{"action":"created","issue":{"url":"https://api.github.com/repos/onelogin/php-saml/issues/243","repository_url":"https://api.github.com/repos/onelogin/php-saml","labels_url":"https://api.github.com/repos/onelogin/php-saml/issues/243/labels{/name}","comments_url":"https://api.github.com/repos/onelogin/php-saml/issues/243/comments","events_url":"https://api.github.com/repos/onelogin/php-saml/issues/243/events","html_url":"https://github.com/onelogin/php-saml/issues/243","id":247272334,"number":243,"title":"SLS signature verification failure","user":{"login":"williamhector","id":3031386,"avatar_url":"https://avatars1.githubusercontent.com/u/3031386?v=4","gravatar_id":"","url":"https://api.github.com/users/williamhector","html_url":"https://github.com/williamhector","followers_url":"https://api.github.com/users/williamhector/followers","following_url":"https://api.github.com/users/williamhector/following{/other_user}","gists_url":"https://api.github.com/users/williamhector/gists{/gist_id}","starred_url":"https://api.github.com/users/williamhector/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/williamhector/subscriptions","organizations_url":"https://api.github.com/users/williamhector/orgs","repos_url":"https://api.github.com/users/williamhector/repos","events_url":"https://api.github.com/users/williamhector/events{/privacy}","received_events_url":"https://api.github.com/users/williamhector/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-08-02T04:48:57Z","updated_at":"2017-08-02T23:58:42Z","closed_at":null,"body":"This may or may be related to Issue #225 \r\nI am using version 2.11.0, but haven't kept an eye on which versions I've used in the past.\r\n\r\nIn `OneLogin_Saml2_Utils->validateBinarySign`, if `$retrieveParametersFromServer` is FALSE and the IdP's logout request contains lowercase url-encoded values, eg `%2f` instead of `%2F`, as Azure does, then when it calls `urlencode()` to rebuild the `$signedQuery`, it results in a query string that has uppercase url-encoded values, obviously causing the signature verification to fail.\r\n\r\nI can set `$retrieveParametersFromServer` to true, which resolves the issue by getting the `$signedQuery` from `$_SERVER['QUERY_STRING']` instead of `$_GET`, however I'm not certain if `$retrieveParametersFromServer` is actually meant for a different purpose. \r\n\r\nIs there another purpose for `$retrieveParametersFromServer`, which could potentially cause other issues, or is that what it was built for?\r\nI'd assume there is another reason, or else why isn't it the default option, since it seems less error prone..."},"comment":{"url":"https://api.github.com/repos/onelogin/php-saml/issues/comments/319830487","html_url":"https://github.com/onelogin/php-saml/issues/243#issuecomment-319830487","issue_url":"https://api.github.com/repos/onelogin/php-saml/issues/243","id":319830487,"user":{"login":"williamhector","id":3031386,"avatar_url":"https://avatars1.githubusercontent.com/u/3031386?v=4","gravatar_id":"","url":"https://api.github.com/users/williamhector","html_url":"https://github.com/williamhector","followers_url":"https://api.github.com/users/williamhector/followers","following_url":"https://api.github.com/users/williamhector/following{/other_user}","gists_url":"https://api.github.com/users/williamhector/gists{/gist_id}","starred_url":"https://api.github.com/users/williamhector/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/williamhector/subscriptions","organizations_url":"https://api.github.com/users/williamhector/orgs","repos_url":"https://api.github.com/users/williamhector/repos","events_url":"https://api.github.com/users/williamhector/events{/privacy}","received_events_url":"https://api.github.com/users/williamhector/received_events","type":"User","site_admin":false},"created_at":"2017-08-02T23:58:42Z","updated_at":"2017-08-02T23:58:42Z","body":"Thanks for the tip. However, from what I understand so far it might be better to always do signature validation against the unaltered $_SERVER['QUERY_STRING'] instead of re-encoding from the $_GET vars.\r\n\r\nI'd rather not use that lowercaseUrlencoding setting because our IdPs could change theirs without notice.\r\n\r\nBecause of this and some other things I've noticed, I get the sense that this project might need a major, breaking version change at some point. For example, I noticed that there is both an \"x509cert\" and \"x509certMulti\" IdP setting, but the code base could be simplified if it only supported the array setting.\r\nI'd love to be able to help if that is a goal.\r\n"}}
{"actor":{"display_login":"williamhector"}}