SAML - Getting response from the identity provider - php

Question

I am trying to implement SAML authentication system using onelogin.com, I am using this php library https://github.com/simplesamlphp/saml2 with below code
// Set up an AuthnRequest
$request = new SAML2_AuthnRequest();
// $request->setId(SAML2_Utils::generateId());
$request->setIssuer('http://localhost:8888/yii2/dw/advanced/frontend/web/index.php?r=site/auth');
$request->setDestination('https://app.onelogin.com/trust/saml2/http-post/sso/418578');
// Send it off using the HTTP-Redirect binding
$binding = new SAML2_HTTPRedirect();
$binding->send($request);
Above code is successfully authenticating me and posting back me to my success page, but I don't know how to get user information from posted data.
I am trying below code to get the user data
$response = new \SAML2_Response();
print_r($response);
It is giving below data
SAML2_Response Object
(
[assertions:SAML2_Response:private] => Array
(
)
[inResponseTo:SAML2_StatusResponse:private] =>
[status:SAML2_StatusResponse:private] => Array
(
[Code] => urn:oasis:names:tc:SAML:2.0:status:Success
[SubCode] =>
[Message] =>
)
[extensions:protected] =>
[tagName:SAML2_Message:private] => Response
[id:SAML2_Message:private] => _afe4d7fd7add270de7d334231e2eec68d1492363130
[issueInstant:SAML2_Message:private] => 14340322405
[destination:SAML2_Message:private] =>
[consent:SAML2_Message:private] => urn:oasis:names:tc:SAML:2.0:consent:unspecified
[issuer:SAML2_Message:private] =>
[relayState:SAML2_Message:private] =>
[document:protected] =>
[signatureKey:SAML2_Message:private] =>
[messageContainedSignatureUponConstruction:protected] =>
[certificates:SAML2_Message:private] => Array
(
)
[validators:SAML2_Message:private] => Array
(
)
)
From above output I am not able to get user information, Please help.

Answer 1

Your code:
$response = new \SAML2_Response();
actually creates a new SAML 2.0 Response object instead of parsing the one that is posted back from the IDP. This call should be used by an IDP that wants to create a SAML response. You should be looking to execute something like the following code on the Assertion Consumer (ACS) URL:
$b = SAML2_Binding::getCurrentBinding();
$response = $b->receive();
but I would very strongly advise you to use simpleSAMLphp itself (or another 3rd party SAML implementation) for integration SAML in to your PHP application since it deals with all complex and security sensitive SAML processing.
The SAML 2.0 library is only meant for developers who want to use SAML for other purposes than Web SSO or that want to rebuild a SAML implementation because simpleSAMLphp does not suit them. Assuming you have no requirements that simpleSAMLphp can't meet, you're far better off (and secure) using that. Moreover, if you'd have an extension requirement, I would create a pull request for simpleSAMLphp instead of redoing that project from scratch.

Answer 2

#HansZ is right. Be careful when using directly the SAML core of simpleSAMLphp instead the whole framework.
I also wanted to suggest an alternative, since you want to connect your application with onelogin.com, why not use the OneLogin's PHP SAML Toolkit? https://github.com/onelogin/php-saml