libsaml 3.7.0 → 3.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e689c8b19f26da4c7cc09904fb18cb052088834f32567abf14023219f9987481
-  data.tar.gz: cbc544b35d8b045d11c09c85f074234466d33b1a90a91a229d47d594456cc646
+  metadata.gz: 52056387172170f48159a403ea8ccd8adccdd4f3bf2f1dbdc104a8034f71d0c0
+  data.tar.gz: bc0f3ca0dd6b47297af36255f9309b1d5b636a322289825d6ac8556321ed2ad9
 SHA512:
-  metadata.gz: 1b11d5dda8bf220251d944a1c8397075e33b0c98c67a42b6d0e61bffe0c67722a8628e79461880d3ecd9d982751ef322ff5485a18cd320c024f1ef13e5d80827
-  data.tar.gz: cec277eeadebc7a6c4f5294437b34f7a39daff47873c9e35ad95e6c42e0f91429580bca880214c4e95728f17cdf599694e60981bab8d24c2483f99ab0c79c1cb
+  metadata.gz: dd18ec249485cee4a1d71aceaa4ea9bd0acb248182fc53f9df7969bd6fcdccb161f5870187ce23bfb748f2879dc5ed17d7a1f14bd939136cf49669e1f6b73ca4
+  data.tar.gz: fb87df8c97c301ac2af52102242f47bd129e4f9bcc617634810f93efac6176dd37f39832cd4b0040fbf5ccf2f171636fcca3e9e1a2436ddbf5f106872469c93a

data/lib/saml.rb

@@ -34,6 +34,8 @@ module Saml
     end
     class UnparseableMessage < SamlError
     end
+    class InvalidParams < SamlError
+    end
     class MetadataDownloadFailed < SamlError
     end
     class InvalidStore < SamlError

data/lib/saml/assertion.rb

@@ -46,7 +46,8 @@ module Saml
       @authn_statement = Saml::Elements::AuthnStatement.new(authn_instant: authn_instant,
                                                             address: options.delete(:address),
                                                             authn_context_class_ref: options.delete(:authn_context_class_ref),
-                                                            session_index: options.delete(:session_index))
+                                                            session_index: options.delete(:session_index),
+                                                            session_not_on_or_after: options.delete(:session_not_on_or_after))
       super(*(args << options))
       @_id           ||= Saml.generate_id
       @issue_instant ||= Time.now

data/lib/saml/bindings/http_post.rb

@@ -20,7 +20,12 @@ module Saml
         end
 
         def receive_message(request, type)
-          message             = Saml::Encoding.decode_64(request.params["SAMLRequest"] || request.params["SAMLResponse"])
+          receive_xml = request.params["SAMLRequest"] || request.params["SAMLResponse"]
+          if receive_xml.nil?
+            raise Saml::Errors::InvalidParams, 'require params `SAMLRequest` or `SAMLResponse`'
+          end
+
+          message             = Saml::Encoding.decode_64(receive_xml)
           notify('receive_message', message)
           request_or_response = Saml.parse_message(message, type)
 

data/lib/saml/bindings/http_redirect.rb

@@ -14,6 +14,11 @@ module Saml
           options[:signature_algorithm] = http_request.params["SigAlg"]
           options[:relay_state]         = http_request.params["RelayState"]
 
+          receive_xml = http_request.params["SAMLRequest"] || http_request.params["SAMLResponse"]
+          if receive_xml.nil?
+            raise Saml::Errors::InvalidParams, 'require params `SAMLRequest` or `SAMLResponse`'
+          end
+          
           request_or_response = parse_request_or_response(options.delete(:type), http_request.params)
 
           redirect_binding = new(request_or_response, options)

data/lib/saml/elements/authn_statement.rb

@@ -8,6 +8,7 @@ module Saml
 
       attribute :authn_instant, Time, tag: "AuthnInstant", on_save: lambda { |val| val.utc.xmlschema }
       attribute :session_index, String, tag: "SessionIndex"
+      attribute :session_not_on_or_after, Time, tag: "SessionNotOnOrAfter", on_save: lambda { |val| val.utc.xmlschema if val.present?}
 
       has_one :subject_locality, Saml::Elements::SubjectLocality, tag: "SubjectLocality"
       has_one :authn_context, Saml::Elements::AuthnContext, tag: "AuthnContext"

data/lib/saml/elements/encrypted_attribute.rb

@@ -15,27 +15,9 @@ module Saml
       validates :encrypted_data, presence: true
 
       def encrypt(attribute, encrypted_key_data, encrypted_data_options = {})
-        self.encrypted_data = Xmlenc::Builder::EncryptedData.new(encrypted_data_options)
-        self.encrypted_data.set_encryption_method algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
-        self.encrypted_data.set_key_name key_name
-
-        encrypted_key_data.each do |key_descriptor, key_options|
-          encrypted_key = self.encrypted_data.encrypt Nokogiri::XML(attribute.to_xml).root.to_xml, key_options
-          encrypted_key.set_encryption_method algorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p', digest_method_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha1'
-          encrypted_key.set_key_name key_descriptor.key_info.key_name
-          encrypted_key.carried_key_name = key_name
-          encrypted_key.encrypt key_descriptor.certificate.public_key
-
-          self.encrypted_keys ||= []
-          self.encrypted_keys << encrypted_key
-        end
+        Saml::Util.encrypt_element(self, attribute, encrypted_key_data, encrypted_data_options)
       end
 
-      private
-
-      def key_name
-        @key_name ||= Saml.generate_id
-      end
     end
   end
 end

data/lib/saml/elements/encrypted_id.rb

@@ -28,16 +28,16 @@ module Saml
 
         if key_descriptors.any?
           if key_descriptors.one?
-            encrypt_for_one_recipient(key_descriptors.first, key_options)
+            encrypt_for_one_key_descriptor(key_descriptors.first, key_options)
           else
-            encrypt_for_multiple_recipients(key_descriptors, key_options)
+            encrypt_for_multiple_key_descriptors(key_descriptors, key_options)
           end
         end
       end
 
       private
 
-      def encrypt_for_one_recipient(key_descriptor, key_options = {})
+      def encrypt_for_one_key_descriptor(key_descriptor, key_options = {})
         self.encrypted_data = Xmlenc::Builder::EncryptedData.new
 
         self.encrypted_data.set_key_retrieval_method Xmlenc::Builder::RetrievalMethod.new(
@@ -47,7 +47,7 @@ module Saml
           algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
         )
 
-        encrypted_key = self.encrypted_data.encrypt(name_id_xml, key_options)
+        encrypted_key = self.encrypted_data.encrypt(Nokogiri::XML(name_id.to_xml).root.to_xml, key_options)
         encrypted_key.set_encryption_method(
           algorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
           digest_method_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha1'
@@ -60,39 +60,18 @@ module Saml
         self.name_id = nil
       end
 
-      def encrypt_for_multiple_recipients(key_descriptors, key_options = {})
-        key_name = key_options[:key_name]
-        encrypted_keys = []
-
-        self.encrypted_data = Xmlenc::Builder::EncryptedData.new
-        self.encrypted_data.set_key_name key_name
-        self.encrypted_data.set_encryption_method(
-          algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc'
-        )
-
-        key_descriptors.each do |key_descriptor|
-          encrypted_key = self.encrypted_data.encrypt(
-            name_id_xml,
-            key_options.merge(id: "_#{SecureRandom.uuid}", carried_key_name: key_name)
-          )
-          encrypted_key.set_encryption_method(
-            algorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p',
-            digest_method_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha1'
-          )
-
-          encrypted_key.set_key_name(key_descriptor.key_info.key_name)
-          encrypted_key.encrypt(key_descriptor.certificate.public_key)
-
-          encrypted_keys << encrypted_key
+      def encrypt_for_multiple_key_descriptors(encrypted_key_data, encrypted_data_options = {})
+        if encrypted_data_options[:recipient].present? && encrypted_key_data.first.is_a?(Saml::Elements::KeyDescriptor)
+          encrypted_key_data.map! do |key_descriptor|
+            [ key_descriptor, { recipient: encrypted_data_options[:recipient] } ]
+          end
         end
 
-        self.encrypted_keys = encrypted_keys
+        Saml::Util.encrypt_element(self, name_id, encrypted_key_data, encrypted_data_options)
+
         self.name_id = nil
       end
 
-      def name_id_xml
-        Nokogiri::XML(name_id.to_xml).root.to_xml
-      end
     end
   end
 end

data/lib/saml/provider.rb

@@ -105,6 +105,8 @@ module Saml
     def digest_method(signature_algorithm)
       digest = signature_algorithm && signature_algorithm =~ /sha(.*?)$/i && $1.to_i
       case digest
+        when 512 then
+          OpenSSL::Digest::SHA512
         when 256 then
           OpenSSL::Digest::SHA256
         else

data/lib/saml/response.rb

@@ -28,10 +28,14 @@ module Saml
       !success? && status.status_code.unknown_principal?
     end
 
-    def encrypt_assertions(certificate, include_certificate: false)
+    def encrypt_assertions(key_descriptor_or_certificate, include_certificate: false, include_key_retrieval_method: false)
       @encrypted_assertions = []
       assertions.each do |assertion|
-        @encrypted_assertions << Saml::Util.encrypt_assertion(assertion, certificate, include_certificate: include_certificate)
+        @encrypted_assertions << Saml::Util.encrypt_assertion(
+          assertion, key_descriptor_or_certificate,
+          include_certificate: include_certificate,
+          include_key_retrieval_method: include_key_retrieval_method
+        )
       end
       assertions.clear
     end

data/lib/saml/util.rb

@@ -60,7 +60,7 @@ module Saml
         end
       end
 
-      def encrypt_assertion(assertion, key_descriptor_or_certificate, include_certificate: false)
+      def encrypt_assertion(assertion, key_descriptor_or_certificate, include_certificate: false, include_key_retrieval_method: false)
         case key_descriptor_or_certificate
         when OpenSSL::X509::Certificate
           certificate = key_descriptor_or_certificate
@@ -87,6 +87,11 @@ module Saml
         end
         encrypted_key.encrypt(certificate.public_key)
 
+        if include_key_retrieval_method
+          encrypted_key.id = '_' + SecureRandom.uuid
+          encrypted_data.set_key_retrieval_method (Xmlenc::Builder::RetrievalMethod.new(uri: "##{encrypted_key.id}"))
+        end
+
         Saml::Elements::EncryptedAssertion.new(encrypted_data: encrypted_data, encrypted_keys: encrypted_key)
       end
 
@@ -98,6 +103,32 @@ module Saml
         Saml::Assertion.parse(encrypted_document.decrypt(private_key), single: true)
       end
 
+      def encrypt_element(element, target_element, encrypted_key_data, encrypted_data_options)
+        key_name = encrypted_data_options.fetch(:key_name, Saml.generate_id)
+
+        element.encrypted_data = Xmlenc::Builder::EncryptedData.new(encrypted_data_options)
+        element.encrypted_data.set_encryption_method(algorithm: 'http://www.w3.org/2001/04/xmlenc#aes256-cbc')
+        element.encrypted_data.set_key_name key_name
+
+        original_encrypted_key = element.encrypted_data.encrypt(Nokogiri::XML(target_element.to_xml).root.to_xml, encrypted_data_options)
+
+        encrypted_key_data.each do |key_descriptor, key_options = {}|
+          encrypted_key_options = key_options.merge(id: Saml.generate_id, data: original_encrypted_key.data)
+
+          encrypted_key = Xmlenc::Builder::EncryptedKey.new(encrypted_key_options)
+          encrypted_key.add_data_reference(element.encrypted_data.id)
+          encrypted_key.set_key_name(key_descriptor.key_info.key_name)
+          encrypted_key.carried_key_name = key_name
+          encrypted_key.set_encryption_method(algorithm: 'http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p', digest_method_algorithm: 'http://www.w3.org/2000/09/xmldsig#sha1')
+          encrypted_key.encrypt(key_descriptor.certificate.public_key)
+
+          element.encrypted_keys ||= []
+          element.encrypted_keys << encrypted_key
+        end
+
+        element
+      end
+
       def encrypt_name_id(name_id, key_descriptor, key_options = {})
         encrypted_id = Saml::Elements::EncryptedID.new(name_id: name_id)
         encrypt_encrypted_id(encrypted_id, key_descriptor, key_options)

data/lib/saml/version.rb

@@ -1,3 +1,3 @@
 module Saml
-  VERSION = '3.7.0'
+  VERSION = '3.9.3'.freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libsaml
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 3.9.3
 platform: ruby
 authors:
 - Benoist Claassen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-03-17 00:00:00.000000000 Z
+date: 2021-06-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -255,7 +255,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.4
 signing_key: 
 specification_version: 4
 summary: A gem to easily create SAML 2.0 messages.