Revision: 1753
Author: olavmrk
Date: Thu Sep 10 05:41:51 2009
Log: saml: Check that the responder is the same as the one the request was
sent to.
http://code.google.com/p/simplesamlphp/source/detail?r=1753
Modified:
/trunk/modules/saml/lib/Auth/Source/SP.php
/trunk/modules/saml/www/sp/saml1-acs.php
=======================================
--- /trunk/modules/saml/lib/Auth/Source/SP.php Thu Sep 3 03:37:34 2009
+++ /trunk/modules/saml/lib/Auth/Source/SP.php Thu Sep 10 05:41:51 2009
@@ -141,6 +141,8 @@
$idpEntityId = $idpMetadata->getString('entityid');
+ $state['saml:idp'] = $idpEntityId;
+
$ar = new SimpleSAML_XML_Shib13_AuthnRequest();
$ar->setIssuer($this->entityId);
=======================================
--- /trunk/modules/saml/www/sp/saml1-acs.php Wed Aug 19 01:31:19 2009
+++ /trunk/modules/saml/www/sp/saml1-acs.php Thu Sep 10 05:41:51 2009
@@ -23,6 +23,8 @@
throw new SimpleSAML_Error_Exception('Source type changed?');
}
+$idpEntityId = $state['saml:idp'];
+$idpMetadata = $source->getIdPMetadata($idpEntityId);
$responseXML = $_REQUEST['SAMLResponse'];
$responseXML = base64_decode($responseXML);
@@ -32,15 +34,19 @@
$response->validate();
-$idp = $response->getIssuer();
+$responseIssuer = $response->getIssuer();
$attributes = $response->getAttributes();
+if ($responseIssuer !== $idpEntityId) {
+ throw new SimpleSAML_Error_Exception('The issuer of the response
wasn\'t
the destination of the request.');
+}
+
$logoutState = array(
'saml:logout:Type' => 'saml1'
);
$state['LogoutState'] = $logoutState;
-$source->handleResponse($state, $idp, $attributes);
+$source->handleResponse($state, $idpEntityId, $attributes);
assert('FALSE');
?>
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en
-~----------~----~----~----~------~----~------~--~---
