| Methods |
public
|
__debugInfo()
Defines a custom output for print_r() and var_dump() functions,
in order to hide cryptographic material used by the object for
security reasons.
Defines a custom output for print_r() and var_dump() functions,
in order to hide cryptographic material used by the object for
security reasons.
|
#
|
protected
|
__construct(
mixed $xmlOrData,
string $signKeyPath = null,
string $signKeyPassword = null,
string $signCertPath = null,
string|null $cryptKeyPath = null,
string|null $cryptKeyPassword = null,
string $cryptCertPath = null,
array $options = [],
)
Instantiate an XMLDSigToken object.
Instantiate an XMLDSigToken object.
This constructor is protected. To get an instance of an XMLDSigToken
object use one of the following static functions according to what the
object is intended for:
-
createXMLToken()
-
createSecureXMLToken()
-
analyzeXMLToken()
-
analyzeSecureXMLToken()
An XMLDSigToken object allows creating an XML token and also analyzing an
existing XML token. The type of the $xmlOrData parameter determines how
the object behaves.
XML token creation:
If $xmlOrData is an array (a flat or multidimensional associative
array), the object will create an enveloping XML digital signature
containing an XML token that holds the provided data and a timestamp
generated automatically, with a random identifier (see getTokenId()).
In this case, the $signKeyPath and $signCertPath parameters are
required. If the $cryptCertPath parameter is also provided, the XML
token will be encrypted for the owner of this certificate. The
$cryptKeyPath parameter, the private key of the recipient, is
optional: given, it is used to decrypt the created token and check its
content too. If this private key is protected by a password, this
password may be passed using the $cryptKeyPassword parameter.
XML token analysis:
If $xmlOrData is a string, the object will treat it as an enveloping
XML digital signature containing a token:
-
It will check that the signature is valid.
-
It will decrypt the token if this one is encrypted.
-
It will extract timestamp and data from the token.
In this case, the $xmlOrData parameter and a trust anchor (the
options caCertPath and/or signerCertPath, see below) are required:
without a trust anchor, no token is valid. If the XML
token is encrypted, the $cryptKeyPath parameter must also be provided.
If the private key used for decryption (cf. $cryptKeyPath parameter) is
protected by a password, this password may be passed using the
$cryptKeyPassword parameter.
When the object creates a token, it analyzes it right away to check it,
and trusts the certificate of its own signing key ($signCertPath) for
that: the trust options do not apply to token creation. An encrypted
token created without $cryptKeyPath is checked up to its decryption
(structure, algorithms, digest, signature, trust in the signing
certificate) and its content is not read (see createSecureXMLToken()).
Configuring the object:
The $options parameter of this function allows to override the default
configuration of the object passing it the desired options via an
associative array.
Example:
$options = [
'base64Encode' => false,
'xmldsigNsPrefix' => ''
];
Each option applies to a context: token creation (createXMLToken(),
createSecureXMLToken()), token analysis (analyzeXMLToken(),
analyzeSecureXMLToken()), or both. The encryption options only apply
when an encryption certificate (creation) or a decryption key
(analysis) is given. An unknown option, an option given out of its
context, or an option whose value is NULL or invalid throws an
exception.
The algorithm options apply to both contexts: at creation, they are the
algorithms the token is built with; at analysis, the algorithms the
token must have been built with. A token built with other algorithms is
rejected (getError() lists them), unless checkSigningAlgorithms or
checkCryptingAlgorithms is FALSE. To analyze a token built with
RSA-SHA1 and SHA-1:
$options = [
'caCertPath' => ['intermediate.cert.pem', 'root.cert.pem'],
'signatureAlgorithm' => XMLDSigToken::RSA_SHA1,
'digestAlgorithm' => XMLDSigToken::SHA1
];
Available options are the following:
-
caCertPath [string|array] Analysis only. The path, or the list
of paths, of PEM files holding the trusted CA certificates. The
signing certificate is only trusted if OpenSSL builds and verifies
its chain, from these certificates only, up to a self-signed
certificate of these files (see X509Cert::isTrustedBy()). To trust
the certificates issued by an intermediate CA, give its certificate
and the certificates up to its root, in one file or in several:
['intermediate.cert.pem', 'root.cert.pem']. A chain that stops at
an intermediate CA is rejected: with the intermediate CA alone,
isSignatureValid() returns FALSE and getError() returns "Signing
certificate is not issued by a trusted CA: its chain could not be
verified up to the CA certificates of the option 'caCertPath', which
must hold the issuing CA and the certificates up to its root!".
Only the signing certificate is taken from the token, so a
certificate issued by another intermediate CA of the same root is
rejected; a certificate issued directly by a CA of the files (the
root included) is accepted.
Default value: none.
-
signerCertPath [string] Analysis only. The path to the PEM
certificate the token must be signed with (certificate pinning): the
signing certificate must be this very certificate. Given alone, it is
the trust anchor; given with caCertPath, both are required.
Default value: none.
-
expectedSubject [string|array] Analysis only. The subject the
signing certificate must have, either:
-
an array of the subject fields to check, as returned by
getCertSubject(): ['O' => 'Lothbrok Ltd', 'OU' => 'Jarl Dept'].
Fields that are not given are not checked.
-
or a string, compared as is with the full Distinguished Name
returned by getCertDN(). This is the OpenSSL "oneline" format
(openssl_x509_parse(), key name): every field of the subject,
in the order of the certificate, each written /<short name>=<value>
with no space and no escaping, e.g.
'/C=DK/ST=Jylland/L=Kattegat/O=Lothbrok Ltd/OU=Signature Dept/CN=www.lothbrok.dk/emailAddress=ivar@lothbrok.dk'.
It is neither the RFC 2253 form (CN=...,O=...) nor the form
printed by the openssl command line (C=DK, ST=...): copy it
from getCertDN() or X509Cert::getDN().
Character case is significant. It does not replace a trust anchor.
Default value: none.
-
expectedAudience [string] Analysis only. The audience of this
receiver, which the token must be addressed to (see audience):
isSignatureValid() returns FALSE if the token names no audience or
does not name this one. A token that names audiences is rejected
when this option is not given, so that a receiver of the issuer
cannot accept a token addressed to another one. Compared as is
(character case included).
Default value: none.
-
audience [string|array] Creation only. The audience, or the
list of audiences, the token is addressed to: names of the receivers
(an application name, a URL...), agreed between the issuer and each
receiver. Each one is a non-empty string, with no surrounding white
space and no control character. They are written in the token,
covered by the signature (see getAudience()).
Default value: none (the token names no audience).
-
validity [int] Creation only. The number of seconds after which
the token is out of date, whatever the time to live the receiver
gives to isOutOfDate(). The expiry date is written in the token,
covered by the signature (see getExpiry()).
Default value: none (only the receiver sets the time to live).
-
base64Encode [boolean] Creation only. Whether to base64 encode
token data or not.
Default value: TRUE.
-
xmldsigNsPrefix [string] Creation only. The XML namespace
(xmlns) prefix to use in the XML digital signature tags. Set it to
empty string to avoid prefix usage.
Default value: 'ds'.
-
checkSigningAlgorithms [boolean] Analysis only. Whether to
check that the algorithms used to sign the token are the expected
ones or not. Even when FALSE, an algorithm that is not in the lists
below is rejected.
Default value: TRUE.
-
checkCryptingAlgorithms [boolean] Analysis with a decryption
key only. Whether to check that the algorithms used to encrypt the
token are the expected ones or not. Even when FALSE, an algorithm
that is not in the lists below is rejected.
Default value: TRUE.
-
canonicalizationAlgorithm [string] Creation and analysis. The
algorithm used to canonicalize the XML digital signature and to
canonicalize token data before computing its hash.
Possible values:
-
signatureAlgorithm [string] Creation and analysis. The
asymmetric algorithm used to sign the hash of token data. Key
transport algorithms (see cryptAlgorithm) are rejected.
Possible values:
-
digestAlgorithm [string] Creation and analysis. The algorithm
used to compute the hash of token data.
Possible values:
-
sessionKeyCipheringAlgorithm [string] Encryption only
(creation with an encryption certificate, analysis with a decryption
key). The symmetric algorithm used to encrypt token data with a
generated session key.
Possible values:
The CBC algorithms do not protect the integrity of the data: only
the signature does. An analysis only decrypts a token encrypted with
one of them if this option names it, even when
checkCryptingAlgorithms is FALSE.
-
cryptAlgorithm [string] Encryption only (creation with an
encryption certificate, analysis with a decryption key). The
asymmetric algorithm used to encrypt the session key with the
encryption certificate (key transport). Signature algorithms (see
signatureAlgorithm) are rejected, and so is RSA 1.5
(http://www.w3.org/2001/04/xmlenc#rsa-1_5), at creation as at
analysis.
Possible values:
Parameters
| $xmlOrData |
An XML token (string) or token data (associative
array).
|
| $signKeyPath |
The path to the PEM private key file that will
be used to sign the token.
|
| $signKeyPassword |
The password, if needed, to access the
private key that will be used to sign the token. Use NULL if no
password needed.
|
| $signCertPath |
The path to the PEM X.509 certificate file
that will be included in the XML digital signature, in order to
verify the signature.
|
| $cryptKeyPath |
The path to the PEM private key file
that will be used to decrypt the session key which was used to
encrypt the token. Required to analyze an encrypted token, optional
to create one.
|
| $cryptKeyPassword |
The password to access the private
key that will be used to decrypt the session key which was used to
encrypt the token. Use NULL if no password needed.
|
| $cryptCertPath |
The path to the PEM X.509 certificate file
that will be used to encrypt the session key which will be used to
encrypt the token.
|
| $options |
Configuration options.
|
Throws
|
#
|
public
static
|
createXMLToken(
array $data,
string $signKeyPath,
string $signCertPath,
string $signKeyPassword = null,
array $options = [],
): XMLDSigToken
Creates an XML token for the given user data.
Creates an XML token for the given user data.
The created XML token can be retrieved using the function getXML().
Parameters
| $data |
Token data (an associative array that may be
multi-dimensional).
|
| $signKeyPath |
The path to the PEM private key file that will
be used to sign the token.
|
| $signCertPath |
The path to the PEM X.509 certificate file
that will be included in the XML digital signature, in order to
verify the signature.
|
| $signKeyPassword |
The password to access the private key
that will be used to sign the token. Use NULL if no password needed.
|
| $options |
Configuration options
(see __construct() for details).
|
Returns
An XMLDSigToken object. If the token cannot be
created, getError() tells why.
Throws
|
#
|
public
static
|
createSecureXMLToken(
array $data,
string $signKeyPath,
string $signCertPath,
string|null $cryptKeyPath,
string $cryptCertPath,
string $signKeyPassword = null,
string|null $cryptKeyPassword = null,
array $options = [],
): XMLDSigToken
Creates a secure (encrypted) XML token for the given user data.
Creates a secure (encrypted) XML token for the given user data.
The created XML token can be retrieved using the function getXML().
The token is encrypted for the owner of the encryption certificate
($cryptCertPath): only the private key of this certificate decrypts
it. The sender does not need this private key: pass NULL as
$cryptKeyPath.
$token = XMLDSigToken::createSecureXMLToken($data, $signKeyPath, $signCertPath, null, $cryptCertPath, $signKeyPassword);
The created token is checked right away:
-
Without $cryptKeyPath, the check covers everything that can be
verified without decrypting the token: its structure, its
algorithms, its digest, its signature and the trust in the signing
certificate. isSignatureValid() and isDataEncrypted() return
TRUE, while getData(), getTimestamp() and getTokenId() return
NULL: they are inside the encrypted content, which is not decrypted.
-
With $cryptKeyPath, the token is also decrypted and its content
read, as by analyzeSecureXMLToken(): getData(), getTimestamp()
and getTokenId() return what the decrypted token holds.
Parameters
| $data |
Token data (an associative array that may be
multi-dimensional).
|
| $signKeyPath |
The path to the PEM private key file that will
be used to sign the token.
|
| $signCertPath |
The path to the PEM X.509 certificate file
that will be included in the XML digital signature, in order to
verify the signature.
|
| $cryptKeyPath |
The path to the PEM private key file of
the recipient, associated to $cryptCertPath, used to decrypt the
created token in order to check its content. Use NULL to create the
token without it.
|
| $cryptCertPath |
The path to the PEM X.509 certificate file
that will be used to encrypt the session key which will be used to
encrypt the token.
|
| $signKeyPassword |
The password to access the private key
that will be used to sign the token. Use NULL if no password needed.
|
| $cryptKeyPassword |
The password to access the private
key $cryptKeyPath. Use NULL if no password needed, and when
$cryptKeyPath is NULL.
|
| $options |
Configuration options
(see __construct() for details).
|
Returns
An XMLDSigToken object. If the token cannot be
created, getError() tells why.
Throws
|
#
|
public
static
|
analyzeXMLToken(string $xml, array $options = []): XMLDSigToken
Parse an XML token.
The options must hold a trust anchor, caCertPath and/or
signerCertPath; without it, isSignatureValid() returns FALSE.
$token = XMLDSigToken::analyzeXMLToken($xml, [
'caCertPath' => ['path/to/intermediate.cert.pem', 'path/to/root.cert.pem'],
]);
Parameters
| $xml |
An XML token.
|
| $options |
Configuration options, trust anchor included
(see __construct() for details).
|
Returns
An XMLDSigToken object. If the token is not
valid, isSignatureValid() returns FALSE and getError() tells
why.
Throws
|
#
|
public
static
|
analyzeSecureXMLToken(
string $xml,
string $cryptKeyPath,
string $cryptKeyPassword = null,
array $options = [],
): XMLDSigToken
Parse an XML token whose data are encrypted.
Parse an XML token whose data are encrypted.
NOTE: An unencrypted token can also be parsed using this function.
The options must hold a trust anchor, caCertPath and/or
signerCertPath; without it, isSignatureValid() returns FALSE.
Parameters
| $xml |
An XML token.
|
| $cryptKeyPath |
The path to the PEM private key file that
will be used to decrypt the session key which was used to encrypt
token data.
|
| $cryptKeyPassword |
The password to access the private key
that will be used to decrypt the session key which was used to
encrypt the token. Use NULL if no password needed.
|
| $options |
Configuration options, trust anchor included
(see __construct() for details).
|
Returns
An XMLDSigToken object. If the token is not
valid, isSignatureValid() returns FALSE and getError() tells
why.
Throws
|
#
|
public
|
isSignatureValid(): boolean
Indicates whether XML token signature is valid or not.
Indicates whether XML token signature is valid or not.
This means that:
-
No error occurred during the analysis of the XML digital signature.
-
No anomaly detected during the analysis of the XML digital signature.
-
The token hash has been verified and is valid.
-
The token hash signature has been verified and is valid.
-
The X.509 certificate included in the XML token is trusted: it is
valid at the current date, it is the pinned certificate and/or its
chain has been verified up to the trusted CA certificates, and its
subject is the expected one, if any (see isCertTrusted()).
-
The token is addressed to the audience given by the option
expectedAudience, if it names audiences or if this option is given
(see getAudience()).
Without a trust anchor given to the analysis, it returns FALSE.
It checks neither the freshness of the token nor whether it is
replayed. A token that was valid once stays valid here, however old
it is and however many times it is submitted. Before trusting the data
of a received token, the caller must check that:
-
isSignatureValid() returns TRUE;
-
isOutOfDate($ttl) returns FALSE, for the time to live the
application accepts (it also checks the expiry of the token, if
any);
-
the identifier returned by getTokenId() has not been accepted
before: store it atomically, and refuse the token if it already is.
The trust anchor caCertPath accepts any certificate its CA issues: if
this CA also issues certificates to others than the expected sender,
any of them can sign a token that passes this check. Restrict it then
to the sender with the option expectedSubject, or pin its certificate
with signerCertPath.
For a token created encrypted without the private key of the
recipient, it tells whether the checks made without decrypting the
token passed (see createSecureXMLToken()).
Returns
TRUE if XML token is valid, FALSE otherwise.
|
#
|
public
|
isCertTrusted(): boolean|null
Indicates whether the X.509 certificate included in the XML token is
trusted or not, according to the trust anchor given to the analysis
(options caCertPath, signerCertPath and expectedSubject).
Indicates whether the X.509 certificate included in the XML token is
trusted or not, according to the trust anchor given to the analysis
(options caCertPath, signerCertPath and expectedSubject).
NOTE: If not evaluated (because an error occurred before), this function
returns NULL. When it returns FALSE, getError() gives the reason.
Returns
TRUE if the certificate is trusted, FALSE
otherwise, NULL if cannot be evaluated.
|
#
|
public
|
isOutOfDate(int $ttl = self::TOKEN_DEFAULT_TTL): boolean
Indicates whether the XML token is out of date or not.
Indicates whether the XML token is out of date or not.
The token is out of date if its timestamp is more than $ttl seconds
in the past, or more than DESYNC_TOLERANCE seconds in the future
(clocks of sender and receiver out of sync), or if it has no valid
timestamp. A token created with the option validity is also out of
date once its expiry is passed (see getExpiry()): the shorter of the
validity set by the issuer and the $ttl set by the receiver applies.
The expiry is only checked here, with the timestamp: like the time to
live, it is a check left to the caller, and isSignatureValid() does
not make it. DESYNC_TOLERANCE does not apply to the expiry: a
receiver whose clock is ahead rejects the token a little earlier.
Version 1.0 of this class ignores the expiry: a receiver that has not
upgraded only applies its own $ttl.
NOTE: A token that is not out of date can still be a replayed one: see
getTokenId().
Parameters
| $ttl |
The time to live (in seconds) allowed for the token.
|
Returns
TRUE if token is out of date, FALSE otherwise.
|
#
|
public
|
isDataEncrypted(): boolean|null
Indicates whether token data is encrypted or not.
Indicates whether token data is encrypted or not.
For a token created encrypted, it returns TRUE, whether or not the
private key of the recipient was given (see createSecureXMLToken()).
NOTE: If not evaluated (because an error occurred before), this function
returns NULL.
Returns
TRUE if token data is encrypted, FALSE otherwise,
NULL if cannot be evaluated.
|
#
|
public
|
isDigestValueOk(): boolean|null
Indicates whether the digest of token data (a hash) has been verified and
is valid or not.
Indicates whether the digest of token data (a hash) has been verified and
is valid or not.
NOTE: If not evaluated (because an error occurred before), this function
returns NULL.
Returns
TRUE if token hash has been verified and is valid,
FALSE otherwise, NULL if cannot be evaluated.
|
#
|
public
|
isSignatureValueOk(): boolean|null
Indicates whether signature of the digest of the token data has been
verified and is valid or not.
Indicates whether signature of the digest of the token data has been
verified and is valid or not.
NOTE: If not evaluated (because an error occurred before), this function
returns NULL.
Returns
TRUE if token hash signature has been verified and
is valid, FALSE otherwise, NULL if cannot be evaluated.
|
#
|
public
|
getXML(): string|null
Returns
The XML token, NULL if not available.
|
#
|
public
|
getData(): array|null
Get the user data contained in the XML token.
Get the user data contained in the XML token.
The data can only be trusted if isSignatureValid() returns TRUE (and
the token is neither out of date nor replayed). They are only read
once the digest, the signature and the signing certificate have been
verified.
A token created encrypted without the private key of the recipient is
not decrypted: its data are not available (see
createSecureXMLToken()).
Returns
The associative array containing token data, NULL if
not available.
|
#
|
public
|
getTimestamp(): string|null
Get the timestamp of the XML token.
Get the timestamp of the XML token.
The timestamp of a token that is not valid is not given: nothing read
from such a token can be trusted. isOutOfDate() still reads it, and
rejects such a token anyway when its timestamp could not be read.
Returns
The token timestamp, NULL if the token is not
valid (see isSignatureValid()), or if it was created encrypted
without the private key of the recipient, which leaves its content
unread (see createSecureXMLToken()).
|
#
|
public
|
getTokenId(): string|null
Get the identifier of the XML token.
Get the identifier of the XML token.
Each token created by this class holds a random identifier of 128 bits
(32 hexadecimal characters), generated with random_bytes() and
covered by the signature. A valid token can be submitted again for as
long as isOutOfDate() accepts it: the class keeps no list of the
tokens it has analyzed, so the caller must refuse a token whose
identifier it has already accepted. A token is accepted from
DESYNC_TOLERANCE seconds before its timestamp to $ttl seconds after
it (see isOutOfDate()): keep each accepted identifier for at least
$ttl + XMLDSigToken::DESYNC_TOLERANCE seconds after accepting it.
A token without identifier (as created by the 0.x versions) is not
valid.
Returns
The token identifier, NULL if the token is not
valid (see isSignatureValid()), or if it was created encrypted
without the private key of the recipient, which leaves its content
unread (see createSecureXMLToken()).
|
#
|
public
|
getAudience(): array|null
Get the audiences the XML token is addressed to.
Get the audiences the XML token is addressed to.
A token created with the option audience names the receivers it is
addressed to, and isSignatureValid() only accepts it if the analysis
gives one of them with the option expectedAudience (see
__construct()).
Returns
The list of the audiences of the token, NULL if the
token is not valid (see isSignatureValid()), if it names no
audience, or if it was created encrypted without the private key of
the recipient, which leaves its content unread (see
createSecureXMLToken()).
|
#
|
public
|
getExpiry(): string|null
Get the expiry of the XML token.
Get the expiry of the XML token.
A token created with the option validity holds the date after which
it is out of date (see isOutOfDate()), in the format of the timestamp
(TOKEN_TIMESTAMP_FORMAT, UTC).
Returns
The token expiry, NULL if the token is not valid
(see isSignatureValid()), if it has no expiry, or if it was
created encrypted without the private key of the recipient, which
leaves its content unread (see createSecureXMLToken()).
|
#
|
public
|
getError(): string|null
Get the message of the error that occurred while parsing the XML token.
Get the message of the error that occurred while parsing the XML token.
Returns
The error message. If no error, NULL is returned.
|
#
|
public
|
getAnomalies(): array
Get the list of anomalies that occurred while parsing the XML token.
Get the list of anomalies that occurred while parsing the XML token.
Returns
The list of anomalies, empty if none.
|
#
|
public
|
getCertificate(): string|null
Get the X.509 certificate that is included in the XML token (PEM format).
Get the X.509 certificate that is included in the XML token (PEM format).
Returns
The content of the X.509 certificate, NULL if not
available.
|
#
|
public
|
getCertIssuer(): array|null
Get the issuer information of the X.509 certificate that is included in
the XML token.
Get the issuer information of the X.509 certificate that is included in
the XML token.
Returns
The issuer information of the X.509 certificate, NULL
if not available.
|
#
|
public
|
getCertSubject(): array|null
Get the subject information of the X.509 certificate that is included in
the XML token.
Get the subject information of the X.509 certificate that is included in
the XML token.
Returns
The subject information of the X.509 certificate, NULL
if not available.
|
#
|
public
|
getCertDN(): string|null
Get the Distinguished Name of the X.509 certificate that is included in
the XML token.
Get the Distinguished Name of the X.509 certificate that is included in
the XML token.
Returns
The Distinguished Name of the X.509 certificate, NULL
if not available.
|
#
|
public
|
getCertValidFrom(string $dateFormat = self::TOKEN_TIMESTAMP_FORMAT): string|null|false
Get the UTC date from which the X.509 certificate that is included in the
XML token is valid.
Get the UTC date from which the X.509 certificate that is included in the
XML token is valid.
Parameters
| $dateFormat |
The format of the returned date (Default:
XMLDSigToken::TOKEN_TIMESTAMP_FORMAT).
|
Returns
The date from which the X.509 certificate is
valid, NULL if not available, FALSE if $dateFormat is invalid.
|
#
|
public
|
getCertValidTo(string $dateFormat = self::TOKEN_TIMESTAMP_FORMAT): string|null|false
Get the UTC date to which the X.509 certificate that is included in the
XML token is valid.
Get the UTC date to which the X.509 certificate that is included in the
XML token is valid.
Parameters
| $dateFormat |
The format of the returned date (Default:
XMLDSigToken::TOKEN_TIMESTAMP_FORMAT).
|
Returns
The date to which the X.509 certificate is
valid, NULL if
not available, FALSE if $dateFormat is invalid.
|
#
|
public
|
isCertOutOfDate(): boolean
Indicates whether the X.509 certificate included in the XML token is out
of date or not.
Indicates whether the X.509 certificate included in the XML token is out
of date or not.
Returns
TRUE if X.509 certificate is out of date, FALSE
otherwise.
|
#
|
public
|
isValidCertIssuer(array $expectedIssuerInfo): boolean
Check that the issuer information of the X.509 certificate that is
included in the XML token matches the expected one.
Check that the issuer information of the X.509 certificate that is
included in the XML token matches the expected one.
The expected issuer information must be passed as an array to the
function:
$ExpectedIssuerInfo = [
'C' => 'DK',
'ST' => 'Jylland',
'O' => 'Lothbrok Ltd',
'OU' => 'Jarl Dept',
'CN' => 'www.Lothbrok.dk',
'emailAddress' => 'ragnar@Lothbrok.dk'
];
NOTE: Character case of data is significant.
NOTE: This only compares names, which any certificate can copy: it
tells nothing about who issued the certificate. isSignatureValid()
verifies the certificate against the trust anchor of the analysis.
Parameters
| $expectedIssuerInfo |
The issuer information that the X.509
certificate should match.
|
Returns
TRUE if the issuer of the X.509 certificate holds the
expected information, FALSE otherwise.
Throws
|
#
|
public
|
isValidCertCA(string $caCertPath): boolean
Check that the X.509 certificate included in the XML token comes from the
expected CA.
Check that the X.509 certificate included in the XML token comes from the
expected CA.
Note that more than one CA certificate can give a positive result, some
CAs re-issue signing certificates after having only changed the
expiration dates.
Note that it also works with self-signed certificates. In this case,
pass the X.509 certificate that is supposed to be included in the XML
token to the function.
Only the link between the certificate and the given CA certificate is
checked (see X509Cert::isValidCA()). isSignatureValid() verifies the
whole chain against the trust anchor of the analysis.
Parameters
| $caCertPath |
The PEM certificate (public key) that is
supposed to be used by the CA to sign the X.509 certificate included in
the XML token.
|
Returns
TRUE if the X.509 certificate has been signed by the
expected CA, FALSE otherwise (and when no certificate has been read
from the token).
Throws
|
#
|
public
static
|
alterXML(string &$xml, string $nodePath, string $nodeAttribute, string $newValue, boolean $delete = false): string|false
Utility function for modifying a node of an XML content.
Utility function for modifying a node of an XML content.
The XML content is loaded as an XML token is: a document with a
document type declaration (DOCTYPE), or not encoded in UTF-8, is
refused before it is parsed, and the parser never accesses the network
(see _loadXML()). A refused or invalid document is left unchanged and
the function returns FALSE.
Parameters
| $xml |
XML content, passed by reference.
|
| $nodePath |
The xpath query to select the node to modify.
This should be a full path that identifies a single node.
|
| $nodeAttribute |
In case you want to modify an attribute of
the specified node, provide its name here, otherwise set this
parameter to NULL.
|
| $newValue |
The value that will replace the original value of
the node or of the attribute of the node if $nodeAttribute parameter
is provided.
|
| $delete |
If TRUE delete the specified node or attribute.
|
Returns
The value of the node or attribute before
modification or deletion, FALSE otherwise.
|
#
|
public
|
getPrettyXML(): string
Return the XML token in a pretty readable format.
Return the XML token in a pretty readable format.
This function is intended for display purposes only. Use the getXML()
function to obtain the raw XML token you want to work with.
Returns
The pretty formatted XMLDSigToken signature.
|
#
|
public
|
getHTMLDump(): string
Utility function that returns information on the XML token in HTML
format.
Utility function that returns information on the XML token in HTML
format.
The output shows what the token carries, valid or not: data,
certificate fields and error messages come from whoever sent the token.
Every value is therefore escaped with htmlspecialchars()
(ENT_QUOTES | ENT_SUBSTITUTE, UTF-8), the outputs of var_dump()
included, so that it can be displayed as is in an HTML page. The output
loads no external resource (script, style sheet, image).
Returns
|
#
|