diff --git a/modules/adfs/lib/IdP/ADFS.php b/modules/adfs/lib/IdP/ADFS.php index 3a28b9243497602ca75a5a8c9524e4ef6c0be8ee..965d37739b1d21b8cf5ec5f6a68c05a95b4a6d54 100644 --- a/modules/adfs/lib/IdP/ADFS.php +++ b/modules/adfs/lib/IdP/ADFS.php @@ -25,14 +25,18 @@ class sspmod_adfs_IdP_ADFS 'adfs:wctx' => $requestid, ); + if (isset($_GET['wreply']) && !empty($_GET['wreply'])) { + $state['adfs:wreply'] = SimpleSAML\Utils\HTTP::checkURLAllowed($_GET['wreply']); + } + $idp->handleAuthenticationRequest($state); } - private static function generateResponse($issuer, $target, $nameid, $attributes) + private static function generateResponse($issuer, $target, $nameid, $attributes, $assertionLifetime) { $issueInstant = SimpleSAML\Utils\Time::generateTimestamp(); $notBefore = SimpleSAML\Utils\Time::generateTimestamp(time() - 30); - $assertionExpire = SimpleSAML\Utils\Time::generateTimestamp(time() + 60 * 5); + $assertionExpire = SimpleSAML\Utils\Time::generateTimestamp(time() + $assertionLifetime); $assertionID = SimpleSAML\Utils\Random::generateID(); $nameidFormat = 'http://schemas.xmlsoap.org/claims/UPN'; $nameid = htmlspecialchars($nameid); @@ -168,7 +172,12 @@ MSG; 'adfs:entityID' => $spEntityId, )); - $response = sspmod_adfs_IdP_ADFS::generateResponse($idpEntityId, $spEntityId, $nameid, $attributes); + $assertionLifetime = $spMetadata->getInteger('assertion.lifetime', null); + if ($assertionLifetime === null) { + $assertionLifetime = $idpMetadata->getInteger('assertion.lifetime', 300); + } + + $response = sspmod_adfs_IdP_ADFS::generateResponse($idpEntityId, $spEntityId, $nameid, $attributes, $assertionLifetime); $privateKeyFile = \SimpleSAML\Utils\Config::getCertPath($idpMetadata->getString('privatekey')); $certificateFile = \SimpleSAML\Utils\Config::getCertPath($idpMetadata->getString('certificate'));