PHP SimpleSAML_Utilities::loadPrivateKey方法代码示例

 protected function createLogoutResponse($testrun, $logoutRequest, $logoutRelayState)
 {
     $this->log($testrun, 'Creating response with relaystate [' . $logoutRelayState . ']');
     $idpMetadata = SimpleSAML_Configuration::loadFromArray($this->idpmetadata);
     $spMetadata = SimpleSAML_Configuration::loadFromArray($this->metadata);
     // Get SingleLogoutService URL
     $consumerURLf = $spMetadata->getDefaultEndpoint('SingleLogoutService', array('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'));
     $consumerURL = $consumerURLf['Location'];
     /* Create an send response. */
     $response = sspmod_saml2_Message::buildLogoutResponse($idpMetadata, $spMetadata);
     $response->setRelayState($logoutRequest->getRelayState());
     $response->setInResponseTo($logoutRequest->getId());
     $keyArray = SimpleSAML_Utilities::loadPrivateKey($idpMetadata, TRUE);
     $certArray = SimpleSAML_Utilities::loadPublicKey($idpMetadata, FALSE);
     $privateKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
     $privateKey->loadKey($keyArray['PEM'], FALSE);
     $response->setSignatureKey($privateKey);
     if ($certArray === NULL) {
         throw new Exception('No certificates found. [1]');
     }
     if (!array_key_exists('PEM', $certArray)) {
         throw new Exception('No certificates found. [2]');
     }
     $response->setCertificates(array($certArray['PEM']));
     #$this->tweakResponse($testrun, $response);
     $msgStr = $response->toUnsignedXML();
     #$this->tweakResponseDOM($testrun, $msgStr);
     $msgStr = $msgStr->ownerDocument->saveXML($msgStr);
     #	echo '<pre>'; echo(htmlspecialchars($msgStr)); exit;
     #		$msgStr = base64_encode($msgStr);
     #		$msgStr = htmlspecialchars($msgStr);
     return array('url' => $consumerURL, 'Response' => $msgStr, 'ResponseObj' => $response, 'RelayState' => $logoutRelayState);
 }

 /**
  * Send an authenticationResponse using HTTP-POST.
  *
  * @param string $response  The response which should be sent.
  * @param array $idpmd  The metadata of the IdP which is sending the response.
  * @param array $spmd  The metadata of the SP which is receiving the response.
  * @param string|NULL $relayState  The relaystate for the SP.
  * @param string $shire  The shire which should receive the response.
  */
 public function sendResponse($response, $idpmd, $spmd, $relayState, $shire)
 {
     SimpleSAML_Utilities::validateXMLDocument($response, 'saml11');
     $privatekey = SimpleSAML_Utilities::loadPrivateKey($idpmd, TRUE);
     $publickey = SimpleSAML_Utilities::loadPublicKey($idpmd, TRUE);
     $responsedom = new DOMDocument();
     $responsedom->loadXML(str_replace("\r", "", $response));
     $responseroot = $responsedom->getElementsByTagName('Response')->item(0);
     $firstassertionroot = $responsedom->getElementsByTagName('Assertion')->item(0);
     /* Determine what we should sign - either the Response element or the Assertion. The default
      * is to sign the Assertion, but that can be overridden by the 'signresponse' option in the
      * SP metadata or 'saml20.signresponse' in the global configuration.
      */
     $signResponse = FALSE;
     if (array_key_exists('signresponse', $spmd) && $spmd['signresponse'] !== NULL) {
         $signResponse = $spmd['signresponse'];
         if (!is_bool($signResponse)) {
             throw new Exception('Expected the \'signresponse\' option in the metadata of the' . ' SP \'' . $spmd['entityid'] . '\' to be a boolean value.');
         }
     } else {
         $signResponse = $this->configuration->getBoolean('shib13.signresponse', TRUE);
     }
     /* Check if we have an assertion to sign. Force to sign the response if not. */
     if ($firstassertionroot === NULL) {
         $signResponse = TRUE;
     }
     $signer = new SimpleSAML_XML_Signer(array('privatekey_array' => $privatekey, 'publickey_array' => $publickey, 'id' => $signResponse ? 'ResponseID' : 'AssertionID'));
     if (array_key_exists('certificatechain', $idpmd)) {
         $signer->addCertificate($idpmd['certificatechain']);
     }
     if ($signResponse) {
         /* Sign the response - this must be done after encrypting the assertion. */
         /* We insert the signature before the saml2p:Status element. */
         $statusElements = SimpleSAML_Utilities::getDOMChildren($responseroot, 'Status', '@saml1p');
         assert('count($statusElements) === 1');
         $signer->sign($responseroot, $responseroot, $statusElements[0]);
     } else {
         /* Sign the assertion */
         $signer->sign($firstassertionroot, $firstassertionroot);
     }
     $response = $responsedom->saveXML();
     if ($this->configuration->getBoolean('debug', FALSE)) {
         $p = new SimpleSAML_XHTML_Template($this->configuration, 'post-debug.php');
         $p->data['header'] = 'SAML (Shibboleth 1.3) Response Debug-mode';
         $p->data['RelayStateName'] = 'TARGET';
         $p->data['RelayState'] = $relayState;
         $p->data['destination'] = $shire;
         $p->data['response'] = str_replace("\n", "", base64_encode($response));
         $p->data['responseHTML'] = htmlspecialchars(SimpleSAML_Utilities::formatXMLString($response));
         $p->show();
     } else {
         SimpleSAML_Utilities::postRedirect($shire, array('TARGET' => $relayState, 'SAMLResponse' => base64_encode($response)));
     }
 }

 /**
  * Send an authenticationResponse using HTTP-POST.
  *
  * @param string $response  The response which should be sent.
  * @param SimpleSAML_Configuration $idpmd  The metadata of the IdP which is sending the response.
  * @param SimpleSAML_Configuration $spmd  The metadata of the SP which is receiving the response.
  * @param string|NULL $relayState  The relaystate for the SP.
  * @param string $shire  The shire which should receive the response.
  */
 public function sendResponse($response, SimpleSAML_Configuration $idpmd, SimpleSAML_Configuration $spmd, $relayState, $shire)
 {
     SimpleSAML_Utilities::validateXMLDocument($response, 'saml11');
     $privatekey = SimpleSAML_Utilities::loadPrivateKey($idpmd, TRUE);
     $publickey = SimpleSAML_Utilities::loadPublicKey($idpmd, TRUE);
     $responsedom = new DOMDocument();
     $responsedom->loadXML(str_replace("\r", "", $response));
     $responseroot = $responsedom->getElementsByTagName('Response')->item(0);
     $firstassertionroot = $responsedom->getElementsByTagName('Assertion')->item(0);
     /* Determine what we should sign - either the Response element or the Assertion. The default
      * is to sign the Assertion, but that can be overridden by the 'signresponse' option in the
      * SP metadata or 'saml20.signresponse' in the global configuration.
      */
     $signResponse = FALSE;
     if ($spmd->hasValue('signresponse')) {
         $signResponse = $spmd->getBoolean['signresponse'];
     } else {
         $signResponse = $this->configuration->getBoolean('shib13.signresponse', TRUE);
     }
     /* Check if we have an assertion to sign. Force to sign the response if not. */
     if ($firstassertionroot === NULL) {
         $signResponse = TRUE;
     }
     $signer = new SimpleSAML_XML_Signer(array('privatekey_array' => $privatekey, 'publickey_array' => $publickey, 'id' => $signResponse ? 'ResponseID' : 'AssertionID'));
     if ($idpmd->hasValue('certificatechain')) {
         $signer->addCertificate($idpmd->getString('certificatechain'));
     }
     if ($signResponse) {
         /* Sign the response - this must be done after encrypting the assertion. */
         /* We insert the signature before the saml2p:Status element. */
         $statusElements = SimpleSAML_Utilities::getDOMChildren($responseroot, 'Status', '@saml1p');
         assert('count($statusElements) === 1');
         $signer->sign($responseroot, $responseroot, $statusElements[0]);
     } else {
         /* Sign the assertion */
         $signer->sign($firstassertionroot, $firstassertionroot);
     }
     $response = $responsedom->saveXML();
     SimpleSAML_Utilities::debugMessage($response, 'out');
     SimpleSAML_Utilities::postRedirect($shire, array('TARGET' => $relayState, 'SAMLResponse' => base64_encode($response)));
 }

 /**
  * Retrieve the decryption keys from metadata.
  *
  * @param SimpleSAML_Configuration $srcMetadata  The metadata of the sender (IdP).
  * @param SimpleSAML_Configuration $dstMetadata  The metadata of the recipient (SP).
  * @return array  Array of decryption keys.
  */
 public static function getDecryptionKeys(SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata)
 {
     $sharedKey = $srcMetadata->getString('sharedkey', NULL);
     if ($sharedKey !== NULL) {
         $key = new XMLSecurityKey(XMLSecurityKey::AES128_CBC);
         $key->loadKey($sharedKey);
         return array($key);
     }
     $keys = array();
     /* Load the new private key if it exists. */
     $keyArray = SimpleSAML_Utilities::loadPrivateKey($dstMetadata, FALSE, 'new_');
     if ($keyArray !== NULL) {
         assert('isset($keyArray["PEM"])');
         $key = new XMLSecurityKey(XMLSecurityKey::RSA_1_5, array('type' => 'private'));
         if (array_key_exists('password', $keyArray)) {
             $key->passphrase = $keyArray['password'];
         }
         $key->loadKey($keyArray['PEM']);
         $keys[] = $key;
     }
     /* Find the existing private key. */
     $keyArray = SimpleSAML_Utilities::loadPrivateKey($dstMetadata, TRUE);
     assert('isset($keyArray["PEM"])');
     $key = new XMLSecurityKey(XMLSecurityKey::RSA_1_5, array('type' => 'private'));
     if (array_key_exists('password', $keyArray)) {
         $key->passphrase = $keyArray['password'];
     }
     $key->loadKey($keyArray['PEM']);
     $keys[] = $key;
     return $keys;
 }

 /**
  * Retrieve the decryption key from metadata.
  *
  * @param SimpleSAML_Configuration $srcMetadata  The metadata of the sender (IdP).
  * @param SimpleSAML_Configuration $dstMetadata  The metadata of the recipient (SP).
  * @return XMLSecurityKey  The decryption key.
  */
 private static function getDecryptionKey(SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata)
 {
     $sharedKey = $srcMetadata->getString('sharedkey', NULL);
     if ($sharedKey !== NULL) {
         $key = new XMLSecurityKey(XMLSecurityKey::AES128_CBC);
         $key->loadKey($sharedKey);
     } else {
         /* Find the private key we should use to decrypt messages to this SP. */
         $keyArray = SimpleSAML_Utilities::loadPrivateKey($dstMetadata, TRUE);
         if (!array_key_exists('PEM', $keyArray)) {
             throw new Exception('Unable to locate key we should use to decrypt the message.');
         }
         /* Extract the public key from the certificate for encryption. */
         $key = new XMLSecurityKey(XMLSecurityKey::RSA_1_5, array('type' => 'private'));
         if (array_key_exists('password', $keyArray)) {
             $key->passphrase = $keyArray['password'];
         }
         $key->loadKey($keyArray['PEM']);
     }
     return $key;
 }

 /**
  * This function sends the SOAP message to the service location and returns SOAP response
  *
  * @param SAML2_Message $m  The request that should be sent.
  * @param SimpleSAML_Configuration $srcMetadata  The metadata of the issuer of the message.
  * @param SimpleSAML_Configuration $dstMetadata  The metadata of the destination of the message.
  * @return SAML2_Message  The response we received.
  */
 public function send(SAML2_Message $msg, SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata = NULL)
 {
     $issuer = $msg->getIssuer();
     $ctxOpts = array('ssl' => array('capture_peer_cert' => TRUE));
     // Determine if we are going to do a MutualSSL connection between the IdP and SP  - Shoaib
     if ($srcMetadata->hasValue('saml.SOAPClient.certificate')) {
         $ctxOpts['ssl']['local_cert'] = SimpleSAML_Utilities::resolveCert($srcMetadata->getString('saml.SOAPClient.certificate'));
         if ($srcMetadata->hasValue('saml.SOAPClient.privatekey_pass')) {
             $ctxOpts['ssl']['passphrase'] = $srcMetadata->getString('saml.SOAPClient.privatekey_pass');
         }
     } else {
         /* Use the SP certificate and privatekey if it is configured. */
         $privateKey = SimpleSAML_Utilities::loadPrivateKey($srcMetadata);
         $publicKey = SimpleSAML_Utilities::loadPublicKey($srcMetadata);
         if ($privateKey !== NULL && $publicKey !== NULL && isset($publicKey['PEM'])) {
             $keyCertData = $privateKey['PEM'] . $publicKey['PEM'];
             $file = SimpleSAML_Utilities::getTempDir() . '/' . sha1($keyCertData) . '.pem';
             if (!file_exists($file)) {
                 SimpleSAML_Utilities::writeFile($file, $keyCertData);
             }
             $ctxOpts['ssl']['local_cert'] = $file;
             if (isset($privateKey['password'])) {
                 $ctxOpts['ssl']['passphrase'] = $privateKey['password'];
             }
         }
     }
     // do peer certificate verification
     if ($dstMetadata !== NULL) {
         $peerPublicKeys = $dstMetadata->getPublicKeys('signing', TRUE);
         $certData = '';
         foreach ($peerPublicKeys as $key) {
             if ($key['type'] !== 'X509Certificate') {
                 continue;
             }
             $certData .= "-----BEGIN CERTIFICATE-----\n" . chunk_split($key['X509Certificate'], 64) . "-----END CERTIFICATE-----\n";
         }
         $peerCertFile = SimpleSAML_Utilities::getTempDir() . '/' . sha1($certData) . '.pem';
         if (!file_exists($peerCertFile)) {
             SimpleSAML_Utilities::writeFile($peerCertFile, $certData);
         }
         // create ssl context
         $ctxOpts['ssl']['verify_peer'] = TRUE;
         $ctxOpts['ssl']['verify_depth'] = 1;
         $ctxOpts['ssl']['cafile'] = $peerCertFile;
     }
     $context = stream_context_create($ctxOpts);
     if ($context === NULL) {
         throw new Exception('Unable to create SSL stream context');
     }
     $options = array('uri' => $issuer, 'location' => $msg->getDestination(), 'stream_context' => $context);
     $x = new SoapClient(NULL, $options);
     // Add soap-envelopes
     $request = $msg->toSignedXML();
     $request = self::START_SOAP_ENVELOPE . $request->ownerDocument->saveXML($request) . self::END_SOAP_ENVELOPE;
     SimpleSAML_Utilities::debugMessage($request, 'out');
     $action = 'http://www.oasis-open.org/committees/security';
     $version = '1.1';
     $destination = $msg->getDestination();
     /* Perform SOAP Request over HTTP */
     $soapresponsexml = $x->__doRequest($request, $destination, $action, $version);
     if ($soapresponsexml === NULL || $soapresponsexml === "") {
         throw new Exception('Empty SOAP response, check peer certificate.');
     }
     SimpleSAML_Utilities::debugMessage($soapresponsexml, 'in');
     // Convert to SAML2_Message (DOMElement)
     $dom = new DOMDocument();
     if (!$dom->loadXML($soapresponsexml)) {
         throw new Exception('Not a SOAP response.');
     }
     $soapfault = $this->getSOAPFault($dom);
     if (isset($soapfault)) {
         throw new Exception($soapfault);
     }
     //Extract the message from the response
     $xml = $dom->firstChild;
     /* Soap Envelope */
     $samlresponse = SAML2_Utils::xpQuery($dom->firstChild, '/soap-env:Envelope/soap-env:Body/*[1]');
     $samlresponse = SAML2_Message::fromXML($samlresponse[0]);
     /* Add validator to message which uses the SSL context. */
     self::addSSLValidator($samlresponse, $context);
     SimpleSAML_Logger::debug("Valid ArtifactResponse received from IdP");
     return $samlresponse;
 }

 protected function createResponse($testrun, $request, $relayState = NULL)
 {
     $this->log($testrun, 'Creating response with relaystate [' . $relayState . ']');
     $idpMetadata = SimpleSAML_Configuration::loadFromArray($this->idpmetadata);
     $spMetadata = SimpleSAML_Configuration::loadFromArray($this->metadata);
     $requestId = $request->getId();
     $consumerURL = $request->getAssertionConsumerServiceURL();
     $spentityid = $spMetadata->getString('entityid');
     $idpentityid = $idpMetadata->getString('entityid');
     $consumerURLf = $spMetadata->getDefaultEndpoint('AssertionConsumerService', array('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'), $consumerURL);
     $consumerURL = $consumerURLf['Location'];
     #		print_r($spMetadata); exit;
     #		print_r($spMetadata->getString('AssertionConsumerServiceURL'))
     $protocolBinding = SAML2_Const::BINDING_HTTP_POST;
     $config = $this->getConfig($testrun);
     $authnInstant = time();
     // Build assertion
     $a = new sspmod_fedlab_xml_Assertion();
     if ($config['signAssertion']) {
         $keyArray = SimpleSAML_Utilities::loadPrivateKey($idpMetadata, TRUE);
         $certArray = SimpleSAML_Utilities::loadPublicKey($idpMetadata, FALSE);
         $privateKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
         $privateKey->loadKey($keyArray['PEM'], FALSE);
         $a->setSignatureKey($privateKey);
         if ($certArray === NULL) {
             throw new Exception('No certificates found. [1]');
         }
         if (!array_key_exists('PEM', $certArray)) {
             throw new Exception('No certificates found. [2]');
         }
         $a->setCertificates(array($certArray['PEM']));
     }
     $a->includeAuthn = $config['includeAuthn'];
     $a->addSubjectConfirmationData = $config['addSubjectConfirmationData'];
     $a->iterateSubjectConfirmationData = $config['iterateSubjectConfirmationData'];
     $a->subjectAddresses = $this->getAddresses($testrun, array(NULL));
     if (isset($config['dateFormat'])) {
         $a->dateformat = $config['dateFormat'];
     }
     $a->setIssueInstant(time() + $config['issueInstantMod']);
     $a->extracondition = $config['extracondition'];
     $a->setIssuer($this->getIssuerAssertion($testrun, $idpentityid));
     $a->setDestination($this->getDestinationAssertion($testrun, array($consumerURL)));
     $a->setValidAudiences($this->getValidAudience($testrun, array(array($spentityid))));
     $a->setNotBefore(time() + $config['notBeforeSkew']);
     $assertionLifetime = $config['assertionLifetime'];
     $a->setNotOnOrAfter(time() + $assertionLifetime);
     $a->notOnOrAfterSubjectConfirmationData = time() + $config['SubjectConfirmationDataLifetime'];
     $a->setAuthnContext($this->getAuthnContext($testrun, SAML2_Const::AC_PASSWORD));
     $a->setAuthnInstant($authnInstant);
     $sessionLifetime = $config['sessionLifetime'];
     $a->setSessionNotOnOrAfter(time() + $sessionLifetime);
     $sessionIndex = SimpleSAML_Utilities::generateID();
     $a->setSessionIndex($sessionIndex);
     /* Add attributes. */
     $attributeNameFormat = $config['attributeNameFormat'];
     $a->setAttributeNameFormat($attributeNameFormat);
     $attributes = array('urn:oid:1.3.6.1.4.1.5923.1.1.1.6' => array('andreas@uninett.no'), 'urn:mace:dir:attribute-def:eduPersonPrincipalName' => array('andreas@uninett.no'));
     $a->setAttributes($attributes);
     $nameId = array('Format' => $config['nameIdFormat'], 'SPNameQualifier' => $spentityid, 'Value' => SimpleSAML_Utilities::generateID());
     $a->setNameId($nameId);
     // Assertion builded....
     #		print_r($requestId);
     $inresponseto = $this->getInResponseToAssertion($testrun, $requestId);
     if (!empty($inresponseto)) {
         $a->setInResponseTo($inresponseto);
     }
     // $assertion->setAuthenticatingAuthority($state['saml:AuthenticatingAuthority']);
     /* Maybe encrypt the assertion. */
     // $a = sspmod_saml2_Message::encryptAssertion($idpMetadata, $spMetadata, $a);
     // Build the response
     $signResponse = $config['signResponse'];
     $response = new sspmod_fedlab_xml_Response();
     $response->setIssuer($this->getIssuerResponse($testrun, $idpentityid));
     $response->setDestination($this->getDestinationResponse($testrun, $consumerURL));
     if ($signResponse) {
         // self::addSign($srcMetadata, $dstMetadata, $r);
         $keyArray = SimpleSAML_Utilities::loadPrivateKey($idpMetadata, TRUE);
         $certArray = SimpleSAML_Utilities::loadPublicKey($idpMetadata, FALSE);
         $privateKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
         $privateKey->loadKey($keyArray['PEM'], FALSE);
         $response->setSignatureKey($privateKey);
         if ($certArray === NULL) {
             throw new Exception('No certificates found. [1]');
         }
         if (!array_key_exists('PEM', $certArray)) {
             throw new Exception('No certificates found. [2]');
         }
         $response->setCertificates(array($certArray['PEM']));
     }
     $inresponseto = $this->getInResponseToResponse($testrun, $requestId);
     if (!empty($inresponseto)) {
         $response->setInResponseTo($inresponseto);
     }
     $response->setRelayState($this->getRelayState($testrun, $relayState));
     $response->setAssertions(array($a));
     $this->tweakResponse($testrun, $response);
     $msgStr = $response->toSignedXML();
     $this->tweakResponseDOM($testrun, $msgStr);
     $msgStr = $msgStr->ownerDocument->saveXML($msgStr);
//.........这里部分代码省略.........

 /**
  * This function sends the SOAP message to the service location and returns SOAP response
  *
  * @param  SAML2_Message            $msg         The request that should be sent.
  * @param  SimpleSAML_Configuration $srcMetadata The metadata of the issuer of the message.
  * @param  SimpleSAML_Configuration $dstMetadata The metadata of the destination of the message.
  * @return SAML2_Message            The response we received.
  * @throws Exception
  */
 public function send(SAML2_Message $msg, SimpleSAML_Configuration $srcMetadata, SimpleSAML_Configuration $dstMetadata = NULL)
 {
     $issuer = $msg->getIssuer();
     $ctxOpts = array('ssl' => array('capture_peer_cert' => TRUE));
     /* Determine if we are going to do a MutualSSL connection between the IdP and SP  - Shoaib */
     if ($srcMetadata->hasValue('saml.SOAPClient.certificate')) {
         $cert = $srcMetadata->getValue('saml.SOAPClient.certificate');
         if ($cert !== FALSE) {
             $ctxOpts['ssl']['local_cert'] = SimpleSAML_Utilities::resolveCert($srcMetadata->getString('saml.SOAPClient.certificate'));
             if ($srcMetadata->hasValue('saml.SOAPClient.privatekey_pass')) {
                 $ctxOpts['ssl']['passphrase'] = $srcMetadata->getString('saml.SOAPClient.privatekey_pass');
             }
         }
     } else {
         /* Use the SP certificate and privatekey if it is configured. */
         $privateKey = SimpleSAML_Utilities::loadPrivateKey($srcMetadata);
         $publicKey = SimpleSAML_Utilities::loadPublicKey($srcMetadata);
         if ($privateKey !== NULL && $publicKey !== NULL && isset($publicKey['PEM'])) {
             $keyCertData = $privateKey['PEM'] . $publicKey['PEM'];
             $file = SimpleSAML_Utilities::getTempDir() . '/' . sha1($keyCertData) . '.pem';
             if (!file_exists($file)) {
                 SimpleSAML_Utilities::writeFile($file, $keyCertData);
             }
             $ctxOpts['ssl']['local_cert'] = $file;
             if (isset($privateKey['password'])) {
                 $ctxOpts['ssl']['passphrase'] = $privateKey['password'];
             }
         }
     }
     /* Do peer certificate verification */
     if ($dstMetadata !== NULL) {
         $peerPublicKeys = $dstMetadata->getPublicKeys('signing', TRUE);
         $certData = '';
         foreach ($peerPublicKeys as $key) {
             if ($key['type'] !== 'X509Certificate') {
                 continue;
             }
             $certData .= "-----BEGIN CERTIFICATE-----\n" . chunk_split($key['X509Certificate'], 64) . "-----END CERTIFICATE-----\n";
         }
         $peerCertFile = SimpleSAML_Utilities::getTempDir() . '/' . sha1($certData) . '.pem';
         if (!file_exists($peerCertFile)) {
             SimpleSAML_Utilities::writeFile($peerCertFile, $certData);
         }
         /* Create ssl context */
         $ctxOpts['ssl']['verify_peer'] = TRUE;
         $ctxOpts['ssl']['verify_depth'] = 1;
         $ctxOpts['ssl']['cafile'] = $peerCertFile;
     }
     $ctxOpts['http']['header'] = 'SOAPAction: "http://www.oasis-open.org/committees/security"' . "\n";
     if ($this->username !== NULL && $this->password !== NULL) {
         /* Add HTTP Basic authentication header. */
         $authData = $this->username . ':' . $this->password;
         $authData = base64_encode($authData);
         $ctxOpts['http']['header'] .= 'Authorization: Basic ' . $authData . "\n";
     }
     if ($srcMetadata->hasValue('saml.SOAPClient.proxyhost')) {
         $options['proxy_host'] = $srcMetadata->getValue('saml.SOAPClient.proxyhost');
     }
     if ($srcMetadata->hasValue('saml.SOAPClient.proxyport')) {
         $options['proxy_port'] = $srcMetadata->getValue('saml.SOAPClient.proxyport');
     }
     $x = new SoapClient(NULL, $options);
     /* Add soap-envelopes */
     $request = $msg->toSignedXML();
     $request = self::START_SOAP_ENVELOPE . $request->ownerDocument->saveXML($request) . self::END_SOAP_ENVELOPE;
     SAML2_Utils::getContainer()->debugMessage($request, 'out');
     $ctxOpts['http']['content'] = $request;
     $ctxOpts['http']['header'] .= 'Content-Type: text/xml; charset=utf-8' . "\n";
     $ctxOpts['http']['method'] = 'POST';
     $destination = $msg->getDestination();
     /* Perform SOAP Request over HTTP */
     $context = stream_context_create($ctxOpts);
     if ($context === NULL) {
         throw new Exception('Unable to create stream context');
     }
     $soapresponsexml = @file_get_contents($destination, FALSE, $context);
     if ($soapresponsexml === FALSE) {
         throw new Exception('Error processing SOAP call: ' . SimpleSAML_Utilities::getLastError());
     }
     SAML2_Utils::getContainer()->debugMessage($soapresponsexml, 'in');
     /* Convert to SAML2_Message (DOMElement) */
     try {
         $dom = SAML2_DOMDocumentFactory::fromString($soapresponsexml);
     } catch (SAML2_Exception_RuntimeException $e) {
         throw new Exception('Not a SOAP response.', 0, $e);
     }
     $soapfault = $this->getSOAPFault($dom);
     if (isset($soapfault)) {
         throw new Exception($soapfault);
     }
     /* Extract the message from the response */
//.........这里部分代码省略.........

 protected function createResponse($testrun, $request, $relayState = NULL)
 {
     $this->log($testrun, 'Creating response with relaystate [' . $relayState . ']');
     $idpMetadata = SimpleSAML_Configuration::loadFromArray($this->idpmetadata);
     $spMetadata = SimpleSAML_Configuration::loadFromArray($this->metadata);
     $requestId = $request->getId();
     $consumerURL = $request->getAssertionConsumerServiceURL();
     $spentityid = $spMetadata->getString('entityid');
     $idpentityid = $idpMetadata->getString('entityid');
     $consumerURLf = $spMetadata->getDefaultEndpoint('AssertionConsumerService', array('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'), $consumerURL);
     $consumerURL = $consumerURLf['Location'];
     $protocolBinding = SAML2_Const::BINDING_HTTP_POST;
     $config = $this->getConfig($testrun);
     #		print_r($requestId);
     // Build the response
     $signResponse = $config['signResponse'];
     $response = new sspmod_fedlab_xml_Response();
     $response->setIssuer($this->getIssuerResponse($testrun, $idpentityid));
     $response->setDestination($this->getDestinationResponse($testrun, $consumerURL));
     if ($signResponse) {
         // self::addSign($srcMetadata, $dstMetadata, $r);
         $keyArray = SimpleSAML_Utilities::loadPrivateKey($idpMetadata, TRUE);
         $certArray = SimpleSAML_Utilities::loadPublicKey($idpMetadata, FALSE);
         $privateKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
         $privateKey->loadKey($keyArray['PEM'], FALSE);
         $response->setSignatureKey($privateKey);
         if ($certArray === NULL) {
             throw new Exception('No certificates found. [1]');
         }
         if (!array_key_exists('PEM', $certArray)) {
             throw new Exception('No certificates found. [2]');
         }
         $response->setCertificates(array($certArray['PEM']));
     }
     $inresponseto = $this->getInResponseToResponse($testrun, $requestId);
     if (!empty($inresponseto)) {
         $response->setInResponseTo($inresponseto);
     }
     $response->setRelayState($this->getRelayState($testrun, $relayState));
     $realAttr = array('urn:oid:1.3.6.1.4.1.5923.1.1.1.6' => array('andreas@uninett.no'), 'urn:mace:dir:attribute-def:eduPersonPrincipalName' => array('andreas@uninett.no'));
     $fakeAttr = array('urn:foo' => array('bar'));
     switch ($testrun) {
         /* getAssertion($testrun, $request, $attributes = NULL, $sign = FALSE, $includeAuthn = TRUE) { */
         case 'multipleassertion1':
             $response->setAssertions(array($this->getAssertion($testrun, $request, $realAttr, $config['signAssertion'], TRUE), $this->getAssertion($testrun, $request, $fakeAttr, $config['signAssertion'], TRUE)));
             break;
         case 'multipleassertion2':
             $response->setAssertions(array($this->getAssertion($testrun, $request, $fakeAttr, $config['signAssertion'], TRUE), $this->getAssertion($testrun, $request, $realAttr, $config['signAssertion'], TRUE)));
             break;
         case 'multipleassertion3':
             $response->setAssertions(array($this->getAssertion($testrun, $request, $fakeAttr, TRUE, TRUE), $this->getAssertion($testrun, $request, $realAttr, FALSE, TRUE)));
             break;
         case 'multipleassertion3b':
             $response->setAssertions(array($this->getAssertion($testrun, $request, $realAttr, FALSE, TRUE), $this->getAssertion($testrun, $request, $fakeAttr, TRUE, TRUE)));
             break;
         case 'multipleassertion4':
             $response->setAssertions(array($this->getAssertion($testrun, $request, $realAttr, TRUE, FALSE), $this->getAssertion($testrun, $request, $fakeAttr, FALSE, TRUE)));
             break;
         case 'multipleassertion4b':
             $response->setAssertions(array($this->getAssertion($testrun, $request, $fakeAttr, FALSE, TRUE), $this->getAssertion($testrun, $request, $realAttr, TRUE, FALSE)));
             break;
     }
     $this->tweakResponse($testrun, $response);
     $msgStr = $response->toSignedXML();
     $msgStr = $msgStr->ownerDocument->saveXML($msgStr);
     return array('url' => $consumerURL, 'Response' => $msgStr, 'RelayState' => $relayState);
 }

 protected function createLogoutRequest($testrun, $samlResponse)
 {
     $idpMetadata = SimpleSAML_Configuration::loadFromArray($this->idpmetadata);
     $spMetadata = SimpleSAML_Configuration::loadFromArray($this->metadata);
     // Get SingleLogoutService URL
     $consumerURLf = $spMetadata->getDefaultEndpoint('SingleLogoutService', array('urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'));
     $consumerURL = $consumerURLf['Location'];
     $lr = sspmod_fedlab_xml_Message::buildLogoutRequest($idpMetadata, $spMetadata);
     // $lr->setSessionIndex($association['saml:SessionIndex']);
     // $lr->setNameId($association['saml:NameID']);
     $lr->setSessionIndex($this->getSessionIndex($testrun, $samlResponse['SessionIndex']));
     $lr->setNameId($this->getNameID($testrun, $samlResponse['NameID']));
     if ($this->signRequest($testrun)) {
         $keyArray = SimpleSAML_Utilities::loadPrivateKey($idpMetadata, TRUE);
         $certArray = SimpleSAML_Utilities::loadPublicKey($idpMetadata, FALSE);
         $privateKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'private'));
         $privateKey->loadKey($keyArray['PEM'], FALSE);
         $lr->setSignatureKey($privateKey);
         if ($certArray === NULL) {
             throw new Exception('No certificates found. [1]');
         }
         if (!array_key_exists('PEM', $certArray)) {
             throw new Exception('No certificates found. [2]');
         }
         $lr->setCertificates(array($certArray['PEM']));
     }
     $this->tweakLogoutRequest($testrun, $lr);
     $msgStr = $lr->toSignedXML();
     $this->tweakLogoutRequestDOM($testrun, $msgStr);
     $msgStr = $msgStr->ownerDocument->saveXML($msgStr);
     #	echo '<pre>'; echo(htmlspecialchars($msgStr)); exit;
     #		$msgStr = base64_encode($msgStr);
     #		$msgStr = htmlspecialchars($msgStr);
     return array('url' => $consumerURL, 'Request' => $msgStr, 'RequestObj' => $lr);
 }