IDP SAML2: AttributeConsumingServiceIndex implementation

[tbenr]

I propose this PR for implementing IDP compliance to SAML2 service providers using different AttributeConsumingServices in their metadata, sending request using AttributeConsumingServiceIndex.

1. new AttributeConsumingService parameter in saml20-sp-remote to hold Service specification
2. SAMLParser.php has been modified to generate the new configuration param accordingly (metarefresh.php now generates this new param instead of simple attributes array).
3. IdP/SAML2.php adds saml:AttributeConsumingServiceIndex in state variable.
4. AttributeLimit.php, if AttributeConsumingService is defined in Destination metadata, uses saml:AttributeConsumingServiceIndex to resolve the attribute set corresponding to the requested Service. If not found, backward compatibility is maintained.
5. simplesamlphp-reference-sp-remote.md has been updated.
6. SAMLParserTest.php and AttributeLimitTest.php have been updated to cover code changes.

[tbenr]

Hi all, any comment on this PR? just to know if i'm in the right direction.. I'm working on a project that needs this functionality and i'm happy to contribute but i'd like to do it effectively :)

[thijskh]

It's not quite clear to me what this adds over what's currently possible to specify for AttributeConsumingService in metadata (note that isDefault and Index support have been added recently to master).

Can you make more explicit what this achieves and how it adds to what's already possible?

Would be nice if you can resolve conflics with current master since as said that code has been changed in the meantime.

[tbenr]

Hi Thijs,
this PR covers the usecase where you are implementing a SAML2 IDP. It allows you to parse sp metadata loading all AttributeConsumingServices sets defined in metadata. So, when IDP receives AttributeConsumingServiceIndex sent by SP in the AuthnRequest, it is able to pick the corresponding attribute set (implemented by storing the index in the state and make AttributeLimit.php able to get it and select the requested attribute set from sp metadata).
I may be wrong (I didn't follow the latest changes) but I can't see how to do it using the current implementation.
The AttributeConsumingServiceIndex seems to me that has been considered as SP, not as IDP. Moreover, is current implementation it only considering one attribute set for a given SP?

[falco76]

hi @tbenr, hi @thijskh
i need to expose multiple AttributeConsumingService(s) for a single SP?
do this patch solve it?
tnx

[tbenr]

hi @falco76,
yes it implements this use-case. (btw, are you involved in the SPID initiative in Italy?)

[falco76]

@tbenr
certo enrico