Use a local copy of Message:addSign that uses the xmlsecurity-library for signing

Author: tvdijen

composer.json

@@ -39,13 +39,14 @@
         "nyholm/psr7": "~1.8.2",
         "simplesamlphp/saml2": "~5.0.2",
         "simplesamlphp/simplesamlphp": "~2.4.0",
+        "simplesamlphp/xml-common": "~1.25.0",
+        "simplesamlphp/xml-security": "~1.13.0",
         "symfony/http-foundation": "~6.4.0",
         "symfony/psr-http-message-bridge": "~6.4.0"
     },
     "require-dev": {
         "beste/clock": "~3.0.0",
-        "simplesamlphp/simplesamlphp-test-framework": "~1.9.3",
-        "simplesamlphp/xml-security": "~1.13.0"
+        "simplesamlphp/simplesamlphp-test-framework": "~1.9.3"
     },
     "support": {
         "issues": "https://github.com/simplesamlphp/simplesamlphp-module-exampleattributeserver/issues",

src/Controller/AttributeServer.php

@@ -9,11 +9,10 @@
 use SimpleSAML\{Configuration, Error, Logger};
 use SimpleSAML\HTTP\RunnableResponse;
 use SimpleSAML\Metadata\MetaDataStorageHandler;
-use SimpleSAML\Module\saml\Message;;
 use SimpleSAML\SAML2\Binding;
 use SimpleSAML\SAML2\Binding\HTTPPost;
 use SimpleSAML\SAML2\Constants as C;
-use SimpleSAML\SAML2\Utils;
+use SimpleSAML\SAML2\Utils as SAML2_Utils;
 use SimpleSAML\SAML2\XML\saml\{
     Assertion,
     Attribute,
@@ -23,14 +22,18 @@
     AudienceRestriction,
     Conditions,
     Issuer,
-    Status,
-    StatusCode,
     Subject,
     SubjectConfirmation,
     SubjectConfirmationData,
 };
-use SimpleSAML\SAML2\XML\samlp\{AttributeQuery, Response};
+use SimpleSAML\SAML2\XML\samlp\{AttributeQuery, Response, Status, StatusCode};
+use SimpleSAML\Utils;
 use SimpleSAML\XML\Utils\Random;
+use SimpleSAML\XMLSecurity\Alg\Signature\SignatureAlgorithmFactory;
+use SimpleSAML\XMLSecurity\CryptoEncoding\PEM;
+use SimpleSAML\XMLSecurity\Key\PrivateKey;
+use SimpleSAML\XMLSecurity\XML\ds\{KeyInfo, X509Certificate, X509Data};
+use SimpleSAML\XMLSecurity\XML\SignableElementInterface;
 use Symfony\Bridge\PsrHttpMessage\Factory\{HttpFoundationFactory, PsrHttpFactory};
 use Symfony\Component\HttpFoundation\Request;
 
@@ -159,7 +162,7 @@ public function main(/** @scrutinizer ignore-unused */ Request $request): Runnab
         }
 
         // $returnAttributes contains the attributes we should return. Send them
-        $clock = Utils::getContainer()->getClock();
+        $clock = SAML2_Utils::getContainer()->getClock();
 
         $assertion = new Assertion(
             issuer: new Issuer($idpEntityId),
@@ -192,24 +195,22 @@ public function main(/** @scrutinizer ignore-unused */ Request $request): Runnab
             ],
         );
 
-        // TODO:  Fix signing; should use xml-security lib
-        Message::addSign($idpMetadata, $spMetadata, $assertion);
+        self::addSign($idpMetadata, $spMetadata, $assertion);
 
         $response = new Response(
             status: new Status(
                 new StatusCode(C::STATUS_SUCCESS),
             ),
             issueInstant: $clock->now(),
-            issuer: new Issuer($issuer),
+            issuer: $issuer,
             id: (new Random())->generateID(),
             version: '2.0',
             inResponseTo: $message->getId(),
             destination: $endpoint,
             assertions: [$assertion],
         );
 
-        // TODO:  Fix signing; should use xml-security lib
-        Message::addSign($idpMetadata, $spMetadata, $response);
+        self::addSign($idpMetadata, $spMetadata, $response);
 
         $httpPost = new HTTPPost();
         $httpPost->setRelayState($binding->getRelayState());
@@ -238,4 +239,60 @@ private function filterAttributeValues(array $reqValues, array $values): array
 
         return $result;
     }
+
+
+    /**
+     * @deprecated This method is a modified version of \SimpleSAML\Module\saml\Message::addSign and
+     *  should be replaced with a call to a future ServiceProvider-class in the saml2-library
+     *
+     * Add signature key and sender certificate to an element (Message or Assertion).
+     *
+     * @param \SimpleSAML\Configuration $srcMetadata The metadata of the sender.
+     * @param \SimpleSAML\Configuration $dstMetadata The metadata of the recipient.
+     * @param \SimpleSAML\XMLSecurity\XML\SignableElementInterface $element The element we should add the data to.
+     */
+    private static function addSign(
+        Configuration $srcMetadata,
+        Configuration $dstMetadata,
+        SignableElementInterface &$element,
+    ): void {
+        $dstPrivateKey = $dstMetadata->getOptionalString('signature.privatekey', null);
+        $cryptoUtils = new Utils\Crypto();
+
+        if ($dstPrivateKey !== null) {
+            /** @var array $keyArray */
+            $keyArray = $cryptoUtils->loadPrivateKey($dstMetadata, true, 'signature.');
+            $certArray = $cryptoUtils->loadPublicKey($dstMetadata, false, 'signature.');
+        } else {
+            /** @var array $keyArray */
+            $keyArray = $cryptoUtils->loadPrivateKey($srcMetadata, true);
+            $certArray = $cryptoUtils->loadPublicKey($srcMetadata, false);
+        }
+
+        $algo = $dstMetadata->getOptionalString('signature.algorithm', null);
+        if ($algo === null) {
+            $algo = $srcMetadata->getOptionalString('signature.algorithm', C::SIG_RSA_SHA256);
+        }
+
+        $privateKey = PrivateKey::fromFile($keyArray['PEM'], $keyArray['password']);
+
+        $keyInfo = null;
+        if ($certArray !== null) {
+            $certificate = new X509Certificate(PEM::fromString($keyArray['PEM']));
+            $keyInfo = new KeyInfo([
+                new X509Data(
+                    [
+                        new X509Certificate($certArray['PEM']),
+                    ],
+                ),
+            ]);
+        }
+
+        $signer = (new SignatureAlgorithmFactory())->getAlgorithm(
+            $algo,
+            $privateKey,
+        );
+
+        $element->sign($signer, C::C14N_EXCLUSIVE_WITHOUT_COMMENTS, $keyInfo);
+    }
 }

tests/src/Controller/AttributeServerTest.php

@@ -60,7 +60,7 @@ public function testMain(): void
         $mdh->method('getMetaDataCurrentEntityID')->willReturn('https://example.org/');
         $mdh->method('getMetaDataConfig')->willReturn(Configuration::loadFromArray([
             'EntityID' => 'auth_source_id',
-            'testAttributeEndpoint' => 'test',
+            'testAttributeEndpoint' => 'https://example.org/testAttributeEndpoint',
             'privatekey' => PEMCertificatesMock::buildKeysPath(PEMCertificatesMock::SELFSIGNED_PRIVATE_KEY),
             'privatekey_pass' => '1234',
         ]));