|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace LightSaml\Tests\Functional\Model\Metadata; |
|
4
|
|
|
|
|
5
|
|
|
use LightSaml\Model\Context\DeserializationContext; |
|
6
|
|
|
use LightSaml\Model\Metadata\AssertionConsumerService; |
|
7
|
|
|
use LightSaml\Model\Metadata\EntityDescriptor; |
|
8
|
|
|
use LightSaml\Model\Metadata\IdpSsoDescriptor; |
|
9
|
|
|
use LightSaml\Model\Metadata\KeyDescriptor; |
|
10
|
|
|
use LightSaml\Model\Metadata\SingleLogoutService; |
|
11
|
|
|
use LightSaml\Model\Metadata\SingleSignOnService; |
|
12
|
|
|
use LightSaml\Model\Metadata\SpSsoDescriptor; |
|
13
|
|
|
use LightSaml\Model\Metadata\SSODescriptor; |
|
14
|
|
|
use LightSaml\SamlConstants; |
|
15
|
|
|
use LightSaml\Tests\BaseTestCase; |
|
16
|
|
|
|
|
17
|
|
|
class EntityDescriptorFunctionalTest extends BaseTestCase |
|
18
|
|
|
{ |
|
19
|
|
|
public function test__deserialization_idp2_ed() |
|
20
|
|
|
{ |
|
21
|
|
|
$context = new DeserializationContext(); |
|
22
|
|
|
$context->getDocument()->load(__DIR__.'/../../../../../../resources/sample/EntityDescriptor/idp2-ed.xml'); |
|
23
|
|
|
|
|
24
|
|
|
$ed = new EntityDescriptor(); |
|
25
|
|
|
$ed->deserialize($context->getDocument(), $context); |
|
26
|
|
|
|
|
27
|
|
|
$this->assertEquals('_2240bd9c-30c4-4d2a-ab3e-87a94ea334fd', $ed->getID()); |
|
28
|
|
|
$this->assertEquals('https://B1.bead.loc/adfs/services/trust', $ed->getEntityID()); |
|
29
|
|
|
|
|
30
|
|
|
$this->assertNotNull($ed->getSignature()); |
|
31
|
|
|
|
|
32
|
|
|
$this->assertCount(1, $ed->getAllIdpSsoDescriptors()); |
|
|
|
|
|
|
33
|
|
|
$this->assertCount(1, $ed->getAllSpSsoDescriptors()); |
|
|
|
|
|
|
34
|
|
|
|
|
35
|
|
|
$this->assertCount(1, $ed->getAllContactPersons()); |
|
|
|
|
|
|
36
|
|
|
|
|
37
|
|
|
//region SP |
|
38
|
|
|
$sp = $ed->getFirstSpSsoDescriptor(); |
|
39
|
|
|
$this->assertNotNull($sp); |
|
40
|
|
|
|
|
41
|
|
|
$this->assertTrue($sp->getWantAssertionsSigned()); |
|
42
|
|
|
$this->assertEquals(SamlConstants::PROTOCOL_SAML2, $sp->getProtocolSupportEnumeration()); |
|
43
|
|
|
$this->assertCount(2, $sp->getAllKeyDescriptors()); |
|
44
|
|
|
$this->assertCount(1, $sp->getAllKeyDescriptorsByUse(KeyDescriptor::USE_SIGNING)); |
|
45
|
|
|
$this->assertCount(1, $sp->getAllKeyDescriptorsByUse(KeyDescriptor::USE_ENCRYPTION)); |
|
46
|
|
|
|
|
47
|
|
|
$this->checkKD($sp, KeyDescriptor::USE_SIGNING, 'MIIC0jCCAbqgAwIBAgIQGFT6omLmWbhAD65bM40rGzANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExpBREZTIFNpZ25pbmcgLSBCMS5iZWFkLmxvYzAeFw0xMzEwMDkxNDUyMDVaFw0xNDEwMDkxNDUyMDVaMCUxIzAhBgNVBAMTGkFERlMgU2lnbmluZyAtIEIxLmJlYWQubG9jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlGKV64+63lpqdPmCTZ0kt/yKr8xukR1Y071SlmRVV5sSFhTe8cjylPqqxdyEBrfPhpL6vwFQyKfDhuM8T9E+BW5fUdoXO4WmIHrLOxV/BzKv2rDGidlCFzDSQPDxPH2RdQkMBksiauIMSHIYXB92rO4fkcsTgQ6cc+PZp4M3Z/jR1mcxQzz9RQk3I9w2OtI9xcv+uDC5mQU0ZWVHc99VSFQt+zshduwIqxQdHvMdTRslso+oCLEQom42pGCD8TksQTGw4sB7Ctb0mgXdfy0PDIznfi2oDBGtPY2Hkms6/n9xoyCynQea0YYXcpEe7lAvs+t6Lq+ZaKp2kUaa2x8d+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBfwlmaN1iPg0gNiqdVphJjWnzpV4h6/Mz3L0xYzNQeglWCDKCKuajQfmo/AQBErtOWZJsP8avzK79gNRqFHXF6CirjGnL6WO+S6Ug1hvy3xouOxOkIYgZsbmcNL2XO1hIxP4z/QWPthotp3FSUTae2hFBHuy4Gtb+9d9a60GDtgrHnfgVeCTE7CSiaI/D/51JNbtpg2tCpcEzMQgPkQqb8E+V79xc0dnEcI5cBaS6eYgkJgS5gKIMbwaJ/VxzCVGIKwFjFnJedJ5N7zH7OVwor56Q7nuKD7X4yFY9XR3isjGnwXveh9E4d9wD4CMl52AHJpsYsToXsi3eRvApDV/PE'); |
|
|
|
|
|
|
48
|
|
|
$this->checkKD($sp, KeyDescriptor::USE_ENCRYPTION, 'MIIC2DCCAcCgAwIBAgIQGUB7ppqiALBK62Hy+nSDsTANBgkqhkiG9w0BAQsFADAoMSYwJAYDVQQDEx1BREZTIEVuY3J5cHRpb24gLSBCMS5iZWFkLmxvYzAeFw0xMzEwMDkxNDUyMDZaFw0xNDEwMDkxNDUyMDZaMCgxJjAkBgNVBAMTHUFERlMgRW5jcnlwdGlvbiAtIEIxLmJlYWQubG9jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4ngzZI32ekN1jP8f4N6DpF9jBIwAiLi+bMhhz6lc1QpIbxAsbDQqZEeNSXPj548eEbG2K4dCWFdXWM6fjmjf9olYtDZSJe7XsHciBZoNjxRkLoiNkqIJzLT8Eb+G8NRm8oU6NneziJZtIm6Y6bV/fo3q0fX6aAdOAT7gSoFEEmlkw0Uf49XJCGrS4sMfD5gpXeQpcUuislpnEGgN1NfftE/K1sf6Rdx+5TabCAhEo9wKA9D0qkq6rdf1NEnDSur8RJkrhXy7XIX1pmCw70fLs456vksWzj98j3puZ7soOc3yKf+05UjlNy9ZNnNILgiHarcKMIP4Tp7vp9167TVreQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAKBxeIITIO3bu3ln+pH9djN9MTNCFsm7AU9BULbmj/1kHol73Te/xlS4lBzLUjv2WfSm3fN96lzSwYZY/OIQzz69sSnj0sLnU8eSdk5q5l1l5fhMK05cJsUqJQ6eRWsIdxGkDb3c8pUwpSDu3y+sGRAj7aR8tu4JcvqtvLrBpBHk6eCLdj7D3UeRcTW9bSsfxnxhT1pXVaK8VEVrKSOe26vD6VOnGactYff2gL8a3zouqAKFHQKRA8ogci3zoh8Q7ypApuwEohlUlX7boPQ3trwVA24hor/MfCFZ2GPi3at2F4rX+p0ZGrjWzYt0wUIUUQSy15GLPo972qctydzDeE'); |
|
|
|
|
|
|
49
|
|
|
|
|
50
|
|
|
$this->assertCount(2, $sp->getAllSingleLogoutServices()); |
|
51
|
|
|
$this->assertCount(3, $sp->getAllAssertionConsumerServices()); |
|
52
|
|
|
$this->assertCount(3, $sp->getAllNameIDFormats()); |
|
53
|
|
|
$this->assertContainsOnly('LightSaml\Model\Metadata\SingleLogoutService', $sp->getAllSingleLogoutServices()); |
|
54
|
|
|
$this->assertContainsOnly('LightSaml\Model\Metadata\AssertionConsumerService', $sp->getAllAssertionConsumerServices()); |
|
55
|
|
|
$this->assertContainsOnly('string', $sp->getAllNameIDFormats()); |
|
56
|
|
|
|
|
57
|
|
|
$this->checkSLO($sp, SamlConstants::BINDING_SAML2_HTTP_REDIRECT, 'https://b1.bead.loc/adfs/ls/'); |
|
|
|
|
|
|
58
|
|
|
$this->checkSLO($sp, SamlConstants::BINDING_SAML2_HTTP_POST, 'https://b1.bead.loc/adfs/ls/'); |
|
|
|
|
|
|
59
|
|
|
|
|
60
|
|
|
$this->assertTrue($sp->hasNameIDFormat(SamlConstants::NAME_ID_FORMAT_EMAIL)); |
|
61
|
|
|
$this->assertTrue($sp->hasNameIDFormat(SamlConstants::NAME_ID_FORMAT_PERSISTENT)); |
|
62
|
|
|
$this->assertTrue($sp->hasNameIDFormat(SamlConstants::NAME_ID_FORMAT_TRANSIENT)); |
|
63
|
|
|
|
|
64
|
|
|
$this->checkACS($sp, SamlConstants::BINDING_SAML2_HTTP_POST, 'https://b1.bead.loc/adfs/ls/', '0', true); |
|
|
|
|
|
|
65
|
|
|
$this->checkACS($sp, SamlConstants::BINDING_SAML2_HTTP_ARTIFACT, 'https://b1.bead.loc/adfs/ls/', '1', false); |
|
|
|
|
|
|
66
|
|
|
$this->checkACS($sp, SamlConstants::BINDING_SAML2_HTTP_REDIRECT, 'https://b1.bead.loc/adfs/ls/', '2', false); |
|
|
|
|
|
|
67
|
|
|
|
|
68
|
|
|
unset($sp); |
|
69
|
|
|
//endregion |
|
70
|
|
|
|
|
71
|
|
|
//region IDP |
|
72
|
|
|
$idp = $ed->getFirstIdpSsoDescriptor(); |
|
73
|
|
|
$this->assertNotNull($idp); |
|
74
|
|
|
$this->assertEquals(SamlConstants::PROTOCOL_SAML2, $idp->getProtocolSupportEnumeration()); |
|
75
|
|
|
|
|
76
|
|
|
$this->checkKD($idp, KeyDescriptor::USE_ENCRYPTION, 'MIIC2DCCAcCgAwIBAgIQGUB7ppqiALBK62Hy+nSDsTANBgkqhkiG9w0BAQsFADAoMSYwJAYDVQQDEx1BREZTIEVuY3J5cHRpb24gLSBCMS5iZWFkLmxvYzAeFw0xMzEwMDkxNDUyMDZaFw0xNDEwMDkxNDUyMDZaMCgxJjAkBgNVBAMTHUFERlMgRW5jcnlwdGlvbiAtIEIxLmJlYWQubG9jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4ngzZI32ekN1jP8f4N6DpF9jBIwAiLi+bMhhz6lc1QpIbxAsbDQqZEeNSXPj548eEbG2K4dCWFdXWM6fjmjf9olYtDZSJe7XsHciBZoNjxRkLoiNkqIJzLT8Eb+G8NRm8oU6NneziJZtIm6Y6bV/fo3q0fX6aAdOAT7gSoFEEmlkw0Uf49XJCGrS4sMfD5gpXeQpcUuislpnEGgN1NfftE/K1sf6Rdx+5TabCAhEo9wKA9D0qkq6rdf1NEnDSur8RJkrhXy7XIX1pmCw70fLs456vksWzj98j3puZ7soOc3yKf+05UjlNy9ZNnNILgiHarcKMIP4Tp7vp9167TVreQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQAKBxeIITIO3bu3ln+pH9djN9MTNCFsm7AU9BULbmj/1kHol73Te/xlS4lBzLUjv2WfSm3fN96lzSwYZY/OIQzz69sSnj0sLnU8eSdk5q5l1l5fhMK05cJsUqJQ6eRWsIdxGkDb3c8pUwpSDu3y+sGRAj7aR8tu4JcvqtvLrBpBHk6eCLdj7D3UeRcTW9bSsfxnxhT1pXVaK8VEVrKSOe26vD6VOnGactYff2gL8a3zouqAKFHQKRA8ogci3zoh8Q7ypApuwEohlUlX7boPQ3trwVA24hor/MfCFZ2GPi3at2F4rX+p0ZGrjWzYt0wUIUUQSy15GLPo972qctydzDeE'); |
|
|
|
|
|
|
77
|
|
|
$this->checkKD($idp, KeyDescriptor::USE_SIGNING, 'MIIC0jCCAbqgAwIBAgIQGFT6omLmWbhAD65bM40rGzANBgkqhkiG9w0BAQsFADAlMSMwIQYDVQQDExpBREZTIFNpZ25pbmcgLSBCMS5iZWFkLmxvYzAeFw0xMzEwMDkxNDUyMDVaFw0xNDEwMDkxNDUyMDVaMCUxIzAhBgNVBAMTGkFERlMgU2lnbmluZyAtIEIxLmJlYWQubG9jMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlGKV64+63lpqdPmCTZ0kt/yKr8xukR1Y071SlmRVV5sSFhTe8cjylPqqxdyEBrfPhpL6vwFQyKfDhuM8T9E+BW5fUdoXO4WmIHrLOxV/BzKv2rDGidlCFzDSQPDxPH2RdQkMBksiauIMSHIYXB92rO4fkcsTgQ6cc+PZp4M3Z/jR1mcxQzz9RQk3I9w2OtI9xcv+uDC5mQU0ZWVHc99VSFQt+zshduwIqxQdHvMdTRslso+oCLEQom42pGCD8TksQTGw4sB7Ctb0mgXdfy0PDIznfi2oDBGtPY2Hkms6/n9xoyCynQea0YYXcpEe7lAvs+t6Lq+ZaKp2kUaa2x8d+QIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBfwlmaN1iPg0gNiqdVphJjWnzpV4h6/Mz3L0xYzNQeglWCDKCKuajQfmo/AQBErtOWZJsP8avzK79gNRqFHXF6CirjGnL6WO+S6Ug1hvy3xouOxOkIYgZsbmcNL2XO1hIxP4z/QWPthotp3FSUTae2hFBHuy4Gtb+9d9a60GDtgrHnfgVeCTE7CSiaI/D/51JNbtpg2tCpcEzMQgPkQqb8E+V79xc0dnEcI5cBaS6eYgkJgS5gKIMbwaJ/VxzCVGIKwFjFnJedJ5N7zH7OVwor56Q7nuKD7X4yFY9XR3isjGnwXveh9E4d9wD4CMl52AHJpsYsToXsi3eRvApDV/PE'); |
|
|
|
|
|
|
78
|
|
|
|
|
79
|
|
|
$this->assertCount(2, $idp->getAllSingleLogoutServices()); |
|
80
|
|
|
$this->assertCount(3, $idp->getAllNameIDFormats()); |
|
81
|
|
|
$this->assertCount(2, $idp->getAllSingleSignOnServices()); |
|
82
|
|
|
|
|
83
|
|
|
$this->assertContainsOnly('LightSaml\Model\Metadata\SingleLogoutService', $idp->getAllSingleLogoutServices()); |
|
84
|
|
|
$this->assertContainsOnly('LightSaml\Model\Metadata\SingleSignOnService', $idp->getAllSingleSignOnServices()); |
|
85
|
|
|
$this->assertContainsOnly('string', $idp->getAllNameIDFormats()); |
|
86
|
|
|
|
|
87
|
|
|
$this->checkSLO($idp, SamlConstants::BINDING_SAML2_HTTP_REDIRECT, 'https://b1.bead.loc/adfs/ls/'); |
|
|
|
|
|
|
88
|
|
|
$this->checkSLO($idp, SamlConstants::BINDING_SAML2_HTTP_POST, 'https://b1.bead.loc/adfs/ls/'); |
|
|
|
|
|
|
89
|
|
|
|
|
90
|
|
|
$this->assertTrue($idp->hasNameIDFormat(SamlConstants::NAME_ID_FORMAT_EMAIL)); |
|
91
|
|
|
$this->assertTrue($idp->hasNameIDFormat(SamlConstants::NAME_ID_FORMAT_PERSISTENT)); |
|
92
|
|
|
$this->assertTrue($idp->hasNameIDFormat(SamlConstants::NAME_ID_FORMAT_TRANSIENT)); |
|
93
|
|
|
|
|
94
|
|
|
$this->checkSSO($idp, SamlConstants::BINDING_SAML2_HTTP_REDIRECT, 'https://b1.bead.loc/adfs/ls/'); |
|
|
|
|
|
|
95
|
|
|
$this->checkSSO($idp, SamlConstants::BINDING_SAML2_HTTP_POST, 'https://b1.bead.loc/adfs/ls/'); |
|
|
|
|
|
|
96
|
|
|
//endregion |
|
97
|
|
|
} |
|
98
|
|
|
|
|
99
|
|
|
public function test__deserialize_formatted_certificate() |
|
100
|
|
|
{ |
|
101
|
|
|
$context = new DeserializationContext(); |
|
102
|
|
|
$context->getDocument()->load(__DIR__.'/../../../../../../resources/sample/EntityDescriptor/ed01-formatted-certificate.xml'); |
|
103
|
|
|
|
|
104
|
|
|
$ed = new EntityDescriptor(); |
|
105
|
|
|
$ed->deserialize($context->getDocument(), $context); |
|
106
|
|
|
|
|
107
|
|
|
$this->assertNotNull($ed->getFirstIdpSsoDescriptor()); |
|
108
|
|
|
|
|
109
|
|
|
$arr = $ed->getFirstIdpSsoDescriptor()->getAllKeyDescriptors(); |
|
110
|
|
|
$this->assertCount(1, $arr); |
|
111
|
|
|
/** @var KeyDescriptor $kd */ |
|
112
|
|
|
$kd = array_shift($arr); |
|
113
|
|
|
$crt = openssl_x509_parse($kd->getCertificate()->toPem()); |
|
114
|
|
|
$this->assertEquals('idp.testshib.org', $crt['subject']['CN']); |
|
115
|
|
|
} |
|
116
|
|
|
|
|
117
|
|
|
public function test_deserialize_engine_surfconext_nl_authentication_idp_metadata() |
|
118
|
|
|
{ |
|
119
|
|
|
$ed = EntityDescriptor::load(__DIR__.'/../../../../../../resources/sample/EntityDescriptor/engine.surfconext.nl_authentication_idp_metadata.xml'); |
|
120
|
|
|
$this->assertEquals('https://engine.surfconext.nl/authentication/idp/metadata', $ed->getEntityID()); |
|
121
|
|
|
} |
|
122
|
|
|
|
|
123
|
|
|
public function test_throws_on_entities_descriptor_document() |
|
124
|
|
|
{ |
|
125
|
|
|
$this->expectExceptionMessage("Expected 'EntityDescriptor' xml node and 'urn:oasis:names:tc:SAML:2.0:metadata' namespace but got node 'EntitiesDescriptor' and namespace 'urn:oasis:names:tc:SAML:2.0:metadata'"); |
|
126
|
|
|
$this->expectException(\LightSaml\Error\LightSamlXmlException::class); |
|
127
|
|
|
EntityDescriptor::load(__DIR__.'/../../../../../../resources/sample/EntitiesDescriptor/testshib-providers.xml'); |
|
128
|
|
|
} |
|
129
|
|
|
|
|
130
|
|
|
private function checkKD(SSODescriptor $descriptor, $use, $certificate) |
|
131
|
|
|
{ |
|
132
|
|
|
$arrKD = $descriptor->getAllKeyDescriptorsByUse($use); |
|
133
|
|
|
/** @var KeyDescriptor $kd */ |
|
134
|
|
|
$kd = array_shift($arrKD); |
|
135
|
|
|
$this->assertNotNull($kd); |
|
136
|
|
|
$this->assertEquals($use, $kd->getUse()); |
|
137
|
|
|
$this->assertNotEmpty($kd->getCertificate()->getData()); |
|
138
|
|
|
$this->assertEquals($certificate, $kd->getCertificate()->getData()); |
|
139
|
|
|
} |
|
140
|
|
|
|
|
141
|
|
View Code Duplication |
private function checkSLO(SSODescriptor $descriptor, $binding, $location) |
|
|
|
|
|
|
142
|
|
|
{ |
|
143
|
|
|
$arr = $descriptor->getAllSingleLogoutServicesByBinding($binding); |
|
144
|
|
|
/** @var SingleLogoutService $svc */ |
|
145
|
|
|
$svc = array_shift($arr); |
|
146
|
|
|
$this->assertNotNull($svc); |
|
147
|
|
|
$this->assertEquals($binding, $svc->getBinding()); |
|
148
|
|
|
$this->assertEquals($location, $svc->getLocation()); |
|
149
|
|
|
} |
|
150
|
|
|
|
|
151
|
|
|
private function checkACS(SpSsoDescriptor $sp, $binding, $location, $index, $isDefault) |
|
152
|
|
|
{ |
|
153
|
|
|
$arr = $sp->getAllAssertionConsumerServicesByBinding($binding); |
|
154
|
|
|
/** @var AssertionConsumerService $svc */ |
|
155
|
|
|
$svc = array_shift($arr); |
|
156
|
|
|
$this->assertNotNull($svc); |
|
157
|
|
|
$this->assertEquals($binding, $svc->getBinding()); |
|
158
|
|
|
$this->assertEquals($location, $svc->getLocation()); |
|
159
|
|
|
$this->assertEquals($index, $svc->getIndex()); |
|
160
|
|
|
$this->assertEquals($isDefault, $svc->getIsDefaultBool()); |
|
161
|
|
|
} |
|
162
|
|
|
|
|
163
|
|
View Code Duplication |
private function checkSSO(IdpSsoDescriptor $idp, $binding, $location) |
|
|
|
|
|
|
164
|
|
|
{ |
|
165
|
|
|
$arr = $idp->getAllSingleSignOnServicesByBinding($binding); |
|
166
|
|
|
/** @var SingleSignOnService $svc */ |
|
167
|
|
|
$svc = array_shift($arr); |
|
168
|
|
|
$this->assertNotNull($svc); |
|
169
|
|
|
$this->assertEquals($binding, $svc->getBinding()); |
|
170
|
|
|
$this->assertEquals($location, $svc->getLocation()); |
|
171
|
|
|
} |
|
172
|
|
|
} |
|
173
|
|
|
|
It seems like the type of the argument is not accepted by the function/method which you are calling.
In some cases, in particular if PHP’s automatic type-juggling kicks in this might be fine. In other cases, however this might be a bug.
We suggest to add an explicit type cast like in the following example: