Skip to content
Snippets Groups Projects
Commit af7d4ab6 authored by Thijs Kinkhorst's avatar Thijs Kinkhorst
Browse files

Merge branch 'enhancement/disable_scoping' of...

Merge branch 'enhancement/disable_scoping' of https://github.com/ghalse/simplesamlphp into ghalse-enhancement/disable_scoping
parents 4b581b8b 10222395
No related branches found
No related tags found
No related merge requests found
...@@ -104,6 +104,15 @@ SAML 2.0 options ...@@ -104,6 +104,15 @@ SAML 2.0 options
The following SAML 2.0 options are available: The following SAML 2.0 options are available:
`disable_scoping`
: Whether sending of samlp:Scoping elements in authentication requests should be suppressed. The default value is `FALSE`.
When set to `TRUE`, no scoping elements will be sent. This does not comply with the SAML2 specification, but allows
interoperability with ADFS which [does not support Scoping elements](https://docs.microsoft.com/en-za/azure/active-directory/develop/active-directory-single-sign-on-protocol-reference#scoping).
: Note that this option also exists in the SP configuration. This
entry in the IdP-remote metadata overrides the option in the
[SP configuration](./saml:sp).
`encryption.blacklisted-algorithms` `encryption.blacklisted-algorithms`
: Blacklisted encryption algorithms. This is an array containing the algorithm identifiers. : Blacklisted encryption algorithms. This is an array containing the algorithm identifiers.
......
...@@ -35,6 +35,13 @@ class SP extends Source ...@@ -35,6 +35,13 @@ class SP extends Source
*/ */
private $discoURL; private $discoURL;
/**
* Flag to indicate whether to disable sending the Scoping element.
*
* @var boolean|FALSE
*/
private $disable_scoping;
/** /**
* Constructor for SAML SP authentication source. * Constructor for SAML SP authentication source.
* *
...@@ -64,6 +71,7 @@ class SP extends Source ...@@ -64,6 +71,7 @@ class SP extends Source
$this->entityId = $this->metadata->getString('entityID'); $this->entityId = $this->metadata->getString('entityID');
$this->idp = $this->metadata->getString('idp', null); $this->idp = $this->metadata->getString('idp', null);
$this->discoURL = $this->metadata->getString('discoURL', null); $this->discoURL = $this->metadata->getString('discoURL', null);
$this->disable_scoping = $this->metadata->getBoolean('disable_scoping', false);
if (empty($this->discoURL) && \SimpleSAML\Module::isModuleEnabled('discojuice')) { if (empty($this->discoURL) && \SimpleSAML\Module::isModuleEnabled('discojuice')) {
$this->discoURL = \SimpleSAML\Module::getModuleURL('discojuice/central.php'); $this->discoURL = \SimpleSAML\Module::getModuleURL('discojuice/central.php');
...@@ -241,10 +249,33 @@ class SP extends Source ...@@ -241,10 +249,33 @@ class SP extends Source
$ar->setNameIdPolicy($policy); $ar->setNameIdPolicy($policy);
} }
if (isset($state['saml:IDPList'])) { $IDPList = [];
$IDPList = $state['saml:IDPList']; $requesterID = [];
/* Only check for real info for Scoping element if we are going to send Scoping element */
if ($this->disable_scoping != true && $idpMetadata->getBoolean('disable_scoping', false) != true) {
if (isset($state['saml:IDPList'])) {
$IDPList = $state['saml:IDPList'];
}
if (isset($state['saml:ProxyCount']) && $state['saml:ProxyCount'] !== null) {
$ar->setProxyCount($state['saml:ProxyCount']);
} elseif ($idpMetadata->getInteger('ProxyCount', null) !== null) {
$ar->setProxyCount($idpMetadata->getInteger('ProxyCount', null));
} elseif ($this->metadata->getInteger('ProxyCount', null) !== null) {
$ar->setProxyCount($this->metadata->getInteger('ProxyCount', null));
}
$requesterID = [];
if (isset($state['saml:RequesterID'])) {
$requesterID = $state['saml:RequesterID'];
}
if (isset($state['core:SP'])) {
$requesterID[] = $state['core:SP'];
}
} else { } else {
$IDPList = []; \SimpleSAML\Logger::debug('Disabling samlp:Scoping for '.var_export($idpMetadata->getString('entityid'), true));
} }
$ar->setIDPList( $ar->setIDPList(
...@@ -257,23 +288,6 @@ class SP extends Source ...@@ -257,23 +288,6 @@ class SP extends Source
) )
); );
if (isset($state['saml:ProxyCount']) && $state['saml:ProxyCount'] !== null) {
$ar->setProxyCount($state['saml:ProxyCount']);
} elseif ($idpMetadata->getInteger('ProxyCount', null) !== null) {
$ar->setProxyCount($idpMetadata->getInteger('ProxyCount', null));
} elseif ($this->metadata->getInteger('ProxyCount', null) !== null) {
$ar->setProxyCount($this->metadata->getInteger('ProxyCount', null));
}
$requesterID = [];
if (isset($state['saml:RequesterID'])) {
$requesterID = $state['saml:RequesterID'];
}
if (isset($state['core:SP'])) {
$requesterID[] = $state['core:SP'];
}
$ar->setRequesterID($requesterID); $ar->setRequesterID($requesterID);
if (isset($state['saml:Extensions'])) { if (isset($state['saml:Extensions'])) {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment