SAML nested assertion

You must hack the SAML PHP Toolkit library.

This kind of error seems like it's not the module's problem but the libary's problem. (Or an IdP problem. this problem has not been reported before, and I don't know of nested SAML assertion -- though I'm not a SAML protocol expert.)

However... inspecting the code, it seems like the error is thrown in a non-critical part of the code, after the response was already processed.

Please comment out this line in \OneLogin\Saml2\Auth::processResponse()

$this->_lastAssertionId = $response->getAssertionId();

...and respond if it fixes your problem.
If it does,

• that is going to be an extra reason for me getting rid of the Auth class which I was already planning. So this issue can stay open as a reminder
• I may have questions around the structure of your SAML assertion, when I do. (But as long as this stays a volunteer project, it might be years away. The planned re-work is fairly big.)

I had just updated the issue with the modification I made...

OK, our comments intersected.

Re. security:

This is not a nice thing to do in principle. (IMHO it also shows there may be something weird with your IdP's responses because the code isn't there for nothing. And that is up to you to decide.)

However, assuming that the path to the incoming responses from your IdP is secure, in practice this doesn't matter right now because

• validateNumAssertions() seems to be called only by Auth::processResponse() - the line I quoted above
• The Auth class is a weird one (just a 'helper' class but IMHO the logic isn't structured nicely)
• Nothing in the process / the samlauth code checks $this->_lastAssertionId, ever.

...so nothing is currently affected, except the ability of 'custom code' to get to the "last assertion id" value.
It seems to be just an extra check outside of validating the response right now. Why? Dunno.

(That is -unless I'm reading the code wrong and just changing that single line I quoted, is not enough.)