Check on missing Assertion element in Response
- Dominant language
- PHP
- Stars
- 29
- Forks
- 37
- PR merge metrics
- No merged PRs in 30d
Description
Hello.
According to the SPID Quality Assessment Document ( https://www.spid.gov.it/assets/download/SPID_QAD.pdf ), test 3.32,
if the Assertion element is missing, the Service Provider should give an error message.
This lib, perform tests on the assertion:
https://github.com/italia/spid-php-lib/blob/29888e0e43c15b5778d89672990d8167aa880d93/src/Spid/Saml/In/Response.php#L66
but it doesn't throw an exception if the element is not present in the response.
In fact, when performing tests with the spid-testenv2 ( https://github.com/italia/spid-testenv2 ), if i check the "Assertion assente" option. i can't login but i don't get any error message.
Looking at the spid-php-lib code, it seems to be legitimate to have no Assertion, so i don't really know which way to go, whether to add the exception or leave the code as it is.
Could you give me some suggestions? Thank you.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.