The implementation of OneLogin_Saml2_Response::validateSignedElements has changed so that it checks the elements based on their local name rather than full tag name (included namespace), due to changes in OneLogin_Saml2_Response::isValid.

This causes issues where the validation of signed elements fails with the exception 'Found an unexpected Signature Element. SAML Response rejected'.

The saml_sp_Response class should be removed as it does nothing else than override this method (why does it even exist?).

CommentFileSizeAuthor
#2 2649478-saml_sp-validation_of_signed_elements_fails-2.patch2.66 KBsyastrov

Comments

syastrov created an issue. See original summary.

syastrov’s picture

syastrov commented
StatusFileSize
new 2649478-saml_sp-validation_of_signed_elements_fails-2.patch2.66 KB
tizzo’s picture

tizzo commented
Status: Needs review » Reviewed & tested by the community

LGTM. This patch resolved my issue in oauthing against a liferay IdP.

alimc29’s picture

alimc29 commented

This patch works for us, as well

arnt’s picture

arnt commented

We ran into this as well. If this patch wasn't applied to keep compatibility with both old and new versions of OneLogin_Saml2_Response, saml_sp_Response::validateSignedElements should be extended to also allow 'Response', instead of only 'samlp:Response'.

jrglasgow’s picture

jrglasgow commented
Status: Reviewed & tested by the community » Fixed

I actually already made this change in the code base a few months ago, without seeing this issue

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.