Accept nullable service_name on SP configuration push

composer.json

@@ -62,6 +62,7 @@
         "malukenho/docheader": "^1.1",
         "mockery/mockery": "^1.6.12",
         "overtrue/phplint": ">=9.5.6",
+        "phpcpd-next/phpcpd": "^1.1",
         "phpmd/phpmd": "^2.15",
         "phpstan/phpstan": "^2.0",
         "phpstan/phpstan-doctrine": "^2.0",

src/Surfnet/StepupMiddleware/ManagementBundle/Tests/Controller/ConfigurationControllerTest.php

@@ -218,6 +218,22 @@ public function validPushWithOnlyGatewayIsAccepted(): void
         ]);
     }
 
+    #[Test]
+    #[Group('management')]
+    public function validPushWithServiceNameIsAccepted(): void
+    {
+        $this->pushConfiguration([
+            'gateway' => [
+                'identity_providers' => [],
+                'service_providers' => [
+                    array_merge(self::minimalServiceProvider(), [
+                        'service_name' => ['en_GB' => 'Test Service', 'nl_NL' => 'Test Dienst'],
+                    ]),
+                ],
+            ],
+        ]);
+    }
+
     #[Test]
     #[Group('management')]
     public function pushWithSraaAndEmailTemplatesIsSilentlyAccepted(): void

src/Surfnet/StepupMiddleware/ManagementBundle/Tests/Validator/Fixtures/invalid_configuration/invalid_sp_service_name.php

@@ -0,0 +1,44 @@
+<?php
+
+/**
+ * Copyright 2014 SURFnet bv
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+return [
+    'expectedPropertyPath' => 'gateway.service_providers[0].service_name',
+    'configuration' => [
+        'gateway' => [
+            'identity_providers' => [],
+            'service_providers' => [
+                [
+                    "entity_id" => "https://entity.tld/id",
+                    "public_key" => "MIIE...",
+                    "acs" => ["https://entity.tld/consume-assertion"],
+                    "loa" => [
+                        "__default__" => "https://entity.tld/authentication/loa2",
+                    ],
+                    "second_factor_only" => false,
+                    "second_factor_only_nameid_patterns" => [],
+                    "assertion_encryption_enabled" => false,
+                    "blacklisted_encryption_algorithms" => [],
+                    // A well-formed locale map (e.g. ['en_GB' => 'Test Service']) is now
+                    // valid. This fixture demonstrates a malformed value is still
+                    // rejected: locale keys must be non-empty strings, not numeric.
+                    "service_name" => [0 => 'Some Name'],
+                ],
+            ],
+        ],
+    ],
+];

src/Surfnet/StepupMiddleware/ManagementBundle/Tests/Validator/Fixtures/invalid_configuration/invalid_sp_service_name_colliding_locales.php

@@ -0,0 +1,47 @@
+<?php
+
+/**
+ * Copyright 2026 SURFnet bv
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+return [
+    'expectedPropertyPath' => 'gateway.service_providers[0].service_name',
+    'configuration' => [
+        'gateway' => [
+            'identity_providers' => [],
+            'service_providers' => [
+                [
+                    "entity_id" => "https://entity.tld/id",
+                    "public_key" => "MIIE...",
+                    "acs" => ["https://entity.tld/consume-assertion"],
+                    "loa" => [
+                        "__default__" => "https://entity.tld/authentication/loa2",
+                    ],
+                    "second_factor_only" => false,
+                    "second_factor_only_nameid_patterns" => [],
+                    "assertion_encryption_enabled" => false,
+                    "blacklisted_encryption_algorithms" => [],
+                    // en_GB and en_US both normalize to the primary subtag "en". Gateway
+                    // matches on the primary subtag only, so this is rejected: which entry
+                    // "wins" would otherwise be an undocumented JSON-key-order accident.
+                    "service_name" => [
+                        'en_GB' => 'English (UK) Name',
+                        'en_US' => 'English (US) Name',
+                    ],
+                ],
+            ],
+        ],
+    ],
+];

src/Surfnet/StepupMiddleware/ManagementBundle/Tests/Validator/Fixtures/invalid_configuration/invalid_sp_service_name_empty_map.php

@@ -0,0 +1,44 @@
+<?php
+
+/**
+ * Copyright 2026 SURFnet bv
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+return [
+    'expectedPropertyPath' => 'gateway.service_providers[0].service_name',
+    'configuration' => [
+        'gateway' => [
+            'identity_providers' => [],
+            'service_providers' => [
+                [
+                    "entity_id" => "https://entity.tld/id",
+                    "public_key" => "MIIE...",
+                    "acs" => ["https://entity.tld/consume-assertion"],
+                    "loa" => [
+                        "__default__" => "https://entity.tld/authentication/loa2",
+                    ],
+                    "second_factor_only" => false,
+                    "second_factor_only_nameid_patterns" => [],
+                    "assertion_encryption_enabled" => false,
+                    "blacklisted_encryption_algorithms" => [],
+                    // An empty map is rejected: Gateway treats {} as "not configured" and
+                    // falls through to the SP-supplied name, which is not what an
+                    // administrator writing {} intends. Omit the property instead.
+                    "service_name" => [],
+                ],
+            ],
+        ],
+    ],
+];

src/Surfnet/StepupMiddleware/ManagementBundle/Validator/ServiceProviderConfigurationValidator.php

@@ -40,6 +40,7 @@ public function validate(array $configuration, string $propertyPath): void
             'use_pdp',
             'allow_sso_on_2fa',
             'set_sso_cookie_on_2fa',
+            'service_name',
         ];
 
         if (empty($configuration['use_pdp'])) {
@@ -54,6 +55,10 @@ public function validate(array $configuration, string $propertyPath): void
             $configuration['set_sso_cookie_on_2fa'] = false;
         }
 
+        if (!array_key_exists('service_name', $configuration)) {
+            $configuration['service_name'] = null;
+        }
+
         StepupAssert::keysMatch(
             $configuration,
             $requiredProperties,
@@ -91,6 +96,68 @@ public function validate(array $configuration, string $propertyPath): void
         $this->validateBooleanValue($configuration, 'use_pdp', $propertyPath);
         $this->validateBooleanValue($configuration, 'allow_sso_on_2fa', $propertyPath);
         $this->validateBooleanValue($configuration, 'set_sso_cookie_on_2fa', $propertyPath);
+
+        if (isset($configuration['service_name'])) {
+            $this->validateServiceNameLocaleMap($configuration, 'service_name', $propertyPath);
+        }
+    }
+
+    /**
+     * service_name is optional; when present it must be a non-empty map of locale code
+     * (e.g. "en_GB", "nl_NL") to a non-empty display name string for that
+     * locale. Per RFC OpenConext/Stepup-Gateway#587: "If set it must be a
+     * map of locale to service name." An empty map is rejected: Gateway treats an empty
+     * map as "not configured" and falls through to the SP-supplied name, which is the
+     * opposite of what an administrator writing `{}` intends. Locale keys must normalize
+     * (by primary language subtag) to distinct values, since Gateway matches on the primary
+     * subtag only and an administrator has no visibility into which region variant would win.
+     *
+     * @param array<string, mixed> $configuration
+     */
+    private function validateServiceNameLocaleMap(array $configuration, string $name, string $propertyPath): void
+    {
+        $value = $configuration[$name];
+        $path = $propertyPath . '.' . $name;
+
+        Assertion::isArray($value, 'value must be a map of locale to service name', $path);
+        Assertion::notEmpty(
+            $value,
+            'value must not be an empty map; omit service_name entirely to leave it unconfigured',
+            $path,
+        );
+
+        $primarySubtags = [];
+        foreach ($value as $locale => $serviceName) {
+            Assertion::string($locale, 'locale keys must be strings', $path);
+            Assertion::notBlank($locale, 'locale keys must not be empty', $path);
+            Assertion::regex(
+                $locale,
+                '/^[a-zA-Z]{2}([_-][a-zA-Z]{2})?$/',
+                sprintf(
+                    "locale key '%s' must be a language code (e.g. 'en') optionally followed by "
+                    . "a region (e.g. 'en_GB')",
+                    $locale,
+                ),
+                $path,
+            );
+            Assertion::string($serviceName, 'service name values must be strings', $path . '.' . $locale);
+            Assertion::notBlank($serviceName, 'service name values must not be empty', $path . '.' . $locale);
+
+            $primarySubtag = strtolower(substr((string) $locale, 0, 2));
+            $collidesWith = $primarySubtags[$primarySubtag] ?? null;
+            Assertion::null(
+                $collidesWith,
+                sprintf(
+                    "locale key '%s' collides with '%s' after normalization to '%s'; only one "
+                    . 'region variant per language is allowed',
+                    $locale,
+                    $collidesWith,
+                    $primarySubtag,
+                ),
+                $path,
+            );
+            $primarySubtags[$primarySubtag] = $locale;
+        }
     }
 
     private function validateStringValue(array $configuration, string $name, string $propertyPath): void