kl-ruby-saml 0.0.4 → 0.0.5
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Gemfile +1 -1
- data/README.md +2 -2
- data/lib/{xml_security.rb → kl_xml_security.rb} +5 -5
- data/lib/onelogin/kl-ruby-saml/authrequest.rb +2 -2
- data/lib/onelogin/kl-ruby-saml/logoutrequest.rb +2 -2
- data/lib/onelogin/kl-ruby-saml/logoutresponse.rb +2 -2
- data/lib/onelogin/kl-ruby-saml/metadata.rb +1 -1
- data/lib/onelogin/kl-ruby-saml/response.rb +7 -7
- data/lib/onelogin/kl-ruby-saml/saml_message.rb +1 -1
- data/lib/onelogin/kl-ruby-saml/settings.rb +5 -5
- data/lib/onelogin/kl-ruby-saml/slo_logoutresponse.rb +2 -2
- data/lib/onelogin/kl-ruby-saml/utils.rb +1 -1
- data/lib/onelogin/kl-ruby-saml/version.rb +1 -1
- data/test/logoutrequest_test.rb +16 -16
- data/test/logoutresponse_test.rb +4 -4
- data/test/metadata_test.rb +4 -4
- data/test/request_test.rb +8 -8
- data/test/response_test.rb +3 -3
- data/test/settings_test.rb +4 -4
- data/test/slo_logoutrequest_test.rb +4 -4
- data/test/slo_logoutresponse_test.rb +16 -16
- data/test/xml_security_test.rb +41 -41
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA1:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: f44b4e601309171d6735398f138704b4ff54cea2
|
4
|
+
data.tar.gz: 525052e90ee9d5aa368972a8e1921a609f5aca2d
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 5094f8cd2198ebc0d0914c84325b2f13aa54ea51e766fc59ce66d5c03438b677998014d5559b5598a58467876ac7fbf95549932c802484eb7fc7729c24009230
|
7
|
+
data.tar.gz: f3c2aa6a89a0af160d3087f86106a16d651103cae3cc2503cdfab66cec4bc1db238948abebd156b28c52827ad13a06d044fda3e2be51e63d32c0a61a81205c52
|
data/Gemfile
CHANGED
data/README.md
CHANGED
@@ -376,8 +376,8 @@ The settings related to sign are stored in the `security` attribute of the setti
|
|
376
376
|
settings.security[:logout_responses_signed] = true # Enable or not signature on Logout Response
|
377
377
|
settings.security[:metadata_signed] = true # Enable or not signature on Metadata
|
378
378
|
|
379
|
-
settings.security[:digest_method] =
|
380
|
-
settings.security[:signature_method] =
|
379
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA1
|
380
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
381
381
|
|
382
382
|
# Embeded signature or HTTP GET parameter signature
|
383
383
|
# Note that metadata signature is always embedded regardless of this value.
|
@@ -31,7 +31,7 @@ require "digest/sha1"
|
|
31
31
|
require "digest/sha2"
|
32
32
|
require "onelogin/kl-ruby-saml/validation_error"
|
33
33
|
|
34
|
-
module
|
34
|
+
module KlXMLSecurity
|
35
35
|
|
36
36
|
class BaseDocument < REXML::Document
|
37
37
|
REXML::Document::entity_expansion_limit = 0
|
@@ -110,7 +110,7 @@ module XMLSecurity
|
|
110
110
|
#</Signature>
|
111
111
|
def sign_document(private_key, certificate, signature_method = RSA_SHA1, digest_method = SHA1)
|
112
112
|
noko = Nokogiri.parse(self.to_s) do |options|
|
113
|
-
options =
|
113
|
+
options = KlXMLSecurity::BaseDocument::NOKOGIRI_OPTIONS
|
114
114
|
end
|
115
115
|
|
116
116
|
signature_element = REXML::Element.new("ds:Signature").add_namespace('ds', DSIG)
|
@@ -134,7 +134,7 @@ module XMLSecurity
|
|
134
134
|
|
135
135
|
# add SignatureValue
|
136
136
|
noko_sig_element = Nokogiri.parse(signature_element.to_s) do |options|
|
137
|
-
options =
|
137
|
+
options = KlXMLSecurity::BaseDocument::NOKOGIRI_OPTIONS
|
138
138
|
end
|
139
139
|
|
140
140
|
noko_signed_info_element = noko_sig_element.at_xpath('//ds:Signature/ds:SignedInfo', 'ds' => DSIG)
|
@@ -211,7 +211,7 @@ module XMLSecurity
|
|
211
211
|
cert = OpenSSL::X509::Certificate.new(cert_text)
|
212
212
|
|
213
213
|
if options[:fingerprint_alg]
|
214
|
-
fingerprint_alg =
|
214
|
+
fingerprint_alg = KlXMLSecurity::BaseDocument.new.algorithm(options[:fingerprint_alg]).new
|
215
215
|
else
|
216
216
|
fingerprint_alg = OpenSSL::Digest::SHA1.new
|
217
217
|
end
|
@@ -233,7 +233,7 @@ module XMLSecurity
|
|
233
233
|
inclusive_namespaces = extract_inclusive_namespaces
|
234
234
|
|
235
235
|
document = Nokogiri.parse(self.to_s) do |options|
|
236
|
-
options =
|
236
|
+
options = KlXMLSecurity::BaseDocument::NOKOGIRI_OPTIONS
|
237
237
|
end
|
238
238
|
|
239
239
|
# create a working copy so we don't modify the original
|
@@ -70,7 +70,7 @@ module OneLogin
|
|
70
70
|
:relay_state => relay_state,
|
71
71
|
:sig_alg => params['SigAlg']
|
72
72
|
)
|
73
|
-
sign_algorithm =
|
73
|
+
sign_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method])
|
74
74
|
signature = settings.get_sp_key.sign(sign_algorithm.new, url_string)
|
75
75
|
params['Signature'] = encode(signature)
|
76
76
|
end
|
@@ -89,7 +89,7 @@ module OneLogin
|
|
89
89
|
def create_authentication_xml_doc(settings)
|
90
90
|
time = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
|
91
91
|
|
92
|
-
request_doc =
|
92
|
+
request_doc = KlXMLSecurity::Document.new
|
93
93
|
request_doc.uuid = uuid
|
94
94
|
|
95
95
|
root = request_doc.add_element "samlp:AuthnRequest", { "xmlns:samlp" => "urn:oasis:names:tc:SAML:2.0:protocol", "xmlns:saml" => "urn:oasis:names:tc:SAML:2.0:assertion" }
|
@@ -68,7 +68,7 @@ module OneLogin
|
|
68
68
|
:relay_state => relay_state,
|
69
69
|
:sig_alg => params['SigAlg']
|
70
70
|
)
|
71
|
-
sign_algorithm =
|
71
|
+
sign_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method])
|
72
72
|
signature = settings.get_sp_key.sign(sign_algorithm.new, url_string)
|
73
73
|
params['Signature'] = encode(signature)
|
74
74
|
end
|
@@ -87,7 +87,7 @@ module OneLogin
|
|
87
87
|
def create_logout_request_xml_doc(settings)
|
88
88
|
time = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
|
89
89
|
|
90
|
-
request_doc =
|
90
|
+
request_doc = KlXMLSecurity::Document.new
|
91
91
|
request_doc.uuid = uuid
|
92
92
|
|
93
93
|
root = request_doc.add_element "samlp:LogoutRequest", { "xmlns:samlp" => "urn:oasis:names:tc:SAML:2.0:protocol", "xmlns:saml" => "urn:oasis:names:tc:SAML:2.0:assertion" }
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require "
|
1
|
+
require "kl_xml_security"
|
2
2
|
require "onelogin/kl-ruby-saml/saml_message"
|
3
3
|
|
4
4
|
require "time"
|
@@ -44,7 +44,7 @@ module OneLogin
|
|
44
44
|
|
45
45
|
@options = options
|
46
46
|
@response = decode_raw_saml(response)
|
47
|
-
@document =
|
47
|
+
@document = KlXMLSecurity::SignedDocument.new(@response)
|
48
48
|
end
|
49
49
|
|
50
50
|
# Append the cause to the errors array, and based on the value of soft, return false or raise
|
@@ -18,7 +18,7 @@ module OneLogin
|
|
18
18
|
# @return [String] XML Metadata of the Service Provider
|
19
19
|
#
|
20
20
|
def generate(settings, pretty_print=false)
|
21
|
-
meta_doc =
|
21
|
+
meta_doc = KlXMLSecurity::Document.new
|
22
22
|
namespaces = {
|
23
23
|
"xmlns:md" => "urn:oasis:names:tc:SAML:2.0:metadata"
|
24
24
|
}
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require "
|
1
|
+
require "kl_xml_security"
|
2
2
|
require "onelogin/kl-ruby-saml/attributes"
|
3
3
|
|
4
4
|
require "time"
|
@@ -52,7 +52,7 @@ module OneLogin
|
|
52
52
|
end
|
53
53
|
|
54
54
|
@response = decode_raw_saml(response)
|
55
|
-
@document =
|
55
|
+
@document = KlXMLSecurity::SignedDocument.new(@response, @errors)
|
56
56
|
|
57
57
|
if assertion_encrypted?
|
58
58
|
@decrypted_document = generate_decrypted_document
|
@@ -623,7 +623,7 @@ module OneLogin
|
|
623
623
|
end
|
624
624
|
|
625
625
|
# Generates the decrypted_document
|
626
|
-
# @return [
|
626
|
+
# @return [KlXMLSecurity::SignedDocument] The SAML Response with the assertion decrypted
|
627
627
|
#
|
628
628
|
def generate_decrypted_document
|
629
629
|
if settings.nil? || !settings.get_sp_key
|
@@ -632,7 +632,7 @@ module OneLogin
|
|
632
632
|
|
633
633
|
# Marshal at Ruby 1.8.7 throw an Exception
|
634
634
|
if RUBY_VERSION < "1.9"
|
635
|
-
document_copy =
|
635
|
+
document_copy = KlXMLSecurity::SignedDocument.new(response, errors)
|
636
636
|
else
|
637
637
|
document_copy = Marshal.load(Marshal.dump(document))
|
638
638
|
end
|
@@ -641,8 +641,8 @@ module OneLogin
|
|
641
641
|
end
|
642
642
|
|
643
643
|
# Obtains a SAML Response with the EncryptedAssertion element decrypted
|
644
|
-
# @param document_copy [
|
645
|
-
# @return [
|
644
|
+
# @param document_copy [KlXMLSecurity::SignedDocument] A copy of the original SAML Response with the encrypted assertion
|
645
|
+
# @return [KlXMLSecurity::SignedDocument] The SAML Response with the assertion decrypted
|
646
646
|
#
|
647
647
|
def decrypt_assertion_from_document(document_copy)
|
648
648
|
response_node = REXML::XPath.first(
|
@@ -657,7 +657,7 @@ module OneLogin
|
|
657
657
|
)
|
658
658
|
response_node.add(decrypt_assertion(encrypted_assertion_node))
|
659
659
|
encrypted_assertion_node.remove
|
660
|
-
|
660
|
+
KlXMLSecurity::SignedDocument.new(response_node.to_s)
|
661
661
|
end
|
662
662
|
|
663
663
|
# Checks if the SAML Response contains or not an EncryptedAssertion element
|
@@ -65,7 +65,7 @@ module OneLogin
|
|
65
65
|
def valid_saml?(document, soft = true)
|
66
66
|
begin
|
67
67
|
xml = Nokogiri::XML(document.to_s) do |config|
|
68
|
-
config.options =
|
68
|
+
config.options = KlXMLSecurity::BaseDocument::NOKOGIRI_OPTIONS
|
69
69
|
end
|
70
70
|
rescue Exception => error
|
71
71
|
return false if soft
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require "
|
1
|
+
require "kl_xml_security"
|
2
2
|
require "onelogin/kl-ruby-saml/attribute_service"
|
3
3
|
require "onelogin/kl-ruby-saml/utils"
|
4
4
|
|
@@ -107,7 +107,7 @@ module OneLogin
|
|
107
107
|
idp_cert_fingerprint || begin
|
108
108
|
idp_cert = get_idp_cert
|
109
109
|
if idp_cert
|
110
|
-
fingerprint_alg =
|
110
|
+
fingerprint_alg = KlXMLSecurity::BaseDocument.new.algorithm(idp_cert_fingerprint_algorithm).new
|
111
111
|
fingerprint_alg.hexdigest(idp_cert.to_der).upcase.scan(/../).join(":")
|
112
112
|
end
|
113
113
|
end
|
@@ -145,7 +145,7 @@ module OneLogin
|
|
145
145
|
DEFAULTS = {
|
146
146
|
:assertion_consumer_service_binding => "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST".freeze,
|
147
147
|
:single_logout_service_binding => "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect".freeze,
|
148
|
-
:idp_cert_fingerprint_algorithm =>
|
148
|
+
:idp_cert_fingerprint_algorithm => KlXMLSecurity::Document::SHA1,
|
149
149
|
:compress_request => true,
|
150
150
|
:compress_response => true,
|
151
151
|
:soft => true,
|
@@ -155,8 +155,8 @@ module OneLogin
|
|
155
155
|
:logout_responses_signed => false,
|
156
156
|
:metadata_signed => false,
|
157
157
|
:embed_sign => false,
|
158
|
-
:digest_method =>
|
159
|
-
:signature_method =>
|
158
|
+
:digest_method => KlXMLSecurity::Document::SHA1,
|
159
|
+
:signature_method => KlXMLSecurity::Document::RSA_SHA1
|
160
160
|
}.freeze,
|
161
161
|
:double_quote_xml_attribute_values => false,
|
162
162
|
}.freeze
|
@@ -73,7 +73,7 @@ module OneLogin
|
|
73
73
|
:relay_state => relay_state,
|
74
74
|
:sig_alg => params['SigAlg']
|
75
75
|
)
|
76
|
-
sign_algorithm =
|
76
|
+
sign_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method])
|
77
77
|
signature = settings.get_sp_key.sign(sign_algorithm.new, url_string)
|
78
78
|
params['Signature'] = encode(signature)
|
79
79
|
end
|
@@ -94,7 +94,7 @@ module OneLogin
|
|
94
94
|
def create_logout_response_xml_doc(settings, request_id = nil, logout_message = nil)
|
95
95
|
time = Time.now.utc.strftime('%Y-%m-%dT%H:%M:%SZ')
|
96
96
|
|
97
|
-
response_doc =
|
97
|
+
response_doc = KlXMLSecurity::Document.new
|
98
98
|
response_doc.uuid = uuid
|
99
99
|
|
100
100
|
root = response_doc.add_element 'samlp:LogoutResponse', { 'xmlns:samlp' => 'urn:oasis:names:tc:SAML:2.0:protocol', "xmlns:saml" => "urn:oasis:names:tc:SAML:2.0:assertion" }
|
@@ -70,7 +70,7 @@ module OneLogin
|
|
70
70
|
#
|
71
71
|
def self.verify_signature(params)
|
72
72
|
cert, sig_alg, signature, query_string = [:cert, :sig_alg, :signature, :query_string].map { |k| params[k]}
|
73
|
-
signature_algorithm =
|
73
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(sig_alg)
|
74
74
|
return cert.public_key.verify(signature_algorithm.new, Base64.decode64(signature), query_string)
|
75
75
|
end
|
76
76
|
|
data/test/logoutrequest_test.rb
CHANGED
@@ -103,8 +103,8 @@ class RequestTest < Minitest::Test
|
|
103
103
|
|
104
104
|
it "create a signed logout request with 256 digest and signature method" do
|
105
105
|
settings.compress_request = false
|
106
|
-
settings.security[:signature_method] =
|
107
|
-
settings.security[:digest_method] =
|
106
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
107
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA256
|
108
108
|
|
109
109
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings)
|
110
110
|
request_xml = Base64.decode64(params["SAMLRequest"])
|
@@ -116,8 +116,8 @@ class RequestTest < Minitest::Test
|
|
116
116
|
|
117
117
|
it "create a signed logout request with 512 digest and signature method RSA_SHA384" do
|
118
118
|
settings.compress_request = false
|
119
|
-
settings.security[:signature_method] =
|
120
|
-
settings.security[:digest_method] =
|
119
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA384
|
120
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA512
|
121
121
|
|
122
122
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings)
|
123
123
|
request_xml = Base64.decode64(params["SAMLRequest"])
|
@@ -141,67 +141,67 @@ class RequestTest < Minitest::Test
|
|
141
141
|
end
|
142
142
|
|
143
143
|
it "create a signature parameter with RSA_SHA1 / SHA1 and validate it" do
|
144
|
-
settings.security[:signature_method] =
|
144
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
145
145
|
|
146
146
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
147
147
|
assert params['SAMLRequest']
|
148
148
|
assert params[:RelayState]
|
149
149
|
assert params['Signature']
|
150
|
-
assert_equal params['SigAlg'],
|
150
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA1
|
151
151
|
|
152
152
|
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
|
153
153
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
154
154
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
155
155
|
|
156
|
-
signature_algorithm =
|
156
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
157
157
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA1
|
158
158
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
159
159
|
end
|
160
160
|
|
161
161
|
it "create a signature parameter with RSA_SHA256 / SHA256 and validate it" do
|
162
|
-
settings.security[:signature_method] =
|
162
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
163
163
|
|
164
164
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
165
165
|
assert params['Signature']
|
166
|
-
assert_equal params['SigAlg'],
|
166
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA256
|
167
167
|
|
168
168
|
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
|
169
169
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
170
170
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
171
171
|
|
172
|
-
signature_algorithm =
|
172
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
173
173
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA256
|
174
174
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
175
175
|
end
|
176
176
|
|
177
177
|
it "create a signature parameter with RSA_SHA384 / SHA384 and validate it" do
|
178
|
-
settings.security[:signature_method] =
|
178
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA384
|
179
179
|
|
180
180
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
181
181
|
assert params['Signature']
|
182
|
-
assert_equal params['SigAlg'],
|
182
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA384
|
183
183
|
|
184
184
|
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
|
185
185
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
186
186
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
187
187
|
|
188
|
-
signature_algorithm =
|
188
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
189
189
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA384
|
190
190
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
191
191
|
end
|
192
192
|
|
193
193
|
it "create a signature parameter with RSA_SHA512 / SHA512 and validate it" do
|
194
|
-
settings.security[:signature_method] =
|
194
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA512
|
195
195
|
|
196
196
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
197
197
|
assert params['Signature']
|
198
|
-
assert_equal params['SigAlg'],
|
198
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA512
|
199
199
|
|
200
200
|
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
|
201
201
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
202
202
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
203
203
|
|
204
|
-
signature_algorithm =
|
204
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
205
205
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA512
|
206
206
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
207
207
|
end
|
data/test/logoutresponse_test.rb
CHANGED
@@ -215,7 +215,7 @@ class KlRubySamlTest < Minitest::Test
|
|
215
215
|
end
|
216
216
|
|
217
217
|
it "return true when valid RSA_SHA1 Signature" do
|
218
|
-
settings.security[:signature_method] =
|
218
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
219
219
|
params['RelayState'] = params[:RelayState]
|
220
220
|
options = {}
|
221
221
|
options[:get_params] = params
|
@@ -224,7 +224,7 @@ class KlRubySamlTest < Minitest::Test
|
|
224
224
|
end
|
225
225
|
|
226
226
|
it "return true when valid RSA_SHA256 Signature" do
|
227
|
-
settings.security[:signature_method] =
|
227
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
228
228
|
params['RelayState'] = params[:RelayState]
|
229
229
|
options = {}
|
230
230
|
options[:get_params] = params
|
@@ -233,7 +233,7 @@ class KlRubySamlTest < Minitest::Test
|
|
233
233
|
end
|
234
234
|
|
235
235
|
it "return false when invalid RSA_SHA1 Signature" do
|
236
|
-
settings.security[:signature_method] =
|
236
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
237
237
|
params['RelayState'] = 'http://invalid.example.com'
|
238
238
|
options = {}
|
239
239
|
options[:get_params] = params
|
@@ -242,7 +242,7 @@ class KlRubySamlTest < Minitest::Test
|
|
242
242
|
end
|
243
243
|
|
244
244
|
it "raise when invalid RSA_SHA1 Signature" do
|
245
|
-
settings.security[:signature_method] =
|
245
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
246
246
|
settings.soft = false
|
247
247
|
params['RelayState'] = 'http://invalid.example.com'
|
248
248
|
options = {}
|
data/test/metadata_test.rb
CHANGED
@@ -174,7 +174,7 @@ class MetadataTest < Minitest::Test
|
|
174
174
|
assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>]m, xml_text
|
175
175
|
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], xml_text
|
176
176
|
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2000/09/xmldsig#sha1'/>], xml_text
|
177
|
-
signed_metadata =
|
177
|
+
signed_metadata = KlXMLSecurity::SignedDocument.new(xml_text)
|
178
178
|
assert signed_metadata.validate_document(ruby_saml_cert_fingerprint, false)
|
179
179
|
|
180
180
|
assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
|
@@ -182,8 +182,8 @@ class MetadataTest < Minitest::Test
|
|
182
182
|
|
183
183
|
describe "when digest and signature methods are specified" do
|
184
184
|
before do
|
185
|
-
settings.security[:signature_method] =
|
186
|
-
settings.security[:digest_method] =
|
185
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
186
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA512
|
187
187
|
end
|
188
188
|
|
189
189
|
it "creates a signed metadata with specified digest and signature methods" do
|
@@ -191,7 +191,7 @@ class MetadataTest < Minitest::Test
|
|
191
191
|
assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], xml_text
|
192
192
|
assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#sha512'/>], xml_text
|
193
193
|
|
194
|
-
signed_metadata_2 =
|
194
|
+
signed_metadata_2 = KlXMLSecurity::SignedDocument.new(xml_text)
|
195
195
|
|
196
196
|
assert signed_metadata_2.validate_document(ruby_saml_cert_fingerprint, false)
|
197
197
|
|
data/test/request_test.rb
CHANGED
@@ -191,8 +191,8 @@ class RequestTest < Minitest::Test
|
|
191
191
|
end
|
192
192
|
|
193
193
|
it "create a signed request with 256 digest and signature methods" do
|
194
|
-
settings.security[:signature_method] =
|
195
|
-
settings.security[:digest_method] =
|
194
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
195
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA512
|
196
196
|
|
197
197
|
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings)
|
198
198
|
|
@@ -217,36 +217,36 @@ class RequestTest < Minitest::Test
|
|
217
217
|
end
|
218
218
|
|
219
219
|
it "create a signature parameter with RSA_SHA1 and validate it" do
|
220
|
-
settings.security[:signature_method] =
|
220
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
221
221
|
|
222
222
|
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
223
223
|
assert params['SAMLRequest']
|
224
224
|
assert params[:RelayState]
|
225
225
|
assert params['Signature']
|
226
|
-
assert_equal params['SigAlg'],
|
226
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA1
|
227
227
|
|
228
228
|
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
|
229
229
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
230
230
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
231
231
|
|
232
|
-
signature_algorithm =
|
232
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
233
233
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA1
|
234
234
|
|
235
235
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
236
236
|
end
|
237
237
|
|
238
238
|
it "create a signature parameter with RSA_SHA256 and validate it" do
|
239
|
-
settings.security[:signature_method] =
|
239
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
240
240
|
|
241
241
|
params = OneLogin::KlRubySaml::Authrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
242
242
|
assert params['Signature']
|
243
|
-
assert_equal params['SigAlg'],
|
243
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA256
|
244
244
|
|
245
245
|
query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
|
246
246
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
247
247
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
248
248
|
|
249
|
-
signature_algorithm =
|
249
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
250
250
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA256
|
251
251
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
252
252
|
end
|
data/test/response_test.rb
CHANGED
@@ -43,7 +43,7 @@ class KlRubySamlTest < Minitest::Test
|
|
43
43
|
end
|
44
44
|
|
45
45
|
it "be able to parse a document which contains ampersands" do
|
46
|
-
|
46
|
+
KlXMLSecurity::SignedDocument.any_instance.stubs(:digests_match?).returns(true)
|
47
47
|
OneLogin::KlRubySaml::Response.any_instance.stubs(:validate_conditions).returns(true)
|
48
48
|
|
49
49
|
ampersands_response = OneLogin::KlRubySaml::Response.new(ampersands_document)
|
@@ -301,7 +301,7 @@ class KlRubySamlTest < Minitest::Test
|
|
301
301
|
no_signature_response.stubs(:validate_subject_confirmation).returns(true)
|
302
302
|
no_signature_response.settings = settings
|
303
303
|
no_signature_response.settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
|
304
|
-
|
304
|
+
KlXMLSecurity::SignedDocument.any_instance.expects(:validate_signature).returns(true)
|
305
305
|
assert no_signature_response.is_valid?
|
306
306
|
end
|
307
307
|
|
@@ -870,7 +870,7 @@ class KlRubySamlTest < Minitest::Test
|
|
870
870
|
it 'Sign an unsigned SAML Response XML and initiate the SAML object with it' do
|
871
871
|
xml = Base64.decode64(fixture("test_sign.xml"))
|
872
872
|
|
873
|
-
document =
|
873
|
+
document = KlXMLSecurity::Document.new(xml)
|
874
874
|
|
875
875
|
formated_cert = OneLogin::KlRubySaml::Utils.format_cert(ruby_saml_cert_text)
|
876
876
|
cert = OpenSSL::X509::Certificate.new(formated_cert)
|
data/test/settings_test.rb
CHANGED
@@ -67,14 +67,14 @@ class SettingsTest < Minitest::Test
|
|
67
67
|
settings = OneLogin::KlRubySaml::Settings.new
|
68
68
|
settings.security[:authn_requests_signed] = true
|
69
69
|
settings.security[:embed_sign] = true
|
70
|
-
settings.security[:digest_method] =
|
71
|
-
settings.security[:signature_method] =
|
70
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA256
|
71
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
72
72
|
|
73
73
|
new_settings = OneLogin::KlRubySaml::Settings.new
|
74
74
|
assert_equal new_settings.security[:authn_requests_signed], false
|
75
75
|
assert_equal new_settings.security[:embed_sign], false
|
76
|
-
assert_equal new_settings.security[:digest_method],
|
77
|
-
assert_equal new_settings.security[:signature_method],
|
76
|
+
assert_equal new_settings.security[:digest_method], KlXMLSecurity::Document::SHA1
|
77
|
+
assert_equal new_settings.security[:signature_method], KlXMLSecurity::Document::RSA_SHA1
|
78
78
|
end
|
79
79
|
|
80
80
|
describe "#single_logout_service_url" do
|
@@ -221,7 +221,7 @@ class KlRubySamlTest < Minitest::Test
|
|
221
221
|
end
|
222
222
|
|
223
223
|
it "return true when valid RSA_SHA1 Signature" do
|
224
|
-
settings.security[:signature_method] =
|
224
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
225
225
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
226
226
|
params['RelayState'] = params[:RelayState]
|
227
227
|
options = {}
|
@@ -232,7 +232,7 @@ class KlRubySamlTest < Minitest::Test
|
|
232
232
|
end
|
233
233
|
|
234
234
|
it "return true when valid RSA_SHA256 Signature" do
|
235
|
-
settings.security[:signature_method] =
|
235
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
236
236
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
237
237
|
options = {}
|
238
238
|
options[:get_params] = params
|
@@ -243,7 +243,7 @@ class KlRubySamlTest < Minitest::Test
|
|
243
243
|
end
|
244
244
|
|
245
245
|
it "return false when invalid RSA_SHA1 Signature" do
|
246
|
-
settings.security[:signature_method] =
|
246
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
247
247
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
248
248
|
params['RelayState'] = 'http://invalid.exampcle.com'
|
249
249
|
params[:RelayState] = params['RelayState']
|
@@ -256,7 +256,7 @@ class KlRubySamlTest < Minitest::Test
|
|
256
256
|
end
|
257
257
|
|
258
258
|
it "raise when invalid RSA_SHA1 Signature" do
|
259
|
-
settings.security[:signature_method] =
|
259
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
260
260
|
settings.soft = false
|
261
261
|
params = OneLogin::KlRubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
|
262
262
|
params['RelayState'] = 'http://invalid.exampcle.com'
|
@@ -70,8 +70,8 @@ class SloLogoutresponseTest < Minitest::Test
|
|
70
70
|
end
|
71
71
|
|
72
72
|
it "create a signed logout response with 256 digest and signature methods" do
|
73
|
-
settings.security[:signature_method] =
|
74
|
-
settings.security[:digest_method] =
|
73
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
74
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA256
|
75
75
|
|
76
76
|
params = OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, logout_request.id, "Custom Logout Message")
|
77
77
|
|
@@ -82,8 +82,8 @@ class SloLogoutresponseTest < Minitest::Test
|
|
82
82
|
end
|
83
83
|
|
84
84
|
it "create a signed logout response with 512 digest and signature method RSA_SHA384" do
|
85
|
-
settings.security[:signature_method] =
|
86
|
-
settings.security[:digest_method] =
|
85
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA384
|
86
|
+
settings.security[:digest_method] = KlXMLSecurity::Document::SHA512
|
87
87
|
logout_request.settings = settings
|
88
88
|
|
89
89
|
params = OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, logout_request.id, "Custom Logout Message")
|
@@ -106,76 +106,76 @@ class SloLogoutresponseTest < Minitest::Test
|
|
106
106
|
end
|
107
107
|
|
108
108
|
it "create a signature parameter with RSA_SHA1 and validate it" do
|
109
|
-
settings.security[:signature_method] =
|
109
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA1
|
110
110
|
|
111
111
|
params = OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, logout_request.id, "Custom Logout Message", :RelayState => 'http://example.com')
|
112
112
|
assert params['SAMLResponse']
|
113
113
|
assert params[:RelayState]
|
114
114
|
assert params['Signature']
|
115
|
-
assert_equal params['SigAlg'],
|
115
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA1
|
116
116
|
|
117
117
|
query_string = "SAMLResponse=#{CGI.escape(params['SAMLResponse'])}"
|
118
118
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
119
119
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
120
120
|
|
121
|
-
signature_algorithm =
|
121
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
122
122
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA1
|
123
123
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
124
124
|
end
|
125
125
|
|
126
126
|
it "create a signature parameter with RSA_SHA256 /SHA256 and validate it" do
|
127
|
-
settings.security[:signature_method] =
|
127
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA256
|
128
128
|
|
129
129
|
params = OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, logout_request.id, "Custom Logout Message", :RelayState => 'http://example.com')
|
130
130
|
assert params['SAMLResponse']
|
131
131
|
assert params[:RelayState]
|
132
132
|
assert params['Signature']
|
133
133
|
|
134
|
-
assert_equal params['SigAlg'],
|
134
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA256
|
135
135
|
|
136
136
|
query_string = "SAMLResponse=#{CGI.escape(params['SAMLResponse'])}"
|
137
137
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
138
138
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
139
139
|
|
140
|
-
signature_algorithm =
|
140
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
141
141
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA256
|
142
142
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
143
143
|
end
|
144
144
|
|
145
145
|
it "create a signature parameter with RSA_SHA384 / SHA384 and validate it" do
|
146
|
-
settings.security[:signature_method] =
|
146
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA384
|
147
147
|
|
148
148
|
params = OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, logout_request.id, "Custom Logout Message", :RelayState => 'http://example.com')
|
149
149
|
assert params['SAMLResponse']
|
150
150
|
assert params[:RelayState]
|
151
151
|
assert params['Signature']
|
152
152
|
|
153
|
-
assert_equal params['SigAlg'],
|
153
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA384
|
154
154
|
|
155
155
|
query_string = "SAMLResponse=#{CGI.escape(params['SAMLResponse'])}"
|
156
156
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
157
157
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
158
158
|
|
159
|
-
signature_algorithm =
|
159
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
160
160
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA384
|
161
161
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
162
162
|
end
|
163
163
|
|
164
164
|
it "create a signature parameter with RSA_SHA512 / SHA512 and validate it" do
|
165
|
-
settings.security[:signature_method] =
|
165
|
+
settings.security[:signature_method] = KlXMLSecurity::Document::RSA_SHA512
|
166
166
|
|
167
167
|
params = OneLogin::KlRubySaml::SloLogoutresponse.new.create_params(settings, logout_request.id, "Custom Logout Message", :RelayState => 'http://example.com')
|
168
168
|
assert params['SAMLResponse']
|
169
169
|
assert params[:RelayState]
|
170
170
|
assert params['Signature']
|
171
171
|
|
172
|
-
assert_equal params['SigAlg'],
|
172
|
+
assert_equal params['SigAlg'], KlXMLSecurity::Document::RSA_SHA512
|
173
173
|
|
174
174
|
query_string = "SAMLResponse=#{CGI.escape(params['SAMLResponse'])}"
|
175
175
|
query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
|
176
176
|
query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
|
177
177
|
|
178
|
-
signature_algorithm =
|
178
|
+
signature_algorithm = KlXMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
|
179
179
|
assert_equal signature_algorithm, OpenSSL::Digest::SHA512
|
180
180
|
assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
|
181
181
|
end
|
data/test/xml_security_test.rb
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
|
2
|
-
require '
|
2
|
+
require 'kl_xml_security'
|
3
3
|
require 'timecop'
|
4
4
|
|
5
5
|
class XmlSecurityTest < Minitest::Test
|
6
|
-
include
|
6
|
+
include KlXMLSecurity
|
7
7
|
|
8
8
|
describe "XmlSecurity" do
|
9
9
|
|
10
10
|
let(:decoded_response) { Base64.decode64(response_document_without_recipient) }
|
11
|
-
let(:document) {
|
11
|
+
let(:document) { KlXMLSecurity::SignedDocument.new(decoded_response) }
|
12
12
|
let(:settings) { OneLogin::KlRubySaml::Settings.new() }
|
13
13
|
|
14
14
|
before do
|
@@ -31,7 +31,7 @@ class XmlSecurityTest < Minitest::Test
|
|
31
31
|
|
32
32
|
it "not raise an error when softly validating the document and the X509Certificate is missing" do
|
33
33
|
decoded_response.sub!(/<ds:X509Certificate>.*<\/ds:X509Certificate>/, "")
|
34
|
-
mod_document =
|
34
|
+
mod_document = KlXMLSecurity::SignedDocument.new(decoded_response)
|
35
35
|
assert !mod_document.validate_document("a fingerprint", true) # The fingerprint isn't relevant to this test
|
36
36
|
end
|
37
37
|
|
@@ -54,7 +54,7 @@ class XmlSecurityTest < Minitest::Test
|
|
54
54
|
it "should raise Key validation error" do
|
55
55
|
decoded_response.sub!("<ds:DigestValue>pJQ7MS/ek4KRRWGmv/H43ReHYMs=</ds:DigestValue>",
|
56
56
|
"<ds:DigestValue>b9xsAXLsynugg3Wc1CI3kpWku+0=</ds:DigestValue>")
|
57
|
-
mod_document =
|
57
|
+
mod_document = KlXMLSecurity::SignedDocument.new(decoded_response)
|
58
58
|
base64cert = mod_document.elements["//ds:X509Certificate"].text
|
59
59
|
exception = assert_raises(OneLogin::KlRubySaml::ValidationError) do
|
60
60
|
mod_document.validate_signature(base64cert, false)
|
@@ -64,14 +64,14 @@ class XmlSecurityTest < Minitest::Test
|
|
64
64
|
end
|
65
65
|
|
66
66
|
it "correctly obtain the digest method with alternate namespace declaration" do
|
67
|
-
adfs_document =
|
67
|
+
adfs_document = KlXMLSecurity::SignedDocument.new(fixture(:adfs_response_xmlns, false))
|
68
68
|
base64cert = adfs_document.elements["//X509Certificate"].text
|
69
69
|
assert adfs_document.validate_signature(base64cert, false)
|
70
70
|
end
|
71
71
|
|
72
72
|
it "raise validation error when the X509Certificate is missing" do
|
73
73
|
decoded_response.sub!(/<ds:X509Certificate>.*<\/ds:X509Certificate>/, "")
|
74
|
-
mod_document =
|
74
|
+
mod_document = KlXMLSecurity::SignedDocument.new(decoded_response)
|
75
75
|
exception = assert_raises(OneLogin::KlRubySaml::ValidationError) do
|
76
76
|
mod_document.validate_document("a fingerprint", false) # The fingerprint isn't relevant to this test
|
77
77
|
end
|
@@ -82,46 +82,46 @@ class XmlSecurityTest < Minitest::Test
|
|
82
82
|
describe "#canon_algorithm" do
|
83
83
|
it "C14N_EXCLUSIVE_1_0" do
|
84
84
|
canon_algorithm = Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0
|
85
|
-
assert_equal canon_algorithm,
|
86
|
-
assert_equal canon_algorithm,
|
87
|
-
assert_equal canon_algorithm,
|
85
|
+
assert_equal canon_algorithm, KlXMLSecurity::BaseDocument.new.canon_algorithm("http://www.w3.org/2001/10/xml-exc-c14n#")
|
86
|
+
assert_equal canon_algorithm, KlXMLSecurity::BaseDocument.new.canon_algorithm("http://www.w3.org/2001/10/xml-exc-c14n#WithComments")
|
87
|
+
assert_equal canon_algorithm, KlXMLSecurity::BaseDocument.new.canon_algorithm("other")
|
88
88
|
end
|
89
89
|
|
90
90
|
it "C14N_1_0" do
|
91
91
|
canon_algorithm = Nokogiri::XML::XML_C14N_1_0
|
92
|
-
assert_equal canon_algorithm,
|
92
|
+
assert_equal canon_algorithm, KlXMLSecurity::BaseDocument.new.canon_algorithm("http://www.w3.org/TR/2001/REC-xml-c14n-20010315")
|
93
93
|
end
|
94
94
|
|
95
95
|
it "XML_C14N_1_1" do
|
96
96
|
canon_algorithm = Nokogiri::XML::XML_C14N_1_1
|
97
|
-
assert_equal canon_algorithm,
|
97
|
+
assert_equal canon_algorithm, KlXMLSecurity::BaseDocument.new.canon_algorithm("http://www.w3.org/2006/12/xml-c14n11")
|
98
98
|
end
|
99
99
|
end
|
100
100
|
|
101
101
|
describe "#algorithm" do
|
102
102
|
it "SHA1" do
|
103
103
|
alg = OpenSSL::Digest::SHA1
|
104
|
-
assert_equal alg,
|
105
|
-
assert_equal alg,
|
106
|
-
assert_equal alg,
|
104
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2000/09/xmldsig#rsa-sha1")
|
105
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2000/09/xmldsig#sha1")
|
106
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("other")
|
107
107
|
end
|
108
108
|
|
109
109
|
it "SHA256" do
|
110
110
|
alg = OpenSSL::Digest::SHA256
|
111
|
-
assert_equal alg,
|
112
|
-
assert_equal alg,
|
111
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha256")
|
112
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2001/04/xmldsig-more#sha256")
|
113
113
|
end
|
114
114
|
|
115
115
|
it "SHA384" do
|
116
116
|
alg = OpenSSL::Digest::SHA384
|
117
|
-
assert_equal alg,
|
118
|
-
assert_equal alg,
|
117
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha384")
|
118
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2001/04/xmldsig-more#sha384")
|
119
119
|
end
|
120
120
|
|
121
121
|
it "SHA512" do
|
122
122
|
alg = OpenSSL::Digest::SHA512
|
123
|
-
assert_equal alg,
|
124
|
-
assert_equal alg,
|
123
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2001/04/xmldsig-more#rsa-sha512")
|
124
|
+
assert_equal alg, KlXMLSecurity::BaseDocument.new.algorithm("http://www.w3.org/2001/04/xmldsig-more#sha512")
|
125
125
|
end
|
126
126
|
end
|
127
127
|
|
@@ -133,53 +133,53 @@ class XmlSecurityTest < Minitest::Test
|
|
133
133
|
sha1_fingerprint_downcase = "f13c6b80905a030e6c913e5d15faddb016454872"
|
134
134
|
|
135
135
|
assert response_fingerprint_test.document.validate_document(sha1_fingerprint)
|
136
|
-
assert response_fingerprint_test.document.validate_document(sha1_fingerprint, true, :fingerprint_alg =>
|
136
|
+
assert response_fingerprint_test.document.validate_document(sha1_fingerprint, true, :fingerprint_alg => KlXMLSecurity::Document::SHA1)
|
137
137
|
|
138
138
|
assert response_fingerprint_test.document.validate_document(sha1_fingerprint_downcase)
|
139
|
-
assert response_fingerprint_test.document.validate_document(sha1_fingerprint_downcase, true, :fingerprint_alg =>
|
139
|
+
assert response_fingerprint_test.document.validate_document(sha1_fingerprint_downcase, true, :fingerprint_alg => KlXMLSecurity::Document::SHA1)
|
140
140
|
end
|
141
141
|
|
142
142
|
it "validate using SHA256" do
|
143
143
|
sha256_fingerprint = "C4:C6:BD:41:EC:AD:57:97:CE:7B:7D:80:06:C3:E4:30:53:29:02:0B:DD:2D:47:02:9E:BD:85:AD:93:02:45:21"
|
144
144
|
|
145
145
|
assert !response_fingerprint_test.document.validate_document(sha256_fingerprint)
|
146
|
-
assert response_fingerprint_test.document.validate_document(sha256_fingerprint, true, :fingerprint_alg =>
|
146
|
+
assert response_fingerprint_test.document.validate_document(sha256_fingerprint, true, :fingerprint_alg => KlXMLSecurity::Document::SHA256)
|
147
147
|
end
|
148
148
|
|
149
149
|
it "validate using SHA384" do
|
150
150
|
sha384_fingerprint = "98:FE:17:90:31:E7:68:18:8A:65:4D:DA:F5:76:E2:09:97:BE:8B:E3:7E:AA:8D:63:64:7C:0C:38:23:9A:AC:A2:EC:CE:48:A6:74:4D:E0:4C:50:80:40:B4:8D:55:14:14"
|
151
151
|
|
152
152
|
assert !response_fingerprint_test.document.validate_document(sha384_fingerprint)
|
153
|
-
assert response_fingerprint_test.document.validate_document(sha384_fingerprint, true, :fingerprint_alg =>
|
153
|
+
assert response_fingerprint_test.document.validate_document(sha384_fingerprint, true, :fingerprint_alg => KlXMLSecurity::Document::SHA384)
|
154
154
|
end
|
155
155
|
|
156
156
|
it "validate using SHA512" do
|
157
157
|
sha512_fingerprint = "5A:AE:BA:D0:BA:9D:1E:25:05:01:1E:1A:C9:E9:FF:DB:ED:FA:6E:F7:52:EB:45:49:BD:DB:06:D8:A3:7E:CC:63:3A:04:A2:DD:DF:EE:61:05:D9:58:95:2A:77:17:30:4B:EB:4A:9F:48:4A:44:1C:D0:9E:0B:1E:04:77:FD:A3:D2"
|
158
158
|
|
159
159
|
assert !response_fingerprint_test.document.validate_document(sha512_fingerprint)
|
160
|
-
assert response_fingerprint_test.document.validate_document(sha512_fingerprint, true, :fingerprint_alg =>
|
160
|
+
assert response_fingerprint_test.document.validate_document(sha512_fingerprint, true, :fingerprint_alg => KlXMLSecurity::Document::SHA512)
|
161
161
|
end
|
162
162
|
|
163
163
|
end
|
164
164
|
|
165
165
|
describe "Signature Algorithms" do
|
166
166
|
it "validate using SHA1" do
|
167
|
-
document =
|
167
|
+
document = KlXMLSecurity::SignedDocument.new(fixture(:adfs_response_sha1, false))
|
168
168
|
assert document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
|
169
169
|
end
|
170
170
|
|
171
171
|
it "validate using SHA256" do
|
172
|
-
document =
|
172
|
+
document = KlXMLSecurity::SignedDocument.new(fixture(:adfs_response_sha256, false))
|
173
173
|
assert document.validate_document("28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA")
|
174
174
|
end
|
175
175
|
|
176
176
|
it "validate using SHA384" do
|
177
|
-
document =
|
177
|
+
document = KlXMLSecurity::SignedDocument.new(fixture(:adfs_response_sha384, false))
|
178
178
|
assert document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
|
179
179
|
end
|
180
180
|
|
181
181
|
it "validate using SHA512" do
|
182
|
-
document =
|
182
|
+
document = KlXMLSecurity::SignedDocument.new(fixture(:adfs_response_sha512, false))
|
183
183
|
assert document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
|
184
184
|
end
|
185
185
|
end
|
@@ -189,7 +189,7 @@ class XmlSecurityTest < Minitest::Test
|
|
189
189
|
describe "#extract_inclusive_namespaces" do
|
190
190
|
it "support explicit namespace resolution for exclusive canonicalization" do
|
191
191
|
response = fixture(:open_saml_response, false)
|
192
|
-
document =
|
192
|
+
document = KlXMLSecurity::SignedDocument.new(response)
|
193
193
|
inclusive_namespaces = document.send(:extract_inclusive_namespaces)
|
194
194
|
|
195
195
|
assert_equal %w[ xs ], inclusive_namespaces
|
@@ -197,7 +197,7 @@ class XmlSecurityTest < Minitest::Test
|
|
197
197
|
|
198
198
|
it "support implicit namespace resolution for exclusive canonicalization" do
|
199
199
|
response = fixture(:no_signature_ns, false)
|
200
|
-
document =
|
200
|
+
document = KlXMLSecurity::SignedDocument.new(response)
|
201
201
|
inclusive_namespaces = document.send(:extract_inclusive_namespaces)
|
202
202
|
|
203
203
|
assert_equal %w[ #default saml ds xs xsi ], inclusive_namespaces
|
@@ -219,14 +219,14 @@ class XmlSecurityTest < Minitest::Test
|
|
219
219
|
response = fixture(:no_signature_ns, false)
|
220
220
|
response.slice! %r{<InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default saml ds xs xsi"/>}
|
221
221
|
|
222
|
-
document =
|
222
|
+
document = KlXMLSecurity::SignedDocument.new(response)
|
223
223
|
inclusive_namespaces = document.send(:extract_inclusive_namespaces)
|
224
224
|
|
225
225
|
assert inclusive_namespaces.empty?
|
226
226
|
end
|
227
227
|
end
|
228
228
|
|
229
|
-
describe "
|
229
|
+
describe "KlXMLSecurity::DSIG" do
|
230
230
|
before do
|
231
231
|
settings.idp_sso_target_url = "https://idp.example.com/sso"
|
232
232
|
settings.protocol_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
|
@@ -241,13 +241,13 @@ class XmlSecurityTest < Minitest::Test
|
|
241
241
|
request = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
242
242
|
request.sign_document(ruby_saml_key, ruby_saml_cert)
|
243
243
|
# verify our signature
|
244
|
-
signed_doc =
|
244
|
+
signed_doc = KlXMLSecurity::SignedDocument.new(request.to_s)
|
245
245
|
assert signed_doc.validate_document(ruby_saml_cert_fingerprint, false)
|
246
246
|
|
247
247
|
request2 = OneLogin::KlRubySaml::Authrequest.new.create_authentication_xml_doc(settings)
|
248
248
|
request2.sign_document(ruby_saml_key, ruby_saml_cert_text)
|
249
249
|
# verify our signature
|
250
|
-
signed_doc2 =
|
250
|
+
signed_doc2 = KlXMLSecurity::SignedDocument.new(request2.to_s)
|
251
251
|
assert signed_doc2.validate_document(ruby_saml_cert_fingerprint, false)
|
252
252
|
end
|
253
253
|
|
@@ -256,7 +256,7 @@ class XmlSecurityTest < Minitest::Test
|
|
256
256
|
request.sign_document(ruby_saml_key, ruby_saml_cert_text)
|
257
257
|
|
258
258
|
# verify our signature
|
259
|
-
signed_doc =
|
259
|
+
signed_doc = KlXMLSecurity::SignedDocument.new(request.to_s)
|
260
260
|
assert signed_doc.validate_document(ruby_saml_cert_fingerprint, false)
|
261
261
|
end
|
262
262
|
|
@@ -264,13 +264,13 @@ class XmlSecurityTest < Minitest::Test
|
|
264
264
|
logout_request = OneLogin::KlRubySaml::Logoutrequest.new.create_logout_request_xml_doc(settings)
|
265
265
|
logout_request.sign_document(ruby_saml_key, ruby_saml_cert)
|
266
266
|
# verify our signature
|
267
|
-
signed_doc =
|
267
|
+
signed_doc = KlXMLSecurity::SignedDocument.new(logout_request.to_s)
|
268
268
|
assert signed_doc.validate_document(ruby_saml_cert_fingerprint, false)
|
269
269
|
|
270
270
|
logout_request2 = OneLogin::KlRubySaml::Logoutrequest.new.create_logout_request_xml_doc(settings)
|
271
271
|
logout_request2.sign_document(ruby_saml_key, ruby_saml_cert_text)
|
272
272
|
# verify our signature
|
273
|
-
signed_doc2 =
|
273
|
+
signed_doc2 = KlXMLSecurity::SignedDocument.new(logout_request2.to_s)
|
274
274
|
signed_doc2.validate_document(ruby_saml_cert_fingerprint, false)
|
275
275
|
assert signed_doc2.validate_document(ruby_saml_cert_fingerprint, false)
|
276
276
|
end
|
@@ -279,13 +279,13 @@ class XmlSecurityTest < Minitest::Test
|
|
279
279
|
logout_response = OneLogin::KlRubySaml::SloLogoutresponse.new.create_logout_response_xml_doc(settings, 'request_id_example', "Custom Logout Message")
|
280
280
|
logout_response.sign_document(ruby_saml_key, ruby_saml_cert)
|
281
281
|
# verify our signature
|
282
|
-
signed_doc =
|
282
|
+
signed_doc = KlXMLSecurity::SignedDocument.new(logout_response.to_s)
|
283
283
|
assert signed_doc.validate_document(ruby_saml_cert_fingerprint, false)
|
284
284
|
|
285
285
|
logout_response2 = OneLogin::KlRubySaml::SloLogoutresponse.new.create_logout_response_xml_doc(settings, 'request_id_example', "Custom Logout Message")
|
286
286
|
logout_response2.sign_document(ruby_saml_key, ruby_saml_cert_text)
|
287
287
|
# verify our signature
|
288
|
-
signed_doc2 =
|
288
|
+
signed_doc2 = KlXMLSecurity::SignedDocument.new(logout_response2.to_s)
|
289
289
|
signed_doc2.validate_document(ruby_saml_cert_fingerprint, false)
|
290
290
|
assert signed_doc2.validate_document(ruby_saml_cert_fingerprint, false)
|
291
291
|
end
|
metadata
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: kl-ruby-saml
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.5
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- OneLogin LLC
|
@@ -170,6 +170,7 @@ files:
|
|
170
170
|
- gemfiles/nokogiri-1.5.gemfile
|
171
171
|
- kl-ruby-saml.gemspec
|
172
172
|
- lib/kl-ruby-saml.rb
|
173
|
+
- lib/kl_xml_security.rb
|
173
174
|
- lib/onelogin/kl-ruby-saml.rb
|
174
175
|
- lib/onelogin/kl-ruby-saml/attribute_service.rb
|
175
176
|
- lib/onelogin/kl-ruby-saml/attributes.rb
|
@@ -200,7 +201,6 @@ files:
|
|
200
201
|
- lib/schemas/xenc-schema.xsd
|
201
202
|
- lib/schemas/xml.xsd
|
202
203
|
- lib/schemas/xmldsig-core-schema.xsd
|
203
|
-
- lib/xml_security.rb
|
204
204
|
- test/certificates/certificate1
|
205
205
|
- test/certificates/certificate_without_head_foot
|
206
206
|
- test/certificates/formatted_certificate
|