catalyst / moodle-auth_saml2

SAML done 100% in Moodle, fast, simple, secure
https://moodle.org/plugins/auth_saml2
70 stars 132 forks source link

Improper xml:lang attribute in SP metadata #811

Open breakwaterlabs opened 2 months ago

breakwaterlabs commented 2 months ago

When using a multipart language (e.g. en_us_wp for Moodle Workplace) this code is embedded in the xml:lang tags in the Moodle SP SAML metadata.

When trying to configure this with ADFS (which does not work out of the box) this is rejected because that is not a valid XML language tag.

As per the SAML metadata specification 2.2.4, these should be a 'standard XML language attribute'. The examples given in the specification in section 2.6 (lines 1086, 1088, 1092, 1137, 1141, 1155) all show the use of an ISO 639 2-character language code such as 'en'.

The spec does not indicate whether it is permissible to use an ISO 639 code concatenated with an ISO 3166 code (e.g. en_US), but 3-part languages appear to be out of spec.

In any event these language codes break compatibility with ADFS, requiring either the language to be switched to 'en' for initial SP metadata import, or the metadata to be manually downloaded and edited. Otherwise, ADFS will throw an error stating 'invalid attribute lang=en_us_wp' or similar.