Skip to content

Migrate metadata generation to new SAML2-library#1901

Draft
tvdijen wants to merge 18 commits intomasterfrom
saml2v5_metadata
Draft

Migrate metadata generation to new SAML2-library#1901
tvdijen wants to merge 18 commits intomasterfrom
saml2v5_metadata

Conversation

@tvdijen
Copy link
Copy Markdown
Member

@tvdijen tvdijen commented Nov 20, 2023

This PR aims to partially migrate to the new SAML2 library. First run: metadata generation!

To do:

  • Raise coverage on the MetadataBuilder class.
  • Create a MetadataParser class as a replacement of the old SAMLParser class. This class should be able to parse XML metadata into SimpleSAMLphp's array-format. The Signer class should become obsolete.
  • Convert the ADFS module to use the new MetadataBuilder class. This also requires us to add a few missing classes to the ws-security library and . Missing classes are:
    • wst:RequestSecurityTokenResponse
    • wst:RequestSecurityToken
    • wsp:AppliesTo
  • Ensure that metadata we generate or consume complies with: https://docs.oasis-open.org/security/saml/Post2.0/sstc-metadata-iop-os.pdf

@codecov
Copy link
Copy Markdown

codecov bot commented Nov 20, 2023

Codecov Report

Merging #1901 (74d478c) into master (d456913) will decrease coverage by 0.49%.
Report is 3 commits behind head on master.
The diff coverage is 52.95%.

Additional details and impacted files
@@             Coverage Diff              @@
##             master    #1901      +/-   ##
============================================
- Coverage     44.59%   44.10%   -0.49%     
+ Complexity     3743     3720      -23     
============================================
  Files           166      165       -1     
  Lines         12728    12728              
============================================
- Hits           5676     5614      -62     
- Misses         7052     7114      +62     

@tvdijen tvdijen force-pushed the saml2v5_metadata branch 4 times, most recently from 7cd3f83 to 74d478c Compare November 27, 2023 23:31
@tvdijen tvdijen force-pushed the master branch 3 times, most recently from ccb9b02 to 120a100 Compare December 1, 2023 14:34
@tvdijen tvdijen force-pushed the saml2v5_metadata branch from 74d478c to 80b1a9d Compare April 2, 2024 18:53
@tvdijen tvdijen force-pushed the saml2v5_metadata branch 6 times, most recently from e0b429d to ab9195e Compare April 29, 2024 15:50
@tvdijen tvdijen force-pushed the master branch 2 times, most recently from 6004a77 to 58bf8db Compare May 4, 2024 23:45
@tvdijen tvdijen force-pushed the master branch 2 times, most recently from 5c9fb2c to 0970efc Compare May 27, 2024 12:27
@tvdijen tvdijen force-pushed the master branch 2 times, most recently from c27831c to 71e49f4 Compare June 19, 2024 17:03
@tvdijen tvdijen force-pushed the master branch 6 times, most recently from 35e78c0 to 5f06278 Compare March 23, 2026 21:37
@monkeyiq
Copy link
Copy Markdown
Contributor

I noticed a few things on the first reading. One which is probably a matter of style is the old getEntityDescriptorText method being removed seems to want replication of the following lines in places that used to call that.

            $entityDescriptor = $builder->buildDocument();
            $document = $entityDescriptor->toXML();
            $document->ownerDocument->formatOutput = true;
            $document->ownerDocument->encoding = 'UTF-8';
            $xml = $document->ownerDocument->saveXML();

If the document is not used for other purposes than builder to XML string then maybe having a buildXMLString() in MetadataBuilder?

            $xml = $builder->buildXMLString();

@tvdijen
Copy link
Copy Markdown
Member Author

tvdijen commented Mar 31, 2026

Yes, I believe these lines are replicated one or two times, so it makes sense to refactor this into a new method!

@monkeyiq
Copy link
Copy Markdown
Contributor

I have been working on a MetadataParser implementation. It is sort of a copy from SAMLParser and attempt to update the code so a copy of SAMLParserTest copied to MetadataParserTest will actually run. It is a bit slow going at the moment.

@monkeyiq
Copy link
Copy Markdown
Contributor

I am trying to get DiscoveryResponse to be processed properly for the first test to actually complete :/

@tvdijen
Copy link
Copy Markdown
Member Author

tvdijen commented Mar 31, 2026

Make sure to leverage the toArray-method on some of the saml2-elements. We can add more if needed

monkeyiq and others added 6 commits April 10, 2026 09:42
The MetadataParser is based on SAMLParser with the API being updated
to the newer saml library. This is part of the update effort to move
code that was using saml2-legacy to use saml2 instead.

Note that this is very much a WIP with only the first test
testDiscoveryResponse updated to using the new MetadataParser class.
That one test does now complete so it is a good first move toward that
whole file using the new API.

This is also rough at this stage and will need more polish once all
the tests are passing.
Comment thread tests/src/SimpleSAML/Metadata/MetadataParserTest.php Outdated
@monkeyiq
Copy link
Copy Markdown
Contributor

I should have the other 9 tests working today or very soon. The code is still extremely ugly, my first goal was getting the existing tests to all work on MetadataParser and then move on from there.

I pushed the starting changes up here as it was a new class and an update to the one test file. As I have point on this update I thought that wasn't going to get in the way of anything being partial.

@monkeyiq
Copy link
Copy Markdown
Contributor

monkeyiq commented Apr 13, 2026

My starting plan was to create MetadataParser as a copy of SAMLParser and update it to the new SimpleSAML\SAML2\XML\md classes. Then I would try to get the tests in MetadataParserTest.php to all run again. That is the place I am at currently. [ed: the 10 tests now run]

The code in MetadataParser is very rough and not "merge ready" but does what is needed for that test suite file to run and be happy. From there working out how to merge the changes inisHiddenFromDiscoveryAV into isHiddenFromDiscovery so there are not two methods and substituting out the self::flatten method for something more descriptive or correct. Then making the MetadataParser class more of a first class citizen (fully update the code and remove redundant stuff) while still running the test suite ok is the goal.

Comment thread src/SimpleSAML/Metadata/MetadataParser.php Outdated
The unit test was also expecting an epoch integer here so that got
updated to expecting a Z time string.
There is a choice to either use an array of SAMLAnyURIValue for a
$SAML20Protocols function replacement and then intersect on that or we
can flatten the objects to strings an the normal array_intersect will
work ok on the same data types here.

I have code that does both things depending on which we are after.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants