/**
* Convert the response message to an XML element.
*
* @return DOMElement This response.
*/
public function toUnsignedXML()
{
$root = parent::toUnsignedXML();
foreach ($this->assertions as $assertion) {
$node = $assertion->toXML($root);
}
return $root;
}
/**
* Convert the response message to an XML element.
*
* @return DOMElement This response.
*/
public function toUnsignedXML()
{
$root = parent::toUnsignedXML();
if (isset($this->any)) {
$node = $root->ownerDocument->importNode($this->any, TRUE);
$root->appendChild($node);
}
return $root;
}
/**
* Convert the response message to an XML element.
*
* @return DOMElement This response.
*/
public function toUnsignedXML()
{
$root = parent::toUnsignedXML();
/** @var SAML2_Assertion|SAML2_EncryptedAssertion $assertion */
foreach ($this->assertions as $assertion) {
$assertion->toXML($root);
}
return $root;
}
/**
* @param string $saml_response Base64 Encoded SAML
*
* @throws Exception When no assertions are found or signature in invalid
*/
public function load_saml_response($saml_response)
{
$response_element = SAML2_DOMDocumentFactory::fromString(base64_decode($saml_response))->documentElement;
$signature_info = SAML2_Utils::validateElement($response_element);
SAML2_Utils::validateSignature($signature_info, $this->security_key);
$response = SAML2_StatusResponse::fromXML($response_element);
$this->destination = $response->getDestination();
$assertions = $response->getAssertions();
$this->assertions = $assertions;
}
/**
* Retrieve the status code of a response as a sspmod_saml_Error.
*
* @param SAML2_StatusResponse $response The response.
* @return sspmod_saml_Error The error.
*/
public static function getResponseError(SAML2_StatusResponse $response)
{
$status = $response->getStatus();
return new sspmod_saml_Error($status['Code'], $status['SubCode'], $status['Message']);
}
/**
* Front controller for LaunchKey Native/White Label authentication
*
*
* @param WP_User $user Unused parameter always passed first by authenticate filter
* @param string $username Username specified by the user in the login screen
* @param string $password Password specifiedby the user in the login screen
*
* @since 1.0.0
* @return WP_User
*/
public function authenticate($user, $username, $password)
{
if (empty($user) && empty($username) && empty($password) && !empty($_REQUEST['SAMLResponse'])) {
$response_element = SAML2_DOMDocumentFactory::fromString(base64_decode($_REQUEST['SAMLResponse']))->documentElement;
$signature_info = SAML2_Utils::validateElement($response_element);
try {
SAML2_Utils::validateSignature($signature_info, $this->security_key);
$response = SAML2_StatusResponse::fromXML($response_element);
/** @var SAML2_Assertion[] $assertions */
$assertions = $response->getAssertions();
if (empty($assertions)) {
throw new Exception("No assertions in SAML response");
}
$assertion = $assertions[0];
$name_id = $assertion->getNameId();
$username = $name_id['Value'];
$session_id = $assertion->getSessionIndex();
// Find the user by login
$user = $this->wp_facade->get_user_by('login', $username);
// If we don't have a user, create one
if (!$user instanceof WP_User) {
$attributes = $assertion->getAttributes();
$user_data = array('user_login' => $username, 'user_pass' => '', 'role' => empty($attributes['role']) ? false : $this->translate_role($attributes['role'][0]));
$user_id = $this->wp_facade->wp_insert_user($user_data);
// Unset the password - wp_insert_user always generates a hash - it's misleading
$this->wp_facade->wp_update_user(array('ID' => $user_id, 'user_pass' => ''));
$user = new WP_User($user_id);
}
// Set the SSO session so we know we are logged in via SSSO
$this->wp_facade->update_user_meta($user->ID, 'launchkey_sso_session', $session_id);
} catch (Exception $e) {
$this->wp_facade->wp_redirect($this->error_url);
exit;
}
return $user;
}
}
/**
* Constructor for SAML 2 response messages.
*
* @param string $tagName The tag name of the root element.
* @param DOMElement|NULL $xml The input message.
*/
public function __construct(DOMElement $xml = NULL)
{
parent::__construct('LogoutResponse', $xml);
/* No new fields added by LogoutResponse. */
}
