Merge pull request #190 from OpenConext/feature/allow-validation-without-registration

pablothedude · web-flow · commit 7037ec7d6d8a · 2025-05-27T09:36:17.000+02:00
Allow validation without registration
diff --git a/.github/workflows/test-acceptance.yml b/.github/workflows/test-acceptance.yml
@@ -30,3 +30,6 @@ jobs:
       
       - name: Run PHPUnit WebTests
         run: composer web-tests
+
+      - name: Run Behat tests
+        run: composer behat
diff --git a/composer.json b/composer.json
@@ -133,9 +133,6 @@
       "/.env.vm",
       "/*.xml",
       "/*.xml.dist",
-      "/config/routes/dev",
-      "/config/packages/dev",
-      "/config/packages/test",
       "/node_modules",
       "/coverage",
       "/build",
diff --git a/config/openconext/institutions.yaml.dist b/config/openconext/institutions.yaml.dist
@@ -9,32 +9,32 @@ parameters:
           certificates:
             - |
                 -----BEGIN CERTIFICATE-----
-                MIIEJTCCAw2gAwIBAgIJANug+o++1X5IMA0GCSqGSIb3DQEBCwUAMIGoMQswCQYD
-                VQQGEwJOTDEQMA4GA1UECAwHVXRyZWNodDEQMA4GA1UEBwwHVXRyZWNodDEVMBMG
-                A1UECgwMU1VSRm5ldCBCLlYuMRMwEQYDVQQLDApTVVJGY29uZXh0MRwwGgYDVQQD
-                DBNTVVJGbmV0IERldmVsb3BtZW50MSswKQYJKoZIhvcNAQkBFhxzdXJmY29uZXh0
-                LWJlaGVlckBzdXJmbmV0Lm5sMB4XDTE0MTAyMDEyMzkxMVoXDTE0MTExOTEyMzkx
-                MVowgagxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
-                dHJlY2h0MRUwEwYDVQQKDAxTVVJGbmV0IEIuVi4xEzARBgNVBAsMClNVUkZjb25l
-                eHQxHDAaBgNVBAMME1NVUkZuZXQgRGV2ZWxvcG1lbnQxKzApBgkqhkiG9w0BCQEW
-                HHN1cmZjb25leHQtYmVoZWVyQHN1cmZuZXQubmwwggEiMA0GCSqGSIb3DQEBAQUA
-                A4IBDwAwggEKAoIBAQDXuSSBeNJY3d4p060oNRSuAER5nLWT6AIVbv3XrXhcgSwc
-                9m2b8u3ksp14pi8FbaNHAYW3MjlKgnLlopYIylzKD/6Ut/clEx67aO9Hpqsc0HmI
-                P0It6q2bf5yUZ71E4CN2HtQceO5DsEYpe5M7D5i64kS2A7e2NYWVdA5Z01DqUpQG
-                RBc+uMzOwyif6StBiMiLrZH3n2r5q5aVaXU4Vy5EE4VShv3Mp91sgXJj/v155fv0
-                wShgl681v8yf2u2ZMb7NKnQRA4zM2Ng2EUAyy6PQ+Jbn+rALSm1YgiJdVuSlTLhv
-                gwbiHGO2XgBi7bTHhlqSrJFK3Gs4zwIsop/XqQRBAgMBAAGjUDBOMB0GA1UdDgQW
-                BBQCJmcoa/F7aM3jIFN7Bd4uzWRgzjAfBgNVHSMEGDAWgBQCJmcoa/F7aM3jIFN7
-                Bd4uzWRgzjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBd80GpWKjp
-                1J+Dgp0blVAox1s/WPWQlex9xrx1GEYbc5elp3svS+S82s7dFm2llHrrNOBt1HZV
-                C+TdW4f+MR1xq8O5lOYjDRsosxZc/u9jVsYWYc3M9bQAx8VyJ8VGpcAK+fLqRNab
-                YlqTnj/t9bzX8fS90sp8JsALV4g84Aj0G8RpYJokw+pJUmOpuxsZN5U84MmLPnVf
-                mrnuCVh/HkiLNV2c8Pk8LSomg6q1M1dQUTsz/HVxcOhHLj/owwh3IzXf/KXV/E8v
-                SYW8o4WWCAnruYOWdJMI4Z8NG1Mfv7zvb7U3FL1C/KLV04DqzALXGj+LVmxtDvux
-                qC042apoIDQV
+                MIIEEzCCAnsCFEow2E90q1t//LDuqkgF2zo7VNo4MA0GCSqGSIb3DQEBCwUAMEYx
+                GzAZBgNVBAMMEkF6dXJlLU1GQSBHU1NQIElkUDEnMCUGA1UECgweRGV2ZWxvcG1l
+                bnQgRG9ja2VyIGVudmlyb25tZW50MB4XDTIzMDUyNTA5MzMyM1oXDTI4MDUyMzA5
+                MzMyM1owRjEbMBkGA1UEAwwSQXp1cmUtTUZBIEdTU1AgSWRQMScwJQYDVQQKDB5E
+                ZXZlbG9wbWVudCBEb2NrZXIgZW52aXJvbm1lbnQwggGiMA0GCSqGSIb3DQEBAQUA
+                A4IBjwAwggGKAoIBgQCWaoXdTdU3N0RL2jK/88PEN3jwyyz7AFJX64Rfx48CtCsI
+                3Hze+0i+0KQgILsVU91kKujllFBM6N4V5PKQ+9Z5zafJeuhT80zQ9jcHVxyQoKi3
+                0438fBGzlAKD9hGojG7DwjKopK+96Eawvu90KCxf8q7STh50n8dO6hnxWtE8RGk5
+                a9R2cMDxEuOlvrW2B8Ih+EVCT3OmOsCQdp31TuTt5x3xLxmY/04mGGPpQi9PBV38
+                O2uTd4G2mbqGqNGx6S6iPAMgh6u4NVmg03iqBKkFJgQvNRCdif+gMQTKEW0mJwr6
+                2PrEQrPBoBphgCpJNF9pnEy/+mdWiKCo8lvVxiPGQaaKyoNvZEt1IROwp8Ga2gLE
+                oFjtcMcodnLgudusDOCH6Idp0CtuTkrf3hLIxKjQMOFTCiCmOCtMlJZa9+l7Lbhz
+                EGcJUcHH0i1k+ufqUhOSBrrfKoiohixAnW+bayqymef+Zy32YoT+/LDjoP/vyMrN
+                nRwpwqguPMwBF+HWgwUCAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAReFJH/X+PyA8
+                cFe6RdCgyTbuRuq2rTgadKpqfhhbXlwcOTh8rEpevqFf8tequegCj7fFZgz+hIL0
+                75ZsEcZwk2N8F8m32cVjmYHar2rLsYEkqhEc/yCUjyGffqUeZBVmdUnUM6ggGsIH
+                qcjTvrNhmFrh3ManebvZkjvDyJCkrwUOGYvCpbFjXa4CW1Rp+I0+e7HnQeyFW3p+
+                3T0SAmdo3eJEZLhRsMm/YLcyCW7IRTVvpTvGoxhbvQU1k6EtkhLcahA+MWVzNbgi
+                IdHP/otSQnaLW243sxoxYm7EiuAihnQ0iRaNEzsFrx/W06G0e5rmTbWPGc4LZj6Y
+                DKd7531SGIwqOOC1wrzrZ36iuwPm5PrZReCWH3ptR6bSszQerbQsx6wkumYN7iDZ
+                g9EK9ADHRzfovbqOPad2s+N5iVWAOfEXGqItZcrLdW53vUOqbfXXuFt7szhtdvTW
+                RWWQQJryrg61UmLgJcLb3xMMdZZ+D6mcXqa3v2cSzGdfO932xUzq
                 -----END CERTIFICATE-----
+
           email_domains: # A list of email domains that are used to identify registering users (addresses must match the email domain of the institution)
-            - 'stepup.example.com'
+            - 'dev.openconext.local'
             - 'institution-a.example.com'
             - '*.dev.openconext.local' # Wildcards are allowed
           is_azure_ad: true # AzureAD (Entra) does not accept a SAML subject, ADFS does require this
@@ -43,31 +43,31 @@ parameters:
           sso_location: 'https://azuremfa.dev.openconext.local/mock/sso' # Location of the Azure MFA endpoint
           certificates:
             - |
-              -----BEGIN CERTIFICATE-----
-              MIIEJTCCAw2gAwIBAgIJANug+o++1X5IMA0GCSqGSIb3DQEBCwUAMIGoMQswCQYD
-              VQQGEwJOTDEQMA4GA1UECAwHVXRyZWNodDEQMA4GA1UEBwwHVXRyZWNodDEVMBMG
-              A1UECgwMU1VSRm5ldCBCLlYuMRMwEQYDVQQLDApTVVJGY29uZXh0MRwwGgYDVQQD
-              DBNTVVJGbmV0IERldmVsb3BtZW50MSswKQYJKoZIhvcNAQkBFhxzdXJmY29uZXh0
-              LWJlaGVlckBzdXJmbmV0Lm5sMB4XDTE0MTAyMDEyMzkxMVoXDTE0MTExOTEyMzkx
-              MVowgagxCzAJBgNVBAYTAk5MMRAwDgYDVQQIDAdVdHJlY2h0MRAwDgYDVQQHDAdV
-              dHJlY2h0MRUwEwYDVQQKDAxTVVJGbmV0IEIuVi4xEzARBgNVBAsMClNVUkZjb25l
-              eHQxHDAaBgNVBAMME1NVUkZuZXQgRGV2ZWxvcG1lbnQxKzApBgkqhkiG9w0BCQEW
-              HHN1cmZjb25leHQtYmVoZWVyQHN1cmZuZXQubmwwggEiMA0GCSqGSIb3DQEBAQUA
-              A4IBDwAwggEKAoIBAQDXuSSBeNJY3d4p060oNRSuAER5nLWT6AIVbv3XrXhcgSwc
-              9m2b8u3ksp14pi8FbaNHAYW3MjlKgnLlopYIylzKD/6Ut/clEx67aO9Hpqsc0HmI
-              P0It6q2bf5yUZ71E4CN2HtQceO5DsEYpe5M7D5i64kS2A7e2NYWVdA5Z01DqUpQG
-              RBc+uMzOwyif6StBiMiLrZH3n2r5q5aVaXU4Vy5EE4VShv3Mp91sgXJj/v155fv0
-              wShgl681v8yf2u2ZMb7NKnQRA4zM2Ng2EUAyy6PQ+Jbn+rALSm1YgiJdVuSlTLhv
-              gwbiHGO2XgBi7bTHhlqSrJFK3Gs4zwIsop/XqQRBAgMBAAGjUDBOMB0GA1UdDgQW
-              BBQCJmcoa/F7aM3jIFN7Bd4uzWRgzjAfBgNVHSMEGDAWgBQCJmcoa/F7aM3jIFN7
-              Bd4uzWRgzjAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBd80GpWKjp
-              1J+Dgp0blVAox1s/WPWQlex9xrx1GEYbc5elp3svS+S82s7dFm2llHrrNOBt1HZV
-              C+TdW4f+MR1xq8O5lOYjDRsosxZc/u9jVsYWYc3M9bQAx8VyJ8VGpcAK+fLqRNab
-              YlqTnj/t9bzX8fS90sp8JsALV4g84Aj0G8RpYJokw+pJUmOpuxsZN5U84MmLPnVf
-              mrnuCVh/HkiLNV2c8Pk8LSomg6q1M1dQUTsz/HVxcOhHLj/owwh3IzXf/KXV/E8v
-              SYW8o4WWCAnruYOWdJMI4Z8NG1Mfv7zvb7U3FL1C/KLV04DqzALXGj+LVmxtDvux
-              qC042apoIDQV
-              -----END CERTIFICATE-----
+                -----BEGIN CERTIFICATE-----
+                MIIEEzCCAnsCFEow2E90q1t//LDuqkgF2zo7VNo4MA0GCSqGSIb3DQEBCwUAMEYx
+                GzAZBgNVBAMMEkF6dXJlLU1GQSBHU1NQIElkUDEnMCUGA1UECgweRGV2ZWxvcG1l
+                bnQgRG9ja2VyIGVudmlyb25tZW50MB4XDTIzMDUyNTA5MzMyM1oXDTI4MDUyMzA5
+                MzMyM1owRjEbMBkGA1UEAwwSQXp1cmUtTUZBIEdTU1AgSWRQMScwJQYDVQQKDB5E
+                ZXZlbG9wbWVudCBEb2NrZXIgZW52aXJvbm1lbnQwggGiMA0GCSqGSIb3DQEBAQUA
+                A4IBjwAwggGKAoIBgQCWaoXdTdU3N0RL2jK/88PEN3jwyyz7AFJX64Rfx48CtCsI
+                3Hze+0i+0KQgILsVU91kKujllFBM6N4V5PKQ+9Z5zafJeuhT80zQ9jcHVxyQoKi3
+                0438fBGzlAKD9hGojG7DwjKopK+96Eawvu90KCxf8q7STh50n8dO6hnxWtE8RGk5
+                a9R2cMDxEuOlvrW2B8Ih+EVCT3OmOsCQdp31TuTt5x3xLxmY/04mGGPpQi9PBV38
+                O2uTd4G2mbqGqNGx6S6iPAMgh6u4NVmg03iqBKkFJgQvNRCdif+gMQTKEW0mJwr6
+                2PrEQrPBoBphgCpJNF9pnEy/+mdWiKCo8lvVxiPGQaaKyoNvZEt1IROwp8Ga2gLE
+                oFjtcMcodnLgudusDOCH6Idp0CtuTkrf3hLIxKjQMOFTCiCmOCtMlJZa9+l7Lbhz
+                EGcJUcHH0i1k+ufqUhOSBrrfKoiohixAnW+bayqymef+Zy32YoT+/LDjoP/vyMrN
+                nRwpwqguPMwBF+HWgwUCAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAReFJH/X+PyA8
+                cFe6RdCgyTbuRuq2rTgadKpqfhhbXlwcOTh8rEpevqFf8tequegCj7fFZgz+hIL0
+                75ZsEcZwk2N8F8m32cVjmYHar2rLsYEkqhEc/yCUjyGffqUeZBVmdUnUM6ggGsIH
+                qcjTvrNhmFrh3ManebvZkjvDyJCkrwUOGYvCpbFjXa4CW1Rp+I0+e7HnQeyFW3p+
+                3T0SAmdo3eJEZLhRsMm/YLcyCW7IRTVvpTvGoxhbvQU1k6EtkhLcahA+MWVzNbgi
+                IdHP/otSQnaLW243sxoxYm7EiuAihnQ0iRaNEzsFrx/W06G0e5rmTbWPGc4LZj6Y
+                DKd7531SGIwqOOC1wrzrZ36iuwPm5PrZReCWH3ptR6bSszQerbQsx6wkumYN7iDZ
+                g9EK9ADHRzfovbqOPad2s+N5iVWAOfEXGqItZcrLdW53vUOqbfXXuFt7szhtdvTW
+                RWWQQJryrg61UmLgJcLb3xMMdZZ+D6mcXqa3v2cSzGdfO932xUzq
+                -----END CERTIFICATE-----
+
           email_domains: # A list of email domains that are used to identify registering users (addresses must match the email domain of the institution)
             - 'institution-b.example.com'
           is_azure_ad: true # AzureAD (Entra) does not accept a SAML subject, ADFS does require this
diff --git a/config/openconext/parameters.yaml.dist b/config/openconext/parameters.yaml.dist
@@ -19,7 +19,7 @@ parameters:
     saml_idp_publickey: '/config/azuremfa/azuremfa_idp.crt'
     saml_idp_privatekey: '/config/azuremfa/azuremfa_idp.key'
     saml_metadata_publickey: '/config/azuremfa/azuremfa_idp.crt'
-    saml_metadata_privatekey: '/config/axuremfa/azuremfa_idp.key'
+    saml_metadata_privatekey: '/config/azuremfa/azuremfa_idp.key'
     saml_remote_sp_entity_id: 'https://gateway.dev.openconext.local/gssp/azuremfa/metadata'
     saml_remote_sp_certificate: '/config/gateway/gateway_gssp_sp.crt'
     saml_remote_sp_acs: 'https://gateway.dev.openconext.local/gssp/azuremfa/consume-assertion'
diff --git a/config/openconext/parameters.yaml.test.dist b/config/openconext/parameters.yaml.test.dist
@@ -16,7 +16,7 @@ parameters:
     saml_idp_publickey: '/config/azuremfa/azuremfa_idp.crt'
     saml_idp_privatekey: '/config/azuremfa/azuremfa_idp.key'
     saml_metadata_publickey: '/config/azuremfa/azuremfa_idp.crt'
-    saml_metadata_privatekey: '/config/axuremfa/azuremfa_idp.key'
+    saml_metadata_privatekey: '/config/azuremfa/azuremfa_idp.key'
     saml_remote_sp_entity_id: 'https://gateway.dev.openconext.local/gssp/azuremfa/metadata'
     saml_remote_sp_certificate: '/config/gateway/gateway_gssp_sp.crt'
     saml_remote_sp_acs: 'https://gateway.dev.openconext.local/gssp/azuremfa/consume-assertion'
diff --git a/config/routes/smoketest/demo.yaml b/config/routes/smoketest/demo.yaml
@@ -0,0 +1,3 @@
+controllers:
+    resource: ../../../dev/Controller/
+    type: attribute
diff --git a/config/services_dev.yaml b/config/services_dev.yaml
@@ -18,8 +18,8 @@ services:
 
   Dev\Mock\MockConfiguration:
     arguments:
-      $identityProviderEntityId: 'https://azuremfa.stepup.example.com/mock/idp/metadata'
-      $serviceProviderEntityId: 'https://azuremfa.stepup.example.com/saml/metadata'
+      $identityProviderEntityId: 'https://azuremfa.dev.openconext.local/mock/idp/metadata'
+      $serviceProviderEntityId: 'https://azuremfa.dev.openconext.local/saml/metadata'
       $privateKeyPath: '%saml_idp_privatekey%'
       $publicCertPath: '%saml_idp_publickey%'
 
diff --git a/config/services_smoketest.yaml b/config/services_smoketest.yaml
@@ -0,0 +1,31 @@
+services:
+    _defaults:
+        autowire: true
+        autoconfigure: true
+
+    Surfnet\AzureMfa\Test\Features\:
+        resource: '../tests/Functional/Features/*'
+        exclude:
+            - '../tests/Functional/Features/bootstrap'
+
+    # makes classes in src/ available to be used as services
+    # this creates a service per class whose id is the fully-qualified class name
+    Dev\:
+        resource: '../dev/*'
+        exclude: '../dev/{DependencyInjection,Entity,Migrations,Tests,Kernel.php}'
+
+    # controllers are imported separately to make sure services can be injected
+    # as action arguments even if you don't extend any base controller class
+    Dev\Controller\:
+        resource: '../dev/Controller'
+        tags: ['controller.service_arguments']
+
+    Dev\Mock\MockConfiguration:
+        arguments:
+            $identityProviderEntityId: 'https://azuremfa.dev.openconext.local/mock/idp/metadata'
+            $serviceProviderEntityId: 'https://azuremfa.dev.openconext.local/saml/metadata'
+            $privateKeyPath: '%saml_idp_privatekey%'
+            $publicCertPath: '%saml_idp_publickey%'
+
+    # add more service definitions when explicit configuration is needed
+    # please note that last definitions always *replace* previous ones
diff --git a/dev/Controller/MockAzureMfaController.php b/dev/Controller/MockAzureMfaController.php
@@ -43,7 +43,7 @@ public function __construct(
     #[Route(path: '/mock/sso', name: 'mock_sso')]
     public function sso(Request $request): SymfonyResponse
     {
-        if (!in_array($this->getParameter('kernel.environment'), ['test', 'dev'])) {
+        if (!in_array($this->getParameter('kernel.environment'), ['test', 'dev', 'smoketest'])) {
             throw new Exception('Invalid environment encountered.');
         }
 
diff --git a/src/Surfnet/AzureMfa/Domain/UserId.php b/src/Surfnet/AzureMfa/Domain/UserId.php
@@ -44,16 +44,17 @@ public function __construct(private readonly string $userId)
             throw new InvalidUserIdException('An empty id was specified');
         }
 
+        $emailAddress = $this->userId;
+
         $pos = strpos($userId, self::SEPARATOR);
-        if ($pos === false) {
-            throw new InvalidUserIdException('An invalid id was specified');
-        }
-        $emailAddress = substr($userId, $pos + 1);
-        $uniquePrefix = substr($userId, 0, $pos);
+        if ($pos !== false) {
+            $emailAddress = substr($userId, $pos + 1);
+            $uniquePrefix = substr($userId, 0, $pos);
 
-        $match = preg_match(self::VALID_UNIQUE_ID, $uniquePrefix);
-        if ($match !== 1) {
-            throw new InvalidUserIdException('An invalid id was specified');
+            $match = preg_match(self::VALID_UNIQUE_ID, $uniquePrefix);
+            if ($match !== 1) {
+                throw new InvalidUserIdException('An invalid id was specified');
+            }
         }
 
         try {
diff --git a/src/Surfnet/AzureMfa/Infrastructure/Controller/DefaultController.php b/src/Surfnet/AzureMfa/Infrastructure/Controller/DefaultController.php
@@ -28,6 +28,7 @@
 use Surfnet\AzureMfa\Domain\UserId;
 use Surfnet\AzureMfa\Infrastructure\Form\EmailAddressDto;
 use Surfnet\AzureMfa\Infrastructure\Form\EmailAddressType;
+use Surfnet\GsspBundle\Exception\NotFound;
 use Surfnet\GsspBundle\Service\AuthenticationService;
 use Surfnet\GsspBundle\Service\RegistrationService;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
@@ -80,11 +81,15 @@ public function registration(Request $request): RedirectResponse|Response
             return $this->registrationService->replyToServiceProvider();
         }
 
-        $attribs = $this->authenticationService->getGsspUserAttributes();
-        if ($attribs && $attribs->getAttributeValue('urn:mace:dir:attribute-def:mail')) {
-            $emailAddr = new EmailAddress($attribs->getAttributeValue('urn:mace:dir:attribute-def:mail'));
-            $user = $this->azureMfaService->startRegistration($emailAddr);
-            return new RedirectResponse($this->azureMfaService->createAuthnRequest($user));
+        try {
+            $attribs = $this->authenticationService->getGsspUserAttributes();
+            if ($attribs && $attribs->getAttributeValue('urn:mace:dir:attribute-def:mail')) {
+                $emailAddr = new EmailAddress($attribs->getAttributeValue('urn:mace:dir:attribute-def:mail'));
+                $user = $this->azureMfaService->startRegistration($emailAddr);
+                return new RedirectResponse($this->azureMfaService->createAuthnRequest($user));
+            }
+        } catch (NotFound $e) {
+            $this->logger->info('No GSSP attributes were found, so we should ask for an email address');
         }
 
         $requiresRegistration = $this->registrationService->registrationRequired();
diff --git a/templates/dev/mock-acs.html.twig b/templates/dev/mock-acs.html.twig
@@ -14,6 +14,12 @@
     "value": [
         "test@stepup.example.com"
     ]
+},
+{
+    "name": "http://schemas.microsoft.com/claims/authnmethodsreferences",
+    "value": [
+        "http://schemas.microsoft.com/claims/multipleauthn"
+    ]
 }
 ]
         </textarea>
diff --git a/tests/Functional/Features/Context/ErrorReportContext.php b/tests/Functional/Features/Context/ErrorReportContext.php
@@ -32,7 +32,7 @@
 /**
  * Generates a HTML/png error output report when a build fails.
  */
-final class ErrorReportContext implements Context
+class ErrorReportContext implements Context
 {
 
     /**
diff --git a/tests/Functional/Features/Context/WebContext.php b/tests/Functional/Features/Context/WebContext.php
@@ -59,7 +59,6 @@ class WebContext implements Context
 
     public function __construct(
         private readonly KernelInterface $kernel,
-        private readonly IdentityProvider $identityProvider,
         BridgeContainer $bridgeContainer
     ) {
         ContainerSingleton::setContainer($bridgeContainer);
@@ -111,11 +110,6 @@ public function callIdentityProviderSSOActionWithAuthnRequest()
         $this->minkContext->pressButton('Login');
     }
 
-    public function getIdentityProvider(): IdentityProvider
-    {
-        return $this->identityProvider;
-    }
-
     /**
      * @return \Surfnet\SamlBundle\Entity\ServiceProvider
      *
@@ -130,23 +124,22 @@ public function getServiceProvider()
     }
 
     /**
-     * @Given /^a normal SAML 2.0 AuthnRequest form a unknown service provider$/
+     * @Given /^a normal SAML 2.0 AuthnRequest from an unknown service provider$/
      *
      * @throws \Exception
      */
-    public function aNormalSAMLAuthnRequestFormAUnknownServiceProvider()
+    public function aNormalSAMLAuthnRequestFromAnUnknownServiceProvider()
     {
         $authnRequest = new AuthnRequest();
         $authnRequest->setAssertionConsumerServiceURL('https://unkown_service_provider/saml/acs');
-        $authnRequest->setDestination($this->getIdentityProvider()->getSsoUrl());
+        $authnRequest->setDestination('/saml/sso');
         $issuer = new Issuer();
         $issuer->setValue('https://unkown_service_provider/saml/metadata');
         $authnRequest->setIssuer($issuer);
         $authnRequest->setProtocolBinding(Constants::BINDING_HTTP_REDIRECT);
 
-        // Sign with random key, does not mather for now.
         $authnRequest->setSignatureKey(
-            $this->loadPrivateKey($this->getIdentityProvider()->getPrivateKey(PrivateKey::NAME_DEFAULT))
+            $this->loadPrivateKey(new PrivateKey('/config/azuremfa/azuremfa_idp.key', 'default'))
         );
 
         $request = Saml2AuthnRequest::createNew($authnRequest);
@@ -183,9 +176,8 @@ public function iSendARegistrationRequestRequestTo($destination)
         $authnRequest->setIssuer($issuer);
         $authnRequest->setProtocolBinding(Constants::BINDING_HTTP_REDIRECT);
 
-        // Sign with random key, does not mather for now.
         $authnRequest->setSignatureKey(
-            $this->loadPrivateKey($this->getIdentityProvider()->getPrivateKey(PrivateKey::NAME_DEFAULT))
+            $this->loadPrivateKey(new PrivateKey('/config/azuremfa/azuremfa_idp.key', 'default'))
         );
 
         $request = Saml2AuthnRequest::createNew($authnRequest);
@@ -209,9 +201,9 @@ public function iSendAnAuthenticationRequestRequestToWithNameID($destination, $n
         $authnRequest->setNameId($nameIdVo);
         $authnRequest->setProtocolBinding(Constants::BINDING_HTTP_REDIRECT);
         $authnRequest->setRequesterID(['https://azuremfa.dev.openconext.local/saml/metadata']);
-        // Sign with random key, does not mather for now.
+
         $authnRequest->setSignatureKey(
-            $this->loadPrivateKey($this->getIdentityProvider()->getPrivateKey(PrivateKey::NAME_DEFAULT))
+            $this->loadPrivateKey(new PrivateKey('/config/azuremfa/azuremfa_idp.key', 'default'))
         );
 
         $request = Saml2AuthnRequest::createNew($authnRequest);
diff --git a/tests/Functional/Features/authentication.feature b/tests/Functional/Features/authentication.feature
@@ -8,6 +8,7 @@ Feature: When an user needs to authenticate
     Given the login with Azure MFA succeeds and the following attributes are released:
       | name                                                       | value                     |
       | urn:mace:dir:attribute-def:mail                            | user@dev.openconext.local |
+      | http://schemas.microsoft.com/claims/authnmethodsreferences | http://schemas.microsoft.com/claims/multipleauthn |
     Then I should be on "https://azuremfa.dev.openconext.local/saml/sso_return"
     And the SAML Response should contain element "StatusCode" with attribute "Value" with attribute value "urn:oasis:names:tc:SAML:2.0:status:Success"
     And the SAML Response should contain element "NameID" with value "q2b27d-0000|user@dev.openconext.local"
diff --git a/tests/Functional/Features/registration.feature b/tests/Functional/Features/registration.feature
diff --git a/tests/Functional/Features/sp_authentication.feature b/tests/Functional/Features/sp_authentication.feature
diff --git a/tests/Functional/Features/sp_authentication_auth_only.feature b/tests/Functional/Features/sp_authentication_auth_only.feature
diff --git a/tests/Functional/Features/sp_registration.feature b/tests/Functional/Features/sp_registration.feature
diff --git a/tests/Unit/Domain/UserIdTest.php b/tests/Unit/Domain/UserIdTest.php

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+controllers:`
	`2`	`+ resource: ../../../dev/Controller/`
	`3`	`+ type: attribute`
Original file line number	Diff line number	Diff line change
`@@ -43,7 +43,7 @@ public function __construct(`
`43`	`43`	`#[Route(path: '/mock/sso', name: 'mock_sso')]`
`44`	`44`	`public function sso(Request $request): SymfonyResponse`
`45`	`45`	`{`
`46`		`- if (!in_array($this->getParameter('kernel.environment'), ['test', 'dev'])) {`
	`46`	`+ if (!in_array($this->getParameter('kernel.environment'), ['test', 'dev', 'smoketest'])) {`
`47`	`47`	`throw new Exception('Invalid environment encountered.');`
`48`	`48`	`}`
`49`	`49`