Skip to content

Commit 1df8a6b

Browse files
ghalseghalse
authored
All NameID authproc-filters use identifyingAttribute (simplesamlphp#1709)
1 parent b403cbe commit 1df8a6b

8 files changed

Lines changed: 61 additions & 46 deletions

File tree

‎docs/simplesamlphp-googleapps.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -145,13 +145,13 @@ In the `saml20-sp-remote.php` file we will configure an entry for Google Workspa
145145
* must properly configure the saml:AttributeNameID authproc-filter with the name of an attribute that for this user has the value of 'john'.
146146
*/
147147
$metadata['https://www.google.com/a/g.feide.no'] => [
148-
'AssertionConsumerService' => 'https://www.google.com/a/g.feide.no/acs',
148+
'AssertionConsumerService' => 'https://www.google.com/a/g.feide.no/acs',
149149
'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
150150
'simplesaml.attributes' => false,
151151
'authproc' => [
152152
1 => [
153153
'saml:AttributeNameID',
154-
'attribute' => 'uid',
154+
'identifyingAttribute' => 'uid',
155155
'format' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
156156
],
157157
],

‎docs/simplesamlphp-upgrade-notes-2.0.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@ composer require simplesamlphp/simplesamlphp-module-ldap --update-no-dev
2929
by setting `validate.authnrequest` to `false`. If unset (or set to true) signatures will be
3030
validated if present and requests not passing validation will be refused.
3131
- In the core:TargetedID authproc-filter, the `attributename` setting has been renamed to `identifyingAttribute`.
32+
Similarly, in the saml:AttributeNameID, saml:PersistentNameID and saml:SQLPersistentNameId authproc-filters, the
33+
`attribute` setting has been renamed to `identifyingAttribute` for consistency with other NameID filters.
3234
- The default encryption algorithm is set from `AES128_CBC` to `AES128_GCM`.
3335
It is possible to switch back via the `sharedkey_algorithm`.
3436
Note however that CBC is vulnerable to the Padding oracle attack.

‎metadata-templates/saml20-sp-remote.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
'authproc' => [
2828
1 => [
2929
'saml:AttributeNameID',
30-
'attribute' => 'uid',
30+
'identifyingAttribute' => 'uid',
3131
'format' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
3232
],
3333
],

‎modules/core/docs/authproc_targetedid.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@
33

44
This filter generates the `eduPersonTargetedID` attribute for the user.
55

6-
This filter will use the contents of the attribute set by the `attributename` option as the unique user ID.
6+
This filter will use the contents of the attribute set by the `identifyingAttribute` option as the unique user ID.
77

88
Parameters
99
----------
1010

11-
`attributename`
11+
`identifyingAttribute`
1212
: The name of the attribute we should use for the unique user identifier.
1313

1414
Note: only the first value of the specified attribute is being used for the generation of the identifier.
@@ -26,7 +26,7 @@ A custom attribute:
2626
'authproc' => [
2727
50 => [
2828
'class' => 'core:TargetedID',
29-
'attributename' => 'eduPersonPrincipalName'
29+
'identifyingAttribute' => 'eduPersonPrincipalName'
3030
],
3131
],
3232

‎modules/saml/docs/nameid.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ Uses the value of an attribute to generate a NameID.
2626

2727
**Options**:
2828

29-
`attribute`
29+
`identifyingAttribute`
3030
: The name of the attribute we should use as the unique user ID.
3131

3232
`Format`
@@ -40,7 +40,7 @@ The resulting hash is sent as the persistent NameID.
4040

4141
**Options**:
4242

43-
`attribute`
43+
`identifyingAttribute`
4444
: The name of the attribute we should use as the unique user ID.
4545

4646
## `saml:TransientNameID`
@@ -60,7 +60,7 @@ See the `store.type` configuration option in `config.php`.
6060

6161
**Options**:
6262

63-
`attribute`
63+
`identifyingAttribute`
6464
: The name of the attribute we should use as the unique user ID.
6565

6666
`allowUnspecified`
@@ -109,11 +109,11 @@ This example makes three NameIDs available:
109109
],
110110
2 => [
111111
'class' => 'saml:PersistentNameID',
112-
'attribute' => 'eduPersonPrincipalName',
112+
'identifyingAttribute' => 'eduPersonPrincipalName',
113113
],
114114
3 => [
115115
'class' => 'saml:AttributeNameID',
116-
'attribute' => 'mail',
116+
'identifyingAttribute' => 'mail',
117117
'Format' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
118118
],
119119
],
@@ -126,7 +126,7 @@ Storing persistent NameIDs in a SQL database:
126126
],
127127
2 => [
128128
'class' => 'saml:SQLPersistentNameID',
129-
'attribute' => 'eduPersonPrincipalName',
129+
'identifyingAttribute' => 'eduPersonPrincipalName',
130130
],
131131
],
132132

@@ -136,7 +136,7 @@ Generating Persistent NameID and eduPersonTargetedID.
136136
// Generate the persistent NameID.
137137
2 => [
138138
'class' => 'saml:PersistentNameID',
139-
'attribute' => 'eduPersonPrincipalName',
139+
'identifyingAttribute' => 'eduPersonPrincipalName',
140140
],
141141
// Add the persistent to the eduPersonTargetedID attribute
142142
60 => [

‎modules/saml/src/Auth/Process/AttributeNameID.php‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class AttributeNameID extends BaseNameIDGenerator
2222
*
2323
* @var string
2424
*/
25-
private string $attribute;
25+
private string $identifyingAttribute;
2626

2727

2828
/**
@@ -31,7 +31,7 @@ class AttributeNameID extends BaseNameIDGenerator
3131
* @param array $config Configuration information about this filter.
3232
* @param mixed $reserved For future use.
3333
*
34-
* @throws \SimpleSAML\Error\Exception If the required options 'Format' or 'attribute' are missing.
34+
* @throws \SimpleSAML\Error\Exception If the required options 'Format' or 'identifyingAttribute' are missing.
3535
*/
3636
public function __construct(array $config, $reserved)
3737
{
@@ -42,10 +42,10 @@ public function __construct(array $config, $reserved)
4242
}
4343
$this->format = (string) $config['Format'];
4444

45-
if (!isset($config['attribute'])) {
46-
throw new Error\Exception("AttributeNameID: Missing required option 'attribute'.");
45+
if (!isset($config['identifyingAttribute'])) {
46+
throw new Error\Exception("AttributeNameID: Missing required option 'identifyingAttribute'.");
4747
}
48-
$this->attribute = (string) $config['attribute'];
48+
$this->identifyingAttribute = (string) $config['identifyingAttribute'];
4949
}
5050

5151

@@ -57,26 +57,30 @@ public function __construct(array $config, $reserved)
5757
*/
5858
protected function getValue(array &$state): ?string
5959
{
60-
if (!isset($state['Attributes'][$this->attribute]) || count($state['Attributes'][$this->attribute]) === 0) {
60+
if (
61+
!isset($state['Attributes'][$this->identifyingAttribute])
62+
|| count($state['Attributes'][$this->identifyingAttribute]) === 0
63+
) {
6164
Logger::warning(
62-
'Missing attribute ' . var_export($this->attribute, true) .
65+
'Missing attribute ' . var_export($this->identifyingAttribute, true) .
6366
' on user - not generating attribute NameID.'
6467
);
6568
return null;
6669
}
67-
if (count($state['Attributes'][$this->attribute]) > 1) {
70+
if (count($state['Attributes'][$this->identifyingAttribute]) > 1) {
6871
Logger::warning(
69-
'More than one value in attribute ' . var_export($this->attribute, true) .
72+
'More than one value in attribute ' . var_export($this->identifyingAttribute, true) .
7073
' on user - not generating attribute NameID.'
7174
);
7275
return null;
7376
}
74-
$value = array_values($state['Attributes'][$this->attribute]); // just in case the first index is no longer 0
77+
// just in case the first index is no longer 0
78+
$value = array_values($state['Attributes'][$this->identifyingAttribute]);
7579
$value = strval($value[0]);
7680

7781
if (empty($value)) {
7882
Logger::warning(
79-
'Empty value in attribute ' . var_export($this->attribute, true) .
83+
'Empty value in attribute ' . var_export($this->identifyingAttribute, true) .
8084
' on user - not generating attribute NameID.'
8185
);
8286
return null;

‎modules/saml/src/Auth/Process/PersistentNameID.php‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ class PersistentNameID extends BaseNameIDGenerator
2424
*
2525
* @var string
2626
*/
27-
private string $attribute;
27+
private string $identifyingAttribute;
2828

2929

3030
/**
@@ -33,18 +33,18 @@ class PersistentNameID extends BaseNameIDGenerator
3333
* @param array $config Configuration information about this filter.
3434
* @param mixed $reserved For future use.
3535
*
36-
* @throws \SimpleSAML\Error\Exception If the required option 'attribute' is missing.
36+
* @throws \SimpleSAML\Error\Exception If the required option 'identifyingAttribute' is missing.
3737
*/
3838
public function __construct(array $config, $reserved)
3939
{
4040
parent::__construct($config, $reserved);
4141

4242
$this->format = Constants::NAMEID_PERSISTENT;
4343

44-
if (!isset($config['attribute'])) {
45-
throw new Error\Exception("PersistentNameID: Missing required option 'attribute'.");
44+
if (!isset($config['identifyingAttribute'])) {
45+
throw new Error\Exception("PersistentNameID: Missing required option 'identifyingAttribute'.");
4646
}
47-
$this->attribute = $config['attribute'];
47+
$this->identifyingAttribute = $config['identifyingAttribute'];
4848
}
4949

5050

@@ -68,26 +68,30 @@ protected function getValue(array &$state): ?string
6868
}
6969
$idpEntityId = $state['Source']['entityid'];
7070

71-
if (!isset($state['Attributes'][$this->attribute]) || count($state['Attributes'][$this->attribute]) === 0) {
71+
if (
72+
!isset($state['Attributes'][$this->identifyingAttribute])
73+
|| count($state['Attributes'][$this->identifyingAttribute]) === 0
74+
) {
7275
Logger::warning(
73-
'Missing attribute ' . var_export($this->attribute, true) .
76+
'Missing attribute ' . var_export($this->identifyingAttribute, true) .
7477
' on user - not generating persistent NameID.'
7578
);
7679
return null;
7780
}
78-
if (count($state['Attributes'][$this->attribute]) > 1) {
81+
if (count($state['Attributes'][$this->identifyingAttribute]) > 1) {
7982
Logger::warning(
80-
'More than one value in attribute ' . var_export($this->attribute, true) .
83+
'More than one value in attribute ' . var_export($this->identifyingAttribute, true) .
8184
' on user - not generating persistent NameID.'
8285
);
8386
return null;
8487
}
85-
$uid = array_values($state['Attributes'][$this->attribute]); // just in case the first index is no longer 0
88+
// just in case the first index is no longer 0
89+
$uid = array_values($state['Attributes'][$this->identifyingAttribute]);
8690
$uid = $uid[0];
8791

8892
if (empty($uid)) {
8993
Logger::warning(
90-
'Empty value in attribute ' . var_export($this->attribute, true) .
94+
'Empty value in attribute ' . var_export($this->identifyingAttribute, true) .
9195
' on user - not generating persistent NameID.'
9296
);
9397
return null;

‎modules/saml/src/Auth/Process/SQLPersistentNameID.php‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ class SQLPersistentNameID extends BaseNameIDGenerator
2323
*
2424
* @var string
2525
*/
26-
private string $attribute;
26+
private string $identifyingAttribute;
2727

2828
/**
2929
* Whether we should create a persistent NameID if not explicitly requested (as saml:PersistentNameID does).
@@ -60,18 +60,18 @@ class SQLPersistentNameID extends BaseNameIDGenerator
6060
* @param array $config Configuration information about this filter.
6161
* @param mixed $reserved For future use.
6262
*
63-
* @throws \SimpleSAML\Error\Exception If the 'attribute' option is not specified.
63+
* @throws \SimpleSAML\Error\Exception If the 'identifyingAttribute' option is not specified.
6464
*/
6565
public function __construct(array &$config, $reserved)
6666
{
6767
parent::__construct($config, $reserved);
6868

6969
$this->format = Constants::NAMEID_PERSISTENT;
7070

71-
if (!isset($config['attribute'])) {
72-
throw new Error\Exception("PersistentNameID: Missing required option 'attribute'.");
71+
if (!isset($config['identifyingAttribute'])) {
72+
throw new Error\Exception("PersistentNameID: Missing required option 'identifyingAttribute'.");
7373
}
74-
$this->attribute = $config['attribute'];
74+
$this->identifyingAttribute = $config['identifyingAttribute'];
7575

7676
if (isset($config['allowUnspecified'])) {
7777
$this->allowUnspecified = (bool) $config['allowUnspecified'];
@@ -137,26 +137,31 @@ protected function getValue(array &$state): ?string
137137
}
138138
$idpEntityId = $state['Source']['entityid'];
139139

140-
if (!isset($state['Attributes'][$this->attribute]) || count($state['Attributes'][$this->attribute]) === 0) {
140+
if (
141+
!isset($state['Attributes'][$this->identifyingAttribute])
142+
|| count($state['Attributes'][$this->identifyingAttribute]) === 0
143+
) {
141144
Logger::warning(
142-
'SQLPersistentNameID: Missing attribute ' . var_export($this->attribute, true) .
145+
'SQLPersistentNameID: Missing attribute ' . var_export($this->identifyingAttribute, true) .
143146
' on user - not generating persistent NameID.'
144147
);
145148
return null;
146149
}
147-
if (count($state['Attributes'][$this->attribute]) > 1) {
150+
if (count($state['Attributes'][$this->identifyingAttribute]) > 1) {
148151
Logger::warning(
149-
'SQLPersistentNameID: More than one value in attribute ' . var_export($this->attribute, true) .
152+
'SQLPersistentNameID: More than one value in attribute ' .
153+
var_export($this->identifyingAttribute, true) .
150154
' on user - not generating persistent NameID.'
151155
);
152156
return null;
153157
}
154-
$uid = array_values($state['Attributes'][$this->attribute]); // just in case the first index is no longer 0
158+
// just in case the first index is no longer 0
159+
$uid = array_values($state['Attributes'][$this->identifyingAttribute]);
155160
$uid = $uid[0];
156161

157162
if (empty($uid)) {
158163
Logger::warning(
159-
'Empty value in attribute ' . var_export($this->attribute, true) .
164+
'Empty value in attribute ' . var_export($this->identifyingAttribute, true) .
160165
' on user - not generating persistent NameID.'
161166
);
162167
return null;

0 commit comments

Comments
 (0)