kl-ruby-saml 0.0.3 → 0.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile +3 -0
- data/README.md +24 -24
- data/Rakefile +1 -1
- data/changelog.md +3 -3
- data/kl-ruby-saml.gemspec +4 -4
- data/lib/kl-ruby-saml.rb +1 -0
- data/lib/onelogin/kl-ruby-saml.rb +17 -0
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/attribute_service.rb +1 -1
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/attributes.rb +1 -1
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/authrequest.rb +7 -7
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/http_error.rb +1 -1
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/idp_metadata_parser.rb +3 -3
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/logging.rb +3 -3
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/logoutrequest.rb +7 -7
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/logoutresponse.rb +7 -7
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/metadata.rb +3 -3
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/response.rb +9 -9
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/saml_message.rb +2 -2
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/settings.rb +6 -6
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/slo_logoutrequest.rb +6 -6
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/slo_logoutresponse.rb +7 -7
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/utils.rb +1 -1
- data/lib/onelogin/{ruby-saml → kl-ruby-saml}/validation_error.rb +1 -1
- data/lib/onelogin/kl-ruby-saml/version.rb +5 -0
- data/lib/xml_security.rb +5 -5
- data/test/idp_metadata_parser_test.rb +7 -7
- data/test/logging_test.rb +11 -11
- data/test/logout_responses/logoutresponse_fixtures.rb +1 -1
- data/test/logoutrequest_test.rb +17 -17
- data/test/logoutresponse_test.rb +39 -39
- data/test/metadata_test.rb +5 -5
- data/test/request_test.rb +26 -26
- data/test/response_test.rb +116 -116
- data/test/saml_message_test.rb +4 -4
- data/test/settings_test.rb +19 -19
- data/test/slo_logoutrequest_test.rb +26 -26
- data/test/slo_logoutresponse_test.rb +16 -16
- data/test/test_helper.rb +3 -3
- data/test/utils_test.rb +23 -23
- data/test/xml_security_test.rb +17 -17
- metadata +23 -23
- data/lib/onelogin/ruby-saml.rb +0 -17
- data/lib/onelogin/ruby-saml/version.rb +0 -5
- data/lib/ruby-saml.rb +0 -1
@@ -52,7 +52,7 @@ def invalid_xml_logout_response_document
|
|
52
52
|
end
|
53
53
|
|
54
54
|
def settings
|
55
|
-
@settings ||= OneLogin::
|
55
|
+
@settings ||= OneLogin::KlRubySaml::Settings.new(
|
56
56
|
{
|
57
57
|
:assertion_consumer_service_url => "http://app.muda.no/sso/consume",
|
58
58
|
:single_logout_service_url => "http://app.muda.no/sso/consume_logout",
|
data/test/logoutrequest_test.rb
CHANGED
@@ -1,11 +1,11 @@
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
|
2
2
|
|
3
|
-
require 'onelogin/ruby-saml/logoutrequest'
|
3
|
+
require 'onelogin/kl-ruby-saml/logoutrequest'
|
4
4
|
|
5
5
|
class RequestTest < Minitest::Test
|
6
6
|
|
7
7
|
describe "Logoutrequest" do
|
8
|
-
let(:settings) { OneLogin::
|
8
|
+
let(:settings) { OneLogin::KlRubySaml::Settings.new }
|
9
9
|
|
10
10
|
before do
|
11
11
|
settings.idp_slo_target_url = "http://unauth.com/logout"
|
@@ -13,7 +13,7 @@ class RequestTest < Minitest::Test
|
|
13
13
|
end
|
14
14
|
|
15
15
|
it "create the deflated SAMLRequest URL parameter" do
|
16
|
-
unauth_url = OneLogin::
|
16
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings)
|
17
17
|
assert_match /^http:\/\/unauth\.com\/logout\?SAMLRequest=/, unauth_url
|
18
18
|
|
19
19
|
inflated = decode_saml_request_payload(unauth_url)
|
@@ -21,10 +21,10 @@ class RequestTest < Minitest::Test
|
|
21
21
|
end
|
22
22
|
|
23
23
|
it "support additional params" do
|
24
|
-
unauth_url = OneLogin::
|
24
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings, { :hello => nil })
|
25
25
|
assert_match /&hello=$/, unauth_url
|
26
26
|
|
27
|
-
unauth_url = OneLogin::
|
27
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings, { :foo => "bar" })
|
28
28
|
assert_match /&foo=bar$/, unauth_url
|
29
29
|
end
|
30
30
|
|
@@ -32,7 +32,7 @@ class RequestTest < Minitest::Test
|
|
32
32
|
sessionidx = UUID.new.generate
|
33
33
|
settings.sessionindex = sessionidx
|
34
34
|
|
35
|
-
unauth_url = OneLogin::
|
35
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings, { :nameid => "there" })
|
36
36
|
inflated = decode_saml_request_payload(unauth_url)
|
37
37
|
|
38
38
|
assert_match /<samlp:SessionIndex/, inflated
|
@@ -44,7 +44,7 @@ class RequestTest < Minitest::Test
|
|
44
44
|
name_identifier_value = "abc123"
|
45
45
|
settings.name_identifier_value = name_identifier_value
|
46
46
|
|
47
|
-
unauth_url = OneLogin::
|
47
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings, { :nameid => "there" })
|
48
48
|
inflated = decode_saml_request_payload(unauth_url)
|
49
49
|
|
50
50
|
assert_match /<saml:NameID/, inflated
|
@@ -53,7 +53,7 @@ class RequestTest < Minitest::Test
|
|
53
53
|
|
54
54
|
describe "when the target url doesn't contain a query string" do
|
55
55
|
it "create the SAMLRequest parameter correctly" do
|
56
|
-
unauth_url = OneLogin::
|
56
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings)
|
57
57
|
assert_match /^http:\/\/unauth.com\/logout\?SAMLRequest/, unauth_url
|
58
58
|
end
|
59
59
|
end
|
@@ -62,7 +62,7 @@ class RequestTest < Minitest::Test
|
|
62
62
|
it "create the SAMLRequest parameter correctly" do
|
63
63
|
settings.idp_slo_target_url = "http://example.com?field=value"
|
64
64
|
|
65
|
-
unauth_url = OneLogin::
|
65
|
+
unauth_url = OneLogin::KlRubySaml::Logoutrequest.new.create(settings)
|
66
66
|
assert_match /^http:\/\/example.com\?field=value&SAMLRequest/, unauth_url
|
67
67
|
end
|
68
68
|
end
|
@@ -71,7 +71,7 @@ class RequestTest < Minitest::Test
|
|
71
71
|
it "have access to the request uuid" do
|
72
72
|
settings.idp_slo_target_url = "http://example.com?field=value"
|
73
73
|
|
74
|
-
unauth_req = OneLogin::
|
74
|
+
unauth_req = OneLogin::KlRubySaml::Logoutrequest.new
|
75
75
|
unauth_url = unauth_req.create(settings)
|
76
76
|
|
77
77
|
inflated = decode_saml_request_payload(unauth_url)
|
@@ -92,7 +92,7 @@ class RequestTest < Minitest::Test
|
|
92
92
|
it "created a signed logout request" do
|
93
93
|
settings.compress_request = true
|
94
94
|
|
95
|
-
unauth_req = OneLogin::
|
95
|
+
unauth_req = OneLogin::KlRubySaml::Logoutrequest.new
|
96
96
|
unauth_url = unauth_req.create(settings)
|
97
97
|
|
98
98
|
inflated = decode_saml_request_payload(unauth_url)
|
@@ -106,7 +106,7 @@ class RequestTest < Minitest::Test
|
|
106
106
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
|
107
107
|
settings.security[:digest_method] = XMLSecurity::Document::SHA256
|
108
108
|
|
109
|
-
params = OneLogin::
|
109
|
+
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings)
|
110
110
|
request_xml = Base64.decode64(params["SAMLRequest"])
|
111
111
|
|
112
112
|
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
|
@@ -119,7 +119,7 @@ class RequestTest < Minitest::Test
|
|
119
119
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA384
|
120
120
|
settings.security[:digest_method] = XMLSecurity::Document::SHA512
|
121
121
|
|
122
|
-
params = OneLogin::
|
122
|
+
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings)
|
123
123
|
request_xml = Base64.decode64(params["SAMLRequest"])
|
124
124
|
|
125
125
|
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
|
@@ -143,7 +143,7 @@ class RequestTest < Minitest::Test
|
|
143
143
|
it "create a signature parameter with RSA_SHA1 / SHA1 and validate it" do
|
144
144
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
|
145
145
|
|
146
|
-
params = OneLogin::
|
146
|
+
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
147
147
|
assert params['SAMLRequest']
|
148
148
|
assert params[:RelayState]
|
149
149
|
assert params['Signature']
|
@@ -161,7 +161,7 @@ class RequestTest < Minitest::Test
|
|
161
161
|
it "create a signature parameter with RSA_SHA256 / SHA256 and validate it" do
|
162
162
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
|
163
163
|
|
164
|
-
params = OneLogin::
|
164
|
+
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
165
165
|
assert params['Signature']
|
166
166
|
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA256
|
167
167
|
|
@@ -177,7 +177,7 @@ class RequestTest < Minitest::Test
|
|
177
177
|
it "create a signature parameter with RSA_SHA384 / SHA384 and validate it" do
|
178
178
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA384
|
179
179
|
|
180
|
-
params = OneLogin::
|
180
|
+
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
181
181
|
assert params['Signature']
|
182
182
|
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA384
|
183
183
|
|
@@ -193,7 +193,7 @@ class RequestTest < Minitest::Test
|
|
193
193
|
it "create a signature parameter with RSA_SHA512 / SHA512 and validate it" do
|
194
194
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA512
|
195
195
|
|
196
|
-
params = OneLogin::
|
196
|
+
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
197
197
|
assert params['Signature']
|
198
198
|
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA512
|
199
199
|
|
data/test/logoutresponse_test.rb
CHANGED
@@ -1,18 +1,18 @@
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
|
2
2
|
|
3
|
-
require 'onelogin/ruby-saml/logoutresponse'
|
3
|
+
require 'onelogin/kl-ruby-saml/logoutresponse'
|
4
4
|
require 'logout_responses/logoutresponse_fixtures'
|
5
5
|
|
6
|
-
class
|
6
|
+
class KlRubySamlTest < Minitest::Test
|
7
7
|
|
8
8
|
describe "Logoutresponse" do
|
9
9
|
|
10
|
-
let(:valid_logout_response_without_settings) { OneLogin::
|
11
|
-
let(:valid_logout_response) { OneLogin::
|
10
|
+
let(:valid_logout_response_without_settings) { OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document) }
|
11
|
+
let(:valid_logout_response) { OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document, settings) }
|
12
12
|
|
13
13
|
describe "#new" do
|
14
14
|
it "raise an exception when response is initialized with nil" do
|
15
|
-
assert_raises(ArgumentError) { OneLogin::
|
15
|
+
assert_raises(ArgumentError) { OneLogin::KlRubySaml::Logoutresponse.new(nil) }
|
16
16
|
end
|
17
17
|
it "default to empty settings" do
|
18
18
|
assert_nil valid_logout_response_without_settings.settings
|
@@ -21,12 +21,12 @@ class RubySamlTest < Minitest::Test
|
|
21
21
|
refute_nil valid_logout_response.settings
|
22
22
|
end
|
23
23
|
it "accept constructor-injected options" do
|
24
|
-
logoutresponse = OneLogin::
|
24
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document, nil, { :foo => :bar} )
|
25
25
|
assert !logoutresponse.options.empty?
|
26
26
|
end
|
27
27
|
it "support base64 encoded responses" do
|
28
28
|
generated_logout_response = valid_logout_response_document
|
29
|
-
logoutresponse = OneLogin::
|
29
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(Base64.encode64(generated_logout_response), settings)
|
30
30
|
assert_equal generated_logout_response, logoutresponse.response
|
31
31
|
end
|
32
32
|
end
|
@@ -34,15 +34,15 @@ class RubySamlTest < Minitest::Test
|
|
34
34
|
describe "#validate_structure" do
|
35
35
|
it "invalidates when the logout response has an invalid xml" do
|
36
36
|
settings.soft = true
|
37
|
-
logoutresponse = OneLogin::
|
37
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(invalid_xml_logout_response_document, settings)
|
38
38
|
assert !logoutresponse.send(:validate_structure)
|
39
39
|
assert_includes logoutresponse.errors, "Invalid SAML Logout Response. Not match the saml-schema-protocol-2.0.xsd"
|
40
40
|
end
|
41
41
|
|
42
42
|
it "raise when the logout response has an invalid xml" do
|
43
43
|
settings.soft = false
|
44
|
-
logoutresponse = OneLogin::
|
45
|
-
assert_raises OneLogin::
|
44
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(invalid_xml_logout_response_document, settings)
|
45
|
+
assert_raises OneLogin::KlRubySaml::ValidationError do
|
46
46
|
logoutresponse.send(:validate_structure)
|
47
47
|
end
|
48
48
|
end
|
@@ -58,7 +58,7 @@ class RubySamlTest < Minitest::Test
|
|
58
58
|
in_relation_to_request_id = random_id
|
59
59
|
opts = { :matches_request_id => in_relation_to_request_id}
|
60
60
|
|
61
|
-
logoutresponse = OneLogin::
|
61
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document({:uuid => in_relation_to_request_id}), settings, opts)
|
62
62
|
|
63
63
|
assert logoutresponse.validate
|
64
64
|
|
@@ -74,7 +74,7 @@ class RubySamlTest < Minitest::Test
|
|
74
74
|
settings.idp_entity_id = 'http://app.muda.no'
|
75
75
|
opts = { :matches_request_id => in_relation_to_request_id}
|
76
76
|
|
77
|
-
logoutresponse = OneLogin::
|
77
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document({:uuid => in_relation_to_request_id}), settings, opts)
|
78
78
|
assert logoutresponse.validate
|
79
79
|
assert_equal in_relation_to_request_id, logoutresponse.in_response_to
|
80
80
|
assert logoutresponse.success?
|
@@ -82,7 +82,7 @@ class RubySamlTest < Minitest::Test
|
|
82
82
|
end
|
83
83
|
|
84
84
|
it "invalidate logout response when initiated with blank" do
|
85
|
-
logoutresponse = OneLogin::
|
85
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new("", settings)
|
86
86
|
assert !logoutresponse.validate
|
87
87
|
assert_includes logoutresponse.errors, "Blank logout response"
|
88
88
|
end
|
@@ -90,7 +90,7 @@ class RubySamlTest < Minitest::Test
|
|
90
90
|
it "invalidate logout response when initiated with no idp cert or fingerprint" do
|
91
91
|
settings.idp_cert_fingerprint = nil
|
92
92
|
settings.idp_cert = nil
|
93
|
-
logoutresponse = OneLogin::
|
93
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document, settings)
|
94
94
|
assert !logoutresponse.validate
|
95
95
|
assert_includes logoutresponse.errors, "No fingerprint or certificate on settings of the logout response"
|
96
96
|
end
|
@@ -99,7 +99,7 @@ class RubySamlTest < Minitest::Test
|
|
99
99
|
expected_request_id = "_some_other_expected_uuid"
|
100
100
|
opts = { :matches_request_id => expected_request_id}
|
101
101
|
|
102
|
-
logoutresponse = OneLogin::
|
102
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document, settings, opts)
|
103
103
|
|
104
104
|
assert !logoutresponse.validate
|
105
105
|
refute_equal expected_request_id, logoutresponse.in_response_to
|
@@ -107,7 +107,7 @@ class RubySamlTest < Minitest::Test
|
|
107
107
|
end
|
108
108
|
|
109
109
|
it "invalidate logout response with wrong request status" do
|
110
|
-
logoutresponse = OneLogin::
|
110
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(unsuccessful_logout_response_document, settings)
|
111
111
|
|
112
112
|
assert !logoutresponse.success?
|
113
113
|
assert !logoutresponse.validate
|
@@ -118,7 +118,7 @@ class RubySamlTest < Minitest::Test
|
|
118
118
|
it "invalidate logout response when in lack of issuer setting" do
|
119
119
|
bad_settings = settings
|
120
120
|
bad_settings.issuer = nil
|
121
|
-
logoutresponse = OneLogin::
|
121
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(unsuccessful_logout_response_document, bad_settings)
|
122
122
|
assert !logoutresponse.validate
|
123
123
|
assert_includes logoutresponse.errors, "No issuer in settings of the logout response"
|
124
124
|
end
|
@@ -126,7 +126,7 @@ class RubySamlTest < Minitest::Test
|
|
126
126
|
it "invalidate logout response with wrong issuer" do
|
127
127
|
in_relation_to_request_id = random_id
|
128
128
|
settings.idp_entity_id = 'http://invalid.issuer.example.com/'
|
129
|
-
logoutresponse = OneLogin::
|
129
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document({:uuid => in_relation_to_request_id}), settings)
|
130
130
|
assert !logoutresponse.validate
|
131
131
|
assert_includes logoutresponse.errors, "Doesn't match the issuer, expected: <#{logoutresponse.settings.idp_entity_id}>, but was: <http://app.muda.no>"
|
132
132
|
end
|
@@ -141,23 +141,23 @@ class RubySamlTest < Minitest::Test
|
|
141
141
|
it "validates good logout response" do
|
142
142
|
in_relation_to_request_id = random_id
|
143
143
|
|
144
|
-
logoutresponse = OneLogin::
|
144
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document({:uuid => in_relation_to_request_id}), settings)
|
145
145
|
assert logoutresponse.validate
|
146
146
|
assert_empty logoutresponse.errors
|
147
147
|
end
|
148
148
|
|
149
149
|
it "raises validation error when response initiated with blank" do
|
150
|
-
logoutresponse = OneLogin::
|
150
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new("", settings)
|
151
151
|
|
152
|
-
assert_raises(OneLogin::
|
152
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
153
153
|
assert_includes logoutresponse.errors, "Blank logout response"
|
154
154
|
end
|
155
155
|
|
156
156
|
it "raises validation error when initiated with no idp cert or fingerprint" do
|
157
157
|
settings.idp_cert_fingerprint = nil
|
158
158
|
settings.idp_cert = nil
|
159
|
-
logoutresponse = OneLogin::
|
160
|
-
assert_raises(OneLogin::
|
159
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document, settings)
|
160
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
161
161
|
assert_includes logoutresponse.errors, "No fingerprint or certificate on settings of the logout response"
|
162
162
|
end
|
163
163
|
|
@@ -166,43 +166,43 @@ class RubySamlTest < Minitest::Test
|
|
166
166
|
expected_request_id = "_some_other_expected_id"
|
167
167
|
opts = { :matches_request_id => expected_request_id}
|
168
168
|
|
169
|
-
logoutresponse = OneLogin::
|
170
|
-
assert_raises(OneLogin::
|
169
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document, settings, opts)
|
170
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
171
171
|
assert_includes logoutresponse.errors, "Response does not match the request ID, expected: <#{expected_request_id}>, but was: <#{logoutresponse.in_response_to}>"
|
172
172
|
end
|
173
173
|
|
174
174
|
it "raise validation error for wrong request status" do
|
175
|
-
logoutresponse = OneLogin::
|
175
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(unsuccessful_logout_response_document, settings)
|
176
176
|
|
177
|
-
assert_raises(OneLogin::
|
177
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
178
178
|
assert_includes logoutresponse.errors, "Bad status code. Expected <urn:oasis:names:tc:SAML:2.0:status:Success>, but was: <urn:oasis:names:tc:SAML:2.0:status:Requester>"
|
179
179
|
end
|
180
180
|
|
181
181
|
it "raise validation error when in bad state" do
|
182
182
|
# no settings
|
183
|
-
logoutresponse = OneLogin::
|
184
|
-
assert_raises(OneLogin::
|
183
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(unsuccessful_logout_response_document, settings)
|
184
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
185
185
|
assert_includes logoutresponse.errors, "Bad status code. Expected <urn:oasis:names:tc:SAML:2.0:status:Success>, but was: <urn:oasis:names:tc:SAML:2.0:status:Requester>"
|
186
186
|
end
|
187
187
|
|
188
188
|
it "raise validation error when in lack of issuer setting" do
|
189
189
|
settings.issuer = nil
|
190
|
-
logoutresponse = OneLogin::
|
191
|
-
assert_raises(OneLogin::
|
190
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(unsuccessful_logout_response_document, settings)
|
191
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
192
192
|
assert_includes logoutresponse.errors, "No issuer in settings of the logout response"
|
193
193
|
end
|
194
194
|
|
195
195
|
it "raise validation error when logout response with wrong issuer" do
|
196
196
|
in_relation_to_request_id = random_id
|
197
197
|
settings.idp_entity_id = 'http://invalid.issuer.example.com/'
|
198
|
-
logoutresponse = OneLogin::
|
199
|
-
assert_raises(OneLogin::
|
198
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(valid_logout_response_document({:uuid => in_relation_to_request_id}), settings)
|
199
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.validate }
|
200
200
|
assert_includes logoutresponse.errors, "Doesn't match the issuer, expected: <#{logoutresponse.settings.idp_entity_id}>, but was: <http://app.muda.no>"
|
201
201
|
end
|
202
202
|
end
|
203
203
|
|
204
204
|
describe "#validate_signature" do
|
205
|
-
let (:params) { OneLogin::
|
205
|
+
let (:params) { OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, random_id, "Custom Logout Message", :RelayState => 'http://example.com') }
|
206
206
|
|
207
207
|
before do
|
208
208
|
settings.soft = true
|
@@ -219,7 +219,7 @@ class RubySamlTest < Minitest::Test
|
|
219
219
|
params['RelayState'] = params[:RelayState]
|
220
220
|
options = {}
|
221
221
|
options[:get_params] = params
|
222
|
-
logoutresponse_sign_test = OneLogin::
|
222
|
+
logoutresponse_sign_test = OneLogin::KlRubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
|
223
223
|
assert logoutresponse_sign_test.send(:validate_signature)
|
224
224
|
end
|
225
225
|
|
@@ -228,7 +228,7 @@ class RubySamlTest < Minitest::Test
|
|
228
228
|
params['RelayState'] = params[:RelayState]
|
229
229
|
options = {}
|
230
230
|
options[:get_params] = params
|
231
|
-
logoutresponse = OneLogin::
|
231
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
|
232
232
|
assert logoutresponse.send(:validate_signature)
|
233
233
|
end
|
234
234
|
|
@@ -237,7 +237,7 @@ class RubySamlTest < Minitest::Test
|
|
237
237
|
params['RelayState'] = 'http://invalid.example.com'
|
238
238
|
options = {}
|
239
239
|
options[:get_params] = params
|
240
|
-
logoutresponse = OneLogin::
|
240
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
|
241
241
|
assert !logoutresponse.send(:validate_signature)
|
242
242
|
end
|
243
243
|
|
@@ -247,9 +247,9 @@ class RubySamlTest < Minitest::Test
|
|
247
247
|
params['RelayState'] = 'http://invalid.example.com'
|
248
248
|
options = {}
|
249
249
|
options[:get_params] = params
|
250
|
-
logoutresponse = OneLogin::
|
250
|
+
logoutresponse = OneLogin::KlRubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
|
251
251
|
|
252
|
-
assert_raises(OneLogin::
|
252
|
+
assert_raises(OneLogin::KlRubySaml::ValidationError) { logoutresponse.send(:validate_signature) }
|
253
253
|
assert logoutresponse.errors.include? "Invalid Signature on Logout Response"
|
254
254
|
end
|
255
255
|
end
|
data/test/metadata_test.rb
CHANGED
@@ -1,12 +1,12 @@
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
|
2
2
|
|
3
|
-
require 'onelogin/ruby-saml/metadata'
|
3
|
+
require 'onelogin/kl-ruby-saml/metadata'
|
4
4
|
|
5
5
|
class MetadataTest < Minitest::Test
|
6
6
|
|
7
7
|
describe 'Metadata' do
|
8
|
-
let(:settings) { OneLogin::
|
9
|
-
let(:xml_text) { OneLogin::
|
8
|
+
let(:settings) { OneLogin::KlRubySaml::Settings.new }
|
9
|
+
let(:xml_text) { OneLogin::KlRubySaml::Metadata.new.generate(settings, false) }
|
10
10
|
let(:xml_doc) { REXML::Document.new(xml_text) }
|
11
11
|
let(:spsso_descriptor) { REXML::XPath.first(xml_doc, "//md:SPSSODescriptor") }
|
12
12
|
let(:acs) { REXML::XPath.first(xml_doc, "//md:AssertionConsumerService") }
|
@@ -18,7 +18,7 @@ class MetadataTest < Minitest::Test
|
|
18
18
|
end
|
19
19
|
|
20
20
|
it "generates Pretty Print Service Provider Metadata" do
|
21
|
-
xml_text = OneLogin::
|
21
|
+
xml_text = OneLogin::KlRubySaml::Metadata.new.generate(settings, true)
|
22
22
|
# assert correct xml declaration
|
23
23
|
start = "<?xml version='1.0' encoding='UTF-8'?>\n<md:EntityDescriptor"
|
24
24
|
assert_equal xml_text[0..start.length-1],start
|
@@ -40,7 +40,7 @@ class MetadataTest < Minitest::Test
|
|
40
40
|
it "generates Service Provider Metadata" do
|
41
41
|
settings.single_logout_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
|
42
42
|
settings.single_logout_service_url = "https://foo.example/saml/sls"
|
43
|
-
xml_metadata = OneLogin::
|
43
|
+
xml_metadata = OneLogin::KlRubySaml::Metadata.new.generate(settings, false)
|
44
44
|
|
45
45
|
start = "<?xml version='1.0' encoding='UTF-8'?><md:EntityDescriptor"
|
46
46
|
assert_equal xml_metadata[0..start.length-1],start
|
data/test/request_test.rb
CHANGED
@@ -1,18 +1,18 @@
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
|
2
2
|
|
3
|
-
require 'onelogin/ruby-saml/authrequest'
|
3
|
+
require 'onelogin/kl-ruby-saml/authrequest'
|
4
4
|
|
5
5
|
class RequestTest < Minitest::Test
|
6
6
|
|
7
7
|
describe "Authrequest" do
|
8
|
-
let(:settings) { OneLogin::
|
8
|
+
let(:settings) { OneLogin::KlRubySaml::Settings.new }
|
9
9
|
|
10
10
|
before do
|
11
11
|
settings.idp_sso_target_url = "http://example.com"
|
12
12
|
end
|
13
13
|
|
14
14
|
it "create the deflated SAMLRequest URL parameter" do
|
15
|
-
auth_url = OneLogin::
|
15
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
16
16
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
17
17
|
payload = CGI.unescape(auth_url.split("=").last)
|
18
18
|
decoded = Base64.decode64(payload)
|
@@ -26,7 +26,7 @@ class RequestTest < Minitest::Test
|
|
26
26
|
end
|
27
27
|
|
28
28
|
it "create the deflated SAMLRequest URL parameter including the Destination" do
|
29
|
-
auth_url = OneLogin::
|
29
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
30
30
|
payload = CGI.unescape(auth_url.split("=").last)
|
31
31
|
decoded = Base64.decode64(payload)
|
32
32
|
|
@@ -40,7 +40,7 @@ class RequestTest < Minitest::Test
|
|
40
40
|
|
41
41
|
it "create the SAMLRequest URL parameter without deflating" do
|
42
42
|
settings.compress_request = false
|
43
|
-
auth_url = OneLogin::
|
43
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
44
44
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
45
45
|
payload = CGI.unescape(auth_url.split("=").last)
|
46
46
|
decoded = Base64.decode64(payload)
|
@@ -50,7 +50,7 @@ class RequestTest < Minitest::Test
|
|
50
50
|
|
51
51
|
it "create the SAMLRequest URL parameter with IsPassive" do
|
52
52
|
settings.passive = true
|
53
|
-
auth_url = OneLogin::
|
53
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
54
54
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
55
55
|
payload = CGI.unescape(auth_url.split("=").last)
|
56
56
|
decoded = Base64.decode64(payload)
|
@@ -65,7 +65,7 @@ class RequestTest < Minitest::Test
|
|
65
65
|
|
66
66
|
it "create the SAMLRequest URL parameter with ProtocolBinding" do
|
67
67
|
settings.protocol_binding = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
|
68
|
-
auth_url = OneLogin::
|
68
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
69
69
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
70
70
|
payload = CGI.unescape(auth_url.split("=").last)
|
71
71
|
decoded = Base64.decode64(payload)
|
@@ -80,7 +80,7 @@ class RequestTest < Minitest::Test
|
|
80
80
|
|
81
81
|
it "create the SAMLRequest URL parameter with AttributeConsumingServiceIndex" do
|
82
82
|
settings.attributes_index = 30
|
83
|
-
auth_url = OneLogin::
|
83
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
84
84
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
85
85
|
payload = CGI.unescape(auth_url.split("=").last)
|
86
86
|
decoded = Base64.decode64(payload)
|
@@ -94,7 +94,7 @@ class RequestTest < Minitest::Test
|
|
94
94
|
|
95
95
|
it "create the SAMLRequest URL parameter with ForceAuthn" do
|
96
96
|
settings.force_authn = true
|
97
|
-
auth_url = OneLogin::
|
97
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
98
98
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
99
99
|
payload = CGI.unescape(auth_url.split("=").last)
|
100
100
|
decoded = Base64.decode64(payload)
|
@@ -108,7 +108,7 @@ class RequestTest < Minitest::Test
|
|
108
108
|
|
109
109
|
it "create the SAMLRequest URL parameter with NameID Format" do
|
110
110
|
settings.name_identifier_format = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
|
111
|
-
auth_url = OneLogin::
|
111
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
112
112
|
assert_match /^http:\/\/example\.com\?SAMLRequest=/, auth_url
|
113
113
|
payload = CGI.unescape(auth_url.split("=").last)
|
114
114
|
decoded = Base64.decode64(payload)
|
@@ -122,17 +122,17 @@ class RequestTest < Minitest::Test
|
|
122
122
|
end
|
123
123
|
|
124
124
|
it "accept extra parameters" do
|
125
|
-
auth_url = OneLogin::
|
125
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings, { :hello => "there" })
|
126
126
|
assert_match /&hello=there$/, auth_url
|
127
127
|
|
128
|
-
auth_url = OneLogin::
|
128
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings, { :hello => nil })
|
129
129
|
assert_match /&hello=$/, auth_url
|
130
130
|
end
|
131
131
|
|
132
132
|
describe "when the target url doesn't contain a query string" do
|
133
133
|
it "create the SAMLRequest parameter correctly" do
|
134
134
|
|
135
|
-
auth_url = OneLogin::
|
135
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
136
136
|
assert_match /^http:\/\/example.com\?SAMLRequest/, auth_url
|
137
137
|
end
|
138
138
|
end
|
@@ -141,20 +141,20 @@ class RequestTest < Minitest::Test
|
|
141
141
|
it "create the SAMLRequest parameter correctly" do
|
142
142
|
settings.idp_sso_target_url = "http://example.com?field=value"
|
143
143
|
|
144
|
-
auth_url = OneLogin::
|
144
|
+
auth_url = OneLogin::KlRubySaml::Authrequest.new.create(settings)
|
145
145
|
assert_match /^http:\/\/example.com\?field=value&SAMLRequest/, auth_url
|
146
146
|
end
|
147
147
|
end
|
148
148
|
|
149
149
|
it "create the saml:AuthnContextClassRef element correctly" do
|
150
150
|
settings.authn_context = 'secure/name/password/uri'
|
151
|
-
auth_doc = OneLogin::
|
151
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
152
152
|
assert_match /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/, auth_doc.to_s
|
153
153
|
end
|
154
154
|
|
155
155
|
it "create the saml:AuthnContextClassRef with comparison exact" do
|
156
156
|
settings.authn_context = 'secure/name/password/uri'
|
157
|
-
auth_doc = OneLogin::
|
157
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
158
158
|
assert_match /<samlp:RequestedAuthnContext[\S ]+Comparison='exact'/, auth_doc.to_s
|
159
159
|
assert_match /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/, auth_doc.to_s
|
160
160
|
end
|
@@ -162,14 +162,14 @@ class RequestTest < Minitest::Test
|
|
162
162
|
it "create the saml:AuthnContextClassRef with comparison minimun" do
|
163
163
|
settings.authn_context = 'secure/name/password/uri'
|
164
164
|
settings.authn_context_comparison = 'minimun'
|
165
|
-
auth_doc = OneLogin::
|
165
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
166
166
|
assert_match /<samlp:RequestedAuthnContext[\S ]+Comparison='minimun'/, auth_doc.to_s
|
167
167
|
assert_match /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/, auth_doc.to_s
|
168
168
|
end
|
169
169
|
|
170
170
|
it "create the saml:AuthnContextDeclRef element correctly" do
|
171
171
|
settings.authn_context_decl_ref = 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
|
172
|
-
auth_doc = OneLogin::
|
172
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
173
173
|
assert_match /<saml:AuthnContextDeclRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<\/saml:AuthnContextDeclRef>/, auth_doc.to_s
|
174
174
|
end
|
175
175
|
|
@@ -184,7 +184,7 @@ class RequestTest < Minitest::Test
|
|
184
184
|
end
|
185
185
|
|
186
186
|
it "create a signed request" do
|
187
|
-
params = OneLogin::
|
187
|
+
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings)
|
188
188
|
request_xml = Base64.decode64(params["SAMLRequest"])
|
189
189
|
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
|
190
190
|
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], request_xml
|
@@ -194,7 +194,7 @@ class RequestTest < Minitest::Test
|
|
194
194
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
|
195
195
|
settings.security[:digest_method] = XMLSecurity::Document::SHA512
|
196
196
|
|
197
|
-
params = OneLogin::
|
197
|
+
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings)
|
198
198
|
|
199
199
|
request_xml = Base64.decode64(params["SAMLRequest"])
|
200
200
|
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
|
@@ -219,7 +219,7 @@ class RequestTest < Minitest::Test
|
|
219
219
|
it "create a signature parameter with RSA_SHA1 and validate it" do
|
220
220
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
|
221
221
|
|
222
|
-
params = OneLogin::
|
222
|
+
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
223
223
|
assert params['SAMLRequest']
|
224
224
|
assert params[:RelayState]
|
225
225
|
assert params['Signature']
|
@@ -238,7 +238,7 @@ class RequestTest < Minitest::Test
|
|
238
238
|
it "create a signature parameter with RSA_SHA256 and validate it" do
|
239
239
|
settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
|
240
240
|
|
241
|
-
params = OneLogin::
|
241
|
+
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
242
242
|
assert params['Signature']
|
243
243
|
assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA256
|
244
244
|
|
@@ -254,13 +254,13 @@ class RequestTest < Minitest::Test
|
|
254
254
|
|
255
255
|
it "create the saml:AuthnContextClassRef element correctly" do
|
256
256
|
settings.authn_context = 'secure/name/password/uri'
|
257
|
-
auth_doc = OneLogin::
|
257
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
258
258
|
assert auth_doc.to_s =~ /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/
|
259
259
|
end
|
260
260
|
|
261
261
|
it "create the saml:AuthnContextClassRef with comparison exact" do
|
262
262
|
settings.authn_context = 'secure/name/password/uri'
|
263
|
-
auth_doc = OneLogin::
|
263
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
264
264
|
assert auth_doc.to_s =~ /<samlp:RequestedAuthnContext[\S ]+Comparison='exact'/
|
265
265
|
assert auth_doc.to_s =~ /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/
|
266
266
|
end
|
@@ -268,14 +268,14 @@ class RequestTest < Minitest::Test
|
|
268
268
|
it "create the saml:AuthnContextClassRef with comparison minimun" do
|
269
269
|
settings.authn_context = 'secure/name/password/uri'
|
270
270
|
settings.authn_context_comparison = 'minimun'
|
271
|
-
auth_doc = OneLogin::
|
271
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
272
272
|
assert auth_doc.to_s =~ /<samlp:RequestedAuthnContext[\S ]+Comparison='minimun'/
|
273
273
|
assert auth_doc.to_s =~ /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/
|
274
274
|
end
|
275
275
|
|
276
276
|
it "create the saml:AuthnContextDeclRef element correctly" do
|
277
277
|
settings.authn_context_decl_ref = 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
|
278
|
-
auth_doc = OneLogin::
|
278
|
+
auth_doc = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
279
279
|
assert auth_doc.to_s =~ /<saml:AuthnContextDeclRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<\/saml:AuthnContextDeclRef>/
|
280
280
|
end
|
281
281
|
end
|