lyrebird 1.0.0 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61005075359475ff6b492db62c80f7fea1724bb059c03f19a3f9d04c1f37871f
-  data.tar.gz: 0e44c46fe69c8701c7b5441f7a23b6bbf752ad957ae044e5f19d398c01a8db91
+  metadata.gz: 6b9457c5f260c26c5adf43de4262d67077e1f5729b4506ff0efa92ec61519346
+  data.tar.gz: 16a5dbf97973cd9c3673c26212fa0be146955ef9ddaf877768d40120416d6e54
 SHA512:
-  metadata.gz: 1ccd8ff5e0c7a4f441dc275a6231924f8969993c7b670b83a60d01f16e4ebf8fff33ccedffaad21a45dc6bca056d1450c5b6566699f9fd733f71fc9342818bec
-  data.tar.gz: c0ebff2c3cc4134b84fb52327ee41c7d34bd9b2ab3d89ac7a50a3485bc912ca6936ad64388b04253001106a961f7f2caad313b88a2915e86c7bbd4c516eae673
+  metadata.gz: fc83af3b91fb52553dc96733c2a8ea0e89c561fe124bddc1b769cb39f681e03c1e18ff78ec2c83ffe886114b369e4a1630e637e56a1cf2dcee2137a5fe88680b
+  data.tar.gz: 138bd3e26e223c69dc10e435b21c12e0e1fcf3322e64df65d1775695d8920e6a274caf0d1323c5722244d73a47a09296d4d2a1d2037f2761084f470fcff6202c

data/README.md

@@ -7,6 +7,7 @@ A Ruby gem for mimicking SAML Identity Provider (IdP) responses in test
 environments.
 
 ## Installation
+Requires Ruby 3.2 or newer.
 ```ruby
 gem "lyrebird", group: :test
 ```
@@ -24,6 +25,7 @@ class SAMLTest < ActionDispatch::IntegrationTest
       r.recipient = saml_consume_url
       r.audience = root_url
       r.name_id = user.email
+      r.sign_with = Lyrebird::Certificate.default
 
       r.attributes do |a|
         a.email = user.email
@@ -88,8 +90,12 @@ end
 ### Getting the encoded response
 ```ruby
 response.mimic    # Base64-encoded SAML response (for POST binding)
-response.document # Nokogiri::XML::Document for inspection
+response.to_xml   # the same response as plain XML (for reading)
+response.document # the response as a Nokogiri document (for searching)
 ```
+Use `response.to_xml`, not `document.to_xml`. Going through `document`
+adds spaces and line breaks, which breaks the signature, and the SP
+rejects the response.
 
 ### Signing
 Sign both the assertion and response with an IdP certificate:
@@ -112,6 +118,35 @@ response = Lyrebird::Response.build do |r|
   r.encrypt_with = sp_cert
 end
 ```
+The assertion is signed first and then encrypted, and the response is
+signed over the ciphertext.
+
+### Testing rejection paths
+Build deliberately invalid responses the SP should reject:
+```ruby
+# Expired (NotOnOrAfter in the past)
+response = Lyrebird::Response.build do |r|
+  r.sign_with = idp_cert
+  r.valid_for = -10
+end
+
+# Not yet valid (NotBefore in the future)
+response = Lyrebird::Response.build do |r|
+  r.sign_with = idp_cert
+  r.not_before = Time.now.utc + 600
+end
+
+# Wrong audience
+response = Lyrebird::Response.build do |r|
+  r.sign_with = idp_cert
+  r.audience = "https://wrong.example.com"
+end
+
+# Untrusted signature (a certificate the SP does not know)
+response = Lyrebird::Response.build do |r|
+  r.sign_with = Lyrebird::Certificate.build
+end
+```
 
 ### NameID Formats
 ```ruby
@@ -134,13 +169,19 @@ Lyrebird.configure do |d|
   d.attributes = { role: "user" }
 end
 ```
-Defaults are frozen after configuration for thread safety.
+Defaults are frozen after configuration for thread safety, so
+`configure` can only be called once.
 
 ## Certificate
 Generates and manages X.509 certificates for signing SAML responses.
 
 ### Building a certificate
+Key generation is slow, so `Lyrebird::Certificate.default` generates one
+certificate and reuses it.
 ```ruby
+# Generated once and reused
+cert = Lyrebird::Certificate.default
+
 # With defaults
 cert = Lyrebird::Certificate.build
 
@@ -164,11 +205,11 @@ cert = Lyrebird::Certificate.load(
 
 ### Using a certificate
 ```ruby
-cert.key          # OpenSSL::PKey::RSA private key
-cert.x509         # OpenSSL::X509::Certificate object
-cert.key_pem      # PEM-encoded private key
-cert.x509_pem     # PEM-encoded certificate
-cert.sign(data)   # Sign data with RSA-SHA256
-cert.base64       # Base64-encoded certificate (for SAML metadata)
-cert.fingerprint  # SHA256 fingerprint
+cert.key                 # OpenSSL::PKey::RSA private key
+cert.x509                # OpenSSL::X509::Certificate object
+cert.key_pem             # PEM-encoded private key
+cert.x509_pem            # PEM-encoded certificate
+cert.base64              # Base64-encoded certificate (for SAML metadata)
+cert.fingerprint         # SHA256 fingerprint, colon-separated
+cert.fingerprint(:sha1)  # SHA1 fingerprint
 ```

data/lib/lyrebird/assertion.rb

@@ -20,15 +20,15 @@ module Lyrebird
       @name_id_format = name_id_format
       @recipient = recipient
       @in_response_to = in_response_to
-      @not_before = not_before || @issue_instant
-      @not_on_or_after = @issue_instant + valid_for
+      @not_before = (not_before || @issue_instant).to_time.getutc
+      @not_on_or_after = [@issue_instant, @not_before].max + valid_for
       @audience = audience
       @authn_context = authn_context
       @attributes = attributes
     end
 
     def document
-      Nokogiri::XML::Document.new.tap do |doc|
+      @document ||= Nokogiri::XML::Document.new.tap do |doc|
         doc.root = root(doc)
       end
     end
@@ -121,12 +121,14 @@ module Lyrebird
         as.namespace = ns
 
         @attributes.each do |name, values|
+          list = values.is_a?(Enumerable) ? values.to_a : [values].compact
+
           as.add_child(doc.create_element("Attribute")).tap do |a|
             a.namespace = ns
             a["Name"] = name
             a["NameFormat"] = ATTR_NAME_FORMAT
 
-            Array(values).each do |value|
+            list.each do |value|
               a.add_child(doc.create_element("AttributeValue")).tap do |av|
                 av.namespace = ns
                 av.content = value

data/lib/lyrebird/certificate.rb

@@ -2,8 +2,19 @@
 
 module Lyrebird
   class Certificate
+    LOCK = Mutex.new
+
+    EXTENSIONS = {
+      "basicConstraints" => "CA:FALSE",
+      "keyUsage" => "digitalSignature,keyEncipherment"
+    }.freeze
+
     attr_reader :key, :x509
 
+    def self.default
+      LOCK.synchronize { @default ||= build }
+    end
+
     def self.build(**kwargs)
       config = OpenStruct.new(kwargs)
       yield config if block_given?
@@ -18,7 +29,7 @@ module Lyrebird
 
     def initialize(
       bits: 2048,
-      cn: nil,
+      cn: "lyrebird",
       o: nil,
       valid_for: 365,
       valid_until: nil,
@@ -41,18 +52,15 @@ module Lyrebird
       @x509.to_pem
     end
 
-    def fingerprint
-      OpenSSL::Digest::SHA256.hexdigest(@x509.to_der)
+    def fingerprint(algorithm = :sha256)
+      digest = OpenSSL::Digest.new(algorithm.to_s)
+      digest.hexdigest(@x509.to_der).upcase.scan(/../).join(":")
     end
 
     def base64
       Base64.strict_encode64(@x509.to_der)
     end
 
-    def sign(data)
-      @key.sign("SHA256", data)
-    end
-
     private
 
     def build_x509
@@ -66,6 +74,11 @@ module Lyrebird
         c.issuer = c.subject
         c.not_before = now
         c.not_after = @valid_until || now + (@valid_for * 86_400)
+
+        EXTENSIONS.each do |oid, value|
+          c.add_extension(OpenSSL::X509::Extension.new(oid, value, true))
+        end
+
         c.sign(@key, OpenSSL::Digest::SHA256.new)
       end
     end

data/lib/lyrebird/encryption.rb

@@ -49,7 +49,6 @@ module Lyrebird
 
     def build_encrypted_key
       @doc.create_element("EncryptedKey").tap do |ek|
-        ek.add_namespace_definition("xenc", XMLENC_NS)
         ek.namespace = @xenc
 
         ek.add_child(@doc.create_element("EncryptionMethod")).tap do |em|
@@ -81,7 +80,8 @@ module Lyrebird
       cipher.encrypt
       cipher.key = @aes_key
       iv = cipher.random_iv
-      ciphertext = cipher.update(@element.to_xml) + cipher.final
+      plaintext = @element.to_xml(save_with: 0)
+      ciphertext = cipher.update(plaintext) + cipher.final
 
       @doc.create_element("CipherData").tap do |cd|
         cd.namespace = @xenc

data/lib/lyrebird/response.rb

@@ -6,7 +6,11 @@ module Lyrebird
       config = OpenStruct.new(kwargs)
 
       config.define_singleton_method(:attributes) do |&block|
-        self.attributes = OpenStruct.new.tap(&block).to_h
+        current = self[:attributes] || {}
+        return current unless block
+
+        fresh = OpenStruct.new.tap(&block).to_h
+        self[:attributes] = current.transform_keys(&:to_sym).merge(fresh)
       end
 
       yield config if block_given?
@@ -35,11 +39,15 @@ module Lyrebird
     end
 
     def mimic
-      Base64.strict_encode64(document.to_xml(save_with: 0))
+      Base64.strict_encode64(to_xml)
+    end
+
+    def to_xml
+      document.to_xml(save_with: 0)
     end
 
     def document
-      Nokogiri::XML::Document.new.tap do |doc|
+      @document ||= Nokogiri::XML::Document.new.tap do |doc|
         doc.root = build_response(doc)
         sign_assertion(doc) if @sign_with && !@encrypt_with
         sign_response(doc) if @sign_with
@@ -66,13 +74,12 @@ module Lyrebird
         end
 
         r.add_child(build_status(doc))
-        r.add_child(build_assertion_element(doc))
+        r.add_child(build_assertion_element)
       end
     end
 
-    def build_assertion_element(doc)
-      assertion_doc = @assertion.document
-      element = assertion_doc.root
+    def build_assertion_element
+      element = @assertion.document.root
 
       if @encrypt_with
         Signature.new(element, @sign_with).sign! if @sign_with

data/lib/lyrebird/signature.rb

@@ -11,8 +11,11 @@ module Lyrebird
     end
 
     def sign!
-      issuer = @element.at_xpath("saml:Issuer", "saml" => SAML_ASSERTION_NS)
+      ns = { "saml" => SAML_ASSERTION_NS, "ds" => XMLDSIG_NS }
+      @element.at_xpath("ds:Signature", ns)&.remove
+      issuer = @element.at_xpath("saml:Issuer", ns)
       issuer.add_next_sibling(build_signature)
+      populate_signature_value
       self
     end
 
@@ -32,7 +35,6 @@ module Lyrebird
     def build_signed_info
       @doc.create_element("SignedInfo").tap do |si|
         @signed_info = si
-        si.add_namespace_definition("ds", XMLDSIG_NS)
         si.namespace = @ds
 
         si.add_child(@doc.create_element("CanonicalizationMethod")).tap do |cm|
@@ -52,16 +54,14 @@ module Lyrebird
     def build_signature_value
       @doc.create_element("SignatureValue").tap do |sv|
         sv.namespace = @ds
-        canonical = canonicalize_signed_info
-        sig = @certificate.sign(canonical)
-        sv.content = Base64.strict_encode64(sig)
+        @signature_value = sv
       end
     end
 
-    def canonicalize_signed_info
-      xml = @signed_info.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML)
-      xml = xml.sub("<ds:SignedInfo>", "<ds:SignedInfo xmlns:ds=\"#{XMLDSIG_NS}\">")
-      Nokogiri::XML(xml).root.canonicalize(C14N_EXCLUSIVE)
+    def populate_signature_value
+      canonical = @signed_info.canonicalize(C14N_EXCLUSIVE)
+      sig = @certificate.key.sign("SHA256", canonical)
+      @signature_value.content = Base64.strict_encode64(sig)
     end
 
     def build_key_info

data/lib/lyrebird/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Lyrebird
-  VERSION = "1.0.0"
+  VERSION = "2.0.0"
 end

data/lib/lyrebird.rb

@@ -18,8 +18,6 @@ require_relative "lyrebird/signature"
 require_relative "lyrebird/version"
 
 module Lyrebird
-  class Error < StandardError; end
-
   rails_env = ENV["RAILS_ENV"]&.downcase
   rack_env = ENV["RACK_ENV"]&.downcase
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: lyrebird
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 2.0.0
 platform: ruby
 authors:
 - Josh
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-02-02 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -114,11 +114,8 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/ci.yml"
-- ".github/workflows/publish.yml"
 - LICENSE.md
 - README.md
-- Rakefile
 - lib/lyrebird.rb
 - lib/lyrebird/assertion.rb
 - lib/lyrebird/certificate.rb
@@ -129,22 +126,13 @@ files:
 - lib/lyrebird/response.rb
 - lib/lyrebird/signature.rb
 - lib/lyrebird/version.rb
-- lyrebird.gemspec
-- sig/lyrebird.rbs
-- test/lyrebird/assertion_test.rb
-- test/lyrebird/certificate_test.rb
-- test/lyrebird/defaults_test.rb
-- test/lyrebird/encryption_test.rb
-- test/lyrebird/id_test.rb
-- test/lyrebird/integration_test.rb
-- test/lyrebird/namespaces_test.rb
-- test/lyrebird/response_test.rb
-- test/lyrebird/signature_test.rb
-- test/test_helper.rb
 homepage: https://github.com/simplesaml/lyrebird
 licenses:
 - MIT
-metadata: {}
+metadata:
+  source_code_uri: https://github.com/simplesaml/lyrebird
+  changelog_uri: https://github.com/simplesaml/lyrebird/releases
+  bug_tracker_uri: https://github.com/simplesaml/lyrebird/issues
 post_install_message:
 rdoc_options: []
 require_paths:

data/.github/workflows/ci.yml

@@ -1,25 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        ruby-version: ["3.2", "3.3", "3.4", "4.0"]
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up Ruby ${{ matrix.ruby-version }}
-        uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: ${{ matrix.ruby-version }}
-          bundler-cache: true
-      - name: Run tests
-        run: bundle exec rake test

data/.github/workflows/publish.yml

@@ -1,20 +0,0 @@
-name: Publish
-
-on:
-  release:
-    types: [published]
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ruby/setup-ruby@v1
-        with:
-          ruby-version: "3.2"
-      - name: Build gem
-        run: gem build lyrebird.gemspec
-      - name: Publish to RubyGems
-        run: gem push lyrebird-*.gem
-        env:
-          GEM_HOST_API_KEY: ${{ secrets.RUBYGEMS_API_KEY }}

data/Rakefile

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/gem_tasks"
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs.push("test")
-  t.test_files = FileList["test/**/*_test.rb"]
-end
-
-task default: :test

data/lyrebird.gemspec

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/lyrebird/version"
-
-Gem::Specification.new do |spec|
-  spec.name = "lyrebird"
-  spec.version = Lyrebird::VERSION
-  spec.authors = ["Josh"]
-
-  spec.summary = "Mimics SAML Identity Provider (IdP) responses for testing"
-  spec.homepage = "https://github.com/simplesaml/lyrebird"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 3.2.0"
-
-  spec.files = `git ls-files -z`.split("\x0")
-  spec.files.delete("Gemfile")
-  spec.files.delete(".gitignore")
-  spec.files.reject! { |f| f.start_with?("bin/") }
-
-  spec.require_paths = ["lib"]
-
-  spec.add_dependency "base64"
-  spec.add_dependency "nokogiri"
-  spec.add_dependency "ostruct"
-
-  # ruby-saml's gemspec has a conditional dependency on logger for Ruby >= 3.4,
-  # but it was evaluated at gem build time (on Ruby < 3.4), so the published gem
-  # doesn't include it.
-  spec.add_development_dependency "logger"
-  spec.add_development_dependency "minitest"
-  spec.add_development_dependency "rake"
-  spec.add_development_dependency "ruby-saml"
-end

data/sig/lyrebird.rbs

@@ -1,4 +0,0 @@
-module Lyrebird
-  VERSION: String
-  # See the writing guide of rbs: https://github.com/ruby/rbs#guides
-end