public static function validateBinarySign($messageType, $getData, $idpData, $retrieveParametersFromServer = false)
    {
        if (!isset($getData['SigAlg'])) {
            $signAlg = XMLSecurityKey::RSA_SHA1;
        } else {
            $signAlg = $getData['SigAlg'];
        }

        if ($retrieveParametersFromServer) {
            $signedQuery = $messageType.'='.OneLogin_Saml2_Utils::extractOriginalQueryParam($messageType);
            if (isset($getData['RelayState'])) {
                $signedQuery .= '&RelayState='.OneLogin_Saml2_Utils::extractOriginalQueryParam('RelayState');
            }
            $signedQuery .= '&SigAlg='.OneLogin_Saml2_Utils::extractOriginalQueryParam('SigAlg');
        } else {
            $signedQuery = $messageType.'='.urlencode($getData[$messageType]);
            if (isset($getData['RelayState'])) {
                $signedQuery .= '&RelayState='.urlencode($getData['RelayState']);
            }
            $signedQuery .= '&SigAlg='.urlencode($signAlg);
        }

        if ($messageType == "SAMLRequest") {
            $strMessageType = "Logout Request";
        } else {
            $strMessageType = "Logout Response";
        }
        $existsMultiX509Sign = isset($idpData['x509certMulti']) && isset($idpData['x509certMulti']['signing']) && !empty($idpData['x509certMulti']['signing']);
        if ((!isset($idpData['x509cert']) || empty($idpData['x509cert'])) && !$existsMultiX509Sign) {
            throw new OneLogin_Saml2_Error(
                "In order to validate the sign on the ".$strMessageType.", the x509cert of the IdP is required",
                OneLogin_Saml2_Error::CERT_NOT_FOUND
            );
        }

        if ($existsMultiX509Sign) {
            $multiCerts = $idpData['x509certMulti']['signing'];
        } else {
            $multiCerts = array($idpData['x509cert']);
        }

        $signatureValid = false;
        foreach ($multiCerts as $cert) {
            $objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'public'));
            $objKey->loadKey($cert, false, true);

            if ($signAlg != XMLSecurityKey::RSA_SHA1) {
                try {
                    $objKey = OneLogin_Saml2_Utils::castKey($objKey, $signAlg, 'public');
                } catch (Exception $e) {
                    $ex = new OneLogin_Saml2_ValidationError(
                        "Invalid signAlg in the recieved ".$strMessageType,
                        OneLogin_Saml2_ValidationError::INVALID_SIGNATURE
                    );
                    if (count($multiCerts) == 1) {
                        throw $ex;
                    }
                }
            }

            if ($objKey->verifySignature($signedQuery, base64_decode($_GET['Signature'])) === 1) {
                $signatureValid = true;
                break;
            }
        }
        return $signatureValid;
    }
public static function validateBinarySign($messageType, $getData, $idpData, $retrieveParametersFromServer = false)
    {
        if (!isset($getData['SigAlg'])) {
            $signAlg = XMLSecurityKey::RSA_SHA1;
        } else {
            $signAlg = $getData['SigAlg'];
        }

        if ($retrieveParametersFromServer) {
            $signedQuery = $messageType.'='.OneLogin_Saml2_Utils::extractOriginalQueryParam($messageType);
            if (isset($getData['RelayState'])) {
                $signedQuery .= '&RelayState='.OneLogin_Saml2_Utils::extractOriginalQueryParam('RelayState');
            }
            $signedQuery .= '&SigAlg='.OneLogin_Saml2_Utils::extractOriginalQueryParam('SigAlg');
        } else {
            $signedQuery = $messageType.'='.urlencode($getData[$messageType]);
            if (isset($getData['RelayState'])) {
                $signedQuery .= '&RelayState='.urlencode($getData['RelayState']);
            }
            $signedQuery .= '&SigAlg='.urlencode($signAlg);
        }

        if ($messageType == "SAMLRequest") {
            $strMessageType = "Logout Request";
        } else {
            $strMessageType = "Logout Response";
        }
        $existsMultiX509Sign = isset($idpData['x509certMulti']) && isset($idpData['x509certMulti']['signing']) && !empty($idpData['x509certMulti']['signing']);
        if ((!isset($idpData['x509cert']) || empty($idpData['x509cert'])) && !$existsMultiX509Sign) {
            throw new OneLogin_Saml2_Error(
                "In order to validate the sign on the ".$strMessageType.", the x509cert of the IdP is required",
                OneLogin_Saml2_Error::CERT_NOT_FOUND
            );
        }

        if ($existsMultiX509Sign) {
            $multiCerts = $idpData['x509certMulti']['signing'];
        } else {
            $multiCerts = array($idpData['x509cert']);
        }

        $signatureValid = false;
        foreach ($multiCerts as $cert) {
            $objKey = new XMLSecurityKey(XMLSecurityKey::RSA_SHA1, array('type' => 'public'));
            $objKey->loadKey($cert, false, true);

            if ($signAlg != XMLSecurityKey::RSA_SHA1) {
                try {
                    $objKey = OneLogin_Saml2_Utils::castKey($objKey, $signAlg, 'public');
                } catch (Exception $e) {
                    $ex = new OneLogin_Saml2_ValidationError(
                        "Invalid signAlg in the recieved ".$strMessageType,
                        OneLogin_Saml2_ValidationError::INVALID_SIGNATURE
                    );
                    if (count($multiCerts) == 1) {
                        throw $ex;
                    }
                }
            }

            if ($objKey->verifySignature($signedQuery, base64_decode($_GET['Signature'])) === 1) {
                $signatureValid = true;
                break;
            }
        }
        return $signatureValid;
    }
public static function validateBinarySign ( $ messageType , $ getData , $ idpData , $ retrieveParametersFromServer = false ) { if ( ! isset ( $ getData [ 'SigAlg' ] ) ) { $ signAlg = XMLSecurityKey :: RSA_SHA1 ; } else { $ signAlg = $ getData [ 'SigAlg' ] ; } if ( $ retrieveParametersFromServer ) { $ signedQuery = $ messageType . '=' . OneLogin_Saml2_Utils :: extractOriginalQueryParam ( $ messageType ) ; if ( isset ( $ getData [ 'RelayState' ] ) ) { $ signedQuery .= '&RelayState=' . OneLogin_Saml2_Utils :: extractOriginalQueryParam ( 'RelayState' ) ; } $ signedQuery .= '&SigAlg=' . OneLogin_Saml2_Utils :: extractOriginalQueryParam ( 'SigAlg' ) ; } else { $ signedQuery = $ messageType . '=' . urlencode ( $ getData [ $ messageType ] ) ; if ( isset ( $ getData [ 'RelayState' ] ) ) { $ signedQuery .= '&RelayState=' . urlencode ( $ getData [ 'RelayState' ] ) ; } $ signedQuery .= '&SigAlg=' . urlencode ( $ signAlg ) ; } if ( $ messageType == "SAMLRequest" ) { $ strMessageType = "Logout Request" ; } else { $ strMessageType = "Logout Response" ; } $ existsMultiX509Sign = isset ( $ idpData [ 'x509certMulti' ] ) && isset ( $ idpData [ 'x509certMulti' ] [ 'signing' ] ) && ! empty ( $ idpData [ 'x509certMulti' ] [ 'signing' ] ) ; if ( ( ! isset ( $ idpData [ 'x509cert' ] ) || empty ( $ idpData [ 'x509cert' ] ) ) && ! $ existsMultiX509Sign ) { throw new OneLogin_Saml2_Error ( "In order to validate the sign on the " . $ strMessageType . ", the x509cert of the IdP is required" , OneLogin_Saml2_Error :: CERT_NOT_FOUND ) ; } if ( $ existsMultiX509Sign ) { $ multiCerts = $ idpData [ 'x509certMulti' ] [ 'signing' ] ; } else { $ multiCerts = array ( $ idpData [ 'x509cert' ] ) ; } $ signatureValid = false ; foreach ( $ multiCerts as $ cert ) { $ objKey = new XMLSecurityKey ( XMLSecurityKey :: RSA_SHA1 , array ( 'type' => 'public' ) ) ; $ objKey -> loadKey ( $ cert , false , true ) ; if ( $ signAlg != XMLSecurityKey :: RSA_SHA1 ) { try { $ objKey = OneLogin_Saml2_Utils :: castKey ( $ objKey , $ signAlg , 'public' ) ; } catch ( Exception $ e ) { $ ex = new OneLogin_Saml2_ValidationError ( "Invalid signAlg in the recieved " . $ strMessageType , OneLogin_Saml2_ValidationError :: INVALID_SIGNATURE ) ; if ( count ( $ multiCerts ) == 1 ) { throw $ ex ; } } } if ( $ objKey -> verifySignature ( $ signedQuery , base64_decode ( $ _GET [ 'Signature' ] ) ) === 1 ) { $ signatureValid = true ; break ; } } return $ signatureValid ; }
Validates a binary signature

@param string $messageType                    Type of SAML Message
@param array  $getData                        HTTP GET array
@param array  $idpData                        IdP setting data
@param bool   $retrieveParametersFromServer   Indicates where to get the values in order to validate the Sign, from getData or from $_SERVER

@return bool

@throws Exception
Validates a binary signature