OKTA SAML Signature verfication - PHP

Question

My application (PHP) gets the SAML response back from OKTA which has the signature value and I also have OKTA's certificate which has the public key. My application does the following,

1. Gets the public key from the cert.
2. Gets the signature value from the SAML sent to it.
3. Now, it uses the function openssl_verify($data, $signature, $pubkeykey,"sha1WithRSAEncryption"); Since $data is the content used by OKTA to sign the saml response, I am not sure what $data has to set.

My Code,

$pubkeyid = openssl_pkey_get_details(openssl_pkey_get_public(file_get_contents("okta.cert")));
$pubkeyid = $pubkeyid["key"];
$signature = "<get it form SAML Response>";
$data = ???? (what should be provided) 
$ok = openssl_verify($data, $signature, $pubkeyid,"sha1WithRSAEncryption");

I always get 0 when I assign the value of data to be the SAML Response sent to the application. Am I missing something ?

Answer 1

SAML signature verification is much more then calling openssl_verify() function. I would suggest using some library for that purpose, like https://github.com/lightSAML/lightSAML.

In that case, using LightSAML-Core, signature validation can be done like explained on their cookbook page http://www.lightsaml.com/LightSAML-Core/Cookbook/How-to-verify-signature-of-SAML-message/ in following steps

• deserialize XML to data model object - in your case the Response class
• load public key of IDP from its certificate from their metadata
• call validate() method on response signature property

Note that proper handling of the Response is still more then just validating the signature. Complete SAML Web browser SSO profile address additional verifications, which LightSAML also implements.

You might check LightSAML/SpBundle if you're using Symfony, since it implements full SAML SSO profile and integrates with Symfony's security making SAML SSO quite easy to implement.

If you're really into doing it yourself from scratch, you can check how xmlseclibs does it, for example in one of its maintained forks on https://github.com/robrichards/xmlseclibs.