saml: Verify that we have at least one AuthnStatement in the response.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2728 44740490-163a-0410-bde0-09ae8108e29a

modules/saml/www/sp/saml2-acs.php

@@ -60,6 +60,7 @@ $nameId = NULL;
 $sessionIndex = NULL;
 $expire = NULL;
 $attributes = array();
+$foundAuthnStatement = FALSE;
 foreach ($assertions as $assertion) {
 
 	/* Check for duplicate assertion (replay attack). */
@@ -96,6 +97,16 @@ foreach ($assertions as $assertion) {
 	}
 
 	$attributes = array_merge($attributes, $assertion->getAttributes());
+
+	if ($assertion->getAuthnInstant() !== NULL) {
+		/* Assertion contains AuthnStatement, since AuthnInstant is a required attribute. */
+		$foundAuthnStatement = TRUE;
+	}
+}
+
+if (!$foundAuthnStatement) {
+	$e = new SimpleSAML_Error_Exception('No AuthnStatement found in assertion(s).');
+	SimpleSAML_Auth_State::throwException($state, $e);
 }
 
 if ($expire === NULL) {