Skip to content

Commit ba4f387

Browse files
oharstaoharsta
committed
Merge branch 'bugfix-6' into 3.7.2-open-aselect-release
2 parents 9c19b62 + a74d6d3 commit ba4f387

File tree

6 files changed

+112
-10
lines changed

6 files changed

+112
-10
lines changed

‎library/EngineBlock/Corto/Module/Bindings.php‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -559,7 +559,11 @@ protected function _verifySignatureMessage($message, $key)
559559
return ($verified === 1);
560560
}
561561

562-
protected function _verifySignatureXMLElement($publicKey, $xml, $element)
562+
/**
563+
* Note: this method is only public to make it unit testable, it would be better to move it's content to one or more separate classes
564+
* which can be tested separately
565+
*/
566+
public function _verifySignatureXMLElement($publicKey, $xml, $element)
563567
{
564568
if (!isset($element['ds:Signature'])) {
565569
throw new EngineBlock_Corto_Module_Bindings_Exception(
@@ -606,11 +610,7 @@ protected function _verifySignatureXMLElement($publicKey, $xml, $element)
606610
);
607611
}
608612
$referencedElement = $xpathResults->item(0);
609-
$referencedDocument = new DomDocument();
610-
$importedNode = $referencedDocument->importNode($referencedElement->cloneNode(true), true);
611-
$referencedDocument->appendChild($importedNode);
612-
613-
$referencedDocumentXml = $referencedDocument->saveXML();
613+
$referencedDocumentXml = $document->saveXML($referencedElement->cloneNode(true));
614614

615615
// First process any transforms
616616
if (isset($reference['ds:Transforms']['ds:Transform'])) {

‎library/EngineBlock/Corto/ProxyServer.php‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1003,6 +1003,11 @@ protected function callAttributeFilter($callback, array &$response, array $reque
10031003

10041004
$responseAssertionAttributes = &$response['saml:Assertion']['saml:AttributeStatement'][0]['saml:Attribute'];
10051005

1006+
// Workaround When response does not contain an Assertion -> $responseAssertionAttributes will be null
1007+
// EngineBlock_Corto_XmlToArray::attributes2array parameter is type hinted to be an array
1008+
if (empty($responseAssertionAttributes)) {
1009+
$responseAssertionAttributes = array();
1010+
}
10061011
// Take the attributes out
10071012
$responseAttributes = EngineBlock_Corto_XmlToArray::attributes2array($responseAssertionAttributes);
10081013
// Pass em along

‎library/EngineBlock/Saml/MessageSerializer.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ class EngineBlock_Saml_MessageSerializer
1313
public function serialize(SAML2_Message $samlMessage)
1414
{
1515
if ($samlMessage->getSignatureKey()) {
16-
$samlMessagetDomElement = $samlMessage->toSignedXML();
16+
$samlMessageDomElement = $samlMessage->toSignedXML();
1717
} else {
18-
$samlMessagetDomElement = $samlMessage->toUnsignedXML();
18+
$samlMessageDomElement = $samlMessage->toUnsignedXML();
1919
}
20-
return $samlMessagetDomElement->ownerDocument->saveXML($samlMessagetDomElement);
20+
return $samlMessageDomElement->ownerDocument->saveXML($samlMessageDomElement);
2121
}
2222

2323
/**

‎tests/library/EngineBlock/Test/Corto/Module/BindingsTest.php‎

Lines changed: 71 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,11 +4,16 @@
44
*/
55
class EngineBlock_Test_Corto_Module_BindingsTest extends PHPUnit_Framework_TestCase
66
{
7+
/**
8+
* @var EngineBlock_Corto_Module_Bindings
9+
*/
710
private $bindings;
811

912
public function setup()
1013
{
1114
$proxyServer = Phake::mock('EngineBlock_Corto_ProxyServer');
15+
$log = Phake::mock('EngineBlock_Log');
16+
Phake::when($proxyServer)->getSessionLog()->thenReturn($log);
1217
$this->bindings = new EngineBlock_Corto_Module_Bindings($proxyServer);
1318
}
1419

@@ -26,4 +31,69 @@ public function testResponseRedirectIsNotSupported()
2631
$remoteEntity = array();
2732
$this->bindings->send($message, $remoteEntity);
2833
}
29-
}
34+
35+
/**
36+
* @param string $xmlFile
37+
* @param string $certificateFile
38+
*
39+
* @dataProvider responseProvider
40+
*/
41+
public function testResponseVerifies($xmlFile, $certificateFile)
42+
{
43+
$xml2array = new EngineBlock_Corto_XmlToArray();
44+
$xml = file_get_contents($xmlFile);
45+
46+
$element = $xml2array->xml2array($xml);
47+
48+
$publicCertificate = file_get_contents($certificateFile);
49+
50+
$publicKey = openssl_pkey_get_public($publicCertificate);
51+
52+
if (isset($element['ds:Signature'])) {
53+
$this->assertTrue(
54+
$this->bindings->_verifySignatureXMLElement(
55+
$publicKey,
56+
$xml,
57+
$element
58+
)
59+
);
60+
}
61+
62+
if (isset($element['saml:Assertion']['ds:Signature'])) {
63+
$this->assertTrue(
64+
$this->bindings->_verifySignatureXMLElement(
65+
$publicKey,
66+
$xml,
67+
$element['saml:Assertion']
68+
)
69+
);
70+
}
71+
}
72+
73+
/**
74+
* Provides a list of paths to response xml files and certificate files
75+
*
76+
* @return array
77+
*/
78+
public function responseProvider()
79+
{
80+
$responseFiles = array();
81+
$certificateFiles = array();
82+
$responsesDir = new DirectoryIterator(TEST_RESOURCES_DIR . '/saml/responses');
83+
/** @var $responseFile DirectoryIterator */
84+
foreach($responsesDir as $responseFile) {
85+
if ($responseFile->isFile() && !$responseFile->isDot()) {
86+
$extension = substr($responseFile->getFilename(), -3);
87+
$fileNameWithoutExtension = substr($responseFile->getFilename(), 0, -4);
88+
89+
if ($extension == 'cer') {
90+
$certificateFiles[$fileNameWithoutExtension] = $responseFile->getRealPath();
91+
} elseif ($extension == 'xml') {
92+
$responseFiles[$fileNameWithoutExtension] = $responseFile->getRealPath();
93+
}
94+
}
95+
}
96+
97+
return array_merge_recursive($responseFiles, $certificateFiles);
98+
}
99+
}

‎tests/resources/saml/responses/engineblock-dummy-idp.cer‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDrzCCApegAwIBAgIJAOaOFTs6UrvPMA0GCSqGSIb3DQEBBQUAMG4xCzAJBgNV
3+
BAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdVdHJlY2h0MRAwDgYD
4+
VQQKDAdTdXJmbmV0MRMwEQYDVQQLDApPcGVuQ29uZXh0MRQwEgYDVQQDDAtFbmdp
5+
bmVCbG9jazAeFw0xMzA4MTYwNzQxMDVaFw00MTAxMDEwNzQxMDVaMG4xCzAJBgNV
6+
BAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdVdHJlY2h0MRAwDgYD
7+
VQQKDAdTdXJmbmV0MRMwEQYDVQQLDApPcGVuQ29uZXh0MRQwEgYDVQQDDAtFbmdp
8+
bmVCbG9jazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALRDrSUvOMwa
9+
Lg2UbZaPbxvpRublp5m8kSFRg8hlMnStXPPPSpBbD7hzaV+Ey8bgTcw5mmoxf0wQ
10+
ar2HsH/99W9lvbhVrbhwPJygcSEmPVbjjCZaUx9b/52wjJby6omC0LkXkeJkQYBF
11+
YLHPqc32HdlvALSxcW146LWQR8X9cblJuEx9Iz18vHCNnRLI+/w3o5qyI2EG4kJF
12+
7vBdhbLMUnaDl6XGvHWyXej35feAhJByeCckxpmqAm79W1a+s6I7dUfLHtFWaHH1
13+
+r4dsiOmoViqKGVqtQY18FM2nTfR6VZ+Gj0uvGwCUUrIs7NjGqeWVL1EHQ9uSWhE
14+
/BSDKd3ugpcCAwEAAaNQME4wHQYDVR0OBBYEFMdjB4+yV5QG4Ct9RvXSus5dYv+q
15+
MB8GA1UdIwQYMBaAFMdjB4+yV5QG4Ct9RvXSus5dYv+qMAwGA1UdEwQFMAMBAf8w
16+
DQYJKoZIhvcNAQEFBQADggEBAFyq+F3zM+BU85ROM7SZv5poUxKeQ8pP12Sx7LzA
17+
sJVZUMtfQwK7WlFkIJXasolL/iuwj/9Y9OMgqUl6IdHrMPNI5znn+Er7wmo2RCbe
18+
nNAYw9/ywWP/kNa28nb8FVhgX43+0oBf2s8dJngBiLB87Jp/ZGc7CIMqbADJ+ZVG
19+
C/6DN9yRXModL4mqnlkXaUVwGoU6EsDbr5WoJyEdpy69HotE7CiIZniMjeVSQ//8
20+
enkp7d/rsOAlGCQLD5ajUzaAm3ymIzkMLPGdSpsNjTcMPgEc64ZcOu2gzn8M8/b3
21+
6nfr3xMS9MutksOPHIO/So7DgFAwvKwiWGk0FUereNM+yMg=
22+
-----END CERTIFICATE-----

‎tests/resources/saml/responses/engineblock-dummy-idp.xml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="_6bad0f2fce7a4b50143fa12ea471bc5de213b230a1" Version="2.0" IssueInstant="2013-09-26T14:31:33Z" Destination="https://engine-test.demo.openconext.org/authentication/sp/consume-assertion" InResponseTo="CORTO7e72e589e307f786d8fa003e9d1e9a0a5a441151"><saml:Issuer>https://engine-test.demo.openconext.org/dummy/idp</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xs="http://www.w3.org/2001/XMLSchema" ID="_b3e56fd292687fea47d9b1daa2e75bb7c7241729c2" Version="2.0" IssueInstant="2013-09-26T14:31:33Z"><saml:Issuer>https://engine-test.demo.openconext.org/dummy/idp</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
2+
<ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
3+
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
4+
<ds:Reference URI="#_b3e56fd292687fea47d9b1daa2e75bb7c7241729c2"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>hrv+zU3pLtEM0a11jbP5X5vUgvo=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>gwdw+1cOwmZtID/6vItrvLCsv4RCIeXoBqQ2AMO2RW6h5+w1i3Z1wKVrIWJ+ta0hEUleqDcNmOEkpfkExukhAzuPkwSjLOxTWeVAbLl3FjaOxLqcFHKk/UZrCJqGlIKfNnakYb9grFbg9lihnG/7AWdb2EVE/XRCru0eq8m4DczXc9rXROX84ezj8thzz1gDGQTis7AgmS3Hb0XqSK3I/jil4QFRSHjppWChmyMyS9mibFPOL8K4BE5lky66Ro8yzN+K9H43FdfiLkzGtvwBimCzPw1/G6vyQhD3jUWKeeGfYpB2pyLRALwkqb7C9v53j11/ZCRRLI7M3+e2SvZxBQ==</ds:SignatureValue>
5+
<ds:KeyInfo><ds:X509Data><ds:X509Certificate>-----BEGINCERTIFICATE-----MIIDrzCCApegAwIBAgIJAOaOFTs6UrvPMA0GCSqGSIb3DQEBBQUAMG4xCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdVdHJlY2h0MRAwDgYDVQQKDAdTdXJmbmV0MRMwEQYDVQQLDApPcGVuQ29uZXh0MRQwEgYDVQQDDAtFbmdpbmVCbG9jazAeFw0xMzA4MTYwNzQxMDVaFw00MTAxMDEwNzQxMDVaMG4xCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdVdHJlY2h0MRAwDgYDVQQKDAdTdXJmbmV0MRMwEQYDVQQLDApPcGVuQ29uZXh0MRQwEgYDVQQDDAtFbmdpbmVCbG9jazCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALRDrSUvOMwaLg2UbZaPbxvpRublp5m8kSFRg8hlMnStXPPPSpBbD7hzaV+Ey8bgTcw5mmoxf0wQar2HsH/99W9lvbhVrbhwPJygcSEmPVbjjCZaUx9b/52wjJby6omC0LkXkeJkQYBFYLHPqc32HdlvALSxcW146LWQR8X9cblJuEx9Iz18vHCNnRLI+/w3o5qyI2EG4kJF7vBdhbLMUnaDl6XGvHWyXej35feAhJByeCckxpmqAm79W1a+s6I7dUfLHtFWaHH1+r4dsiOmoViqKGVqtQY18FM2nTfR6VZ+Gj0uvGwCUUrIs7NjGqeWVL1EHQ9uSWhE/BSDKd3ugpcCAwEAAaNQME4wHQYDVR0OBBYEFMdjB4+yV5QG4Ct9RvXSus5dYv+qMB8GA1UdIwQYMBaAFMdjB4+yV5QG4Ct9RvXSus5dYv+qMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAFyq+F3zM+BU85ROM7SZv5poUxKeQ8pP12Sx7LzAsJVZUMtfQwK7WlFkIJXasolL/iuwj/9Y9OMgqUl6IdHrMPNI5znn+Er7wmo2RCbenNAYw9/ywWP/kNa28nb8FVhgX43+0oBf2s8dJngBiLB87Jp/ZGc7CIMqbADJ+ZVGC/6DN9yRXModL4mqnlkXaUVwGoU6EsDbr5WoJyEdpy69HotE7CiIZniMjeVSQ//8enkp7d/rsOAlGCQLD5ajUzaAm3ymIzkMLPGdSpsNjTcMPgEc64ZcOu2gzn8M8/b36nfr3xMS9MutksOPHIO/So7DgFAwvKwiWGk0FUereNM+yMg=-----ENDCERTIFICATE-----</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">johndoe</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2013-09-26T14:36:33Z" Recipient="https://engine-test.demo.openconext.org/authentication/sp/consume-assertion" InResponseTo="CORTO7e72e589e307f786d8fa003e9d1e9a0a5a441151"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2013-09-26T14:31:33Z" NotOnOrAfter="2013-09-26T14:36:33Z"/><saml:AuthnStatement AuthnInstant="2013-09-26T14:31:33Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="urn:mace:dir:attribute-def:uid"><saml:AttributeValue xsi:type="xs:string">johndoe</saml:AttributeValue></saml:Attribute><saml:Attribute Name="urn:mace:terena.org:attribute-def:schacHomeOrganization"><saml:AttributeValue xsi:type="xs:string">example.com</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>

0 commit comments

Comments
 (0)