icn_saml_idp 0.4.1

data/lib/saml_idp/name_id_formatter.rb

@@ -0,0 +1,68 @@
+module SamlIdp
+  class NameIdFormatter
+    attr_accessor :list
+    def initialize(list)
+      self.list = (list || {})
+    end
+
+    def all
+      if split?
+        one_one.map { |key_val| build("1.1", key_val)[:name] } +
+        two_zero.map { |key_val| build("2.0", key_val)[:name] }
+      else
+        list.map { |key_val| build("2.0", key_val)[:name] }
+      end
+    end
+
+    def chosen
+      if split?
+        version, choose = "1.1", one_one.first
+        version, choose = "2.0", two_zero.first unless choose
+        version, choose = "2.0", "persistent" unless choose
+        build(version, choose)
+      else
+        choose = list.first || "persistent"
+        build("2.0", choose)
+      end
+    end
+
+    def build(version, key_val)
+      key_val = Array(key_val)
+      name = key_val.first.to_s.underscore
+      getter = build_getter key_val.last || name
+      {
+        name: "urn:oasis:names:tc:SAML:#{version}:nameid-format:#{name.camelize(:lower)}",
+        getter: getter
+      }
+    end
+    private :build
+
+    def build_getter(getter_val)
+      if getter_val.respond_to?(:call)
+        getter_val
+      else
+        ->(p) { p.public_send getter_val.to_s }
+      end
+    end
+    private :build_getter
+
+    def split?
+      list.is_a?(Hash) && (list.key?("2.0") || list.key?("1.1"))
+    end
+    private :split?
+
+    def one_one
+      list["1.1"] || {}
+    rescue TypeError
+      {}
+    end
+    private :one_one
+
+    def two_zero
+      list["2.0"] || {}
+    rescue TypeError
+      {}
+    end
+    private :two_zero
+  end
+end

data/lib/saml_idp/persisted_metadata.rb

@@ -0,0 +1,10 @@
+require 'saml_idp/attributeable'
+module SamlIdp
+  class PersistedMetadata
+    include Attributeable
+
+    def sign_assertions?
+      !!attributes[:sign_assertions]
+    end
+  end
+end

data/lib/saml_idp/request.rb

@@ -0,0 +1,180 @@
+require 'saml_idp/xml_security'
+require 'saml_idp/service_provider'
+module SamlIdp
+  class Request
+    def self.from_deflated_request(raw)
+      if raw
+        decoded = Base64.decode64(raw)
+        zstream = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+        begin
+          inflated = zstream.inflate(decoded).tap do
+            zstream.finish
+            zstream.close
+          end
+        rescue Zlib::BufError, Zlib::DataError # not compressed
+          inflated = decoded
+        end
+      else
+        inflated = ""
+      end
+      new(inflated)
+    end
+
+    attr_accessor :raw_xml
+
+    delegate :config, to: :SamlIdp
+    private :config
+    delegate :xpath, to: :document
+    private :xpath
+
+    def initialize(raw_xml = "")
+      self.raw_xml = raw_xml
+    end
+
+    def logout_request?
+      logout_request.nil? ? false : true
+    end
+
+    def authn_request?
+      authn_request.nil? ? false : true
+    end
+
+    def request_id
+      request["ID"]
+    end
+
+    def request
+      if authn_request?
+        authn_request
+      elsif logout_request?
+        logout_request
+      end
+    end
+
+    def requested_authn_context
+      if authn_request? && authn_context_node
+        authn_context_node.content
+      else
+        nil
+      end
+    end
+
+    def acs_url
+      service_provider.acs_url ||
+        authn_request["AssertionConsumerServiceURL"].to_s
+    end
+
+    def logout_url
+      service_provider.assertion_consumer_logout_service_url
+    end
+
+    def response_url
+      if authn_request?
+        acs_url
+      elsif logout_request?
+        logout_url
+      end
+    end
+
+    def log(msg)
+      if Rails && Rails.logger
+        Rails.logger.info msg
+      else
+        puts msg
+      end
+    end
+
+    def valid?
+      unless service_provider?
+        log "Unable to find service provider for issuer #{issuer}"
+        return false
+      end
+
+      unless (authn_request? ^ logout_request?)
+        log "One and only one of authnrequest and logout request is required. authnrequest: #{authn_request?} logout_request: #{logout_request?} "
+        return false
+      end
+
+      unless valid_signature?
+        log "Signature is invalid in #{raw_xml}"
+        return false
+      end
+
+      if response_url.nil?
+        log "Unable to find response url for #{issuer}: #{raw_xml}"
+        return false
+      end
+
+      return true
+    end
+
+    def valid_signature?
+      # Force signatures for logout requests because there is no other
+      # protection against a cross-site DoS.
+      service_provider.valid_signature?(document, logout_request?)
+    end
+
+    def service_provider?
+      service_provider.valid?
+    end
+
+    def service_provider
+      @_service_provider ||= ServiceProvider.new((service_provider_finder[issuer] || {}).merge(identifier: issuer))
+    end
+
+    def issuer
+      @_issuer ||= xpath("//saml:Issuer", saml: assertion).first.try(:content)
+      @_issuer if @_issuer.present?
+    end
+
+    def name_id
+      @_name_id ||= xpath("//saml:NameID", saml: assertion).first.try(:content)
+    end
+
+    def session_index
+      @_session_index ||= xpath("//samlp:SessionIndex", samlp: samlp).first.try(:content)
+    end
+
+    def document
+      @_document ||= Saml::XML::Document.parse(raw_xml)
+    end
+    private :document
+
+    def authn_context_node
+      @_authn_context_node ||= xpath("//samlp:AuthnRequest/samlp:RequestedAuthnContext/saml:AuthnContextClassRef",
+        samlp: samlp,
+        saml: assertion).first
+    end
+    private :authn_context_node
+
+    def authn_request
+      @_authn_request ||= xpath("//samlp:AuthnRequest", samlp: samlp).first
+    end
+    private :authn_request
+
+    def logout_request
+      @_logout_request ||= xpath("//samlp:LogoutRequest", samlp: samlp).first
+    end
+    private :logout_request
+
+    def samlp
+      Saml::XML::Namespaces::PROTOCOL
+    end
+    private :samlp
+
+    def assertion
+      Saml::XML::Namespaces::ASSERTION
+    end
+    private :assertion
+
+    def signature_namespace
+      Saml::XML::Namespaces::SIGNATURE
+    end
+    private :signature_namespace
+
+    def service_provider_finder
+      config.service_provider.finder
+    end
+    private :service_provider_finder
+  end
+end

data/lib/saml_idp/response_builder.rb

@@ -0,0 +1,62 @@
+require 'builder'
+module SamlIdp
+  class ResponseBuilder
+    attr_accessor :response_id
+    attr_accessor :issuer_uri
+    attr_accessor :saml_acs_url
+    attr_accessor :saml_request_id
+    attr_accessor :assertion_and_signature
+
+    def initialize(response_id, issuer_uri, saml_acs_url, saml_request_id, assertion_and_signature)
+      self.response_id = response_id
+      self.issuer_uri = issuer_uri
+      self.saml_acs_url = saml_acs_url
+      self.saml_request_id = saml_request_id
+      self.assertion_and_signature = assertion_and_signature
+    end
+
+    def encoded
+      @encoded ||= encode
+    end
+
+    def raw
+      build
+    end
+
+    def encode
+      Base64.strict_encode64(raw)
+    end
+    private :encode
+
+    def build
+      resp_options = {}
+      resp_options[:ID] = response_id_string
+      resp_options[:Version] =  "2.0"
+      resp_options[:IssueInstant] = now_iso
+      resp_options[:Destination] = saml_acs_url
+      resp_options[:Consent] = Saml::XML::Namespaces::Consents::UNSPECIFIED
+      resp_options[:InResponseTo] = saml_request_id unless saml_request_id.nil?
+      resp_options["xmlns:samlp"] = Saml::XML::Namespaces::PROTOCOL
+
+      builder = Builder::XmlMarkup.new
+      builder.tag! "samlp:Response", resp_options do |response|
+          response.Issuer issuer_uri, xmlns: Saml::XML::Namespaces::ASSERTION
+          response.tag! "samlp:Status" do |status|
+            status.tag! "samlp:StatusCode", Value: Saml::XML::Namespaces::Statuses::SUCCESS
+          end
+          response << assertion_and_signature
+        end
+    end
+    private :build
+
+    def response_id_string
+      "_#{response_id}"
+    end
+    private :response_id_string
+
+    def now_iso
+      Time.now.utc.iso8601
+    end
+    private :now_iso
+  end
+end

data/lib/saml_idp/saml_response.rb

@@ -0,0 +1,79 @@
+require 'saml_idp/assertion_builder'
+require 'saml_idp/response_builder'
+module SamlIdp
+  class SamlResponse
+    attr_accessor :assertion_with_signature
+    attr_accessor :reference_id
+    attr_accessor :response_id
+    attr_accessor :issuer_uri
+    attr_accessor :principal
+    attr_accessor :audience_uri
+    attr_accessor :saml_request_id
+    attr_accessor :saml_acs_url
+    attr_accessor :algorithm
+    attr_accessor :secret_key
+    attr_accessor :x509_certificate
+    attr_accessor :authn_context_classref
+    attr_accessor :expiry
+    attr_accessor :encryption_opts
+
+    def initialize(reference_id,
+          response_id,
+          issuer_uri,
+          principal,
+          audience_uri,
+          saml_request_id,
+          saml_acs_url,
+          algorithm,
+          authn_context_classref,
+          expiry=60*60,
+          encryption_opts=nil
+          )
+      self.reference_id = reference_id
+      self.response_id = response_id
+      self.issuer_uri = issuer_uri
+      self.principal = principal
+      self.audience_uri = audience_uri
+      self.saml_request_id = saml_request_id
+      self.saml_acs_url = saml_acs_url
+      self.algorithm = algorithm
+      self.secret_key = secret_key
+      self.x509_certificate = x509_certificate
+      self.authn_context_classref = authn_context_classref
+      self.expiry = expiry
+      self.encryption_opts = encryption_opts
+    end
+
+    def build
+      @built ||= response_builder.encoded
+    end
+
+    def signed_assertion
+      if encryption_opts
+        assertion_builder.encrypt(sign: true)
+      else
+        assertion_builder.signed
+      end
+    end
+    private :signed_assertion
+
+    def response_builder
+      ResponseBuilder.new(response_id, issuer_uri, saml_acs_url, saml_request_id, signed_assertion)
+    end
+    private :response_builder
+
+    def assertion_builder
+      @assertion_builder ||= AssertionBuilder.new reference_id,
+        issuer_uri,
+        principal,
+        audience_uri,
+        saml_request_id,
+        saml_acs_url,
+        algorithm,
+        authn_context_classref,
+        expiry,
+        encryption_opts
+    end
+    private :assertion_builder
+  end
+end

data/lib/saml_idp/service_provider.rb

@@ -0,0 +1,76 @@
+require 'httparty'
+require 'saml_idp/attributeable'
+require 'saml_idp/incoming_metadata'
+require 'saml_idp/persisted_metadata'
+module SamlIdp
+  class ServiceProvider
+    include Attributeable
+    attribute :identifier
+    attribute :cert
+    attribute :fingerprint
+    attribute :metadata_url
+    attribute :validate_signature
+    attribute :acs_url
+    attribute :assertion_consumer_logout_service_url
+
+    delegate :config, to: :SamlIdp
+
+    def valid?
+      attributes.present?
+    end
+
+    def valid_signature?(doc, require_signature = false)
+      if require_signature || should_validate_signature?
+        doc.valid_signature?(fingerprint)
+      else
+        true
+      end
+    end
+
+    def should_validate_signature?
+      attributes[:validate_signature] ||
+        current_metadata.respond_to?(:sign_assertions?) && current_metadata.sign_assertions?
+    end
+
+    def refresh_metadata
+      fresh = fresh_incoming_metadata
+      if valid_signature?(fresh.document)
+        metadata_persister[identifier, fresh]
+        @current_metadata = nil
+        fresh
+      end
+    end
+
+    def current_metadata
+      @current_metadata ||= get_current_or_build
+    end
+
+    def get_current_or_build
+      persisted = metadata_getter[identifier, self]
+      if persisted.is_a? Hash
+        PersistedMetadata.new(persisted)
+      end
+    end
+    private :get_current_or_build
+
+    def metadata_getter
+      config.service_provider.persisted_metadata_getter
+    end
+    private :metadata_getter
+
+    def metadata_persister
+      config.service_provider.metadata_persister
+    end
+    private :metadata_persister
+
+    def fresh_incoming_metadata
+      IncomingMetadata.new request_metadata
+    end
+    private :fresh_incoming_metadata
+
+    def request_metadata
+      metadata_url.present? ? HTTParty.get(metadata_url).body : ""
+    end
+    private :request_metadata
+  end
+end