Fix Psalm-issues in the modules-directory

It does not seem like something that is normal so a warning seems in
place. However, forbidding it does not add much value since we accept
unsollicited responses (from any idp) anyway.

Closes: #975

Making the AuthnInstant available in the state array as saml:AuthnInstant and adding that to PersistentAuthData

If we get a response with an InResponseTo attribute that doesn't match a valid state array, and the response is not a duplicate, we should continue with the response as an unsolicited one.

Now we are finally using the 2.x branch of the SAML2 library, which was also migrated to use namespaces. Even though the library provides an autoloader that allows loading the classes with the old names using class aliasing, we need to do the migration in one commit (at least for most part of it). This is due to the way SimpleSAMLphp checks data types, using inheritance to check objects agains abstract or more general classes. Even though class aliasing works, there's no way to replicate those relationships, and type checks that use the old class names will fail because the aliases are virtually new classes that don't inherit from others.

Be graceful if a SAML assertion does not contain a NameID. Do not set it in the state array, and set logout as "saml1" to avoid SLO, since SLO requires NameIDs.

Duplicate the $state['SimpleSAML_Auth_Default.*'] entries to $state['SimpleSAML_Auth_Source.*'] where needed, while we are transitioning to 2.0. Leave those that will be removed in SimpleSAML_Auth_Default. Move the rest of the code to the new entries in the state array.

No data about previous authentication is stored if authentication was not started at the SP (IdP-first flow). That makes the replay protection measures fail, leading to an ugly exception show to the user. Fix that.

Additionally, give precedence to the RelayState configured in the local metadata, as the one received together with the SAML response may not even be an URL.

This resolves #230.

Move SimpleSAML_Utilities:: checkURLAllowed() to SimpleSAML\Utils\HTTP:: checkURLAllowed() and deprecate the former.

Move SimpleSAML_Utilities:: redirectTrustedURL() to SimpleSAML\Utils\HTTP:: redirectTrustedURL() and deprecate the former.

Fail more gracefully when the different endpoints are accessed directly. Instead of displaying an "Unable to find the current binding" error message that creates confusion, tell the user it's his fault.

Solve a security issue with some modules (not validating URLs we are redirecting to) by moving the check to the SimpleSAML_Auth_State::loadState() method.

Rename SimpleSAML_Session::getInstance() to SimpleSAML_Session::getSessionFromRequest(), and leave the former as deprecated.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3336 44740490-163a-0410-bde0-09ae8108e29a

Followup on previous commits. Use redirectUntrustedURL() as a shortcut, and let everything else make use of redirectTrustedURL(). Move the responsibility to check the input out of the library, to the places where URLs are grabbed from input parameters.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3332 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3326 44740490-163a-0410-bde0-09ae8108e29a

Fix to make issuer entity ID validation work when the remote IdP is a proxy and we are using IDPList option.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3264 44740490-163a-0410-bde0-09ae8108e29a

The saml:sp:IdP authentication data was only saved for SAML 2.0
authentication. This patch moves this variable into common code, so
that it is shared between SAML 2.0 and SAML 1.1.

Thanks to Tim Jobling for reporting this bug!

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3240 44740490-163a-0410-bde0-09ae8108e29a

The issuer of an AuthnResponse is now validated to check if we get the response from the same entity ID we sent the request to.

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3189 44740490-163a-0410-bde0-09ae8108e29a

git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@3104 44740490-163a-0410-bde0-09ae8108e29a