PHP怎样处理SAML元数据更新 SAML元数据处理技巧分享

<?php

use RobRichards\XMLSecLibs\XMLSecurityDSig;
use RobRichards\XMLSecLibs\XMLSecurityKey;

// 从URL获取元数据
$metadataURL = 'https://idp.example.com/metadata';
$metadata = file_get_contents($metadataURL);

// 加载XML文档
$dom = new DOMDocument();
$dom->loadXML($metadata);

$security = new XMLSecurityDSig();
$security->locateSignature($dom);

$key = new XMLSecurityKey(XMLSecurityKey::RSA_SHA256, ['type' => 'public']);

// 从元数据中加载公钥 (这部分需要根据实际元数据结构调整)
$keyInfo = $security->locateKeyInfo();
if ($keyInfo) {
    $x509Data = $keyInfo->getElementsByTagName('X509Data')->item(0);
    if ($x509Data) {
        $x509Certificate = $x509Data->getElementsByTagName('X509Certificate')->item(0);
        if ($x509Certificate) {
            $publicKey = trim($x509Certificate->textContent);
            $key->loadKey($publicKey);
        }
    }
}

// 验证签名
$result = $security->verify($dom, $key);

if ($result == 1) {
    echo "Metadata signature is valid.\n";
    // 元数据有效，可以继续处理
} else {
    echo "Metadata signature is invalid.\n";
    // 元数据无效，停止处理
}

?>

<?php

// ... (之前的签名验证代码) ...

// 比较新元数据和本地存储的元数据
$localMetadataFile = '/path/to/local/metadata.xml';
$localMetadata = file_get_contents($localMetadataFile);

if ($metadata !== $localMetadata) {
    // 元数据已更新，保存新元数据
    file_put_contents($localMetadataFile, $metadata);
    echo "Metadata updated successfully.\n";
} else {
    echo "Metadata is up to date.\n";
}

?>