italia / italia/spid-php-lib

Check on missing Assertion element in Response

Open
#113 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
PHP
Stars
29
Forks
37
PR merge metrics
No merged PRs in 30d

Description

Hello.
According to the SPID Quality Assessment Document ( https://www.spid.gov.it/assets/download/SPID_QAD.pdf ), test 3.32,
if the Assertion element is missing, the Service Provider should give an error message.

This lib, perform tests on the assertion:
https://github.com/italia/spid-php-lib/blob/29888e0e43c15b5778d89672990d8167aa880d93/src/Spid/Saml/In/Response.php#L66

but it doesn't throw an exception if the element is not present in the response.
In fact, when performing tests with the spid-testenv2 ( https://github.com/italia/spid-testenv2 ), if i check the "Assertion assente" option. i can't login but i don't get any error message.

Looking at the spid-php-lib code, it seems to be legitimate to have no Assertion, so i don't really know which way to go, whether to add the exception or leave the code as it is.
Could you give me some suggestions? Thank you.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.