Skip to content

Commit 85e2c1d

Browse files
timleggetimlegge
committed
Update Changes for 0.60
1 parent f29670e commit 85e2c1d

File tree

1 file changed

+111
-0
lines changed

1 file changed

+111
-0
lines changed

‎Changes‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,119 @@ Revision history for Perl extension Net::SAML2.
22

33
{{$NEXT}}
44

5+
[ Significant Changes since 0.59 ]
6+
7+
There are multiple potentially BREAKING CHANGES depending on how you
8+
have written your application. Your application may need updates for
9+
this version.
10+
11+
[BREAKING CHANGES]
12+
13+
- Support multiple signing keys in the metadata. This version attempts
14+
to ensure compatibility but the call to Net::SAML2::IdP->cert will return
15+
an array of certs for each 'use'. It is, however, likely that there will
16+
only be one cert in the array.
17+
18+
- Net::SAML2::Binding::SOAP was improved. The call to
19+
Net::SAML2::Binding::SOAP->handle_request() now returns the XML whereas in
20+
the past it returned the certificate's subject and the xml as an array.
21+
This make it consistent with the Redirect and POST Bindings.
22+
23+
- Net::SAML2::Binding::POST was also improved. Previously the call to
24+
Net::SAML2::Binding::POST->handle_response() returned inconsistent results
25+
depending on whether a cacert was provided. This version returns the XML
26+
of the decoded request.
27+
28+
- The testapp required only changes related to the call to
29+
Net::SAML2::IdP->cert($use) that now returns an ARRAY.
30+
31+
[Changes of note:]
32+
33+
- Support multiple signing keys in the metadata. This version attempts to
34+
ensure compatability but the call to Net::SAML2::IdP->cert will return an
35+
array of certs for each $use. It is, however, likely that there will only
36+
be one cert in the array.
37+
38+
- Redirects now validate the raw URI that is passed to the call. It is
39+
assumed that the URI that your application has sent is unmodified from the
40+
response that the web server received. lighttpd in particular normalizes
41+
the response and will break Redirects from Microsoft Azure
42+
(see lighttpd.conf in xt/testapp for a working configuration)
43+
44+
- Net::SAML2::Binding::SOAP and Net::SAML2::Binding::POST were improved.
45+
46+
- SAML trust anchors were implemented and the verification of the SAML
47+
response was improved. It is possible to validate the response with
48+
subject, issuer or issuer_hash as anchors in addition to the cacert.
49+
Neither cacert nor anchors are required as long as the signature of
50+
the response is valid. The cacert has not been required for the
51+
Redirect or SOAP binding so this treats SOAP the same.
52+
53+
[Required Application Updates]
54+
55+
- There were several changed to the test suite that will likely need to be
56+
made in your application:
57+
58+
- To support metadata.xml containing multiple KeyDescriptors the call to
59+
Net::SAML2::IdP->cert($use) now returns an ARRAY. As this is an helper
60+
function that is meant to allow you to pass the cert to another Net::SAML2
61+
call it was deemed low risk. Your code may be unaffected.
62+
63+
- The call to Net::SAML2::Binding::SOAP->handle_request() needs to be updated
64+
to reflect that it returns only the decoded XML not an array of the
65+
Certificate Subject and XML. Depending how your application uses the
66+
response will determine whether changes are required.
67+
68+
- The call to Net::SAML2::Binding::POST->handle_response() returned
69+
inconsistent results depending on whether a cacert was provided. This
70+
version returns the XML of the decoded request. Previously it returned
71+
either 1 for success or if a cacert was used, either "(verified) and the
72+
certificate Subject" or 0 if the certificate verification failed.
73+
74+
- The lighttpd.conf for the testapp did require a change to prevent it from
75+
"normalizing" a SAML Logout Redirect. There are contradictory RFCs
76+
concerning SAML and the "normalising" URIs. If you use lighttpd in a SAML
77+
application with AZURE as your SAML IdP see
78+
[lighttpd.conf](https://github.com/perl-net-saml2/perl-Net-SAML2/commit/3855393eb454097e1e326a516a573f37ce3456a3#diff-8fd15aaa870fd2b9cda596bf3bb870ce2723ae412e55f0b653124b45d87e1bea)
79+
80+
[Possible Impacts]
81+
82+
- It is worth noting that the testapp (that implements a rudimentary Service
83+
Provider) included in the git repo did not require any changes to the
84+
application for this version.
85+
86+
- While my setup tests against multiple IdPs I do not have a working SOAP
87+
IdP at present.
88+
89+
[ Full Change Log ]
90+
91+
- e95e7c2 Fix bug where two keys with different usage fails
92+
- 33092f1 Add isDefault when isDefault is missing in assertion_consumer_service
93+
- 66a4146 Bump version to .60
94+
- 812ea36 0.59 updates
95+
- f589dd0 v0.59
96+
- c1b25f9 Sync changes with the wiki page and clean up indents
97+
- 2c432f2 Remove unnecessary parameters
98+
- 3855393 Allow URIs that do not include scheme and host in redirect
99+
- e1774b6 Update docs for Net::SAML2::Protocol::LogoutRequest
100+
- fdcfbeb Fix docs for Net::SAML2::Binding::Redirect
101+
- 8d24c89 Update docs for Net::SAML2::Protocol::ArtifactResolve
102+
- 27f6508 Update docs for Net::SAML::SP
103+
- 4a89679 Fix docs for Net::SAML2::Binding::SOAP
104+
- f43727d Verify the SAMLResponse based on the raw query string
105+
- 50f5c8a Fixes #12 - multiple signing keys in metadata
106+
- 4902c89 Make SAML trust anchors work on verification of the SAML request
107+
- af68b68 SOAP binding does not require a cacert anymore
108+
- 1854e35 Implement verify_xml() call which only verifies the XML
109+
5110
0.59 -- Wed Aug 24 22:23:53 ADT 2022
6111

112+
There were no changes other than incrementing the version number
113+
from 0.58-TRIAL.
114+
115+
- 564fa93 (tag: 0.59) Update Changes for .58 release
116+
- 2a43f4e v0.58
117+
7118
0.58 -- Fri Aug 12 16:25:59 ADT 2022
8119

9120
[ Significant Changes since 0.57 ]

0 commit comments

Comments
 (0)