ruby-saml-mod 0.1.19 → 0.1.20

data/lib/onelogin/saml.rb

@@ -2,6 +2,7 @@ require 'zlib'
 require "base64"
 require "xml/libxml"
 require "xml_sec"
+require "cgi"
 
 module Onelogin
   NAMESPACES = {

data/lib/onelogin/saml/log_out_request.rb

@@ -16,19 +16,41 @@ module Onelogin::Saml
       @id = Onelogin::Saml::AuthRequest.generate_unique_id(42)
       issue_instant = Onelogin::Saml::AuthRequest.get_timestamp
       
-      @request_xml = "<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"#{@id}\" Version=\"2.0\" IssueInstant=\"#{issue_instant}\"> " +
+      @request_xml = "<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"#{@id}\" Version=\"2.0\" IssueInstant=\"#{issue_instant}\" Destination=\"#{@settings.idp_slo_target_url}\">" +
           "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{@settings.issuer}</saml:Issuer>" +
           "<saml:NameID xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" NameQualifier=\"#{@session[:name_qualifier]}\" SPNameQualifier=\"#{@settings.issuer}\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\">#{@session[:name_id]}</saml:NameID>" + 
           "<samlp:SessionIndex xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">#{@session[:session_index]}</samlp:SessionIndex>" +
           "</samlp:LogoutRequest>"
 
-      deflated_logout_request = Zlib::Deflate.deflate(@request_xml, 9)[2..-5]     
-      base64_logout_request = Base64.encode64(deflated_logout_request)  
-      encoded_logout_request = CGI.escape(base64_logout_request)  
+      if settings.sign?
+        @request_xml = XMLSecurity.sign(@request_xml, @settings.xmlsec_privatekey)
+      end
 
-      @forward_url = @settings.idp_slo_target_url + (@settings.idp_slo_target_url.include?("?") ? "&" : "?") + "SAMLRequest=" + encoded_logout_request 
+      deflated_logout_request = Zlib::Deflate.deflate(@request_xml, 9)[2..-5]
+      base64_logout_request = Base64.encode64(deflated_logout_request)
+
+      url, existing_query_string = @settings.idp_slo_target_url.split('?')
+      query_string = _query_string_append(existing_query_string, 'SAMLRequest', base64_logout_request)
+
+      if settings.sign?
+        query_string = _query_string_append(query_string, "SigAlg", "http://www.w3.org/2000/09/xmldsig#rsa-sha1")
+        signature =  _generate_signature(query_string, @settings.xmlsec_privatekey)
+        query_string = _query_string_append(query_string, "Signature", signature)
+      end
+
+      @forward_url = [url, query_string].join("?")
   
       @forward_url
     end
+
+    def _generate_signature(string, private_key)
+      pkey = OpenSSL::PKey::RSA.new(File.read(private_key))
+      sign = pkey.sign(OpenSSL::Digest::SHA1.new, string)
+      Base64.encode64(sign).gsub(/\s/, '')
+    end
+
+    def _query_string_append(query_string, key, value)
+      [query_string, "#{CGI.escape(key)}=#{CGI.escape(value)}"].compact.join('&')
+    end
   end
 end

data/lib/onelogin/saml/meta_data.rb

@@ -21,6 +21,20 @@ module Onelogin::Saml
             </KeyDescriptor>
         }
       end
+      if settings.sign?
+        xml += %{
+            <KeyDescriptor use="signing">
+              <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+                <X509Data>
+                  <X509Certificate>
+                    #{File.read(settings.xmlsec_certificate).gsub(/\w*-+(BEGIN|END) CERTIFICATE-+\w*/, "").strip}
+                  </X509Certificate>
+                </X509Data>
+              </KeyInfo>
+            </KeyDescriptor>
+        }
+      end
+
       xml += %{
             <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="#{settings.sp_slo_url}"/>
       }

data/lib/onelogin/saml/settings.rb

@@ -56,5 +56,9 @@ module Onelogin::Saml
     def encryption_configured?
       !!self.xmlsec_privatekey
     end
+
+    def sign?
+      !!self.xmlsec_privatekey
+    end
   end
 end

data/lib/xml_sec.rb

@@ -192,17 +192,58 @@ module XMLSecurity
   attach_function :xmlSecEncCtxDecrypt, [ :pointer, :pointer ], :int
   attach_function :xmlSecEncCtxDestroy, [ :pointer ], :void
 
+  attach_function :xmlSecErrorsDefaultCallbackEnableOutput, [ :bool ], :void
+
+  attach_function :xmlSecTransformExclC14NGetKlass, [], :pointer
+  attach_function :xmlSecOpenSSLTransformRsaSha1GetKlass, [], :pointer
+  attach_function :xmlSecOpenSSLTransformSha1GetKlass, [], :pointer
+
+  attach_function :xmlSecTmplSignatureCreate, [ :pointer, :pointer, :pointer, :string ], :pointer
+  attach_function :xmlSecTmplSignatureAddReference, [ :pointer, :pointer, :pointer, :pointer, :pointer ], :pointer
+  attach_function :xmlSecTransformEnvelopedGetKlass, [], :pointer
+  attach_function :xmlSecTmplSignatureEnsureKeyInfo, [ :pointer, :pointer ], :pointer
+  attach_function :xmlSecTmplReferenceAddTransform, [ :pointer, :pointer ], :pointer
+
+  attach_function :xmlSecKeySetName, [ :pointer, :string ], :int
+
+  attach_function :xmlSecTmplKeyInfoAddKeyName, [ :pointer, :pointer ], :pointer
+
+  attach_function :xmlSecDSigCtxSign, [ :pointer, :pointer ], :int
+
+
+
+
   # libxml functions
   attach_function :xmlInitParser, [], :void
   attach_function :xmlDocGetRootElement, [ :pointer ], :pointer
   attach_function :xmlDocDumpFormatMemory, [ :pointer, :pointer, :pointer, :int ], :void
   attach_function :xmlFreeDoc, [ :pointer ], :void
+  attach_function :xmlParseMemory, [ :pointer, :int ], :pointer
+  attach_function :xmlAddChild, [ :pointer, :pointer ], :pointer
+
+  attach_variable :__xmlFree, :xmlFree, callback([ :pointer ], :void)
+  attach_variable :__xmlMalloc, :xmlMalloc, callback([ :size_t ], :pointer)
+
+  def self.xmlMalloc(size)
+    __xmlMalloc.call(size)
+  end
+
+  def self.xmlFree(ptr)
+    __xmlFree.call(ptr)
+  end
 
   self.xmlInitParser
   raise "Failed initializing XMLSec" if self.xmlSecInit < 0
   raise "Failed initializing app crypto" if self.xmlSecOpenSSLAppInit(nil) < 0
   raise "Failed initializing crypto" if self.xmlSecOpenSSLInit < 0
 
+
+  def self.mute(&block)
+    xmlSecErrorsDefaultCallbackEnableOutput(false)
+    block.call
+    xmlSecErrorsDefaultCallbackEnableOutput(true)
+  end
+
   module SignedDocument
     attr_reader :validation_error
 
@@ -350,4 +391,59 @@ module XMLSecurity
       result
     end
   end
+
+  class SignatureFailure < RuntimeError; end
+
+  def self.sign(xml_string, private_key)
+    doc = self.xmlParseMemory(xml_string, xml_string.size)
+    raise SignatureFailure.new("could not parse XML document") if doc.null?
+
+    canonicalization_method_id = self.xmlSecTransformExclC14NGetKlass
+    sign_method_id = self.xmlSecOpenSSLTransformRsaSha1GetKlass
+
+    sign_node = self.xmlSecTmplSignatureCreate(doc, canonicalization_method_id, sign_method_id, nil)
+
+    raise SignatureFailure.new("failed to create signature template") if sign_node.null?
+    self.xmlAddChild(self.xmlDocGetRootElement(doc), sign_node)
+
+    ref_node = self.xmlSecTmplSignatureAddReference(sign_node, self.xmlSecOpenSSLTransformSha1GetKlass, nil, nil, nil)
+    raise SignatureFailure.new("failed to add a reference") if ref_node.null?
+
+    envelope_result = self.xmlSecTmplReferenceAddTransform(ref_node, self.xmlSecTransformEnvelopedGetKlass)
+    raise SignatureFailure.new("failed to add envelope transform to reference") if envelope_result.null?
+
+    key_info_node = self.xmlSecTmplSignatureEnsureKeyInfo(sign_node, nil)
+    raise SignatureFailure.new("failed to add key info") if key_info_node.null?
+
+    digital_signature_context = self.xmlSecDSigCtxCreate(nil)
+    raise SignatureFailure.new("failed to create signature context") if digital_signature_context.null?
+
+    digital_signature_context[:signKey] = self.xmlSecOpenSSLAppKeyLoad(private_key, :xmlSecKeyDataFormatPem, nil, nil, nil)
+    raise SignatureFailure.new("failed to load private pem ley from #{private_key}") if digital_signature_context[:signKey].null?
+
+    if self.xmlSecKeySetName(digital_signature_context[:signKey], File.basename(private_key)) < 0
+      raise SignatureFailure.new("failed to set key name for key of #{private_key}")
+    end
+
+    if self.xmlSecTmplKeyInfoAddKeyName(key_info_node, nil).null?
+      raise SignatureFailure.new("failed to add key info")
+    end
+
+    if self.xmlSecDSigCtxSign(digital_signature_context, sign_node) < 0
+      raise SignatureFailure.new("signature failed!")
+    end
+
+    ptr = FFI::MemoryPointer.new(:pointer, 1)
+    sizeptr = FFI::MemoryPointer.new(:pointer, 1)
+    self.xmlDocDumpFormatMemory(doc, ptr, sizeptr, 1)
+    strptr = ptr.read_pointer
+    result = strptr.null? ? nil : strptr.read_string
+  ensure
+    ptr.free if defined?(ptr) && ptr
+    sizeptr.free if defined?(sizeptr) && sizeptr
+    self.xmlFreeDoc(doc) if defined?(doc) && doc && !doc.null?
+    self.xmlSecDSigCtxDestroy(digital_signature_context) if defined?(digital_signature_context) && digital_signature_context && !digital_signature_context.null?
+    self.xmlFree(strptr) if defined?(strptr) && strptr && !strptr.null?
+  end
+
 end

data/ruby-saml-mod.gemspec

@@ -1,9 +1,9 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.19"
+  s.version = "0.1.20"
 
-  s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody", "Jeremy"]
-  s.date = %q{2012-09-26}
+  s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody", "Jeremy", "Paul"]
+  s.date = %q{2013-02-15}
   s.extra_rdoc_files = [
     "LICENSE"
   ]
@@ -26,9 +26,6 @@ Gem::Specification.new do |s|
   s.add_dependency('libxml-ruby', '>= 2.3.0')
   s.add_dependency('ffi')
 
-  s.add_development_dependency 'ruby-debug'
-  s.add_development_dependency 'rspec', '1.3.2'
-
   s.homepage = %q{http://github.com/bracken/ruby-saml}
   s.require_paths = ["lib"]
   s.summary = %q{Ruby library for SAML service providers}

metadata

@@ -1,95 +1,61 @@
---- !ruby/object:Gem::Specification 
+--- !ruby/object:Gem::Specification
 name: ruby-saml-mod
-version: !ruby/object:Gem::Version 
-  hash: 61
+version: !ruby/object:Gem::Version
+  version: 0.1.20
   prerelease: 
-  segments: 
-  - 0
-  - 1
-  - 19
-  version: 0.1.19
 platform: ruby
-authors: 
+authors:
 - OneLogin LLC
 - Bracken
 - Zach
 - Cody
 - Jeremy
+- Paul
 autorequire: 
 bindir: bin
 cert_chain: []
-
-date: 2012-09-26 00:00:00 Z
-dependencies: 
-- !ruby/object:Gem::Dependency 
+date: 2013-02-15 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
   name: libxml-ruby
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 2
-        - 3
-        - 0
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
         version: 2.3.0
   type: :runtime
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: ffi
   prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
+  version_requirements: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  type: :runtime
-  version_requirements: *id002
-- !ruby/object:Gem::Dependency 
-  name: ruby-debug
-  prerelease: false
-  requirement: &id003 !ruby/object:Gem::Requirement 
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: 2.3.0
+- !ruby/object:Gem::Dependency
+  name: ffi
+  requirement: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  type: :development
-  version_requirements: *id003
-- !ruby/object:Gem::Dependency 
-  name: rspec
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
+  version_requirements: !ruby/object:Gem::Requirement
     none: false
-    requirements: 
-    - - "="
-      - !ruby/object:Gem::Version 
-        hash: 31
-        segments: 
-        - 1
-        - 3
-        - 2
-        version: 1.3.2
-  type: :development
-  version_requirements: *id004
-description: "This is an early fork from https://github.com/onelogin/ruby-saml - I plan to \"rebase\" these changes ontop of their current version eventually. "
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: ! 'This is an early fork from https://github.com/onelogin/ruby-saml -
+  I plan to "rebase" these changes ontop of their current version eventually. '
 email: 
 executables: []
-
 extensions: []
-
-extra_rdoc_files: 
+extra_rdoc_files:
 - LICENSE
-files: 
+files:
 - LICENSE
 - README
 - lib/onelogin/saml.rb
@@ -106,37 +72,27 @@ files:
 - ruby-saml-mod.gemspec
 homepage: http://github.com/bracken/ruby-saml
 licenses: []
-
 post_install_message: 
 rdoc_options: []
-
-require_paths: 
+require_paths:
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement 
+required_ruby_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
-required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
-  requirements: 
-  - - ">="
-    - !ruby/object:Gem::Version 
-      hash: 3
-      segments: 
-      - 0
-      version: "0"
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
 requirements: []
-
 rubyforge_project: 
-rubygems_version: 1.8.15
+rubygems_version: 1.8.24
 signing_key: 
 specification_version: 3
 summary: Ruby library for SAML service providers
 test_files: []
-
 has_rdoc: