omniauth-saml 2.2.3 → 2.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 74e6f8ffd71deca8c0cf5a47561df7c878b200af810dbf893f89677eb49da313
-  data.tar.gz: 217c895d6d946983062dc1f66f362f98aa394c94a8f0267e69e2af9f1555cbc4
+  metadata.gz: 0ee62f105d63c2d5778122c04beb5c36a4fa8c8768beaa46d822d24ef40659ad
+  data.tar.gz: b9e3d10fa4c3bdae5ba7144e0ba8cd8e3ad98a7a16e022458cacbe2e267dd7f4
 SHA512:
-  metadata.gz: '0825de571d12121384accff0a106c4d76420308d007698632dd2661f030942cc4ed570e649f8b455ddcf2340d9109d26422de44ec3eb36f06978b732023409b4'
-  data.tar.gz: 5229a183ad1d335f01b9de5111293925d5be4d8e461de89e2d5f4924a14939eb4286fe4d307af7c7e5db2b126a0ff495a0c3c9ba064f6d430624f207c25119df
+  metadata.gz: 33702588126fa0a198d286e58a4c4d7e55830582d9ed7188db51f8e428718e79c9399af1fa7d5271f804560afa45b8118182b49f6a66252200b2435c86c9e926
+  data.tar.gz: b550692fca027b90ef1f29a89a97eac2b22dfbdce6591c7b5b5cbda731b4ec807bbdfd63ef7b5397f64319b6cbea8076aa39220eb3fb7bc7491ab29668e95b59

data/CHANGELOG.md

@@ -1,10 +1,19 @@
+<a name="v2.2.4"></a>
+### v2.2.4 (2025-05-14)
+
+
+#### Bug Fixes
+
+* remove :idp_cert_fingerprint_validator	 ([c573690](/../../commit/c573690))
+* Fix GHSA-cgp2-2cmh-pf7x
+
 <a name="v2.2.3"></a>
 ### v2.2.3 (2025-03-12)
 
 
 #### Features
 
-* new release 2.2.3	 ([0d06a3c](/../../commit/0d06a3c))
+* new release 2.2.3	 ([34eb354](/../../commit/34eb354))
 
 
 #### Bug Fixes

data/README.md

@@ -39,7 +39,6 @@ use OmniAuth::Strategies::SAML,
                                            :encryption => []
                                          },
   :idp_cert_fingerprint               => "E7:91:B2:E1:...",
-  :idp_cert_fingerprint_validator     => lambda { |fingerprint| fingerprint },
   :name_identifier_format             => "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
 ```
 
@@ -66,7 +65,6 @@ Rails.application.config.middleware.use OmniAuth::Builder do
                                              :encryption => []
                                            },
     :idp_cert_fingerprint               => "E7:91:B2:E1:...",
-    :idp_cert_fingerprint_validator     => lambda { |fingerprint| fingerprint },
     :name_identifier_format             => "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
 end
 ```
@@ -112,20 +110,16 @@ Note that when [integrating with Devise](#devise-integration), the URL path will
   `original_param_value`. Optional.
 
 * `:idp_cert` - The identity provider's certificate in PEM format. Takes precedence
-  over the fingerprint option below. This option or `:idp_cert_multi` or `:idp_cert_fingerprint` or `:idp_cert_fingerprint_validator` must
+  over the fingerprint option below. This option or `:idp_cert_multi` or `:idp_cert_fingerprint` must
   be present.
   
 * `:idp_cert_multi` - Multiple identity provider certificates in PEM format. Takes precedence
-over the fingerprint option below. This option `:idp_cert` or `:idp_cert_fingerprint` or `:idp_cert_fingerprint_validator` must
+over the fingerprint option below. This option `:idp_cert` or `:idp_cert_fingerprint` must
 be present.
 
 * `:idp_cert_fingerprint` - The SHA1 fingerprint of the certificate, e.g.
   "90:CC:16:F0:8D:...". This is provided from the identity provider when setting up
-  the relationship. This option or `:idp_cert` or `:idp_cert_multi` or `:idp_cert_fingerprint_validator` MUST be present.
-
-* `:idp_cert_fingerprint_validator` - A lambda that MUST accept one parameter
-  (the fingerprint), verify if it is valid and return it if successful. This option
-  or `:idp_cert` or `:idp_cert_multi` or `:idp_cert_fingerprint` MUST be present.
+  the relationship. This option or `:idp_cert` or `:idp_cert_multi` MUST be present.
 
 * `:name_identifier_format` - Used during SP-initiated SSO. Describes the format of
   the username required by this application. If you need the email address, use

data/lib/omniauth/strategies/saml.rb

@@ -43,9 +43,6 @@ module OmniAuth
         raise OmniAuth::Strategies::SAML::ValidationError.new("SAML response missing") unless request.params["SAMLResponse"]
 
         with_settings do |settings|
-          # Call a fingerprint validation method if there's one
-          validate_fingerprint(settings) if options.idp_cert_fingerprint_validator
-
           handle_response(request.params["SAMLResponse"], options_for_response_object, settings) do
             super
           end
@@ -218,17 +215,6 @@ module OmniAuth
         yield OneLogin::RubySaml::Settings.new(options)
       end
 
-      def validate_fingerprint(settings)
-        fingerprint_exists = options.idp_cert_fingerprint_validator[response_fingerprint]
-
-        unless fingerprint_exists
-          raise OmniAuth::Strategies::SAML::ValidationError.new("Non-existent fingerprint")
-        end
-
-        # id_cert_fingerprint becomes the given fingerprint if it exists
-        settings.idp_cert_fingerprint = fingerprint_exists
-      end
-
       def options_for_response_object
         # filter options to select only extra parameters
         opts = options.select {|k,_| RUBYSAML_RESPONSE_OPTIONS.include?(k.to_sym)}

data/lib/omniauth-saml/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module SAML
-    VERSION = '2.2.3'
+    VERSION = '2.2.4'
   end
 end

data/spec/omniauth/strategies/saml_spec.rb

@@ -150,41 +150,6 @@ describe OmniAuth::Strategies::SAML, :type => :strategy do
       end
     end
 
-    context "when fingerprint is empty and there's a fingerprint validator" do
-      before :each do
-        saml_options.delete(:idp_cert_fingerprint)
-        saml_options[:idp_cert_fingerprint_validator] = fingerprint_validator
-      end
-
-      let(:fingerprint_validator) { lambda { |_| "C1:59:74:2B:E8:0C:6C:A9:41:0F:6E:83:F6:D1:52:25:45:58:89:FB" } }
-
-      context "when the fingerprint validator returns a truthy value" do
-        before { post_xml }
-
-        it "should set the uid to the nameID in the SAML response" do
-          expect(auth_hash['uid']).to eq '_1f6fcf6be5e13b08b1e3610e7ff59f205fbd814f23'
-        end
-
-        it "should set the raw info to all attributes" do
-          expect(auth_hash['extra']['raw_info'].all.to_hash).to eq(
-            'first_name'   => ['Rajiv'],
-            'last_name'    => ['Manglani'],
-            'email'        => ['user@example.com'],
-            'company_name' => ['Example Company'],
-            'fingerprint'  => 'C1:59:74:2B:E8:0C:6C:A9:41:0F:6E:83:F6:D1:52:25:45:58:89:FB'
-          )
-        end
-      end
-
-      context "when the fingerprint validator returns false" do
-        let(:fingerprint_validator) { lambda { |_| false } }
-
-        before { post_xml }
-
-        it { is_expected.to fail_with(:invalid_ticket) }
-      end
-    end
-
     context "when the assertion_consumer_service_url is the default" do
       before :each do
         saml_options.delete(:assertion_consumer_service_url)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth-saml
 version: !ruby/object:Gem::Version
-  version: 2.2.3
+  version: 2.2.4
 platform: ruby
 authors:
 - Raecoo Cao
@@ -14,7 +14,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-03-12 00:00:00.000000000 Z
+date: 2025-05-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth