ruby-saml-idp 0.2 → 0.2.5

data/README.md

@@ -14,7 +14,7 @@ Add this to your Gemfile:
 
 ### Not using rails?
 
-Include `SamlIdp::Controller` and see the examples that use rails. It should be straightforward for you. Basically you call `decode_SAMLRequest(params[:SAMLRequest])` and then use the value `saml_acs_url` to determine the source for which you need to authenticate a user. Once a user has successfully authenticated on your system send the Service Provider a SAMLReponse by posting to `saml_acs_url` the parameter `SAMLResponse` with the return value from a call to `create_SAMLResponse(user_email, audience_uri, issuer_uri)`
+Include `SamlIdp::Controller` and see the examples that use rails. It should be straightforward for you. Basically you call `decode_SAMLRequest(params[:SAMLRequest])` and then use the value `saml_acs_url` to determine the source for which you need to authenticate a user. Once a user has successfully authenticated on your system send the Service Provider a SAMLReponse by posting to `saml_acs_url` the parameter `SAMLResponse` with the return value from a call to `encode_SAMLResponse(user_email)`
 
 ### Using rails?
 
@@ -38,7 +38,7 @@ class SamlIdpController < SamlIdp::IdpController
   end
 
   def idp_make_saml_response(user)
-    create_SAMLResponse(user.email, "https://example.com")
+    encode_SAMLResponse(user.email)
   end
 
   private
@@ -56,7 +56,7 @@ end
 Keys and Secrets
 ----------------
 
-To generate the SAML Response it uses a default X.509 certificate and secret key... which isn't so secret. You can find them in `SamlIdp::Default`. The X.509 certificate is valid until year 2032. Obviously you shouldn't use these if you intend to use this in production environments. In that case, within the controller set the properties `x509_certificate` and `secret_key` using a `prepend_before_filter` callback.
+To generate the SAML Response it uses a default X.509 certificate and secret key... which isn't so secret. You can find them in `SamlIdp::Default`. The X.509 certificate is valid until year 2032. Obviously you shouldn't use these if you intend to use this in production environments. In that case, within the controller set the properties `x509_certificate` and `secret_key` using a `prepend_before_filter` callback within the current request context or set them globally via the `SamlIdp.x509_certificate` and `SamlIdp.secret_key` properties.
 
 The fingerprint to use, if you use the default X.509 certificate of this gem, is:
 

data/lib/ruby-saml-idp.rb

@@ -1,4 +1,24 @@
-require 'saml-idp/controller'
-require 'saml-idp/default'
-require 'saml-idp/version'
-require 'saml-idp/rails' if defined?(::Rails) && Rails::VERSION::MAJOR > 2
+module SamlIdp
+  autoload :Controller,   'saml-idp/controller'
+  autoload :Default,      'saml-idp/default'
+  autoload :Engine,       'saml-idp/engine'
+  autoload :Version,      'saml-idp/version'
+
+  def self.x509_certificate
+    @@x509_certificate
+  end
+  def self.x509_certificate=(x509_certificate)
+    @@x509_certificate = x509_certificate
+  end
+  @@x509_certificate = Default::X509_CERTIFICATE
+
+  def self.secret_key
+    @@secret_key
+  end
+  def self.secret_key=(secret_key)
+    @@secret_key = secret_key
+  end
+  @@secret_key = Default::SECRET_KEY
+
+end
+

data/lib/saml-idp/controller.rb

@@ -13,12 +13,12 @@ module SamlIdp
 
     def x509_certificate
       return @x509_certificate if defined?(@x509_certificate)
-      @x509_certificate = SamlIdp::Default::X509_CERTIFICATE
+      @x509_certificate = SamlIdp.x509_certificate
     end
 
     def secret_key
       return @secret_key if defined?(@secret_key)
-      @secret_key = SamlIdp::Default::SECRET_KEY
+      @secret_key = SamlIdp.secret_key
     end
 
     protected
@@ -36,9 +36,11 @@ module SamlIdp
         @saml_acs_url = text[/AssertionConsumerServiceURL='(.+?)'/, 1]
       end
 
-      def create_SAMLResponse(nameID, audience_uri, issuer_uri = "#{request.scheme}://#{request.host_with_port}#{request.fullpath}")
+      def encode_SAMLResponse(nameID, opts = {})
         now = Time.now.utc
         response_id, reference_id = UUID.generate, UUID.generate
+        audience_uri = opts[:audience_uri] || saml_acs_url[/^(.*?\/\/.*?\/)/, 1]
+        issuer_uri = opts[:issuer_uri] || (defined?(request) && request.url) || "http://example.com"
 
         assertion = %[<Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_#{reference_id}" IssueInstant="#{now.iso8601}" Version="2.0"><Issuer>#{issuer_uri}</Issuer><Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">#{nameID}</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData InResponseTo="#{@saml_request_id}" NotOnOrAfter="#{(now+3*60).iso8601}" Recipient="#{@saml_acs_url}"></SubjectConfirmationData></SubjectConfirmation></Subject><Conditions NotBefore="#{(now-5).iso8601}" NotOnOrAfter="#{(now+60*60).iso8601}"><AudienceRestriction><Audience>#{audience_uri}</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"><AttributeValue>#{nameID}</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant="#{now.iso8601}" SessionIndex="_#{reference_id}"><AuthnContext><AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion>]
 

data/lib/saml-idp/engine.rb

@@ -0,0 +1,4 @@
+module SamlIdp
+  class Engine < Rails::Engine
+  end
+end if defined?(::Rails) && Rails::VERSION::MAJOR > 2

data/lib/saml-idp/version.rb

@@ -1,3 +1,3 @@
 module SamlIdp
-  VERSION = '0.2'
+  VERSION = '0.2.5'
 end

data/spec/controller_spec.rb

@@ -25,11 +25,11 @@ describe SamlIdp::Controller do
     auth_url = auth_request.create(saml_config)
     params[:SAMLRequest] = CGI.unescape(auth_url.split("=").last)
     validate_saml_request
-    saml_response = create_SAMLResponse("foo@example.com", "https://idp.com/saml/idp", "https://idp.com")
+    saml_response = encode_SAMLResponse("foo@example.com")
 
     response = Onelogin::Saml::Response.new(saml_response)
     response.name_id.should == "foo@example.com"
-    response.issuer.should == "https://idp.com"
+    response.issuer.should == "http://example.com"
     response.settings = saml_config
     response.is_valid?.should be_true
   end
@@ -39,7 +39,7 @@ describe SamlIdp::Controller do
     def saml_settings(saml_acs_url)
       settings = Onelogin::Saml::Settings.new
       settings.assertion_consumer_service_url = saml_acs_url
-      settings.issuer = "http://example.com"
+      settings.issuer = "http://example.com/issuer"
       settings.idp_sso_target_url = "http://idp.com/saml/idp"
       settings.idp_cert_fingerprint = SamlIdp::Default::FINGERPRINT
       settings.name_identifier_format = SamlIdp::Default::NAME_ID_FORMAT

metadata

@@ -1,12 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ruby-saml-idp
 version: !ruby/object:Gem::Version 
-  hash: 15
+  hash: 29
   prerelease: 
   segments: 
   - 0
   - 2
-  version: "0.2"
+  - 5
+  version: 0.2.5
 platform: ruby
 authors: 
 - Lawrence Pit
@@ -87,7 +88,7 @@ files:
 - lib/ruby-saml-idp.rb
 - lib/saml-idp/controller.rb
 - lib/saml-idp/default.rb
-- lib/saml-idp/rails.rb
+- lib/saml-idp/engine.rb
 - lib/saml-idp/version.rb
 - MIT-LICENSE
 - README.md

data/lib/saml-idp/rails.rb

@@ -1,4 +0,0 @@
-module SamlIdp
-  class Engine < Rails::Engine
-  end
-end