ruby-saml-federazione-trentina 0.0.1 → 0.0.2
Sign up to get free protection for your applications and to get access to all the features.
- data/lib/{onelogin → federazione_trentina}/ruby-saml/authrequest.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/coding.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/logging.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/logout_request.rb +2 -2
- data/lib/{onelogin → federazione_trentina}/ruby-saml/logout_response.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/metadata.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/request.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/response.rb +2 -2
- data/lib/{onelogin → federazione_trentina}/ruby-saml/settings.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/validation_error.rb +1 -1
- data/lib/{onelogin → federazione_trentina}/ruby-saml/version.rb +1 -1
- data/lib/ruby-saml-federazione-trentina.rb +11 -0
- data/lib/xml_security.rb +4 -4
- data/{ruby-saml.gemspec → ruby-saml-federazione-trentina.gemspec} +2 -2
- data/test/logoutrequest_test.rb +13 -13
- data/test/request_test.rb +9 -9
- data/test/response_test.rb +47 -47
- data/test/settings_test.rb +2 -2
- data/test/xml_security_test.rb +6 -6
- metadata +18 -18
- data/lib/ruby-saml.rb +0 -11
@@ -1,6 +1,6 @@
|
|
1
1
|
require 'uuid'
|
2
2
|
|
3
|
-
module
|
3
|
+
module FederazioneTrentina::Saml
|
4
4
|
class LogoutRequest
|
5
5
|
ASSERTION = "urn:oasis:names:tc:SAML:2.0:assertion"
|
6
6
|
PROTOCOL = "urn:oasis:names:tc:SAML:2.0:protocol"
|
@@ -14,7 +14,7 @@ module Onelogin::Saml
|
|
14
14
|
def initialize( options = {} )
|
15
15
|
opt = { :request => nil, :settings => nil }.merge(options)
|
16
16
|
@settings = opt[:settings]
|
17
|
-
@issue_instant =
|
17
|
+
@issue_instant = LogoutRequest.timestamp
|
18
18
|
@request_params = Hash.new
|
19
19
|
# We need to generate a LogoutRequest to send to the IdP
|
20
20
|
if opt[:request].nil?
|
@@ -8,7 +8,7 @@ require "digest/md5"
|
|
8
8
|
# Return this XML in a controller, then give that URL to the the
|
9
9
|
# IdP administrator. The IdP will poll the URL and your settings
|
10
10
|
# will be updated automatically
|
11
|
-
module
|
11
|
+
module FederazioneTrentina
|
12
12
|
module Saml
|
13
13
|
class Metadata
|
14
14
|
include REXML
|
@@ -7,7 +7,7 @@ require "openssl"
|
|
7
7
|
require "digest/sha1"
|
8
8
|
|
9
9
|
# Only supports SAML 2.0
|
10
|
-
module
|
10
|
+
module FederazioneTrentina
|
11
11
|
module Saml
|
12
12
|
|
13
13
|
class Response
|
@@ -123,7 +123,7 @@ module Onelogin
|
|
123
123
|
# The idp_cert needs to be populated before the validate_response_state method
|
124
124
|
|
125
125
|
if settings
|
126
|
-
|
126
|
+
Metadata.new(settings).get_idp_metadata
|
127
127
|
end
|
128
128
|
return false if validate_structure(soft) == false
|
129
129
|
return false if validate_response_state(soft) == false
|
@@ -0,0 +1,11 @@
|
|
1
|
+
require 'federazione_trentina/ruby-saml/logging'
|
2
|
+
require 'federazione_trentina/ruby-saml/coding'
|
3
|
+
require 'federazione_trentina/ruby-saml/request'
|
4
|
+
require 'federazione_trentina/ruby-saml/authrequest'
|
5
|
+
require 'federazione_trentina/ruby-saml/logout_request'
|
6
|
+
require 'federazione_trentina/ruby-saml/logout_response'
|
7
|
+
require 'federazione_trentina/ruby-saml/response'
|
8
|
+
require 'federazione_trentina/ruby-saml/settings'
|
9
|
+
require 'federazione_trentina/ruby-saml/validation_error'
|
10
|
+
require 'federazione_trentina/ruby-saml/metadata'
|
11
|
+
require 'federazione_trentina/ruby-saml/version'
|
data/lib/xml_security.rb
CHANGED
@@ -29,7 +29,7 @@ require "openssl"
|
|
29
29
|
require 'nokogiri'
|
30
30
|
require "digest/sha1"
|
31
31
|
require "digest/sha2"
|
32
|
-
require "
|
32
|
+
require "federazione_trentina/ruby-saml/validation_error"
|
33
33
|
|
34
34
|
module XMLSecurity
|
35
35
|
|
@@ -55,7 +55,7 @@ module XMLSecurity
|
|
55
55
|
fingerprint = Digest::SHA1.hexdigest(cert.to_der)
|
56
56
|
|
57
57
|
if fingerprint != idp_cert_fingerprint.gsub(/[^a-zA-Z0-9]/,"").downcase
|
58
|
-
return soft ? false : (raise
|
58
|
+
return soft ? false : (raise FederazioneTrentina::Saml::ValidationError.new("Fingerprint mismatch"))
|
59
59
|
end
|
60
60
|
|
61
61
|
validate_doc(base64_cert, soft)
|
@@ -98,7 +98,7 @@ module XMLSecurity
|
|
98
98
|
digest_value = Base64.decode64(REXML::XPath.first(ref, "//ds:DigestValue", {"ds"=>DSIG}).text)
|
99
99
|
|
100
100
|
unless digests_match?(hash, digest_value)
|
101
|
-
return soft ? false : (raise
|
101
|
+
return soft ? false : (raise FederazioneTrentina::Saml::ValidationError.new("Digest mismatch"))
|
102
102
|
end
|
103
103
|
end
|
104
104
|
|
@@ -113,7 +113,7 @@ module XMLSecurity
|
|
113
113
|
signature_algorithm = algorithm(REXML::XPath.first(signed_info_element, "//ds:SignatureMethod", {"ds"=>DSIG}))
|
114
114
|
|
115
115
|
unless cert.public_key.verify(signature_algorithm.new, signature, canon_string)
|
116
|
-
return soft ? false : (raise
|
116
|
+
return soft ? false : (raise FederazioneTrentina::Saml::ValidationError.new("Key validation error"))
|
117
117
|
end
|
118
118
|
|
119
119
|
return true
|
@@ -2,7 +2,7 @@ $LOAD_PATH.push File.expand_path('../lib', __FILE__)
|
|
2
2
|
|
3
3
|
Gem::Specification.new do |s|
|
4
4
|
s.name = 'ruby-saml-federazione-trentina'
|
5
|
-
s.version = '0.0.
|
5
|
+
s.version = '0.0.2'
|
6
6
|
|
7
7
|
s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
|
8
8
|
s.authors = ["Fabiano Pavan"]
|
@@ -10,7 +10,7 @@ Gem::Specification.new do |s|
|
|
10
10
|
s.description = %q{SAML toolkit for Ruby programs to integrate with federazione PAT trentina }
|
11
11
|
s.email = %q{fabiano.pavan@soluzionipa.it}
|
12
12
|
s.files = `git ls-files`.split("\n")
|
13
|
-
s.homepage = %q{https://github.com/fabianopavan/ruby-saml}
|
13
|
+
s.homepage = %q{https://github.com/fabianopavan/ruby-saml-federazione-trentina}
|
14
14
|
s.rdoc_options = ["--charset=UTF-8"]
|
15
15
|
s.require_paths = ["lib"]
|
16
16
|
s.summary = %q{SAML Ruby Tookit}
|
data/test/logoutrequest_test.rb
CHANGED
@@ -3,11 +3,11 @@ require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
|
|
3
3
|
class RequestTest < Test::Unit::TestCase
|
4
4
|
|
5
5
|
context "Logoutrequest" do
|
6
|
-
settings =
|
6
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
7
7
|
|
8
8
|
should "create the deflated SAMLRequest URL parameter" do
|
9
9
|
settings.idp_slo_target_url = "http://unauth.com/logout"
|
10
|
-
unauth_url =
|
10
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings)
|
11
11
|
assert unauth_url =~ /^http:\/\/unauth\.com\/logout\?SAMLRequest=/
|
12
12
|
|
13
13
|
inflated = decode_saml_request_payload(unauth_url)
|
@@ -17,10 +17,10 @@ class RequestTest < Test::Unit::TestCase
|
|
17
17
|
|
18
18
|
should "support additional params" do
|
19
19
|
|
20
|
-
unauth_url =
|
20
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings, { :hello => nil })
|
21
21
|
assert unauth_url =~ /&hello=$/
|
22
22
|
|
23
|
-
unauth_url =
|
23
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings, { :foo => "bar" })
|
24
24
|
assert unauth_url =~ /&foo=bar$/
|
25
25
|
end
|
26
26
|
|
@@ -29,7 +29,7 @@ class RequestTest < Test::Unit::TestCase
|
|
29
29
|
sessionidx = UUID.new.generate
|
30
30
|
settings.sessionindex = sessionidx
|
31
31
|
|
32
|
-
unauth_url =
|
32
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings, { :name_id => "there" })
|
33
33
|
inflated = decode_saml_request_payload(unauth_url)
|
34
34
|
|
35
35
|
assert_match /<samlp:SessionIndex/, inflated
|
@@ -37,13 +37,13 @@ class RequestTest < Test::Unit::TestCase
|
|
37
37
|
end
|
38
38
|
|
39
39
|
should "set name_identifier_value" do
|
40
|
-
settings =
|
40
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
41
41
|
settings.idp_slo_target_url = "http://example.com"
|
42
42
|
settings.name_identifier_format = "transient"
|
43
43
|
name_identifier_value = "abc123"
|
44
44
|
settings.name_identifier_value = name_identifier_value
|
45
45
|
|
46
|
-
unauth_url =
|
46
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings, { :name_id => "there" })
|
47
47
|
inflated = decode_saml_request_payload(unauth_url)
|
48
48
|
|
49
49
|
assert_match /<saml:NameID/, inflated
|
@@ -52,30 +52,30 @@ class RequestTest < Test::Unit::TestCase
|
|
52
52
|
|
53
53
|
context "when the target url doesn't contain a query string" do
|
54
54
|
should "create the SAMLRequest parameter correctly" do
|
55
|
-
settings =
|
55
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
56
56
|
settings.idp_slo_target_url = "http://example.com"
|
57
57
|
|
58
|
-
unauth_url =
|
58
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings)
|
59
59
|
assert unauth_url =~ /^http:\/\/example.com\?SAMLRequest/
|
60
60
|
end
|
61
61
|
end
|
62
62
|
|
63
63
|
context "when the target url contains a query string" do
|
64
64
|
should "create the SAMLRequest parameter correctly" do
|
65
|
-
settings =
|
65
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
66
66
|
settings.idp_slo_target_url = "http://example.com?field=value"
|
67
67
|
|
68
|
-
unauth_url =
|
68
|
+
unauth_url = FederazioneTrentina::Saml::Logoutrequest.new.create(settings)
|
69
69
|
assert unauth_url =~ /^http:\/\/example.com\?field=value&SAMLRequest/
|
70
70
|
end
|
71
71
|
end
|
72
72
|
|
73
73
|
context "consumation of logout may need to track the transaction" do
|
74
74
|
should "have access to the request uuid" do
|
75
|
-
settings =
|
75
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
76
76
|
settings.idp_slo_target_url = "http://example.com?field=value"
|
77
77
|
|
78
|
-
unauth_req =
|
78
|
+
unauth_req = FederazioneTrentina::Saml::Logoutrequest.new
|
79
79
|
unauth_url = unauth_req.create(settings)
|
80
80
|
|
81
81
|
inflated = decode_saml_request_payload(unauth_url)
|
data/test/request_test.rb
CHANGED
@@ -4,9 +4,9 @@ class RequestTest < Test::Unit::TestCase
|
|
4
4
|
|
5
5
|
context "Authrequest" do
|
6
6
|
should "create the deflated SAMLRequest URL parameter" do
|
7
|
-
settings =
|
7
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
8
8
|
settings.idp_sso_target_url = "http://example.com"
|
9
|
-
auth_url =
|
9
|
+
auth_url = FederazioneTrentina::Saml::Authrequest.new.create(settings)
|
10
10
|
assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
|
11
11
|
payload = CGI.unescape(auth_url.split("=").last)
|
12
12
|
decoded = Base64.decode64(payload)
|
@@ -20,32 +20,32 @@ class RequestTest < Test::Unit::TestCase
|
|
20
20
|
end
|
21
21
|
|
22
22
|
should "accept extra parameters" do
|
23
|
-
settings =
|
23
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
24
24
|
settings.idp_sso_target_url = "http://example.com"
|
25
25
|
|
26
|
-
auth_url =
|
26
|
+
auth_url = FederazioneTrentina::Saml::Authrequest.new.create(settings, { :hello => "there" })
|
27
27
|
assert auth_url =~ /&hello=there$/
|
28
28
|
|
29
|
-
auth_url =
|
29
|
+
auth_url = FederazioneTrentina::Saml::Authrequest.new.create(settings, { :hello => nil })
|
30
30
|
assert auth_url =~ /&hello=$/
|
31
31
|
end
|
32
32
|
|
33
33
|
context "when the target url doesn't contain a query string" do
|
34
34
|
should "create the SAMLRequest parameter correctly" do
|
35
|
-
settings =
|
35
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
36
36
|
settings.idp_sso_target_url = "http://example.com"
|
37
37
|
|
38
|
-
auth_url =
|
38
|
+
auth_url = FederazioneTrentina::Saml::Authrequest.new.create(settings)
|
39
39
|
assert auth_url =~ /^http:\/\/example.com\?SAMLRequest/
|
40
40
|
end
|
41
41
|
end
|
42
42
|
|
43
43
|
context "when the target url contains a query string" do
|
44
44
|
should "create the SAMLRequest parameter correctly" do
|
45
|
-
settings =
|
45
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
46
46
|
settings.idp_sso_target_url = "http://example.com?field=value"
|
47
47
|
|
48
|
-
auth_url =
|
48
|
+
auth_url = FederazioneTrentina::Saml::Authrequest.new.create(settings)
|
49
49
|
assert auth_url =~ /^http:\/\/example.com\?field=value&SAMLRequest/
|
50
50
|
end
|
51
51
|
end
|
data/test/response_test.rb
CHANGED
@@ -4,40 +4,40 @@ class RubySamlTest < Test::Unit::TestCase
|
|
4
4
|
|
5
5
|
context "Response" do
|
6
6
|
should "raise an exception when response is initialized with nil" do
|
7
|
-
assert_raises(ArgumentError) {
|
7
|
+
assert_raises(ArgumentError) { FederazioneTrentina::Saml::Response.new(nil) }
|
8
8
|
end
|
9
9
|
|
10
10
|
should "be able to parse a document which contains ampersands" do
|
11
11
|
XMLSecurity::SignedDocument.any_instance.stubs(:digests_match?).returns(true)
|
12
|
-
|
12
|
+
FederazioneTrentina::Saml::Response.any_instance.stubs(:validate_conditions).returns(true)
|
13
13
|
|
14
|
-
response =
|
15
|
-
settings =
|
14
|
+
response = FederazioneTrentina::Saml::Response.new(ampersands_response)
|
15
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
16
16
|
settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
|
17
17
|
response.settings = settings
|
18
18
|
response.validate!
|
19
19
|
end
|
20
20
|
|
21
21
|
should "adapt namespace" do
|
22
|
-
response =
|
22
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
23
23
|
assert !response.name_id.nil?
|
24
|
-
response =
|
24
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_2)
|
25
25
|
assert !response.name_id.nil?
|
26
|
-
response =
|
26
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_3)
|
27
27
|
assert !response.name_id.nil?
|
28
28
|
end
|
29
29
|
|
30
30
|
should "default to raw input when a response is not Base64 encoded" do
|
31
31
|
decoded = Base64.decode64(response_document_2)
|
32
|
-
response =
|
32
|
+
response = FederazioneTrentina::Saml::Response.new(decoded)
|
33
33
|
assert response.document
|
34
34
|
end
|
35
35
|
|
36
36
|
context "Assertion" do
|
37
37
|
should "only retreive an assertion with an ID that matches the signature's reference URI" do
|
38
|
-
response =
|
38
|
+
response = FederazioneTrentina::Saml::Response.new(wrapped_response_2)
|
39
39
|
response.stubs(:conditions).returns(nil)
|
40
|
-
settings =
|
40
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
41
41
|
settings.idp_cert_fingerprint = signature_fingerprint_1
|
42
42
|
response.settings = settings
|
43
43
|
assert response.name_id.nil?
|
@@ -46,8 +46,8 @@ class RubySamlTest < Test::Unit::TestCase
|
|
46
46
|
|
47
47
|
context "#validate!" do
|
48
48
|
should "raise when encountering a condition that prevents the document from being valid" do
|
49
|
-
response =
|
50
|
-
assert_raise(
|
49
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
50
|
+
assert_raise(FederazioneTrentina::Saml::ValidationError) do
|
51
51
|
response.validate!
|
52
52
|
end
|
53
53
|
end
|
@@ -55,20 +55,20 @@ class RubySamlTest < Test::Unit::TestCase
|
|
55
55
|
|
56
56
|
context "#is_valid?" do
|
57
57
|
should "return false when response is initialized with blank data" do
|
58
|
-
response =
|
58
|
+
response = FederazioneTrentina::Saml::Response.new('')
|
59
59
|
assert !response.is_valid?
|
60
60
|
end
|
61
61
|
|
62
62
|
should "return false if settings have not been set" do
|
63
|
-
response =
|
63
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
64
64
|
assert !response.is_valid?
|
65
65
|
end
|
66
66
|
|
67
67
|
should "return true when the response is initialized with valid data" do
|
68
|
-
response =
|
68
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_4)
|
69
69
|
response.stubs(:conditions).returns(nil)
|
70
70
|
assert !response.is_valid?
|
71
|
-
settings =
|
71
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
72
72
|
assert !response.is_valid?
|
73
73
|
response.settings = settings
|
74
74
|
assert !response.is_valid?
|
@@ -77,28 +77,28 @@ class RubySamlTest < Test::Unit::TestCase
|
|
77
77
|
end
|
78
78
|
|
79
79
|
should "return true when using certificate instead of fingerprint" do
|
80
|
-
response =
|
80
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_4)
|
81
81
|
response.stubs(:conditions).returns(nil)
|
82
|
-
settings =
|
82
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
83
83
|
response.settings = settings
|
84
84
|
settings.idp_cert = signature_1
|
85
85
|
assert response.is_valid?
|
86
86
|
end
|
87
87
|
|
88
88
|
should "not allow signature wrapping attack" do
|
89
|
-
response =
|
89
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_4)
|
90
90
|
response.stubs(:conditions).returns(nil)
|
91
|
-
settings =
|
91
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
92
92
|
settings.idp_cert_fingerprint = signature_fingerprint_1
|
93
93
|
response.settings = settings
|
94
94
|
assert response.is_valid?
|
95
|
-
assert response.name_id == "test@
|
95
|
+
assert response.name_id == "test@FederazioneTrentina.com"
|
96
96
|
end
|
97
97
|
|
98
98
|
should "support dynamic namespace resolution on signature elements" do
|
99
|
-
response =
|
99
|
+
response = FederazioneTrentina::Saml::Response.new(fixture("no_signature_ns.xml"))
|
100
100
|
response.stubs(:conditions).returns(nil)
|
101
|
-
settings =
|
101
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
102
102
|
response.settings = settings
|
103
103
|
settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
|
104
104
|
XMLSecurity::SignedDocument.any_instance.expects(:validate_doc).returns(true)
|
@@ -106,9 +106,9 @@ class RubySamlTest < Test::Unit::TestCase
|
|
106
106
|
end
|
107
107
|
|
108
108
|
should "validate ADFS assertions" do
|
109
|
-
response =
|
109
|
+
response = FederazioneTrentina::Saml::Response.new(fixture(:adfs_response_sha256))
|
110
110
|
response.stubs(:conditions).returns(nil)
|
111
|
-
settings =
|
111
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
112
112
|
settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
|
113
113
|
response.settings = settings
|
114
114
|
assert response.validate!
|
@@ -116,101 +116,101 @@ class RubySamlTest < Test::Unit::TestCase
|
|
116
116
|
|
117
117
|
should "validate SAML 2.0 XML structure" do
|
118
118
|
resp_xml = Base64.decode64(response_document_4).gsub(/emailAddress/,'test')
|
119
|
-
response =
|
119
|
+
response = FederazioneTrentina::Saml::Response.new(Base64.encode64(resp_xml))
|
120
120
|
response.stubs(:conditions).returns(nil)
|
121
|
-
settings =
|
121
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
122
122
|
settings.idp_cert_fingerprint = signature_fingerprint_1
|
123
123
|
response.settings = settings
|
124
|
-
assert_raises(
|
124
|
+
assert_raises(FederazioneTrentina::Saml::ValidationError, 'Digest mismatch'){ response.validate! }
|
125
125
|
end
|
126
126
|
end
|
127
127
|
|
128
128
|
context "#name_id" do
|
129
129
|
should "extract the value of the name id element" do
|
130
|
-
response =
|
131
|
-
assert_equal "support@
|
130
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
131
|
+
assert_equal "support@FederazioneTrentina.com", response.name_id
|
132
132
|
|
133
|
-
response =
|
133
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_3)
|
134
134
|
assert_equal "someone@example.com", response.name_id
|
135
135
|
end
|
136
136
|
|
137
137
|
should "be extractable from an OpenSAML response" do
|
138
|
-
response =
|
138
|
+
response = FederazioneTrentina::Saml::Response.new(fixture(:open_saml))
|
139
139
|
assert_equal "someone@example.org", response.name_id
|
140
140
|
end
|
141
141
|
|
142
142
|
should "be extractable from a Simple SAML PHP response" do
|
143
|
-
response =
|
143
|
+
response = FederazioneTrentina::Saml::Response.new(fixture(:simple_saml_php))
|
144
144
|
assert_equal "someone@example.com", response.name_id
|
145
145
|
end
|
146
146
|
end
|
147
147
|
|
148
148
|
context "#check_conditions" do
|
149
149
|
should "check time conditions" do
|
150
|
-
response =
|
150
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
151
151
|
assert !response.send(:validate_conditions, true)
|
152
|
-
response =
|
152
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_6)
|
153
153
|
assert response.send(:validate_conditions, true)
|
154
154
|
time = Time.parse("2011-06-14T18:25:01.516Z")
|
155
155
|
Time.stubs(:now).returns(time)
|
156
|
-
response =
|
156
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_5)
|
157
157
|
assert response.send(:validate_conditions, true)
|
158
158
|
end
|
159
159
|
end
|
160
160
|
|
161
161
|
context "#attributes" do
|
162
162
|
should "extract the first attribute in a hash accessed via its symbol" do
|
163
|
-
response =
|
163
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
164
164
|
assert_equal "demo", response.attributes[:uid]
|
165
165
|
end
|
166
166
|
|
167
167
|
should "extract the first attribute in a hash accessed via its name" do
|
168
|
-
response =
|
168
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
169
169
|
assert_equal "demo", response.attributes["uid"]
|
170
170
|
end
|
171
171
|
|
172
172
|
should "extract all attributes" do
|
173
|
-
response =
|
173
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
174
174
|
assert_equal "demo", response.attributes[:uid]
|
175
175
|
assert_equal "value", response.attributes[:another_value]
|
176
176
|
end
|
177
177
|
|
178
178
|
should "work for implicit namespaces" do
|
179
|
-
response =
|
179
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_3)
|
180
180
|
assert_equal "someone@example.com", response.attributes["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
|
181
181
|
end
|
182
182
|
|
183
183
|
should "not raise on responses without attributes" do
|
184
|
-
response =
|
184
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_4)
|
185
185
|
assert_equal Hash.new, response.attributes
|
186
186
|
end
|
187
187
|
end
|
188
188
|
|
189
189
|
context "#session_expires_at" do
|
190
190
|
should "extract the value of the SessionNotOnOrAfter attribute" do
|
191
|
-
response =
|
191
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
192
192
|
assert response.session_expires_at.is_a?(Time)
|
193
193
|
|
194
|
-
response =
|
194
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_2)
|
195
195
|
assert response.session_expires_at.nil?
|
196
196
|
end
|
197
197
|
end
|
198
198
|
|
199
199
|
context "#issuer" do
|
200
200
|
should "return the issuer inside the response assertion" do
|
201
|
-
response =
|
202
|
-
assert_equal "https://app.
|
201
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
202
|
+
assert_equal "https://app.FederazioneTrentina.com/saml/metadata/13590", response.issuer
|
203
203
|
end
|
204
204
|
|
205
205
|
should "return the issuer inside the response" do
|
206
|
-
response =
|
206
|
+
response = FederazioneTrentina::Saml::Response.new(response_document_2)
|
207
207
|
assert_equal "wibble", response.issuer
|
208
208
|
end
|
209
209
|
end
|
210
210
|
|
211
211
|
context "#success" do
|
212
212
|
should "find a status code that says success" do
|
213
|
-
response =
|
213
|
+
response = FederazioneTrentina::Saml::Response.new(response_document)
|
214
214
|
response.success?
|
215
215
|
end
|
216
216
|
end
|
data/test/settings_test.rb
CHANGED
@@ -4,7 +4,7 @@ class SettingsTest < Test::Unit::TestCase
|
|
4
4
|
|
5
5
|
context "Settings" do
|
6
6
|
setup do
|
7
|
-
@settings =
|
7
|
+
@settings = FederazioneTrentina::Saml::Settings.new
|
8
8
|
end
|
9
9
|
should "should provide getters and settings" do
|
10
10
|
accessors = [
|
@@ -31,7 +31,7 @@ class SettingsTest < Test::Unit::TestCase
|
|
31
31
|
:idp_cert_fingerprint => "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00",
|
32
32
|
:name_identifier_format => "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
|
33
33
|
}
|
34
|
-
@settings =
|
34
|
+
@settings = FederazioneTrentina::Saml::Settings.new(config)
|
35
35
|
|
36
36
|
config.each do |k,v|
|
37
37
|
assert_equal v, @settings.send(k)
|
data/test/xml_security_test.rb
CHANGED
@@ -15,7 +15,7 @@ class XmlSecurityTest < Test::Unit::TestCase
|
|
15
15
|
end
|
16
16
|
|
17
17
|
should "should run validate with throwing NS related exceptions" do
|
18
|
-
assert_raise(
|
18
|
+
assert_raise(FederazioneTrentina::Saml::ValidationError) do
|
19
19
|
@document.validate_doc(@base64cert, false)
|
20
20
|
end
|
21
21
|
end
|
@@ -27,14 +27,14 @@ class XmlSecurityTest < Test::Unit::TestCase
|
|
27
27
|
end
|
28
28
|
|
29
29
|
should "should raise Fingerprint mismatch" do
|
30
|
-
exception = assert_raise(
|
30
|
+
exception = assert_raise(FederazioneTrentina::Saml::ValidationError) do
|
31
31
|
@document.validate("no:fi:ng:er:pr:in:t", false)
|
32
32
|
end
|
33
33
|
assert_equal("Fingerprint mismatch", exception.message)
|
34
34
|
end
|
35
35
|
|
36
36
|
should "should raise Digest mismatch" do
|
37
|
-
exception = assert_raise(
|
37
|
+
exception = assert_raise(FederazioneTrentina::Saml::ValidationError) do
|
38
38
|
@document.validate_doc(@base64cert, false)
|
39
39
|
end
|
40
40
|
assert_equal("Digest mismatch", exception.message)
|
@@ -46,7 +46,7 @@ class XmlSecurityTest < Test::Unit::TestCase
|
|
46
46
|
"<ds:DigestValue>b9xsAXLsynugg3Wc1CI3kpWku+0=</ds:DigestValue>")
|
47
47
|
document = XMLSecurity::SignedDocument.new(response)
|
48
48
|
base64cert = document.elements["//ds:X509Certificate"].text
|
49
|
-
exception = assert_raise(
|
49
|
+
exception = assert_raise(FederazioneTrentina::Saml::ValidationError) do
|
50
50
|
document.validate_doc(base64cert, false)
|
51
51
|
end
|
52
52
|
assert_equal("Key validation error", exception.message)
|
@@ -96,10 +96,10 @@ class XmlSecurityTest < Test::Unit::TestCase
|
|
96
96
|
|
97
97
|
should_eventually 'support inclusive canonicalization' do
|
98
98
|
|
99
|
-
response =
|
99
|
+
response = FederazioneTrentina::Saml::Response.new(fixture("tdnf_response.xml"))
|
100
100
|
response.stubs(:conditions).returns(nil)
|
101
101
|
assert !response.is_valid?
|
102
|
-
settings =
|
102
|
+
settings = FederazioneTrentina::Saml::Settings.new
|
103
103
|
assert !response.is_valid?
|
104
104
|
response.settings = settings
|
105
105
|
assert !response.is_valid?
|
metadata
CHANGED
@@ -1,13 +1,13 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: ruby-saml-federazione-trentina
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
hash:
|
4
|
+
hash: 27
|
5
5
|
prerelease:
|
6
6
|
segments:
|
7
7
|
- 0
|
8
8
|
- 0
|
9
|
-
-
|
10
|
-
version: 0.0.
|
9
|
+
- 2
|
10
|
+
version: 0.0.2
|
11
11
|
platform: ruby
|
12
12
|
authors:
|
13
13
|
- Fabiano Pavan
|
@@ -15,7 +15,7 @@ autorequire:
|
|
15
15
|
bindir: bin
|
16
16
|
cert_chain: []
|
17
17
|
|
18
|
-
date: 2013-
|
18
|
+
date: 2013-02-11 00:00:00 Z
|
19
19
|
dependencies:
|
20
20
|
- !ruby/object:Gem::Dependency
|
21
21
|
name: canonix
|
@@ -78,24 +78,24 @@ files:
|
|
78
78
|
- LICENSE
|
79
79
|
- README.md
|
80
80
|
- Rakefile
|
81
|
-
- lib/
|
82
|
-
- lib/
|
83
|
-
- lib/
|
84
|
-
- lib/
|
85
|
-
- lib/
|
86
|
-
- lib/
|
87
|
-
- lib/
|
88
|
-
- lib/
|
89
|
-
- lib/
|
90
|
-
- lib/
|
91
|
-
- lib/
|
92
|
-
- lib/ruby-saml.rb
|
81
|
+
- lib/federazione_trentina/ruby-saml/authrequest.rb
|
82
|
+
- lib/federazione_trentina/ruby-saml/coding.rb
|
83
|
+
- lib/federazione_trentina/ruby-saml/logging.rb
|
84
|
+
- lib/federazione_trentina/ruby-saml/logout_request.rb
|
85
|
+
- lib/federazione_trentina/ruby-saml/logout_response.rb
|
86
|
+
- lib/federazione_trentina/ruby-saml/metadata.rb
|
87
|
+
- lib/federazione_trentina/ruby-saml/request.rb
|
88
|
+
- lib/federazione_trentina/ruby-saml/response.rb
|
89
|
+
- lib/federazione_trentina/ruby-saml/settings.rb
|
90
|
+
- lib/federazione_trentina/ruby-saml/validation_error.rb
|
91
|
+
- lib/federazione_trentina/ruby-saml/version.rb
|
92
|
+
- lib/ruby-saml-federazione-trentina.rb
|
93
93
|
- lib/schemas/saml20assertion_schema.xsd
|
94
94
|
- lib/schemas/saml20protocol_schema.xsd
|
95
95
|
- lib/schemas/xenc_schema.xsd
|
96
96
|
- lib/schemas/xmldsig_schema.xsd
|
97
97
|
- lib/xml_security.rb
|
98
|
-
- ruby-saml.gemspec
|
98
|
+
- ruby-saml-federazione-trentina.gemspec
|
99
99
|
- test/certificates/certificate1
|
100
100
|
- test/logoutrequest_test.rb
|
101
101
|
- test/request_test.rb
|
@@ -118,7 +118,7 @@ files:
|
|
118
118
|
- test/settings_test.rb
|
119
119
|
- test/test_helper.rb
|
120
120
|
- test/xml_security_test.rb
|
121
|
-
homepage: https://github.com/fabianopavan/ruby-saml
|
121
|
+
homepage: https://github.com/fabianopavan/ruby-saml-federazione-trentina
|
122
122
|
licenses: []
|
123
123
|
|
124
124
|
post_install_message:
|
data/lib/ruby-saml.rb
DELETED
@@ -1,11 +0,0 @@
|
|
1
|
-
require 'onelogin/ruby-saml/logging'
|
2
|
-
require 'onelogin/ruby-saml/coding'
|
3
|
-
require 'onelogin/ruby-saml/request'
|
4
|
-
require 'onelogin/ruby-saml/authrequest'
|
5
|
-
require 'onelogin/ruby-saml/logout_request'
|
6
|
-
require 'onelogin/ruby-saml/logout_response'
|
7
|
-
require 'onelogin/ruby-saml/response'
|
8
|
-
require 'onelogin/ruby-saml/settings'
|
9
|
-
require 'onelogin/ruby-saml/validation_error'
|
10
|
-
require 'onelogin/ruby-saml/metadata'
|
11
|
-
require 'onelogin/ruby-saml/version'
|