lyrebird 1.0.1 → 2.1.0

data/test/lyrebird/integration_test.rb

@@ -1,243 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-require "onelogin/ruby-saml"
-
-module Lyrebird
-  class IntegrationTest < Minitest::Test
-    def setup
-      unless defined?(@@idp_cert)
-        @@idp_cert = Certificate.build
-        @@sp_cert = Certificate.build
-      end
-
-      @idp_cert = @@idp_cert
-      @sp_cert = @@sp_cert
-    end
-
-    def test_ruby_saml_parses_signed_response
-      name_id = "user@example.com"
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.name_id = name_id
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert saml_response.is_valid?, saml_response.errors
-      assert_equal name_id, saml_response.nameid
-    end
-
-    def test_ruby_saml_decrypts_signed_and_encrypted_response
-      name_id = "user@example.com"
-      email = "test@example.com"
-      role = "admin"
-
-      response = Response.build(
-        sign_with: @idp_cert,
-        encrypt_with: @sp_cert
-      ) do |r|
-        r.name_id = name_id
-
-        r.attributes do |a|
-          a.email = email
-          a.role = role
-        end
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.private_key = @sp_cert.key_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert saml_response.is_valid?, saml_response.errors
-      assert_equal name_id, saml_response.nameid
-      assert_equal email, saml_response.attributes["email"]
-      assert_equal role, saml_response.attributes["role"]
-    end
-
-    def test_ruby_saml_parses_idp_initiated_response
-      name_id = "user@example.com"
-      email = "test@example.com"
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.in_response_to = nil
-        r.destination = nil
-        r.name_id = name_id
-
-        r.attributes do |a|
-          a.email = email
-        end
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert saml_response.is_valid?, saml_response.errors
-      assert_equal name_id, saml_response.nameid
-      assert_equal email, saml_response.attributes["email"]
-    end
-
-    def test_ruby_saml_parses_multi_value_attributes
-      name_id = "user@example.com"
-      groups = ["admin", "users", "developers"]
-      roles = ["editor", "viewer"]
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.name_id = name_id
-
-        r.attributes do |a|
-          a.groups = groups
-          a.roles = roles
-        end
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert saml_response.is_valid?, saml_response.errors
-      assert_equal name_id, saml_response.nameid
-      assert_equal groups, saml_response.attributes.multi("groups")
-      assert_equal roles, saml_response.attributes.multi("roles")
-    end
-
-    def test_ruby_saml_validates_custom_validity_period
-      name_id = "user@example.com"
-      not_before = Time.now.utc - 60
-      valid_for = 600
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.name_id = name_id
-        r.not_before = not_before
-        r.valid_for = valid_for
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert saml_response.is_valid?, saml_response.errors
-      assert_equal name_id, saml_response.nameid
-    end
-
-    def test_ruby_saml_rejects_expired_assertion
-      name_id = "user@example.com"
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.name_id = name_id
-        r.valid_for = -10
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert_operator Time.now.utc, :>=, saml_response.not_on_or_after
-      refute saml_response.is_valid?
-    end
-
-    def test_ruby_saml_rejects_not_yet_valid_assertion
-      name_id = "user@example.com"
-      not_before = Time.now.utc + 600
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.name_id = name_id
-        r.not_before = not_before
-      end
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        response.mimic,
-        settings: settings
-      )
-
-      assert_operator Time.now.utc, :<, saml_response.not_before
-      refute saml_response.is_valid?
-    end
-
-    def test_ruby_saml_rejects_tampered_signed_response
-      original_email = "user@example.com"
-      tampered_email = "attacker@evil.com"
-
-      response = Response.build(sign_with: @idp_cert) do |r|
-        r.name_id = "user@example.com"
-
-        r.attributes do |a|
-          a.email = original_email
-          a.role = "user"
-        end
-      end
-
-      doc = Nokogiri::XML(Base64.strict_decode64(response.mimic))
-      xpath = "//saml:Attribute[@Name='email']/saml:AttributeValue"
-      email_attr = doc.at_xpath(xpath, { "saml" => SAML_ASSERTION_NS })
-      email_attr.content = tampered_email
-      tampered = Base64.strict_encode64(doc.to_xml(save_with: 0))
-
-      settings = OneLogin::RubySaml::Settings.new.tap do |s|
-        s.idp_cert = @idp_cert.x509_pem
-        s.sp_entity_id = DEFAULTS.audience
-        s.assertion_consumer_service_url = DEFAULTS.recipient
-      end
-
-      saml_response = OneLogin::RubySaml::Response.new(
-        tampered,
-        settings: settings
-      )
-
-      refute saml_response.is_valid?
-      assert_includes saml_response.errors.join(" "), "Signature"
-    end
-  end
-end

data/test/lyrebird/namespaces_test.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class NamespacesTest < Minitest::Test
-    def test_saml_assertion_ns
-      assert_equal "urn:oasis:names:tc:SAML:2.0:assertion", SAML_ASSERTION_NS
-    end
-
-    def test_saml_protocol_ns
-      assert_equal "urn:oasis:names:tc:SAML:2.0:protocol", SAML_PROTOCOL_NS
-    end
-
-    def test_xmldsig_ns
-      assert_equal "http://www.w3.org/2000/09/xmldsig#", XMLDSIG_NS
-    end
-
-    def test_enveloped_sig
-      expected = "http://www.w3.org/2000/09/xmldsig#enveloped-signature"
-      assert_equal expected, ENVELOPED_SIG
-    end
-
-    def test_exc_c14n
-      assert_equal "http://www.w3.org/2001/10/xml-exc-c14n#", EXC_C14N
-    end
-
-    def test_sha256_digest
-      assert_equal "http://www.w3.org/2001/04/xmlenc#sha256", SHA256_DIGEST
-    end
-
-    def test_rsa_sha256
-      expected = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
-      assert_equal expected, RSA_SHA256
-    end
-
-    def test_cm_bearer
-      assert_equal "urn:oasis:names:tc:SAML:2.0:cm:bearer", CM_BEARER
-    end
-
-    def test_attr_name_format
-      expected = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
-      assert_equal expected, ATTR_NAME_FORMAT
-    end
-
-    def test_status_success
-      assert_equal "urn:oasis:names:tc:SAML:2.0:status:Success", STATUS_SUCCESS
-    end
-
-    def test_xmlenc_ns
-      assert_equal "http://www.w3.org/2001/04/xmlenc#", XMLENC_NS
-    end
-
-    def test_aes256_cbc
-      assert_equal "http://www.w3.org/2001/04/xmlenc#aes256-cbc", AES256_CBC
-    end
-
-    def test_rsa_oaep
-      expected = "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"
-      assert_equal expected, RSA_OAEP
-    end
-  end
-end

data/test/lyrebird/response_test.rb

@@ -1,258 +0,0 @@
-# frozen_string_literal: true
-
-require "test_helper"
-
-module Lyrebird
-  class ResponseTest < Minitest::Test
-    NAMESPACES = {
-      "saml" => SAML_ASSERTION_NS,
-      "samlp" => SAML_PROTOCOL_NS,
-      "ds" => XMLDSIG_NS,
-      "xenc" => XMLENC_NS
-    }.freeze
-
-    def setup
-      @response = Response.new
-      @root = @response.document.root
-    end
-
-    def test_build_with_defaults
-      response = Response.build
-      root = response.document.root
-      issuer = root.at_xpath("saml:Issuer", NAMESPACES)
-      assert_equal DEFAULTS.issuer, issuer.text
-    end
-
-    def test_build_with_kwargs
-      issuer = "https://test.example.com"
-      refute_equal issuer, DEFAULTS.issuer
-      response = Response.build(issuer: issuer)
-      root = response.document.root
-      assert_equal issuer, root.at_xpath("saml:Issuer", NAMESPACES).text
-    end
-
-    def test_build_with_block
-      issuer = "https://test.example.com"
-      refute_equal issuer, DEFAULTS.issuer
-      response = Response.build { |r| r.issuer = issuer }
-      root = response.document.root
-      assert_equal issuer, root.at_xpath("saml:Issuer", NAMESPACES).text
-    end
-
-    def test_build_with_kwargs_and_block
-      issuer = "https://test.example.com"
-      email = "test@example.com"
-
-      refute_equal issuer, DEFAULTS.issuer
-      refute_equal email, DEFAULTS.name_id
-
-      response = Response.build(issuer: issuer) do |r|
-        r.name_id = email
-      end
-
-      root = response.document.root
-      assert_equal issuer, root.at_xpath("saml:Issuer", NAMESPACES).text
-      xpath = "saml:Assertion/saml:Subject/saml:NameID"
-      assert_equal email, root.at_xpath(xpath, NAMESPACES).text
-    end
-
-    def test_build_with_attributes_block
-      email = "test@example.com"
-      role = "admin"
-
-      response = Response.build do |r|
-        r.attributes do |a|
-          a.email = email
-          a.role = role
-        end
-      end
-
-      root = response.document.root
-      statement_xpath = "saml:Assertion/saml:AttributeStatement"
-      statement = root.at_xpath(statement_xpath, NAMESPACES)
-      email_xpath = "saml:Attribute[@Name='email']/saml:AttributeValue"
-      role_xpath = "saml:Attribute[@Name='role']/saml:AttributeValue"
-      email_element = statement.at_xpath(email_xpath, NAMESPACES)
-      role_element = statement.at_xpath(role_xpath, NAMESPACES)
-
-      assert_equal email, email_element.text
-      assert_equal role, role_element.text
-    end
-
-    def test_build_with_attributes_hash
-      email = "user@example.com"
-
-      response = Response.build do |r|
-        r.attributes = { email: email }
-      end
-
-      root = response.document.root
-      statement_xpath = "saml:Assertion/saml:AttributeStatement"
-      attr_xpath = "saml:Attribute[@Name='email']/saml:AttributeValue"
-      statement = root.at_xpath(statement_xpath, NAMESPACES)
-      assert_equal email, statement.at_xpath(attr_xpath, NAMESPACES).text
-    end
-
-    def test_mimic_returns_base64
-      encoded = @response.mimic
-      decoded = Base64.strict_decode64(encoded)
-      assert decoded.include?("<samlp:Response")
-      assert decoded.include?("<saml:Assertion")
-    end
-
-    def test_document_is_memoized
-      assert_same @response.document, @response.document
-    end
-
-    def test_mimic_is_stable
-      assert_equal @response.mimic, @response.mimic
-    end
-
-    def test_root_name
-      assert_equal "Response", @root.name
-      assert_equal "samlp", @root.namespace.prefix
-    end
-
-    def test_root_namespace
-      assert_equal SAML_PROTOCOL_NS, @root.namespace.href
-    end
-
-    def test_saml_namespace_declared
-      assert_equal SAML_ASSERTION_NS, @root.namespaces["xmlns:saml"]
-    end
-
-    def test_root_id
-      assert @root["ID"].start_with?("_")
-    end
-
-    def test_root_version
-      assert_equal "2.0", @root["Version"]
-    end
-
-    def test_root_issue_instant
-      instant = Time.iso8601(@root["IssueInstant"])
-      assert_in_delta Time.now.to_i, instant.to_i, 1
-    end
-
-    def test_destination_default
-      assert_equal DEFAULTS.recipient, @root["Destination"]
-    end
-
-    def test_destination_override
-      destination = "https://test.example.com/acs"
-      refute_equal destination, DEFAULTS.recipient
-      root = Response.new(destination: destination).document.root
-      assert_equal destination, root["Destination"]
-    end
-
-    def test_in_response_to_default
-      assert_equal DEFAULTS.in_response_to, @root["InResponseTo"]
-    end
-
-    def test_in_response_to_override
-      in_response_to = "_test_request"
-      refute_equal in_response_to, DEFAULTS.in_response_to
-      root = Response.new(in_response_to: in_response_to).document.root
-      assert_equal in_response_to, root["InResponseTo"]
-    end
-
-    def test_destination_omitted_when_nil
-      root = Response.new(destination: nil).document.root
-      assert_nil root["Destination"]
-    end
-
-    def test_in_response_to_omitted_when_nil
-      root = Response.new(in_response_to: nil).document.root
-      assert_nil root["InResponseTo"]
-    end
-
-    def test_issuer
-      issuer = @root.at_xpath("saml:Issuer", NAMESPACES)
-      assert_equal "Issuer", issuer.name
-      assert_equal "saml", issuer.namespace.prefix
-      assert_equal DEFAULTS.issuer, issuer.text
-    end
-
-    def test_issuer_override
-      url = "https://test.idp.example.com"
-      refute_equal url, DEFAULTS.issuer
-      root = Response.new(issuer: url).document.root
-      issuer = root.at_xpath("saml:Issuer", NAMESPACES)
-      assert_equal url, issuer.text
-    end
-
-    def test_status
-      status = @root.at_xpath("samlp:Status", NAMESPACES)
-      assert_equal "Status", status.name
-      assert_equal "samlp", status.namespace.prefix
-    end
-
-    def test_status_code
-      status_code = @root.at_xpath("samlp:Status/samlp:StatusCode", NAMESPACES)
-      assert_equal "StatusCode", status_code.name
-      assert_equal "samlp", status_code.namespace.prefix
-      assert_equal STATUS_SUCCESS, status_code["Value"]
-    end
-
-    def test_assertion_embedded
-      assertion = @root.at_xpath("saml:Assertion", NAMESPACES)
-      assert_equal "Assertion", assertion.name
-      assert_equal "saml", assertion.namespace.prefix
-    end
-
-    def test_assertion_has_id
-      assertion = @root.at_xpath("saml:Assertion", NAMESPACES)
-      assert assertion["ID"].start_with?("_")
-    end
-
-    def test_assertion_inherits_issuer
-      url = "https://test.idp.example.com"
-      refute_equal url, DEFAULTS.issuer
-      root = Response.new(issuer: url).document.root
-      issuer = root.at_xpath("saml:Assertion/saml:Issuer", NAMESPACES)
-      assert_equal url, issuer.text
-    end
-
-    def test_assertion_options_flow_through
-      email = "test@example.com"
-      refute_equal email, DEFAULTS.name_id
-      root = Response.new(name_id: email).document.root
-      xpath = "saml:Assertion/saml:Subject/saml:NameID"
-      assert_equal email, root.at_xpath(xpath, NAMESPACES).text
-    end
-
-    def test_unsigned_by_default
-      assert_nil @root.at_xpath("ds:Signature", NAMESPACES)
-      assert_nil @root.at_xpath("saml:Assertion/ds:Signature", NAMESPACES)
-    end
-
-    def test_sign_with_signs_response_and_assertion
-      root = Response.new(sign_with: Certificate.build).document.root
-      refute_nil root.at_xpath("ds:Signature", NAMESPACES)
-      refute_nil root.at_xpath("saml:Assertion/ds:Signature", NAMESPACES)
-    end
-
-    def test_not_encrypted_by_default
-      assert_nil @root.at_xpath("saml:EncryptedAssertion", NAMESPACES)
-    end
-
-    def test_encrypt_with_creates_encrypted_assertion
-      root = Response.new(encrypt_with: Certificate.build).document.root
-      ea = root.at_xpath("saml:EncryptedAssertion", NAMESPACES)
-      assert_equal "EncryptedAssertion", ea.name
-      assert_equal "saml", ea.namespace.prefix
-    end
-
-    def test_encrypt_with_removes_plain_assertion
-      root = Response.new(encrypt_with: Certificate.build).document.root
-      assert_nil root.at_xpath("saml:Assertion", NAMESPACES)
-    end
-
-    def test_encrypt_with_contains_encrypted_data
-      root = Response.new(encrypt_with: Certificate.build).document.root
-      xpath = "saml:EncryptedAssertion/xenc:EncryptedData"
-      ed = root.at_xpath(xpath, NAMESPACES)
-      assert_equal "EncryptedData", ed.name
-    end
-  end
-end