ruby-saml-federa 0.0.2

data/.document

@@ -0,0 +1,5 @@
+README.rdoc
+lib/**/*.rb
+bin/*
+features/**/*.feature
+LICENSE

data/.gitignore

@@ -0,0 +1,10 @@
+*.sw?
+.DS_Store
+coverage
+rdoc
+pkg
+Gemfile.lock
+.idea/*
+lib/Lib.iml
+test/Test.iml
+.rvmrc

data/.travis.yml

@@ -0,0 +1,5 @@
+language: ruby
+rvm:
+  - 1.8.7
+  - 1.9.3
+  - ree

data/Gemfile

@@ -0,0 +1,12 @@
+source 'http://rubygems.org'
+
+gemspec
+
+group :test do
+  gem "ruby-debug", "~> 0.10.4", :require => nil, :platforms => :ruby_18
+  gem "debugger",   "~> 1.1.1",  :require => nil, :platforms => :ruby_19
+  gem "shoulda"
+  gem "rake"
+  gem "mocha"
+  gem "nokogiri"
+end

data/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2010 OneLogin, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,124 @@
+# Ruby SAML FEDERA
+
+The Ruby SAML Federa library is a fork of Ruby SAML and it is used for implementing the client side of a SAML authorization, initialization and confirmation requests
+with FedERa's identity providers.
+
+
+## The initialization phase
+
+This is the first request you will get from the identity provider. It will hit your application at a specific URL (that you've announced as being your SAML initialization point). The response to this initialization, is a redirect back to the identity provider, which can look something like this:
+
+```ruby
+    def init
+        #your login with Federa method..
+        #create an instance of Federa::Saml::Authrequest
+        request = Federa::Saml::Authrequest.new(get_saml_settings)
+        auth_request = request.create
+        # Based on the IdP metadata, select the appropriate binding 
+        # and return the action to perform to the controller
+        meta = Federa::Saml::Metadata.new(get_saml_settings)
+        signature = get_signature(auth_request.uuid,auth_request.request,"http://www.w3.org/2000/09/xmldsig#rsa-sha1")
+        redirect meta.create_sso_request( auth_request.request, {   :RelayState   => request.uuid,
+                                                                  :SigAlg       => "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
+                                                                  :Signature    => signature
+                                                              } )
+    end
+
+    
+    def get_signature(relayState, request, sigAlg)
+        #url encode of relayState
+        relayState_encoded = escape(relayState)
+        
+        #deflate and base64 of samlrequest
+        deflate_request_B64 = encode(deflate(request))
+        
+        #url encode of samlrequest
+        deflate_request_B64_encoded = escape(deflate_request_B64)
+        
+        #url encode of sigAlg
+        sigAlg_encoded = escape(sigAlg)
+        
+        querystring="SAMLRequest=#{deflate_request_B64_encoded}&RelayState=#{relayState_encoded}&SigAlg=#{sigAlg_encoded}"
+        digest = OpenSSL::Digest::SHA1.new(querystring.strip)  
+        pk = OpenSSL::PKey::RSA.new File.read(File.join("path.of.cert.pem"))
+        qssigned = pk.sign(digest,querystring.strip)
+        Base64.encode64(qssigned).gsub(/\n/, "")
+    end 
+```
+
+
+Once you've redirected back to the identity provider, it will ensure that the user has been authorized and redirect back to your application for final consumption, this is can look something like this (the authorize_success and authorize_failure methods are specific to your application):
+
+```ruby
+    def consume
+        #your assertion_consumer method...
+        saml_response = @request.params['SAMLResponse'] 
+        if !saml_response.nil? 
+          #read the settings
+          settings = get_saml_settings
+          #create an instance of response
+          response = Federa::Saml::Response.new(saml_response)
+          response.settings = settings
+
+          #validation of response
+          if response.is_valid? 
+            authorize_success(response.attributes)
+          else
+            authorize_failure(response.attributes)
+          end
+      end
+    end  
+```
+
+In the above there are a few assumptions in place, one being that the response.name_id is an email address. This is all handled with how you specify the settings that are in play via the saml_settings method. That could be implemented along the lines of this:
+
+```ruby
+    def get_saml_settings  
+        settings = Federa::Saml::Settings.new
+        settings.assertion_consumer_service_url     = ...String, url of your assertion consumer.
+        settings.issuer                             = ...String, host of your service provider or metadata url.
+        settings.sp_cert                            = ...String, path of your cert.pem.
+        settings.single_logout_service_url          = ...String, url of idp logout service'.
+        settings.sp_name_qualifier                  = ...String, name qualifier of service processor  (like your metadata url).
+        settings.idp_name_qualifier                 = ...String, name qualifier of identity provider (idp metadata).
+        settings.name_identifier_format             = ...Array, format names ( ["urn:oasis:names:tc:SAML:2.0:nameid-format:persistent", "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"] ).
+        settings.destination_service_url            = ...String, url of proxy for single sign on (in Idp).
+        settings.single_logout_destination          = ...String, url of logout request. 
+        settings.authn_context                      = ...Array, types of permissions allowed (["urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard", "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"]).
+        settings.requester_identificator            = ...unique id of your service provider domain.
+        settings.skip_validation                    = ...Bool, skip validation of assertion or response (false).
+        settings.idp_sso_target_url                 = ...String, url of idp sso proxy ("https://federatest.lepida.it/gw/SSOProxy/SAML2").
+        settings.idp_metadata                       = ...String, url of idp metadata ("https://federatest.lepida.it/gw/metadata").
+        settings
+    end  
+```
+
+
+
+## Service Provider Metadata
+
+To form a trusted pair relationship with the IdP, the SP (you) need to provide metadata XML
+to the IdP for various good reasons.  (Caching, certificate lookups, relying party permissions, etc)
+
+The class Onelogin::Saml::Metdata takes care of this by reading the Settings and returning XML.  All
+you have to do is add a controller to return the data, then give this URL to the IdP administrator.
+The metdata will be polled by the IdP every few minutes, so updating your settings should propagate
+to the IdP settings.
+
+```ruby
+  class SamlController < ApplicationController
+    # ... the rest of your controller definitions ...
+    def metadata
+      meta = Federa::Saml::Metadata.new
+      settings = get_saml_settings
+      render :xml => meta.generate(settings)
+    end
+  end
+```
+
+## Note on Patches/Pull Requests
+
+* Fork the project.
+* Make your feature addition or bug fix.
+* Commit, do not mess with rakefile, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
+* Send me a pull request.

data/Rakefile

@@ -0,0 +1,41 @@
+require 'rubygems'
+require 'rake'
+
+#not being used yet.
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/*_test.rb'
+  test.verbose = true
+end
+
+begin
+  require 'rcov/rcovtask'
+  Rcov::RcovTask.new do |test|
+    test.libs << 'test'
+    test.pattern = 'test/**/*_test.rb'
+    test.verbose = true
+  end
+rescue LoadError
+  task :rcov do
+    abort "RCov is not available. In order to run rcov, you must: sudo gem install spicycode-rcov"
+  end
+end
+
+task :test
+
+task :default => :test
+
+# require 'rake/rdoctask'
+# Rake::RDocTask.new do |rdoc|
+#   if File.exist?('VERSION')
+#     version = File.read('VERSION')
+#   else
+#     version = ""
+#   end
+
+#   rdoc.rdoc_dir = 'rdoc'
+#   rdoc.title = "ruby-saml #{version}"
+#   rdoc.rdoc_files.include('README*')
+#   rdoc.rdoc_files.include('lib/**/*.rb')
+#end

data/lib/federa/ruby-saml/authrequest.rb

@@ -0,0 +1,181 @@
+require "base64"
+require "uuid"
+require "zlib"
+require "cgi"
+require "rexml/document"
+require "rexml/xpath"
+require "rubygems"
+require "addressable/uri"
+
+module Federa::Saml
+  include REXML
+  class Authrequest
+    # a few symbols for SAML class names
+    HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+    HTTP_GET = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+    
+    attr_accessor :uuid, :request
+
+    def initialize( settings )
+      @settings = settings
+      @request_params = Hash.new
+    end
+    
+    def create(params = {})
+      uuid = "_" + UUID.new.generate
+      self.uuid = uuid
+      time = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
+      # Create AuthnRequest root element using REXML 
+      request_doc = REXML::Document.new
+      request_doc.context[:attribute_quote] = :quote
+      root = request_doc.add_element "saml2p:AuthnRequest", { "xmlns:saml2p" => "urn:oasis:names:tc:SAML:2.0:protocol" }
+      root.attributes['ID'] = uuid
+      root.attributes['IssueInstant'] = time
+      root.attributes['Version'] = "2.0"
+      root.attributes['ProtocolBinding'] = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      #root.attributes['AttributeConsumingServiceIndex'] = "2"
+      root.attributes['ForceAuthn'] = "false"
+      root.attributes['IsPassive'] = "false"
+
+      # Conditionally defined elements based on settings
+      if @settings.assertion_consumer_service_url != nil
+        root.attributes["AssertionConsumerServiceURL"] = @settings.assertion_consumer_service_url
+      end
+
+       if @settings.destination_service_url != nil
+        root.attributes["Destination"] = @settings.destination_service_url
+      end
+
+      if @settings.issuer != nil
+        issuer = root.add_element "saml2:Issuer", { "xmlns:saml2" => "urn:oasis:names:tc:SAML:2.0:assertion" }
+        issuer.text = @settings.issuer
+      end
+      if @settings.name_identifier_format != nil
+        root.add_element "saml2p:NameIDPolicy", { 
+            # Might want to make AllowCreate a setting?
+            "AllowCreate"     => "true",
+            "Format"          => @settings.name_identifier_format[1],
+            "SPNameQualifier" => @settings.sp_name_qualifier
+        }
+      end
+
+      # BUG fix here -- if an authn_context is defined, add the tags with an "exact"
+      # match required for authentication to succeed.  If this is not defined, 
+      # the IdP will choose default rules for authentication.  (Shibboleth IdP)
+      if @settings.authn_context != nil
+        requested_context = root.add_element "saml2p:RequestedAuthnContext", { 
+          "Comparison" => "exact"
+        }
+        context_class = []
+        @settings.authn_context.each_with_index{ |context, index|
+          context_class[index] = requested_context.add_element "saml2:AuthnContextClassRef", {
+            "xmlns:saml2" => "urn:oasis:names:tc:SAML:2.0:assertion"
+          }
+          context_class[index].text = context
+        }
+        
+      end
+
+      if @settings.requester_identificator != nil
+        requester_identificator = root.add_element "saml2p:Scoping", { 
+          "ProxyCount" => "1"
+        }
+        identificators = []
+        @settings.requester_identificator.each_with_index{ |requester, index|
+          identificators[index] = requester_identificator.add_element "saml2p:RequesterID"
+          identificators[index].text = requester
+        }
+        
+      end
+
+      request_doc << REXML::XMLDecl.new(version='1.0', encoding='UTF-8')
+      ret = ""
+      # pretty print the XML so IdP administrators can easily see what the SP supports
+      request_doc.write(ret, 1)
+
+      @request = ""
+      request_doc.write(@request)
+
+      #Logging.debug "Created AuthnRequest: #{@request}"
+
+      return self
+
+    end
+  
+    # get the IdP metadata, and select the appropriate SSO binding
+    # that we can support.  Currently this is HTTP-Redirect and HTTP-POST
+    # but more could be added in the future
+    def binding_select
+      # first check if we're still using the old hard coded method for 
+      # backwards compatability
+      if @settings.idp_metadata == nil && @settings.idp_sso_target_url != nil
+        @URL = @settings.idp_sso_target_url
+        return "GET", content_get
+      end
+      # grab the metadata
+      metadata = Metadata::new
+      meta_doc = metadata.get_idp_metadata(@settings)
+      
+      # first try POST
+      sso_element = REXML::XPath.first(meta_doc,
+        "/EntityDescriptor/IDPSSODescriptor/SingleSignOnService[@Binding='#{HTTP_POST}']")
+      if sso_element 
+        @URL = sso_element.attributes["Location"]
+        #Logging.debug "binding_select: POST to #{@URL}"
+        return "POST", content_post
+      end
+      
+      # next try GET
+      sso_element = REXML::XPath.first(meta_doc,
+        "/EntityDescriptor/IDPSSODescriptor/SingleSignOnService[@Binding='#{HTTP_GET}']")
+      if sso_element 
+        @URL = sso_element.attributes["Location"]
+        Logging.debug "binding_select: GET from #{@URL}"
+        return "GET", content_get
+      end
+      # other types we might want to add in the future:  SOAP, Artifact
+    end
+    
+    # construct the the parameter list on the URL and return
+    def content_get
+      # compress GET requests to try and stay under that 8KB request limit
+      deflated_request  = Zlib::Deflate.deflate(@request, 9)[2..-5]
+      # strict_encode64() isn't available?  sub out the newlines
+      @request_params["SAMLRequest"] = Base64.encode64(deflated_request).gsub(/\n/, "")
+      
+      Logging.debug "SAMLRequest=#{@request_params["SAMLRequest"]}"
+      uri = Addressable::URI.parse(@URL)
+      if uri.query_values == nil
+        uri.query_values = @request_params
+      else
+        # solution to stevenwilkin's parameter merge
+        uri.query_values = @request_params.merge(uri.query_values)
+      end
+      url = uri.to_s
+      #Logging.debug "Sending to URL #{url}"
+      return url
+    end
+    # construct an HTML form (POST) and return the content
+    def content_post
+      # POST requests seem to bomb out when they're deflated
+      # and they probably don't need to be compressed anyway
+      @request_params["SAMLRequest"] = Base64.encode64(@request).gsub(/\n/, "")
+      
+      #Logging.debug "SAMLRequest=#{@request_params["SAMLRequest"]}"
+      # kind of a cheesy method of building an HTML, form since we can't rely on Rails too much,
+      # and REXML doesn't work well with quote characters
+      str = "<html><body onLoad=\"document.getElementById('form').submit();\">\n"
+      str += "<form id='form' name='form' method='POST' action=\"#{@URL}\">\n"
+      # we could change this in the future to associate a temp auth session ID
+      str += "<input name='RelayState' value='ruby-saml' type='hidden' />\n"
+      @request_params.each_pair do |key, value|
+        str += "<input name=\"#{key}\" value=\"#{value}\" type='hidden' />\n"
+        #str += "<input name=\"#{key}\" value=\"#{CGI.escape(value)}\" type='hidden' />\n"
+      end
+      str += "</form></body></html>\n"
+      
+      #Logging.debug "Created form:\n#{str}"
+      return str
+    end
+  end
+end

data/lib/federa/ruby-saml/coding.rb

@@ -0,0 +1,34 @@
+require "cgi"
+require 'zlib'
+
+module Federa
+  module Saml
+    module Coding
+      def decode(encoded)
+        Base64.decode64(encoded)
+      end
+
+      def encode(encoded)
+        Base64.encode64(encoded).gsub(/\n/, "")
+      end
+
+      def escape(unescaped)
+        CGI.escape(unescaped)
+      end
+
+      def unescape(escaped)
+        CGI.unescape(escaped)
+      end
+
+      def inflate(deflated)
+        zlib = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+        zlib.inflate(deflated)
+      end
+
+      def deflate(inflated)
+        Zlib::Deflate.deflate(inflated, 9)[2..-5]
+      end
+
+    end
+  end
+end

data/lib/federa/ruby-saml/logging.rb

@@ -0,0 +1,26 @@
+# Simplistic log class when we're running in Rails
+module Federa
+  module Saml
+    class Logging
+      def self.debug(message)
+        return if !!ENV["ruby-saml/testing"]
+
+        if defined? Rails
+          Rails.logger.debug message
+        else
+          puts message
+        end
+      end
+
+      def self.info(message)
+        return if !!ENV["ruby-saml/testing"]
+
+        if defined? Rails
+          Rails.logger.info message
+        else
+          puts message
+        end
+      end
+    end
+  end
+end