omniauth_crowd 2.1.2 → 2.1.3

data/Gemfile.lock

@@ -1,25 +1,28 @@
 PATH
   remote: .
   specs:
-    omniauth_crowd (2.1.2)
+    omniauth_crowd (2.1.3)
       nokogiri (>= 1.4.4)
       omniauth (~> 1.0)
 
 GEM
   remote: http://rubygems.org/
   specs:
-    addressable (2.2.7)
-    crack (0.3.1)
+    addressable (2.3.5)
+    crack (0.4.1)
+      safe_yaml (~> 0.9.0)
     diff-lcs (1.1.3)
-    hashie (1.2.0)
-    nokogiri (1.5.2)
-    omniauth (1.1.1)
-      hashie (~> 1.2)
+    hashie (2.0.5)
+    mini_portile (0.5.1)
+    nokogiri (1.6.0)
+      mini_portile (~> 0.5.0)
+    omniauth (1.1.4)
+      hashie (>= 1.2, < 3)
       rack
-    rack (1.4.1)
-    rack-test (0.6.1)
+    rack (1.5.2)
+    rack-test (0.6.2)
       rack (>= 1.0)
-    rake (0.9.2.2)
+    rake (10.1.0)
     rspec (2.5.0)
       rspec-core (~> 2.5.0)
       rspec-expectations (~> 2.5.0)
@@ -28,6 +31,7 @@ GEM
     rspec-expectations (2.5.0)
       diff-lcs (~> 1.1.2)
     rspec-mocks (2.5.0)
+    safe_yaml (0.9.5)
     webmock (1.3.5)
       addressable (>= 2.1.1)
       crack (>= 0.1.7)

data/lib/omniauth/strategies/crowd/crowd_validator.rb

@@ -1,16 +1,17 @@
 require 'nokogiri'
 require 'net/http'
 require 'net/https'
-require 'rexml/text'
 
 module OmniAuth
   module Strategies
     class Crowd
       class CrowdValidator
-        SESSION_REQUEST_BODY = "<authentication-context>
-            <username>%s</username>
-            <password>%s</password>
-            </authentication-context>"
+        SESSION_REQUEST_BODY = <<-BODY.strip
+<authentication-context>
+  <username>%s</username>
+  <password>%s</password>
+</authentication-context>
+BODY
         AUTHENTICATION_REQUEST_BODY = "<password><value>%s</value></password>"
         def initialize(configuration, username, password)
           @configuration, @username, @password = configuration, username, password
@@ -49,16 +50,16 @@ module OmniAuth
 
         def add_user_groups!(user_info_hash)
           response = make_user_group_request
-          unless response.code.to_i != 200 || response.body.nil? || response.body == '' 
+          unless response.code.to_i != 200 || response.body.nil? || response.body == ''
             doc = Nokogiri::XML(response.body)
             user_info_hash["groups"] = doc.xpath("//groups/group/@name").map(&:to_s)
           end
           user_info_hash
         end
-        
+
         def retrieve_user_info!
           response = make_authorization_request
-          unless response.code.to_i != 200 || response.body.nil? || response.body == '' 
+          unless response.code.to_i != 200 || response.body.nil? || response.body == ''
             doc = Nokogiri::XML(response.body)
             {
               "user" => doc.xpath("//user/@name").to_s,
@@ -87,12 +88,12 @@ module OmniAuth
             http.request(req)
           end
         end
-        
+
         def make_user_group_request
           make_request(@user_group_uri)
         end
 
-        def make_authorization_request 
+        def make_authorization_request
           make_request(@authentiction_uri, make_authentication_request_body(@password))
         end
 
@@ -104,14 +105,14 @@ module OmniAuth
         def make_authentication_request_body(password)
           request_body = Nokogiri::XML(AUTHENTICATION_REQUEST_BODY)
           password_value = request_body.at_css "value"
-          password_value.content = REXML::Text.normalize(password)
+          password_value.content = password
           return request_body.root.to_s # return the body without the xml header
         end
 
         def make_session_request_body(username,password)
           request_body = Nokogiri::XML(SESSION_REQUEST_BODY)
-          request_body.at_css("username").content = REXML::Text.normalize(username)
-          request_body.at_css("password").content = REXML::Text.normalize(password)
+          request_body.at_css("username").content = username
+          request_body.at_css("password").content = password
           return request_body.root.to_s
         end
       end

data/lib/omniauth_crowd/version.rb

@@ -1,5 +1,5 @@
 module OmniAuth
   module Crowd
-    VERSION = "2.1.2"
+    VERSION = "2.1.3"
   end
 end

data/spec/omniauth/strategies/crowd_spec.rb

@@ -1,5 +1,4 @@
 require File.dirname(__FILE__) + '/../../spec_helper'
-require 'nokogiri'
 
 describe OmniAuth::Strategies::Crowd, :type=>:strategy do
   include OmniAuth::Test::StrategyTestCase
@@ -8,12 +7,60 @@ describe OmniAuth::Strategies::Crowd, :type=>:strategy do
     @crowd_server_url ||= 'https://crowd.example.org'
     @application_name ||= 'bogus_app'
     @application_password ||= 'bogus_app_password'
-    [OmniAuth::Strategies::Crowd, {:crowd_server_url => @crowd_server_url, 
+    [OmniAuth::Strategies::Crowd, {:crowd_server_url => @crowd_server_url,
                                     :application_name => @application_name,
                                     :application_password => @application_password,
                                     :use_sessions => @use_sessions}]
   end
 
+  describe 'Authentication Request Body' do
+    before do
+      config = OmniAuth::Strategies::Crowd::Configuration.new(strategy[1])
+      @validator = OmniAuth::Strategies::Crowd::CrowdValidator.new(config, 'foo', 'bar')
+    end
+
+    it 'should send password in session request' do
+      @validator.send(:make_authentication_request_body, 'bar').should == <<-BODY.strip
+<password>
+  <value>bar</value>
+</password>
+BODY
+    end
+
+    it 'should escape special characters username and password in session request' do
+      @validator.send(:make_authentication_request_body, 'bar<').should == <<-BODY.strip
+<password>
+  <value>bar&lt;</value>
+</password>
+BODY
+    end
+  end
+
+  describe 'Session Request Body' do
+    before do
+      config = OmniAuth::Strategies::Crowd::Configuration.new(strategy[1])
+      @validator = OmniAuth::Strategies::Crowd::CrowdValidator.new(config, 'foo', 'bar')
+    end
+
+    it 'should send username and password in session request' do
+      @validator.send(:make_session_request_body, 'foo', 'bar').should == <<-BODY.strip
+<authentication-context>
+  <username>foo</username>
+  <password>bar</password>
+</authentication-context>
+BODY
+    end
+
+    it 'should escape special characters username and password in session request' do
+      @validator.send(:make_session_request_body, 'foo', 'bar<').should == <<-BODY.strip
+<authentication-context>
+  <username>foo</username>
+  <password>bar&lt;</password>
+</authentication-context>
+BODY
+    end
+  end
+
   describe 'GET /auth/crowd' do
     before do
       get '/auth/crowd'
@@ -69,18 +116,6 @@ describe OmniAuth::Strategies::Crowd, :type=>:strategy do
       end
     end
 
-    context "when using authentication endpoint with special characters" do
-      before do
-        stub_request(:post, "https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/authentication?username=foo")
-        get '/auth/crowd/callback', nil, 'rack.session'=>{'omniauth.crowd'=> {"username"=>"foo", "password"=>"bar&<xml>"}}
-      end
-
-      it 'should escape special characters' do
-        WebMock.should have_requested(:post, 'https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/authentication?username=foo').
-          with { |req| Nokogiri::XML(req.body).at_css("value").content == 'bar&amp;&lt;xml&gt;' }
-      end
-    end
-
     context "when using session endpoint" do
       before do
         @use_sessions = true
@@ -100,12 +135,12 @@ describe OmniAuth::Strategies::Crowd, :type=>:strategy do
       it 'should call through to the master app' do
         last_response.body.should == 'true'
       end
-      
+
       it 'should have an auth hash' do
         auth = last_request.env['omniauth.auth']
         auth.should be_kind_of(Hash)
       end
-      
+
       it 'should have good data' do
         auth = last_request.env['omniauth.auth']['provider'].should == :crowd
         auth = last_request.env['omniauth.auth']['uid'].should == 'foo'
@@ -116,23 +151,6 @@ describe OmniAuth::Strategies::Crowd, :type=>:strategy do
     end
   end
 
-  context "when using session endpoint with special characters" do
-    before do
-      @use_sessions = true
-      stub_request(:post, "https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/authentication?username=foo%26%3Cxml%3E").
-      to_return(:body => File.read(File.join(File.dirname(__FILE__), '..', '..', 'fixtures', 'success.xml')))
-      stub_request(:post, "https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/session").
-      to_return(:status => 201, :body => File.read(File.join(File.dirname(__FILE__), '..', '..', 'fixtures', 'session.xml')))
-      stub_request(:get, "https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/user/group/direct?username=foo%26%3Cxml%3E").
-      to_return(:body => File.read(File.join(File.dirname(__FILE__), '..', '..', 'fixtures', 'groups.xml')))
-      get '/auth/crowd/callback', nil, 'rack.session'=>{'omniauth.crowd'=> {"username"=>"foo&<xml>", "password"=>"bar&<xml>"}}
-    end
-    it 'should escape special characters' do
-      WebMock.should have_requested(:post, 'https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/session').
-        with { |req| Nokogiri::XML(req.body).at_css("username").content == 'foo&amp;&lt;xml&gt;' and Nokogiri::XML(req.body).at_css("password").content == 'bar&amp;&lt;xml&gt;' }
-    end
-  end
-
   describe 'GET /auth/crowd/callback with credentials will fail' do
     before do
       stub_request(:post, "https://bogus_app:bogus_app_password@crowd.example.org/rest/usermanagement/latest/authentication?username=foo").

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omniauth_crowd
 version: !ruby/object:Gem::Version
-  version: 2.1.2
+  version: 2.1.3
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-08-13 00:00:00.000000000 Z
+date: 2013-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: omniauth
@@ -179,7 +179,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 4515462234693520699
+      hash: -1757168840233326872
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -188,7 +188,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 4515462234693520699
+      hash: -1757168840233326872
 requirements: []
 rubyforge_project: 
 rubygems_version: 1.8.25