diff --git a/docs/source/simplesamlphp-sp.xml b/docs/source/simplesamlphp-sp.xml index d1437a4dc71cec1733820241032e8ca5f959cbcc..4b7821f055c4ad6cf5621aeae40cdea9b34024f4 100644 --- a/docs/source/simplesamlphp-sp.xml +++ b/docs/source/simplesamlphp-sp.xml @@ -157,6 +157,13 @@ <para>The NameIDFormat in the request. If you don't know what this is, or don't need it to be anything specific, leave it with the default configuration.</para> + + <para>If you leave out this entry, the default value + <literal>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</literal> + would be used in the authentication request. If you set the + value to <code>null</code>, the + <literal>samlp:NameIDPolicy</literal> element would be + completely removed from the request.</para> </glossdef> </glossentry> diff --git a/lib/SimpleSAML/XML/SAML20/AuthnRequest.php b/lib/SimpleSAML/XML/SAML20/AuthnRequest.php index e479227478bdd628293b6d501d88568acc08909e..2b9f36a2e6da2988a449ef5e4d961ef52fa99ed2 100644 --- a/lib/SimpleSAML/XML/SAML20/AuthnRequest.php +++ b/lib/SimpleSAML/XML/SAML20/AuthnRequest.php @@ -125,12 +125,20 @@ class SimpleSAML_XML_SAML20_AuthnRequest { * Process the SAML 2.0 SP hosted metadata parameter: NameIDFormat */ $nameidformat = 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'; - if (isset($md['NameIDFormat'])) { - if (!is_string($md['NameIDFormat'])) { + $includeNameIDPolicy = true; + if (array_key_exists('NameIDFormat', $md)) { + if (is_null($md['NameIDFormat'])) { + $includeNameIDPolicy = false; + } elseif (!is_string($md['NameIDFormat'])) { throw new Exception('SAML 2.0 SP hosted metadata parameter [NameIDFormat] must be a string.'); + } else { + $nameidformat = $md['NameIDFormat']; } - $nameidformat = $md['NameIDFormat']; } + if ($includeNameIDPolicy) { + $nameIDPolicy = $this->generateNameIDPolicy($nameidformat); + } + /* * Process the SAML 2.0 SP hosted metadata parameter: ForceAuthn @@ -158,6 +166,8 @@ class SimpleSAML_XML_SAML20_AuthnRequest { </samlp:RequestedAuthnContext>'; } + + /* * Create the complete SAML 2.0 Authentication Request */ @@ -169,9 +179,7 @@ class SimpleSAML_XML_SAML20_AuthnRequest { ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="' . htmlspecialchars($assertionConsumerServiceURL) . '"> <saml:Issuer >' . htmlspecialchars($spentityid) . '</saml:Issuer> - <samlp:NameIDPolicy - Format="' . htmlspecialchars($nameidformat) . '" - AllowCreate="true"/> + ' . $nameIDPolicy . ' ' . $requestauthncontext . ' </samlp:AuthnRequest> '; @@ -179,6 +187,16 @@ class SimpleSAML_XML_SAML20_AuthnRequest { return $authnRequest; } + /** + * Generate a NameIDPoliy element + * + * @param $nameidformat NameIDFormat. + */ + public function generateNameIDPolicy($nameidformat) { + return '<samlp:NameIDPolicy + Format="' . htmlspecialchars($nameidformat) . '" + AllowCreate="true" />'; + } }