)
                            || empty($uiItem->lang)
                        ) {
                            continue;
                        }
                        $ret['UIInfo']['Keywords'][$uiItem->lang] = $uiItem->Keywords;
                    }
                    foreach ($e->Logo as $uiItem) {
                        if (!($uiItem instanceof \SAML2\XML\mdui\Logo)
                            || empty($uiItem->url)
                            || empty($uiItem->height)
                            || empty($uiItem->width)
                        ) {
                            continue;
                        }
                        $logo = array(
                            'url'    => $uiItem->url,
                            'height' => $uiItem->height,
                            'width'  => $uiItem->width,
                        );
                        if (!empty($uiItem->lang)) {
                            $logo['lang'] = $uiItem->lang;
                        }
                        $ret['UIInfo']['Logo'][] = $logo;
                    }
                }
            }
 
            // DiscoHints elements are only allowed at IDPSSODescriptor level extensions
            if ($element instanceof \SAML2\XML\md\IDPSSODescriptor) {
                if ($e instanceof \SAML2\XML\mdui\DiscoHints) {
                    $ret['DiscoHints']['IPHint'] = $e->IPHint;
                    $ret['DiscoHints']['DomainHint'] = $e->DomainHint;
                    $ret['DiscoHints']['GeolocationHint'] = $e->GeolocationHint;
                }
            }
 
            if (!($e instanceof \SAML2\XML\Chunk)) {
                continue;
            }
 
            if ($e->localName === 'Attribute' && $e->namespaceURI === \SAML2\Constants::NS_SAML) {
                $attribute = $e->xml;
 
                $name = $attribute->getAttribute('Name');
                $values = array_map(
                    array('SimpleSAML\Utils\XML', 'getDOMText'),
                    SimpleSAML\Utils\XML::getDOMChildren($attribute, 'AttributeValue', '@saml2')
                );
 
                if ($name === 'tags') {
                    foreach ($values as $tagname) {
                        if (!empty($tagname)) {
                            $ret['tags'][] = $tagname;
                        }
                    }
                }
            }
        }
        return $ret;
    }
 
 
    private function processOrganization(\SAML2\XML\md\Organization $element)
    {
        $this->organizationName = $element->OrganizationName;
        $this->organizationDisplayName = $element->OrganizationDisplayName;
        $this->organizationURL = $element->OrganizationURL;
    }
 
 
    private function processContactPerson(\SAML2\XML\md\ContactPerson $element)
    {
        $contactPerson = array();
        if (!empty($element->contactType)) {
            $contactPerson['contactType'] = $element->contactType;
        }
        if (!empty($element->Company)) {
            $contactPerson['company'] = $element->Company;
        }
        if (!empty($element->GivenName)) {
            $contactPerson['givenName'] = $element->GivenName;
        }
        if (!empty($element->SurName)) {
            $contactPerson['surName'] = $element->SurName;
        }
        if (!empty($element->EmailAddress)) {
            $contactPerson['emailAddress'] = $element->EmailAddress;
        }
        if (!empty($element->TelephoneNumber)) {
            $contactPerson['telephoneNumber'] = $element->TelephoneNumber;
        }
        if (!empty($contactPerson)) {
            $this->contacts[] = $contactPerson;
        }
    }
 
 
    private static function parseAttributeConsumerService(\SAML2\XML\md\AttributeConsumingService $element, &$sp)
    {
        assert(is_array($sp));
 
        $sp['name'] = $element->ServiceName;
        $sp['description'] = $element->ServiceDescription;
 
        $format = null;
        $sp['attributes'] = array();
        $sp['attributes.required'] = array();
        foreach ($element->RequestedAttribute as $child) {
            $attrname = $child->Name;
            $sp['attributes'][] = $attrname;
 
            if ($child->isRequired !== null && $child->isRequired === true) {
                $sp['attributes.required'][] = $attrname;
            }
 
            if ($child->NameFormat !== null) {
                $attrformat = $child->NameFormat;
            } else {
                $attrformat = \SAML2\Constants::NAMEFORMAT_UNSPECIFIED;
            }
 
            if ($format === null) {
                $format = $attrformat;
            } elseif ($format !== $attrformat) {
                $format = \SAML2\Constants::NAMEFORMAT_UNSPECIFIED;
            }
        }
 
        if (empty($sp['attributes'])) {
            // a really invalid configuration: all AttributeConsumingServices should have one or more attributes
            unset($sp['attributes']);
        }
        if (empty($sp['attributes.required'])) {
            unset($sp['attributes.required']);
        }
 
        if ($format !== \SAML2\Constants::NAMEFORMAT_UNSPECIFIED && $format !== null) {
            $sp['attributes.NameFormat'] = $format;
        }
    }
 
 
    private static function parseGenericEndpoint(\SAML2\XML\md\EndpointType $element)
    {
        $ep = array();
 
        $ep['Binding'] = $element->Binding;
        $ep['Location'] = $element->Location;
 
        if ($element->ResponseLocation !== null) {
            $ep['ResponseLocation'] = $element->ResponseLocation;
        }
 
        if ($element instanceof \SAML2\XML\md\IndexedEndpointType) {
            $ep['index'] = $element->index;
 
            if ($element->isDefault !== null) {
                $ep['isDefault'] = $element->isDefault;
            }
        }
 
        return $ep;
    }
 
 
    private static function extractEndpoints(array $endpoints)
    {
        $ret = array();
        foreach ($endpoints as $ep) {
            $ret[] = self::parseGenericEndpoint($ep);
        }
 
        return $ret;
    }
 
 
    private static function parseKeyDescriptor(\SAML2\XML\md\KeyDescriptor $kd)
    {
        $r = array();
 
        if ($kd->use === 'encryption') {
            $r['encryption'] = true;
            $r['signing'] = false;
        } elseif ($kd->use === 'signing') {
            $r['encryption'] = false;
            $r['signing'] = true;
        } else {
            $r['encryption'] = true;
            $r['signing'] = true;
        }
 
        $keyInfo = $kd->KeyInfo;
 
        foreach ($keyInfo->info as $i) {
            if ($i instanceof \SAML2\XML\ds\X509Data) {
                foreach ($i->data as $d) {
                    if ($d instanceof \SAML2\XML\ds\X509Certificate) {
                        $r['type'] = 'X509Certificate';
                        $r['X509Certificate'] = $d->certificate;
                        return $r;
                    }
                }
            }
        }
 
        return null;
    }
 
 
    private function getSPDescriptors($protocols)
    {
        assert(is_array($protocols));
 
        $ret = array();
 
        foreach ($this->spDescriptors as $spd) {
            $sharedProtocols = array_intersect($protocols, $spd['protocols']);
            if (count($sharedProtocols) > 0) {
                $ret[] = $spd;
            }
        }
 
        return $ret;
    }
 
 
    private function getIdPDescriptors($protocols)
    {
        assert(is_array($protocols));
 
        $ret = array();
 
        foreach ($this->idpDescriptors as $idpd) {
            $sharedProtocols = array_intersect($protocols, $idpd['protocols']);
            if (count($sharedProtocols) > 0) {
                $ret[] = $idpd;
            }
        }
 
        return $ret;
    }
 
 
    private static function findEntityDescriptor($doc)
    {
        assert($doc instanceof DOMDocument);
 
        // find the EntityDescriptor DOMElement. This should be the first (and only) child of the DOMDocument
        $ed = $doc->documentElement;
 
        if ($ed === null) {
            throw new Exception('Failed to load SAML metadata from empty XML document.');
        }
 
        if (SimpleSAML\Utils\XML::isDOMNodeOfType($ed, 'EntityDescriptor', '@md') === false) {
            throw new Exception('Expected first element in the metadata document to be an EntityDescriptor element.');
        }
 
        return new \SAML2\XML\md\EntityDescriptor($ed);
    }
 
 
    public function validateSignature($certificates)
    {
        foreach ($certificates as $cert) {
            assert(is_string($cert));
            $certFile = \SimpleSAML\Utils\Config::getCertPath($cert);
            if (!file_exists($certFile)) {
                throw new Exception(
                    'Could not find certificate file ['.$certFile.'], which is needed to validate signature'
                );
            }
            $certData = file_get_contents($certFile);
 
            foreach ($this->validators as $validator) {
                $key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, array('type' => 'public'));
                $key->loadKey($certData);
                try {
                    if ($validator->validate($key)) {
                        return true;
                    }
                } catch (Exception $e) {
                    // this certificate did not sign this element, skip
                }
            }
        }
        SimpleSAML\Logger::debug('Could not validate signature');
        return false;
    }
 
 
    public function validateFingerprint($fingerprint)
    {
        assert(is_string($fingerprint));
 
        $fingerprint = strtolower(str_replace(":", "", $fingerprint));
 
        $candidates = array();
        foreach ($this->validators as $validator) {
            foreach ($validator->getValidatingCertificates() as $cert) {
                $fp = strtolower(sha1(base64_decode($cert)));
                $candidates[] = $fp;
                if ($fp === $fingerprint) {
                    return true;
                }
            }
        }
        SimpleSAML\Logger::debug('Fingerprint was ['.$fingerprint.'] not one of ['.join(', ', $candidates).']');
        return false;
    }
}