omniauth-wsfed 0.2.0 → 0.2.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (8) hide show
  1. checksums.yaml +15 -0
  2. data/.travis.yml +5 -0
  3. data/Gemfile.lock +1 -1
  4. data/README.md +4 -0
  5. data/lib/omniauth-wsfed/version.rb +1 -1
  6. data/lib/omniauth/strategies/wsfed/auth_callback_validator.rb +21 -9
  7. data/spec/omniauth/strategies/wsfed/auth_callback_validator_spec.rb +75 -42
  8. metadata +6 -17
checksums.yaml ADDED
@@ -0,0 +1,15 @@
1
+ ---
2
+ !binary "U0hBMQ==":
3
+ metadata.gz: !binary |-
4
+ NTdjMWJkYzEyNmNmNDZmNzRlMzlhN2IzYmZmMGY4MzM1ZTBkNTRmOA==
5
+ data.tar.gz: !binary |-
6
+ ODhlOTYxY2E5M2ZlMjBiZGIzNTFiYTUzNzQ2N2FjMDRlYTdlMDJhMA==
7
+ !binary "U0hBNTEy":
8
+ metadata.gz: !binary |-
9
+ OWU2OTYzMDBhNDE4Y2YyY2NmOGNhNjM4MWVjMTUyMmE4MzYwNjI1NjFhMWM5
10
+ NGIxY2YwNGYwNTk1YjdjNTdiOGE0NTlmODdlZDY1YjA4NDU4MWI5NDc0YWM0
11
+ ZmQ4YjE2MmM3NjNlNGY3N2QwNzY4ZTU5Nzc4Mzc4ZjFjNzVjNjY=
12
+ data.tar.gz: !binary |-
13
+ MTAyMDc4ZWZlYWMwZjQ5YTI0M2RiNGVlYTExMmIyNzJkMzZmZWFhY2EzZjQ1
14
+ YjY4ZTllNTE4ZWQ0MDZlZGIwN2QwNWU3YmZhNWU0NTAyYzE2MTRjYjUwODVk
15
+ ZWZhYmQzMjE5ZjBkNTM2YmUzMWNjMjJhNzMyN2JhMTcyMzE4NDc=
data/.travis.yml ADDED
@@ -0,0 +1,5 @@
1
+ language: ruby
2
+ rvm:
3
+ - 1.9.3
4
+ - 1.9.2
5
+ script: bundle exec rspec spec
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- omniauth-wsfed (0.2.0)
4
+ omniauth-wsfed (0.2.1)
5
5
  omniauth (~> 1.1.0)
6
6
  xmlcanonicalizer (= 0.1.1)
7
7
 
data/README.md CHANGED
@@ -1,5 +1,9 @@
1
1
  # OmniAuth WS-Fed #
2
2
 
3
+ [![Gem Version](https://badge.fury.io/rb/omniauth-wsfed.png)](http://badge.fury.io/rb/omniauth-wsfed)
4
+ [![Code Climate](https://codeclimate.com/github/kbeckman/omniauth-wsfed.png)](https://codeclimate.com/github/kbeckman/omniauth-wsfed)
5
+ [![Build Status](https://travis-ci.org/kbeckman/omniauth-wsfed.png?branch=development)](https://travis-ci.org/kbeckman/omniauth-wsfed)
6
+
3
7
  The OmniAuth-WSFed authentication strategy can be used with the following technologies
4
8
  under scenarios requiring the [WS-Federation protocol](http://msdn.microsoft.com/en-us/library/bb498017.aspx)
5
9
  for authentication. These services are typically used for Identity Federation and Single
data/lib/omniauth-wsfed/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  module OmniAuth
2
2
  module WSFed
3
- VERSION = '0.2.0'
3
+ VERSION = '0.2.1'
4
4
  end
5
5
  end
data/lib/omniauth/strategies/wsfed/auth_callback_validator.rb CHANGED
@@ -8,7 +8,6 @@ module OmniAuth
8
8
 
9
9
  ISSUER_MISMATCH = 'AuthN token issuer does not match configured issuer.'
10
10
  AUDIENCE_MISMATCH = 'AuthN token audience does not match configured realm.'
11
- FUTURE_CREATED_AT = 'AuthN token created timestamp occurs in the future.'
12
11
  TOKEN_EXPIRED = 'AuthN token has expired.'
13
12
  NO_CLAIMS = 'AuthN token contains no claims.'
14
13
  NO_USER_IDENTIFIER = 'AuthN token contains no user identifier. Verify that configured :id_claim setting is correct.'
@@ -19,27 +18,40 @@ module OmniAuth
19
18
  end
20
19
 
21
20
  def validate!
21
+ validate_issuer!
22
+ validate_audience!
23
+ validate_token_expiration!
24
+ validate_claims!
25
+ validate_uid!
26
+
27
+ true
28
+ end
29
+
30
+ def validate_issuer!
22
31
  raise OmniAuth::Strategies::WSFed::ValidationError.new(ISSUER_MISMATCH) unless
23
- auth_callback.issuer == wsfed_settings[:issuer_name]
32
+ auth_callback.issuer == wsfed_settings[:issuer_name]
33
+ end
24
34
 
35
+ def validate_audience!
25
36
  raise OmniAuth::Strategies::WSFed::ValidationError.new(AUDIENCE_MISMATCH) unless
26
- auth_callback.audience == wsfed_settings[:realm]
27
-
28
- raise OmniAuth::Strategies::WSFed::ValidationError.new(FUTURE_CREATED_AT) unless
29
- auth_callback.created_at < Time.now.utc
37
+ auth_callback.audience == wsfed_settings[:realm]
38
+ end
30
39
 
40
+ def validate_token_expiration!
31
41
  raise OmniAuth::Strategies::WSFed::ValidationError.new(TOKEN_EXPIRED) unless
32
- auth_callback.expires_at > Time.now.utc
42
+ auth_callback.expires_at > Time.now.utc
43
+ end
33
44
 
45
+ def validate_claims!
34
46
  if auth_callback.claims.nil? || auth_callback.claims.empty?
35
47
  raise OmniAuth::Strategies::WSFed::ValidationError.new(NO_CLAIMS)
36
48
  end
49
+ end
37
50
 
51
+ def validate_uid!
38
52
  if auth_callback.name_id.nil? || auth_callback.name_id.empty?
39
53
  raise OmniAuth::Strategies::WSFed::ValidationError.new(NO_USER_IDENTIFIER)
40
54
  end
41
-
42
- true
43
55
  end
44
56
 
45
57
  end
data/spec/omniauth/strategies/wsfed/auth_callback_validator_spec.rb CHANGED
@@ -2,85 +2,116 @@ require 'spec_helper'
2
2
 
3
3
  describe OmniAuth::Strategies::WSFed::AuthCallbackValidator do
4
4
 
5
- describe 'Response Validation Rules' do
5
+ let(:auth_callback) { OmniAuth::Strategies::WSFed::AuthCallback.new({}, {})}
6
6
 
7
- let(:auth_callback) { OmniAuth::Strategies::WSFed::AuthCallback.new({}, {})}
7
+ before(:each) do
8
+ @wsfed_settings = {
9
+ :issuer_name => 'https://identity-wwf.accesscontrol.windows.net/',
10
+ :realm => 'http://rp.wwf.com/wsfed-sample',
11
+ :id_claim => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
12
+ }
8
13
 
9
- before(:each) do
10
- @wsfed_settings = {
11
- :issuer_name => 'https://identity-wwf.accesscontrol.windows.net/',
12
- :realm => 'http://rp.wwf.com/wsfed-sample',
13
- :id_claim => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
14
- }
15
-
16
- @claims = {
14
+ @claims = {
17
15
  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => 'ravishing_rick@wwf.com',
18
16
  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => 'rick.rude',
19
17
  'http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider' => 'http://sso.wwf.com'
20
- }
21
-
22
- auth_callback.stub(:issuer).and_return(@wsfed_settings[:issuer_name])
23
- auth_callback.stub(:audience).and_return(@wsfed_settings[:realm])
24
- auth_callback.stub(:claims).and_return(@claims)
25
- auth_callback.stub(:name_id).and_return(@claims[@wsfed_settings[:id_claim]])
26
- auth_callback.stub(:created_at).and_return(Time.now.utc - 1) # 1 second ago
27
- auth_callback.stub(:expires_at).and_return(Time.now.utc + 300) # 5 minutes from now
28
- end
18
+ }
19
+
20
+ auth_callback.stub(:issuer).and_return(@wsfed_settings[:issuer_name])
21
+ auth_callback.stub(:audience).and_return(@wsfed_settings[:realm])
22
+ auth_callback.stub(:claims).and_return(@claims)
23
+ auth_callback.stub(:name_id).and_return(@claims[@wsfed_settings[:id_claim]])
24
+ auth_callback.stub(:created_at).and_return(Time.now.utc - 1) # 1 second ago
25
+ auth_callback.stub(:expires_at).and_return(Time.now.utc + 300) # 5 minutes from now
26
+ end
27
+
28
+ context 'with a Valid AuthN Token Response' do
29
29
 
30
- it 'should pass validation with....' do
30
+ it 'should pass validation' do
31
31
  validator = described_class.new(auth_callback, @wsfed_settings)
32
32
 
33
33
  validator.validate!.should == true
34
34
  end
35
35
 
36
- context 'with Invalid Response' do
36
+ end
37
+
38
+ context 'with an Invalid AuthN Token Response' do
39
+
40
+ context 'having invalid issuer' do
37
41
 
38
- it 'should throw an exception when issuers do not match' do
42
+ before(:each) do
39
43
  auth_callback.stub(:issuer).and_return('https://c4sc-federation-nomatch.accesscontrol.windows.net/')
44
+ @validator = described_class.new(auth_callback, @wsfed_settings)
45
+ end
40
46
 
41
- validator = described_class.new(auth_callback, @wsfed_settings)
47
+ it 'validate_issuer! should throw an exception' do
48
+ lambda { @validator.validate_issuer! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
49
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::ISSUER_MISMATCH
50
+ end
42
51
 
43
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
44
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::ISSUER_MISMATCH
52
+ it 'validate! should throw an exception' do
53
+ lambda { @validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
54
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::ISSUER_MISMATCH
45
55
  end
46
56
 
47
- it 'should throw an exception when realm/audience do not match' do
48
- auth_callback.stub(:audience).and_return('http://rp.c4sc.com/wsfed-sample-nomatch')
57
+ end
49
58
 
50
- validator = described_class.new(auth_callback, @wsfed_settings)
59
+ context 'having invalid realm/audience' do
51
60
 
52
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
53
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::AUDIENCE_MISMATCH
61
+ before(:each) do
62
+ auth_callback.stub(:audience).and_return('http://rp.c4sc.com/wsfed-sample-nomatch')
63
+ @validator = described_class.new(auth_callback, @wsfed_settings)
54
64
  end
55
65
 
56
- it 'should throw an exception when the created_at timestamp is in the future' do
57
- auth_callback.stub(:created_at).and_return(Time.now.utc + 2)
58
-
59
- validator = described_class.new(auth_callback, @wsfed_settings)
66
+ it 'validate_audience! should throw an exception' do
67
+ lambda { @validator.validate_audience! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
68
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::AUDIENCE_MISMATCH
69
+ end
60
70
 
61
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
62
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::FUTURE_CREATED_AT
71
+ it 'validate! should throw an exception' do
72
+ lambda { @validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
73
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::AUDIENCE_MISMATCH
63
74
  end
64
75
 
65
- it 'should throw an exception when the expires_at timestamp limit has been exceeded' do
76
+ end
77
+
78
+ context 'having invalid (limit exceeded) expires_at' do
79
+
80
+ before(:each) do
66
81
  auth_callback.stub(:expires_at).and_return(Time.now.utc - 1)
82
+ @validator = described_class.new(auth_callback, @wsfed_settings)
83
+ end
67
84
 
68
- validator = described_class.new(auth_callback, @wsfed_settings)
85
+ it 'validate_token_expiration! should throw an exception' do
86
+ lambda { @validator.validate_token_expiration! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
87
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::TOKEN_EXPIRED
88
+ end
69
89
 
70
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
71
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::TOKEN_EXPIRED
90
+ it 'validate! should throw an exception' do
91
+ lambda { @validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
92
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::TOKEN_EXPIRED
72
93
  end
73
94
 
74
- it 'should throw an exception when claims are empty or nil' do
95
+ end
96
+
97
+ context 'having a nil or empty claims hash' do
98
+
99
+ it 'validate_claims! and validate! should each throw an exception' do
75
100
  [nil, {}].each do |val|
76
101
  auth_callback.stub(:claims).and_return(val)
77
102
 
78
103
  validator = described_class.new(auth_callback, @wsfed_settings)
79
104
 
105
+ lambda { validator.validate_claims! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
106
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_CLAIMS
107
+
80
108
  lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
81
109
  OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_CLAIMS
82
110
  end
83
111
  end
112
+ end
113
+
114
+ context 'having a nil or empty uid value' do
84
115
 
85
116
  it 'should throw an exception when the name_id is empty or nil' do
86
117
  [nil, ""].each do |val|
@@ -88,6 +119,9 @@ describe OmniAuth::Strategies::WSFed::AuthCallbackValidator do
88
119
 
89
120
  validator = described_class.new(auth_callback, @wsfed_settings)
90
121
 
122
+ lambda { validator.validate_uid! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
123
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_USER_IDENTIFIER
124
+
91
125
  lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
92
126
  OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_USER_IDENTIFIER
93
127
  end
@@ -96,5 +130,4 @@ describe OmniAuth::Strategies::WSFed::AuthCallbackValidator do
96
130
  end
97
131
 
98
132
  end
99
-
100
133
  end
metadata CHANGED
@@ -1,20 +1,18 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: omniauth-wsfed
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.2.0
5
- prerelease:
4
+ version: 0.2.1
6
5
  platform: ruby
7
6
  authors:
8
7
  - Keith Beckman
9
8
  autorequire:
10
9
  bindir: bin
11
10
  cert_chain: []
12
- date: 2013-02-22 00:00:00.000000000 Z
11
+ date: 2013-05-11 00:00:00.000000000 Z
13
12
  dependencies:
14
13
  - !ruby/object:Gem::Dependency
15
14
  name: omniauth
16
15
  requirement: !ruby/object:Gem::Requirement
17
- none: false
18
16
  requirements:
19
17
  - - ~>
20
18
  - !ruby/object:Gem::Version
@@ -22,7 +20,6 @@ dependencies:
22
20
  type: :runtime
23
21
  prerelease: false
24
22
  version_requirements: !ruby/object:Gem::Requirement
25
- none: false
26
23
  requirements:
27
24
  - - ~>
28
25
  - !ruby/object:Gem::Version
@@ -30,7 +27,6 @@ dependencies:
30
27
  - !ruby/object:Gem::Dependency
31
28
  name: xmlcanonicalizer
32
29
  requirement: !ruby/object:Gem::Requirement
33
- none: false
34
30
  requirements:
35
31
  - - '='
36
32
  - !ruby/object:Gem::Version
@@ -38,7 +34,6 @@ dependencies:
38
34
  type: :runtime
39
35
  prerelease: false
40
36
  version_requirements: !ruby/object:Gem::Requirement
41
- none: false
42
37
  requirements:
43
38
  - - '='
44
39
  - !ruby/object:Gem::Version
@@ -46,7 +41,6 @@ dependencies:
46
41
  - !ruby/object:Gem::Dependency
47
42
  name: rspec
48
43
  requirement: !ruby/object:Gem::Requirement
49
- none: false
50
44
  requirements:
51
45
  - - ! '>='
52
46
  - !ruby/object:Gem::Version
@@ -54,7 +48,6 @@ dependencies:
54
48
  type: :development
55
49
  prerelease: false
56
50
  version_requirements: !ruby/object:Gem::Requirement
57
- none: false
58
51
  requirements:
59
52
  - - ! '>='
60
53
  - !ruby/object:Gem::Version
@@ -62,7 +55,6 @@ dependencies:
62
55
  - !ruby/object:Gem::Dependency
63
56
  name: rake
64
57
  requirement: !ruby/object:Gem::Requirement
65
- none: false
66
58
  requirements:
67
59
  - - ! '>='
68
60
  - !ruby/object:Gem::Version
@@ -70,7 +62,6 @@ dependencies:
70
62
  type: :development
71
63
  prerelease: false
72
64
  version_requirements: !ruby/object:Gem::Requirement
73
- none: false
74
65
  requirements:
75
66
  - - ! '>='
76
67
  - !ruby/object:Gem::Version
@@ -78,7 +69,6 @@ dependencies:
78
69
  - !ruby/object:Gem::Dependency
79
70
  name: rack-test
80
71
  requirement: !ruby/object:Gem::Requirement
81
- none: false
82
72
  requirements:
83
73
  - - ! '>='
84
74
  - !ruby/object:Gem::Version
@@ -86,7 +76,6 @@ dependencies:
86
76
  type: :development
87
77
  prerelease: false
88
78
  version_requirements: !ruby/object:Gem::Requirement
89
- none: false
90
79
  requirements:
91
80
  - - ! '>='
92
81
  - !ruby/object:Gem::Version
@@ -102,6 +91,7 @@ extensions: []
102
91
  extra_rdoc_files: []
103
92
  files:
104
93
  - .gitignore
94
+ - .travis.yml
105
95
  - Gemfile
106
96
  - Gemfile.lock
107
97
  - LICENSE
@@ -124,27 +114,26 @@ files:
124
114
  - spec/support/acs_example.xml
125
115
  homepage: https://github.com/kbeckman/omniauth-wsfed
126
116
  licenses: []
117
+ metadata: {}
127
118
  post_install_message:
128
119
  rdoc_options: []
129
120
  require_paths:
130
121
  - lib
131
122
  required_ruby_version: !ruby/object:Gem::Requirement
132
- none: false
133
123
  requirements:
134
124
  - - ! '>='
135
125
  - !ruby/object:Gem::Version
136
126
  version: '0'
137
127
  required_rubygems_version: !ruby/object:Gem::Requirement
138
- none: false
139
128
  requirements:
140
129
  - - ! '>='
141
130
  - !ruby/object:Gem::Version
142
131
  version: '0'
143
132
  requirements: []
144
133
  rubyforge_project:
145
- rubygems_version: 1.8.25
134
+ rubygems_version: 2.0.3
146
135
  signing_key:
147
- specification_version: 3
136
+ specification_version: 4
148
137
  summary: A WS-Federation + WS-Trust strategy for OmniAuth.
149
138
  test_files:
150
139
  - spec/omniauth/strategies/wsfed/auth_callback_spec.rb