refactor(SOAPClient): use XMLSchema AnyURIValue for SOAP destination URI

Author: ioigoume

src/SOAPClient.php

@@ -9,7 +9,6 @@
 use RobRichards\XMLSecLibs\XMLSecurityKey;
 use SimpleSAML\Configuration;
 use SimpleSAML\SAML2\Compat\ContainerSingleton;
-use SimpleSAML\SAML2\Type\SAMLAnyURIValue;
 use SimpleSAML\SAML2\XML\samlp\AbstractMessage;
 use SimpleSAML\SAML2\XML\samlp\MessageFactory;
 use SimpleSAML\SOAP11\Utils\XPath;
@@ -20,6 +19,7 @@
 use SimpleSAML\Utils\Crypto;
 use SimpleSAML\XML\Chunk;
 use SimpleSAML\XML\DOMDocumentFactory;
+use SimpleSAML\XMLSchema\Type\AnyURIValue;
 use SoapClient as BuiltinSoapClient;
 
 use function chunk_split;
@@ -201,21 +201,24 @@ protected function createSoapClient(array $options): BuiltinSoapClient
     /**
      * Wrapper around __doRequest(), overridable for testing.
      *
+     * NOTE: $destination is a generic xs:anyURI value (XMLSchema), since the SOAP endpoint URI
+     * is transport-level and not necessarily subject to SAML-layer URI restrictions.
+     *
      * @param \SoapClient $client
      * @param string|null $request
-     * @param \SimpleSAML\SAML2\Type\SAMLAnyURIValue $destination
+     * @param \SimpleSAML\XMLSchema\Type\AnyURIValue $destination
      * @param string $action
      * @return string
      */
     protected function doSoapRequest(
         BuiltinSoapClient $client,
         ?string $request,
-        SAMLAnyURIValue $destination,
+        AnyURIValue $destination,
         string $action,
     ): string {
         return (string) $client->__doRequest(
             $request,
-            (string)$destination,
+            (string) $destination,
             $action,
             SOAP_1_1,
         );

tests/SAML2/SOAPClientTest.php

@@ -14,6 +14,7 @@
 use SimpleSAML\SAML2\SOAPClient;
 use SimpleSAML\SAML2\Type\SAMLAnyURIValue;
 use SimpleSAML\SAML2\XML\samlp\AbstractMessage;
+use SimpleSAML\XMLSchema\Type\AnyURIValue;
 use SimpleSAML\XMLSecurity\TestUtils\PEMCertificatesMock;
 
 /**
@@ -134,7 +135,7 @@ protected function createSoapClient(array $options): \SoapClient
             protected function doSoapRequest(
                 \SoapClient $client,
                 ?string $request,
-                SAMLAnyURIValue $destination,
+                AnyURIValue $destination,
                 string $action,
             ): string {
                 throw new \LogicException('doSoapRequest() should not be called when destination is missing.');
@@ -159,6 +160,11 @@ protected function doSoapRequest(
     #[DataProvider('provideBadSoapResponses')]
     public function testSendThrowsOnEmptySoapResponseOrSoapFault(string $soapResponse, string $expectedMessage): void
     {
+        /**
+         * Use SAMLAnyURIValue here because AbstractMessage::getDestination() is typed to return it, and PHPUnit
+         * enforces return-type compatibility on stubs. SAMLAnyURIValue still works for SOAP transport because
+         * it extends AnyURIValue.
+         */
         $destination = SAMLAnyURIValue::fromString('https://example.org/soap-endpoint');
 
         $client = new class ($soapResponse) extends SOAPClient {
@@ -182,7 +188,7 @@ protected function createSoapClient(array $options): \SoapClient
             protected function doSoapRequest(
                 \SoapClient $client,
                 ?string $request,
-                SAMLAnyURIValue $destination,
+                AnyURIValue $destination,
                 string $action,
             ): string {
                 return $this->soapResponse;