omniauth-mpassid 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f48ffa5ce82f1a1fc9c58c23c6922a331d9ddd67a8cf0d18727eb1c9a71349b4
-  data.tar.gz: 493aee76ba5c50ba9bbb21e4cac136a73b6a121128a12bbf95863529d2126fdf
+  metadata.gz: 568537fcfc8b851bce49732d5f2ce6dac99cf0b3e8bcd55998f3e852dc7e0039
+  data.tar.gz: 53e4061a25662610162a00fad3589422457477b6404620d60b02f28340de1f7b
 SHA512:
-  metadata.gz: 56ec987f2a110f6ce52471793e4e65625db009d1addb6d3c058f9f6e4d1b59fed48ee24d797c668f6849f36dc661f23ff7d4066d36f5ea733d32dae3efe49aa3
-  data.tar.gz: 21e0c03164aad2c68e4d1062120dbc325a8f141ee5f254e672bdb12e5271ab3f63360253e1d23dfe4281f1cd560f3f6a570817ee5ea72e70fd2815fe0218b346
+  metadata.gz: 32d0f6a89ef0c21992bd1c2da5ea6e2dff25cb756dfad491c18892c8770e5fc279ac53ce12b94623f0e28addc218abe6b98ff2a32209cacfc14d19b48636aa22
+  data.tar.gz: 5a45f519cdf497d900a9df55dda573e4221c33be1df2e2f624240d10952cde76bf4bfb137c32142a0d35c24ae18d727cec0f738b9f32b86bfe8dec9a293aacff

data/README.md

@@ -1,6 +1,6 @@
 # OmniAuth MPASSid (SAML 2.0)
 
-[![Build Status](https://travis-ci.com/mainio/omniauth-mpassid.svg?branch=master)](https://travis-ci.com/mainio/omniauth-mpassid)
+[![Build Status](https://github.com/mainio/omniauth-mpassid/actions/workflows/ci_omniauth_mpassid.yml/badge.svg)](https://github.com/mainio/omniauth-mpassid/actions)
 [![codecov](https://codecov.io/gh/mainio/omniauth-mpassid/branch/master/graph/badge.svg)](https://codecov.io/gh/mainio/omniauth-mpassid)
 
 This is an unofficial OmniAuth strategy for authenticating with the MPASSid

data/lib/omniauth/strategies/mpassid.rb

@@ -10,12 +10,6 @@ module OmniAuth
       # :test - MPASSid test environment
       option :mode, :production
 
-      # The certificate file to define the certificate.
-      option :certificate_file, nil
-
-      # The private key file to define the private key.
-      option :private_key_file, nil
-
       # Defines the lang parameters to check from the request phase request
       # parameters. A valid language will be added to the IdP sign in redirect
       # URL as the last parameter (with the name `lang` as expected by
@@ -45,15 +39,13 @@ module OmniAuth
         # (single value)
         {
           name: 'urn:mpass.id:uid',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassUsername'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
         },
         # Funet EDU person learner ID
         # (single value)
         {
           name: 'urn:oid:1.3.6.1.4.1.16161.1.1.27',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'learnerId'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
         },
         # The first/given name of the user.
         # (single value)
@@ -76,6 +68,26 @@ module OmniAuth
           name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
           friendly_name: 'sn'
         },
+        # The municipality code of the authenticated user. See
+        # http://tilastokeskus.fi/meta/luokitukset/kunta/001-2017/index.html
+        # for mappings in Finland.
+        # (multi value)
+        {
+          name: 'urn:mpass.id:municipalityCode',
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'municipalityCode'
+        },
+        # The human-readable name of the municipality of the authenticated user.
+        # (multi value)
+        {
+          name: 'urn:mpass.id:municipality',
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
+        },
+        {
+          name: 'urn:educloudalliance.org:municipality',
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
+          friendly_name: 'ecaMunicipality'
+        },
         # The school code of the authenticated user. See
         # https://virkailija.opintopolku.fi/koodisto-service/rest/json/oppilaitosnumero/koodi
         # (JSON format)
@@ -87,8 +99,7 @@ module OmniAuth
         # (multi value)
         {
           name: 'urn:mpass.id:schoolCode',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassSchoolCode'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
         },
         # The human-readable name of the school of the authenticated user.
         # (multi value)
@@ -97,21 +108,12 @@ module OmniAuth
           name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
           friendly_name: 'school'
         },
-        # Combination of the school code and official name of the educational
-        # institution separated with semicolon.
-        # For instance: 00000;Tuntematon
-        {
-          name: 'urn:mpass.id:schoolInfo',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassSchoolInfo'
-        },
         # The class/group-information of the authenticated user.
         # For instance: 8A or 3B.
         # (multi value)
         {
           name: 'urn:mpass.id:class',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassClass'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
         },
         {
           name: 'urn:educloudalliance.org:group',
@@ -123,8 +125,7 @@ module OmniAuth
         # (multi value)
         {
           name: 'urn:mpass.id:classLevel',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassClassLevel'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
         },
         # The role name of the user.
         # For instance Oppilas.
@@ -135,43 +136,18 @@ module OmniAuth
           friendly_name: 'ecaRole'
         },
         # The role of the user in four parts, divided with a semicolon (;)
-        # character. First educational provider's organization OID, followed by
-        # school code, group and role in the group.
-        # For instance 1.2.246.562.10.12345678907;99900;7B;Oppilas.
+        # character. First municipality, followed by school code, group and role
+        # in the group.
+        # For instance Helsinki;32132;9A;Oppilas.
         # (multi value)
-        #
-        # The educational providers' organization OIDs can be found from:
-        # https://github.com/Opetushallitus/aitu/blob/master/ttk-db/resources/db/migration/V11_2__koulutustoimijat.sql
         {
           name: 'urn:mpass.id:role',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassRole'
-        },
-        # The educational provider's permanent organization OID.
-        # (multi value)
-        #
-        # The educational providers' organization OIDs can be found from:
-        # https://github.com/Opetushallitus/aitu/blob/master/ttk-db/resources/db/migration/V11_2__koulutustoimijat.sql
-        {
-          name: 'urn:mpass.id:educationProviderId',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassEducationProviderOid'
-        },
-        # The educational provider's human-readable name.
-        # (multi value)
-        {
-          name: 'urn:mpass.id:educationProvider',
-          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassEducationProviderName'
+          name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'
         },
-        # Combination of the education provider's organisation-OID and official
-        # name. Separated by semicolon.
-        # For instance: 1.2.246.562.10.494695390410;Virallinen nimi
-        # (multi value)
         {
-          name: 'urn:mpass.id:educationProviderInfo',
+          name: 'urn:educloudalliance.org:structuredRole',
           name_format: 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri',
-          friendly_name: 'mpassEducationProviderInfo'
+          friendly_name: 'ecaStructuredRole'
         }
       ]
 
@@ -182,8 +158,8 @@ module OmniAuth
         # Given name or all first names (in case given name is not found)
         first_name: ['urn:oid:2.5.4.42', 'http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName'],
         last_name: ['urn:oid:2.5.4.4'],
-        # The education provider (e.g. municipality) of the person (literal format in Finnish)
-        location: ['urn:mpass.id:educationProvider']
+        # The municipality of the person (literal format in Finnish)
+        location: ['urn:mpass.id:municipality', 'urn:educloudalliance.org:municipality']
       )
 
       info do
@@ -211,7 +187,6 @@ module OmniAuth
 
       option(
         :security_settings,
-        authn_requests_signed: true,
         digest_method: XMLSecurity::Document::SHA256,
         signature_method: XMLSecurity::Document::RSA_SHA256
       )
@@ -222,14 +197,14 @@ module OmniAuth
       option(
         :saml_attributes_map,
         given_name: ['urn:oid:2.5.4.42'],
-        first_names: ['urn:oid:2.5.4.42'],
+        first_names: ['http://eidas.europa.eu/attributes/naturalperson/CurrentGivenName'],
         last_name: ['urn:oid:2.5.4.4'],
-        provider_id: {
-          name: ['urn:mpass.id:educationProviderId'],
+        municipality_code: {
+          name: ['urn:mpass.id:municipalityCode'],
           type: :multi
         },
-        provider_name: {
-          name: ['urn:mpass.id:educationProvider'],
+        municipality_name: {
+          name: ['urn:mpass.id:municipality', 'urn:educloudalliance.org:municipality'],
           type: :multi
         },
         school_code: {
@@ -256,8 +231,7 @@ module OmniAuth
           name: ['urn:educloudalliance.org:role'],
           type: :multi
         },
-        # Extra
-        # Unique learner ID
+        # Extra (undocumented)
         funet_person_learner_id: ['urn:oid:1.3.6.1.4.1.16161.1.1.27']
       )
 
@@ -281,7 +255,6 @@ module OmniAuth
         @options = OmniAuth::Strategy::Options.new(
           mpassid_options.merge(options)
         )
-        options[:security][:authn_requests_signed] = false unless options[:certificate] && options[:private_key]
       end
 
       # Override the request phase to be able to pass the lang parameter to
@@ -322,14 +295,6 @@ module OmniAuth
 
     private
 
-      def certificate
-        File.read(options.certificate_file) if options.certificate_file
-      end
-
-      def private_key
-        File.read(options.private_key_file) if options.private_key_file
-      end
-
       def idp_metadata_url
         case options.mode
         when :test
@@ -353,16 +318,10 @@ module OmniAuth
           sso_binding: ['urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect']
         )
 
-        # Local certificate and private key to decrypt the responses
-        settings[:certificate] = certificate
-        settings[:private_key] = private_key
-
         # Define the security settings as there are some defaults that need to be
         # modified
         security_defaults = OneLogin::RubySaml::Settings::DEFAULTS[:security]
-        settings[:security] = security_defaults.merge(
-          options.security_settings.to_h.transform_keys(&:to_sym)
-        )
+        settings[:security] = security_defaults.merge(options.security_settings)
 
         settings
       end

data/lib/omniauth-mpassid/version.rb

@@ -2,6 +2,6 @@
 
 module OmniAuth
   module MPASSid
-    VERSION = '0.3.2'
+    VERSION = '0.4.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-mpassid
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Antti Hukkanen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-09-01 00:00:00.000000000 Z
+date: 2021-12-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth-saml
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.3
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.3
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement