ruby-saml-mod 0.1.13 → 0.1.14

data/lib/onelogin/saml/response.rb

@@ -47,18 +47,35 @@ module Onelogin::Saml
         return false
       end
       
-      if @document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES).nil?
-        @validation_error = "No ds:X509Certificate element"
-        return false
-      end
-      
       if !@settings.idp_cert_fingerprint
         @validation_error = "No fingerprint configured in SAML settings"
         return false
       end
       
-      if !@document.validate(@settings.idp_cert_fingerprint, @logger)
-        @validation_error = @document.validation_error
+      # Verify the original document if it has a signature, otherwise verify the signature
+      # in the encrypted portion. If there is no signature, then we can't verify.
+      verified = false
+      if @document.find_first("//ds:Signature", Onelogin::NAMESPACES)
+        verified = @document.validate(@settings.idp_cert_fingerprint, @logger)
+        if !verified
+          @validation_error = @document.validation_error
+          return false
+        end
+      end
+      
+      # Technically we should also verify the signature inside the encrypted portion, but if
+      # the cryptext has already been verified, the encrypted contents couldn't have been
+      # tampered with. Once we switch to using libxmlsec this won't matter anymore anyway.
+      if !verified && @decrypted_document.find_first("//ds:Signature", Onelogin::NAMESPACES)
+        verified = @decrypted_document.validate(@settings.idp_cert_fingerprint, @logger)
+        if !verified
+          @validation_error = @document.validation_error
+          return false
+        end
+      end
+      
+      if !verified
+        @validation_error = "No signature found in the response"
         return false
       end
       

data/lib/xml_sec.rb

@@ -70,16 +70,16 @@ module XMLSecurity
 
     def validate_doc(base64_cert, logger)
       # validate references
-      sig_element = find_first("//ds:Signature", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
+      sig_element = find_first("//ds:Signature", Onelogin::NAMESPACES)
 
       c14n_method = nil
-      c14n_method_element = sig_element.find_first(".//ds:CanonicalizationMethod", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
+      c14n_method_element = sig_element.find_first(".//ds:CanonicalizationMethod", Onelogin::NAMESPACES)
       if c14n_method_element
         c14n_method = c14n_method_element["Algorithm"]
       end
 
       # check digests
-      sig_element.find(".//ds:Reference", { "ds" => "http://www.w3.org/2000/09/xmldsig#" }).each do |ref|
+      sig_element.find(".//ds:Reference", Onelogin::NAMESPACES).each do |ref|
         # Find the referenced element
         uri = ref["URI"]
         ref_element = find_first("//*[@ID='#{uri[1,uri.size]}']")
@@ -89,13 +89,13 @@ module XMLSecurity
         ref_document.root = ref_document.import(ref_element)
 
         # Remove the Signature node
-        ref_document_sig_element = ref_document.find_first(".//ds:Signature", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
+        ref_document_sig_element = ref_document.find_first(".//ds:Signature", Onelogin::NAMESPACES)
         ref_document_sig_element.remove! if ref_document_sig_element
 
         # Canonicalize the referenced element's document
         ref_document_canonicalized = canonicalize_doc(ref_document, c14n_method)
         hash = Base64::encode64(Digest::SHA1.digest(ref_document_canonicalized)).chomp
-        digest_value = sig_element.find_first(".//ds:DigestValue", { "ds" => "http://www.w3.org/2000/09/xmldsig#" }).content
+        digest_value = sig_element.find_first(".//ds:DigestValue", Onelogin::NAMESPACES).content
 
         if hash != digest_value
           @validation_error = <<-EOF.gsub(/^\s+/, '')
@@ -114,10 +114,10 @@ module XMLSecurity
       end
  
       # verify signature
-      signed_info_element = sig_element.find_first(".//ds:SignedInfo", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
+      signed_info_element = sig_element.find_first(".//ds:SignedInfo", Onelogin::NAMESPACES)
       canon_string = canonicalize_node(signed_info_element, c14n_method)
 
-      base64_signature = sig_element.find_first(".//ds:SignatureValue", { "ds" => "http://www.w3.org/2000/09/xmldsig#" }).content
+      base64_signature = sig_element.find_first(".//ds:SignatureValue", Onelogin::NAMESPACES).content
       signature = Base64.decode64(base64_signature)
 
       cert_text = Base64.decode64(base64_cert)

data/ruby-saml-mod.gemspec

@@ -1,9 +1,9 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.13"
+  s.version = "0.1.14"
 
   s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody"]
-  s.date = %q{2012-05-13}
+  s.date = %q{2012-05-14}
   s.extra_rdoc_files = [
     "LICENSE"
   ]

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version 
-  hash: 1
+  hash: 7
   prerelease: 
   segments: 
   - 0
   - 1
-  - 13
-  version: 0.1.13
+  - 14
+  version: 0.1.14
 platform: ruby
 authors: 
 - OneLogin LLC
@@ -18,7 +18,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-05-13 00:00:00 Z
+date: 2012-05-14 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: libxml-ruby