rack_entra_id_auth 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5423c7efc63ef1114c69f4fdf4ba39b36a2f2aaa51a0aa9edb040d22d3f8034d
-  data.tar.gz: 96726463fbf27c7a11a7d5bd725ed47a476efc76165b00730b0ee1e1974d0358
+  metadata.gz: 86ee586f830d9d44c654338d677e88932c35aea1f5e1d73386ba91cab852f181
+  data.tar.gz: 3a60ec97200adad56e8306b2fbafa27efacf90696f847e05bd323fd5500feadb
 SHA512:
-  metadata.gz: 5f68e45441641aea9888b1daa813b90f88da1e9b38bae0dbab7cb57723eb195b4e2b2a2843128a4f1069655f02b445b5735abf3a681649395c08d716c70504cd
-  data.tar.gz: 97684c1d606dea307c9e3b86008c4b480447571c325c7804dbd72897be169c5e8bc3109038c87c3eb15efd845023b408e7fc85e8a0863d4da59ac9101b2fd9ba
+  metadata.gz: 5075ceb0dea5b90f6379669d8b1929d3053fd0563c3b146f0ee89623b80ab2a96d869e8d17862db3c560702244b0bcd2f85ece39c72d1b26567acc65e924ed80
+  data.tar.gz: 53b2daf93998839ce2412a037760ee2fa3161d596c690f2f6adc1bed7d8432affb6b5d20833be38a5eb6925692fc5908954021216c6140740db8b8c2fc344a15

data/lib/rack_entra_id_auth/configuration.rb

@@ -1,9 +1,49 @@
 require 'active_support/configurable'
+require 'ruby-saml'
 
 module RackEntraIdAuth
   class Configuration
     include ActiveSupport::Configurable
 
+    RUBY_SAML_SETTINGS = %i(
+      idp_entity_id
+      idp_sso_service_url
+      idp_slo_service_url
+      idp_slo_response_service_url
+      idp_cert
+      idp_cert_fingerprint
+      idp_cert_fingerprint_algorithm
+      idp_cert_multi
+      idp_attribute_names
+      idp_name_qualifier
+      valid_until
+      sp_entity_id
+      assertion_consumer_service_url
+      single_logout_service_url
+      sp_name_qualifier
+      name_identifier_format
+      name_identifier_value
+      name_identifier_value_requested
+      sessionindex
+      compress_request
+      compress_response
+      double_quote_xml_attribute_values
+      message_max_bytesize
+      passive
+      attributes_index
+      force_authn
+      certificate
+      private_key
+      sp_cert_multi
+      authn_context
+      authn_context_comparison
+      authn_context_decl_ref
+      security
+      soft
+    )
+
+    RUBY_SAML_SETTINGS.each { |ruby_saml_setting| config_accessor ruby_saml_setting }
+
     config_accessor :login_path, default: '/login'
     config_accessor :login_relay_state_url
     config_accessor :logout_path, default: '/logout'
@@ -24,57 +64,26 @@ module RackEntraIdAuth
     }
     config_accessor :skip_single_logout, default: true
 
-    # Ruby SAML ID Provider Settings
-    config_accessor :idp_entity_id
-    config_accessor :idp_sso_service_url
-    config_accessor :idp_slo_service_url
-    config_accessor :idp_slo_response_service_url
-    config_accessor :idp_cert
-    config_accessor :idp_cert_fingerprint
-    config_accessor :idp_cert_fingerprint_algorithm
-    config_accessor :idp_cert_multi
-    config_accessor :idp_attribute_names
-    config_accessor :idp_name_qualifier
-    config_accessor :valid_until
+    def metadata_url
+      @metadata_url
+    end
+
+    def metadata_url= (metadata_url)
+      @metadata_url = metadata_url
 
-    # Ruby SAML Service Provider Settings
-    config_accessor :sp_entity_id
-    config_accessor :assertion_consumer_service_url
-    config_accessor :single_logout_service_url
-    config_accessor :sp_name_qualifier
-    config_accessor :name_identifier_format
-    config_accessor :name_identifier_value
-    config_accessor :name_identifier_value_requested
-    config_accessor :sessionindex
-    config_accessor :compress_request
-    config_accessor :compress_response
-    config_accessor :double_quote_xml_attribute_values
-    config_accessor :message_max_bytesize
-    config_accessor :passive
-    config_accessor :attributes_index
-    config_accessor :force_authn
-    config_accessor :certificate
-    config_accessor :private_key
-    config_accessor :sp_cert_multi
-    config_accessor :authn_context
-    config_accessor :authn_context_comparison
-    config_accessor :authn_context_decl_ref
+      remote_hash = OneLogin::RubySaml::IdpMetadataParser.new.parse_remote_to_hash(metadata_url)
 
-    # Ruby SAML workflow Settings
-    config_accessor :security
-    config_accessor :soft
+      RUBY_SAML_SETTINGS.each do |ruby_saml_setting|
+        remote_value = remote_hash[ruby_saml_setting]
+
+        self.send("#{ruby_saml_setting}=", remote_value) unless remote_value.nil?
+      end
+
+      @metadata_url
+    end
 
     def ruby_saml_settings
-      config.to_h.except(
-        :login_path,
-        :login_relay_state_url,
-        :logout_path,
-        :logout_relay_state_url,
-        :mock_server,
-        :mock_attributes,
-        :session_key,
-        :session_value_proc,
-        :skip_single_logout)
+      config.to_h.slice(*RUBY_SAML_SETTINGS)
     end
   end
 end

data/lib/rack_entra_id_auth/entra_id_request.rb

@@ -80,7 +80,7 @@ module RackEntraIdAuth
     # @return [String]
     #
     def relay_state_url
-      request.get_header('rack.request.form_hash')['RelayState'] || request.params['RelayState']
+      request.get_header('rack.request.form_hash')['RelayState'] rescue request.params['RelayState'] || base_url
     end
 
     # A single sign-on response for the SAMLResponse in the request's header.

data/lib/rack_entra_id_auth/middleware.rb

@@ -66,13 +66,13 @@ module RackEntraIdAuth
         if !auth_response.is_valid?
           log(env, "Invalid single login reponse from Entra ID: #{auth_response.errors.first}")
 
-          return internal_server_error_response("Invalid login reponse from Entra ID: #{auth_response.errors.first}")
+          return internal_server_error_response("Invalid single login reponse from Entra ID: #{auth_response.errors.first}")
         end
 
         if !auth_response.success?
           log(env, 'Unsuccessful single single reponse from Entra ID.')
 
-          return internal_server_error_response('Unsuccessful login reponse from Entra ID.')
+          return internal_server_error_response('Unsuccessful single login reponse from Entra ID.')
         end
 
         log(env, 'Initializing session and redirecting to relay state URL…')
@@ -94,7 +94,7 @@ module RackEntraIdAuth
         if !logout_request.is_valid?
           log(env, "Invalid single logout request from Entra ID: #{logout_request.errors.first}")
 
-          return internal_server_error_response("Invalid logout request from Entra ID: #{logout_request.errors.first}")
+          return internal_server_error_response("Invalid single logout request from Entra ID: #{logout_request.errors.first}")
         end
 
         log(env, 'Destroying session and sending logout response to Entra ID…')
@@ -124,13 +124,13 @@ module RackEntraIdAuth
         if !logout_response.validate
           log(env, "Invalid single logout reponse from Entra ID: #{logout_response.errors.first}")
 
-          return internal_server_error_response("Invalid logout reponse from Entra ID: #{logout_response.errors.first}")
+          return internal_server_error_response("Invalid single logout reponse from Entra ID: #{logout_response.errors.first}")
         end
 
         if !logout_response.success?
           log(env, 'Unsuccessful single logout reponse from Entra ID.')
 
-          return internal_server_error_response('Unsuccessful logout reponse from Entra ID.')
+          return internal_server_error_response('Unsuccessful single logout reponse from Entra ID.')
         end
 
         log(env, 'Destroying session and redirecting to relay state URL…')

data/lib/rack_entra_id_auth/version.rb

@@ -1,3 +1,3 @@
 module RackEntraIdAuth
-  VERSION = '1.0.2'
+  VERSION = '1.1.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rack_entra_id_auth
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - David Susco
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-08-01 00:00:00.000000000 Z
+date: 2024-08-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -119,7 +119,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dsusco/rack_entra_id_auth/issues
-  changelog_uri: https://github.com/dsusco/rack_entra_id_auth/releases/tag/v1.0.2
+  changelog_uri: https://github.com/dsusco/rack_entra_id_auth/releases/tag/v1.1.0
   homepage_uri: https://github.com/dsusco/rack_entra_id_auth
   source_code_uri: https://github.com/dsusco/rack_entra_id_auth
 post_install_message: