Migrate saml:AuthnContext

tvdijen · tvdijen · commit 0aee0e5ba43d · 2023-08-02T09:26:49.000+02:00
diff --git a/modules/saml/src/Controller/ServiceProvider.php b/modules/saml/src/Controller/ServiceProvider.php
@@ -415,7 +415,7 @@ public function assertionConsumerService(Request $request, string $sourceId): Re
         $state['PersistentAuthData'][] = 'saml:AuthnInstant';
         $state['saml:sp:SessionIndex'] = $sessionIndex;
         $state['PersistentAuthData'][] = 'saml:sp:SessionIndex';
-        $state['saml:sp:AuthnContext'] = $assertion->getAuthnContextClassRef();
+        $state['saml:sp:AuthnContext'] = $assertion->getAuthnContext()?->getAuthnContextClassRef();
         $state['PersistentAuthData'][] = 'saml:sp:AuthnContext';
 
         if ($expire !== null) {
diff --git a/modules/saml/src/IdP/SAML2.php b/modules/saml/src/IdP/SAML2.php
@@ -19,6 +19,7 @@
 use SimpleSAML\SAML2\Exception\ArrayValidationException;
 use SimpleSAML\SAML2\XML\md\ContactPerson;
 use SimpleSAML\SAML2\XML\saml\{AttributeValue, Issuer, NameID, SubjectConfirmation, SubjectConfirmationData};
+use SimpleSAML\SAML2\XML\saml\{AuthenticatingAuthority, AuthnContext, AuthnContextClassRef}; // AuthnContext
 use SimpleSAML\SAML2\XML\samlp\{Status, StatusCode, StatusMessage}; // Status
 use SimpleSAML\XML\DOMDocumentFactory;
 use SimpleSAML\XMLSecurity\XML\ds\{X509Certificate, X509Data, KeyInfo};
@@ -86,10 +87,6 @@ public static function sendResponse(array $state): Response
 
         $assertion = self::buildAssertion($idpMetadata, $spMetadata, $state);
 
-        if (isset($state['saml:AuthenticatingAuthority'])) {
-            $assertion->setAuthenticatingAuthority($state['saml:AuthenticatingAuthority']);
-        }
-
         // create the session association (for logout)
         $association = [
             'id'                => 'saml:' . $spEntityId,
@@ -1184,16 +1181,28 @@ private static function buildAssertion(
 
         $passAuthnContextClassRef = $config->getOptionalBoolean('proxymode.passAuthnContextClassRef', false);
         if (isset($state['saml:AuthnContextClassRef'])) {
-            $a->setAuthnContextClassRef($state['saml:AuthnContextClassRef']);
+            $classRef = $state['saml:AuthnContextClassRef'];
         } elseif ($passAuthnContextClassRef && isset($state['saml:sp:AuthnContext'])) {
             // AuthnContext has been set by the upper IdP in front of the proxy, pass it back to the SP behind the proxy
-            $a->setAuthnContextClassRef($state['saml:sp:AuthnContext']);
-        } elseif ($httpUtils->isHTTPS()) {
-            $a->setAuthnContextClassRef(C::AC_PASSWORD_PROTECTED_TRANSPORT);
+            $classRef = $state['saml:sp:AuthnContext'];
         } else {
-            $a->setAuthnContextClassRef(C::AC_PASSWORD);
+            $classRef = $httpUtils->isHTTPS() ? C::AC_PASSWORD_PROTECTED_TRANSPORT : C::AC_PASSWORD;
+        }
+
+        $authorities = [];
+        if (isset($state['saml:AuthenticatingAuthority'])) {
+            $authorities[] = new AuthenticatingAuthority($state['saml:AuthenticatingAuthority']);
         }
 
+        $a->setAuthnContext(
+            new AuthnContext(
+                authnContextClassRef: new AuthnContextClassRef($classRef),
+                authnContextDecl: null,
+                authnContextDeclRef: null,
+                authenticatingAuthorities: $authorities,
+            )
+        );
+
         $sessionStart = $now;
         if (isset($state['AuthnInstant'])) {
             $a->setAuthnInstant($state['AuthnInstant']);
