diff --git a/docs/simplesamlphp-changelog.md b/docs/simplesamlphp-changelog.md index 3e1f8ec3a8debf367b5e22bca99f60c8f3763d87..e5e74f655424e250feaf0319ade3c0f7979b690e 100644 --- a/docs/simplesamlphp-changelog.md +++ b/docs/simplesamlphp-changelog.md @@ -12,6 +12,10 @@ See the upgrade notes for specific information about upgrading. * Support for SAML 1.1 was removed * Old-style PHP templates were removed * Old-style dictionaries were removed + * The default value for attrname-format was changed to 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri' + to comply with SAML2INT + * core:PairwiseID and core:SubjectID authprocs no longer support the 'scope' config-setting. + Use 'scopeAttribute' instead to identify the attribute holding the scope. ## Version 1.19.1 diff --git a/docs/simplesamlphp-reference-idp-hosted.md b/docs/simplesamlphp-reference-idp-hosted.md index e23eb75dc6813251a013e81c86749a28bea1e74a..a2ab44be0cfb9be49e6aeb16ab6bed0eda7c58a2 100644 --- a/docs/simplesamlphp-reference-idp-hosted.md +++ b/docs/simplesamlphp-reference-idp-hosted.md @@ -180,7 +180,7 @@ The following SAML 2.0 options are available: 2. IdP Hosted Metadata : The default value is: - `urn:oasis:names:tc:SAML:2.0:attrname-format:basic` + `urn:oasis:names:tc:SAML:2.0:attrname-format:uri` : Some examples of values specified in the SAML 2.0 Core Specification: @@ -188,7 +188,7 @@ The following SAML 2.0 options are available: : - `urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified` - `urn:oasis:names:tc:SAML:2.0:attrname-format:uri` (The default - in Shibboleth 2.0) + in Shibboleth 2.0, mandatory as per SAML2INT) - `urn:oasis:names:tc:SAML:2.0:attrname-format:basic` (The default in Sun Access Manager) @@ -199,8 +199,6 @@ The following SAML 2.0 options are available: any value in the SP-remote metadata overrides the one configured in the IdP metadata. -: (This option was previously named `AttributeNameFormat`.) - `encryption.blacklisted-algorithms` : Blacklisted encryption algorithms. This is an array containing the algorithm identifiers. diff --git a/docs/simplesamlphp-reference-sp-remote.md b/docs/simplesamlphp-reference-sp-remote.md index 5d1f5ecf8bb45840f5f37cee5e08dffd26192b6a..8ef4d52ab34912891a418b9c1cb86f3953d0bce8 100644 --- a/docs/simplesamlphp-reference-sp-remote.md +++ b/docs/simplesamlphp-reference-sp-remote.md @@ -131,7 +131,7 @@ The following options can be set: 2. IdP Hosted Metadata : The default value is: - `urn:oasis:names:tc:SAML:2.0:attrname-format:basic` + `urn:oasis:names:tc:SAML:2.0:attrname-format:uri` : Some examples of values specified in the SAML 2.0 Core Specification: @@ -139,7 +139,7 @@ The following options can be set: : - `urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified` - `urn:oasis:names:tc:SAML:2.0:attrname-format:uri` (The default - in Shibboleth 2.0) + in Shibboleth 2.0, mandatory as per SAML2INT) - `urn:oasis:names:tc:SAML:2.0:attrname-format:basic` (The default in Sun Access Manager) @@ -150,8 +150,6 @@ The following options can be set: entry in the SP-remote metadata overrides the option in the IdP-hosted metadata. -: (This option was previously named `AttributeNameFormat`.) - `audience` : An array of additional entities to be added to the AudienceRestriction. By default the only audience is the SP's entityID. diff --git a/lib/SimpleSAML/Metadata/SAMLBuilder.php b/lib/SimpleSAML/Metadata/SAMLBuilder.php index 805215f371f26e1318f45632e6d2d3e82515c891..47d873405f9b1d9dc67e9d3b9a19fb1fdf964a7e 100644 --- a/lib/SimpleSAML/Metadata/SAMLBuilder.php +++ b/lib/SimpleSAML/Metadata/SAMLBuilder.php @@ -205,7 +205,7 @@ class SAMLBuilder foreach ($metadata->getArray('EntityAttributes') as $attributeName => $attributeValues) { $a = new Attribute(); $a->setName($attributeName); - $a->setNameFormat('urn:oasis:names:tc:SAML:2.0:attrname-format:uri'); + $a->setNameFormat(Constants::NAMEFORMAT_UNSPECIFIED); // Attribute names that is not URI is prefixed as this: '{nameformat}name' if (preg_match('/^\{(.*?)\}(.*)$/', $attributeName, $matches)) { @@ -443,7 +443,7 @@ class SAMLBuilder $attributeconsumer->setServiceName($name); $attributeconsumer->setServiceDescription($metadata->getLocalizedString('description', [])); - $nameFormat = $metadata->getString('attributes.NameFormat', Constants::NAMEFORMAT_UNSPECIFIED); + $nameFormat = $metadata->getString('attributes.NameFormat', Constants::NAMEFORMAT_URI); foreach ($attributes as $friendlyName => $attribute) { $t = new RequestedAttribute(); $t->setName($attribute); diff --git a/modules/saml/lib/IdP/SAML2.php b/modules/saml/lib/IdP/SAML2.php index 578bce57323577add4ad6c523513cece9cb9b853..ea75cfc42f4836fc8ee466ff6b154bbf76083402 100644 --- a/modules/saml/lib/IdP/SAML2.php +++ b/modules/saml/lib/IdP/SAML2.php @@ -1068,7 +1068,7 @@ class SAML2 } // default - return Constants::NAMEFORMAT_BASIC; + return Constants::NAMEFORMAT_URI; }