diff --git a/docker/sspwww/sp.php b/docker/sspwww/sp.php
index b6a4ccf..704a3cf 100644
--- a/docker/sspwww/sp.php
+++ b/docker/sspwww/sp.php
@@ -227,6 +227,9 @@
}
}
+ // SAML Extensions
+ $extensionChunks = array();
+
// SAML Extensions (email and SHO)
if ( ( isset($_REQUEST['email_extension']) && strlen($_REQUEST['email_extension']) > 0 ) ||
( isset($_REQUEST['sho_extension']) && strlen($_REQUEST['sho_extension']) > 0 ) )
@@ -274,12 +277,32 @@
// Create a Chunk from the gssp:UserAttributes DOMElement
$userAttributesChunk = new \SAML2\XML\Chunk($userAttributes);
- // Add the gssp:UserAttributes to the SAML request
- // The SAML2 library uses the 'saml:Extensions' element to hold the extensions which is an array of
- // SAML2\XML\Chunk objects, one for each extension to add.
- // The SSP will then add the extensions to the SAML request by calling setExtensions(array $extensions) : void
- // on the SAML2\AuthnRequest object with the array of Chunk objects.
- $context['saml:Extensions'] = array($userAttributesChunk);
+ // Collect the gssp:UserAttributes chunk
+ $extensionChunks[] = $userAttributesChunk;
+ }
+
+ // mdui:UIInfo extension with a mdui:DisplayName (service name), as sent by e.g. OpenConext
+ // EngineBlock when initiating a Stepup callout. The Stepup-Gateway can read the DisplayName
+ // and forward it to the GSSP so the GSSP can show which service the user is authenticating for.
+ if ( isset($_REQUEST['mdui_displayname']) && strlen($_REQUEST['mdui_displayname']) > 0 )
+ {
+ $mduiDom = new DOMDocument('1.0', 'UTF-8');
+ $uiInfo = $mduiDom->createElementNS('urn:oasis:names:tc:SAML:metadata:ui', 'mdui:UIInfo');
+ $displayName = $mduiDom->createElementNS('urn:oasis:names:tc:SAML:metadata:ui', 'mdui:DisplayName');
+ $displayName->setAttributeNS('http://www.w3.org/XML/1998/namespace', 'xml:lang', 'en');
+ $displayName->textContent = $_REQUEST['mdui_displayname'];
+ $uiInfo->appendChild($displayName);
+ $mduiDom->appendChild($uiInfo);
+ $extensionChunks[] = new \SAML2\XML\Chunk($uiInfo);
+ }
+
+ // Add the collected extensions to the SAML request
+ // The SAML2 library uses the 'saml:Extensions' element to hold the extensions which is an array of
+ // SAML2\XML\Chunk objects, one for each extension to add.
+ // The SSP will then add the extensions to the SAML request by calling setExtensions(array $extensions) : void
+ // on the SAML2\AuthnRequest object with the array of Chunk objects.
+ if ( count($extensionChunks) > 0 ) {
+ $context['saml:Extensions'] = $extensionChunks;
}
// login
@@ -320,6 +343,7 @@
$requesterid2=htmlentities(isset($_REQUEST['requesterid2']) ? $_REQUEST['requesterid2'] : "");
$email_extension=htmlentities(isset($_REQUEST['email_extension']) ? $_REQUEST['email_extension'] : "");
$sho_extension=htmlentities(isset($_REQUEST['sho_extension']) ? $_REQUEST['sho_extension'] : "");
+$mdui_displayname=htmlentities(isset($_REQUEST['mdui_displayname']) ? $_REQUEST['mdui_displayname'] : "");
$scopingIDP=htmlentities(isset($_REQUEST['scopingIDP']) ? $_REQUEST['scopingIDP'] : "");
$scopingIDP2=htmlentities(isset($_REQUEST['scopingIDP2']) ? $_REQUEST['scopingIDP2'] : "");
$sp=htmlentities(isset($_REQUEST['sp']) ? $_REQUEST['sp'] : "default-sp");
@@ -622,6 +646,8 @@