Changeset 15311

Timestamp:

10/09/2026 02:25:28 PM (2 weeks ago)

Author:

obenland

Message:

FreeScout: Accept logins from WordPress.org's identity provider

Closes ​https://github.com/WordPress/wordpress.org/pull/1032.

Location:

sites/trunk/freescout.wordpress.net

Files:

• Modules/WPOrgSSO/Config/config.php (modified) (1 diff)
• Modules/WPOrgSSO/Http/Controllers/SsoController.php (modified) (1 diff)
• Modules/WPOrgSSO/Services/Saml.php (modified) (2 diffs)
• Modules/WPOrgSSO/tests/Support/IdentityProvider.php (modified) (1 diff)
• README.md (modified) (1 diff)

sites/trunk/freescout.wordpress.net/Modules/WPOrgSSO/Config/config.php

@@ -19 +19 @@
         // The WordPress.org SAML identity provider, as its settings page lists it.
         'idp'            => array(
-                'entity_id' => env( 'WPORG_SSO_IDP_ENTITY_ID', 'https://login.wordpress.org' ),
+                'entity_id' => env( 'WPORG_SSO_IDP_ENTITY_ID', 'https://wordpress.org' ),
                 'url'       => env( 'WPORG_SSO_IDP_URL', 'https://login.wordpress.org/wp-login.php?action=idp' ),
 

sites/trunk/freescout.wordpress.net/Modules/WPOrgSSO/Http/Controllers/SsoController.php

@@ -79 +79 @@
                         $result = Saml::from_config()->validate( (string) $request->input( 'SAMLResponse', '' ) );
                 } catch ( \Throwable $e ) {
-                        \Log::warning( '[WPOrgSSO] ' . $e->getMessage() );
+                        \Log::error( '[WPOrgSSO] ' . $e->getMessage() );
 
                         return redirect()->away( $complete, 303 );

sites/trunk/freescout.wordpress.net/Modules/WPOrgSSO/Services/Saml.php

@@ -150 +150 @@
 
                         $username       = (string) $response->getNameId();
-                        $in_response_to = (string) $response->getXMLDocument()->documentElement->getAttribute( 'InResponseTo' );
+                        $in_response_to = self::in_response_to( $response->getXMLDocument() );
                 } catch ( RuntimeException $e ) {
                         throw $e;
@@ -167 +167 @@
                         'in_response_to' => $in_response_to,
                 );
+        }
+
+        /**
+         * Gets the ID of the login request a response answers.
+         *
+         * WordPress.org's identity provider only names it in the assertion's bearer confirmation, not on the response
+         * itself. The whole response is signed, so it's as trustworthy there.
+         *
+         * @param \DOMDocument $document Validated response.
+         * @return string Login request ID, or empty.
+         */
+        private static function in_response_to( \DOMDocument $document ): string {
+                $xpath = new \DOMXPath( $document );
+                $xpath->registerNamespace( 'samlp', Constants::NS_SAMLP );
+                $xpath->registerNamespace( 'saml', Constants::NS_SAML );
+
+                return (string) $xpath->evaluate( 'string(/samlp:Response/saml:Assertion/saml:Subject/saml:SubjectConfirmation[@Method="' . Constants::CM_BEARER . '"]/saml:SubjectConfirmationData/@InResponseTo)' );
         }
 

sites/trunk/freescout.wordpress.net/Modules/WPOrgSSO/tests/Support/IdentityProvider.php

@@ -139 +139 @@
                 $id       = '_' . bin2hex( random_bytes( 16 ) );
 
+                // Like wp-saml-idp, only the bearer confirmation names the login request, not the response itself.
                 $xml = sprintf(
-                        '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="%1$s" Version="2.0" IssueInstant="%3$s" Destination="%6$s" InResponseTo="%8$s">' .
+                        '<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="%1$s" Version="2.0" IssueInstant="%3$s" Destination="%6$s">' .
                                 '<saml:Issuer>%5$s</saml:Issuer>' .
                                 '<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>' .

sites/trunk/freescout.wordpress.net/README.md

@@ -51 +51 @@
 |---|---|---|
 | `WPORG_API_URL` | `https://api.wordpress.org/dotorg/freescout/` | Where the helpdesk endpoints are. |
-| `WPORG_SSO_IDP_ENTITY_ID` | `https://login.wordpress.org` | The identity provider's entity ID, from its settings page on login.wordpress.org. |
+| `WPORG_SSO_IDP_ENTITY_ID` | `https://wordpress.org` | The identity provider's entity ID, from its settings page on login.wordpress.org. |
 | `WPORG_SSO_IDP_URL` | `https://login.wordpress.org/wp-login.php?action=idp` | The identity provider's login URL, from the same page. |
 | `WPORG_HELPSCOUT_APP_ID`, `WPORG_HELPSCOUT_APP_SECRET` | | A HelpScout app's credentials, for `WPOrgHelpScoutImport`. Only needed while mailboxes move; delete the app after the last import. |