Skip to content

Commit 4210bc8

Browse files
pitbulkpitbulk
authored
Merge pull request #192 from sproogen/master
Added ability to configure DigestAlgorithm in settings
2 parents 5099e97 + c4dc1fb commit 4210bc8

4 files changed

Lines changed: 81 additions & 6 deletions

File tree

‎advanced_settings_example.php‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,13 @@
8585
// 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha512'
8686
'signatureAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
8787

88+
// Algorithm that the toolkit will use on digest process. Options:
89+
// 'http://www.w3.org/2000/09/xmldsig#sha1'
90+
// 'http://www.w3.org/2001/04/xmlenc#sha256'
91+
// 'http://www.w3.org/2001/04/xmldsig-more#sha384'
92+
// 'http://www.w3.org/2001/04/xmlenc#sha512'
93+
'digestAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#sha1',
94+
8895
// ADFS URL-Encodes SAML data as lowercase, and the toolkit by default uses
8996
// uppercase. Turn it True for ADFS compatibility on signature verification
9097
'lowercaseUrlencoding' => false,

‎lib/Saml2/Settings.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -384,11 +384,16 @@ private function _addDefaultValues()
384384
$this->_security['wantXMLValidation'] = true;
385385
}
386386

387-
// Algorithm
387+
// SignatureAlgorithm
388388
if (!isset($this->_security['signatureAlgorithm'])) {
389389
$this->_security['signatureAlgorithm'] = XMLSecurityKey::RSA_SHA1;
390390
}
391391

392+
// DigestAlgorithm
393+
if (!isset($this->_security['digestAlgorithm'])) {
394+
$this->_security['digestAlgorithm'] = XMLSecurityDSig::SHA1;
395+
}
396+
392397
if (!isset($this->_security['lowercaseUrlencoding'])) {
393398
$this->_security['lowercaseUrlencoding'] = false;
394399
}
@@ -835,7 +840,8 @@ public function getSPMetadata()
835840
}
836841

837842
$signatureAlgorithm = $this->_security['signatureAlgorithm'];
838-
$metadata = OneLogin_Saml2_Metadata::signMetadata($metadata, $keyMetadata, $certMetadata, $signatureAlgorithm);
843+
$digestAlgorithm = $this->_security['digestAlgorithm'];
844+
$metadata = OneLogin_Saml2_Metadata::signMetadata($metadata, $keyMetadata, $certMetadata, $signatureAlgorithm, $digestAlgorithm);
839845
}
840846
return $metadata;
841847
}

‎tests/src/OneLogin/Saml2/MetadataTest.php‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -159,6 +159,58 @@ public function testSignMetadata()
159159
}
160160
}
161161

162+
/**
163+
* Tests the signMetadata method of the OneLogin_Saml2_Metadata
164+
*
165+
* @covers OneLogin_Saml2_Metadata::signMetadata
166+
*/
167+
public function testSignMetadataDefaultAlgorithms()
168+
{
169+
$settingsDir = TEST_ROOT .'/settings/';
170+
include $settingsDir.'settings1.php';
171+
172+
$settings = new OneLogin_Saml2_Settings($settingsInfo);
173+
$spData = $settings->getSPData();
174+
$security = $settings->getSecurityData();
175+
176+
$metadata = OneLogin_Saml2_Metadata::builder($spData, $security['authnRequestsSigned'], $security['wantAssertionsSigned']);
177+
178+
$certPath = $settings->getCertPath();
179+
$key = file_get_contents($certPath.'sp.key');
180+
$cert = file_get_contents($certPath.'sp.crt');
181+
182+
$signedMetadata = OneLogin_Saml2_Metadata::signMetadata($metadata, $key, $cert);
183+
184+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>', $signedMetadata);
185+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>', $signedMetadata);
186+
}
187+
188+
/**
189+
* Tests the signMetadata method of the OneLogin_Saml2_Metadata
190+
*
191+
* @covers OneLogin_Saml2_Metadata::signMetadata
192+
*/
193+
public function testSignMetadataCustomAlgorithms()
194+
{
195+
$settingsDir = TEST_ROOT .'/settings/';
196+
include $settingsDir.'settings1.php';
197+
198+
$settings = new OneLogin_Saml2_Settings($settingsInfo);
199+
$spData = $settings->getSPData();
200+
$security = $settings->getSecurityData();
201+
202+
$metadata = OneLogin_Saml2_Metadata::builder($spData, $security['authnRequestsSigned'], $security['wantAssertionsSigned']);
203+
204+
$certPath = $settings->getCertPath();
205+
$key = file_get_contents($certPath.'sp.key');
206+
$cert = file_get_contents($certPath.'sp.crt');
207+
208+
$signedMetadata = OneLogin_Saml2_Metadata::signMetadata($metadata, $key, $cert, XMLSecurityKey::RSA_SHA256, XMLSecurityDSig::SHA512);
209+
210+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>', $signedMetadata);
211+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>', $signedMetadata);
212+
}
213+
162214
/**
163215
* Tests the addX509KeyDescriptors method of the OneLogin_Saml2_Metadata
164216
*

‎tests/src/OneLogin/Saml2/UtilsTest.php‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1056,39 +1056,49 @@ public function testAddSign()
10561056
$xmlAuthn = base64_decode(file_get_contents(TEST_ROOT . '/data/requests/authn_request.xml.base64'));
10571057
$xmlAuthnSigned = OneLogin_Saml2_Utils::addSign($xmlAuthn, $key, $cert);
10581058
$this->assertContains('<ds:SignatureValue>', $xmlAuthnSigned);
1059+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>', $xmlAuthnSigned);
1060+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>', $xmlAuthnSigned);
10591061
$res = new DOMDocument();
10601062
$res->loadXML($xmlAuthnSigned);
10611063
$dsSignature = $res->firstChild->firstChild->nextSibling->nextSibling;
10621064
$this->assertContains('ds:Signature', $dsSignature->tagName);
10631065

10641066
$dom = new DOMDocument();
10651067
$dom->loadXML($xmlAuthn);
1066-
$xmlAuthnSigned2 = OneLogin_Saml2_Utils::addSign($dom, $key, $cert);
1068+
$xmlAuthnSigned2 = OneLogin_Saml2_Utils::addSign($dom, $key, $cert, XMLSecurityKey::RSA_SHA256, XMLSecurityDSig::SHA512);
10671069
$this->assertContains('<ds:SignatureValue>', $xmlAuthnSigned2);
1070+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>', $xmlAuthnSigned2);
1071+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>', $xmlAuthnSigned2);
10681072
$res2 = new DOMDocument();
10691073
$res2->loadXML($xmlAuthnSigned2);
10701074
$dsSignature2 = $res2->firstChild->firstChild->nextSibling->nextSibling;
10711075
$this->assertContains('ds:Signature', $dsSignature2->tagName);
10721076

10731077
$xmlLogoutReq = base64_decode(file_get_contents(TEST_ROOT . '/data/logout_requests/logout_request.xml.base64'));
1074-
$xmlLogoutReqSigned = OneLogin_Saml2_Utils::addSign($xmlLogoutReq, $key, $cert);
1078+
$xmlLogoutReqSigned = OneLogin_Saml2_Utils::addSign($xmlLogoutReq, $key, $cert, XMLSecurityKey::RSA_SHA256, XMLSecurityDSig::SHA512);
10751079
$this->assertContains('<ds:SignatureValue>', $xmlLogoutReqSigned);
1080+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>', $xmlLogoutReqSigned);
1081+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>', $xmlLogoutReqSigned);
10761082
$res3 = new DOMDocument();
10771083
$res3->loadXML($xmlLogoutReqSigned);
10781084
$dsSignature3 = $res3->firstChild->firstChild->nextSibling->nextSibling;
10791085
$this->assertContains('ds:Signature', $dsSignature3->tagName);
10801086

10811087
$xmlLogoutRes = base64_decode(file_get_contents(TEST_ROOT . '/data/logout_responses/logout_response.xml.base64'));
1082-
$xmlLogoutResSigned = OneLogin_Saml2_Utils::addSign($xmlLogoutRes, $key, $cert);
1088+
$xmlLogoutResSigned = OneLogin_Saml2_Utils::addSign($xmlLogoutRes, $key, $cert, XMLSecurityKey::RSA_SHA256, XMLSecurityDSig::SHA512);
10831089
$this->assertContains('<ds:SignatureValue>', $xmlLogoutResSigned);
1090+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>', $xmlLogoutResSigned);
1091+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>', $xmlLogoutResSigned);
10841092
$res4 = new DOMDocument();
10851093
$res4->loadXML($xmlLogoutResSigned);
10861094
$dsSignature4 = $res4->firstChild->firstChild->nextSibling->nextSibling;
10871095
$this->assertContains('ds:Signature', $dsSignature4->tagName);
10881096

10891097
$xmlMetadata = file_get_contents(TEST_ROOT . '/data/metadata/metadata_settings1.xml');
1090-
$xmlMetadataSigned = OneLogin_Saml2_Utils::addSign($xmlMetadata, $key, $cert);
1098+
$xmlMetadataSigned = OneLogin_Saml2_Utils::addSign($xmlMetadata, $key, $cert, XMLSecurityKey::RSA_SHA256, XMLSecurityDSig::SHA512);
10911099
$this->assertContains('<ds:SignatureValue>', $xmlMetadataSigned);
1100+
$this->assertContains('<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>', $xmlMetadataSigned);
1101+
$this->assertContains('<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>', $xmlMetadataSigned);
10921102
$res5 = new DOMDocument();
10931103
$res5->loadXML($xmlMetadataSigned);
10941104
$dsSignature5 = $res5->firstChild->firstChild;

0 commit comments

Comments
 (0)