Feature/issue 48 mdui chunk - #137
Open
kayjoosten wants to merge 3 commits into
Open
Conversation
kayjoosten
added a commit
to OpenConext/Stepup-gssp-bundle
that referenced
this pull request
Jul 2, 2026
…sting Prior to this change, composer.json required surfnet/stepup-saml-bundle ^7.0 from packagist, which does not yet contain MduiChunk. This caused phpstan to fail with "class not found" errors for all mdui-related symbols. This change adds a VCS repository pointing to the GitHub source and pins the requirement to the feature branch where MduiChunk is implemented. This is a temporary measure to enable end-to-end integration testing from EngineBlock through to the GSSP example application. This must be reverted to a packagist version constraint once the saml-bundle PR is merged and a new release is tagged. Links: - OpenConext/Stepup-saml-bundle#137
kayjoosten
force-pushed
the
feature/issue-48-mdui-chunk
branch
from
July 2, 2026 07:33
e1cdf19 to
9f4866a
Compare
kayjoosten
added a commit
to OpenConext/Stepup-gssp-bundle
that referenced
this pull request
Jul 2, 2026
Prior to this change, the GSSP bundle discarded the mdui:UIInfo extension forwarded by the Gateway on proxy AuthnRequests. Consumers had no way to retrieve per-language service display names from session state, making it impossible to show the correct service name during step-up authentication and registration flows. This change saves mdui:UIInfo to session state in both saveAuthenticationRequest() and saveRegistrationRequest(), and exposes it through getMdui(): ?MduiChunk and hasMdui(): bool on StateHandler and StateHandlerInterface. Behat scenarios cover the present and absent cases for both flows. SSOController is corrected to read the relay state from the query string only, matching the HTTP-Redirect binding specification. Links: - #48 - OpenConext/Stepup-saml-bundle#137
kayjoosten
added a commit
to OpenConext/Stepup-gssp-bundle
that referenced
this pull request
Jul 2, 2026
…sting Prior to this change, composer.json required surfnet/stepup-saml-bundle ^7.0 from packagist, which does not yet contain MduiChunk. This caused phpstan to fail with class-not-found errors for all mdui-related symbols, blocking CI. This change adds a VCS repository pointing to the GitHub source and pins the requirement to the feature branch that implements MduiChunk. This is temporary and must be reverted to a packagist version constraint once the saml-bundle pull request is merged and a new release is tagged. Links: - OpenConext/Stepup-saml-bundle#137
3 tasks
kayjoosten
added a commit
to OpenConext/Stepup-gssp-bundle
that referenced
this pull request
Jul 3, 2026
Prior to this change, the GSSP bundle discarded the mdui:UIInfo extension forwarded by the Gateway on proxy AuthnRequests. Consumers had no way to retrieve per-language service display names from session state, making it impossible to show the correct service name during step-up authentication and registration flows. This change saves mdui:UIInfo to session state in both saveAuthenticationRequest() and saveRegistrationRequest(), and exposes it through getMdui(): ?MduiChunk and hasMdui(): bool on StateHandler and StateHandlerInterface. Behat scenarios cover the present and absent cases for both flows. SSOController is corrected to read the relay state from the query string only, matching the HTTP-Redirect binding specification. Links: - #48 - OpenConext/Stepup-saml-bundle#137
kayjoosten
added a commit
to OpenConext/Stepup-gssp-bundle
that referenced
this pull request
Jul 3, 2026
…sting Prior to this change, composer.json required surfnet/stepup-saml-bundle ^7.0 from packagist, which does not yet contain MduiChunk. This caused phpstan to fail with class-not-found errors for all mdui-related symbols, blocking CI. This change adds a VCS repository pointing to the GitHub source and pins the requirement to the feature branch that implements MduiChunk. This is temporary and must be reverted to a packagist version constraint once the saml-bundle pull request is merged and a new release is tagged. Links: - OpenConext/Stepup-saml-bundle#137
Before this change the bundle could not expose mdui:UIInfo from AuthnRequest extensions, so callers had no reliable way to show the service's localized display name during step-up flows. The branch also needed defensive hardening around signature transform handling and a supported Symfony test matrix so the new behavior could ship safely. Address this by mapping UIInfo extensions to a dedicated MduiChunk and exposing helpers to read localized display names from parsed extensions. Reject unsupported XML Signature transforms before the underlying SAML library evaluates them, fail loudly on malformed UIInfo XML, and refresh the dependency bounds and CI matrix to supported, reproducible versions. - add component and unit coverage for UIInfo parsing and transform validation - document the new UIInfo support and the audit-related dependency decisions Resolves: #48
kayjoosten
force-pushed
the
feature/issue-48-mdui-chunk
branch
from
July 10, 2026 11:09
790eab1 to
f4a5390
Compare
4 tasks
johanib
requested changes
Jul 22, 2026
If applied, this commit will raise the minimum simplesamlphp/saml2 version this bundle allows to 4.16.16 and drop the two audit-ignore entries that are no longer needed. Why is this change needed? The composer constraint was ">=4.6 <4.20", which still permits versions vulnerable to two advisories (PKSA-rxdv-j1j4-96fj, fixed in >=4.16.16, and PKSA-1983-c8jn-trgm, fixed in >=4.6.14) even though the locked version was already patched. The constraint itself did not enforce the fix, only the lock file did. Also adds a regression test for MduiChunk's documented but previously untested behavior with a null value. How does it address the issue? Bumps the floor to ">=4.16.16 <4.20", covering both advisories, and removes the corresponding ignore entries from composer.json since the constraint now enforces them directly. Adds test_empty_ui_info_yields_no_display_names to lock in that an empty MduiChunk yields no display names. Links / references: #137
3 tasks
johanib
approved these changes
Jul 30, 2026
Previously existed as three independently-drifting copies (Stepup-Gateway, Stepup-gssp-bundle, Stepup-Webauthn), one of which truncated to 41 chars instead of 40. Both Gateway and gssp-bundle already depend on this bundle, so this is the natural shared home per the RFC (OpenConext/Stepup-Gateway#587).
kayjoosten
added a commit
to OpenConext/Stepup-Gateway
that referenced
this pull request
Jul 30, 2026
…icate Per Johan's review comment: this sanitization logic (truncate to 40 chars + ellipsis, whitespace collapse, control-char strip) existed as three independently-drifting copies (Gateway, Stepup-gssp-bundle, Stepup-Webauthn), one of which truncated to 41 chars instead of 40. Moved the canonical implementation to Stepup-saml-bundle, which both Gateway and gssp-bundle already depend on. gssp-bundle's own copy is removed in a companion PR (OpenConext/Stepup-gssp-bundle#49) so its ServiceNameResolver delegates to the same class - WebAuthn/DemoGSSP/Tiqr need no changes, they already only call gssp-bundle's ServiceNameResolver, never the formatter directly. Temporarily pinned to Stepup-saml-bundle's feature/issue-48-mdui-chunk branch (OpenConext/Stepup-saml-bundle#137, still open) via a VCS repository entry, matching the same pattern already used in gssp-bundle#49. Needs swapping to a tagged release once #137 merges.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.