| public static loadPublicKey ( SimpleSAML_Configuration $metadata, boolean $required = false, string $prefix = '' ) : array | null | ||
| $metadata | SimpleSAML_Configuration | The metadata. |
| $required | boolean | Whether the private key is required. If this is TRUE, a missing key will cause an exception. Default is FALSE. |
| $prefix | string | The prefix which should be used when reading from the metadata array. Defaults to ''. |
| return | array | null | Public key or certificate data, or NULL if no public key or certificate was found. |
public static function loadPublicKey(\SimpleSAML_Configuration $metadata, $required = false, $prefix = '')
{
if (!is_bool($required) || !is_string($prefix)) {
throw new \InvalidArgumentException('Invalid input parameters.');
}
$keys = $metadata->getPublicKeys(null, false, $prefix);
if ($keys !== null) {
foreach ($keys as $key) {
if ($key['type'] !== 'X509Certificate') {
continue;
}
if ($key['signing'] !== true) {
continue;
}
$certData = $key['X509Certificate'];
$pem = "-----BEGIN CERTIFICATE-----\n" . chunk_split($certData, 64) . "-----END CERTIFICATE-----\n";
$certFingerprint = strtolower(sha1(base64_decode($certData)));
return array('certData' => $certData, 'PEM' => $pem, 'certFingerprint' => array($certFingerprint));
}
// no valid key found
} elseif ($metadata->hasValue($prefix . 'certFingerprint')) {
// we only have a fingerprint available
$fps = $metadata->getArrayizeString($prefix . 'certFingerprint');
// normalize fingerprint(s) - lowercase and no colons
foreach ($fps as &$fp) {
assert('is_string($fp)');
$fp = strtolower(str_replace(':', '', $fp));
}
// We can't build a full certificate from a fingerprint, and may as well return an array with only the
//fingerprint(s) immediately.
return array('certFingerprint' => $fps);
}
// no public key/certificate available
if ($required) {
throw new \SimpleSAML_Error_Exception('No public key / certificate found in metadata.');
} else {
return null;
}
} $idpmeta = $metadata->getMetaDataConfig($idpentityid, 'saml20-idp-hosted');
$availableCerts = array();
$keys = array();
$certInfo = Crypto::loadPublicKey($idpmeta, false, 'new_');
if ($certInfo !== null) {
$availableCerts['new_idp.crt'] = $certInfo;
$keys[] = array('type' => 'X509Certificate', 'signing' => true, 'encryption' => true, 'X509Certificate' => $certInfo['certData']);
$hasNewCert = true;
} else {
$hasNewCert = false;
}
$certInfo = Crypto::loadPublicKey($idpmeta, true);
$availableCerts['idp.crt'] = $certInfo;
$keys[] = array('type' => 'X509Certificate', 'signing' => true, 'encryption' => $hasNewCert ? false : true, 'X509Certificate' => $certInfo['certData']);
if ($idpmeta->hasValue('https.certificate')) {
$httpsCert = Crypto::loadPublicKey($idpmeta, true, 'https.');
assert('isset($httpsCert["certData"])');
$availableCerts['https.crt'] = $httpsCert;
$keys[] = array('type' => 'X509Certificate', 'signing' => true, 'encryption' => false, 'X509Certificate' => $httpsCert['certData']);
}
$metaArray = array('metadata-set' => 'saml20-idp-remote', 'entityid' => $idpentityid);
$ssob = $metadata->getGenerated('SingleSignOnServiceBinding', 'saml20-idp-hosted');
$slob = $metadata->getGenerated('SingleLogoutServiceBinding', 'saml20-idp-hosted');
$ssol = $metadata->getGenerated('SingleSignOnService', 'saml20-idp-hosted');
$slol = $metadata->getGenerated('SingleLogoutService', 'saml20-idp-hosted');
if (is_array($ssob)) {
foreach ($ssob as $binding) {
$metaArray['SingleSignOnService'][] = array('Binding' => $binding, 'Location' => $ssol);
}
} else {
$metaArray['SingleSignOnService'][] = array('Binding' => $ssob, 'Location' => $ssol);