public function isValid($requestId = null, $retrieveParametersFromServer = false)
    {
        $this->_error = null;
        try {
            $idpData = $this->_settings->getIdPData();
            $idPEntityId = $idpData['entityId'];

            if ($this->_settings->isStrict()) {
                $security = $this->_settings->getSecurityData();

                if ($security['wantXMLValidation']) {
                    $res = OneLogin_Saml2_Utils::validateXML($this->document, 'saml-schema-protocol-2.0.xsd', $this->_settings->isDebugActive());
                    if (!$res instanceof DOMDocument) {
                        throw new OneLogin_Saml2_ValidationError(
                            "Invalid SAML Logout Response. Not match the saml-schema-protocol-2.0.xsd",
                            OneLogin_Saml2_ValidationError::INVALID_XML_FORMAT
                        );
                    }
                }

                // Check if the InResponseTo of the Logout Response matchs the ID of the Logout Request (requestId) if provided
                if (isset($requestId) && $this->document->documentElement->hasAttribute('InResponseTo')) {
                    $inResponseTo = $this->document->documentElement->getAttribute('InResponseTo');
                    if ($requestId != $inResponseTo) {
                        throw new OneLogin_Saml2_ValidationError(
                            "The InResponseTo of the Logout Response: $inResponseTo, does not match the ID of the Logout request sent by the SP: $requestId",
                            OneLogin_Saml2_ValidationError::WRONG_INRESPONSETO
                        );
                    }
                }

                // Check issuer
                $issuer = $this->getIssuer();
                if (!empty($issuer) && $issuer != $idPEntityId) {
                    throw new OneLogin_Saml2_ValidationError(
                        "Invalid issuer in the Logout Response",
                        OneLogin_Saml2_ValidationError::WRONG_ISSUER
                    );
                }

                $currentURL = OneLogin_Saml2_Utils::getSelfRoutedURLNoQuery();

                // Check destination
                if ($this->document->documentElement->hasAttribute('Destination')) {
                    $destination = $this->document->documentElement->getAttribute('Destination');
                    if (!empty($destination) && strpos($destination, $currentURL) === false) {
                        throw new OneLogin_Saml2_ValidationError(
                            "The LogoutResponse was received at $currentURL instead of $destination",
                            OneLogin_Saml2_ValidationError::WRONG_DESTINATION
                        );
                    }
                }

                if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
                    throw new OneLogin_Saml2_ValidationError(
                        "The Message of the Logout Response is not signed and the SP requires it",
                        OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
                    );
                }
            }

            if (isset($_GET['Signature'])) {
                $signatureValid = OneLogin_Saml2_Utils::validateBinarySign("SAMLResponse", $_GET, $idpData, $retrieveParametersFromServer);
                if (!$signatureValid) {
                    throw new OneLogin_Saml2_ValidationError(
                        "Signature validation failed. Logout Response rejected",
                        OneLogin_Saml2_ValidationError::INVALID_SIGNATURE
                    );
                }
            }
            return true;
        } catch (Exception $e) {
            $this->_error = $e->getMessage();
            $debug = $this->_settings->isDebugActive();
            if ($debug) {
                echo htmlentities($this->_error);
            }
            return false;
        }
    }
public function isValid($requestId = null, $retrieveParametersFromServer = false)
    {
        $this->_error = null;
        try {
            $idpData = $this->_settings->getIdPData();
            $idPEntityId = $idpData['entityId'];

            if ($this->_settings->isStrict()) {
                $security = $this->_settings->getSecurityData();

                if ($security['wantXMLValidation']) {
                    $res = OneLogin_Saml2_Utils::validateXML($this->document, 'saml-schema-protocol-2.0.xsd', $this->_settings->isDebugActive());
                    if (!$res instanceof DOMDocument) {
                        throw new OneLogin_Saml2_ValidationError(
                            "Invalid SAML Logout Response. Not match the saml-schema-protocol-2.0.xsd",
                            OneLogin_Saml2_ValidationError::INVALID_XML_FORMAT
                        );
                    }
                }

                // Check if the InResponseTo of the Logout Response matchs the ID of the Logout Request (requestId) if provided
                if (isset($requestId) && $this->document->documentElement->hasAttribute('InResponseTo')) {
                    $inResponseTo = $this->document->documentElement->getAttribute('InResponseTo');
                    if ($requestId != $inResponseTo) {
                        throw new OneLogin_Saml2_ValidationError(
                            "The InResponseTo of the Logout Response: $inResponseTo, does not match the ID of the Logout request sent by the SP: $requestId",
                            OneLogin_Saml2_ValidationError::WRONG_INRESPONSETO
                        );
                    }
                }

                // Check issuer
                $issuer = $this->getIssuer();
                if (!empty($issuer) && $issuer != $idPEntityId) {
                    throw new OneLogin_Saml2_ValidationError(
                        "Invalid issuer in the Logout Response",
                        OneLogin_Saml2_ValidationError::WRONG_ISSUER
                    );
                }

                $currentURL = OneLogin_Saml2_Utils::getSelfRoutedURLNoQuery();

                // Check destination
                if ($this->document->documentElement->hasAttribute('Destination')) {
                    $destination = $this->document->documentElement->getAttribute('Destination');
                    if (!empty($destination) && strpos($destination, $currentURL) === false) {
                        throw new OneLogin_Saml2_ValidationError(
                            "The LogoutResponse was received at $currentURL instead of $destination",
                            OneLogin_Saml2_ValidationError::WRONG_DESTINATION
                        );
                    }
                }

                if ($security['wantMessagesSigned'] && !isset($_GET['Signature'])) {
                    throw new OneLogin_Saml2_ValidationError(
                        "The Message of the Logout Response is not signed and the SP requires it",
                        OneLogin_Saml2_ValidationError::NO_SIGNED_MESSAGE
                    );
                }
            }

            if (isset($_GET['Signature'])) {
                $signatureValid = OneLogin_Saml2_Utils::validateBinarySign("SAMLResponse", $_GET, $idpData, $retrieveParametersFromServer);
                if (!$signatureValid) {
                    throw new OneLogin_Saml2_ValidationError(
                        "Signature validation failed. Logout Response rejected",
                        OneLogin_Saml2_ValidationError::INVALID_SIGNATURE
                    );
                }
            }
            return true;
        } catch (Exception $e) {
            $this->_error = $e->getMessage();
            $debug = $this->_settings->isDebugActive();
            if ($debug) {
                echo htmlentities($this->_error);
            }
            return false;
        }
    }
public function isValid ( $ requestId = null , $ retrieveParametersFromServer = false ) { $ this -> _error = null ; try { $ idpData = $ this -> _settings -> getIdPData ( ) ; $ idPEntityId = $ idpData [ 'entityId' ] ; if ( $ this -> _settings -> isStrict ( ) ) { $ security = $ this -> _settings -> getSecurityData ( ) ; if ( $ security [ 'wantXMLValidation' ] ) { $ res = OneLogin_Saml2_Utils :: validateXML ( $ this -> document , 'saml-schema-protocol-2.0.xsd' , $ this -> _settings -> isDebugActive ( ) ) ; if ( ! $ res instanceof DOMDocument ) { throw new OneLogin_Saml2_ValidationError ( "Invalid SAML Logout Response. Not match the saml-schema-protocol-2.0.xsd" , OneLogin_Saml2_ValidationError :: INVALID_XML_FORMAT ) ; } } // Check if the InResponseTo of the Logout Response matchs the ID of the Logout Request (requestId) if provided if ( isset ( $ requestId ) && $ this -> document -> documentElement -> hasAttribute ( 'InResponseTo' ) ) { $ inResponseTo = $ this -> document -> documentElement -> getAttribute ( 'InResponseTo' ) ; if ( $ requestId != $ inResponseTo ) { throw new OneLogin_Saml2_ValidationError ( "The InResponseTo of the Logout Response: $inResponseTo, does not match the ID of the Logout request sent by the SP: $requestId" , OneLogin_Saml2_ValidationError :: WRONG_INRESPONSETO ) ; } } // Check issuer $ issuer = $ this -> getIssuer ( ) ; if ( ! empty ( $ issuer ) && $ issuer != $ idPEntityId ) { throw new OneLogin_Saml2_ValidationError ( "Invalid issuer in the Logout Response" , OneLogin_Saml2_ValidationError :: WRONG_ISSUER ) ; } $ currentURL = OneLogin_Saml2_Utils :: getSelfRoutedURLNoQuery ( ) ; // Check destination if ( $ this -> document -> documentElement -> hasAttribute ( 'Destination' ) ) { $ destination = $ this -> document -> documentElement -> getAttribute ( 'Destination' ) ; if ( ! empty ( $ destination ) && strpos ( $ destination , $ currentURL ) === false ) { throw new OneLogin_Saml2_ValidationError ( "The LogoutResponse was received at $currentURL instead of $destination" , OneLogin_Saml2_ValidationError :: WRONG_DESTINATION ) ; } } if ( $ security [ 'wantMessagesSigned' ] && ! isset ( $ _GET [ 'Signature' ] ) ) { throw new OneLogin_Saml2_ValidationError ( "The Message of the Logout Response is not signed and the SP requires it" , OneLogin_Saml2_ValidationError :: NO_SIGNED_MESSAGE ) ; } } if ( isset ( $ _GET [ 'Signature' ] ) ) { $ signatureValid = OneLogin_Saml2_Utils :: validateBinarySign ( "SAMLResponse" , $ _GET , $ idpData , $ retrieveParametersFromServer ) ; if ( ! $ signatureValid ) { throw new OneLogin_Saml2_ValidationError ( "Signature validation failed. Logout Response rejected" , OneLogin_Saml2_ValidationError :: INVALID_SIGNATURE ) ; } } return true ; } catch ( Exception $ e ) { $ this -> _error = $ e -> getMessage ( ) ; $ debug = $ this -> _settings -> isDebugActive ( ) ; if ( $ debug ) { echo htmlentities ( $ this -> _error ) ; } return false ; } }
Determines if the SAML LogoutResponse is valid

@param string|null $requestId The ID of the LogoutRequest sent by this SP to the IdP
@param bool $retrieveParametersFromServer

@return bool Returns if the SAML LogoutResponse is or not valid
Determines if the SAML LogoutResponse is valid