summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Avoid concatenated error messagesorigin/errorcode-classHanne Moa2016-09-167-12/+10
| | | | For #455
* Add a map from error codes to titles/descriptionsHanne Moa2016-09-162-2/+190
|
* Move mtype array after Template-instantiationHanne Moa2016-09-151-1/+2
| | | | `noop()` is a method on the template after all.
* Make `noop()` staticHanne Moa2016-09-152-5/+5
| | | | This makes instanciating the Translate/Template-class unnecessary.
* Deprecate the use of arrays for t($tag)Hanne Moa2016-09-151-1/+5
| | | | For #455
* Deprecate fallbackdefault argumentHanne Moa2016-09-151-4/+11
| | | | For #455
* Remove concat: translated tab-titleHanne Moa2016-09-152-1/+16
| | | | | | For #455. Note that if translation tags were domain-free strings, the mapping from tab to tabtitle would be redundant. It would still be necessary to mark the strings as noop however.
* Get rid of the mtype-functionHanne Moa2016-09-152-35/+19
| | | | For #454, #455
* Remove concat: translated header in metadata.phpHanne Moa2016-09-155-5/+9
| | | | For #455
* Merge pull request #433 from thijskh/feature/deprecate-certFingerprintJaime Pérez Crespo2016-09-146-19/+14
|\ | | | | Deprecate the certFingerprint option.
| * Deprecate the certFingerprint option.Thijs Kinkhorst2016-08-056-19/+14
| | | | | | | | | | | | Issue a notice when the option is used nonetheless. Closes: #432
* | Add noop() function for marking translationsHanne Moa2016-09-072-1/+26
| |
* | bugfix: The smartattributes:SmartName authproc fails to load.Jaime Pérez2016-09-071-1/+1
| | | | | | | | There was a typo in the name of the class, where the module was referenced as "smartattribute" instead of "smartattributes".
* | Update the documentation with up-to-date requirements.Jaime Pérez2016-09-061-3/+5
| |
* | Add a list of PHP extensions required to the composer.json.Jaime Pérez2016-09-061-0/+8
| |
* | Add the SPL extension to the list of requirements in the web interface.Jaime Pérez2016-09-061-0/+1
| | | | | | | | This is needed for the autoloader to work, or code calling class_implements(), among others.
* | Remove the SimpleXML PHP extension from the requirements.Jaime Pérez2016-09-061-1/+0
| |
* | Enhance the checks for required PHP extensions.Jaime Pérez2016-09-061-0/+4
| | | | | | | | Added checks for Date/Time, JSON, cURL and Session.
* | Add mysteriosuly missing ;Hanne Moa2016-09-061-1/+1
| |
* | Split logic and data for authYubiKey-moduleHanne Moa2016-09-062-2/+4
| | | | | | | | For: #454
* | Split logic and data for negotiate-moduleHanne Moa2016-09-064-10/+6
| | | | | | | | For: #454
* | Allow setting the 'Comparison' attribute in authentication contexts.Jaime Pérez2016-09-053-2/+40
| | | | | | | | Even though the default "exact" is used by most people, and few products support anything else, there's people asking for this.
* | doc: Fix use of SAML2_Const in documentation.Jaime Pérez2016-09-051-1/+1
| | | | | | | | Since we have updated the version of the SAML2 library in use, we should use SAML2\Constants now.
* | Deprecate the old SimpleSAML_Error_NoPassive and ↵Jaime Pérez2016-08-313-0/+18
| | | | | | | | SimpleSAML_Error_ProxyCountExceeded exceptions.
* | Use the new SimpleSAML\Module\saml\Error\ProxyCountExceeded exception.Jaime Pérez2016-08-311-1/+4
| |
* | Remove unused exceptions.Jaime Pérez2016-08-312-30/+0
| |
* | Use the new SAML error exceptions in the saml module.Jaime Pérez2016-08-313-20/+23
| | | | | | | | Instead of keeping SAML-specific error exceptions in lib/SimpleSAML/Error, it makes more sense to have those in the saml module. Now that we have the recent NoAvailableIDP and NoSupportedIDP errors moved there, it's time to change the code implemented recently that uses them.
* | Model some SAML errors as exceptions in the SAML module.Jaime Pérez2016-08-315-0/+140
| | | | | | | | This makes it easier to identify error conditions and return errors to an SP. More known errors should also be added here.
* | Keep the requested authentication context.Jaime Pérez2016-08-301-0/+3
| | | | | | | | The SAML2 IdP should keep the RequestedAuthnContext in the state array, so that authentication sources (or processing filters) can use that information during authentication.
* | Merge pull request #451 from sgomez/fix-twig-extensionJaime Pérez Crespo2016-08-256-6/+13
|\ \ | | | | | | Removed html extension in Twig files
| * | Removed html extension on twig filesSergio Gómez2016-08-256-6/+13
|/ /
* | bugfix: Make sure we can deal with attribute values that are not strings ↵Jaime Pérez2016-08-231-4/+14
| | | | | | | | | | | | (i.e. DOMNodeList). This is due to the update of the SAML2 library, that caused several other bugs, mainly with attributes like eduPersonTargetedID, which should always be an SAML NameID.
* | bugfix: Do not try to apply SSP's base URL if REQUEST_URI does not match.Jaime Pérez2016-08-222-11/+40
|\ \ | | | | | | | | | It is possible that the current script ($_SERVER['SCRIPT_FILENAME']) is inside SimpleSAMLphp's 'www' directory. However, even if that's the case, we should not enforce our base URL (as set in the 'baseurlpath' configuration option) if the request URI ($_SERVER['REQUEST_URI']) does not contain the relative path to the script. This is the case of AuthMemCookie, for example, where accessing a random URL protected by Apache, leads to the execution of a SimpleSAMLphp script, where SimpleSAML\Utils\HTTP::getSelfURL() must not try to be smart when guessing the current URL.
| * | bugfix: Do not try to apply SSP's base URL if REQUEST_URI does not match.Jaime Pérez2016-08-222-11/+40
| | | | | | | | | | | | It is possible that the current script ($_SERVER['SCRIPT_FILENAME']) is inside SimpleSAMLphp's 'www' directory. However, even if that's the case, we should not enforce our base URL (as set in the 'baseurlpath' configuration option) if the request URI ($_SERVER['REQUEST_URI']) does not contain the relative path to the script. This is the case of AuthMemCookie, for example, where accessing a random URL protected by Apache, leads to the execution of a SimpleSAMLphp script, where SimpleSAML\Utils\HTTP::getSelfURL() must not try to be smart when guessing the current URL.
* | | Enhance the list of PHP extensions requirements.Jaime Pérez2016-08-221-4/+5
| | |
* | | bugfix: The configuration page checks for MySQL support, instead of PDO.Jaime Pérez2016-08-221-1/+1
| | | | | | | | | | | | | | | | | | We don't use the MySQL extension directly, but PDO instead. We should therefore check for the PDO extension. This resolves #448.
* | | bugfix: Remove inline style for links in the header, and change that for a ↵Jaime Pérez2016-08-222-2/+7
| | | | | | | | | | | | proper CSS.
* | | Revert "Remove inline style sheet"Jaime Pérez2016-08-222-2/+2
|/ / | | | | | | This reverts commit ce040885023434abb6a7362449d588f90888413e.
* | Merge pull request #429 from dnmvisser/module-enableJaime Pérez Crespo2016-08-171-4/+4
|\ \ | | | | | | Update module docs
| * | Update module docs to use module enabling/disabling through configuration ↵Dick Visser2016-08-031-4/+4
| | | | | | | | | | | | file rather than touching 'enable'/'disable' files inside module directories
* | | Merge pull request #442 from dnmvisser/css-patch1Thijs Kinkhorst2016-08-172-2/+2
|\ \ \ | | | | | | | | Remove inline style sheet
| * | | Remove inline style sheetDick Visser2016-08-162-2/+2
|/ / /
* | | Multiple enhancements and fixes to IDPList support in proxy mode.Jaime Pérez2016-08-155-9/+88
| | | | | | | | | | | | | | | | | | | | | - Bugfix: the modules/saml/www/proxy/invalid_session.php shouldn't call directly the error handler in sspmod_saml_IdP_SAML2. Instead, it should use the SimpleSAML_Auth_State::throwException() method to let it handle the exception appropriately (in this case, it should always return back to the requester). - The standard specifies that a "urn:oasis:names:tc:SAML:2.0:status:NoSupportedIDP" or "urn:oasis:names:tc:SAML:2.0:status:NoAvailableIDP" second-level status code should be returned to the requester in case an error occurs. Add a couple of exceptions to represent both statuses, and use them to set the right status code in the response. - We shouldn't ask the user to logout in case the IDPList does not offer an IdP we recognize, or in case the proxy enforces the use of an IdP ('idp' configuration option in the auth source) and such IdP is in the IDPList. - Similarly, these two cases should also handled in case we are authenticating for the first time, not only when reauthenticating.
* | | bugfix: Fix a bug in AuthMemCookie that prevented the cookie from being set.Jaime Pérez2016-08-152-6/+2
| | | | | | | | | | | | This was due to incorrect use of the SimpleSAML_SessionHandler::setCookie() method to set the cookie, instead of SimpleSAML\Utils\HTTP::setCookie().
* | | Make the 'debug' configuration option more fine-grained.Jaime Pérez2016-08-103-20/+61
| | | | | | | | | | | | | | | | | | | | | | | | Some things, like logging of SAML messages or backtraces, are controlled with the 'debug' configuration option. However, it might be possible that we don't want one while we want the other, but that's impossible with just one option. This commit allows us to configure debugging options independently, but groupping all of them together. This is particularly useful if we want to log backtraces to debug errors, for example, but we don't want to log SAML messages to keep the privacy of the users. This also allows us to get rid of the 'debug.validatexml' configuration option, and group it with other debug options. This changes are backwards-compatible. Old and new configurations will work at the same time.
* | | Log backtraces with the same log level as the error messages, whatever that is.Jaime Pérez2016-08-101-7/+17
| | | | | | | | | | | | It's not very useful to log backtraces always as debug, since that implies getting all the log messages, while backtraces would still help debug a particular error.
* | | Typos.Jaime Pérez2016-08-101-2/+2
| | |
* | | bugfix: Avoid the SAML2 IdP resilient to failures when getting DOMNodeList ↵Jaime Pérez2016-08-101-2/+7
| | | | | | | | | | | | | | | | | | attribute values. Due to recent changes in the SAML2 library, when an attribute has a value that contains XML, its contents are returned as a DOMNodeList instead of a string. This causes problems when running as a proxy, since the SAML2 IdP will obtain attributes in a format that cannot be cast to string. Regardless of the attribute encoding configured in the IdP for a remote SP, we should handle those cases gracefully, so that the IdP don't end up in an uncaught exception.
* | | bugfix: Make sure we log the user out before reauthenticating.Jaime Pérez2016-08-085-12/+214
| | | | | | | | | | | | | | | | | | When acting as a proxy, SimpleSAMLphp was re-authenticating the user in case the IdP that authenticated a user in a valid session was not included in the list of IdPs provided by an SP asking for authentication. Since we cannot use Single Sign On there, we should ask the user to logout before authenticating again, avoiding an inconsistent session with SPs associated to different IdPs. This resolves #84.
* | | Minor fixes in the SAML SP test class.Jaime Pérez2016-08-081-7/+11
| | | | | | | | | | | | Basically, phpdoc formatting and fixing some classes not using namespaces.
* | | Change the new test for the SAML SP class to use namespaces.Jaime Pérez2016-08-061-24/+25
| |/ |/| | | | | For some reason, these changes were not applied in the previous commit. Make sure we use the current interface of the SAML2 library instead of abusing the autoloader.
* | Fix test for sspmod_saml_Auth_Source_SP.Jaime Pérez2016-08-052-200/+261
| | | | | | | | Reformat to comply with our coding guidelines. Migrate all the code to use the newest version of the SAML2 library, using namespaces. Fix some bugs. Move it where it belongs under modules/saml instead of modules/core.
* | Create a common dictionary of general words and expressions that can be used ↵Jaime Pérez2016-08-052-0/+238
| | | | | | | | all over the place.
* | Merge pull request #417 from pmeulen/feature/authnreq-subject-nameid-testsJaime Pérez Crespo2016-08-053-0/+214
|\ \ | | | | | | Test for https://github.com/simplesamlphp/simplesamlphp/pull/400
| * | PHP 5.3 fixesPieter van der Meulen2016-07-131-7/+14
| | |
| * | Add testcase for passing "state" options to sspmod_saml_Auth_Source_SPPieter van der Meulen2016-07-131-0/+193
| | |
| * | Allow the optional Subject NameID to be set in a SAML AuthnRequest through ↵Pieter van der Meulen2016-07-132-0/+14
| | | | | | | | | | | | "saml:NameID"
* | | Merge pull request #430 from ghalse/add-afrikaans-langJaime Pérez Crespo2016-08-052-1/+2
|\ \ \ | |_|/ |/| | Add the existing Afrikaans translation into the list of supported languages
| * | Add the existing Afrikaans translation into the list of supported languages ↵Guy Halse2016-08-052-1/+2
|/ / | | | | | | so that South African users don't need to go editing code.
* | Remove link to the sandbox from configuration tab.Jaime Pérez2016-08-021-8/+0
| | | | | | | | If we want to access the sandbox, we can do that from admin/ or type the URL directly.
* | tests: Add tests for the new saml:FilterScopes authproc filter.Jaime Pérez2016-07-291-0/+137
| |
* | bugfix: Do not remove attribute values that are not scoped.Jaime Pérez2016-07-291-0/+1
| | | | | | | | The saml:FilterScopes filter was removing values that did not contain a scope. It shouldn't.
* | authproc: Add new filter to remove invalid scopes.Jaime Pérez2016-07-293-0/+169
| | | | | | | | | | | | The new saml:FilterScopes allows a SAML Service Provider to remove the values from a scoped attribute whose scope is not declared in the IdP metadata and/or does not match with the domain in use by the IdP itself. This closes #22.
* | Merge pull request #385 from grnet/bug/authfacebook-user-fieldsJaime Pérez Crespo2016-07-292-3/+23
|\ \ | | | | | | Fix issue with Facebook authentication retrieving only user id and name
| * | Fix issue with Facebook authentication retrieving only user id and nameNicolas Liampotis2016-05-082-3/+23
| | |
* | | Update changelog with last releases.Jaime Pérez2016-07-291-0/+25
| | |
* | | Update the upgrade notes.Jaime Pérez2016-07-291-1/+10
| | | | | | | | | | | | Mention the change in the way NameIDs are processed inside an eduPersonTargetedID, and offer an example on how to process the value.
* | | Use AttributeValue serializable objects instead of dumping manually the XML ↵Jaime Pérez2016-07-281-16/+6
| | | | | | | | | | | | | | | | | | contents. This way, we avoid completely any possible XXE attack, and simplify the code as we don't need to deal directly with the DOM. The entire AttributeValue will be saved to the backend as XML, and then recovered back when unserializing.
* | | Remove debugging leftovers.Jaime Pérez2016-07-281-4/+0
| | |
* | | bugfix: Allow attributes to contain raw XML as their values.Jaime Pérez2016-07-282-1/+118
| | | | | | | | | | | | | | | | | | | | | | | | A recent change in simplesamlphp/saml2#60 made the library return a DOMNodeList object when the contents of the AttributeValue element are not text. This lead to a bug, since the returned value is not serializable, and when storing it in the session it will go away as soon as we serialize the session to store it in the backend (whatever that is). This is always, as the SP will always redirect to the URL originating authentication. The result was an empty DOMNodeList object where there should be some value. This commit makes the SimpleSAML_Session to implement the Serializable interface. When obtaining the attributes during login (doLogin() method), the code will now look for DOMNodeList objects, and dump them as a string with the XML representation of their contents in the 'RawAttributes' array inside $this->authData[$authority]. This allows us to parse the XML back when unserializing, and restore the original DOMNodeList object as the value of the attribute. The issue was reported originally in the mailing list by Enrico Cavalli, affecting eduPersonTargetedID. This resolves #424.
* | | Update the SAML2 library.Jaime Pérez2016-07-262-10/+19
| | | | | | | | | | | | Now that the SAML2 library has been updated to use the new SimpleSAML\Logger, we can update the dependency here. Since both libraries are interdependent, we are pointing to a specific commit in master, aliasing it to 2.2. That way we can keep business as usual for any other package which may depend on 2.2, while getting the changes into SimpleSAMLphp.
* | | Stop using SimpleSAML_Configuration::getBaseURL().Jaime Pérez2016-07-263-3/+3
| | | | | | | | | | | | Use the recently added SimpleSAML_Configuration::getBasePath() instead. It guarantees the path prepended with a slash, so no need to do that every time when calling the method. As a side effect, we get rid of buggy invocations (calling getBaseUrl() instead of getBaseURL()), and also of old-style convention for the 'baseurlpath' configuration option, allowing a star at the beginning.
* | | Get rid of the last remaining calls to SimpleSAML_Logger.Jaime Pérez2016-07-261-2/+2
| | |
* | | Bump the version of the SAML2 library.Jaime Pérez2016-07-2639-345/+359
| | | | | | | | | | | | Now we are finally using the 2.x branch of the SAML2 library, which was also migrated to use namespaces. Even though the library provides an autoloader that allows loading the classes with the old names using class aliasing, we need to do the migration in one commit (at least for most part of it). This is due to the way SimpleSAMLphp checks data types, using inheritance to check objects agains abstract or more general classes. Even though class aliasing works, there's no way to replicate those relationships, and type checks that use the old class names will fail because the aliases are virtually new classes that don't inherit from others.
* | | Prepare to bump the version of XMLSecLibs that we are using.Jaime Pérez2016-07-261-0/+8
| | | | | | | | | | | | The 2.x branch of XMLSecLibs uses namespaces, so we need to make sure we can still load the XMLSec* classes after updating the dependency. We can do that in the autoloader, looking for the classes with namespaces, and creating class aliases.
* | | bugfix: Critical configuration errors should not enforce a baseurlpath.Jaime Pérez2016-07-251-1/+0
| | | | | | | | | | | | | | | | | | The code was enforcing this option even if a configuration was passed as a parameter to the constructor. If there is something wrong with a configuration and we are passing it to the constructor, we should know if at least the 'baseurlpath' is correct, and if not, fix it somehow. This bug was producing a default configuration without 'baseurlpath', when no configuration was passed. In that situation, only the default path (/simplesaml) was working correctly.
* | | docs: Add documentation for ldap.port configuration option in authproc filters.Jaime Pérez2016-07-251-0/+11
| | | | | | | | | | | | This is related to PR #313. The option was in use but not documented.
* | | Merge pull request #313 from justinsg/patch-1Jaime Pérez Crespo2016-07-251-0/+1
|\ \ \ | | | | | | | | Added port to the LDAP base filter configuration
| * | | Added port to the LDAP base filter configurationJustin Standring2016-01-191-0/+1
| | | |
* | | | test: Fix build.Jaime Pérez2016-07-221-0/+10
| | | | | | | | | | | | | | | | PHP 5.3 and HHVM do not include the built-in server (or in the case of HHVM, not with the same syntax).
* | | | test: Add a simple test for www/index.phpJaime Pérez2016-07-221-0/+117
| | | | | | | | | | | | | | | | This test works as a demonstration on how to test our web interface endpoints.
* | | | Fix typo and indentation.Jaime Pérez2016-07-221-2/+2
| | | |
* | | | test: Add a router script for the built-in server to initialize SSP's ↵Jaime Pérez2016-07-221-0/+41
| | | | | | | | | | | | | | | | | | | | | | | | configuration. With this script, which will be executed for every request performed to the built-in server, we can preload the configuration from a temporary file, making it possible to configure SimpleSAMLphp dynamically when testing.
* | | | test: Add a class to handle PHP's built-in server.Jaime Pérez2016-07-221-0/+201
| | | | | | | | | | | | | | | | With this class we can run PHP's built-in server specifying the document root (defaulting to the www directory) and a "router" file, which the server will execute for every request received. This is useful to allow testing of the web interfaces as part of our unit testing setup.
* | | | Merge pull request #421 from sgomez/fix-use-exceptionJaime Pérez Crespo2016-07-201-2/+1
|\ \ \ \ | | | | | | | | | | Removed unnecessary exception
| * | | | Removed unnecessary exceptionSergio Gomez2016-07-201-2/+1
|/ / / /
* | | | Do not enforce reading the configuration from files.Jaime Pérez2016-07-191-2/+3
| | | | | | | | | | | | | | | | The www/_include.php script, included by all scripts in www/, checks unconditionally for the existence of the config.php file. However, this prevents us from testing the scripts automatically. Instead of checking for the file, we just try to load the configuration, and live with it if it works. That way we can pre-load the configuration using SimpleSAML_Configuration::loadFromArray(), as we are doing in some tests.
* | | | Version checking: do not poll github when running master, and store result ↵Thijs Kinkhorst2016-07-151-19/+26
| | | | | | | | | | | | | | | | in session.
* | | | bugfix: Restore the capability to get our self URL when invoked from a ↵Jaime Pérez2016-07-152-26/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | third-party script. Recent fixes for URL guessing and building addressed bugs in the code that were preventing the 'baseurlpath' from being used properly. However, they introduced a new issue, as the code was assuming the current URL would always point to a SimpleSAMLphp script. This is not always true, of course, as any script can invoke our API and end up trying to get its own URL (for example, when calling requireAuth()). In order to fix this, we monitor mismatches between SimpleSAMLphp's installation path and the absolute, real path to the current script. When there's a mismatch, it means we are running a third-party script outside SimpleSAMLphp, and therefore we should NOT enforce 'baseurlpath'. This introduces an additional issue, as applications behind a reverse proxy may cause trouble to guess the right URL (we will use the URL as seen by SimpleSAMLphp in the server, which is not necessarily the same as the user sees with a reverse proxy in between). For the moment, we'll leave the responsibility to sort that issue out to implementors. It might be a good idea to add a page to the wiki explaining how to do this. This resolves #418.
* | | | NL translation of warnings_outdatedThijs Kinkhorst2016-07-151-1/+2
| | | |
* | | | Make the "check for updates" new feature configurable.Jaime Pérez2016-07-142-22/+31
| | | | | | | | | | | | | | | | Add a configuration option named 'admin.checkforupdates' to enable or disable this feature.
* | | | bugfix: Set a low timeout for connections to github.Jaime Pérez2016-07-141-3/+1
| | | | | | | | | | | | | | | | We shouldn't wait for long when connecting to github's API to check for the latest release. Set a timeout of a couple of seconds. Also, remove commented debugging code.
* | | | feature: Check if we are running the latest version.Jaime Pérez2016-07-144-2/+33
| | | | | | | | | | | | | | | | Now that we have all our releases in github, we can use its API to see of the latest stable release there is newer than the version we are running. In that case, we show a warning in the configuration tab.
* | | | typo: s/reccomended/recommended/gJaime Pérez2016-07-143-4/+4
| |_|/ |/| |
* | | Merge branch 'master' of github.com:simplesamlphp/simplesamlphpHanne Moa2016-07-134-14/+14
|\ \ \ | | | | | | | | | | | | YA Merge
| * | | Fix some more references to SimpleSAML_Module and SimpleSAML_Logger.Jaime Pérez2016-07-135-19/+19
| | | | | | | | | | | | | | | | Both have been migrated to use namespaces.
* | | | Merge branch 'twigification'Hanne Moa2016-07-1326-79/+587
|\ \ \ \ | |/ / / |/| | | | | | | | | | | This allows for using twig templates, but does not include code for localizing twig templates.
| * | | Allow running without template cache setHanne Moa2016-07-131-3/+7
| | | |
| * | | Document template config switchHanne Moa2016-03-011-0/+4
| | | |
| * | | Move method next to its deprecated kinHanne Moa2016-03-011-11/+11
| | | |
generated by cgit v1.1 at 2025-05-12 20:13:41 +0000