omniauth-wsfed 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. checksums.yaml +15 -0
  2. data/.travis.yml +5 -0
  3. data/Gemfile.lock +1 -1
  4. data/README.md +4 -0
  5. data/lib/omniauth-wsfed/version.rb +1 -1
  6. data/lib/omniauth/strategies/wsfed/auth_callback_validator.rb +21 -9
  7. data/spec/omniauth/strategies/wsfed/auth_callback_validator_spec.rb +75 -42
  8. metadata +6 -17
checksums.yaml ADDED
@@ -0,0 +1,15 @@
1
+ ---
2
+ !binary "U0hBMQ==":
3
+ metadata.gz: !binary |-
4
+ NTdjMWJkYzEyNmNmNDZmNzRlMzlhN2IzYmZmMGY4MzM1ZTBkNTRmOA==
5
+ data.tar.gz: !binary |-
6
+ ODhlOTYxY2E5M2ZlMjBiZGIzNTFiYTUzNzQ2N2FjMDRlYTdlMDJhMA==
7
+ !binary "U0hBNTEy":
8
+ metadata.gz: !binary |-
9
+ OWU2OTYzMDBhNDE4Y2YyY2NmOGNhNjM4MWVjMTUyMmE4MzYwNjI1NjFhMWM5
10
+ NGIxY2YwNGYwNTk1YjdjNTdiOGE0NTlmODdlZDY1YjA4NDU4MWI5NDc0YWM0
11
+ ZmQ4YjE2MmM3NjNlNGY3N2QwNzY4ZTU5Nzc4Mzc4ZjFjNzVjNjY=
12
+ data.tar.gz: !binary |-
13
+ MTAyMDc4ZWZlYWMwZjQ5YTI0M2RiNGVlYTExMmIyNzJkMzZmZWFhY2EzZjQ1
14
+ YjY4ZTllNTE4ZWQ0MDZlZGIwN2QwNWU3YmZhNWU0NTAyYzE2MTRjYjUwODVk
15
+ ZWZhYmQzMjE5ZjBkNTM2YmUzMWNjMjJhNzMyN2JhMTcyMzE4NDc=
data/.travis.yml ADDED
@@ -0,0 +1,5 @@
1
+ language: ruby
2
+ rvm:
3
+ - 1.9.3
4
+ - 1.9.2
5
+ script: bundle exec rspec spec
data/Gemfile.lock CHANGED
@@ -1,7 +1,7 @@
1
1
  PATH
2
2
  remote: .
3
3
  specs:
4
- omniauth-wsfed (0.2.0)
4
+ omniauth-wsfed (0.2.1)
5
5
  omniauth (~> 1.1.0)
6
6
  xmlcanonicalizer (= 0.1.1)
7
7
 
data/README.md CHANGED
@@ -1,5 +1,9 @@
1
1
  # OmniAuth WS-Fed #
2
2
 
3
+ [![Gem Version](https://badge.fury.io/rb/omniauth-wsfed.png)](http://badge.fury.io/rb/omniauth-wsfed)
4
+ [![Code Climate](https://codeclimate.com/github/kbeckman/omniauth-wsfed.png)](https://codeclimate.com/github/kbeckman/omniauth-wsfed)
5
+ [![Build Status](https://travis-ci.org/kbeckman/omniauth-wsfed.png?branch=development)](https://travis-ci.org/kbeckman/omniauth-wsfed)
6
+
3
7
  The OmniAuth-WSFed authentication strategy can be used with the following technologies
4
8
  under scenarios requiring the [WS-Federation protocol](http://msdn.microsoft.com/en-us/library/bb498017.aspx)
5
9
  for authentication. These services are typically used for Identity Federation and Single
data/lib/omniauth-wsfed/version.rb CHANGED
@@ -1,5 +1,5 @@
1
1
  module OmniAuth
2
2
  module WSFed
3
- VERSION = '0.2.0'
3
+ VERSION = '0.2.1'
4
4
  end
5
5
  end
data/lib/omniauth/strategies/wsfed/auth_callback_validator.rb CHANGED
@@ -8,7 +8,6 @@ module OmniAuth
8
8
 
9
9
  ISSUER_MISMATCH = 'AuthN token issuer does not match configured issuer.'
10
10
  AUDIENCE_MISMATCH = 'AuthN token audience does not match configured realm.'
11
- FUTURE_CREATED_AT = 'AuthN token created timestamp occurs in the future.'
12
11
  TOKEN_EXPIRED = 'AuthN token has expired.'
13
12
  NO_CLAIMS = 'AuthN token contains no claims.'
14
13
  NO_USER_IDENTIFIER = 'AuthN token contains no user identifier. Verify that configured :id_claim setting is correct.'
@@ -19,27 +18,40 @@ module OmniAuth
19
18
  end
20
19
 
21
20
  def validate!
21
+ validate_issuer!
22
+ validate_audience!
23
+ validate_token_expiration!
24
+ validate_claims!
25
+ validate_uid!
26
+
27
+ true
28
+ end
29
+
30
+ def validate_issuer!
22
31
  raise OmniAuth::Strategies::WSFed::ValidationError.new(ISSUER_MISMATCH) unless
23
- auth_callback.issuer == wsfed_settings[:issuer_name]
32
+ auth_callback.issuer == wsfed_settings[:issuer_name]
33
+ end
24
34
 
35
+ def validate_audience!
25
36
  raise OmniAuth::Strategies::WSFed::ValidationError.new(AUDIENCE_MISMATCH) unless
26
- auth_callback.audience == wsfed_settings[:realm]
27
-
28
- raise OmniAuth::Strategies::WSFed::ValidationError.new(FUTURE_CREATED_AT) unless
29
- auth_callback.created_at < Time.now.utc
37
+ auth_callback.audience == wsfed_settings[:realm]
38
+ end
30
39
 
40
+ def validate_token_expiration!
31
41
  raise OmniAuth::Strategies::WSFed::ValidationError.new(TOKEN_EXPIRED) unless
32
- auth_callback.expires_at > Time.now.utc
42
+ auth_callback.expires_at > Time.now.utc
43
+ end
33
44
 
45
+ def validate_claims!
34
46
  if auth_callback.claims.nil? || auth_callback.claims.empty?
35
47
  raise OmniAuth::Strategies::WSFed::ValidationError.new(NO_CLAIMS)
36
48
  end
49
+ end
37
50
 
51
+ def validate_uid!
38
52
  if auth_callback.name_id.nil? || auth_callback.name_id.empty?
39
53
  raise OmniAuth::Strategies::WSFed::ValidationError.new(NO_USER_IDENTIFIER)
40
54
  end
41
-
42
- true
43
55
  end
44
56
 
45
57
  end
data/spec/omniauth/strategies/wsfed/auth_callback_validator_spec.rb CHANGED
@@ -2,85 +2,116 @@ require 'spec_helper'
2
2
 
3
3
  describe OmniAuth::Strategies::WSFed::AuthCallbackValidator do
4
4
 
5
- describe 'Response Validation Rules' do
5
+ let(:auth_callback) { OmniAuth::Strategies::WSFed::AuthCallback.new({}, {})}
6
6
 
7
- let(:auth_callback) { OmniAuth::Strategies::WSFed::AuthCallback.new({}, {})}
7
+ before(:each) do
8
+ @wsfed_settings = {
9
+ :issuer_name => 'https://identity-wwf.accesscontrol.windows.net/',
10
+ :realm => 'http://rp.wwf.com/wsfed-sample',
11
+ :id_claim => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
12
+ }
8
13
 
9
- before(:each) do
10
- @wsfed_settings = {
11
- :issuer_name => 'https://identity-wwf.accesscontrol.windows.net/',
12
- :realm => 'http://rp.wwf.com/wsfed-sample',
13
- :id_claim => 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
14
- }
15
-
16
- @claims = {
14
+ @claims = {
17
15
  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress' => 'ravishing_rick@wwf.com',
18
16
  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name' => 'rick.rude',
19
17
  'http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider' => 'http://sso.wwf.com'
20
- }
21
-
22
- auth_callback.stub(:issuer).and_return(@wsfed_settings[:issuer_name])
23
- auth_callback.stub(:audience).and_return(@wsfed_settings[:realm])
24
- auth_callback.stub(:claims).and_return(@claims)
25
- auth_callback.stub(:name_id).and_return(@claims[@wsfed_settings[:id_claim]])
26
- auth_callback.stub(:created_at).and_return(Time.now.utc - 1) # 1 second ago
27
- auth_callback.stub(:expires_at).and_return(Time.now.utc + 300) # 5 minutes from now
28
- end
18
+ }
19
+
20
+ auth_callback.stub(:issuer).and_return(@wsfed_settings[:issuer_name])
21
+ auth_callback.stub(:audience).and_return(@wsfed_settings[:realm])
22
+ auth_callback.stub(:claims).and_return(@claims)
23
+ auth_callback.stub(:name_id).and_return(@claims[@wsfed_settings[:id_claim]])
24
+ auth_callback.stub(:created_at).and_return(Time.now.utc - 1) # 1 second ago
25
+ auth_callback.stub(:expires_at).and_return(Time.now.utc + 300) # 5 minutes from now
26
+ end
27
+
28
+ context 'with a Valid AuthN Token Response' do
29
29
 
30
- it 'should pass validation with....' do
30
+ it 'should pass validation' do
31
31
  validator = described_class.new(auth_callback, @wsfed_settings)
32
32
 
33
33
  validator.validate!.should == true
34
34
  end
35
35
 
36
- context 'with Invalid Response' do
36
+ end
37
+
38
+ context 'with an Invalid AuthN Token Response' do
39
+
40
+ context 'having invalid issuer' do
37
41
 
38
- it 'should throw an exception when issuers do not match' do
42
+ before(:each) do
39
43
  auth_callback.stub(:issuer).and_return('https://c4sc-federation-nomatch.accesscontrol.windows.net/')
44
+ @validator = described_class.new(auth_callback, @wsfed_settings)
45
+ end
40
46
 
41
- validator = described_class.new(auth_callback, @wsfed_settings)
47
+ it 'validate_issuer! should throw an exception' do
48
+ lambda { @validator.validate_issuer! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
49
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::ISSUER_MISMATCH
50
+ end
42
51
 
43
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
44
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::ISSUER_MISMATCH
52
+ it 'validate! should throw an exception' do
53
+ lambda { @validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
54
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::ISSUER_MISMATCH
45
55
  end
46
56
 
47
- it 'should throw an exception when realm/audience do not match' do
48
- auth_callback.stub(:audience).and_return('http://rp.c4sc.com/wsfed-sample-nomatch')
57
+ end
49
58
 
50
- validator = described_class.new(auth_callback, @wsfed_settings)
59
+ context 'having invalid realm/audience' do
51
60
 
52
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
53
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::AUDIENCE_MISMATCH
61
+ before(:each) do
62
+ auth_callback.stub(:audience).and_return('http://rp.c4sc.com/wsfed-sample-nomatch')
63
+ @validator = described_class.new(auth_callback, @wsfed_settings)
54
64
  end
55
65
 
56
- it 'should throw an exception when the created_at timestamp is in the future' do
57
- auth_callback.stub(:created_at).and_return(Time.now.utc + 2)
58
-
59
- validator = described_class.new(auth_callback, @wsfed_settings)
66
+ it 'validate_audience! should throw an exception' do
67
+ lambda { @validator.validate_audience! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
68
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::AUDIENCE_MISMATCH
69
+ end
60
70
 
61
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
62
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::FUTURE_CREATED_AT
71
+ it 'validate! should throw an exception' do
72
+ lambda { @validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
73
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::AUDIENCE_MISMATCH
63
74
  end
64
75
 
65
- it 'should throw an exception when the expires_at timestamp limit has been exceeded' do
76
+ end
77
+
78
+ context 'having invalid (limit exceeded) expires_at' do
79
+
80
+ before(:each) do
66
81
  auth_callback.stub(:expires_at).and_return(Time.now.utc - 1)
82
+ @validator = described_class.new(auth_callback, @wsfed_settings)
83
+ end
67
84
 
68
- validator = described_class.new(auth_callback, @wsfed_settings)
85
+ it 'validate_token_expiration! should throw an exception' do
86
+ lambda { @validator.validate_token_expiration! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
87
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::TOKEN_EXPIRED
88
+ end
69
89
 
70
- lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
71
- OmniAuth::Strategies::WSFed::AuthCallbackValidator::TOKEN_EXPIRED
90
+ it 'validate! should throw an exception' do
91
+ lambda { @validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
92
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::TOKEN_EXPIRED
72
93
  end
73
94
 
74
- it 'should throw an exception when claims are empty or nil' do
95
+ end
96
+
97
+ context 'having a nil or empty claims hash' do
98
+
99
+ it 'validate_claims! and validate! should each throw an exception' do
75
100
  [nil, {}].each do |val|
76
101
  auth_callback.stub(:claims).and_return(val)
77
102
 
78
103
  validator = described_class.new(auth_callback, @wsfed_settings)
79
104
 
105
+ lambda { validator.validate_claims! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
106
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_CLAIMS
107
+
80
108
  lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
81
109
  OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_CLAIMS
82
110
  end
83
111
  end
112
+ end
113
+
114
+ context 'having a nil or empty uid value' do
84
115
 
85
116
  it 'should throw an exception when the name_id is empty or nil' do
86
117
  [nil, ""].each do |val|
@@ -88,6 +119,9 @@ describe OmniAuth::Strategies::WSFed::AuthCallbackValidator do
88
119
 
89
120
  validator = described_class.new(auth_callback, @wsfed_settings)
90
121
 
122
+ lambda { validator.validate_uid! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
123
+ OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_USER_IDENTIFIER
124
+
91
125
  lambda { validator.validate! }.should raise_error OmniAuth::Strategies::WSFed::ValidationError,
92
126
  OmniAuth::Strategies::WSFed::AuthCallbackValidator::NO_USER_IDENTIFIER
93
127
  end
@@ -96,5 +130,4 @@ describe OmniAuth::Strategies::WSFed::AuthCallbackValidator do
96
130
  end
97
131
 
98
132
  end
99
-
100
133
  end
metadata CHANGED
@@ -1,20 +1,18 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: omniauth-wsfed
3
3
  version: !ruby/object:Gem::Version
4
- version: 0.2.0
5
- prerelease:
4
+ version: 0.2.1
6
5
  platform: ruby
7
6
  authors:
8
7
  - Keith Beckman
9
8
  autorequire:
10
9
  bindir: bin
11
10
  cert_chain: []
12
- date: 2013-02-22 00:00:00.000000000 Z
11
+ date: 2013-05-11 00:00:00.000000000 Z
13
12
  dependencies:
14
13
  - !ruby/object:Gem::Dependency
15
14
  name: omniauth
16
15
  requirement: !ruby/object:Gem::Requirement
17
- none: false
18
16
  requirements:
19
17
  - - ~>
20
18
  - !ruby/object:Gem::Version
@@ -22,7 +20,6 @@ dependencies:
22
20
  type: :runtime
23
21
  prerelease: false
24
22
  version_requirements: !ruby/object:Gem::Requirement
25
- none: false
26
23
  requirements:
27
24
  - - ~>
28
25
  - !ruby/object:Gem::Version
@@ -30,7 +27,6 @@ dependencies:
30
27
  - !ruby/object:Gem::Dependency
31
28
  name: xmlcanonicalizer
32
29
  requirement: !ruby/object:Gem::Requirement
33
- none: false
34
30
  requirements:
35
31
  - - '='
36
32
  - !ruby/object:Gem::Version
@@ -38,7 +34,6 @@ dependencies:
38
34
  type: :runtime
39
35
  prerelease: false
40
36
  version_requirements: !ruby/object:Gem::Requirement
41
- none: false
42
37
  requirements:
43
38
  - - '='
44
39
  - !ruby/object:Gem::Version
@@ -46,7 +41,6 @@ dependencies:
46
41
  - !ruby/object:Gem::Dependency
47
42
  name: rspec
48
43
  requirement: !ruby/object:Gem::Requirement
49
- none: false
50
44
  requirements:
51
45
  - - ! '>='
52
46
  - !ruby/object:Gem::Version
@@ -54,7 +48,6 @@ dependencies:
54
48
  type: :development
55
49
  prerelease: false
56
50
  version_requirements: !ruby/object:Gem::Requirement
57
- none: false
58
51
  requirements:
59
52
  - - ! '>='
60
53
  - !ruby/object:Gem::Version
@@ -62,7 +55,6 @@ dependencies:
62
55
  - !ruby/object:Gem::Dependency
63
56
  name: rake
64
57
  requirement: !ruby/object:Gem::Requirement
65
- none: false
66
58
  requirements:
67
59
  - - ! '>='
68
60
  - !ruby/object:Gem::Version
@@ -70,7 +62,6 @@ dependencies:
70
62
  type: :development
71
63
  prerelease: false
72
64
  version_requirements: !ruby/object:Gem::Requirement
73
- none: false
74
65
  requirements:
75
66
  - - ! '>='
76
67
  - !ruby/object:Gem::Version
@@ -78,7 +69,6 @@ dependencies:
78
69
  - !ruby/object:Gem::Dependency
79
70
  name: rack-test
80
71
  requirement: !ruby/object:Gem::Requirement
81
- none: false
82
72
  requirements:
83
73
  - - ! '>='
84
74
  - !ruby/object:Gem::Version
@@ -86,7 +76,6 @@ dependencies:
86
76
  type: :development
87
77
  prerelease: false
88
78
  version_requirements: !ruby/object:Gem::Requirement
89
- none: false
90
79
  requirements:
91
80
  - - ! '>='
92
81
  - !ruby/object:Gem::Version
@@ -102,6 +91,7 @@ extensions: []
102
91
  extra_rdoc_files: []
103
92
  files:
104
93
  - .gitignore
94
+ - .travis.yml
105
95
  - Gemfile
106
96
  - Gemfile.lock
107
97
  - LICENSE
@@ -124,27 +114,26 @@ files:
124
114
  - spec/support/acs_example.xml
125
115
  homepage: https://github.com/kbeckman/omniauth-wsfed
126
116
  licenses: []
117
+ metadata: {}
127
118
  post_install_message:
128
119
  rdoc_options: []
129
120
  require_paths:
130
121
  - lib
131
122
  required_ruby_version: !ruby/object:Gem::Requirement
132
- none: false
133
123
  requirements:
134
124
  - - ! '>='
135
125
  - !ruby/object:Gem::Version
136
126
  version: '0'
137
127
  required_rubygems_version: !ruby/object:Gem::Requirement
138
- none: false
139
128
  requirements:
140
129
  - - ! '>='
141
130
  - !ruby/object:Gem::Version
142
131
  version: '0'
143
132
  requirements: []
144
133
  rubyforge_project:
145
- rubygems_version: 1.8.25
134
+ rubygems_version: 2.0.3
146
135
  signing_key:
147
- specification_version: 3
136
+ specification_version: 4
148
137
  summary: A WS-Federation + WS-Trust strategy for OmniAuth.
149
138
  test_files:
150
139
  - spec/omniauth/strategies/wsfed/auth_callback_spec.rb