cie-es 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.document +5 -0
- data/Gemfile +4 -0
- data/LICENSE +19 -0
- data/README.md +126 -0
- data/Rakefile +41 -0
- data/cie-es.gemspec +22 -0
- data/lib/cie/ruby-saml/authrequest.rb +205 -0
- data/lib/cie/ruby-saml/coding.rb +34 -0
- data/lib/cie/ruby-saml/error_handling.rb +27 -0
- data/lib/cie/ruby-saml/logging.rb +26 -0
- data/lib/cie/ruby-saml/logout_request.rb +126 -0
- data/lib/cie/ruby-saml/logout_response.rb +132 -0
- data/lib/cie/ruby-saml/metadata.rb +489 -0
- data/lib/cie/ruby-saml/request.rb +81 -0
- data/lib/cie/ruby-saml/response.rb +678 -0
- data/lib/cie/ruby-saml/settings.rb +89 -0
- data/lib/cie/ruby-saml/utils.rb +225 -0
- data/lib/cie/ruby-saml/validation_error.rb +7 -0
- data/lib/cie/ruby-saml/version.rb +5 -0
- data/lib/cie/xml_security.rb +166 -0
- data/lib/cie/xml_security_new.rb +373 -0
- data/lib/cie-es.rb +14 -0
- data/lib/schemas/saml20assertion_schema.xsd +283 -0
- data/lib/schemas/saml20protocol_schema.xsd +302 -0
- data/lib/schemas/xenc_schema.xsd +146 -0
- data/lib/schemas/xmldsig_schema.xsd +318 -0
- data/test/certificates/certificate1 +12 -0
- data/test/logoutrequest_test.rb +98 -0
- data/test/request_test.rb +53 -0
- data/test/response_test.rb +219 -0
- data/test/responses/adfs_response_sha1.xml +46 -0
- data/test/responses/adfs_response_sha256.xml +46 -0
- data/test/responses/adfs_response_sha384.xml +46 -0
- data/test/responses/adfs_response_sha512.xml +46 -0
- data/test/responses/no_signature_ns.xml +48 -0
- data/test/responses/open_saml_response.xml +56 -0
- data/test/responses/response1.xml.base64 +1 -0
- data/test/responses/response2.xml.base64 +79 -0
- data/test/responses/response3.xml.base64 +66 -0
- data/test/responses/response4.xml.base64 +93 -0
- data/test/responses/response5.xml.base64 +102 -0
- data/test/responses/response_with_ampersands.xml +139 -0
- data/test/responses/response_with_ampersands.xml.base64 +93 -0
- data/test/responses/simple_saml_php.xml +71 -0
- data/test/responses/wrapped_response_2.xml.base64 +150 -0
- data/test/settings_test.rb +43 -0
- data/test/test_helper.rb +65 -0
- data/test/xml_security_test.rb +123 -0
- metadata +119 -0
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
|
|
2
|
+
# A few helper functions for assembling a SAMLRequest and
|
|
3
|
+
# sending it to the IdP
|
|
4
|
+
module Cie::Saml
|
|
5
|
+
include Coding
|
|
6
|
+
module Request
|
|
7
|
+
|
|
8
|
+
# a few symbols for SAML class names
|
|
9
|
+
HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
|
10
|
+
HTTP_GET = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
|
|
11
|
+
# get the IdP metadata, and select the appropriate SSO binding
|
|
12
|
+
# that we can support. Currently this is HTTP-Redirect and HTTP-POST
|
|
13
|
+
# but more could be added in the future
|
|
14
|
+
def binding_select(service)
|
|
15
|
+
# first check if we're still using the old hard coded method for
|
|
16
|
+
# backwards compatability
|
|
17
|
+
if @settings.idp_metadata == nil && @settings.idp_sso_target_url != nil
|
|
18
|
+
@URL = @settings.idp_sso_target_url
|
|
19
|
+
return "GET", content_get
|
|
20
|
+
end
|
|
21
|
+
# grab the metadata
|
|
22
|
+
metadata = Metadata::new
|
|
23
|
+
meta_doc = metadata.get_idp_metadata(@settings)
|
|
24
|
+
|
|
25
|
+
# first try POST
|
|
26
|
+
sso_element = REXML::XPath.first(meta_doc,
|
|
27
|
+
"/EntityDescriptor/IDPSSODescriptor/#{service}[@Binding='#{HTTP_POST}']")
|
|
28
|
+
if sso_element
|
|
29
|
+
@URL = sso_element.attributes["Location"]
|
|
30
|
+
#Logging.debug "binding_select: POST to #{@URL}"
|
|
31
|
+
return "POST", content_post
|
|
32
|
+
end
|
|
33
|
+
|
|
34
|
+
# next try GET
|
|
35
|
+
sso_element = REXML::XPath.first(meta_doc,
|
|
36
|
+
"/EntityDescriptor/IDPSSODescriptor/#{service}[@Binding='#{HTTP_GET}']")
|
|
37
|
+
if sso_element
|
|
38
|
+
@URL = sso_element.attributes["Location"]
|
|
39
|
+
Logging.debug "binding_select: GET from #{@URL}"
|
|
40
|
+
return "GET", content_get
|
|
41
|
+
end
|
|
42
|
+
# other types we might want to add in the future: SOAP, Artifact
|
|
43
|
+
end
|
|
44
|
+
|
|
45
|
+
# construct the the parameter list on the URL and return
|
|
46
|
+
def content_get
|
|
47
|
+
# compress GET requests to try and stay under that 8KB request limit
|
|
48
|
+
deflated_request = Zlib::Deflate.deflate(@request, 9)[2..-5]
|
|
49
|
+
# strict_encode64() isn't available? sub out the newlines
|
|
50
|
+
@request_params["SAMLRequest"] = Base64.encode64(deflated_request).gsub(/\n/, "")
|
|
51
|
+
|
|
52
|
+
Logging.debug "SAMLRequest=#{@request_params["SAMLRequest"]}"
|
|
53
|
+
uri = Addressable::URI.parse(@URL)
|
|
54
|
+
uri.query_values = @request_params
|
|
55
|
+
url = uri.to_s
|
|
56
|
+
#url = @URL + "?SAMLRequest=" + @request_params["SAMLRequest"]
|
|
57
|
+
Logging.debug "Sending to URL #{url}"
|
|
58
|
+
return url
|
|
59
|
+
end
|
|
60
|
+
# construct an HTML form (POST) and return the content
|
|
61
|
+
def content_post
|
|
62
|
+
# POST requests seem to bomb out when they're deflated
|
|
63
|
+
# and they probably don't need to be compressed anyway
|
|
64
|
+
@request_params["SAMLRequest"] = Base64.encode64(@request).gsub(/\n/, "")
|
|
65
|
+
|
|
66
|
+
#Logging.debug "SAMLRequest=#{@request_params["SAMLRequest"]}"
|
|
67
|
+
# kind of a cheesy method of building an HTML, form since we can't rely on Rails too much,
|
|
68
|
+
# and REXML doesn't work well with quote characters
|
|
69
|
+
str = "<html><body onLoad=\"document.getElementById('form').submit();\">\n"
|
|
70
|
+
str += "<form id='form' name='form' method='POST' action=\"#{@URL}\">\n"
|
|
71
|
+
# we could change this in the future to associate a temp auth session ID
|
|
72
|
+
str += "<input name='RelayState' value='ruby-saml' type='hidden' />\n"
|
|
73
|
+
@request_params.each_pair do |key, value|
|
|
74
|
+
str += "<input name=\"#{key}\" value=\"#{value}\" type='hidden' />\n"
|
|
75
|
+
end
|
|
76
|
+
str += "</form></body></html>\n"
|
|
77
|
+
#Logging.debug "Created form:\n#{str}"
|
|
78
|
+
return str
|
|
79
|
+
end
|
|
80
|
+
end
|
|
81
|
+
end
|