Problem/Motivation

Updating to recent saml packages breaks the module.

simplesamlphp/saml2-legacy (v4.20.3) to (v4.20.5)
simplesamlphp/saml2 (v6.2.4) to (v6.2.5)

Trying to login via SSO results in:

Fatal error: Class SAML2\Compat\Ssp\Container contains 1 abstract method and must therefore be declared abstract or implement the remaining methods (SAML2\Compat\AbstractContainer::getInflateSizeLimit) in /code/vendor/simplesamlphp/saml2-legacy/src/SAML2/Compat/Ssp/Container.php on line 14

Comments

jayemel created an issue.

kreynen’s picture

kreynen commented

Same. This is related to the release of https://github.com/simplesamlphp/saml2-legacy/releases/tag/v4.20.5 to address https://github.com/simplesamlphp/saml2/security/advisories/GHSA-6vhm-xfm....

saml2-legacy is a dependency of the 2.4.x branch of the simpleSAMLphp library itself. Support for that branch ends in March of next year according to https://simplesamlphp.org/security/

I don't know if any testing has been done with this module and the 2.5.x branch of the simpleSAMLphp library, but that version does not require saml2-legacy.

While this isn't an issue with this module, anyone using it is going to have this issue when upgrading.

One option is to pin the saml2-legacy in your root composer.json to the previous version, but that leaves you vulnerable to the issue the update is intended to fix.

kreynen’s picture

kreynen commented

@afinnarn from our team at University of Denver just posted https://github.com/simplesamlphp/simplesamlphp/issues/2693