Revision: 1808
Author: olavmrk
Date: Thu Oct 1 04:44:56 2009
Log: SAML2_Assertion: Support for decryption of encrypted NameId.
http://code.google.com/p/simplesamlphp/source/detail?r=1808
Modified:
/trunk/lib/SAML2/Assertion.php
=======================================
--- /trunk/lib/SAML2/Assertion.php Mon Sep 7 02:25:30 2009
+++ /trunk/lib/SAML2/Assertion.php Thu Oct 1 04:44:56 2009
@@ -42,6 +42,16 @@
private $nameId;
+ /**
+ * The encrypted NameId of the subject.
+ *
+ * If this is not NULL, the NameId needs decryption before it can be
accessed.
+ *
+ * @var DOMElement|NULL
+ */
+ private $encryptedNameId;
+
+
/**
* The earliest time this assertion is valid, as an UNIX timestamp.
*
@@ -220,14 +230,19 @@
}
$subject = $subject[0];
- $nameId = SAML2_Utils::xpQuery($subject,
'./saml_assertion:NameID');
+ $nameId = SAML2_Utils::xpQuery($subject,
'./saml_assertion:NameID
| ./saml_assertion:EncryptedID/xenc:EncryptedData');
if (empty($nameId)) {
- throw new Exception('Missing <saml:NameID> in
<saml:Subject>.');
+ throw new Exception('Missing <saml:NameID> or
<saml:EncryptedID> in
<saml:Subject>.');
} elseif (count($nameId) > 1) {
- throw new Exception('More than one <saml:NameID> in
<saml:Subject>.');
+ throw new Exception('More than one <saml:NameID> or
<saml:EncryptedD>
in <saml:Subject>.');
}
$nameId = $nameId[0];
- $this->nameId = SAML2_Utils::parseNameId($nameId);
+ if ($nameId->localName === 'EncryptedData') {
+ /* The NameID element is encrypted. */
+ $this->encryptedNameId = $nameId;
+ } else {
+ $this->nameId = SAML2_Utils::parseNameId($nameId);
+ }
$subjectConfirmation =
SAML2_Utils::xpQuery($subject, './saml_assertion:SubjectConfirmation');
if (empty($subjectConfirmation)) {
@@ -553,6 +568,11 @@
* @return array|NULL The name identifier of the assertion.
*/
public function getNameId() {
+
+ if ($this->encryptedNameId !== NULL) {
+ throw new Exception('Attempted to retrieve encrypted
NameID without
decrypting it first.');
+ }
+
return $this->nameId;
}
@@ -570,6 +590,40 @@
$this->nameId = $nameId;
}
+
+
+ /**
+ * Check whether the NameId is encrypted.
+ *
+ * @return TRUE if the NameId is encrypted, FALSE if not.
+ */
+ public function isNameIdEncrypted() {
+
+ if ($this->encryptedNameId !== NULL) {
+ return TRUE;
+ }
+
+ return FALSE;
+ }
+
+
+ /**
+ * Decrypt the NameId of the subject in the assertion.
+ *
+ * @param XMLSecurityKey $key The decryption key.
+ */
+ public function decryptNameId(XMLSecurityKey $key) {
+
+ if ($this->encryptedNameId === NULL) {
+ /* No NameID to decrypt. */
+ return;
+ }
+
+ $nameId = SAML2_Utils::decryptElement($this->encryptedNameId,
$key);
+ $this->nameId = SAML2_Utils::parseNameId($nameId);
+
+ $this->encryptedNameId = NULL;
+ }
/**
--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected]
To unsubscribe from this group, send email to
[email protected]
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en
-~----------~----~----~----~------~----~------~--~---
