SimpleSAML_XML_Shib13_AuthnResponse::getAttributes PHP Method

getAttributes() public method

public getAttributes ( )
    public function getAttributes()
    {
        $metadata = SimpleSAML_Metadata_MetaDataStorageHandler::getMetadataHandler();
        $md = $metadata->getMetadata($this->getIssuer(), 'shib13-idp-remote');
        $base64 = isset($md['base64attributes']) ? $md['base64attributes'] : false;
        if (!$this->dom instanceof DOMDocument) {
            return array();
        }
        $attributes = array();
        $assertions = $this->doXPathQuery('/shibp:Response/shib:Assertion');
        foreach ($assertions as $assertion) {
            if (!$this->isNodeValidated($assertion)) {
                throw new Exception('Shib13 AuthnResponse contained an unsigned assertion.');
            }
            $conditions = $this->doXPathQuery('shib:Conditions', $assertion);
            if ($conditions && $conditions->length > 0) {
                $condition = $conditions->item(0);
                $start = $condition->getAttribute('NotBefore');
                $end = $condition->getAttribute('NotOnOrAfter');
                if ($start && $end) {
                    if (!self::checkDateConditions($start, $end)) {
                        error_log('Date check failed ... (from ' . $start . ' to ' . $end . ')');
                        continue;
                    }
                }
            }
            $attribute_nodes = $this->doXPathQuery('shib:AttributeStatement/shib:Attribute/shib:AttributeValue', $assertion);
            foreach ($attribute_nodes as $attribute) {
                $value = $attribute->textContent;
                $name = $attribute->parentNode->getAttribute('AttributeName');
                if ($attribute->hasAttribute('Scope')) {
                    $scopePart = '@' . $attribute->getAttribute('Scope');
                } else {
                    $scopePart = '';
                }
                if (!is_string($name)) {
                    throw new Exception('Shib13 Attribute node without an AttributeName.');
                }
                if (!array_key_exists($name, $attributes)) {
                    $attributes[$name] = array();
                }
                if ($base64) {
                    $encodedvalues = explode('_', $value);
                    foreach ($encodedvalues as $v) {
                        $attributes[$name][] = base64_decode($v) . $scopePart;
                    }
                } else {
                    $attributes[$name][] = $value . $scopePart;
                }
            }
        }
        return $attributes;
    }

Usage Example

Example #1
0
$spMetadata = $source->getMetadata();
if (array_key_exists('SAMLart', $_REQUEST)) {
    if (!isset($state['saml:idp'])) {
        /* Unsolicited response. */
        throw new SimpleSAML_Error_Exception('IdP initiated authentication not supported with the SAML 1.1 SAMLart protocol.');
    }
    $idpMetadata = $source->getIdPMetadata($state['saml:idp']);
    $responseXML = SimpleSAML_Bindings_Shib13_Artifact::receive($spMetadata, $idpMetadata);
    $isValidated = TRUE;
    /* Artifact binding validated with ssl certificate. */
} elseif (array_key_exists('SAMLResponse', $_REQUEST)) {
    $responseXML = $_REQUEST['SAMLResponse'];
    $responseXML = base64_decode($responseXML);
    $isValidated = FALSE;
    /* Must check signature on response. */
} else {
    assert('FALSE');
}
$response = new SimpleSAML_XML_Shib13_AuthnResponse();
$response->setXML($responseXML);
$response->setMessageValidated($isValidated);
$response->validate();
$responseIssuer = $response->getIssuer();
$attributes = $response->getAttributes();
if (isset($state['saml:idp']) && $responseIssuer !== $state['saml:idp']) {
    throw new SimpleSAML_Error_Exception('The issuer of the response wasn\'t the destination of the request.');
}
$logoutState = array('saml:logout:Type' => 'saml1');
$state['LogoutState'] = $logoutState;
$source->handleResponse($state, $responseIssuer, $attributes);
assert('FALSE');