2.0.0: metadata generator on admin/Federation page does not honour the 'host' parameter #1774
Description
Describe the bug
The file metadata/saml20-idp-hosted.php can contain more than one entry, and those entries can refer to distinct DNS host names.
Such metadata functions as expected, with SSO and SLO endpoints on the correct hostnames.
However, when generating the metadata on the Federation page, the SSO and SLO endpoints are not generated for the configured hostnames. Instead, the endpoints always have the current vhost (i.e. the one from which the Federation page is opened) as the hostname.
To Reproduce
Steps to reproduce the behavior:
- Configure saml20-idp-hosted metadata like:
$metadata['https://passwordless.restena.lu/'.'simplesaml_dev/'.'saml2/idp/passwordless.php'] = [
'host' => 'passwordless.restena.lu',
-
Go to the Federation page of the simpleSAMLphp installation with any of the hostnames and check the generated IdP metadata.
-
A snippet of doing so from the Federation page on clueless.restena.lu yields:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://passwordless.restena.lu/simplesaml_dev/saml2/idp/passwordless.php">
[...]
<md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://clueless.restena.lu/simplesaml_dev/module.php/saml/idp/singleLogout"/>
<md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</md:NameIDFormat>
<md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://clueless.restena.lu/simplesaml_dev/module.php/saml/idp/singleSignOnService"/>
</md:IDPSSODescriptor>
Note that the SSO and SLO URLs contain clueless.restena.lu as the hostname, despite the 'host' configuration item.
Expected behavior
SSO and SLO endpoints should start with the configured 'host', not the current serving vhost of the simpleSAMLphp page. In the example above:
Location="https://passwordless.restena.lu/simplesaml_dev/module.php/saml/idp/singleLogout"/>
Location="https://passwordless.restena.lu/simplesaml_dev/module.php/saml/idp/singleSignOnService"/>
Screenshots or logs
N/A
Additional context
simpleSAMLphp 2.0.0