title: OneLogin php saml - Issues with SAML response
body: <p>I have integrated OneLogin using php-saml to connect to our idp service. In our staging environment, everything works fine with the setup we are using. </p>
  
  <p>I am running into an issue using those same files on our production environment however. </p>
  
  <p>The problem is that the SAML response isn't correctly being validated with the <code>saml-schema-protocol-2.0.xsd</code> schema and is throwing errors about it.</p>
  
  <pre><code>$settingsInfo = array(
      'strict' =&gt; true,
      'debug' =&gt; false,
      'sp' =&gt; array(
          'entityId' =&gt; 'website',
          'assertionConsumerService' =&gt; array(
              'url' =&gt; "https://" . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'],
              'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
          ) ,
          'NameIDFormat' =&gt; 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified',
          'x509cert' =&gt; file_get_contents('tool-sso.pem', FILE_USE_INCLUDE_PATH) ,
          'privateKey' =&gt; file_get_contents('tool-sso.key', FILE_USE_INCLUDE_PATH) ,
      ) ,
      'idp' =&gt; array(
          'entityId' =&gt; 'https://sso.example.com',
          'singleSignOnService' =&gt; array(
              'url' =&gt; 'https://sso.example.com/idp/SSO.saml2',
              'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
          ) ,
          'singleLogoutService' =&gt; array(
              'url' =&gt; 'https://sso.example.com/idp/SSO.saml2',
              'binding' =&gt; 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
          ) ,
          'x509cert' =&gt; file_get_contents('sso.pem', FILE_USE_INCLUDE_PATH)
      ) ,
      'compress' =&gt; array(
          'requests' =&gt; true,
          'responses' =&gt; true
      ) ,
      'security' =&gt; array(
          'authnRequestsSigned' =&gt; true,
          'signatureAlgorithm' =&gt; 'http://www.w3.org/2001/04/xmldsig-more#rsa-sha256',
      )
  );
  </code></pre>
  
  <p>However, if I add the following line to the security settings, it works just fine:</p>
  
  <p><code>'wantXMLValidation' =&gt; false</code></p>
  
  <p>This makes me think that the SAML response we are getting back from idp is somehow not in the expected format as defined by the <code>xsd</code>.</p>
  
  <p>Any thoughts as to what might cause the <code>wantXMLValidation=true</code> to fail? Is it due to missing/additional/incorrect data in the SAML response or could the issue be with how we are sending data?</p>
  
  <p>I am trying to rule out idp as being the issue here but in order to keep our staging and production environments in sync, I want to get that <code>wantXMLValidation</code> flag set back to true.</p>
  
  <p>I have tried running the response against the <code>Validate XML with the XSD schema</code> <a href="https://www.samltool.com/validate_xml.php" rel="nofollow noreferrer">tool</a> and it comes back as valid xml.</p>
  
  <p>The specific error I am getting when XML Validation is on is as follows:</p>
  
  <pre><code>    Warning: DOMDocument::schemaValidate(): Invalid Schema in \\fileshare\root\resources\Classes\OneLogin\src\Saml2\Utils.php on line 135 failed to load external entity "/fileshare/root/resources/Classes/OneLogin/src/Saml2/schemas/xmldsig-core-schema.xsd" Element '{http://www.w3.org/2001/XMLSchema}import': Failed to locate a schema at location '/fileshare/root/resources/Classes/OneLogin/src/Saml2/schemas/xmldsig-core-schema.xsd'. Skipping the import. failed to load external entity "/fileshare/root/resources/Classes/OneLogin/src/Saml2/schemas/xenc-schema.xsd" Element '{http://www.w3.org/2001/XMLSchema}import': Failed to locate a schema at location '/fileshare/root/resources/Classes/OneLogin/src/Saml2/schemas/xenc-schema.xsd'. Skipping the import. Element '{http://www.w3.org/2001/XMLSchema}element', attribute 'ref': The QName value '{http://www.w3.org/2001/04/xmlenc#}EncryptedData' does not resolve to a(n) element declaration. Element '{http://www.w3.org/2001/XMLSchema}element', attribute 'ref': The QName value '{http://www.w3.org/2001/04/xmlenc#}EncryptedKey' does not resolve to a(n) element declaration. Invalid SAML Response. Not match the saml-schema-protocol-2.0.xsd
  invalid_response
  
  OneLogin\Saml2\Auth Object
  (
      [_settings:OneLogin\Saml2\Auth:private] =&gt; OneLogin\Saml2\Settings Object
  </code></pre>
  
  <p><strong>Environment:</strong></p>
  
  <p>My setup is a load balancer with 2 windows servers and a single file-share. User connects to LB, web-sever running PHP calls the onelogin PHP files from the file-share (not on the same server as the webservers). The only reason I bring this up is because I am wondering if there is something to do with how the <code>schemaLocations</code> are trying to read the <code>.xsd</code> files.</p>
  
  <p><strong>Update:</strong></p>
  
  <p>I may have figured this out, just not a better way to fix it.</p>
  
  <p>There is a function in the OneLogin file <code>Utils.php</code> called <code>validateXML</code> which loads the schema file that it compares the SAML response with. After some trial an error, I moved the schema files directly to the web server and not the file-share. After moving them and hardcoding the location of these schema files, the issue is resolved.</p>
  
  <pre><code>public static function validateXML($xml, $schema, $debug = false)
      {
          assert(is_string($xml) || $xml instanceof DOMDocument);
          assert(is_string($schema));
  
          libxml_clear_errors();
          libxml_use_internal_errors(true);
  
          if ($xml instanceof DOMDocument) {
              $dom = $xml;
          } else {
              $dom = new DOMDocument;
              $dom = self::loadXML($dom, $xml);
              if (!$dom) {
                  return 'unloaded_xml';
              }
          }
  
          //$schemaFile = __DIR__ . '/schemas/' . $schema;
          $schemaFile = 'file://C:\inetpub\wwwroot\config\schemas\\'. $schema;
  </code></pre>
  
  <p>Prior to this change, the schema file would have been looking at the fileshare for this xsd.</p>
  
  <p>I am not sure if this is a path issue with libXML not being able to read for a directory like this or whether its permissions etc.</p>
  
  <p>I would prefer to have the schemas in the same folder as <code>OneLogin</code> and not have to refer to them from the web-server itself. </p>
  
  <p>Anything stand out with my paths that I might be missing here?</p>