simplesamlphp / simplesamlphp/saml2
Why doesn't the package support multiple NameFormat attributes for the <saml:Attribute> element?
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 306
- Forks
- 138
- PR merge metrics
- No merged PRs in 30d
Description
Description of the problem
I came across this situation today where I need to be able allow users to add multiple Attribute Statements to their custom SAML integration with our IDP. For each additional attribute statement, I need to allow the user to be able to set the following:
- Name (that will be the
Nameattribute) - NameFormat (That will be the
NameFormatattribute) - Value (That will be the value that goes in to the
<saml:AttributeValue>element)
When I took a look at how I could construct the SAMLResponse message for the user's custom SAML integration, I could see no (at least apparent) way to be able to set the NameFormat INDIVIDUALLY on each user defined Attribute Statement.
I see a setter method on the SAML2\Assertion class that looks like this
$this->assertion->setAttributeNameFormat('');
But that method clearly says that it will set the NameFormat for ALL attribute statements. (Those that are all set via an associative array at once). This is not the desired functionality. I dug out the following code block from the SAML2\Assertion class which confirms it. Take a look at this screenshot.
It clearly sets the same NameFormat inside the foreach loop for all statements.
Desired result (solution)
Take a look at the following XML that was generated via a tool which shows the output that I also want.
<saml2:AttributeStatement>
<saml2:Attribute Name="first" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
<saml2:AttributeValue
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value1
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="second" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value2
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute Name="third" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
<saml2:AttributeValue
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value3
</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
As you can see, the NameFormats for all 3 statements are different. How could I achieve this desired XML output (SAMLResponse message) ? Any help will be greatly appreciated.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the SAML2\Assertion class and inspect setAttributeNameFormat and the associative attribute-statement handling shown in the issue. Compare the generated XML with the three requested Attribute elements, and consider how completion would verify that each statement can retain its own NameFormat.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100