Bugfix/nameid policy (#2603)

tvdijen · monkeyiq · web-flow · commit 76cee4a02cc2 · 2026-03-05T11:40:03.000+10:00
* Bugfix: don't set illegal combination of AllowCreate/Format

* Force allowCreate to false if format is TRANSIENT

I also kept a reference to the errata 05 page/line here in a comment

* allowCreate is true by default and contained for TRANSIENT

As the default was true for this before it is now that way again. If
the format is NAMEID_TRANSIENT it will be set to respect the Errata 05.

* The persistent default is back to having allowCreate=true

---------

Co-authored-by: Ben Martin &lt;monkeyiq@users.sourceforge.net&gt;
diff --git a/modules/saml/src/Auth/Source/SP.php b/modules/saml/src/Auth/Source/SP.php
@@ -593,8 +593,11 @@ private function startSSO2(Configuration $idpMetadata, array $state): void
 
         if (!empty($state['saml:NameIDPolicy'])) {
             $ar->setNameIdPolicy($state['saml:NameIDPolicy']);
+        } else {
+            $ar->setNameIdPolicy($this->metadata->getOptionalArray('NameIDPolicy', []));
         }
 
+
         $requesterID = [];
 
         /* Only check for real info for Scoping element if we are going to send Scoping element */
diff --git a/src/SimpleSAML/Utils/Config/Metadata.php b/src/SimpleSAML/Utils/Config/Metadata.php
@@ -248,7 +248,7 @@ public static function parseNameIdPolicy(?array $nameIdPolicy = null): array
     {
         if ($nameIdPolicy === null) {
             // when NameIDPolicy is unset or set to null, default to transient
-            return ['Format' => Constants::NAMEID_TRANSIENT, 'AllowCreate' => true];
+            return ['Format' => Constants::NAMEID_TRANSIENT, 'AllowCreate' => false];
         }
 
         if ($nameIdPolicy === []) {
@@ -258,9 +258,17 @@ public static function parseNameIdPolicy(?array $nameIdPolicy = null): array
 
         // handle configurations specifying an array in the NameIDPolicy config option
         $nameIdPolicy_cf = Configuration::loadFromArray($nameIdPolicy);
+        $format = $nameIdPolicy_cf->getOptionalString('Format', Constants::NAMEID_TRANSIENT);
+        $allowCreate = $nameIdPolicy_cf->getOptionalBoolean('AllowCreate', true);
+        //  SAML Version 2.0 Errata 05 lines 252-255 (pg 12)
+        if ($format === Constants::NAMEID_TRANSIENT) {
+            if ($allowCreate) {
+                $allowCreate = false;
+            }
+        }
         $policy = [
-            'Format'      => $nameIdPolicy_cf->getOptionalString('Format', Constants::NAMEID_TRANSIENT),
-            'AllowCreate' => $nameIdPolicy_cf->getOptionalBoolean('AllowCreate', true),
+            'Format'      => $format,
+            'AllowCreate' => $allowCreate,
         ];
         $spNameQualifier = $nameIdPolicy_cf->getOptionalString('SPNameQualifier', null);
         if ($spNameQualifier !== null) {
diff --git a/tests/modules/saml/src/Auth/Source/SPTest.php b/tests/modules/saml/src/Auth/Source/SPTest.php
@@ -164,7 +164,7 @@ private function createLogoutRequest(array $state = []): LogoutRequest
      */
     public function testAuthnRequest(): void
     {
-        $ar = $this->createAuthnRequest();
+        $ar = $this->createAuthnRequest(['NameIDPolicy' => ['AllowCreate' => false]]);
 
         $xml = $ar->toSignedXML();
 
diff --git a/tests/src/SimpleSAML/Utils/Config/MetadataTest.php b/tests/src/SimpleSAML/Utils/Config/MetadataTest.php
@@ -257,7 +257,7 @@ public function testParseNameIdPolicyDefaults(): void
         $nameIdPolicy = null;
         $this->assertEquals([
             'Format' => Constants::NAMEID_TRANSIENT,
-            'AllowCreate' => true,
+            'AllowCreate' => false,
         ], Metadata::parseNameIdPolicy($nameIdPolicy));
 
         $nameIdPolicy = [

Original file line number	Diff line number	Diff line change
`@@ -593,8 +593,11 @@ private function startSSO2(Configuration $idpMetadata, array $state): void`
`593`	`593`
`594`	`594`	`if (!empty($state['saml:NameIDPolicy'])) {`
`595`	`595`	`$ar->setNameIdPolicy($state['saml:NameIDPolicy']);`
	`596`	`+ } else {`
	`597`	`+ $ar->setNameIdPolicy($this->metadata->getOptionalArray('NameIDPolicy', []));`
`596`	`598`	`}`
`597`	`599`
	`600`	`+`
`598`	`601`	`$requesterID = [];`
`599`	`602`
`600`	`603`	`/* Only check for real info for Scoping element if we are going to send Scoping element */`
Original file line number	Diff line number	Diff line change
`@@ -164,7 +164,7 @@ private function createLogoutRequest(array $state = []): LogoutRequest`
`164`	`164`	`*/`
`165`	`165`	`public function testAuthnRequest(): void`
`166`	`166`	`{`
`167`		`- $ar = $this->createAuthnRequest();`
	`167`	`+ $ar = $this->createAuthnRequest(['NameIDPolicy' => ['AllowCreate' => false]]);`
`168`	`168`
`169`	`169`	`$xml = $ar->toSignedXML();`
`170`	`170`