SAML2: Allow either <saml:AuthnContextClassRef> or <saml:AuthnContextDeclRef>...

SAML2: Allow either <saml:AuthnContextClassRef> or <saml:AuthnContextDeclRef> in <saml:AuthnContext>.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@1702 44740490-163a-0410-bde0-09ae8108e29a

lib/SAML2/Assertion.php

@@ -382,13 +382,18 @@ class SAML2_Assertion implements SAML2_SignedElement {
 
 		$accr = SAML2_Utils::xpQuery($ac, './saml:AuthnContextClassRef');
 		if (empty($accr)) {
-			throw new Exception('Missing almost-required <saml:AuthnContextClassRef> in <saml:AuthnContext>.');
+			$acdr = SAML2_Utils::xpQuery($ac, './saml:AuthnContextDeclRef');
+			if (empty($acdr)) {
+				throw new Exception('Neither <saml:AuthnContextClassRef> nor <saml:AuthnContextDeclRef> found in <saml:AuthnContext>.');
+			} elseif (count($accr) > 1) {
+				throw new Exception('More than one <saml:AuthnContextDeclRef> in <saml:AuthnContext>.');
+			}
+			$this->authnContext = trim($acdr[0]->textContent);
 		} elseif (count($accr) > 1) {
 			throw new Exception('More than one <saml:AuthnContextClassRef> in <saml:AuthnContext>.');
+		} else {
+			$this->authnContext = trim($accr[0]->textContent);
 		}
-		$accr = $accr[0];
-
-		$this->authnContext = trim($accr->textContent);
 	}