Prvním krokem je získání informací z metadat IdP
V dokumentaci je uveden odkaz na metadata NIA IdP FederationMetadata.xml
Více informací o NIA IdP metadatech je uvedeno na stránce IdP - Úvod
<?php
// použijeme knihovnu simplesamlphp/saml2 z https://github.com/simplesamlphp/saml2
use SAML2\XML\md\EntityDescriptor;
use SAML2\DOMDocumentFactory;
$metadata_url = "https://tnia.identitaobcana.cz/FPSTS/FederationMetadata/2007-06/FederationMetadata.xml";
$metadata_string = file_get_contents($metadata_url);
$metadata_dom = DOMDocumentFactory::fromString($metadata_string);
$metadata = new EntityDescriptor($metadata_dom->documentElement);
// také lze využít metodu DOMDocumentFactory::fromFile($filepath); pokud máte metadata stažena lokálně
Objekt následovně obsahuje tato data:EntityDescriptor {#96 #signatureKey: null #certificates: array:1 [ 0 => "MIIIzTCCBrWgAwIBAgIEALuqHzANBgkqhkiG9w0BAQsFADCBgTEqMCgGA1UEAwwhSS5DQSBFVSBRdWFsaWZpZWQgQ0EyL1JTQSAwNi8yMDIyMS0wKwYDVQQKDCRQcnZuw60gY2VydGlmaWthxI1uw60gYXV0b3JpdGEsIGEucy4xFzAVBgNVBGEMDk5UUkNaLTI2NDM5Mzk1MQswCQYDVQQGEwJDWjAeFw0yNDA0MTcxMjA3NDJaFw0yNTA0MTcxMjA3NDJaMIGKMSwwKgYDVQQKDCNEaWdpdMOhbG7DrSBhIGluZm9ybWHEjW7DrSBhZ2VudHVyYTEXMBUGA1UEYQwOTlRSQ1otMTc2NTE5MjExGzAZBgNVBAMMEkdHX0ZQU1RTX1RFU1RfU0lHTjELMAkGA1UEBhMCQ1oxFzAVBgNVBAUTDklDQSAtIDEwNzE5MjY5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0APEiCZX7swEf1M5t7qrqJZSZ/UzarPLoH9wfv2ojoJjeG6sSrQMTyQFfVlCjOeiU2XiRid03tvTdIQzs9jQXvKGrQa18l723ccqt0RFBSyo6mghiKXftKx2VwZkz1nIv1CS7W+1ET2g9C0VYTaJbMRUEgShPYI1hbSzpsV6sSu/i4w9GTCbfAHQY7dGyeyaNvABI8B6yMUCV/M7sO7NTj2gMfoyqD3h4i27DOyGv+fIpg9Ip7ga0ljFdoRO+NriNcpakyXQ0nnes14B9A79kkYfNlRkVpYPOB+1xHr41Zlr0fiICXrG6F7k1rSKDL8rnuyrlzBAh+Sfn3uTB+Hvxukv20DY+L3URkjRF0MwjVqApn2CYz+5+p8nd+667Mh0hmT9gEGY/J1VGfn8QnRaq4PABmMWu56j/yVWWFnt4ola7yTqAQ06SajPS49A7yfimwaFt+/e2l3JDm9X2s5sqsxRiHddvjH6l6rVuBRT1nKdEV7+Dbj92hCelQw+8IaaDPpaXZcHKgkRPQggPwKVYscdg7i9zpYTjW7TIe3P2t75mkFsvy+pwQiU8CZjepZnp5zWtjBzYMPuyKUEmOAOW6Ol3nsBkb+zwL0AVXNqJmzQKQIZAGVaorENb0TIWYAISUSXJU88aRTtmK4+4gGngeOPK7nMRcaHd48G0Nir20ECAwEAAaOCA0AwggM8MCMGA1UdEQQcMBqgGAYKKwYBBAGBuEgEBqAKDAgxMDcxOTI2OTAOBgNVHQ8BAf8EBAMCBeAwCQYDVR0TBAIwADCCASMGA1UdIASCARowggEWMIIBBwYNKwYBBAGBuEgKAR8BADCB9TAdBggrBgEFBQcCARYRaHR0cDovL3d3dy5pY2EuY3owgdMGCCsGAQUFBwICMIHGDIHDVGVudG8ga3ZhbGlmaWtvdmFueSBjZXJ0aWZpa2F0IHBybyBlbGVrdHJvbmlja291IHBlY2V0IGJ5bCB2eWRhbiB2IHNvdWxhZHUgcyBuYXJpemVuaW0gRVUgYy4gOTEwLzIwMTQuVGhpcyBpcyBhIHF1YWxpZmllZCBjZXJ0aWZpY2F0ZSBmb3IgZWxlY3Ryb25pYyBzZWFsIGFjY29yZGluZyB0byBSZWd1bGF0aW9uIChFVSkgTm8gOTEwLzIwMTQuMAkGBwQAi+xAAQEwgY8GA1UdHwSBhzCBhDAqoCigJoYkaHR0cDovL3FjcmxkcDEuaWNhLmN6LzJxY2EyMl9yc2EuY3JsMCqgKKAmhiRodHRwOi8vcWNybGRwMi5pY2EuY3ovMnFjYTIyX3JzYS5jcmwwKqAooCaGJGh0dHA6Ly9xY3JsZHAzLmljYS5jei8ycWNhMjJfcnNhLmNybDCBhAYIKwYBBQUHAQMEeDB2MAgGBgQAjkYBATBVBgYEAI5GAQUwSzAsFiZodHRwOi8vd3d3LmljYS5jei9acHJhdnktcHJvLXV6aXZhdGVsZRMCY3MwGxYVaHR0cDovL3d3dy5pY2EuY3ovUERTEwJlbjATBgYEAI5GAQYwCQYHBACORgEGAjBlBggrBgEFBQcBAQRZMFcwKgYIKwYBBQUHMAKGHmh0dHA6Ly9xLmljYS5jei8ycWNhMjJfcnNhLmNlcjApBggrBgEFBQcwAYYdaHR0cDovL29jc3AuaWNhLmN6LzJxY2EyMl9yc2EwHwYDVR0jBBgwFoAUiv9gsrZIUCWPLs1DUzsIhMXK6GQwHQYDVR0OBBYEFFoxmkE0YPc9s4G31yXc6WcNgbfjMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4ICAQBhtDiu0n2ceSO8NeufLmMudMHR2/dSf1wRCioag88PJHceFVzIt0TZpl8NVvU2ihqAiBguIbZvYEICEBxb+AzJp/KNivuiKriQoY7iXlhi5xm+wWy7HhzZC2J6MprL5VyqsHMbbOj+FLy/ESl1JZqldlMMPVpUhJGKogRSqKAbxXpgCXV4u9zzOqDcpWMxburEKhT6AzlayLki6waZNw3ruMsOvCcqpb+mA//Ugt6ac9sMF87by4fDookRp+lWo/2ddyF2vT6kGPMz5gT+Jp0qMiwJLvY2b5u3viDoB4Wcwsh2bEJP+22aIVilNnGqKRxtgAhDYBXaQm1SN4NHS8Xww7FH2tQ/V4cxRkPTAqp9AdOXa5QS2l06+gE8SftARi0NWBSfncVdjxpSJOOGYkap0/iN6B7ppFEF77HCFz8T+2IiswLEUOtA3DHGzQrqbjP014BWgsq1Y1q9Bc+uVpPpivwsd3QollecQIEkegnzonh0K+2eq6QPpO30VxEMjBdrl0Kp3celEOkZsIYHdk2efa0xsa04tj4iEMNuKvfJQv4Us5XU66AUkZ0K//EPmYq7EJvKiJpih3572jVrggqRPDodJMeDgwVSAFf+ALKUBvJwLlIJXlnb7F9VhrYkqme8CdOYDiOvKZ7cHJXE6F0r1hL7kS4cYMetAkc9W5SAnw==" ] -validators: array:1 [ 0 => array:2 [ "Function" => array:2 [ 0 => "SAML2\Utils" 1 => "validateSignature" ] "Data" => array:2 [ "Signature" => XMLSecurityDSig {#94 +sigNode: DOMElement {#99 +schemaTypeInfo: null +nodeName: "Signature" +nodeValue: "" +nodeType: XML_ELEMENT_NODE +parentNode: null +childNodes: DOMNodeList {#176 +length: 3 } +firstChild: DOMElement {#178 …} +lastChild: DOMElement {#180 …} +previousSibling: null +nextSibling: null +attributes: DOMNamedNodeMap {#183 +length: 0 } +ownerDocument: DOMDocument {#185 …} +namespaceURI: "http://www.w3.org/2000/09/xmldsig#" +prefix: "" +localName: "Signature" +baseURI: "/nix/store/97c54fs7ccx8jvfm3qpm34c27r7pi6w7-nia.otevrenamesta.cz/webroot/" +textContent: "" +tagName: "Signature" } +idKeys: array:1 [ 0 => "ID" ] +idNS: [] -signedInfo: "<SignedInfo xmlns="http://www.w3.org/2000/09/xmldsig#"><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"></SignatureMethod><Reference URI="#_530e4277-09cc-412c-84e9-12a9cc98ff50"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"></Transform><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></Transform></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"></DigestMethod><DigestValue>a9OexB5/5sfpIAwDjRSWO1J79TkRuuO8NrYTXaBkHnI=</DigestValue></Reference></SignedInfo>" -xPathCtx: DOMXPath {#98 +document: DOMDocument {#185 …} } -canonicalMethod: null -prefix: "ds:" -searchpfx: "secdsig" -validatedNodes: array:1 [ "_530e4277-09cc-412c-84e9-12a9cc98ff50" => DOMElement {#95 +schemaTypeInfo: null +nodeName: "EntityDescriptor" +nodeValue: "" +nodeType: XML_ELEMENT_NODE +parentNode: DOMNamedNodeMap {#183} +childNodes: DOMNodeList {#182 +length: 3 } +firstChild: DOMText {#179 …} +lastChild: DOMElement {#180 …} +previousSibling: DOMElement {#178 …} +nextSibling: DOMNodeList {#176} +attributes: DOMNamedNodeMap {#175 +length: 2 } +ownerDocument: DOMNamedNodeMap {#183} +namespaceURI: "urn:oasis:names:tc:SAML:2.0:metadata" +prefix: "" +localName: "EntityDescriptor" +baseURI: "/nix/store/97c54fs7ccx8jvfm3qpm34c27r7pi6w7-nia.otevrenamesta.cz/webroot/" +textContent: "" +tagName: "EntityDescriptor" } ] } "Certificates" => array:1 [ 0 => "MIIIzTCCBrWgAwIBAgIEALuqHzANBgkqhkiG9w0BAQsFADCBgTEqMCgGA1UEAwwhSS5DQSBFVSBRdWFsaWZpZWQgQ0EyL1JTQSAwNi8yMDIyMS0wKwYDVQQKDCRQcnZuw60gY2VydGlmaWthxI1uw60gYXV0b3JpdGEsIGEucy4xFzAVBgNVBGEMDk5UUkNaLTI2NDM5Mzk1MQswCQYDVQQGEwJDWjAeFw0yNDA0MTcxMjA3NDJaFw0yNTA0MTcxMjA3NDJaMIGKMSwwKgYDVQQKDCNEaWdpdMOhbG7DrSBhIGluZm9ybWHEjW7DrSBhZ2VudHVyYTEXMBUGA1UEYQwOTlRSQ1otMTc2NTE5MjExGzAZBgNVBAMMEkdHX0ZQU1RTX1RFU1RfU0lHTjELMAkGA1UEBhMCQ1oxFzAVBgNVBAUTDklDQSAtIDEwNzE5MjY5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0APEiCZX7swEf1M5t7qrqJZSZ/UzarPLoH9wfv2ojoJjeG6sSrQMTyQFfVlCjOeiU2XiRid03tvTdIQzs9jQXvKGrQa18l723ccqt0RFBSyo6mghiKXftKx2VwZkz1nIv1CS7W+1ET2g9C0VYTaJbMRUEgShPYI1hbSzpsV6sSu/i4w9GTCbfAHQY7dGyeyaNvABI8B6yMUCV/M7sO7NTj2gMfoyqD3h4i27DOyGv+fIpg9Ip7ga0ljFdoRO+NriNcpakyXQ0nnes14B9A79kkYfNlRkVpYPOB+1xHr41Zlr0fiICXrG6F7k1rSKDL8rnuyrlzBAh+Sfn3uTB+Hvxukv20DY+L3URkjRF0MwjVqApn2CYz+5+p8nd+667Mh0hmT9gEGY/J1VGfn8QnRaq4PABmMWu56j/yVWWFnt4ola7yTqAQ06SajPS49A7yfimwaFt+/e2l3JDm9X2s5sqsxRiHddvjH6l6rVuBRT1nKdEV7+Dbj92hCelQw+8IaaDPpaXZcHKgkRPQggPwKVYscdg7i9zpYTjW7TIe3P2t75mkFsvy+pwQiU8CZjepZnp5zWtjBzYMPuyKUEmOAOW6Ol3nsBkb+zwL0AVXNqJmzQKQIZAGVaorENb0TIWYAISUSXJU88aRTtmK4+4gGngeOPK7nMRcaHd48G0Nir20ECAwEAAaOCA0AwggM8MCMGA1UdEQQcMBqgGAYKKwYBBAGBuEgEBqAKDAgxMDcxOTI2OTAOBgNVHQ8BAf8EBAMCBeAwCQYDVR0TBAIwADCCASMGA1UdIASCARowggEWMIIBBwYNKwYBBAGBuEgKAR8BADCB9TAdBggrBgEFBQcCARYRaHR0cDovL3d3dy5pY2EuY3owgdMGCCsGAQUFBwICMIHGDIHDVGVudG8ga3ZhbGlmaWtvdmFueSBjZXJ0aWZpa2F0IHBybyBlbGVrdHJvbmlja291IHBlY2V0IGJ5bCB2eWRhbiB2IHNvdWxhZHUgcyBuYXJpemVuaW0gRVUgYy4gOTEwLzIwMTQuVGhpcyBpcyBhIHF1YWxpZmllZCBjZXJ0aWZpY2F0ZSBmb3IgZWxlY3Ryb25pYyBzZWFsIGFjY29yZGluZyB0byBSZWd1bGF0aW9uIChFVSkgTm8gOTEwLzIwMTQuMAkGBwQAi+xAAQEwgY8GA1UdHwSBhzCBhDAqoCigJoYkaHR0cDovL3FjcmxkcDEuaWNhLmN6LzJxY2EyMl9yc2EuY3JsMCqgKKAmhiRodHRwOi8vcWNybGRwMi5pY2EuY3ovMnFjYTIyX3JzYS5jcmwwKqAooCaGJGh0dHA6Ly9xY3JsZHAzLmljYS5jei8ycWNhMjJfcnNhLmNybDCBhAYIKwYBBQUHAQMEeDB2MAgGBgQAjkYBATBVBgYEAI5GAQUwSzAsFiZodHRwOi8vd3d3LmljYS5jei9acHJhdnktcHJvLXV6aXZhdGVsZRMCY3MwGxYVaHR0cDovL3d3dy5pY2EuY3ovUERTEwJlbjATBgYEAI5GAQYwCQYHBACORgEGAjBlBggrBgEFBQcBAQRZMFcwKgYIKwYBBQUHMAKGHmh0dHA6Ly9xLmljYS5jei8ycWNhMjJfcnNhLmNlcjApBggrBgEFBQcwAYYdaHR0cDovL29jc3AuaWNhLmN6LzJxY2EyMl9yc2EwHwYDVR0jBBgwFoAUiv9gsrZIUCWPLs1DUzsIhMXK6GQwHQYDVR0OBBYEFFoxmkE0YPc9s4G31yXc6WcNgbfjMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4ICAQBhtDiu0n2ceSO8NeufLmMudMHR2/dSf1wRCioag88PJHceFVzIt0TZpl8NVvU2ihqAiBguIbZvYEICEBxb+AzJp/KNivuiKriQoY7iXlhi5xm+wWy7HhzZC2J6MprL5VyqsHMbbOj+FLy/ESl1JZqldlMMPVpUhJGKogRSqKAbxXpgCXV4u9zzOqDcpWMxburEKhT6AzlayLki6waZNw3ruMsOvCcqpb+mA//Ugt6ac9sMF87by4fDookRp+lWo/2ddyF2vT6kGPMz5gT+Jp0qMiwJLvY2b5u3viDoB4Wcwsh2bEJP+22aIVilNnGqKRxtgAhDYBXaQm1SN4NHS8Xww7FH2tQ/V4cxRkPTAqp9AdOXa5QS2l06+gE8SftARi0NWBSfncVdjxpSJOOGYkap0/iN6B7ppFEF77HCFz8T+2IiswLEUOtA3DHGzQrqbjP014BWgsq1Y1q9Bc+uVpPpivwsd3QollecQIEkegnzonh0K+2eq6QPpO30VxEMjBdrl0Kp3celEOkZsIYHdk2efa0xsa04tj4iEMNuKvfJQv4Us5XU66AUkZ0K//EPmYq7EJvKiJpih3572jVrggqRPDodJMeDgwVSAFf+ALKUBvJwLlIJXlnb7F9VhrYkqme8CdOYDiOvKZ7cHJXE6F0r1hL7kS4cYMetAkc9W5SAnw==" ] ] ] ] +validUntil: null +cacheDuration: null -entityID: "urn:microsoft:cgg2010:fpsts" -ID: "_530e4277-09cc-412c-84e9-12a9cc98ff50" -Extensions: [] -RoleDescriptor: array:2 [ 0 => UnknownRoleDescriptor {#103 #signatureKey: null #certificates: [] -validators: [] +validUntil: null +cacheDuration: null -elementName: "md:RoleDescriptor" -ID: null -protocolSupportEnumeration: array:1 [ 0 => "http://docs.oasis-open.org/wsfed/federation/200706" ] -errorURL: null -Extensions: [] -KeyDescriptor: array:1 [ 0 => KeyDescriptor {#105 -use: "signing" -KeyInfo: KeyInfo {#101 -Id: null -info: array:1 [ 0 => X509Data {#111 -data: array:1 [ 0 => X509Certificate {#113 -certificate: "MIIIzTCCBrWgAwIBAgIEALuqHzANBgkqhkiG9w0BAQsFADCBgTEqMCgGA1UEAwwhSS5DQSBFVSBRdWFsaWZpZWQgQ0EyL1JTQSAwNi8yMDIyMS0wKwYDVQQKDCRQcnZuw60gY2VydGlmaWthxI1uw60gYXV0b3JpdGEsIGEucy4xFzAVBgNVBGEMDk5UUkNaLTI2NDM5Mzk1MQswCQYDVQQGEwJDWjAeFw0yNDA0MTcxMjA3NDJaFw0yNTA0MTcxMjA3NDJaMIGKMSwwKgYDVQQKDCNEaWdpdMOhbG7DrSBhIGluZm9ybWHEjW7DrSBhZ2VudHVyYTEXMBUGA1UEYQwOTlRSQ1otMTc2NTE5MjExGzAZBgNVBAMMEkdHX0ZQU1RTX1RFU1RfU0lHTjELMAkGA1UEBhMCQ1oxFzAVBgNVBAUTDklDQSAtIDEwNzE5MjY5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0APEiCZX7swEf1M5t7qrqJZSZ/UzarPLoH9wfv2ojoJjeG6sSrQMTyQFfVlCjOeiU2XiRid03tvTdIQzs9jQXvKGrQa18l723ccqt0RFBSyo6mghiKXftKx2VwZkz1nIv1CS7W+1ET2g9C0VYTaJbMRUEgShPYI1hbSzpsV6sSu/i4w9GTCbfAHQY7dGyeyaNvABI8B6yMUCV/M7sO7NTj2gMfoyqD3h4i27DOyGv+fIpg9Ip7ga0ljFdoRO+NriNcpakyXQ0nnes14B9A79kkYfNlRkVpYPOB+1xHr41Zlr0fiICXrG6F7k1rSKDL8rnuyrlzBAh+Sfn3uTB+Hvxukv20DY+L3URkjRF0MwjVqApn2CYz+5+p8nd+667Mh0hmT9gEGY/J1VGfn8QnRaq4PABmMWu56j/yVWWFnt4ola7yTqAQ06SajPS49A7yfimwaFt+/e2l3JDm9X2s5sqsxRiHddvjH6l6rVuBRT1nKdEV7+Dbj92hCelQw+8IaaDPpaXZcHKgkRPQggPwKVYscdg7i9zpYTjW7TIe3P2t75mkFsvy+pwQiU8CZjepZnp5zWtjBzYMPuyKUEmOAOW6Ol3nsBkb+zwL0AVXNqJmzQKQIZAGVaorENb0TIWYAISUSXJU88aRTtmK4+4gGngeOPK7nMRcaHd48G0Nir20ECAwEAAaOCA0AwggM8MCMGA1UdEQQcMBqgGAYKKwYBBAGBuEgEBqAKDAgxMDcxOTI2OTAOBgNVHQ8BAf8EBAMCBeAwCQYDVR0TBAIwADCCASMGA1UdIASCARowggEWMIIBBwYNKwYBBAGBuEgKAR8BADCB9TAdBggrBgEFBQcCARYRaHR0cDovL3d3dy5pY2EuY3owgdMGCCsGAQUFBwICMIHGDIHDVGVudG8ga3ZhbGlmaWtvdmFueSBjZXJ0aWZpa2F0IHBybyBlbGVrdHJvbmlja291IHBlY2V0IGJ5bCB2eWRhbiB2IHNvdWxhZHUgcyBuYXJpemVuaW0gRVUgYy4gOTEwLzIwMTQuVGhpcyBpcyBhIHF1YWxpZmllZCBjZXJ0aWZpY2F0ZSBmb3IgZWxlY3Ryb25pYyBzZWFsIGFjY29yZGluZyB0byBSZWd1bGF0aW9uIChFVSkgTm8gOTEwLzIwMTQuMAkGBwQAi+xAAQEwgY8GA1UdHwSBhzCBhDAqoCigJoYkaHR0cDovL3FjcmxkcDEuaWNhLmN6LzJxY2EyMl9yc2EuY3JsMCqgKKAmhiRodHRwOi8vcWNybGRwMi5pY2EuY3ovMnFjYTIyX3JzYS5jcmwwKqAooCaGJGh0dHA6Ly9xY3JsZHAzLmljYS5jei8ycWNhMjJfcnNhLmNybDCBhAYIKwYBBQUHAQMEeDB2MAgGBgQAjkYBATBVBgYEAI5GAQUwSzAsFiZodHRwOi8vd3d3LmljYS5jei9acHJhdnktcHJvLXV6aXZhdGVsZRMCY3MwGxYVaHR0cDovL3d3dy5pY2EuY3ovUERTEwJlbjATBgYEAI5GAQYwCQYHBACORgEGAjBlBggrBgEFBQcBAQRZMFcwKgYIKwYBBQUHMAKGHmh0dHA6Ly9xLmljYS5jei8ycWNhMjJfcnNhLmNlcjApBggrBgEFBQcwAYYdaHR0cDovL29jc3AuaWNhLmN6LzJxY2EyMl9yc2EwHwYDVR0jBBgwFoAUiv9gsrZIUCWPLs1DUzsIhMXK6GQwHQYDVR0OBBYEFFoxmkE0YPc9s4G31yXc6WcNgbfjMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4ICAQBhtDiu0n2ceSO8NeufLmMudMHR2/dSf1wRCioag88PJHceFVzIt0TZpl8NVvU2ihqAiBguIbZvYEICEBxb+AzJp/KNivuiKriQoY7iXlhi5xm+wWy7HhzZC2J6MprL5VyqsHMbbOj+FLy/ESl1JZqldlMMPVpUhJGKogRSqKAbxXpgCXV4u9zzOqDcpWMxburEKhT6AzlayLki6waZNw3ruMsOvCcqpb+mA//Ugt6ac9sMF87by4fDookRp+lWo/2ddyF2vT6kGPMz5gT+Jp0qMiwJLvY2b5u3viDoB4Wcwsh2bEJP+22aIVilNnGqKRxtgAhDYBXaQm1SN4NHS8Xww7FH2tQ/V4cxRkPTAqp9AdOXa5QS2l06+gE8SftARi0NWBSfncVdjxpSJOOGYkap0/iN6B7ppFEF77HCFz8T+2IiswLEUOtA3DHGzQrqbjP014BWgsq1Y1q9Bc+uVpPpivwsd3QollecQIEkegnzonh0K+2eq6QPpO30VxEMjBdrl0Kp3celEOkZsIYHdk2efa0xsa04tj4iEMNuKvfJQv4Us5XU66AUkZ0K//EPmYq7EJvKiJpih3572jVrggqRPDodJMeDgwVSAFf+ALKUBvJwLlIJXlnb7F9VhrYkqme8CdOYDiOvKZ7cHJXE6F0r1hL7kS4cYMetAkc9W5SAnw==" } ] } ] } -EncryptionMethod: [] } ] -Organization: null -ContactPerson: [] -xml: Chunk {#106 -localName: "RoleDescriptor" -namespaceURI: "urn:oasis:names:tc:SAML:2.0:metadata" -xml: DOMElement {#108 +schemaTypeInfo: null +nodeName: "RoleDescriptor" +nodeValue: "" +nodeType: XML_ELEMENT_NODE +parentNode: null +childNodes: DOMNodeList {#156 +length: 5 } +firstChild: DOMElement {#158 …} +lastChild: DOMElement {#160 …} +previousSibling: null +nextSibling: null +attributes: DOMNamedNodeMap {#163 +length: 2 } +ownerDocument: DOMDocument {#165 …} +namespaceURI: "urn:oasis:names:tc:SAML:2.0:metadata" +prefix: "" +localName: "RoleDescriptor" +baseURI: null +textContent: "" +tagName: "RoleDescriptor" } } } 1 => IDPSSODescriptor {#104 #signatureKey: null #certificates: [] -validators: [] +validUntil: null +cacheDuration: null -elementName: "md:IDPSSODescriptor" -ID: null -protocolSupportEnumeration: array:1 [ 0 => "urn:oasis:names:tc:SAML:2.0:protocol" ] -errorURL: null -Extensions: [] -KeyDescriptor: array:1 [ 0 => KeyDescriptor {#110 -use: "signing" -KeyInfo: KeyInfo {#114 -Id: null -info: array:1 [ 0 => X509Data {#118 -data: array:1 [ 0 => X509Certificate {#120 -certificate: "MIIIzTCCBrWgAwIBAgIEALuqHzANBgkqhkiG9w0BAQsFADCBgTEqMCgGA1UEAwwhSS5DQSBFVSBRdWFsaWZpZWQgQ0EyL1JTQSAwNi8yMDIyMS0wKwYDVQQKDCRQcnZuw60gY2VydGlmaWthxI1uw60gYXV0b3JpdGEsIGEucy4xFzAVBgNVBGEMDk5UUkNaLTI2NDM5Mzk1MQswCQYDVQQGEwJDWjAeFw0yNDA0MTcxMjA3NDJaFw0yNTA0MTcxMjA3NDJaMIGKMSwwKgYDVQQKDCNEaWdpdMOhbG7DrSBhIGluZm9ybWHEjW7DrSBhZ2VudHVyYTEXMBUGA1UEYQwOTlRSQ1otMTc2NTE5MjExGzAZBgNVBAMMEkdHX0ZQU1RTX1RFU1RfU0lHTjELMAkGA1UEBhMCQ1oxFzAVBgNVBAUTDklDQSAtIDEwNzE5MjY5MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA0APEiCZX7swEf1M5t7qrqJZSZ/UzarPLoH9wfv2ojoJjeG6sSrQMTyQFfVlCjOeiU2XiRid03tvTdIQzs9jQXvKGrQa18l723ccqt0RFBSyo6mghiKXftKx2VwZkz1nIv1CS7W+1ET2g9C0VYTaJbMRUEgShPYI1hbSzpsV6sSu/i4w9GTCbfAHQY7dGyeyaNvABI8B6yMUCV/M7sO7NTj2gMfoyqD3h4i27DOyGv+fIpg9Ip7ga0ljFdoRO+NriNcpakyXQ0nnes14B9A79kkYfNlRkVpYPOB+1xHr41Zlr0fiICXrG6F7k1rSKDL8rnuyrlzBAh+Sfn3uTB+Hvxukv20DY+L3URkjRF0MwjVqApn2CYz+5+p8nd+667Mh0hmT9gEGY/J1VGfn8QnRaq4PABmMWu56j/yVWWFnt4ola7yTqAQ06SajPS49A7yfimwaFt+/e2l3JDm9X2s5sqsxRiHddvjH6l6rVuBRT1nKdEV7+Dbj92hCelQw+8IaaDPpaXZcHKgkRPQggPwKVYscdg7i9zpYTjW7TIe3P2t75mkFsvy+pwQiU8CZjepZnp5zWtjBzYMPuyKUEmOAOW6Ol3nsBkb+zwL0AVXNqJmzQKQIZAGVaorENb0TIWYAISUSXJU88aRTtmK4+4gGngeOPK7nMRcaHd48G0Nir20ECAwEAAaOCA0AwggM8MCMGA1UdEQQcMBqgGAYKKwYBBAGBuEgEBqAKDAgxMDcxOTI2OTAOBgNVHQ8BAf8EBAMCBeAwCQYDVR0TBAIwADCCASMGA1UdIASCARowggEWMIIBBwYNKwYBBAGBuEgKAR8BADCB9TAdBggrBgEFBQcCARYRaHR0cDovL3d3dy5pY2EuY3owgdMGCCsGAQUFBwICMIHGDIHDVGVudG8ga3ZhbGlmaWtvdmFueSBjZXJ0aWZpa2F0IHBybyBlbGVrdHJvbmlja291IHBlY2V0IGJ5bCB2eWRhbiB2IHNvdWxhZHUgcyBuYXJpemVuaW0gRVUgYy4gOTEwLzIwMTQuVGhpcyBpcyBhIHF1YWxpZmllZCBjZXJ0aWZpY2F0ZSBmb3IgZWxlY3Ryb25pYyBzZWFsIGFjY29yZGluZyB0byBSZWd1bGF0aW9uIChFVSkgTm8gOTEwLzIwMTQuMAkGBwQAi+xAAQEwgY8GA1UdHwSBhzCBhDAqoCigJoYkaHR0cDovL3FjcmxkcDEuaWNhLmN6LzJxY2EyMl9yc2EuY3JsMCqgKKAmhiRodHRwOi8vcWNybGRwMi5pY2EuY3ovMnFjYTIyX3JzYS5jcmwwKqAooCaGJGh0dHA6Ly9xY3JsZHAzLmljYS5jei8ycWNhMjJfcnNhLmNybDCBhAYIKwYBBQUHAQMEeDB2MAgGBgQAjkYBATBVBgYEAI5GAQUwSzAsFiZodHRwOi8vd3d3LmljYS5jei9acHJhdnktcHJvLXV6aXZhdGVsZRMCY3MwGxYVaHR0cDovL3d3dy5pY2EuY3ovUERTEwJlbjATBgYEAI5GAQYwCQYHBACORgEGAjBlBggrBgEFBQcBAQRZMFcwKgYIKwYBBQUHMAKGHmh0dHA6Ly9xLmljYS5jei8ycWNhMjJfcnNhLmNlcjApBggrBgEFBQcwAYYdaHR0cDovL29jc3AuaWNhLmN6LzJxY2EyMl9yc2EwHwYDVR0jBBgwFoAUiv9gsrZIUCWPLs1DUzsIhMXK6GQwHQYDVR0OBBYEFFoxmkE0YPc9s4G31yXc6WcNgbfjMBMGA1UdJQQMMAoGCCsGAQUFBwMEMA0GCSqGSIb3DQEBCwUAA4ICAQBhtDiu0n2ceSO8NeufLmMudMHR2/dSf1wRCioag88PJHceFVzIt0TZpl8NVvU2ihqAiBguIbZvYEICEBxb+AzJp/KNivuiKriQoY7iXlhi5xm+wWy7HhzZC2J6MprL5VyqsHMbbOj+FLy/ESl1JZqldlMMPVpUhJGKogRSqKAbxXpgCXV4u9zzOqDcpWMxburEKhT6AzlayLki6waZNw3ruMsOvCcqpb+mA//Ugt6ac9sMF87by4fDookRp+lWo/2ddyF2vT6kGPMz5gT+Jp0qMiwJLvY2b5u3viDoB4Wcwsh2bEJP+22aIVilNnGqKRxtgAhDYBXaQm1SN4NHS8Xww7FH2tQ/V4cxRkPTAqp9AdOXa5QS2l06+gE8SftARi0NWBSfncVdjxpSJOOGYkap0/iN6B7ppFEF77HCFz8T+2IiswLEUOtA3DHGzQrqbjP014BWgsq1Y1q9Bc+uVpPpivwsd3QollecQIEkegnzonh0K+2eq6QPpO30VxEMjBdrl0Kp3celEOkZsIYHdk2efa0xsa04tj4iEMNuKvfJQv4Us5XU66AUkZ0K//EPmYq7EJvKiJpih3572jVrggqRPDodJMeDgwVSAFf+ALKUBvJwLlIJXlnb7F9VhrYkqme8CdOYDiOvKZ7cHJXE6F0r1hL7kS4cYMetAkc9W5SAnw==" } ] } ] } -EncryptionMethod: [] } ] -Organization: null -ContactPerson: [] -ArtifactResolutionService: [] -SingleLogoutService: array:1 [ 0 => EndpointType {#112 -Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" -Location: "https://tnia.identita.gov.cz/FPSTS/saml2/basic" -ResponseLocation: null -attributes: [] } ] -ManageNameIDService: [] -NameIDFormat: [] -WantAuthnRequestsSigned: null -SingleSignOnService: array:2 [ 0 => EndpointType {#116 -Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" -Location: "https://tnia.identita.gov.cz/FPSTS/saml2/basic" -ResponseLocation: null -attributes: [] } 1 => EndpointType {#122 -Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" -Location: "https://tnia.identita.gov.cz/FPSTS/saml2/basic" -ResponseLocation: null -attributes: [] } ] -NameIDMappingService: [] -AssertionIDRequestService: [] -AttributeProfile: [] -Attribute: [] } ] -AffiliationDescriptor: null -Organization: null -ContactPerson: [] -AdditionalMetadataLocation: [] }
<?php
use RobRichards\XMLSecLibs\XMLSecurityKey;
// soubor s certifikátem bychom měli mít uložen lokálně, aby validace podpisu proběhla korektně
// na uvedené adrese je uložen NIA certifikát (PEM) z testovacího prostředí
$tnia_cert_data = file_get_contents('https://nia.otevrenamesta.cz/tnia.crt');
// z dat certifikátu vytvoříme klíč
$tnia_key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, ['type' => 'public']);
$tnia_key->loadKey($tnia_cert_data, false, true);
// a použijeme interní metodu EntityDescriptor->validate(XMLSecurityKey $key) pro validaci
$valid = $metadata->validate($tnia_key);
Obsah proměnné valid: null
<?php
use SAML2\Constants;
use SAML2\XML\md\IDPSSODescriptor;
use SAML2\XML\md\EntityDescriptor;
private function extractSSOLoginUrls(EntityDescriptor $idp_descriptor){
$idp_sso_descriptor = false;
foreach ($idp_descriptor->getRoleDescriptor() as $role_descriptor) {
if ($role_descriptor instanceof IDPSSODescriptor) {
$idp_sso_descriptor = $role_descriptor;
}
}
$sso_redirect_login_url = false;
$sso_post_login_url = false;
if ($idp_sso_descriptor instanceof IDPSSODescriptor) {
foreach ($idp_sso_descriptor->getSingleSignOnService() as $descriptorType) {
if ($descriptorType->getBinding() === Constants::BINDING_HTTP_REDIRECT) {
$sso_redirect_login_url = $descriptorType->getLocation();
} else if ($descriptorType->getBinding() === Constants::BINDING_HTTP_POST) {
$sso_post_login_url = $descriptorType->getLocation();
}
}
}
return [Constants::BINDING_HTTP_REDIRECT => $sso_redirect_login_url, Constants::BINDING_HTTP_POST => $sso_post_login_url];
}
$urls = extractSSOLoginUrls($metadata);
$redirect_url = $urls[Constants::BINDING_HTTP_REDIRECT];
$post_url = $urls[Constants::BINDING_HTTP_POST];
Obsah proměnné urls: array:2 [ "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" => "https://tnia.identita.gov.cz/FPSTS/saml2/basic" "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" => "https://tnia.identita.gov.cz/FPSTS/saml2/basic" ]