simplesamlphp / saml2 / 361

pending completion

Build # 361

Build Type

push

travis-ci

Committed by

jaimeperez

Commit Message

<a href="https://github.com/simplesamlphp/saml2/commit/<a class=hub.com/simplesamlphp/saml2/commit/<a class="double-link" href="https://git"><a class=hub.com/simplesamlphp/saml2/commit/<a class="double-link" href="https://git"><a class=hub.com/simplesamlphp/saml2/commit/<a class="double-link" href="https://git"><a class=hub.com/simplesamlphp/saml2/commit/fec412661b1817350f1da91a5722ed8deff61027">fec412661">&lt;a href=&quot;https://github.com/simplesamlphp/saml2/commit/</a><a class="double-link" href="https://github.com/simplesamlphp/saml2/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/simplesamlphp/saml2/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/simplesamlphp/saml2/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/simplesamlphp/saml2/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://git">&lt;a class=</a>hub.com/simplesamlphp/saml2/commit/fec412661b1817350f1da91a5722ed8deff61027">fec412661</a><a href="https://github.com/simplesamlphp/saml2/commit/fec412661b1817350f1da91a5722ed8deff61027">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/simplesamlphp/saml2/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/simplesamlphp/saml2/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/simplesamlphp/saml2/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/simplesamlphp/saml2/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/simplesamlphp/saml2/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/simplesamlphp/saml2/commit/fec412661b1817350f1da91a5722ed8deff61027&quot;&gt;fec412661&lt;/a&gt;&lt;a href=&quot;https://github.com/simplesamlphp/saml2/commit/fec412661b1817350f1da91a5722ed8deff61027&quot;&gt;&amp;quot;&amp;gt;&amp;amp;lt;a href=&amp;amp;quot;https://github.com/simplesamlphp/saml2/commit/&amp;lt;/a&amp;gt;&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://github.com/simples... (continued)

Run Details

1 of 1 new or added line in 1 file covered. (100.0%)

2220 of 4255 relevant lines covered (52.17%)

3.84 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/src/SAML2/SOAPClient.php

<?php

/**
 * Implementation of the SAML 2.0 SOAP binding.
 *
 * @author Shoaib Ali
 * @package SimpleSAMLphp
 */
class SAML2_SOAPClient
{
    const START_SOAP_ENVELOPE = '<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"><soap-env:Header/><soap-env:Body>';
    const END_SOAP_ENVELOPE = '</soap-env:Body></soap-env:Envelope>';

    /**
     * This function sends the SOAP message to the service location and returns SOAP response
     *
     * @param  SAML2_Message            $msg         The request that should be sent.
     * @param  SimpleSAML_Configuration $srcMetadata The metadata of the issuer of the message.
     * @param  SimpleSAML_Configuration $dstMetadata The metadata of the destination of the message.
     * @return SAML2_Message            The response we received.
     * @throws Exception
     */
    public function send(SAML2_Message $msg, SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata = NULL)
    {
        $issuer = $msg->getIssuer();

        $ctxOpts = array(
            'ssl' => array(
                'capture_peer_cert' => TRUE,
            ),
        );

        // Determine if we are going to do a MutualSSL connection between the IdP and SP  - Shoaib
        if ($srcMetadata->hasValue('saml.SOAPClient.certificate')) {
            $cert = $srcMetadata->getValue('saml.SOAPClient.certificate');
            if ($cert !== FALSE) {
                $ctxOpts['ssl']['local_cert'] = SimpleSAML_Utilities::resolveCert(
                    $srcMetadata->getString('saml.SOAPClient.certificate')
                );
                if ($srcMetadata->hasValue('saml.SOAPClient.privatekey_pass')) {
                    $ctxOpts['ssl']['passphrase'] = $srcMetadata->getString('saml.SOAPClient.privatekey_pass');
                }
            }
        } else {
            /* Use the SP certificate and privatekey if it is configured. */
            $privateKey = SimpleSAML_Utilities::loadPrivateKey($srcMetadata);
            $publicKey = SimpleSAML_Utilities::loadPublicKey($srcMetadata);
            if ($privateKey !== NULL && $publicKey !== NULL && isset($publicKey['PEM'])) {
                $keyCertData = $privateKey['PEM'] . $publicKey['PEM'];
                $file = SimpleSAML_Utilities::getTempDir() . '/' . sha1($keyCertData) . '.pem';
                if (!file_exists($file)) {
                    SimpleSAML_Utilities::writeFile($file, $keyCertData);
                }
                $ctxOpts['ssl']['local_cert'] = $file;
                if (isset($privateKey['password'])) {
                    $ctxOpts['ssl']['passphrase'] = $privateKey['password'];
                }
            }
        }

        // do peer certificate verification
        if ($dstMetadata !== NULL) {
            $peerPublicKeys = $dstMetadata->getPublicKeys('signing', TRUE);
            $certData = '';
            foreach ($peerPublicKeys as $key) {
                if ($key['type'] !== 'X509Certificate') {
                    continue;
                }
                $certData .= "-----BEGIN CERTIFICATE-----\n" .
                    chunk_split($key['X509Certificate'], 64) .
                    "-----END CERTIFICATE-----\n";
            }
            $peerCertFile = SimpleSAML_Utilities::getTempDir() . '/' . sha1($certData) . '.pem';
            if (!file_exists($peerCertFile)) {
                SimpleSAML_Utilities::writeFile($peerCertFile, $certData);
            }
            // create ssl context
            $ctxOpts['ssl']['verify_peer'] = TRUE;
            $ctxOpts['ssl']['verify_depth'] = 1;
            $ctxOpts['ssl']['cafile'] = $peerCertFile;
        }

        $context = stream_context_create($ctxOpts);
        if ($context === NULL) {
            throw new Exception('Unable to create SSL stream context');
        }

        $options = array(
            'uri' => $issuer,
            'location' => $msg->getDestination(),
            'stream_context' => $context,
        );

        if ($srcMetadata->hasValue('saml.SOAPClient.proxyhost')) {
            $options['proxy_host'] = $srcMetadata->getValue('saml.SOAPClient.proxyhost');
        }

        if ($srcMetadata->hasValue('saml.SOAPClient.proxyport')) {
            $options['proxy_port'] = $srcMetadata->getValue('saml.SOAPClient.proxyport');
        }

        $x = new SoapClient(NULL, $options);

        // Add soap-envelopes
        $request = $msg->toSignedXML();
        $request = self::START_SOAP_ENVELOPE . $request->ownerDocument->saveXML($request) . self::END_SOAP_ENVELOPE;

        SAML2_Utils::getContainer()->debugMessage($request, 'out');

        $action = 'http://www.oasis-open.org/committees/security';
        $version = '1.1';
        $destination = $msg->getDestination();

        /* Perform SOAP Request over HTTP */
        $soapresponsexml = $x->__doRequest($request, $destination, $action, $version);
        if ($soapresponsexml === NULL || $soapresponsexml === "") {
            throw new Exception('Empty SOAP response, check peer certificate.');
        }

        SAML2_Utils::getContainer()->debugMessage($soapresponsexml, 'in');

        // Convert to SAML2_Message (DOMElement)
        try {
            $dom = SAML2_DOMDocumentFactory::fromString($soapresponsexml);
        } catch (SAML2_Exception_RuntimeException $e) {
            throw new Exception('Not a SOAP response.', 0, $e);
        }

        $soapfault = $this->getSOAPFault($dom);
        if (isset($soapfault)) {
            throw new Exception($soapfault);
        }
        //Extract the message from the response
        $samlresponse = SAML2_Utils::xpQuery($dom->firstChild, '/soap-env:Envelope/soap-env:Body/*[1]');
        $samlresponse = SAML2_Message::fromXML($samlresponse[0]);

        /* Add validator to message which uses the SSL context. */
        self::addSSLValidator($samlresponse, $context);

        SAML2_Utils::getContainer()->getLogger()->debug("Valid ArtifactResponse received from IdP");

        return $samlresponse;

    }

    /**
     * Add a signature validator based on a SSL context.
     *
     * @param SAML2_Message $msg     The message we should add a validator to.
     * @param resource      $context The stream context.
     */
    private static function addSSLValidator(SAML2_Message $msg, $context)
    {
        $options = stream_context_get_options($context);
        if (!isset($options['ssl']['peer_certificate'])) {
            return;
        }

        //$out = '';
        //openssl_x509_export($options['ssl']['peer_certificate'], $out);

        $key = openssl_pkey_get_public($options['ssl']['peer_certificate']);
        if ($key === FALSE) {
            SAML2_Utils::getContainer()->getLogger()->warning('Unable to get public key from peer certificate.');

            return;
        }

        $keyInfo = openssl_pkey_get_details($key);
        if ($keyInfo === FALSE) {
            SAML2_Utils::getContainer()->getLogger()->warning('Unable to get key details from public key.');

            return;
        }

        if (!isset($keyInfo['key'])) {
            SAML2_Utils::getContainer()->getLogger()->warning('Missing key in public key details.');

            return;
        }

        $msg->addValidator(array('SAML2_SOAPClient', 'validateSSL'), $keyInfo['key']);
    }

    /**
     * Validate a SOAP message against the certificate on the SSL connection.
     *
     * @param string         $data The public key that was used on the connection.
     * @param XMLSecurityKey $key  The key we should validate the certificate against.
     * @throws Exception
     */
    public static function validateSSL($data, XMLSecurityKey $key)
    {
        assert('is_string($data)');

        $keyInfo = openssl_pkey_get_details($key->key);
        if ($keyInfo === FALSE) {
            throw new Exception('Unable to get key details from XMLSecurityKey.');
        }

        if (!isset($keyInfo['key'])) {
            throw new Exception('Missing key in public key details.');
        }

        if ($keyInfo['key'] !== $data) {
            SAML2_Utils::getContainer()->getLogger()->debug('Key on SSL connection did not match key we validated against.');

            return;
        }

        SAML2_Utils::getContainer()->getLogger()->debug('Message validated based on SSL certificate.');
    }

    /*
     * Extracts the SOAP Fault from SOAP message
     * @param $soapmessage Soap response needs to be type DOMDocument
     * @return $soapfaultstring string|NULL
     */
    private function getSOAPFault($soapMessage)
    {
        $soapFault = SAML2_Utils::xpQuery($soapMessage->firstChild, '/soap-env:Envelope/soap-env:Body/soap-env:Fault');

        if (empty($soapFault)) {
            /* No fault. */

            return NULL;
        }
        $soapFaultElement = $soapFault[0];
        // There is a fault element but we haven't found out what the fault string is
        $soapFaultString = "Unknown fault string found";
        // find out the fault string
        $faultStringElement =   SAML2_Utils::xpQuery($soapFaultElement, './soap-env:faultstring') ;
        if (!empty($faultStringElement)) {
            return $faultStringElement[0]->textContent;
        }

        return $soapFaultString;
    }

}

1	<?php
2
3	/**
4	* Implementation of the SAML 2.0 SOAP binding.
5	*
6	* @author Shoaib Ali
7	* @package SimpleSAMLphp
8	*/
9	class SAML2_SOAPClient
10	{
11	const START_SOAP_ENVELOPE = '<soap-env:Envelope xmlns:soap-env="http://schemas.xmlsoap.org/soap/envelope/"><soap-env:Header/><soap-env:Body>';
12	const END_SOAP_ENVELOPE = '</soap-env:Body></soap-env:Envelope>';
13
14	/**
15	* This function sends the SOAP message to the service location and returns SOAP response
16	*
17	* @param SAML2_Message $msg The request that should be sent.
18	* @param SimpleSAML_Configuration $srcMetadata The metadata of the issuer of the message.
19	* @param SimpleSAML_Configuration $dstMetadata The metadata of the destination of the message.
20	* @return SAML2_Message The response we received.
21	* @throws Exception
22	*/
23	public function send(SAML2_Message $msg, SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata = NULL)
24	{
25	$issuer = $msg->getIssuer();	×
26
27	$ctxOpts = array(
28	'ssl' => array(
29	'capture_peer_cert' => TRUE,	×
30	),	×
31	);	×
32
33	// Determine if we are going to do a MutualSSL connection between the IdP and SP - Shoaib
34	if ($srcMetadata->hasValue('saml.SOAPClient.certificate')) {	×
35	$cert = $srcMetadata->getValue('saml.SOAPClient.certificate');	×
36	if ($cert !== FALSE) {	×
37	$ctxOpts['ssl']['local_cert'] = SimpleSAML_Utilities::resolveCert(	×
38	$srcMetadata->getString('saml.SOAPClient.certificate')	×
39	);	×
40	if ($srcMetadata->hasValue('saml.SOAPClient.privatekey_pass')) {	×
41	$ctxOpts['ssl']['passphrase'] = $srcMetadata->getString('saml.SOAPClient.privatekey_pass');	×
42	}	×
43	}	×
44	} else {	×
45	/* Use the SP certificate and privatekey if it is configured. */
46	$privateKey = SimpleSAML_Utilities::loadPrivateKey($srcMetadata);	×
47	$publicKey = SimpleSAML_Utilities::loadPublicKey($srcMetadata);	×
48	if ($privateKey !== NULL && $publicKey !== NULL && isset($publicKey['PEM'])) {	×
49	$keyCertData = $privateKey['PEM'] . $publicKey['PEM'];	×
50	$file = SimpleSAML_Utilities::getTempDir() . '/' . sha1($keyCertData) . '.pem';	×
51	if (!file_exists($file)) {	×
52	SimpleSAML_Utilities::writeFile($file, $keyCertData);	×
53	}	×
54	$ctxOpts['ssl']['local_cert'] = $file;	×
55	if (isset($privateKey['password'])) {	×
56	$ctxOpts['ssl']['passphrase'] = $privateKey['password'];	×
57	}	×
58	}	×
59	}
60
61	// do peer certificate verification
62	if ($dstMetadata !== NULL) {	×
63	$peerPublicKeys = $dstMetadata->getPublicKeys('signing', TRUE);	×
64	$certData = '';	×
65	foreach ($peerPublicKeys as $key) {	×
66	if ($key['type'] !== 'X509Certificate') {	×
67	continue;	×
68	}
69	$certData .= "-----BEGIN CERTIFICATE-----\n" .
70	chunk_split($key['X509Certificate'], 64) .	×
71	"-----END CERTIFICATE-----\n";	×
72	}	×
73	$peerCertFile = SimpleSAML_Utilities::getTempDir() . '/' . sha1($certData) . '.pem';	×
74	if (!file_exists($peerCertFile)) {	×
75	SimpleSAML_Utilities::writeFile($peerCertFile, $certData);	×
76	}	×
77	// create ssl context
78	$ctxOpts['ssl']['verify_peer'] = TRUE;	×
79	$ctxOpts['ssl']['verify_depth'] = 1;	×
80	$ctxOpts['ssl']['cafile'] = $peerCertFile;	×
81	}	×
82
83	$context = stream_context_create($ctxOpts);	×
84	if ($context === NULL) {	×
85	throw new Exception('Unable to create SSL stream context');	×
86	}
87
88	$options = array(
89	'uri' => $issuer,	×
90	'location' => $msg->getDestination(),	×
91	'stream_context' => $context,	×
92	);	×
93
94	if ($srcMetadata->hasValue('saml.SOAPClient.proxyhost')) {	×
95	$options['proxy_host'] = $srcMetadata->getValue('saml.SOAPClient.proxyhost');	×
96	}	×
97
98	if ($srcMetadata->hasValue('saml.SOAPClient.proxyport')) {	×
99	$options['proxy_port'] = $srcMetadata->getValue('saml.SOAPClient.proxyport');	×
100	}	×
101
102	$x = new SoapClient(NULL, $options);	×
103
104	// Add soap-envelopes
105	$request = $msg->toSignedXML();	×
106	$request = self::START_SOAP_ENVELOPE . $request->ownerDocument->saveXML($request) . self::END_SOAP_ENVELOPE;	×
107
108	SAML2_Utils::getContainer()->debugMessage($request, 'out');	×
109
110	$action = 'http://www.oasis-open.org/committees/security';	×
111	$version = '1.1';	×
112	$destination = $msg->getDestination();	×
113
114	/* Perform SOAP Request over HTTP */
115	$soapresponsexml = $x->__doRequest($request, $destination, $action, $version);	×
116	if ($soapresponsexml === NULL \|\| $soapresponsexml === "") {	×
117	throw new Exception('Empty SOAP response, check peer certificate.');	×
118	}
119
120	SAML2_Utils::getContainer()->debugMessage($soapresponsexml, 'in');	×
121
122	// Convert to SAML2_Message (DOMElement)
123	try {
124	$dom = SAML2_DOMDocumentFactory::fromString($soapresponsexml);	×
125	} catch (SAML2_Exception_RuntimeException $e) {	×
126	throw new Exception('Not a SOAP response.', 0, $e);	×
127	}
128
129	$soapfault = $this->getSOAPFault($dom);	×
130	if (isset($soapfault)) {	×
131	throw new Exception($soapfault);	×
132	}
133	//Extract the message from the response
134	$samlresponse = SAML2_Utils::xpQuery($dom->firstChild, '/soap-env:Envelope/soap-env:Body/*[1]');	×
135	$samlresponse = SAML2_Message::fromXML($samlresponse[0]);	×
136
137	/* Add validator to message which uses the SSL context. */
138	self::addSSLValidator($samlresponse, $context);	×
139
140	SAML2_Utils::getContainer()->getLogger()->debug("Valid ArtifactResponse received from IdP");	×
141
142	return $samlresponse;	×
143
144	}
145
146	/**
147	* Add a signature validator based on a SSL context.
148	*
149	* @param SAML2_Message $msg The message we should add a validator to.
150	* @param resource $context The stream context.
151	*/
152	private static function addSSLValidator(SAML2_Message $msg, $context)
153	{
154	$options = stream_context_get_options($context);	×
155	if (!isset($options['ssl']['peer_certificate'])) {	×
156	return;	×
157	}
158
159	//$out = '';
160	//openssl_x509_export($options['ssl']['peer_certificate'], $out);
161
162	$key = openssl_pkey_get_public($options['ssl']['peer_certificate']);	×
163	if ($key === FALSE) {	×
164	SAML2_Utils::getContainer()->getLogger()->warning('Unable to get public key from peer certificate.');	×
165
166	return;	×
167	}
168
169	$keyInfo = openssl_pkey_get_details($key);	×
170	if ($keyInfo === FALSE) {	×
171	SAML2_Utils::getContainer()->getLogger()->warning('Unable to get key details from public key.');	×
172
173	return;	×
174	}
175
176	if (!isset($keyInfo['key'])) {	×
177	SAML2_Utils::getContainer()->getLogger()->warning('Missing key in public key details.');	×
178
179	return;	×
180	}
181
182	$msg->addValidator(array('SAML2_SOAPClient', 'validateSSL'), $keyInfo['key']);	×
183	}	×
184
185	/**
186	* Validate a SOAP message against the certificate on the SSL connection.
187	*
188	* @param string $data The public key that was used on the connection.
189	* @param XMLSecurityKey $key The key we should validate the certificate against.
190	* @throws Exception
191	*/
192	public static function validateSSL($data, XMLSecurityKey $key)
193	{
194	assert('is_string($data)');	×
195
196	$keyInfo = openssl_pkey_get_details($key->key);	×
197	if ($keyInfo === FALSE) {	×
198	throw new Exception('Unable to get key details from XMLSecurityKey.');	×
199	}
200
201	if (!isset($keyInfo['key'])) {	×
202	throw new Exception('Missing key in public key details.');	×
203	}
204
205	if ($keyInfo['key'] !== $data) {	×
206	SAML2_Utils::getContainer()->getLogger()->debug('Key on SSL connection did not match key we validated against.');	×
207
208	return;	×
209	}
210
211	SAML2_Utils::getContainer()->getLogger()->debug('Message validated based on SSL certificate.');	×
212	}	×
213
214	/*
215	* Extracts the SOAP Fault from SOAP message
216	* @param $soapmessage Soap response needs to be type DOMDocument
217	* @return $soapfaultstring string\|NULL
218	*/
219	private function getSOAPFault($soapMessage)
220	{
221	$soapFault = SAML2_Utils::xpQuery($soapMessage->firstChild, '/soap-env:Envelope/soap-env:Body/soap-env:Fault');	×
222
223	if (empty($soapFault)) {	×
224	/* No fault. */
225
226	return NULL;	×
227	}
228	$soapFaultElement = $soapFault[0];	×
229	// There is a fault element but we haven't found out what the fault string is
230	$soapFaultString = "Unknown fault string found";	×
231	// find out the fault string
232	$faultStringElement = SAML2_Utils::xpQuery($soapFaultElement, './soap-env:faultstring') ;	×
233	if (!empty($faultStringElement)) {	×
234	return $faultStringElement[0]->textContent;	×
235	}
236
237	return $soapFaultString;	×
238	}
239
240	}

simplesamlphp / saml2 / 361

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous