simplesamlphp/simplesamlphp — pull request #80 by zmousm (2014-06-18 15:34:19+00:00)
Title: An attempt to slightly improve the NameFormat selection for attributes released by the IdP

Imperfect yet non-intrusive.

The status quo ante:
- XML->native metadata (via e.g. metarefresh) takes a very conservative
approach for picking the NameFormat from the RequestedAttribute(s) in
(the first ACS found in) SP metadata: it aborts if both Shib-style and
SAML2-URI NameFormat(s) are found.
- NameFormat selection for the attributes to be asserted by the IdP
blindly prefers the NameFormat detected in SP metadata, even when the
IdP has been explicitly configured to prefer a specific NameFormat
(which is thus almost never used).

This patch:
- Takes a more careful (and perhaps realistic) approach at detecting the
SP-derived NameFormat and also stores (in attributes.NameFormats) all
NameFormats found in the (the first) ACS RequestedAttribute elements.
- Checks if the IdP-configured NameFormat matches any of the NameFormats
detected in SP metadata (attributes.NameFormats). This comes before
any other tests in the NameFormat selection for the IdP assertion.