Skip to content

Commit 2c3cfac

Browse files
waterkipwaterkip
authored
Merge pull request #155 from waterkip/GL-no-name_id_ADFS
Allow assertion without a NameID
2 parents 7d81f20 + 33d9985 commit 2c3cfac

File tree

3 files changed

+100
-5
lines changed

3 files changed

+100
-5
lines changed

‎lib/Net/SAML2/Protocol/Assertion.pm‎

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,8 +41,9 @@ has 'xpath' => (isa => 'XML::LibXML::XPathContext', is => 'ro', required => 1);
4141
has 'nameid_object' => (
4242
isa => 'XML::LibXML::Element',
4343
is => 'ro',
44-
required => 1,
45-
init_arg => 'nameid'
44+
required => 0,
45+
init_arg => 'nameid',
46+
predicate => 'has_nameid',
4647
);
4748

4849
=head1 METHODS
@@ -166,12 +167,20 @@ sub new_from_xml {
166167
$not_after = DateTime->from_epoch(epoch => time() + 1000);
167168
}
168169

170+
my $nameid;
171+
if (my $node = $xpath->findnodes('//samlp:Response/saml:Assertion/saml:Subject/ saml:NameID')) {
172+
$nameid = $node->get_node(1);
173+
}
174+
elsif (my $global = $xpath->findnodes('//saml:Subject/saml:NameID')) {
175+
$nameid = $global->get_node(1);
176+
}
177+
169178
my $self = $class->new(
170179
issuer => $xpath->findvalue('//saml:Assertion/saml:Issuer'),
171180
destination => $xpath->findvalue('/samlp:Response/@Destination'),
172181
attributes => $attributes,
173182
session => $xpath->findvalue('//saml:AuthnStatement/@SessionIndex'),
174-
nameid => $xpath->findnodes('//saml:Subject/saml:NameID')->get_node(1),
183+
$nameid ? (nameid => $nameid) : (),
175184
audience => $xpath->findvalue('//saml:Conditions/saml:AudienceRestriction/saml:Audience'),
176185
not_before => $not_before,
177186
not_after => $not_after,
@@ -202,6 +211,7 @@ Returns the NameID
202211

203212
sub nameid {
204213
my $self = shift;
214+
return unless $self->has_nameid;
205215
return $self->nameid_object->textContent;
206216
}
207217

@@ -213,6 +223,7 @@ Returns the NameID Format
213223

214224
sub nameid_format {
215225
my $self = shift;
226+
return unless $self->has_nameid;
216227
return $self->nameid_object->getAttribute('Format');
217228
}
218229

@@ -224,6 +235,7 @@ Returns the NameID NameQualifier
224235

225236
sub nameid_name_qualifier {
226237
my $self = shift;
238+
return unless $self->has_nameid;
227239
return $self->nameid_object->getAttribute('NameQualifier');
228240
}
229241

@@ -235,6 +247,7 @@ Returns the NameID SPNameQualifier
235247

236248
sub nameid_sp_name_qualifier {
237249
my $self = shift;
250+
return unless $self->has_nameid;
238251
return $self->nameid_object->getAttribute('SPNameQualifier');
239252
}
240253

@@ -246,6 +259,7 @@ Returns the NameID SPProvidedID
246259

247260
sub nameid_sp_provided_id {
248261
my $self = shift;
262+
return unless $self->has_nameid;
249263
return $self->nameid_object->getAttribute('SPProvidedID');
250264
}
251265

‎t/03-assertions.t‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,6 @@ is($assertion->nameid_sp_provided_id,
128128
undef,
129129
"nameid_sp_provided_id undefined as expected");
130130

131-
132-
133131
lives_ok(
134132
sub {
135133
my $xml = path('t/data/eherkenning-assertion.xml')->slurp;
@@ -145,4 +143,12 @@ isa_ok($assertion->not_after, "DateTime", "... and so it not after");
145143
is($assertion->not_before, "2020-06-02T11:48:07", "... and the correct not_before");
146144
is($assertion->not_after, "2020-06-02T11:53:07", "... and the correct not_after");
147145

146+
lives_ok(
147+
sub {
148+
my $xml = path('t/data/saml-adfs-plain.xml')->slurp;
149+
$assertion = Net::SAML2::Protocol::Assertion->new_from_xml(xml => $xml);
150+
},
151+
"Correct parsing of plain ADFS"
152+
);
153+
148154
done_testing;

‎t/data/saml-adfs-plain.xml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
<?xml version="1.0"?>
2+
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_f0b0652f-1382-43af-a70e-97254820f180" Version="2.0" IssueInstant="2018-07-25T08:02:24.342Z" Destination="https://testsuite.zaaksysteem.nl/auth/saml/consumer-post" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" InResponseTo="_c217d2c8502884bf418552907827f430d745fa6c">
3+
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://adfs.dev.mintlab.nl/adfs/services/trust</Issuer>
4+
<samlp:Status>
5+
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
6+
</samlp:Status>
7+
<Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_0024c3a6-3b4e-4920-8c59-0602ae4a3c5d" IssueInstant="2018-07-25T08:02:24.341Z" Version="2.0">
8+
<Issuer>http://adfs.dev.mintlab.nl/adfs/services/trust</Issuer>
9+
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
10+
<ds:SignedInfo>
11+
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
12+
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
13+
<ds:Reference URI="#_0024c3a6-3b4e-4920-8c59-0602ae4a3c5d">
14+
<ds:Transforms>
15+
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
16+
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
17+
</ds:Transforms>
18+
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
19+
<ds:DigestValue>/UGIkccgX9xPwusXApqxm7KDyLpgx7W/tp6gANTvNsw=</ds:DigestValue>
20+
</ds:Reference>
21+
</ds:SignedInfo>
22+
<ds:SignatureValue></ds:SignatureValue>
23+
<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
24+
<ds:X509Data>
25+
<ds:X509Certificate></ds:X509Certificate>
26+
</ds:X509Data>
27+
</KeyInfo>
28+
</ds:Signature>
29+
<Subject>
30+
<SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
31+
<SubjectConfirmationData InResponseTo="_c217d2c8502884bf418552907827f430d745fa6c" NotOnOrAfter="2018-07-25T08:07:24.342Z" Recipient="https://testsuite.zaaksysteem.nl/auth/saml/consumer-post"/>
32+
</SubjectConfirmation>
33+
</Subject>
34+
<Conditions NotBefore="2018-07-25T08:02:24.338Z" NotOnOrAfter="2018-07-25T09:02:24.338Z">
35+
<AudienceRestriction>
36+
<Audience>TestUPN</Audience>
37+
</AudienceRestriction>
38+
</Conditions>
39+
<AttributeStatement>
40+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/initials">
41+
<AttributeValue>G.B.</AttributeValue>
42+
</Attribute>
43+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
44+
<AttributeValue>G&#xC3;&#xA9; G.B.. Ruiker</AttributeValue>
45+
</Attribute>
46+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname">
47+
<AttributeValue>G&#xC3;&#xA9;</AttributeValue>
48+
</Attribute>
49+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
50+
<AttributeValue>gebruiker@testsuite.zaaksysteem.nl</AttributeValue>
51+
</Attribute>
52+
<Attribute Name="http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname">
53+
<AttributeValue>gebruiker</AttributeValue>
54+
</Attribute>
55+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone">
56+
<AttributeValue>0123123123</AttributeValue>
57+
</Attribute>
58+
<Attribute Name="http://schemas.xmlsoap.org/claims/Group">
59+
<AttributeValue>Domain Users</AttributeValue>
60+
<AttributeValue>Zaaksysteemgebruikers</AttributeValue>
61+
</Attribute>
62+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn">
63+
<AttributeValue>gebruiker@testsuite.dev.zaaksysteem.nl</AttributeValue>
64+
</Attribute>
65+
<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname">
66+
<AttributeValue>Ruiker</AttributeValue>
67+
</Attribute>
68+
</AttributeStatement>
69+
<AuthnStatement AuthnInstant="2018-07-25T07:54:35.599Z">
70+
<AuthnContext>
71+
<AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef>
72+
</AuthnContext>
73+
</AuthnStatement>
74+
</Assertion>
75+
</samlp:Response>

0 commit comments

Comments
 (0)