Contrib.social

Need to add wantAssertionsEncrypted as wantNameIdEncrypted errors

Open on Drupal.org →
Created on 13 September 2023, 10 months ago
Updated 20 June 2024, 6 days ago

Problem/Motivation

We want to have out data from the Shibboleth IDP encrypted the only way currently to add a is by setting the wantNameIdEncrypted which adds this tag to the metadata xml but then causes an error in this causes an error with OneLogin.

OneLogin\Saml2\ValidationError: SAML Response that contains an encrypted Assertion with encrypted nameId is not supported. in OneLogin\Saml2\Response->isValid() (line 401 of /code/vendor/onelogin/php-saml/src/Saml2/Response.php).

There is code in the module to allow wantAssertionsEncrypted to add the tag and allow for encryption of data flow from the IDP.

Steps to reproduce

Configure saml_sp with the Want NameID Encrypted box checked.
Error will occur on attempted log in.

Proposed resolution

Patch file: 3387115-saml_sp-1.patch
Update

  • saml_sp.module
  • src/Form/SamlSpConfig.php

Remaining tasks

Test patch file

User interface changes

Adding a checkbox for wantAssertionsEncrypted to the saml_sp configuration form.

API changes

None

Data model changes

None

🐛 Bug report
Status

Fixed

Version

4.0

Component

Code

Created by

wjuda

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

contrib.social Blog FAQ Discussions
Production build 0.69.0 2024