omniauth-mpassid 0.3.1 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 84ae83ac1a0c7a5fc828cbc3737b088c2b1d7541d3f1186bb6912097ef4411cc
-  data.tar.gz: 59ceca293fcacaf4e77e8b255b36b76f7de1494dbe480f7a0139ba8b6a33a03e
+  metadata.gz: 6c9ea1c51d3ddc3c48696d8fa28047dbd410f9a59418cb7f4518c579533d36ad
+  data.tar.gz: c2dc1ef5792ac9363beb524f3e608c19364e7a711e8e2a98e4c57d2bc0919a07
 SHA512:
-  metadata.gz: 435b88073b7560bef4704c05b066ed9ec8b00ec83f2de1a4dc4b7b639e5016e51f91a770bce4db226d8d8d06727f78dab93fd2084e2d360ce04283fd935b0097
-  data.tar.gz: d6918ebe30bc88d39b0b32ffd69d188c33d8bef8f59a094bdf7b88e66f603c0ffc9bb91b1ca9dd8bd2da7977fe9f6a6e58e80fd39a03df018b708c32b61c11f6
+  metadata.gz: f71ab3a1cb4a99f7ad90071c21742b9203f437496f1ebb9b87a6c402e2d2751458e834f27e35ec8691518ebcd2c2a8a8f4064ff6ecc5efd9943fcb94821a81c8
+  data.tar.gz: 165be346329403c8486d526ca2bcbe6c0b9c630f78b81b325843914523f028bd62dfb28007d5b85e370e55ce12551ff3811a19fb39bde216c2e09f1f99b2505e

data/README.md

@@ -1,6 +1,6 @@
 # OmniAuth MPASSid (SAML 2.0)
 
-[![Build Status](https://travis-ci.com/mainio/omniauth-mpassid.svg?branch=master)](https://travis-ci.com/mainio/omniauth-mpassid)
+[![Build Status](https://github.com/mainio/omniauth-mpassid/actions/workflows/ci_omniauth_mpassid.yml/badge.svg)](https://github.com/mainio/omniauth-mpassid/actions)
 [![codecov](https://codecov.io/gh/mainio/omniauth-mpassid/branch/master/graph/badge.svg)](https://codecov.io/gh/mainio/omniauth-mpassid)
 
 This is an unofficial OmniAuth strategy for authenticating with the MPASSid

data/lib/omniauth/strategies/mpassid.rb

@@ -10,6 +10,12 @@ module OmniAuth
       # :test - MPASSid test environment
       option :mode, :production
 
+      # The certificate file to define the certificate.
+      option :certificate_file, nil
+
+      # The private key file to define the private key.
+      option :private_key_file, nil
+
       # Defines the lang parameters to check from the request phase request
       # parameters. A valid language will be added to the IdP sign in redirect
       # URL as the last parameter (with the name `lang` as expected by
@@ -200,11 +206,12 @@ module OmniAuth
           [key, attribute]
         end
 
-        Hash[found_attributes]
+        found_attributes.to_h
       end
 
       option(
         :security_settings,
+        authn_requests_signed: true,
         digest_method: XMLSecurity::Document::SHA256,
         signature_method: XMLSecurity::Document::RSA_SHA256
       )
@@ -264,6 +271,9 @@ module OmniAuth
       # Add the SAML attributes to the extra hash for easier access.
       extra { {saml_attributes: saml_attributes} }
 
+      attr_accessor :options
+      attr_reader :mpassid_thread
+
       def initialize(app, *args, &block)
         super
 
@@ -271,15 +281,19 @@ module OmniAuth
         # fetched from the metadata. The options array is the one that gets
         # priority in case it overrides some of the metadata or locally defined
         # option values.
-        @options = OmniAuth::Strategy::Options.new(
-          mpassid_options.merge(options)
-        )
+        @mpassid_thread = Thread.new do
+          @options = OmniAuth::Strategy::Options.new(
+            mpassid_options.merge(options)
+          )
+          options[:security][:authn_requests_signed] = false unless options[:certificate] && options[:private_key]
+        end
       end
 
       # Override the request phase to be able to pass the lang parameter to
       # the redirect URL. Note that this needs to be the last parameter to
       # be passed to the redirect URL.
       def request_phase
+        mpassid_thread.join if mpassid_thread.alive?
         authn_request = OneLogin::RubySaml::Authrequest.new
         lang = lang_for_authn_request
 
@@ -314,6 +328,14 @@ module OmniAuth
 
     private
 
+      def certificate
+        File.read(options.certificate_file) if options.certificate_file
+      end
+
+      def private_key
+        File.read(options.private_key_file) if options.private_key_file
+      end
+
       def idp_metadata_url
         case options.mode
         when :test
@@ -337,10 +359,16 @@ module OmniAuth
           sso_binding: ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect']
         )
 
+        # Local certificate and private key to decrypt the responses
+        settings[:certificate] = certificate
+        settings[:private_key] = private_key
+
         # Define the security settings as there are some defaults that need to be
         # modified
         security_defaults = OneLogin::RubySaml::Settings::DEFAULTS[:security]
-        settings[:security] = security_defaults.merge(options.security_settings)
+        settings[:security] = security_defaults.merge(
+          options.security_settings.to_h.transform_keys(&:to_sym)
+        )
 
         settings
       end
@@ -357,7 +385,7 @@ module OmniAuth
 
             value = definition[:name].map do |key|
               @attributes.public_send(definition[:type], key)
-            end.reject(&:nil?).first
+            end.compact.first
 
             attrs[target] = value
           end

data/lib/omniauth-mpassid/test/certificate_generator.rb

@@ -17,14 +17,14 @@ module OmniAuth
             cert = OpenSSL::X509::Certificate.new
             cert.subject = cert.issuer = OpenSSL::X509::Name.parse(subject)
             cert.not_before = Time.now
-            cert.not_after = Time.now + 365 * 24 * 60 * 60
+            cert.not_after = Time.now + (365 * 24 * 60 * 60)
             cert.public_key = public_key
             cert.serial = 0x0
             cert.version = 2
 
             inject_certificate_extensions(cert)
 
-            cert.sign(private_key, OpenSSL::Digest::SHA1.new)
+            cert.sign(private_key, OpenSSL::Digest.new('SHA1'))
 
             cert
           end

data/lib/omniauth-mpassid/test/utility.rb

@@ -10,7 +10,7 @@ module OmniAuth
         end
 
         def self.signed_xml(raw_xml_file, opts)
-          raw_xml = IO.read(raw_xml_file)
+          raw_xml = File.read(raw_xml_file)
           signed_xml_from_string(raw_xml, opts)
         end
 

data/lib/omniauth-mpassid/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module MPASSid
-    VERSION = '0.3.1'
+    VERSION = '0.5.1'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-mpassid
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.5.1
 platform: ruby
 authors:
 - Antti Hukkanen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-01-09 00:00:00.000000000 Z
+date: 2022-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-saml
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.3
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.3
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -133,7 +133,8 @@ files:
 homepage: https://github.com/mainio/omniauth-mpassid
 licenses:
 - MIT
-metadata: {}
+metadata:
+  rubygems_mfa_required: 'true'
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -142,7 +143,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '2.5'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="