Repair the IdP a little bit

thijskh · thijskh · commit ea70b5dcd4a2 · 2024-05-01T10:32:20.000Z
diff --git a/modules/saml/src/IdP/SAML2.php b/modules/saml/src/IdP/SAML2.php
@@ -20,7 +20,7 @@
 use SimpleSAML\SAML2\Exception\ArrayValidationException;
 use SimpleSAML\SAML2\XML\md\ContactPerson;
 use SimpleSAML\SAML2\XML\saml\{Assertion, EncryptedAssertion}; // Assertions
-use SimpleSAML\SAML2\XML\saml\{AttributeValue, Audience, Issuer, NameID, SubjectConfirmation, SubjectConfirmationData};
+use SimpleSAML\SAML2\XML\saml\{AttributeValue, Audience, Issuer, NameID, Subject, SubjectConfirmation, SubjectConfirmationData};
 use SimpleSAML\SAML2\XML\saml\{AuthenticatingAuthority, AuthnContext, AuthnContextClassRef}; // AuthnContext
 use SimpleSAML\SAML2\XML\samlp\{AuthnRequest, LogoutRequest, LogoutResponse, Response as SAML2_Response}; // Messages
 use SimpleSAML\SAML2\XML\samlp\{Status, StatusCode, StatusMessage}; // Status
@@ -1188,7 +1188,11 @@ private static function buildAssertion(
             Format: C::NAMEID_ENTITY,
         );
 
-        $a = new Assertion($issuer, new \DateTimeImmutable('now', new \DateTimeZone('Z')));
+        $nameId = self::generateNameId($idpMetadata, $spMetadata, $state);
+        $state['saml:idp:NameID'] = $nameId;
+        $subject = new Subject($nameId);
+
+        $a = new Assertion($issuer, new \DateTimeImmutable('now', new \DateTimeZone('Z')), null, $subject);
         if ($signAssertion) {
             Message::addSign($idpMetadata, $spMetadata, $a);
         }
@@ -1314,10 +1318,6 @@ private static function buildAssertion(
             $a->setAttributes($attributes);
         }
 
-        $nameId = self::generateNameId($idpMetadata, $spMetadata, $state);
-        $state['saml:idp:NameID'] = $nameId;
-        $a->setNameId($nameId);
-
         $encryptNameId = $spMetadata->getOptionalBoolean('nameid.encryption', null);
         if ($encryptNameId === null) {
             $encryptNameId = $idpMetadata->getOptionalBoolean('nameid.encryption', false);
