Skip to content

Commit 89a3d5e

Browse files
jazzsequencejazzsequence
authored
SITE-4575: Update SimpleSAMLphp security requirements to 2.3.7. (#402)
updates the SimpleSAMLphp security requirements to recommend version 2.3.7 as the minimum secure version, while maintaining 2.0.0 as the critical security threshold for CVE-2023-26881
1 parent 5064c75 commit 89a3d5e

34 files changed

Lines changed: 1921 additions & 675 deletions

‎.circleci/config.yml‎

Lines changed: 116 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,15 @@ workflows:
33
version: 2
44
main:
55
jobs:
6-
- test-behat
6+
- test-behat:
7+
name: "Test with SimpleSAMLphp 1.18.0"
8+
simplesamlphp_version: "1.18.0"
9+
- test-behat:
10+
name: "Test with SimpleSAMLphp 2.0.0"
11+
simplesamlphp_version: "2.0.0"
12+
- test-behat:
13+
name: "Test with SimpleSAMLphp 2.4.0"
14+
simplesamlphp_version: "2.4.0"
715
- test-phpunit:
816
name: "Test with PHP 7.4"
917
php_version: "7.4"
@@ -16,6 +24,11 @@ workflows:
1624
- test-phpunit:
1725
name: "Test with PHP 8.2"
1826
php_version: "8.2"
27+
- behat-cleanup:
28+
requires:
29+
- "Test with SimpleSAMLphp 1.18.0"
30+
- "Test with SimpleSAMLphp 2.0.0"
31+
- "Test with SimpleSAMLphp 2.4.0"
1932
nightly:
2033
triggers:
2134
- schedule:
@@ -25,32 +38,57 @@ workflows:
2538
only:
2639
- master
2740
jobs:
28-
- test-behat
41+
- test-behat:
42+
name: "Test with SimpleSAMLphp 1.18.0"
43+
simplesamlphp_version: "1.18.0"
44+
- test-behat:
45+
name: "Test with SimpleSAMLphp 2.0.0"
46+
simplesamlphp_version: "2.0.0"
47+
- test-behat:
48+
name: "Test with SimpleSAMLphp 2.4.0"
49+
simplesamlphp_version: "2.4.0"
50+
- behat-cleanup:
51+
requires:
52+
- "Test with SimpleSAMLphp 1.18.0"
53+
- "Test with SimpleSAMLphp 2.0.0"
54+
- "Test with SimpleSAMLphp 2.4.0"
2955
jobs:
3056
test-behat:
57+
parameters:
58+
simplesamlphp_version:
59+
type: enum
60+
enum:
61+
- "1.18.0"
62+
- "2.0.0"
63+
- "2.4.0"
3164
working_directory: ~/pantheon-systems/wp-saml-auth
32-
parallelism: 1
3365
docker:
3466
- image: quay.io/pantheon-public/build-tools-ci:8.x-php8.2
3567
steps:
3668
- checkout
3769
- restore_cache:
3870
keys:
39-
- test-behat-dependencies-{{ checksum "composer.json" }}
40-
- run: composer install -n --prefer-dist
41-
- save_cache:
42-
key: test-behat-dependencies-{{ checksum "composer.json" }}
71+
- composer-cache-v1-{{ checksum "composer.lock" }}
72+
- composer-cache-v1-
73+
- run:
74+
name: Install Composer dependencies
75+
command: composer install -n --prefer-dist
76+
- save_cache: # Save composer's internal cache
77+
key: composer-cache-v1-{{ checksum "composer.lock" }}
4378
paths:
4479
- vendor
4580
- run: echo $(openssl rand -hex 8) > /tmp/WORDPRESS_ADMIN_PASSWORD
46-
- run: |
47-
echo 'export TERMINUS_ENV=ci-$CIRCLE_BUILD_NUM' >> $BASH_ENV
48-
echo 'export TERMINUS_SITE=wp-saml-auth' >> $BASH_ENV
49-
echo 'export SITE_ENV=wp-saml-auth.ci-$CIRCLE_BUILD_NUM' >> $BASH_ENV
50-
echo 'export WORDPRESS_ADMIN_USERNAME=pantheon' >> $BASH_ENV
51-
echo 'export WORDPRESS_ADMIN_EMAIL=no-reply@getpantheon.com' >> $BASH_ENV
52-
echo 'export WORDPRESS_ADMIN_PASSWORD=$(cat /tmp/WORDPRESS_ADMIN_PASSWORD)' >> $BASH_ENV
53-
source $BASH_ENV
81+
- run:
82+
name: Set environment variables
83+
command: |
84+
echo 'export TERMINUS_ENV=ci-$CIRCLE_BUILD_NUM' >> $BASH_ENV
85+
echo 'export TERMINUS_SITE=wp-saml-auth' >> $BASH_ENV
86+
echo 'export SITE_ENV=wp-saml-auth.ci-$CIRCLE_BUILD_NUM' >> $BASH_ENV
87+
echo 'export WORDPRESS_ADMIN_USERNAME=pantheon' >> $BASH_ENV
88+
echo 'export WORDPRESS_ADMIN_EMAIL=no-reply@getpantheon.com' >> $BASH_ENV
89+
echo 'export WORDPRESS_ADMIN_PASSWORD=$(cat /tmp/WORDPRESS_ADMIN_PASSWORD)' >> $BASH_ENV
90+
echo 'export SIMPLESAMLPHP_VERSION="<< parameters.simplesamlphp_version >>"' >> $BASH_ENV
91+
source $BASH_ENV
5492
- run: echo "StrictHostKeyChecking no" >> "$HOME/.ssh/config"
5593
- run: |
5694
if [ -z "$GITHUB_TOKEN" ]; then
@@ -67,12 +105,62 @@ jobs:
67105
exit 0
68106
fi
69107
terminus auth:login --machine-token=$TERMINUS_TOKEN
70-
- run: ./bin/validate-fixture-version.sh
71-
- run: ./bin/behat-prepare.sh
72-
- run: ./bin/behat-test.sh --strict
73108
- run:
74-
command: ./bin/behat-cleanup.sh
75-
when: always
109+
name: Save environment name for cleanup
110+
command: |
111+
echo "wp-saml-auth.ci-$CIRCLE_BUILD_NUM" > "/tmp/site_env_<< parameters.simplesamlphp_version >>.txt"
112+
- persist_to_workspace:
113+
root: /tmp
114+
paths:
115+
- "site_env_<< parameters.simplesamlphp_version >>.txt"
116+
- run:
117+
name: Validate fixture version
118+
command: ./bin/validate-fixture-version.sh
119+
- run:
120+
name: Prepare and run Behat tests
121+
command: |
122+
set -e
123+
source $BASH_ENV
124+
125+
# Prepare fixture environment for tests.
126+
if [ << parameters.simplesamlphp_version >> != '1.18.0' ]; then
127+
./bin/behat-prepare.sh
128+
else
129+
./bin/1.18/behat-prepare-simplesaml1.18.0.sh
130+
fi
131+
132+
echo ""
133+
echo "=========================================================================="
134+
echo "Running Behat on https://${TERMINUS_ENV}-${TERMINUS_SITE}.pantheonsite.io/wp-login.php"
135+
echo "with SimpleSAMLphp version $SIMPLESAMLPHP_VERSION"
136+
echo "=========================================================================="
137+
echo ""
138+
./bin/behat-test.sh --strict
139+
behat-cleanup:
140+
docker:
141+
- image: quay.io/pantheon-public/build-tools-ci:8.x-php8.2
142+
working_directory: ~/pantheon-systems/wp-saml-auth
143+
steps:
144+
- attach_workspace:
145+
workspace: ~/workspace
146+
at: /tmp/behat-envs
147+
- checkout
148+
- run:
149+
name: Set environment variables
150+
command: |
151+
echo 'export TERMINUS_SITE=wp-saml-auth' >> $BASH_ENV
152+
echo 'export TERMINUS_ENV=ci-$CIRCLE_BUILD_NUM' >> $BASH_ENV
153+
echo 'export SITE_ENV=wp-saml-auth.ci-$CIRCLE_BUILD_NUM' >> $BASH_ENV
154+
source $BASH_ENV
155+
- run: |
156+
if [ -z "$TERMINUS_TOKEN" ]; then
157+
echo "TERMINUS_TOKEN environment variables missing; assuming unauthenticated build"
158+
exit 0
159+
fi
160+
terminus auth:login --machine-token=$TERMINUS_TOKEN
161+
- run:
162+
name: Run Cleanup Script
163+
command: ./bin/behat-cleanup.sh
76164
test-phpunit:
77165
parameters:
78166
php_version:
@@ -94,7 +182,10 @@ jobs:
94182
- restore_cache:
95183
keys:
96184
- test-phpunit-dependencies-{{ checksum "composer.json" }}
97-
- run: composer update && composer install -n --prefer-dist
185+
- run: |
186+
composer update
187+
composer install -n --prefer-dist
188+
chmod +x bin/*.sh
98189
- save_cache:
99190
key: test-phpunit-dependencies-{{ checksum "composer.json" }}
100191
paths:
@@ -110,12 +201,11 @@ jobs:
110201
sudo docker-php-ext-enable imagick
111202
sudo docker-php-ext-install mysqli
112203
sudo apt-get install mariadb-client
204+
curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
205+
chmod +x wp-cli.phar
206+
sudo mv wp-cli.phar /usr/local/bin/wp
113207
- run:
114208
name: "Run Tests"
115209
command: |
116-
bash bin/install-wp-tests.sh wordpress_test root '' 127.0.0.1 latest
117-
composer phpunit
118-
WP_MULTISITE=1 composer phpunit
119-
rm -rf $WP_TESTS_DIR $WP_CORE_DIR
120-
bash bin/install-wp-tests.sh wordpress_test root '' 127.0.0.1 nightly true
210+
composer test:install:withdb
121211
composer phpunit

‎.github/workflows/lint-test.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,13 @@ jobs:
2929
run: |
3030
composer install
3131
composer lint
32+
shellcheck:
33+
name: ShellCheck
34+
runs-on: ubuntu-latest
35+
steps:
36+
- name: Checkout
37+
uses: actions/checkout@v4
38+
- name: Run ShellCheck
39+
run: |
40+
shellcheck --version
41+
shellcheck bin/*.sh

‎.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,10 @@ wp-cli.local.yml
33
/node_modules/
44
/simplesamlphp/
55
/vendor/
6+
7+
# PHPUnit Helpers
8+
bin/helpers.sh
9+
bin/install-wp-tests.sh
10+
bin/install-local-tests.sh
11+
bin/phpunit-test.sh
12+
.phpunit*

‎README.md‎

Lines changed: 46 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
# WP SAML Auth #
2-
**Contributors:** [getpantheon](https://profiles.wordpress.org/getpantheon/), [danielbachhuber](https://profiles.wordpress.org/danielbachhuber/), [outlandish-josh](https://profiles.wordpress.org/outlandish-josh/), [jazzs3quence](https://profiles.wordpress.org/jazzs3quence/)
2+
**Contributors:** [getpantheon](https://profiles.wordpress.org/getpantheon/), [danielbachhuber](https://profiles.wordpress.org/danielbachhuber/), [outlandish-josh](https://profiles.wordpress.org/outlandish-josh/), [jazzs3quence](https://profiles.wordpress.org/jazzs3quence/), [lcatlett](https://profiles.wordpress.org/lcatlett/)
33
**Tags:** authentication, SAML
4-
**Requires at least:** 4.4
5-
**Tested up to:** 6.3
4+
**Requires at least:** 6.4
5+
**Tested up to:** 6.8.1
66
**Requires PHP:** 7.3
7-
**Stable tag:** 2.1.5-dev
7+
**Stable tag:** 2.2.0-dev
88
**License:** GPLv2 or later
99
**License URI:** http://www.gnu.org/licenses/gpl-2.0.html
1010

@@ -40,6 +40,8 @@ If you're connecting directly to an existing IdP, you should use the bundled One
4040

4141
If you have more complex authentication needs, then you can also use a SimpleSAMLphp installation running in the same environment. These settings are not configurable through the WordPress backend; they'll need to be defined with a filter. And, if you have a filter in place, the WordPress backend settings will be removed.
4242

43+
**Note:** A security vulnerability was found in SimpleSAMLphp versions 2.0.0 and below. It is highly recommended if you are using SimpleSAMLphp with WP SAML Auth that you update your SimpleSAMLphp library to 2.4.0 or above. (See [CVE-2025-27773](https://nvd.nist.gov/vuln/detail/CVE-2025-27773) and [The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect bindings](https://github.com/advisories/GHSA-46r4-f8gj-xg56) for more information.)
44+
4345
Additional explanation of each setting can be found in the code snippet below.
4446

4547
To install SimpleSAMLphp locally for testing purposes, the [Identity Provider QuickStart](https://simplesamlphp.org/docs/stable/simplesamlphp-idp) is a good place to start. On Pantheon, the SimpleSAMLphp web directory needs to be symlinked to `~/code/simplesaml` to be properly handled by Nginx. [Read the docs](https://pantheon.io/docs/shibboleth-sso/) for more details about configuring SimpleSAMLphp on Pantheon.
@@ -201,6 +203,28 @@ If you need to adapt authentication behavior based on the SAML response, you can
201203
return $ret;
202204
}, 10, 2 );
203205

206+
If you have installed SimpleSAMLphp to a non-default path, you can set that path via the `wp_saml_auth_simplesamlphp_path_array` filter. By default, it is assumed that SimpleSAMLphp is installed into one of the following paths:
207+
* `ABSPATH . 'simplesaml'`
208+
* `ABSPATH . 'private/simplesamlphp'`
209+
* `ABSPATH . 'simplesamlphp'`
210+
211+
```php
212+
add_filter( 'wp_saml_auth_simplesamlphp_path_array', function( $simplesamlphp_path_array ) {
213+
// Override default paths with a defined path.
214+
return [ ABSPATH . 'path/to/simplesamlphp' ];
215+
}
216+
```
217+
218+
You can also define an explicit path to the SimpleSAMLphp autoloader file (defaults to the `lib/_autoload.php` file under the SimpleSAMLphp path) with the `wp_saml_auth_ssp_autoloader` filter.
219+
220+
```php
221+
add_filter( 'wp_saml_auth_ssp_autoloader', function( $ssp_autoloader ) {
222+
if ( ! file_exists( $ssp_autoloader ) ) {
223+
return ABSPATH . 'path/to/simplesamlphp/autoload.php';
224+
}
225+
}
226+
```
227+
204228
## WP-CLI Commands ##
205229

206230
This plugin implements a variety of [WP-CLI](https://wp-cli.org) commands. All commands are grouped into the `wp saml-auth` namespace.
@@ -233,6 +257,16 @@ See [CONTRIBUTING.md](https://github.com/pantheon-systems/wp-saml-auth/blob/mast
233257
### Reporting Security Bugs
234258
Please report security bugs found in the WP SAML Auth plugin's source code through the [Patchstack Vulnerability Disclosure Program](https://patchstack.com/database/vdp/wp-saml-auth). The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
235259

260+
## Security Requirements
261+
262+
### SimpleSAMLphp Version
263+
264+
If you're using the SimpleSAMLphp connection type:
265+
- **Critical Security Requirement:** Version 2.0.0 or later is required to fix CVE-2023-26881 (XML signature validation bypass vulnerability).
266+
- **Recommended Security Requirement:** Version 2.3.7 or later is recommended for additional security fixes.
267+
- Authentication will be blocked for versions below 2.0.0 when "Enforce Security Requirements" is enabled.
268+
- It's always recommended to use the latest stable version of SimpleSAMLphp for security and compatibility.
269+
236270
## Frequently Asked Questions ##
237271

238272
### Can I update an existing WordPress user's data when they log back in? ###
@@ -272,13 +306,20 @@ There is no third step. Because SimpleSAMLphp loads WordPress, which has WP Nati
272306

273307
## Upgrade Notice ##
274308

309+
### 2.2.0 ###
310+
WP SAML Auth 2.2.0 requires WordPress version 6.4 or later.
311+
312+
SimpleSAMLphp recommended version is 2.3.7 or later for `simplesamlphp` SAML authentication type. With "Enforce Security Requirements" enabled, SimpleSAMLphp versions below 2.0.0 will be blocked. 2.0.0 or later is required to fix CVE-2023-26881 (XML signature validation bypass vulnerability).
313+
275314
### 2.0.0 ###
276315
Minimum supported PHP version is 7.3.
277316

278317
## Changelog ##
279318

280-
### 2.1.5-dev ###
319+
### 2.2.0-dev ###
281320
* Add a hook to modify returned attributes. [[#379](https://github.com/pantheon-systems/wp-saml-auth/pull/379/)] (props @anthonybaxter-uwu)
321+
* Updates [`onelogin/php-saml`](https://github.com/SAML-Toolkits/php-saml) to 4.2.0. [[#402](https://github.com/pantheon-systems/wp-saml-auth/pull/402/)]
322+
* Adds warnings and the option to disable SAML when using a vulnerable version of simplesamlphp [[#402](https://github.com/pantheon-systems/wp-saml-auth/pull/402/)]
282323

283324
### 2.1.4 (November 27, 2023) ###
284325
* Fix typo in the label for the certificate path [[#352](https://github.com/pantheon-systems/wp-saml-auth/pull/352)]

‎bin/1.18/1-adminnotice.feature‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
Feature: Admin Notice for SimpleSAMLphp 1.18 Vulnerability
2+
In order to ensure administrators are aware of critical security issues
3+
As a site administrator
4+
I need to see an admin notice regarding the SimpleSAMLphp vulnerability
5+
6+
Scenario: Admin user sees the SimpleSAMLphp vulnerability notice
7+
Given I log in as an admin
8+
Then I should be on "/wp-admin/"
9+
And I should see "Security Alert:" in the "div.notice.notice-error[data-slug='wp-saml-auth'][data-type='simplesamlphp-critical-vulnerability']" element
10+
And I should see "The SimpleSAMLphp version used by the WP SAML Auth plugin (1.18.4) has a critical security vulnerability (CVE-2023-26881). Please update to version 2.0.0 or later. Learn more." in the "div.notice.notice-error[data-slug='wp-saml-auth'][data-type='simplesamlphp-critical-vulnerability'] p" element
11+
And I go to "/wp-admin/options-general.php"
12+
Then I should see "Security Alert:" in the "div.notice.notice-error[data-slug='wp-saml-auth'][data-type='simplesamlphp-critical-vulnerability']" element
13+
And I should see "The SimpleSAMLphp version used by the WP SAML Auth plugin (1.18.4) has a critical security vulnerability (CVE-2023-26881)" in the "div.notice.notice-error[data-slug='wp-saml-auth'] p" element

bin/fixtures/authsources.php.additions renamed to bin/1.18/authsources.php.additions

File renamed without changes.

0 commit comments

Comments
 (0)