- Variables possibly undefined when first used.
- Usage of XMLSecurityKey class without proper namespace.

This resolves #530. There are two problems here:

- When only one SubjectConfirmation is received and it is empty, an error should be thrown. However, the error would be a not very descriptive message warning about access to a non-property in a null object. Something more descriptive should be in place.
- Additionally, in PHP 7.0 this is an error and not an exception, and then the code continues to execute, effectively allowing assertions without a proper SubjectConfirmation element. This is wrong according to the standard.

Even though the default "exact" is used by most people, and few products support anything else, there's people asking for this.

Issue a notice when the option is used nonetheless.

Closes: #432

Now we are finally using the 2.x branch of the SAML2 library, which was also migrated to use namespaces. Even though the library provides an autoloader that allows loading the classes with the old names using class aliasing, we need to do the migration in one commit (at least for most part of it). This is due to the way SimpleSAMLphp checks data types, using inheritance to check objects agains abstract or more general classes. Even though class aliasing works, there's no way to replicate those relationships, and type checks that use the old class names will fail because the aliases are virtually new classes that don't inherit from others.

This is related to #346, and closes #347. It enables richer NameIDPolicy configuration, allowing to set not only the format, but also the value for "AllowCreate".

(being respectful with occurences that might change the behaviour, i.e. default database prefixes)

This reverts commit 09c5a23f.

SHA-1 is still supported but needs to be configured explicitly if you need it.

Move SimpleSAML_Utilities::selfURLNoQuery() to SimpleSAML\Utils\HTTP::getSelfURLNoQuery() and deprecate the former.

Mark the old ones as deprecated and schedule them for removal in 2.0.

`preg_match` returns `0` if no matches are found, `FALSE` only on error. This means that with the previous check unmatching certificates would not be identified, only when the preg_match itself would error.

Remove 'saml2.relaxvalidation' option from documentation. This feature was removed back in 2009. Fixes #78.

Blacklist 'http://www.w3.org/2001/04/xmlenc#rsa-1_5' (RSA encryption with PKCS#1 v1.5 padding) by default.

Properly document the signature.algorithm option. Also add configuration examples showing how to start using SHA-256, and warning about SHA-1 being disallowed starting in 2014.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3297 44740490-163a-0410-bde0-09ae8108e29a

This patch adds support for sending the AttributeConsumingService and
AssertionConsumerServiceIndex attributes in the authentication request.

Thanks to Dale Clarke for providing this patch!

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3266 44740490-163a-0410-bde0-09ae8108e29a

Full support for HTTP-POST binding in WebSSO profile. Two new directives in hosted metadata (SingleSignOnServiceBinding and SingleLogoutServiceBinding) to control the bindings published as supported in the metadata.

Bugfix in the logout handler (SOAP binding should be reused when responding a request).

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3257 44740490-163a-0410-bde0-09ae8108e29a

Instead of always adding the endpoint to the metadata, require
setting a separate option to enable it.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3194 44740490-163a-0410-bde0-09ae8108e29a

Fixed a bug on ArtifactResolutionService introduced by a previous commit on new SHA signatures support.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3186 44740490-163a-0410-bde0-09ae8108e29a

Support for RSA_SHA256, RSA_SHA384 and RSA_SHA512 in HTTP Redirect binding. Signature algorithm can now be set also in the remote IdP metadata, with more priority than the one specified in hosted SP metadata.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3181 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3165 44740490-163a-0410-bde0-09ae8108e29a

Added support for RSA-SHA256, RSA-SHA384 and RSA-SHA512 signature algorithms. New hosted IdP metadata option 'signature.algorithm' to configure this, defaults to SHA1 for backwards compatibility.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3164 44740490-163a-0410-bde0-09ae8108e29a

This option allows us to disable some encryption algorithms.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3139 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3137 44740490-163a-0410-bde0-09ae8108e29a

This patch adds support for the holder-of-key profile for both the
SAML 2.0 SP and the SAML 2.0 IdP.

Thanks to Andreas Mayer for implementing this!

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3061 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@2899 44740490-163a-0410-bde0-09ae8108e29a