Revision: 1782
Author: olavmrk
Date: Thu Sep 24 04:54:08 2009
Log: saml: Move sourceid into AssertionConsumerService url.
http://code.google.com/p/simplesamlphp/source/detail?r=1782
Modified:
/trunk/modules/saml/lib/Auth/Source/SP.php
/trunk/modules/saml/www/sp/metadata.php
/trunk/modules/saml/www/sp/saml1-acs.php
/trunk/modules/saml/www/sp/saml2-acs.php
=======================================
--- /trunk/modules/saml/lib/Auth/Source/SP.php Thu Sep 10 05:41:51 2009
+++ /trunk/modules/saml/lib/Auth/Source/SP.php Thu Sep 24 04:54:08 2009
@@ -149,7 +149,7 @@
$id = SimpleSAML_Auth_State::saveState($state,
'saml:sp:ssosent-saml1');
$ar->setRelayState($id);
- $url = $ar->createRedirect($idpEntityId,
SimpleSAML_Module::getModuleURL('saml/sp/saml1-acs.php'));
+ $url = $ar->createRedirect($idpEntityId,
SimpleSAML_Module::getModuleURL('saml/sp/saml1-acs.php/' . $this->authId));
SimpleSAML_Logger::debug('Starting SAML 1 SSO to ' .
var_export($idpEntityId, TRUE) .
' from ' . var_export($this->entityId, TRUE) . '.');
@@ -167,7 +167,7 @@
$ar = sspmod_saml2_Message::buildAuthnRequest($this->metadata,
$idpMetadata);
-
$ar->setAssertionConsumerServiceURL(SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php'));
+
$ar->setAssertionConsumerServiceURL(SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php/'
.
$this->authId));
$ar->setProtocolBinding(SAML2_Const::BINDING_HTTP_POST);
$id = SimpleSAML_Auth_State::saveState($state,
'saml:sp:ssosent-saml2');
=======================================
--- /trunk/modules/saml/www/sp/metadata.php Thu Sep 3 03:37:53 2009
+++ /trunk/modules/saml/www/sp/metadata.php Thu Sep 24 04:54:08 2009
@@ -17,22 +17,22 @@
$entityId = $source->getEntityId();
$metaArray11 = array(
- 'AssertionConsumerService' =>
SimpleSAML_Module::getModuleURL('saml/sp/saml1-acs.php'),
+ 'AssertionConsumerService' =>
SimpleSAML_Module::getModuleURL('saml/sp/saml1-acs.php/' . $sourceId),
);
$spconfig = $source->getMetadata();
if ($spconfig->getBoolean('saml11.binding.artifact.enable', FALSE)) {
- $metaArray11['AssertionConsumerService.artifact'] =
SimpleSAML_Module::getModuleURL('saml/sp/saml1-acs.php/artifact');
+ $metaArray11['AssertionConsumerService.artifact'] =
SimpleSAML_Module::getModuleURL('saml/sp/saml1-acs.php/' .
$sourceId . '/artifact');
}
$metaArray20 = array(
- 'AssertionConsumerService' =>
SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php'),
+ 'AssertionConsumerService' =>
SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php/' . $sourceId),
'SingleLogoutService' =>
SimpleSAML_Module::getModuleURL('saml/sp/saml2-logout.php/' . $sourceId),
);
if ($spconfig->getBoolean('saml20.binding.artifact.enable', FALSE)) {
- $metaArray20['AssertionConsumerService.artifact'] =
SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php');
+ $metaArray20['AssertionConsumerService.artifact'] =
SimpleSAML_Module::getModuleURL('saml/sp/saml2-acs.php/' . $sourceId);
}
$certInfo = SimpleSAML_Utilities::loadPublicKey($spconfig->toArray());
=======================================
--- /trunk/modules/saml/www/sp/saml1-acs.php Thu Sep 10 05:41:51 2009
+++ /trunk/modules/saml/www/sp/saml1-acs.php Thu Sep 24 04:54:08 2009
@@ -8,19 +8,22 @@
throw new SimpleSAML_Error_BadRequest('Missing TARGET parameter.');
}
+$sourceId = $_SERVER['PATH_INFO'];
+$end = strpos($sourceId, '/', 1);
+if ($end === FALSE) {
+ $end = strlen($sourceId);
+}
+$sourceId = substr($sourceId, 1, $end - 1);
+
+$source =
SimpleSAML_Auth_Source::getById($sourceId, 'sspmod_saml_Auth_Source_SP');
+
$state =
SimpleSAML_Auth_State::loadState($_REQUEST['TARGET'], 'saml:sp:ssosent-saml1');
-/* Find authentication source. */
+/* Check that the authentication source is correct. */
assert('array_key_exists("saml:sp:AuthId", $state)');
-$sourceId = $state['saml:sp:AuthId'];
-
-$source = SimpleSAML_Auth_Source::getById($sourceId);
-if ($source === NULL) {
- throw new SimpleSAML_Error_Exception('Could not find authentication
source with id ' . $sourceId);
-}
-if (!($source instanceof sspmod_saml_Auth_Source_SP)) {
- throw new SimpleSAML_Error_Exception('Source type changed?');
+if ($state['saml:sp:AuthId'] !== $sourceId) {
+ throw new SimpleSAML_Error_Exception('The authentication source id in
the
URL does not match the authentication source which sent the request.');
}
$idpEntityId = $state['saml:idp'];
=======================================
--- /trunk/modules/saml/www/sp/saml2-acs.php Wed Aug 19 01:31:19 2009
+++ /trunk/modules/saml/www/sp/saml2-acs.php Thu Sep 24 04:54:08 2009
@@ -4,6 +4,9 @@
* Assertion consumer service handler for SAML 2.0 SP authentication
client.
*/
+$sourceId = substr($_SERVER['PATH_INFO'], 1);
+$source =
SimpleSAML_Auth_Source::getById($sourceId, 'sspmod_saml_Auth_Source_SP');
+
$b = SAML2_Binding::getCurrentBinding();
$response = $b->receive();
if (!($response instanceof SAML2_Response)) {
@@ -17,16 +20,10 @@
$state =
SimpleSAML_Auth_State::loadState($relayState, 'saml:sp:ssosent-saml2');
-/* Find authentication source. */
+/* Check that the authentication source is correct. */
assert('array_key_exists("saml:sp:AuthId", $state)');
-$sourceId = $state['saml:sp:AuthId'];
-
-$source = SimpleSAML_Auth_Source::getById($sourceId);
-if ($source === NULL) {
- throw new Exception('Could not find authentication source with id ' .
$sourceId);
-}
-if (!($source instanceof sspmod_saml_Auth_Source_SP)) {
- throw new SimpleSAML_Error_Exception('Source type changed?');
+if ($state['saml:sp:AuthId'] !== $sourceId) {
+ throw new SimpleSAML_Error_Exception('The authentication source id in
the
URL does not match the authentication source which sent the request.');
}
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en
-~----------~----~----~----~------~----~------~--~---
