Do not overwrite $request, initially the Symfony HTTP Request, with a SAML AuthnRequest halfway through the method

thijskh · thijskh · commit 21eba3279dc6 · 2024-05-01T10:20:11.000Z
diff --git a/modules/saml/src/IdP/SAML2.php b/modules/saml/src/IdP/SAML2.php
@@ -411,17 +411,17 @@ public static function receiveAuthnRequest(Request $request, IdP $idp): Response
             $psrHttpFactory = new PsrHttpFactory($psr17Factory, $psr17Factory, $psr17Factory, $psr17Factory);
             $psrRequest = $psrHttpFactory->createRequest($request);
             $binding = Binding::getCurrentBinding($psrRequest);
-            $request = $binding->receive($psrRequest);
+            $authnRequest = $binding->receive($psrRequest);
 
-            if (!($request instanceof AuthnRequest)) {
+            if (!($authnRequest instanceof AuthnRequest)) {
                 throw new Error\BadRequest(
                     "Message received on authentication request endpoint wasn't an authentication request."
                 );
             }
 
             $username = $request->get('username', null);
 
-            $issuer = $request->getIssuer();
+            $issuer = $authnRequest->getIssuer();
             if ($issuer === null) {
                 throw new Error\BadRequest(
                     'Received message on authentication request endpoint without issuer.'
@@ -430,12 +430,12 @@ public static function receiveAuthnRequest(Request $request, IdP $idp): Response
             $spEntityId = $issuer->getContent();
             $spMetadata = $metadata->getMetaDataConfig($spEntityId, 'saml20-sp-remote');
 
-            $authnRequestSigned = Message::validateMessage($spMetadata, $idpMetadata, $request);
+            $authnRequestSigned = Message::validateMessage($spMetadata, $idpMetadata, $authnRequest);
 
-            $relayState = $request->getRelayState();
+            $relayState = $authnRequest->getRelayState();
 
-            $requestId = $request->getId();
-            $scoping = $request->getScoping();
+            $requestId = $authnRequest->getId();
+            $scoping = $authnRequest->getScoping();
 
             $ProxyCount = $scoping?->getProxyCount();
             if ($ProxyCount !== null) {
@@ -457,15 +457,15 @@ public static function receiveAuthnRequest(Request $request, IdP $idp): Response
                 }
             }
 
-            $forceAuthn = $request->getForceAuthn();
-            $isPassive = $request->getIsPassive();
-            $consumerURL = $request->getAssertionConsumerServiceURL();
-            $protocolBinding = $request->getProtocolBinding();
-            $consumerIndex = $request->getAssertionConsumerServiceIndex();
-            $extensions = $request->getExtensions();
-            $authnContext = $request->getRequestedAuthnContext();
+            $forceAuthn = $authnRequest->getForceAuthn();
+            $isPassive = $authnRequest->getIsPassive();
+            $consumerURL = $authnRequest->getAssertionConsumerServiceURL();
+            $protocolBinding = $authnRequest->getProtocolBinding();
+            $consumerIndex = $authnRequest->getAssertionConsumerServiceIndex();
+            $extensions = $authnRequest->getExtensions();
+            $authnContext = $authnRequest->getRequestedAuthnContext();
 
-            $nameIdPolicy = $request->getNameIdPolicy();
+            $nameIdPolicy = $authnRequest->getNameIdPolicy();
             $nameIDFormat = $nameIdPolicy?->getFormat();
             $allowCreate = $nameIdPolicy?->getAllowCreate() ?? false;
 
