rack-saml 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1314ff15a31bc098b119f2ea98cc8f009db5399f
-  data.tar.gz: 6d71dcdd13bfe052275b78c9f4801fedb7163265
+  metadata.gz: 814e3162772ca1b7deea5751c77af1fa07b969c4
+  data.tar.gz: 7ead1385a2a3b93c4e74b269d2f764bca77c8bce
 SHA512:
-  metadata.gz: 48113f2dae7eb3f86e09e0a6e6ca14e5ceeaff37ad22e6f239b23b7e81665afa9c3f8223f957a11da35c40baf52b3e51e02fa937e96c4c77f2c9731e3ed0221d
-  data.tar.gz: 118031ccc0114d6a03a597451a7510dce5b0b5663724012366857a61dbf6f3facabb1457f66afbf23bb6b382fe4722de05c976078dfc2334a20c688657b71b50
+  metadata.gz: 06a068a3c5ae379525c365abf7096dec77013be2d722e66baf62019135d93297258b25af3a805b283139d01e125dfb834c5dfe1f47f6d23c7f3f169c15889abb
+  data.tar.gz: 71382a6922efbeb60ce3284720c114a1e2e1764ab03115857cb0fed51f2059488413628199c116f09e3bd49aeac4156fa1027fa3026a1cbaf0ca12319fc5b234

data/README.md

@@ -10,6 +10,7 @@ rack-saml uses external libraries to generate and validate SAML AuthnRequest/Res
 ## Changes
 
 * version 0.0.2: SP session is supported using Rack::Session for Rack applications and ActionDispatch::Session for Rails applications. 
+* version 0.1.1: Update to fit newer ruby-saml.
 
 ## Limitations
 
@@ -19,15 +20,12 @@ Current implementation supports only Onelogin SAML assertion handler. It does no
 
 ## Getting Started
 
-### Installation
-
-    % gem install rack-saml
-
-### Setup Gemfile
+### Setup Gemfile and Installation
 
     % cd rails-app
     % vi Gemfile
     gem 'rack-saml'
+    % bundle install
 
 ### Setup Rack::Saml middleware
 
@@ -103,6 +101,8 @@ Configuration to set SAML parameters. At least, you must configure saml_idp or s
 * *saml_sp*: Set the SAML SP's entity ID
 * *sp_cert*: path to the SAML SP's certificate file, e.g. cert.pem (AuthnRequest Signing and Response Encryption are not supported yet)
 * *sp_key*: path to the SAML SP's key file, e.g. key.pem (AuthnRequest Signing and Response Encryption are not supported yet)
+* *allowed_clock_drift*: A clock margin (second) for checking NotBefore condition specified in a SAML Response (default: 0 seconds, 60 second may be good for local test).
+* *validation_error*: If set to true, a detailed reason of SAML response validation error will be shown on the browser (true/false)
 
 If not set explicitly, SAML SP's entity ID (saml_sp) is automatically generated from request URI and /rack-saml-sp (fixed path name). The Assertion Consumer Service URI is generated from request URI and protected_path.
 

data/config/rack-saml.yml

@@ -5,3 +5,5 @@ saml_idp: https://localhost/idp/shibboleth
 saml_sess_timeout: 1800
 shib_app_id: default
 shibb_ds: https://localhost/discovery/WAYF
+allowed_clock_drift: 60
+validation_error: true

data/lib/rack/saml/response/onelogin_response.rb

@@ -8,12 +8,22 @@ module Rack
 
       def initialize(request, config, metadata)
         super(request, config, metadata)
-        @response = OneLogin::RubySaml::Response.new(@request.params['SAMLResponse'])
+        @response = OneLogin::RubySaml::Response.new(@request.params['SAMLResponse'], {
+          :allowed_clock_drift => config['allowed_clock_drift']
+        })
         @response.settings = saml_settings
       end
 
       def is_valid?
-        @response.is_valid?
+        begin
+          if config['validation_error']
+            @response.validate!
+          else
+            @response.is_valid?
+          end
+        rescue OneLogin::RubySaml::ValidationError => e
+          raise ValidationError.new(e.message)
+        end
       end
 
       def attributes

data/lib/rack/saml.rb

@@ -18,15 +18,15 @@ module Rack
   #   'rack_saml' => {
   #     'ds.session' => {
   #       'sid' => temporally_generated_hash,
-  #       'expire_at' => xxxxx # timestamp
+  #       'expires_at' => xxxxx # timestamp
   #     }
   #     'saml_authreq.session' => {
   #       'sid' => temporally_generated_hash,
-  #       'expire_at' => xxxxx # timestamp
+  #       'expires_at' => xxxxx # timestamp
   #     }
   #     'saml_res.session' => {
   #       'sid' => temporally_generated_hash,
-  #       'expire_at' => xxxxx # timestamp,
+  #       'expires_at' => xxxxx # timestamp,
   #       'env' => {}
   #     }
   #   }
@@ -36,6 +36,9 @@ module Rack
     autoload "MetadataHandler", 'rack/saml/metadata_handler'
     autoload "ResponseHandler", 'rack/saml/response_handler'
 
+    class ValidationError < StandardError
+    end
+
     def default_config_path(config_file)
       ::File.expand_path("../../../config/#{config_file}", __FILE__)
     end
@@ -112,7 +115,7 @@ module Rack
           sid = generate_sid
         end
         @session["#{type}.session"]['sid'] = sid
-        @session["#{type}.session"]['expired_at'] = period
+        @session["#{type}.session"]['expires_at'] = period
         @session["#{type}.session"]
       end
 
@@ -127,11 +130,11 @@ module Rack
       def is_valid?(type, sid = nil)
         session = @session["#{type}.session"]
         return false if session['sid'].nil? # no valid session
-        if session['expired_at'].nil? # no expiration
+        if session['expires_at'].nil? # no expiration
           return true if sid.nil? # no sid check
           return true if session['sid'] == sid # sid check
         else
-          if Time.now < Time.parse(session['expired_at']) # before expiration
+          if Time.now < Time.parse(session['expires_at'].to_s) # before expiration
             return true if sid.nil? # no sid check
             return true if session['sid'] == sid # sid check
           end
@@ -190,15 +193,19 @@ module Rack
       elsif request.request_method == 'POST' && match_protected_path?(request) # process Response
         if session.is_valid?('saml_authreq')
           handler = ResponseHandler.new(request, @config, @metadata['idp_lists'][@config['saml_idp']])
-          if handler.response.is_valid?
-            session.finish('saml_authreq')
-            session.start('saml_res', @config['saml_sess_timeout'] || 1800)
-            handler.extract_attrs(env, session, @attribute_map)
-            return Rack::Response.new.tap { |r|
-              r.redirect request.url
-            }.finish
-          else
-            return create_response(403, 'text/html', 'SAML Error: Invalid SAML response.')
+          begin
+            if handler.response.is_valid?
+              session.finish('saml_authreq')
+              session.start('saml_res', @config['saml_sess_timeout'] || 1800)
+              handler.extract_attrs(env, session, @attribute_map)
+              return Rack::Response.new.tap { |r|
+                r.redirect request.url
+              }.finish
+            else
+              return create_response(403, 'text/html', 'SAML Error: Invalid SAML response.')
+            end
+          rescue ValidationError => e
+            return create_response(403, 'text/html', "SAML Error: Invalid SAML response.<br/>Reason: #{e.message}")
           end
         else
           return create_response(500, 'text/html', 'No valid AuthnRequest session.')

data/lib/rack-saml/version.rb

@@ -1,6 +1,6 @@
 require 'rack'
 module Rack
   module Saml
-    VERSION = "0.1.0"
+    VERSION = "0.1.1"
   end
 end

data/rack-saml.gemspec

@@ -2,6 +2,7 @@
 require File.expand_path('../lib/rack-saml/version', __FILE__)
 
 Gem::Specification.new do |gem|
+  gem.add_dependency 'rack'
   gem.add_dependency 'ruby-saml', '~> 0.8.0'
   gem.add_development_dependency 'rspec'
 

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: rack-saml
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Toyokazu Akiyama
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-10-26 00:00:00.000000000 Z
+date: 2014-11-07 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: ruby-saml
   requirement: !ruby/object:Gem::Requirement