Skip to content

Show SP service name from mdui:UIInfo on authentication page and push notification - #411

Open
kayjoosten wants to merge 2 commits into
mainfrom
feature/issue-401-display-name-from-saml
Open

Show SP service name from mdui:UIInfo on authentication page and push notification#411
kayjoosten wants to merge 2 commits into
mainfrom
feature/issue-401-display-name-from-saml

Conversation

@kayjoosten

Copy link
Copy Markdown
Contributor

Summary

Closes #401.

  • Gateway forwards the SP's mdui:DisplayName in a mdui:UIInfo SAML extension on the AuthnRequest sent to Tiqr (Stepup-Gateway#624).
  • gssp-bundle preserves it in session state and exposes it via StateHandlerInterface::getMdui() (Stepup-gssp-bundle#49).
  • This PR resolves that into a locale-matched, sanitized service name and:
    • shows it on the authentication page
    • forwards it to the tiqr push notification payload (tiqr/tiqr-server-libphp already supports a serviceName param on sendAuthNotification)

Service name processing rules

  • Prefer current locale, fall back to en, then first available language.
  • Strip control/format characters, collapse consecutive whitespace, trim.
  • Truncate to 40 chars with a trailing if longer.
  • No mdui data -> page renders normally with nothing shown.

Dependency note

composer.json temporarily pins surfnet/stepup-gssp-bundle and surfnet/stepup-saml-bundle to their mdui feature branches (Stepup-gssp-bundle#49 / Stepup-saml-bundle#137), same as Stepup-Webauthn#273. These pins (and the accompanying audit.ignore entries) need to be swapped for tagged releases before this merges.

Test plan

  • composer phpstan clean
  • composer phpcs clean
  • composer phpmd clean
  • composer unit-tests — 77 passing, including new ServiceNameFormatterTest / ServiceNameResolverTest and extended AuthenticationNotificationControllerTest
  • Manual verification against devconf once gssp-bundle/saml-bundle are tagged

Users currently see a generic authentication page and push notification
when a service provider sends its display name via mdui:UIInfo. That
loses useful context during the second-factor flow and leaves the new
metadata support in Gateway and the GSSP bundle unused.

Resolve the service name from the SAML metadata, format it for display,
and surface it consistently in the browser and Tiqr notification path.
The dependency pins keep the required bundle changes available until
those branches are replaced by tagged releases.

- show the resolved service name on the authentication page
- include the formatted name in Tiqr push notifications
- pin the required bundle branches and lockfile updates

Resolves: #401
@kayjoosten
kayjoosten force-pushed the feature/issue-401-display-name-from-saml branch from b1bcef7 to 72b84e4 Compare July 10, 2026 11:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Use the Displayname from the SAML request

1 participant