|
| 1 | +<?php |
| 2 | + |
| 3 | +$metadata = \SimpleSAML\Metadata\MetaDataStorageHandler::getMetadataHandler(); |
| 4 | + |
| 5 | +$binding = \SAML2\Binding::getCurrentBinding(); |
| 6 | +$query = $binding->receive(); |
| 7 | +if (!($query instanceof \SAML2\AttributeQuery)) { |
| 8 | + throw new \SimpleSAML\Error\BadRequest('Invalid message received to AttributeQuery endpoint.'); |
| 9 | +} |
| 10 | + |
| 11 | +$idpEntityId = $metadata->getMetaDataCurrentEntityID('saml20-idp-hosted'); |
| 12 | + |
| 13 | +$issuer = $query->getIssuer(); |
| 14 | +if ($issuer === null) { |
| 15 | + throw new \SimpleSAML\Error\BadRequest('Missing <saml:Issuer> in <samlp:AttributeQuery>.'); |
| 16 | +} elseif (is_string($issuer)) { |
| 17 | + $spEntityId = $issuer; |
| 18 | +} else { |
| 19 | + $spEntityId = $issuer->getValue(); |
| 20 | +} |
| 21 | + |
| 22 | +$idpMetadata = $metadata->getMetaDataConfig($idpEntityId, 'saml20-idp-hosted'); |
| 23 | +$spMetadata = $metadata->getMetaDataConfig($spEntityId, 'saml20-sp-remote'); |
| 24 | + |
| 25 | +// The endpoint we should deliver the message to |
| 26 | +$endpoint = $spMetadata->getString('testAttributeEndpoint'); |
| 27 | + |
| 28 | +// The attributes we will return |
| 29 | +$attributes = [ |
| 30 | + 'name' => ['value1', 'value2', 'value3'], |
| 31 | + 'test' => ['test'], |
| 32 | +]; |
| 33 | + |
| 34 | +// The name format of the attributes |
| 35 | +$attributeNameFormat = \SAML2\Constants::NAMEFORMAT_UNSPECIFIED; |
| 36 | + |
| 37 | +// Determine which attributes we will return |
| 38 | +$returnAttributes = array_keys($query->getAttributes()); |
| 39 | +if (count($returnAttributes) === 0) { |
| 40 | + SimpleSAML\Logger::debug('No attributes requested - return all attributes.'); |
| 41 | + $returnAttributes = $attributes; |
| 42 | +} elseif ($query->getAttributeNameFormat() !== $attributeNameFormat) { |
| 43 | + SimpleSAML\Logger::debug('Requested attributes with wrong NameFormat - no attributes returned.'); |
| 44 | + $returnAttributes = []; |
| 45 | +} else { |
| 46 | + foreach ($returnAttributes as $name => $values) { |
| 47 | + /** @var array $values */ |
| 48 | + if (!array_key_exists($name, $attributes)) { |
| 49 | + // We don't have this attribute |
| 50 | + unset($returnAttributes[$name]); |
| 51 | + continue; |
| 52 | + } |
| 53 | + if (count($values) === 0) { |
| 54 | + // Return all attributes |
| 55 | + $returnAttributes[$name] = $attributes[$name]; |
| 56 | + continue; |
| 57 | + } |
| 58 | + |
| 59 | + // Filter which attribute values we should return |
| 60 | + $returnAttributes[$name] = array_intersect($values, $attributes[$name]); |
| 61 | + } |
| 62 | +} |
| 63 | + |
| 64 | +// $returnAttributes contains the attributes we should return. Send them |
| 65 | +$assertion = new \SAML2\Assertion(); |
| 66 | +$assertion->setIssuer($idpEntityId); |
| 67 | +$assertion->setNameId($query->getNameId()); |
| 68 | +$assertion->setNotBefore(time()); |
| 69 | +$assertion->setNotOnOrAfter(time() + 300); // 60*5 = 5min |
| 70 | +$assertion->setValidAudiences([$spEntityId]); |
| 71 | +$assertion->setAttributes($returnAttributes); |
| 72 | +$assertion->setAttributeNameFormat($attributeNameFormat); |
| 73 | + |
| 74 | +$sc = new \SAML2\XML\saml\SubjectConfirmation(); |
| 75 | +$sc->Method = \SAML2\Constants::CM_BEARER; |
| 76 | +$sc->SubjectConfirmationData = new \SAML2\XML\saml\SubjectConfirmationData(); |
| 77 | +$sc->SubjectConfirmationData->setNotOnOrAfter(time() + 300); // 60*5 = 5min |
| 78 | +$sc->SubjectConfirmationData->setRecipient($endpoint); |
| 79 | +$sc->SubjectConfirmationData->setInResponseTo($query->getId()); |
| 80 | +$assertion->setSubjectConfirmation([$sc]); |
| 81 | + |
| 82 | +\SimpleSAML\Module\saml\Message::addSign($idpMetadata, $spMetadata, $assertion); |
| 83 | + |
| 84 | +$response = new \SAML2\Response(); |
| 85 | +$response->setRelayState($query->getRelayState()); |
| 86 | +$response->setDestination($endpoint); |
| 87 | +$response->setIssuer($idpEntityId); |
| 88 | +$response->setInResponseTo($query->getId()); |
| 89 | +$response->setAssertions([$assertion]); |
| 90 | +\SimpleSAML\Module\saml\Message::addSign($idpMetadata, $spMetadata, $response); |
| 91 | + |
| 92 | +$binding = new \SAML2\HTTPPost(); |
| 93 | +$binding->send($response); |
0 commit comments