omniauth-mpassid 0.2.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0ad530f57ac203cabecd26263fb3b354453accd9c090a6e5ee3fb7c93d9194ff
-  data.tar.gz: '05595993304c718c6b147720243a53df052454560f6a1c78418298d218443ea4'
+  metadata.gz: f48ffa5ce82f1a1fc9c58c23c6922a331d9ddd67a8cf0d18727eb1c9a71349b4
+  data.tar.gz: 493aee76ba5c50ba9bbb21e4cac136a73b6a121128a12bbf95863529d2126fdf
 SHA512:
-  metadata.gz: 2b46afa68f7a1b52b6558adfef5005fb1255c273a1865b3cd70b51bc3f9ba0fc67ed2975e03fe9041cf25013fb54933fb4f10d071bd46a73d6078e4b2136a32e
-  data.tar.gz: 9ffc3151656b1611f1c9cd156383d7857564509011dc87e7432b7604b5c6433d39364c71e6f64075c975387b4acb219a212778730035cf56d15d0a94325e9cf0
+  metadata.gz: 56ec987f2a110f6ce52471793e4e65625db009d1addb6d3c058f9f6e4d1b59fed48ee24d797c668f6849f36dc661f23ff7d4066d36f5ea733d32dae3efe49aa3
+  data.tar.gz: 21e0c03164aad2c68e4d1062120dbc325a8f141ee5f254e672bdb12e5271ab3f63360253e1d23dfe4281f1cd560f3f6a570817ee5ea72e70fd2815fe0218b346

data/lib/omniauth/strategies/mpassid.rb

@@ -10,6 +10,12 @@ module OmniAuth
       # :test - MPASSid test environment
       option :mode, :production
 
+      # The certificate file to define the certificate.
+      option :certificate_file, nil
+
+      # The private key file to define the private key.
+      option :private_key_file, nil
+
       # Defines the lang parameters to check from the request phase request
       # parameters. A valid language will be added to the IdP sign in redirect
       # URL as the last parameter (with the name `lang` as expected by
@@ -23,13 +29,13 @@ module OmniAuth
       # - fi_FI
       #
       # In case a valid language cannot be parsed from the parameter, the lang
-      # parameter will default to `:idp_sso_target_url_default_lang`.
-      option :idp_sso_target_url_lang_params, %w[locale language lang]
+      # parameter will default to `:idp_sso_service_url_default_lang`.
+      option :idp_sso_service_url_lang_params, %w[locale language lang]
 
       # This is the default language to be passed to IdP sign in redirect URL as
       # defined above. In case a valid language is not found from the request
       # parameters, this will be used instead.
-      option :idp_sso_target_url_default_lang, 'fi'
+      option :idp_sso_service_url_default_lang, 'fi'
 
       # The request attributes for MPASSid
       option :request_attributes, [
@@ -39,13 +45,15 @@ module OmniAuth
         # (single value)
         {
           name: 'urn:mpass.id:uid',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassUsername'
         },
         # Funet EDU person learner ID
         # (single value)
         {
           name: 'urn:oid:1.3.6.1.4.1.16161.1.1.27',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'learnerId'
         },
         # The first/given name of the user.
         # (single value)
@@ -68,26 +76,6 @@ module OmniAuth
           name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
           friendly_name: 'sn'
         },
-        # The municipality code of the authenticated user. See
-        # http://tilastokeskus.fi/meta/luokitukset/kunta/001-2017/index.html
-        # for mappings in Finland.
-        # (multi value)
-        {
-          name: 'urn:mpass.id:municipalityCode',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'municipalityCode'
-        },
-        # The human-readable name of the municipality of the authenticated user.
-        # (multi value)
-        {
-          name: 'urn:mpass.id:municipality',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
-        },
-        {
-          name: 'urn:educloudalliance.org:municipality',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'ecaMunicipality'
-        },
         # The school code of the authenticated user. See
         # https://virkailija.opintopolku.fi/koodisto-service/rest/json/oppilaitosnumero/koodi
         # (JSON format)
@@ -99,7 +87,8 @@ module OmniAuth
         # (multi value)
         {
           name: 'urn:mpass.id:schoolCode',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassSchoolCode'
         },
         # The human-readable name of the school of the authenticated user.
         # (multi value)
@@ -108,12 +97,21 @@ module OmniAuth
           name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
           friendly_name: 'school'
         },
+        # Combination of the school code and official name of the educational
+        # institution separated with semicolon.
+        # For instance: 00000;Tuntematon
+        {
+          name: 'urn:mpass.id:schoolInfo',
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassSchoolInfo'
+        },
         # The class/group-information of the authenticated user.
         # For instance: 8A or 3B.
         # (multi value)
         {
           name: 'urn:mpass.id:class',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassClass'
         },
         {
           name: 'urn:educloudalliance.org:group',
@@ -125,7 +123,8 @@ module OmniAuth
         # (multi value)
         {
           name: 'urn:mpass.id:classLevel',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassClassLevel'
         },
         # The role name of the user.
         # For instance Oppilas.
@@ -136,18 +135,43 @@ module OmniAuth
           friendly_name: 'ecaRole'
         },
         # The role of the user in four parts, divided with a semicolon (;)
-        # character. First municipality, followed by school code, group and role
-        # in the group.
-        # For instance Helsinki;32132;9A;Oppilas.
+        # character. First educational provider's organization OID, followed by
+        # school code, group and role in the group.
+        # For instance 1.2.246.562.10.12345678907;99900;7B;Oppilas.
         # (multi value)
+        #
+        # The educational providers' organization OIDs can be found from:
+        # https://github.com/Opetushallitus/aitu/blob/master/ttk-db/resources/db/migration/V11_2__koulutustoimijat.sql
         {
           name: 'urn:mpass.id:role',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassRole'
+        },
+        # The educational provider's permanent organization OID.
+        # (multi value)
+        #
+        # The educational providers' organization OIDs can be found from:
+        # https://github.com/Opetushallitus/aitu/blob/master/ttk-db/resources/db/migration/V11_2__koulutustoimijat.sql
+        {
+          name: 'urn:mpass.id:educationProviderId',
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassEducationProviderOid'
+        },
+        # The educational provider's human-readable name.
+        # (multi value)
+        {
+          name: 'urn:mpass.id:educationProvider',
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'mpassEducationProviderName'
         },
+        # Combination of the education provider's organisation-OID and official
+        # name. Separated by semicolon.
+        # For instance: 1.2.246.562.10.494695390410;Virallinen nimi
+        # (multi value)
         {
-          name: 'urn:educloudalliance.org:structuredRole',
+          name: 'urn:mpass.id:educationProviderInfo',
           name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'ecaStructuredRole'
+          friendly_name: 'mpassEducationProviderInfo'
         }
       ]
 
@@ -158,8 +182,8 @@ module OmniAuth
         # Given name or all first names (in case given name is not found)
         first_name: ['urn:oid:2.5.4.42', 'http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName'],
         last_name: ['urn:oid:2.5.4.4'],
-        # The municipality of the person (literal format in Finnish)
-        location: ['urn:mpass.id:municipality', 'urn:educloudalliance.org:municipality']
+        # The education provider (e.g. municipality) of the person (literal format in Finnish)
+        location: ['urn:mpass.id:educationProvider']
       )
 
       info do
@@ -187,6 +211,7 @@ module OmniAuth
 
       option(
         :security_settings,
+        authn_requests_signed: true,
         digest_method: XMLSecurity::Document::SHA256,
         signature_method: XMLSecurity::Document::RSA_SHA256
       )
@@ -197,14 +222,14 @@ module OmniAuth
       option(
         :saml_attributes_map,
         given_name: ['urn:oid:2.5.4.42'],
-        first_names: ['http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName'],
+        first_names: ['urn:oid:2.5.4.42'],
         last_name: ['urn:oid:2.5.4.4'],
-        municipality_code: {
-          name: ['urn:mpass.id:municipalityCode'],
+        provider_id: {
+          name: ['urn:mpass.id:educationProviderId'],
           type: :multi
         },
-        municipality_name: {
-          name: ['urn:mpass.id:municipality', 'urn:educloudalliance.org:municipality'],
+        provider_name: {
+          name: ['urn:mpass.id:educationProvider'],
           type: :multi
         },
         school_code: {
@@ -231,7 +256,8 @@ module OmniAuth
           name: ['urn:educloudalliance.org:role'],
           type: :multi
         },
-        # Extra (undocumented)
+        # Extra
+        # Unique learner ID
         funet_person_learner_id: ['urn:oid:1.3.6.1.4.1.16161.1.1.27']
       )
 
@@ -255,6 +281,7 @@ module OmniAuth
         @options = OmniAuth::Strategy::Options.new(
           mpassid_options.merge(options)
         )
+        options[:security][:authn_requests_signed] = false unless options[:certificate] && options[:private_key]
       end
 
       # Override the request phase to be able to pass the lang parameter to
@@ -295,6 +322,14 @@ module OmniAuth
 
     private
 
+      def certificate
+        File.read(options.certificate_file) if options.certificate_file
+      end
+
+      def private_key
+        File.read(options.private_key_file) if options.private_key_file
+      end
+
       def idp_metadata_url
         case options.mode
         when :test
@@ -318,10 +353,16 @@ module OmniAuth
           sso_binding: ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect']
         )
 
+        # Local certificate and private key to decrypt the responses
+        settings[:certificate] = certificate
+        settings[:private_key] = private_key
+
         # Define the security settings as there are some defaults that need to be
         # modified
         security_defaults = OneLogin::RubySaml::Settings::DEFAULTS[:security]
-        settings[:security] = security_defaults.merge(options.security_settings)
+        settings[:security] = security_defaults.merge(
+          options.security_settings.to_h.transform_keys(&:to_sym)
+        )
 
         settings
       end
@@ -346,8 +387,8 @@ module OmniAuth
       end
 
       def lang_for_authn_request
-        if options.idp_sso_target_url_lang_params.is_a?(Array)
-          options.idp_sso_target_url_lang_params.each do |param|
+        if options.idp_sso_service_url_lang_params.is_a?(Array)
+          options.idp_sso_service_url_lang_params.each do |param|
             next unless request.params.key?(param.to_s)
 
             lang = parse_language_value(request.params[param.to_s])
@@ -355,7 +396,7 @@ module OmniAuth
           end
         end
 
-        options.idp_sso_target_url_default_lang
+        options.idp_sso_service_url_default_lang
       end
 
       def parse_language_value(string)

data/lib/omniauth-mpassid/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module MPASSid
-    VERSION = '0.2.1'
+    VERSION = '0.3.2'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-mpassid
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.2
 platform: ruby
 authors:
 - Antti Hukkanen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-22 00:00:00.000000000 Z
+date: 2022-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-saml