simplesamlphp / simplesamlphp/saml2

Why doesn't the package support multiple NameFormat attributes for the <saml:Attribute> element?

Open
#286 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
306
Forks
138
PR merge metrics
No merged PRs in 30d

Description

Description of the problem

I came across this situation today where I need to be able allow users to add multiple Attribute Statements to their custom SAML integration with our IDP. For each additional attribute statement, I need to allow the user to be able to set the following:

  • Name (that will be the Name attribute)
  • NameFormat (That will be the NameFormat attribute)
  • Value (That will be the value that goes in to the <saml:AttributeValue> element)

When I took a look at how I could construct the SAMLResponse message for the user's custom SAML integration, I could see no (at least apparent) way to be able to set the NameFormat INDIVIDUALLY on each user defined Attribute Statement.
I see a setter method on the SAML2\Assertion class that looks like this

$this->assertion->setAttributeNameFormat('');

But that method clearly says that it will set the NameFormat for ALL attribute statements. (Those that are all set via an associative array at once). This is not the desired functionality. I dug out the following code block from the SAML2\Assertion class which confirms it. Take a look at this screenshot.

Screenshot 2021-09-12 at 10 46 05 PM

It clearly sets the same NameFormat inside the foreach loop for all statements.

Desired result (solution)

Take a look at the following XML that was generated via a tool which shows the output that I also want.

    <saml2:AttributeStatement>
        <saml2:Attribute Name="first" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
            <saml2:AttributeValue
                xmlns:xs="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value1
            </saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute Name="second" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
            <saml2:AttributeValue
                xmlns:xs="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value2
            </saml2:AttributeValue>
        </saml2:Attribute>
        <saml2:Attribute Name="third" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
            <saml2:AttributeValue
                xmlns:xs="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value3
            </saml2:AttributeValue>
        </saml2:Attribute>
    </saml2:AttributeStatement>

As you can see, the NameFormats for all 3 statements are different. How could I achieve this desired XML output (SAMLResponse message) ? Any help will be greatly appreciated.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in the SAML2\Assertion class and inspect setAttributeNameFormat and the associative attribute-statement handling shown in the issue. Compare the generated XML with the three requested Attribute elements, and consider how completion would verify that each statement can retain its own NameFormat.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.