Revision: 2185
Author: hans.zandbelt
Date: Wed Feb 17 00:30:36 2010
Log: fix: swap the order of metadata parameters in verifying signatures on
incoming messages, so the correct certificate from the SP(!) metadata is
used to check the signature instead of the IDP one
http://code.google.com/p/simplesamlphp/source/detail?r=2185
Modified:
/trunk/modules/saml/lib/IdP/SAML2.php
=======================================
--- /trunk/modules/saml/lib/IdP/SAML2.php Mon Feb 1 01:46:49 2010
+++ /trunk/modules/saml/lib/IdP/SAML2.php Wed Feb 17 00:30:36 2010
@@ -377,7 +377,7 @@
$idpMetadata = $idp->getConfig();
$spMetadata =
$metadata->getMetaDataConfig($spEntityId, 'saml20-sp-remote');
- sspmod_saml2_Message::validateMessage($idpMetadata, $spMetadata,
$message);
+ sspmod_saml2_Message::validateMessage($spMetadata, $idpMetadata,
$message);
if ($message instanceof SAML2_LogoutResponse) {
--
You received this message because you are subscribed to the Google Groups
"simpleSAMLphp commits" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/simplesamlphp-commits?hl=en.
