ruby-saml-federazione-trentina 0.0.1

data/.document

@@ -0,0 +1,5 @@
+README.rdoc
+lib/**/*.rb
+bin/*
+features/**/*.feature
+LICENSE

data/.gitignore

@@ -0,0 +1,10 @@
+*.sw?
+.DS_Store
+coverage
+rdoc
+pkg
+Gemfile.lock
+.idea/*
+lib/Lib.iml
+test/Test.iml
+.rvmrc

data/.travis.yml

@@ -0,0 +1,5 @@
+language: ruby
+rvm:
+  - 1.8.7
+  - 1.9.3
+  - ree

data/Gemfile

@@ -0,0 +1,12 @@
+source 'http://rubygems.org'
+
+gemspec
+
+group :test do
+  gem "ruby-debug", "~> 0.10.4", :require => nil, :platforms => :ruby_18
+  gem "debugger",   "~> 1.1.1",  :require => nil, :platforms => :ruby_19
+  gem "shoulda"
+  gem "rake"
+  gem "mocha"
+  gem "nokogiri"
+end

data/LICENSE

@@ -0,0 +1,19 @@
+Copyright (c) 2010 OneLogin, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,126 @@
+# Ruby SAML [![Build Status](https://secure.travis-ci.org/onelogin/ruby-saml.png)](http://travis-ci.org/onelogin/ruby-saml)
+
+The Ruby SAML library is for implementing the client side of a SAML authorization, i.e. it provides a means for managing authorization initialization and confirmation requests from identity providers.
+
+SAML authorization is a two step process and you are expected to implement support for both.
+
+## The initialization phase
+
+This is the first request you will get from the identity provider. It will hit your application at a specific URL (that you've announced as being your SAML initialization point). The response to this initialization, is a redirect back to the identity provider, which can look something like this (ignore the saml_settings method call for now):
+
+```ruby
+    def init
+      request = Onelogin::Saml::Authrequest.new
+      redirect_to(request.create(saml_settings))
+    end
+```
+
+Once you've redirected back to the identity provider, it will ensure that the user has been authorized and redirect back to your application for final consumption, this is can look something like this (the authorize_success and authorize_failure methods are specific to your application):
+
+```ruby
+    def consume
+      response          = Onelogin::Saml::Response.new(params[:SAMLResponse])
+      response.settings = saml_settings
+
+      if response.is_valid? && user = current_account.users.find_by_email(response.name_id)
+        authorize_success(user)
+      else
+        authorize_failure(user)
+      end
+    end
+```
+
+In the above there are a few assumptions in place, one being that the response.name_id is an email address. This is all handled with how you specify the settings that are in play via the saml_settings method. That could be implemented along the lines of this:
+
+```ruby
+  def saml_settings
+    settings = Onelogin::Saml::Settings.new
+
+    settings.assertion_consumer_service_url = "http://#{request.host}/saml/finalize"
+    settings.issuer                         = request.host
+    settings.idp_sso_target_url             = "https://app.onelogin.com/saml/signon/#{OneLoginAppId}"
+    settings.idp_cert_fingerprint           = OneLoginAppCertFingerPrint
+    settings.name_identifier_format         = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+    # Optional for most SAML IdPs
+    settings.authn_context = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+
+    settings
+  end
+```
+
+What's left at this point, is to wrap it all up in a controller and point the initialization and consumption URLs in OneLogin at that. A full controller example could look like this:
+
+```ruby
+  # This controller expects you to use the URLs /saml/init and /saml/consume in your OneLogin application.
+  class SamlController < ApplicationController
+    def init
+      request = Onelogin::Saml::Authrequest.new
+      redirect_to(request.create(saml_settings))
+    end
+
+    def consume
+      response          = Onelogin::Saml::Response.new(params[:SAMLResponse])
+      response.settings = saml_settings
+
+      if response.is_valid? && user = current_account.users.find_by_email(response.name_id)
+        authorize_success(user)
+      else
+        authorize_failure(user)
+      end
+    end
+
+    private
+
+    def saml_settings
+      settings = Onelogin::Saml::Settings.new
+
+      settings.assertion_consumer_service_url = "http://#{request.host}/saml/consume"
+      settings.issuer                         = request.host
+      settings.idp_sso_target_url             = "https://app.onelogin.com/saml/signon/#{OneLoginAppId}"
+      settings.idp_cert_fingerprint           = OneLoginAppCertFingerPrint
+      settings.name_identifier_format         = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+      # Optional for most SAML IdPs
+      settings.authn_context = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+
+      settings
+    end
+  end
+```
+
+If are using saml:AttributeStatement to transfare metadata, like the user name, you can access all the attributes through response.attributes. It
+contains all the saml:AttributeStatement with its 'Name' as a indifferent key and the one saml:AttributeValue as value.
+
+  response          = Onelogin::Saml::Response.new(params[:SAMLResponse])
+  response.settings = saml_settings
+
+  response.attributes[:username]
+
+## Service Provider Metadata
+
+To form a trusted pair relationship with the IdP, the SP (you) need to provide metadata XML
+to the IdP for various good reasons.  (Caching, certificate lookups, relying party permissions, etc)
+
+The class Onelogin::Saml::Metdata takes care of this by reading the Settings and returning XML.  All
+you have to do is add a controller to return the data, then give this URL to the IdP administrator.
+The metdata will be polled by the IdP every few minutes, so updating your settings should propagate
+to the IdP settings.
+
+```ruby
+  class SamlController < ApplicationController
+    # ... the rest of your controller definitions ...
+    def metadata
+      settings = Account.get_saml_settings
+      meta = Onelogin::Saml::Metadata.new
+      render :xml => meta.generate(settings)
+    end
+  end
+```
+
+## Note on Patches/Pull Requests
+
+* Fork the project.
+* Make your feature addition or bug fix.
+* Add tests for it. This is important so I don't break it in a
+  future version unintentionally.
+* Commit, do not mess with rakefile, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
+* Send me a pull request. Bonus points for topic branches.

data/Rakefile

@@ -0,0 +1,41 @@
+require 'rubygems'
+require 'rake'
+
+#not being used yet.
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/*_test.rb'
+  test.verbose = true
+end
+
+begin
+  require 'rcov/rcovtask'
+  Rcov::RcovTask.new do |test|
+    test.libs << 'test'
+    test.pattern = 'test/**/*_test.rb'
+    test.verbose = true
+  end
+rescue LoadError
+  task :rcov do
+    abort "RCov is not available. In order to run rcov, you must: sudo gem install spicycode-rcov"
+  end
+end
+
+task :test
+
+task :default => :test
+
+# require 'rake/rdoctask'
+# Rake::RDocTask.new do |rdoc|
+#   if File.exist?('VERSION')
+#     version = File.read('VERSION')
+#   else
+#     version = ""
+#   end
+
+#   rdoc.rdoc_dir = 'rdoc'
+#   rdoc.title = "ruby-saml #{version}"
+#   rdoc.rdoc_files.include('README*')
+#   rdoc.rdoc_files.include('lib/**/*.rb')
+#end

data/lib/onelogin/ruby-saml/authrequest.rb

@@ -0,0 +1,189 @@
+require "base64"
+require "uuid"
+require "zlib"
+require "cgi"
+require "rexml/document"
+require "rexml/xpath"
+require "rubygems"
+require "addressable/uri"
+
+module Onelogin::Saml
+  include REXML
+  class Authrequest
+    # a few symbols for SAML class names
+    HTTP_POST = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+    HTTP_GET = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+    
+    attr_accessor :uuid, :request
+
+    def initialize( settings )
+      @settings = settings
+      @request_params = Hash.new
+    end
+    
+    def create(params = {})
+      uuid = "_" + UUID.new.generate
+      self.uuid = uuid
+      time = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
+      # Create AuthnRequest root element using REXML 
+      request_doc = REXML::Document.new
+      request_doc.context[:attribute_quote] = :quote
+      root = request_doc.add_element "saml2p:AuthnRequest", { "xmlns:saml2p" => "urn:oasis:names:tc:SAML:2.0:protocol" }
+      root.attributes['ID'] = uuid
+      root.attributes['IssueInstant'] = time
+      root.attributes['Version'] = "2.0"
+      root.attributes['ProtocolBinding'] = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+      root.attributes['AttributeConsumingServiceIndex'] = "2"
+      root.attributes['ForceAuthn'] = "false"
+      root.attributes['IsPassive'] = "false"
+
+      # Conditionally defined elements based on settings
+      if @settings.assertion_consumer_service_url != nil
+        root.attributes["AssertionConsumerServiceURL"] = @settings.assertion_consumer_service_url
+      end
+
+       if @settings.destination_service_url != nil
+        root.attributes["Destination"] = @settings.destination_service_url
+      end
+
+      if @settings.issuer != nil
+        issuer = root.add_element "saml2:Issuer", { "xmlns:saml2" => "urn:oasis:names:tc:SAML:2.0:assertion" }
+        issuer.text = @settings.issuer
+      end
+      if @settings.name_identifier_format != nil
+        root.add_element "saml2p:NameIDPolicy", { 
+            # Might want to make AllowCreate a setting?
+            "AllowCreate"     => "false",
+            "Format"          => @settings.name_identifier_format[1],
+            "SPNameQualifier" => @settings.sp_name_qualifier
+        }
+      end
+
+      # BUG fix here -- if an authn_context is defined, add the tags with an "exact"
+      # match required for authentication to succeed.  If this is not defined, 
+      # the IdP will choose default rules for authentication.  (Shibboleth IdP)
+      if @settings.authn_context != nil
+        requested_context = root.add_element "saml2p:RequestedAuthnContext", { 
+          "Comparison" => "exact"
+        }
+        context_class = []
+        @settings.authn_context.each_with_index{ |context, index|
+          context_class[index] = requested_context.add_element "saml2:AuthnContextClassRef", {
+            "xmlns:saml2" => "urn:oasis:names:tc:SAML:2.0:assertion"
+          }
+          context_class[index].text = context
+        }
+        
+      end
+
+      if @settings.requester_identificator != nil
+        requester_identificator = root.add_element "saml2p:Scoping", { 
+          "ProxyCount" => "1"
+        }
+        identificators = []
+        @settings.requester_identificator.each_with_index{ |requester, index|
+          identificators[index] = requester_identificator.add_element "saml2p:RequesterID"
+          identificators[index].text = requester
+        }
+        
+      end
+
+      request_doc << REXML::XMLDecl.new(version='1.0', encoding='UTF-8')
+      ret = ""
+      # pretty print the XML so IdP administrators can easily see what the SP supports
+      request_doc.write(ret, 1)
+
+      @request = ""
+      request_doc.write(@request)
+
+      #Logging.debug "Created AuthnRequest: #{@request}"
+
+      #params.each_pair do |key, value|
+      #  #request_params << "&#{key}=#{CGI.escape(value.to_s)}"
+      # @request_params[key] = value
+      #end
+
+      #settings.idp_sso_target_url + request_params
+
+      return self
+
+    end
+  
+    # get the IdP metadata, and select the appropriate SSO binding
+    # that we can support.  Currently this is HTTP-Redirect and HTTP-POST
+    # but more could be added in the future
+    def binding_select
+      # first check if we're still using the old hard coded method for 
+      # backwards compatability
+      if @settings.idp_metadata == nil && @settings.idp_sso_target_url != nil
+        @URL = @settings.idp_sso_target_url
+        return "GET", content_get
+      end
+      # grab the metadata
+      metadata = Metadata::new
+      meta_doc = metadata.get_idp_metadata(@settings)
+      
+      # first try POST
+      sso_element = REXML::XPath.first(meta_doc,
+        "/EntityDescriptor/IDPSSODescriptor/SingleSignOnService[@Binding='#{HTTP_POST}']")
+      if sso_element 
+        @URL = sso_element.attributes["Location"]
+        #Logging.debug "binding_select: POST to #{@URL}"
+        return "POST", content_post
+      end
+      
+      # next try GET
+      sso_element = REXML::XPath.first(meta_doc,
+        "/EntityDescriptor/IDPSSODescriptor/SingleSignOnService[@Binding='#{HTTP_GET}']")
+      if sso_element 
+        @URL = sso_element.attributes["Location"]
+        Logging.debug "binding_select: GET from #{@URL}"
+        return "GET", content_get
+      end
+      # other types we might want to add in the future:  SOAP, Artifact
+    end
+    
+    # construct the the parameter list on the URL and return
+    def content_get
+      # compress GET requests to try and stay under that 8KB request limit
+      deflated_request  = Zlib::Deflate.deflate(@request, 9)[2..-5]
+      # strict_encode64() isn't available?  sub out the newlines
+      @request_params["SAMLRequest"] = Base64.encode64(deflated_request).gsub(/\n/, "")
+      
+      Logging.debug "SAMLRequest=#{@request_params["SAMLRequest"]}"
+      uri = Addressable::URI.parse(@URL)
+      if uri.query_values == nil
+        uri.query_values = @request_params
+      else
+        # solution to stevenwilkin's parameter merge
+        uri.query_values = @request_params.merge(uri.query_values)
+      end
+      url = uri.to_s
+      #url = @URL + "?SAMLRequest=" + @request_params["SAMLRequest"]
+      #Logging.debug "Sending to URL #{url}"
+      return url
+    end
+    # construct an HTML form (POST) and return the content
+    def content_post
+      # POST requests seem to bomb out when they're deflated
+      # and they probably don't need to be compressed anyway
+      @request_params["SAMLRequest"] = Base64.encode64(@request).gsub(/\n/, "")
+      
+      #Logging.debug "SAMLRequest=#{@request_params["SAMLRequest"]}"
+      # kind of a cheesy method of building an HTML, form since we can't rely on Rails too much,
+      # and REXML doesn't work well with quote characters
+      str = "<html><body onLoad=\"document.getElementById('form').submit();\">\n"
+      str += "<form id='form' name='form' method='POST' action=\"#{@URL}\">\n"
+      # we could change this in the future to associate a temp auth session ID
+      str += "<input name='RelayState' value='ruby-saml' type='hidden' />\n"
+      @request_params.each_pair do |key, value|
+        str += "<input name=\"#{key}\" value=\"#{value}\" type='hidden' />\n"
+        #str += "<input name=\"#{key}\" value=\"#{CGI.escape(value)}\" type='hidden' />\n"
+      end
+      str += "</form></body></html>\n"
+      
+      #Logging.debug "Created form:\n#{str}"
+      return str
+    end
+  end
+end

data/lib/onelogin/ruby-saml/coding.rb

@@ -0,0 +1,34 @@
+require "cgi"
+require 'zlib'
+
+module Onelogin
+  module Saml
+    module Coding
+      def decode(encoded)
+        Base64.decode64(encoded)
+      end
+
+      def encode(encoded)
+        Base64.encode64(encoded).gsub(/\n/, "")
+      end
+
+      def escape(unescaped)
+        CGI.escape(unescaped)
+      end
+
+      def unescape(escaped)
+        CGI.unescape(escaped)
+      end
+
+      def inflate(deflated)
+        zlib = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+        zlib.inflate(deflated)
+      end
+
+      def deflate(inflated)
+        Zlib::Deflate.deflate(inflated, 9)[2..-5]
+      end
+
+    end
+  end
+end