sspmod_adfs_IdP_ADFS Class Reference

Collaboration diagram for sspmod_adfs_IdP_ADFS:

Static Public Member Functions
static	receiveAuthnRequest (SimpleSAML_IdP $idp)
static	sendResponse (array $state)
static	sendLogoutResponse (SimpleSAML_IdP $idp, array $state)
static	receiveLogoutMessage (SimpleSAML_IdP $idp)
static	getLogoutURL (SimpleSAML_IdP $idp, array $association, $relayState)

Static Private Member Functions
static	generateResponse ($issuer, $target, $nameid, $attributes, $assertionLifetime)
static	signResponse ($response, $key, $cert, $algo)
static	postResponse ($url, $wresult, $wctx)

Detailed Description

Definition at line 6 of file ADFS.php.

Member Function Documentation

generateResponse()

static sspmod_adfs_IdP_ADFS::generateResponse (   $issuer,   $target,   $nameid,   $attributes,   $assertionLifetime  )

staticprivate

Definition at line 40 of file ADFS.php.

References $assertionLifetime, $attributes, $name, $nameid, $namespace, $result, $target, $values, SimpleSAML\Utils\Random\generateID(), SimpleSAML\Utils\Time\generateTimestamp(), SimpleSAML\Utils\Attributes\getAttributeNamespace(), and NotOnOrAfter.

Referenced by sendResponse().

    {
        $issueInstant = SimpleSAML\Utils\Time::generateTimestamp();
        $notBefore = SimpleSAML\Utils\Time::generateTimestamp(time() - 30);
        $assertionExpire = SimpleSAML\Utils\Time::generateTimestamp(time() + $assertionLifetime);
        $assertionID = SimpleSAML\Utils\Random::generateID();
        $nameidFormat = 'http://schemas.xmlsoap.org/claims/UPN';
        $nameid = htmlspecialchars($nameid);

        $result = <<<MSG
<wst:RequestSecurityTokenResponse xmlns:wst="http://schemas.xmlsoap.org/ws/2005/02/trust">
    <wst:RequestedSecurityToken>
        <saml:Assertion Issuer="$issuer" IssueInstant="$issueInstant" AssertionID="$assertionID" MinorVersion="1" MajorVersion="1" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
            <saml:Conditions NotOnOrAfter="$assertionExpire" NotBefore="$notBefore">
                <saml:AudienceRestrictionCondition>
                    <saml:Audience>$target</saml:Audience>
                </saml:AudienceRestrictionCondition>
            </saml:Conditions>
            <saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:unspecified" AuthenticationInstant="$issueInstant">
                <saml:Subject>
                    <saml:NameIdentifier Format="$nameidFormat">$nameid</saml:NameIdentifier>
                </saml:Subject>
            </saml:AuthenticationStatement>
            <saml:AttributeStatement>
                <saml:Subject>
                    <saml:NameIdentifier Format="$nameidFormat">$nameid</saml:NameIdentifier>
                </saml:Subject>
MSG;

        foreach ($attributes as $name => $values) {
            if ((!is_array($values)) || (count($values) == 0)) {
                continue;
            }

            list($namespace, $name) = SimpleSAML\Utils\Attributes::getAttributeNamespace($name, 'http://schemas.xmlsoap.org/claims');
            foreach ($values as $value) {
                if ((!isset($value)) || ($value === '')) {
                    continue;
                }
                $value = htmlspecialchars($value);

                $result .= <<<MSG
                <saml:Attribute AttributeNamespace="$namespace" AttributeName="$name">
                    <saml:AttributeValue>$value</saml:AttributeValue>
                </saml:Attribute>
MSG;

            }
        }

        $result .= <<<MSG
            </saml:AttributeStatement>
        </saml:Assertion>
   </wst:RequestedSecurityToken>
   <wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy">
       <wsa:EndpointReference xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing">
           <wsa:Address>$target</wsa:Address>
       </wsa:EndpointReference>
   </wsp:AppliesTo>
</wst:RequestSecurityTokenResponse>
MSG;

        return $result;
    }

Here is the call graph for this function:

Here is the caller graph for this function:

getLogoutURL()

static sspmod_adfs_IdP_ADFS::getLogoutURL ( SimpleSAML_IdP  $idp, array  $association,   $relayState  )

static

Definition at line 228 of file ADFS.php.

References $metadata, $relayState, $returnTo, $spMetadata, SimpleSAML_Metadata_MetaDataStorageHandler\getMetadataHandler(), and SimpleSAML\Module\getModuleURL().

    {
        $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
        $spMetadata = $metadata->getMetaDataConfig($association['adfs:entityID'], 'adfs-sp-remote');
        $returnTo = SimpleSAML\Module::getModuleURL('adfs/idp/prp.php?assocId='.urlencode($association["id"]).'&relayState='.urlencode($relayState));
        return $spMetadata->getValue('prp').'?wa=wsignoutcleanup1.0&wreply='.urlencode($returnTo);
    }

Here is the call graph for this function:

postResponse()

static sspmod_adfs_IdP_ADFS::postResponse (   $url,   $wresult,   $wctx  )

staticprivate

Definition at line 130 of file ADFS.php.

References $post, exit, and input.

Referenced by sendResponse().

    {
        $wresult = htmlspecialchars($wresult);
        $wctx = htmlspecialchars($wctx);

        $post = <<<MSG
    <body onload="document.forms[0].submit()">
        <form method="post" action="$url">
            <input type="hidden" name="wa" value="wsignin1.0">
            <input type="hidden" name="wresult" value="$wresult">
            <input type="hidden" name="wctx" value="$wctx">
            <noscript>
                <input type="submit" value="Continue">
            </noscript>
        </form>
    </body>
MSG;

        echo $post;
        exit;
    }

Here is the caller graph for this function:

receiveAuthnRequest()

static sspmod_adfs_IdP_ADFS::receiveAuthnRequest ( SimpleSAML_IdP  $idp )

static

Definition at line 8 of file ADFS.php.

References $_SERVER, $issuer, $metadata, $query, $spMetadata, $state, SimpleSAML\Utils\HTTP\checkURLAllowed(), SimpleSAML_Metadata_MetaDataStorageHandler\getMetadataHandler(), SimpleSAML_IdP\handleAuthenticationRequest(), and SimpleSAML\Logger\info().

    {
        try {
            parse_str($_SERVER['QUERY_STRING'], $query);

            $requestid = $query['wctx'];
            $issuer = $query['wtrealm'];

            $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
            $spMetadata = $metadata->getMetaDataConfig($issuer, 'adfs-sp-remote');

            SimpleSAML\Logger::info('ADFS - IdP.prp: Incoming Authentication request: '.$issuer.' id '.$requestid);
        } catch (Exception $exception) {
            throw new SimpleSAML_Error_Error('PROCESSAUTHNREQUEST', $exception);
        }

        $state = array(
            'Responder' => array('sspmod_adfs_IdP_ADFS', 'sendResponse'),
            'SPMetadata' => $spMetadata->toArray(),
            'ForceAuthn' => false,
            'isPassive' => false,
            'adfs:wctx' => $requestid,
            'adfs:wreply' => false
        );

        if (isset($query['wreply']) && !empty($query['wreply'])) {
            $state['adfs:wreply'] = SimpleSAML\Utils\HTTP::checkURLAllowed($query['wreply']);
        }

        $idp->handleAuthenticationRequest($state);              
    }

Here is the call graph for this function:

receiveLogoutMessage()

static sspmod_adfs_IdP_ADFS::receiveLogoutMessage ( SimpleSAML_IdP  $idp )

static

Definition at line 208 of file ADFS.php.

References $_GET, $assocId, $state, SimpleSAML_IdP\doLogoutRedirect(), and SimpleSAML_IdP\handleLogoutRequest().

    {
        // if a redirect is to occur based on wreply, we will redirect to url as
        // this implies an override to normal sp notification
        if (isset($_GET['wreply']) && !empty($_GET['wreply'])) {
            $idp->doLogoutRedirect(\SimpleSAML\Utils\HTTP::checkURLAllowed($_GET['wreply']));
            assert(false);
        }

        $state = array(
            'Responder' => array('sspmod_adfs_IdP_ADFS', 'sendLogoutResponse'),
        );
        $assocId = null;
        // TODO: verify that this is really no problem for: 
        //       a) SSP, because there's no caller SP.
        //       b) ADFS SP because caller will be called back..
        $idp->handleLogoutRequest($state, $assocId);
    }

Here is the call graph for this function:

sendLogoutResponse()

static sspmod_adfs_IdP_ADFS::sendLogoutResponse ( SimpleSAML_IdP  $idp, array  $state  )

static

Definition at line 201 of file ADFS.php.

References $idpMetadata, getBaseURL(), SimpleSAML_IdP\getConfig(), and SimpleSAML\Utils\HTTP\redirectTrustedURL().

    {
        // NB:: we don't know from which SP the logout request came from
        $idpMetadata = $idp->getConfig();
        \SimpleSAML\Utils\HTTP::redirectTrustedURL($idpMetadata->getValue('redirect-after-logout', \SimpleSAML\Utils\HTTP::getBaseURL()));
    }

Here is the call graph for this function:

sendResponse()

static sspmod_adfs_IdP_ADFS::sendResponse ( array  $state )

static

Definition at line 152 of file ADFS.php.

References $algo, $assertionLifetime, $attributes, $idp, $idpEntityId, $idpMetadata, $nameid, $response, $spEntityId, $spMetadata, SimpleSAML\Utils\Random\generateID(), generateResponse(), SimpleSAML_IdP\getByState(), SimpleSAML\Utils\Config\getCertPath(), SimpleSAML_Configuration\loadFromArray(), postResponse(), and signResponse().

    {
        $spMetadata = $state["SPMetadata"];
        $spEntityId = $spMetadata['entityid'];
        $spMetadata = SimpleSAML_Configuration::loadFromArray($spMetadata, '$metadata['.var_export($spEntityId, true).']');

        $attributes = $state['Attributes'];

        $nameidattribute = $spMetadata->getValue('simplesaml.nameidattribute');
        if (!empty($nameidattribute)) {
            if (!array_key_exists($nameidattribute, $attributes)) {
                throw new Exception('simplesaml.nameidattribute does not exist in resulting attribute set');
            }
            $nameid = $attributes[$nameidattribute][0];
        } else {
            $nameid = SimpleSAML\Utils\Random::generateID();
        }

        $idp = SimpleSAML_IdP::getByState($state);              
        $idpMetadata = $idp->getConfig();
        $idpEntityId = $idpMetadata->getString('entityid');

        $idp->addAssociation(array(
            'id' => 'adfs:'.$spEntityId,
            'Handler' => 'sspmod_adfs_IdP_ADFS',
            'adfs:entityID' => $spEntityId,
        ));

        $assertionLifetime = $spMetadata->getInteger('assertion.lifetime', null);
        if ($assertionLifetime === null) {
            $assertionLifetime = $idpMetadata->getInteger('assertion.lifetime', 300);
        }

        $response = sspmod_adfs_IdP_ADFS::generateResponse($idpEntityId, $spEntityId, $nameid, $attributes, $assertionLifetime);

        $privateKeyFile = \SimpleSAML\Utils\Config::getCertPath($idpMetadata->getString('privatekey'));
        $certificateFile = \SimpleSAML\Utils\Config::getCertPath($idpMetadata->getString('certificate'));

        $algo = $spMetadata->getString('signature.algorithm', null);
        if ($algo === null) {
            $algo = $idpMetadata->getString('signature.algorithm', XMLSecurityKey::RSA_SHA256);
        }
        $wresult = sspmod_adfs_IdP_ADFS::signResponse($response, $privateKeyFile, $certificateFile, $algo);

        $wctx = $state['adfs:wctx'];
        $wreply = $state['adfs:wreply'] ? : $spMetadata->getValue('prp');
        sspmod_adfs_IdP_ADFS::postResponse($wreply, $wresult, $wctx);
    }

Here is the call graph for this function:

signResponse()

static sspmod_adfs_IdP_ADFS::signResponse (   $response,   $key,   $cert,   $algo  )

staticprivate

Definition at line 105 of file ADFS.php.

References $algo, $key, $response, and SAML2\DOMDocumentFactory\fromString().

Referenced by sendResponse().

    {
        $objXMLSecDSig = new XMLSecurityDSig();
        $objXMLSecDSig->idKeys = array('AssertionID');  
        $objXMLSecDSig->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);  
        $responsedom = \SAML2\DOMDocumentFactory::fromString(str_replace("\r", "", $response));
        $firstassertionroot = $responsedom->getElementsByTagName('Assertion')->item(0);
        $objXMLSecDSig->addReferenceList(
            array($firstassertionroot), XMLSecurityDSig::SHA256,
            array('http://www.w3.org/2000/09/xmldsig#enveloped-signature', XMLSecurityDSig::EXC_C14N),
            array('id_name' => 'AssertionID')
        );

        $objKey = new XMLSecurityKey($algo, array('type' => 'private'));
        $objKey->loadKey($key, true);
        $objXMLSecDSig->sign($objKey);
        if ($cert) {
            $public_cert = file_get_contents($cert);
            $objXMLSecDSig->add509Cert($public_cert, true);
        }
        $newSig = $responsedom->importNode($objXMLSecDSig->sigNode, true);
        $firstassertionroot->appendChild($newSig);      
        return $responsedom->saveXML();
    }

Here is the call graph for this function:

Here is the caller graph for this function:

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/modules/adfs/lib/IdP/ADFS.php