niif / simplesamlphp-module-aa Goto Github PK

If an SP has more than one certificates, its authentication fails for some reason, even though the AA is supposed to authenticate against all possible certificates.

This makes the AA unable to work with SPs under a certificate rollover, for example.

According to Assertion Query/Request Profile (SAML 2.0 Profiles Section 6.3.2), the Attribute Authority MUST provide a Response, even if the requester can not be authenticated, metadata or other errors.

If the AA is deployed behind a load balancer, SSL client authentication might not be handled by the webserver running the AA but on an external host. In order to inject client certificate data (which is required to authorize the SP), an alternative header, such as X-SSL-CLIENT-CERT could be used.

This should be a configuration item, defaulting the current SSL_CLIENT_CERT value.