diff options
| author | Olav Morken <olav.morken@uninett.no> | 2008-07-04 12:40:49 +0000 |
|---|---|---|
| committer | Olav Morken <olav.morken@uninett.no> | 2008-07-04 12:40:49 +0000 |
| commit | d85f62b671ba9a854c84f3a0d081a19e846307d9 (patch) | |
| tree | ce41c9b2729362e98e05529df474114a524a0a4d | |
| parent | 8ebe7ebc74d56920a6a783c2006a101844062aba (diff) | |
| download | simplesamlphp-d85f62b671ba9a854c84f3a0d081a19e846307d9.zip simplesamlphp-d85f62b671ba9a854c84f3a0d081a19e846307d9.tar.gz simplesamlphp-d85f62b671ba9a854c84f3a0d081a19e846307d9.tar.bz2 | |
SAML2 SP: Add support for CA path validation.
git-svn-id: https://simplesamlphp.googlecode.com/svn/trunk@771 44740490-163a-0410-bde0-09ae8108e29a
| -rw-r--r-- | lib/SimpleSAML/XML/SAML20/AuthnResponse.php | 21 |
1 files changed, 17 insertions, 4 deletions
diff --git a/lib/SimpleSAML/XML/SAML20/AuthnResponse.php b/lib/SimpleSAML/XML/SAML20/AuthnResponse.php index d3f9989..855908a 100644 --- a/lib/SimpleSAML/XML/SAML20/AuthnResponse.php +++ b/lib/SimpleSAML/XML/SAML20/AuthnResponse.php @@ -260,11 +260,24 @@ class SimpleSAML_XML_SAML20_AuthnResponse extends SimpleSAML_XML_AuthnResponse { $this->validator = new SimpleSAML_XML_Validator($node, 'ID', $publickey); if (!$publickey) { - /* Get fingerprint for the certificate of the issuer. */ - $issuerFingerprint = $md['certFingerprint']; + if(array_key_exists('certFingerprint', $md)) { + + /* Get fingerprint for the certificate of the issuer. */ + $issuerFingerprint = $md['certFingerprint']; - /* Validate the fingerprint. */ - $this->validator->validateFingerprint($issuerFingerprint); + /* Validate the fingerprint. */ + $this->validator->validateFingerprint($issuerFingerprint); + + } elseif(array_key_exists('caFile', $md)) { + + /* Validation against a CA file. */ + $this->validator->validateCA($this->configuration->getPathValue('certdir') . $md['caFile']); + } else { + + /* Misconfigured - neither publickey, certFingerprint or caFile given. */ + throw new Exception('Misconfigured saml20-idp-remote ' . $this->issuer . ':' . + ' Neither publickey, certFingerprint or caFile given.'); + } } } |