devise_saml_authenticatable 1.9.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f5dd2cc3931480caf617a4a22266968ea550c52c4980353a5e295652dc25ce4d
-  data.tar.gz: b712dd20efd0c4ddd9c8a1321dc6e2cbf8876053689c36c94d272be5445f8fd7
+  metadata.gz: e861297bd4cb5df8bb43ec4aec39496fd5af27ad26ab80c0313ef5005159929e
+  data.tar.gz: 6e7199213c9e79ad65fb55581f862eedc9ca5093215e36509d3a6872debdefc4
 SHA512:
-  metadata.gz: 697615b8dfb2f798ae0fd71b796359825633b783fbebaf66cc947bd33d78ded081a862609b55b6407d87495a7a3b3df4ae9dfce1dd2143d7ce54e2c811727d1e
-  data.tar.gz: 74037754bbe52f5036aed75ad1d96cd0a44677f2963f496a5986a8f6be0542f92645f6a3c8fa67e738a9656d2d9697566f41dfbe6f5aa4b8306114e99a182864
+  metadata.gz: c0eb3bc7144986fab5d45c7a44c0abf949e7ca004af03c81c6c852e4f505d9cfa29051a5b338e1907a21d5d4c2d239c059f2645e270813efcc61140d43918d20
+  data.tar.gz: 61690adf342117a247eea96b0430920b97d8c551c1fe36d84eea449998cb69ee3b7eb295fa669603381f65cff54f887622c042f53fd0a5a54140debe5d1fba62

data/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

data/.github/workflows/ci.yml

@@ -2,9 +2,11 @@ name: ci
 on:
   push:
     branches:
+      - 1.x-maintenance
       - master
   pull_request:
     branches:
+      - 1.x-maintenance
       - master
 jobs:
   test:
@@ -12,39 +14,22 @@ jobs:
       fail-fast: false
       matrix:
         ruby:
-          - "3.1"
-          - "3.0"
-          - "2.7"
-          - "2.6"
+          - "3.4"
+          - "3.3"
+          - "3.2"
         gemfile:
           - Gemfile
-          - spec/support/Gemfile.rails6.1
-          - spec/support/Gemfile.rails6
-          - spec/support/Gemfile.rails5.2
+          - spec/support/Gemfile.rails7.1
+          - spec/support/Gemfile.rails7.2
         bundler:
           - "2"
-        exclude:
-          - ruby: "2.6"
-            gemfile: Gemfile
-            bundler: "2"
-          - ruby: "3.0"
-            gemfile: spec/support/Gemfile.rails5.2
-            bundler: "2"
-          - ruby: "3.0"
-            gemfile: spec/support/Gemfile.rails6
-            bundler: "2"
-          - ruby: "3.1"
-            gemfile: spec/support/Gemfile.rails5.2
-            bundler: "2"
-          - ruby: "3.1"
-            gemfile: spec/support/Gemfile.rails6
-            bundler: "2"
     runs-on: ubuntu-latest
     env:
       BUNDLE_GEMFILE: ${{ github.workspace }}/${{ matrix.gemfile }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: ruby/setup-ruby@v1
+      - uses: actions/checkout@v4
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
         with:
           bundler: ${{ matrix.bundler }}
           ruby-version: ${{ matrix.ruby }}

data/.ruby-version

@@ -1 +1 @@
-3.1.0
+3.3.7

data/Gemfile

@@ -6,19 +6,13 @@ gemspec
 group :test do
   gem 'rake'
   gem 'rspec', '~> 3.0'
-  gem 'rails', '~> 7.0.0'
+  gem 'rails', '~> 8.0.0'
   gem 'rspec-rails'
-  gem 'sqlite3', '~> 1.4.0'
+  gem 'sqlite3', '~> 2.6.0'
   gem 'capybara'
   gem 'selenium-webdriver'
-
-  if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new("3.0")
-    gem 'webrick'
-  end
-
-  if Gem::Version.new(RUBY_VERSION.dup) >= Gem::Version.new("3.1")
-    gem 'net-smtp', require: false
-    gem 'net-imap', require: false
-    gem 'net-pop', require: false
-  end
+  gem 'webrick'
+  gem 'net-smtp', require: false
+  gem 'net-imap', require: false
+  gem 'net-pop', require: false
 end

data/README.md

@@ -1,15 +1,18 @@
-[![Build Status](https://travis-ci.org/apokalipto/devise_saml_authenticatable.svg?branch=master)](https://travis-ci.org/apokalipto/devise_saml_authenticatable)
+[![Build Status](https://github.com/apokalipto/devise_saml_authenticatable/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/apokalipto/devise_saml_authenticatable/actions/workflows/ci.yml)
 # DeviseSamlAuthenticatable
 
 Devise Saml Authenticatable is a Single-Sign-On authentication strategy for devise that relies on SAML.
 It uses [ruby-saml][] to handle all SAML-related stuff.
 
+> [!WARNING]
+> The master branch now represents v2.x of this gem, which is still unreleased.
+> See [the 1.x branch README](https://github.com/apokalipto/devise_saml_authenticatable/tree/refs/heads/1.x-maintenance?tab=readme-ov-file) for details about that version.
+
 ## Installation
 
 Add this gem to your application's Gemfile:
 
-    git_source(:github) { |repo_name| "https://github.com/#{repo_name}" }
-    gem "devise_saml_authenticatable", github: "apokalipto/devise_saml_authenticatable"
+    gem "devise_saml_authenticatable"
 
 And then execute:
 
@@ -87,7 +90,7 @@ In `config/initializers/devise.rb`:
 
     # Lambda that is called if Devise.saml_update_user and/or Devise.saml_create_user are true.
     # Receives the model object, saml_response and auth_value, and defines how the object's values are
-    # updated with regards to the SAML response. 
+    # updated with regards to the SAML response.
     # config.saml_update_resource_hook = -> (user, saml_response, auth_value) {
     #   saml_response.attributes.resource_keys.each do |key|
     #     user.send "#{key}=", saml_response.attribute_value_by_resource_key(key)
@@ -104,17 +107,17 @@ In `config/initializers/devise.rb`:
     # Receives a copy of the ActiveRecord::Model, saml_response and auth_value. Is expected to return
     # one instance of the provided model that is the matched account, or nil if none exists.
     # config.saml_resource_locator = -> (model, saml_response, auth_value) {
-    #   model.where(Devise.saml_default_user_key => auth_value).first
+    #   model.find_by(Devise.saml_default_user_key => auth_value)
     # }
-    
+
 
     # Set the default user key. The user will be looked up by this key. Make
     # sure that the Authentication Response includes the attribute.
     config.saml_default_user_key = :email
 
-    # Optional. This stores the session index defined by the IDP during login.  If provided it will be used as a salt
-    # for the user's session to facilitate an IDP initiated logout request.
-    config.saml_session_index_key = :session_index
+    # Optional. This stores the session index defined by the IDP during login.
+    # If provided it will be used to facilitate an IDP initiated logout request.
+    config.saml_session_index_key = :saml_session_index
 
     # You can set this value to use Subject or SAML assertion as info to which email will be compared.
     # If you don't set it then email will be extracted from SAML assertion attributes.
@@ -151,7 +154,7 @@ In `config/initializers/devise.rb`:
       settings.assertion_consumer_service_url     = "http://localhost:3000/users/saml/auth"
       settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
       settings.name_identifier_format             = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
-      settings.issuer                             = "http://localhost:3000/saml/metadata"
+      settings.sp_entity_id                       = "http://localhost:3000/saml/metadata"
       settings.authn_context                      = ""
       settings.idp_slo_service_url                = "http://localhost/simplesaml/www/saml2/idp/SingleLogoutService.php"
       settings.idp_sso_service_url                = "http://localhost/simplesaml/www/saml2/idp/SSOService.php"
@@ -225,6 +228,9 @@ If you only have one IdP, you can use the config file above, or just return a si
   end
 ```
 
+If you are mapping authorisation *groups* or any other array of values as some providers render (ie: Okta), be aware of [ruby-saml's `single_value_compatibility`](https://github.com/SAML-Toolkits/ruby-saml#retrieving-attributes).
+
+
 ## IdP Settings Adapter
 
 Implementing a custom settings adapter allows you to support multiple Identity Providers, and dynamic application domains with the request object.
@@ -240,7 +246,7 @@ class IdPSettingsAdapter
         assertion_consumer_service_url: "#{request.protocol}#{request.host_with_port}/users/saml/auth",
         assertion_consumer_service_binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
         name_identifier_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-        issuer: "#{request.protocol}#{request.host_with_port}/saml/metadata",
+        sp_entity_id: "#{request.protocol}#{request.host_with_port}/saml/metadata",
         idp_entity_id: "http://www.example_idp_entity_id.com",
         authn_context: "",
         idp_slo_service_url: "http://example_idp_slo_service_url.com",
@@ -252,7 +258,7 @@ class IdPSettingsAdapter
         assertion_consumer_service_url: "http://localhost:3000/users/saml/auth",
         assertion_consumer_service_binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
         name_identifier_format: "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-        issuer: "http://localhost:3000/saml/metadata",
+        sp_entity_id: "http://localhost:3000/saml/metadata",
         idp_entity_id: "http://www.another_idp_entity_id.biz",
         authn_context: "",
         idp_slo_service_url: "http://another_idp_slo_service_url.com",
@@ -297,7 +303,7 @@ Logout support is included by immediately terminating the local session and then
 
 Logout requests from the IDP are supported by the `idp_sign_out` endpoint.  Directing logout requests to `users/saml/idp_sign_out` will log out the respective user by invalidating their current sessions.
 
-`saml_session_index_key` must be configured to support this feature.
+To disable this feature, set `saml_session_index_key` to `nil`.
 
 ## Signing and Encrypting Authentication Requests and Assertions
 

data/app/controllers/devise/saml_sessions_controller.rb

@@ -23,10 +23,11 @@ class Devise::SamlSessionsController < Devise::SessionsController
 
   def idp_sign_out
     if params[:SAMLRequest] && Devise.saml_session_index_key
+      Devise.sign_out_all_scopes ? sign_out : sign_out(resource_name)
+      session[Devise.saml_session_index_key] = nil
+
       saml_config = saml_config(get_idp_entity_id(params), request)
       logout_request = OneLogin::RubySaml::SloLogoutrequest.new(params[:SAMLRequest], settings: saml_config)
-      resource_class.reset_session_key_for(logout_request.name_id)
-
       redirect_to generate_idp_logout_response(saml_config, logout_request.id), allow_other_host: true
     elsif params[:SAMLResponse]
       # Currently Devise handles the session invalidation when the request is made.
@@ -56,7 +57,7 @@ class Devise::SamlSessionsController < Devise::SessionsController
 
     @name_identifier_value_for_sp_initiated_logout = Devise.saml_name_identifier_retriever.call(current_user)
     if Devise.saml_session_index_key
-      @sessionindex_for_sp_initiated_logout = current_user.public_send(Devise.saml_session_index_key)
+      @sessionindex_for_sp_initiated_logout = session[Devise.saml_session_index_key]
     end
   end
 

data/devise_saml_authenticatable.gemspec

@@ -6,7 +6,7 @@ Gem::Specification.new do |gem|
   gem.email         = ["Josef.Sauter@gmail.com"]
   gem.description   = %q{SAML Authentication for devise}
   gem.summary       = %q{SAML Authentication for devise }
-  gem.homepage      = ""
+  gem.homepage      = "https://github.com/apokalipto/devise_saml_authenticatable"
   gem.license     = "MIT"
 
   gem.files         = `git ls-files`.split($\)
@@ -16,7 +16,8 @@ Gem::Specification.new do |gem|
   gem.require_paths = ["lib"]
   gem.version       = DeviseSamlAuthenticatable::VERSION
   gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
+  gem.required_ruby_version = ">= 2.6.0"
 
   gem.add_dependency("devise","> 2.0.0")
-  gem.add_dependency("ruby-saml","~> 1.7")
+  gem.add_dependency("ruby-saml","~> 1.18")
 end

data/lib/devise_saml_authenticatable/model.rb

@@ -12,22 +12,6 @@ module Devise
         attr_accessor :password_confirmation
       end
 
-      def after_saml_authentication(session_index)
-        if Devise.saml_session_index_key && self.respond_to?(Devise.saml_session_index_key)
-          self.update_attribute(Devise.saml_session_index_key, session_index)
-        end
-      end
-
-      def authenticatable_salt
-        if Devise.saml_session_index_key &&
-           self.respond_to?(Devise.saml_session_index_key) &&
-           self.send(Devise.saml_session_index_key).present?
-          self.send(Devise.saml_session_index_key)
-        else
-          super
-        end
-      end
-
       module ClassMethods
         def authenticate_with_saml(saml_response, relay_state)
           key = Devise.saml_default_user_key
@@ -50,7 +34,7 @@ module Devise
                     else Devise.saml_resource_validator_hook.call(resource, decorated_response, auth_value)
                     end
             if !valid
-              logger.info("User(#{auth_value}) did not pass custom validation.")
+              logger.info("#{self.name}(#{auth_value}) did not pass custom validation.")
               return nil
             end
           end
@@ -60,10 +44,10 @@ module Devise
                         end
           if resource.nil?
             if create_user
-              logger.info("Creating user(#{auth_value}).")
+              logger.info("Creating #{self.name.downcase}(#{auth_value}).")
               resource = new
             else
-              logger.info("User(#{auth_value}) not found.  Not configured to create the user.")
+              logger.info("#{self.name}(#{auth_value}) not found. Not configured to create the #{self.name.downcase}.")
               return nil
             end
           end
@@ -78,11 +62,6 @@ module Devise
           resource
         end
 
-        def reset_session_key_for(name_id)
-          resource = find_by(Devise.saml_default_user_key => name_id)
-          resource.update_attribute(Devise.saml_session_index_key, nil) unless resource.nil?
-        end
-
         def find_for_shibb_authentication(conditions)
           find_for_authentication(conditions)
         end

data/lib/devise_saml_authenticatable/saml_config.rb

@@ -14,7 +14,7 @@ module DeviseSamlAuthenticatable
       return @file_based_config if @file_based_config
       idp_config_path = "#{Rails.root}/config/idp.yml"
 
-      if File.exists?(idp_config_path)
+      if File.exist?(idp_config_path)
         @file_based_config ||= OneLogin::RubySaml::Settings.new(YAML.load(File.read(idp_config_path))[Rails.env])
       end
     end

data/lib/devise_saml_authenticatable/strategy.rb

@@ -19,7 +19,9 @@ module Devise
         parse_saml_response
         retrieve_resource unless self.halted?
         unless self.halted?
-          @resource.after_saml_authentication(@response.sessionindex)
+          if Devise.saml_session_index_key
+            request.session[Devise.saml_session_index_key] = @response.sessionindex
+          end
           success!(@resource)
         end
       end

data/lib/devise_saml_authenticatable/version.rb

@@ -1,3 +1,3 @@
 module DeviseSamlAuthenticatable
-  VERSION = "1.9.0"
+  VERSION = "2.0.0"
 end

data/lib/devise_saml_authenticatable.rb

@@ -30,7 +30,7 @@ module Devise
 
   # Add valid users to database
   # Can accept a Boolean value or a Proc that is called with the model class, the saml_response and auth_value
-  # Ex: 
+  # Ex:
   # Devise.saml_create_user = Proc.new do |model_class, saml_response, auth_value|
   #  model_class == Admin
   # end
@@ -39,7 +39,7 @@ module Devise
 
   # Update user attributes after login
   # Can accept a Boolean value or a Proc that is called with the model class, the saml_response and auth_value
-  # Ex: 
+  # Ex:
   # Devise.saml_update_user = Proc.new do |model_class, saml_response, auth_value|
   #  model_class == User
   # end
@@ -54,7 +54,7 @@ module Devise
 
   # Key used to index sessions for later retrieval
   mattr_accessor :saml_session_index_key
-  @@saml_session_index_key
+  @@saml_session_index_key ||= :saml_session_index
 
   # Redirect after signout (redirects to 'users/saml/sign_in' by default)
   mattr_accessor :saml_sign_out_success_url
@@ -134,7 +134,7 @@ module Devise
   # See saml_resource_locator for more information.
   mattr_reader :saml_default_resource_locator
   @@saml_default_resource_locator = Proc.new do |model, saml_response, auth_value|
-    model.where(Devise.saml_default_user_key => auth_value).first
+    model.find_by(Devise.saml_default_user_key => auth_value)
   end
 
   # Proc that is called to resolve the saml_response and auth_value into the correct user object.

data/spec/controllers/devise/saml_sessions_controller_spec.rb

@@ -31,6 +31,7 @@ require_relative '../../../app/controllers/devise/saml_sessions_controller'
 
 describe Devise::SamlSessionsController, type: :controller do
   include RubySamlSupport
+  include Devise::Test::ControllerHelpers
 
   let(:idp_providers_adapter) { spy('Stub IDPSettings Adaptor') }
 
@@ -40,8 +41,8 @@ describe Devise::SamlSessionsController, type: :controller do
       assertion_consumer_service_url: 'acs_url',
       assertion_consumer_service_binding: 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
       name_identifier_format: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
-      issuer: 'sp_issuer',
-      idp_entity_id: 'http://www.example.com',
+      sp_entity_id: 'sp_issuer',
+      idp_entity_id: 'https://www.example.com',
       authn_context: '',
       idp_cert: 'idp_cert'
     }
@@ -123,7 +124,7 @@ describe Devise::SamlSessionsController, type: :controller do
         end
 
         subject(:do_get) do
-          get :new, params: { entity_id: 'http://www.example.com' }
+          get :new, params: { entity_id: 'https://www.example.com' }
         end
 
         before do
@@ -137,7 +138,7 @@ describe Devise::SamlSessionsController, type: :controller do
 
         it 'redirects to the associated IdP SSO target url' do
           do_get
-          expect(idp_providers_adapter).to have_received(:settings).with('http://www.example.com', request)
+          expect(idp_providers_adapter).to have_received(:settings).with('https://www.example.com', request)
           expect(response).to redirect_to(%r{\Ahttp://idp_sso_url\?SAMLRequest=})
         end
       end
@@ -167,7 +168,7 @@ describe Devise::SamlSessionsController, type: :controller do
           settings.assertion_consumer_service_url = 'http://localhost:3000/users/saml/auth'
           settings.assertion_consumer_service_binding = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
           settings.name_identifier_format = 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
-          settings.issuer = 'http://localhost:3000'
+          settings.sp_entity_id = 'http://localhost:3000'
         end
       end
 
@@ -256,7 +257,8 @@ describe Devise::SamlSessionsController, type: :controller do
         end
 
         it 'includes a LogoutRequest with the name identifier and session index', :aggregate_failures do
-          controller.current_user = Struct.new(:email, :session_index).new('user@example.com', 'sessionindex')
+          controller.current_user = Struct.new(:email).new('user@example.com')
+          session[Devise.saml_session_index_key] = 'sessionindex'
 
           actual_settings = nil
           expect_any_instance_of(OneLogin::RubySaml::Logoutrequest).to receive(:create) do |_, settings|
@@ -290,7 +292,7 @@ describe Devise::SamlSessionsController, type: :controller do
           end
 
           subject(:do_delete) do
-            delete :destroy, params: { entity_id: 'http://www.example.com' }
+            delete :destroy, params: { entity_id: 'https://www.example.com' }
           end
 
           before do
@@ -305,7 +307,7 @@ describe Devise::SamlSessionsController, type: :controller do
           it 'redirects to the associated IdP SLO target url' do
             do_delete
             expect(controller).to have_received(:sign_out)
-            expect(idp_providers_adapter).to have_received(:settings).with('http://www.example.com', request)
+            expect(idp_providers_adapter).to have_received(:settings).with('https://www.example.com', request)
             expect(response).to redirect_to(%r{\Ahttp://idp_slo_url\?SAMLRequest=})
           end
         end
@@ -322,9 +324,10 @@ describe Devise::SamlSessionsController, type: :controller do
     end
 
     it 'returns invalid request if SAMLRequest or SAMLResponse is not passed' do
-      expect(User).not_to receive(:reset_session_key_for)
+      session[Devise.saml_session_index_key] = 'sessionindex'
       post :idp_sign_out
       expect(response.status).to eq 500
+      expect(session[Devise.saml_session_index_key]).to eq('sessionindex')
     end
 
     context 'when receiving a logout response from the IdP after redirecting an SP logout request' do
@@ -361,23 +364,23 @@ describe Devise::SamlSessionsController, type: :controller do
         double(:slo_logoutrequest, {
                  id: 42,
                  name_id: name_id,
-                 issuer: 'http://www.example.com'
+                 issuer: 'https://www.example.com'
                })
       end
       let(:name_id) { '12312312' }
       before do
         allow(OneLogin::RubySaml::SloLogoutrequest).to receive(:new).and_return(saml_request)
-        allow(User).to receive(:reset_session_key_for)
+        session[Devise.saml_session_index_key] = 'sessionindex'
       end
 
       it 'direct the resource to reset the session key' do
         do_post
         expect(response).to redirect_to response_url
-        expect(User).to have_received(:reset_session_key_for).with(name_id)
+        expect(session[Devise.saml_session_index_key]).to be_nil
       end
 
       context 'with a specified idp' do
-        let(:idp_entity_id) { 'http://www.example.com' }
+        let(:idp_entity_id) { 'https://www.example.com' }
         before do
           Devise.idp_settings_adapter = idp_providers_adapter
         end
@@ -387,6 +390,7 @@ describe Devise::SamlSessionsController, type: :controller do
           expect(response.status).to eq 302
           expect(idp_providers_adapter).to have_received(:settings).with(idp_entity_id, request)
           expect(response).to redirect_to 'http://localhost/logout_response'
+          expect(session[Devise.saml_session_index_key]).to be_nil
         end
       end
 
@@ -407,7 +411,6 @@ describe Devise::SamlSessionsController, type: :controller do
         end
 
         it 'returns invalid request' do
-          expect(User).not_to receive(:reset_session_key_for).with(name_id)
           do_post
           expect(response.status).to eq 500
         end