Strict specs enforcement

E14: AllowCreate

Author: tvdijen

src/XML/samlp/NameIDPolicy.php

@@ -6,7 +6,9 @@
 
 use DOMElement;
 use SimpleSAML\SAML2\Assert\Assert;
+use SimpleSAML\SAML2\Constants as C;
 use SimpleSAML\SAML2\Exception\ArrayValidationException;
+use SimpleSAML\SAML2\Exception\ProtocolViolationException;
 use SimpleSAML\SAML2\Type\SAMLAnyURIValue;
 use SimpleSAML\SAML2\Type\SAMLStringValue;
 use SimpleSAML\XML\ArrayizableElementInterface;
@@ -45,6 +47,18 @@ public function __construct(
         protected ?SAMLStringValue $SPNameQualifier = null,
         protected ?BooleanValue $AllowCreate = null,
     ) {
+        if ($AllowCreate->equals(BooleanValue::fromBoolean(true)) {
+            // Per Errata E14: AllowCreate
+            Assert::notSame(
+                $Format->getValue(),
+                C::NAMEID_TRANSIENT,
+                ProtocolViolationException::class,
+                sprintf(
+                    'AllowCreate=\"true\" MUST NOT be used in conjunction with the %s <NameID> Format.',
+                    C::NAMEID_TRANSIENT,
+                ),
+            );
+        }
     }
 
 

tests/SAML2/XML/samlp/NameIDPolicyTest.php

@@ -8,6 +8,7 @@
 use PHPUnit\Framework\Attributes\Group;
 use PHPUnit\Framework\TestCase;
 use SimpleSAML\SAML2\Constants as C;
+use SimpleSAML\SAML2\Exception\ProtocolViolationException;
 use SimpleSAML\SAML2\Type\SAMLAnyURIValue;
 use SimpleSAML\SAML2\Type\SAMLStringValue;
 use SimpleSAML\SAML2\XML\samlp\AbstractSamlpElement;
@@ -103,4 +104,19 @@ public function testMarshallingEmptyElement(): void
         );
         $this->assertTrue($nameIdPolicy->isEmptyElement());
     }
+
+
+    /**
+     * Illegal combination of AllowCreate=true and transient NameID format is rejected.
+     */
+    public function testIllegalCombinationThrowsException(): void
+    {
+        $this->expectException(ProtocolViolationException::class);
+
+        new NameIDPolicy(
+            SAMLAnyURIValue::fromString(C::NAMEID_TRANSIENT),
+            SAMLStringValue::fromString('urn:x-simplesamlphp:spnamequalifier'),
+            BooleanValue::fromBoolean(true),
+        );
+    }
 }