diff --git a/modules/saml/www/sp/saml1-acs.php b/modules/saml/www/sp/saml1-acs.php index b30128a6fd3a3d240c987cdca0de78d69ea87ae9..cc42502b89e70592e651e1497d5a4520c3275062 100644 --- a/modules/saml/www/sp/saml1-acs.php +++ b/modules/saml/www/sp/saml1-acs.php @@ -20,16 +20,25 @@ $source = SimpleSAML_Auth_Source::getById($sourceId, 'sspmod_saml_Auth_Source_SP SimpleSAML_Logger::debug('Received SAML1 response'); -$state = SimpleSAML_Auth_State::loadState($_REQUEST['TARGET'], 'saml:sp:sso'); - -/* Check that the authentication source is correct. */ -assert('array_key_exists("saml:sp:AuthId", $state)'); -if ($state['saml:sp:AuthId'] !== $sourceId) { - throw new SimpleSAML_Error_Exception('The authentication source id in the URL does not match the authentication source which sent the request.'); -} +$target = (string)$_REQUEST['TARGET']; +if (preg_match('@^https?://@i', $target)) { + /* Unsolicited response. */ + $state = array( + 'saml:sp:isUnsoliced' => TRUE, + 'saml:sp:AuthId' => $sourceId, + 'saml:sp:RelayState' => $target, + ); +} else { + $state = SimpleSAML_Auth_State::loadState($_REQUEST['TARGET'], 'saml:sp:sso'); -assert('isset($state["saml:idp"])'); + /* Check that the authentication source is correct. */ + assert('array_key_exists("saml:sp:AuthId", $state)'); + if ($state['saml:sp:AuthId'] !== $sourceId) { + throw new SimpleSAML_Error_Exception('The authentication source id in the URL does not match the authentication source which sent the request.'); + } + assert('isset($state["saml:idp"])'); +} $spMetadata = $source->getMetadata();