Skip to content

Commit c06041b

Browse files
pdavidepdavide
committed
Add support to IssueInstant attribute check
1 parent fb67560 commit c06041b

4 files changed

Lines changed: 106 additions & 9 deletions

File tree

‎README.md‎

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -675,6 +675,17 @@ header('Location: ' . $ssoBuiltUrl);
675675
exit();
676676
```
677677

678+
If a check on the future SAMLResponse IssueInstant and the AuthNRequest IssueInstant to be sent is required, that AuthNRequest IssueInstant must to be extracted and saved.
679+
680+
```php
681+
$ssoBuiltUrl = $auth->login(null, array(), false, false, true);
682+
$_SESSION['AuthNRequestIssueInstant'] = $auth->getLastRequestIssueInstant();
683+
header('Pragma: no-cache');
684+
header('Cache-Control: no-cache, must-revalidate');
685+
header('Location: ' . $ssoBuiltUrl);
686+
exit();
687+
````
688+
678689
#### The SP Endpoints ####
679690

680691
Related to the SP there are three important views: The metadata view, the ACS view and the SLS view. The toolkit
@@ -743,8 +754,15 @@ if (isset($_SESSION) && isset($_SESSION['AuthNRequestID'])) {
743754
$requestID = null;
744755
}
745756

746-
$auth->processResponse($requestID);
757+
if (isset($_SESSION) && isset($_SESSION['AuthNRequestIssueInstant'])) {
758+
$requestIssueInstant = $_SESSION['AuthNRequestIssueInstant'];
759+
} else {
760+
$requestIssueInstant = null;
761+
}
762+
763+
$auth->processResponse($requestID, $requestIssueInstant);
747764
unset($_SESSION['AuthNRequestID']);
765+
unset($_SESSION['AuthNRequestIssueInstant']);
748766

749767
$errors = $auth->getErrors();
750768

@@ -884,8 +902,13 @@ if (isset($_SESSION) && isset($_SESSION['LogoutRequestID'])) {
884902
} else {
885903
$requestID = null;
886904
}
905+
if (isset($_SESSION) && isset($_SESSION['LogoutRequestIssueInstant'])) {
906+
$requestIssueInstant = $_SESSION['LogoutRequestIssueInstant'];
907+
} else {
908+
$requestIssueInstant = null;
909+
}
887910

888-
$auth->processSLO(false, $requestID);
911+
$auth->processSLO(false, $requestID, false, null, false, $requestIssueInstant);
889912

890913
$errors = $auth->getErrors();
891914

@@ -1058,6 +1081,17 @@ header('Location: ' . $sloBuiltUrl);
10581081
exit();
10591082
```
10601083

1084+
If a check on the future LogoutResponse IssueInstant and the LogoutRequest IssueInstant to be sent is required, that LogoutRequest IssueInstant must to be extracted and saved.
1085+
1086+
```php
1087+
$sloBuiltUrl = $auth->logout(null, $paramters, $nameId, $sessionIndex, true);
1088+
$_SESSION['LogoutRequestIssueInstant'] = $auth->getLastRequestIssueInstant();
1089+
header('Pragma: no-cache');
1090+
header('Cache-Control: no-cache, must-revalidate');
1091+
header('Location: ' . $sloBuiltUrl);
1092+
exit();
1093+
````
1094+
10611095
#### Example of a view that initiates the SSO request and handles the response (is the acs target) ####
10621096

10631097
We can code a unique file that initiates the SSO process, handle the response, get the attributes, initiate
@@ -1310,12 +1344,12 @@ Main class of OneLogin PHP Toolkit
13101344
* `getErrors` - Returns if there were any error
13111345
* `getSSOurl` - Gets the SSO url.
13121346
* `getSLOurl` - Gets the SLO url.
1313-
* `getLastRequestID` - The ID of the last Request SAML message generated.
13141347
* `buildRequestSignature` - Generates the Signature for a SAML Request
13151348
* `buildResponseSignature` - Generates the Signature for a SAML Response
13161349
* `getSettings` - Returns the settings info
13171350
* `setStrict` - Set the strict mode active/disable
13181351
* `getLastRequestID` - Gets the ID of the last AuthNRequest or LogoutRequest generated by the Service Provider.
1352+
* `getLastRequestIssueInstant` - Gets the IssueInstant attribute of the last AuthNRequest or LogoutRequest generated by the Service Provider.
13191353
* `getLastRequestXML` - Returns the most recently-constructed/processed XML SAML request (AuthNRequest, LogoutRequest)
13201354
* `getLastResponseXML` - Returns the most recently-constructed/processed XML SAML response (SAMLResponse, LogoutResponse). If the SAMLResponse had an encrypted assertion, decrypts it.
13211355

‎demo1/index.php‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,14 @@
2222
# header('Location: ' . $ssoBuiltUrl);
2323
# exit();
2424

25+
# If AuthNRequest IssueInstant need to be saved in order to later validate it, do instead
26+
# $ssoBuiltUrl = $auth->login(null, array(), false, false, true);
27+
# $_SESSION['AuthNRequestIssueInstant'] = $auth->getLastRequestIssueInstant();
28+
# header('Pragma: no-cache');
29+
# header('Cache-Control: no-cache, must-revalidate');
30+
# header('Location: ' . $ssoBuiltUrl);
31+
# exit();
32+
2533
} else if (isset($_GET['sso2'])) {
2634
$returnTo = $spBaseUrl.'/demo1/attrs.php';
2735
$auth->login($returnTo);
@@ -58,14 +66,28 @@
5866
# header('Location: ' . $sloBuiltUrl);
5967
# exit();
6068

69+
# If LogoutRequest IssueInstant need to be saved in order to later validate it, do instead
70+
# $sloBuiltUrl = $auth->logout(null, $paramters, $nameId, $sessionIndex, true);
71+
# $_SESSION['LogoutRequestIssueInstant'] = $auth->getLastRequestIssueInstant();
72+
# header('Pragma: no-cache');
73+
# header('Cache-Control: no-cache, must-revalidate');
74+
# header('Location: ' . $sloBuiltUrl);
75+
# exit();
76+
6177
} else if (isset($_GET['acs'])) {
6278
if (isset($_SESSION) && isset($_SESSION['AuthNRequestID'])) {
6379
$requestID = $_SESSION['AuthNRequestID'];
6480
} else {
6581
$requestID = null;
6682
}
6783

68-
$auth->processResponse($requestID);
84+
if (isset($_SESSION) && isset($_SESSION['AuthNRequestIssueInstant'])) {
85+
$requestIssueInstant = $_SESSION['AuthNRequestIssueInstant'];
86+
} else {
87+
$requestIssueInstant = null;
88+
}
89+
90+
$auth->processResponse($requestID, $requestIssueInstant);
6991

7092
$errors = $auth->getErrors();
7193

@@ -95,7 +117,13 @@
95117
$requestID = null;
96118
}
97119

98-
$auth->processSLO(false, $requestID);
120+
if (isset($_SESSION) && isset($_SESSION['LogoutRequestIssueInstant'])) {
121+
$requestIssueInstant = $_SESSION['LogoutRequestIssueInstant'];
122+
} else {
123+
$requestIssueInstant = null;
124+
}
125+
126+
$auth->processSLO(false, $requestID, false, null, false, $requestIssueInstant);
99127
$errors = $auth->getErrors();
100128
if (empty($errors)) {
101129
echo '<p>Sucessfully logged out</p>';

‎lib/Saml2/Auth.php‎

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -123,6 +123,13 @@ class OneLogin_Saml2_Auth
123123
*/
124124
private $_lastRequestID;
125125

126+
/**
127+
* Last AuthNRequest or LogoutRequest IssueInstant generated by this Service Provider
128+
*
129+
* @var string
130+
*/
131+
private $_lastRequestIssueInstant;
132+
126133
/**
127134
* The most recently-constructed/processed XML SAML request
128135
* (AuthNRequest, LogoutRequest)
@@ -189,7 +196,7 @@ public function setStrict($value)
189196
* @throws OneLogin_Saml2_Error
190197
* @throws OneLogin_Saml2_ValidationError
191198
*/
192-
public function processResponse($requestId = null)
199+
public function processResponse($requestId = null, $requestIssueInstant = null)
193200
{
194201
$this->_errors = array();
195202
$this->_errorReason = null;
@@ -198,7 +205,7 @@ public function processResponse($requestId = null)
198205
$response = new OneLogin_Saml2_Response($this->_settings, $_POST['SAMLResponse']);
199206
$this->_lastResponse = $response->getXMLDocument();
200207

201-
if ($response->isValid($requestId)) {
208+
if ($response->isValid($requestId, $requestIssueInstant)) {
202209
$this->_attributes = $response->getAttributes();
203210
$this->_attributesWithFriendlyName = $response->getAttributesWithFriendlyName();
204211
$this->_nameid = $response->getNameId();
@@ -237,14 +244,14 @@ public function processResponse($requestId = null)
237244
*
238245
* @throws OneLogin_Saml2_Error
239246
*/
240-
public function processSLO($keepLocalSession = false, $requestId = null, $retrieveParametersFromServer = false, $cbDeleteSession = null, $stay = false)
247+
public function processSLO($keepLocalSession = false, $requestId = null, $retrieveParametersFromServer = false, $cbDeleteSession = null, $stay = false, $requestIssueInstant = null)
241248
{
242249
$this->_errors = array();
243250
$this->_errorReason = null;
244251
if (isset($_GET['SAMLResponse'])) {
245252
$logoutResponse = new OneLogin_Saml2_LogoutResponse($this->_settings, $_GET['SAMLResponse']);
246253
$this->_lastResponse = $logoutResponse->getXML();
247-
if (!$logoutResponse->isValid($requestId, $retrieveParametersFromServer)) {
254+
if (!$logoutResponse->isValid($requestId, $retrieveParametersFromServer, $requestIssueInstant)) {
248255
$this->_errors[] = 'invalid_logout_response';
249256
$this->_errorReason = $logoutResponse->getError();
250257
} else if ($logoutResponse->getStatus() !== OneLogin_Saml2_Constants::STATUS_SUCCESS) {
@@ -497,6 +504,7 @@ public function login($returnTo = null, $parameters = array(), $forceAuthn = fal
497504

498505
$this->_lastRequest = $authnRequest->getXML();
499506
$this->_lastRequestID = $authnRequest->getId();
507+
$this->_lastRequestIssueInstant = $authnRequest->getIssueInstant();
500508

501509
$samlRequest = $authnRequest->getRequest();
502510
$parameters['SAMLRequest'] = $samlRequest;
@@ -554,6 +562,7 @@ public function logout($returnTo = null, $parameters = array(), $nameId = null,
554562

555563
$this->_lastRequest = $logoutRequest->getXML();
556564
$this->_lastRequestID = $logoutRequest->id;
565+
$this->_lastRequestIssueInstant = $logoutRequest->getIssueInstant();
557566

558567
$samlRequest = $logoutRequest->getRequest();
559568

@@ -624,6 +633,16 @@ public function getLastRequestID()
624633
return $this->_lastRequestID;
625634
}
626635

636+
/**
637+
* Gets the IssueInstant of the last AuthNRequest or LogoutRequest generated by the Service Provider.
638+
*
639+
* @return string The IssueInstant of the Request SAML message.
640+
*/
641+
public function getLastRequestIssueInstant()
642+
{
643+
return $this->_lastRequestIssueInstant;
644+
}
645+
627646
/**
628647
* Generates the Signature for a SAML Request
629648
*

‎tests/src/OneLogin/Saml2/AuthTest.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,22 @@ public function testGetLastRequestID()
5757
$this->assertNotEquals($id1, $id2);
5858
}
5959

60+
/**
61+
* Tests the getLastRequestIssueInstant method of the OneLogin_Saml2_Auth class
62+
*
63+
* @covers OneLogin_Saml2_Auth::getLastRequestIssueInstant
64+
*/
65+
public function testGetLastRequestIssueInstant()
66+
{
67+
$targetSSOURL = $this->_auth->login(null, array(), false, false, true, false, false);
68+
$issueInstant1 = $this->_auth->getLastRequestIssueInstant();
69+
$this->assertNotNull($issueInstant1);
70+
71+
$targetSLOURL = $this->_auth->logout(null, array(), null, null, true, null, null);
72+
$issueInstant2 = $this->_auth->getLastRequestIssueInstant();
73+
$this->assertNotNull($issueInstant2);
74+
}
75+
6076
/**
6177
* Tests the getSSOurl method of the OneLogin_Saml2_Auth class
6278
*

0 commit comments

Comments
 (0)