ruby-saml-mod 0.1.22 → 0.1.23

data/lib/onelogin/saml/response.rb

@@ -2,7 +2,7 @@ module Onelogin::Saml
   class Response
 
     attr_accessor :settings
-    attr_reader :document, :decrypted_document, :xml, :response
+    attr_reader :document, :xml, :response
     attr_reader :name_id, :name_qualifier, :session_index, :saml_attributes
     attr_reader :status_code, :status_message
     attr_reader :in_response_to, :destination, :issuer
@@ -14,14 +14,14 @@ module Onelogin::Saml
         @xml = Base64.decode64(@response)
         @document = LibXML::XML::Document.string(@xml)
         @document.extend(XMLSecurity::SignedDocument)
-      rescue => e
+      rescue
         # could not parse document, everything is invalid
         @response = nil
         return
       end
 
-      @issuer = @document.find_first("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content rescue nil
-      @status_code = @document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil
+      @issuer = document.find_first("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content rescue nil
+      @status_code = document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil
 
       process(settings) if settings
     end
@@ -30,79 +30,119 @@ module Onelogin::Saml
       @settings = settings
       return unless @response
 
-      @decrypted_document = LibXML::XML::Document.document(@document)
-      @decrypted_document.extend(XMLSecurity::SignedDocument)
-      @decrypted_document.decrypt!(@settings)
+      @in_response_to = untrusted_find_first("/samlp:Response")['InResponseTo'] rescue nil
+      @destination    = untrusted_find_first("/samlp:Response")['Destination'] rescue nil
+      @status_message = untrusted_find_first("/samlp:Response/samlp:Status/samlp:StatusCode").content rescue nil
+
+      @name_id        = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID").content rescue nil
+      @name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["NameQualifier"] rescue nil
+      @session_index  = trusted_find_first("saml:Assertion/saml:AuthnStatement")["SessionIndex"] rescue nil
 
-      @in_response_to = @decrypted_document.find_first("/samlp:Response", Onelogin::NAMESPACES)['InResponseTo'] rescue nil
-      @destination = @decrypted_document.find_first("/samlp:Response", Onelogin::NAMESPACES)['Destination'] rescue nil
-      @name_id = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).content rescue nil
       @saml_attributes = {}
-      @decrypted_document.find("//saml:Attribute", Onelogin::NAMESPACES).each do |attr|
+      trusted_find("saml:Attribute").each do |attr|
         attrname = attr['FriendlyName'] || Onelogin::ATTRIBUTES[attr['Name']] || attr['Name']
         @saml_attributes[attrname] = attr.content.strip rescue nil
       end
-      @name_qualifier = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES)["NameQualifier"] rescue nil
-      @session_index = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:AuthnStatement", Onelogin::NAMESPACES)["SessionIndex"] rescue nil
-      @status_message = @decrypted_document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).content rescue nil
+    end
+
+    def disable_signature_validation!(settings)
+      @settings      = settings
+      @is_valid      = true
+      @trusted_roots = [decrypted_document.root]
+    end
+
+    def decrypted_document
+      @decrypted_document ||= LibXML::XML::Document.document(document).tap do |doc|
+        doc.extend(XMLSecurity::SignedDocument)
+        doc.decrypt!(settings)
+      end
+    end
+
+    def untrusted_find_first(xpath)
+      decrypted_document.find(xpath, Onelogin::NAMESPACES).first
+    end
+
+    def trusted_find_first(xpath)
+      trusted_find(xpath).first
+    end
+
+    def trusted_find(xpath)
+      trusted_roots.map do |trusted_root|
+        trusted_root.find("descendant-or-self::#{xpath}", Onelogin::NAMESPACES).to_a
+      end.flatten.compact
     end
 
     def logger=(val)
       @logger = val
     end
-    
+
     def is_valid?
-      if @response.nil? || @response == ""
+      @is_valid ||= validate
+    end
+
+    def validate
+      if response.nil? || response == ""
         @validation_error = "No response to validate"
         return false
       end
-      
-      if !@settings.idp_cert_fingerprint
+
+      if !settings.idp_cert_fingerprint
         @validation_error = "No fingerprint configured in SAML settings"
         return false
       end
-      
+
       # Verify the original document if it has a signature, otherwise verify the signature
       # in the encrypted portion. If there is no signature, then we can't verify.
       verified = false
-      if @document.find_first("//ds:Signature", Onelogin::NAMESPACES)
-        verified = @document.validate(@settings.idp_cert_fingerprint, @logger)
+
+      if document.has_signature?
+        verified = document.validate(settings.idp_cert_fingerprint, @logger)
         if !verified
-          @validation_error = @document.validation_error
+          @validation_error = document.validation_error
           return false
         end
       end
 
-      if !verified && @decrypted_document.find_first("//ds:Signature", Onelogin::NAMESPACES)
-        verified = @decrypted_document.validate(@settings.idp_cert_fingerprint, @logger)
+      if !verified && decrypted_document.has_signature?
+        verified = decrypted_document.validate(settings.idp_cert_fingerprint, @logger)
         if !verified
-          @validation_error = @document.validation_error
+          @validation_error = decrypted_document.validation_error
           return false
         end
       end
-      
+
       if !verified
         @validation_error = "No signature found in the response"
         return false
       end
-      
+
+      # If we get here, validation has succeeded, and we can trust all
+      # <ds:Signature> elements. Each of those has a <ds:Reference> which
+      # points to the root of the root of the NodeSet it signs.
+      @trusted_roots = decrypted_document.signed_roots
+
       true
     end
-    
+
+    # triggers validation
+    def trusted_roots
+      is_valid? ? @trusted_roots : []
+    end
+
     def success_status?
       @status_code == Onelogin::Saml::StatusCodes::SUCCESS_URI
     end
-    
+
     def auth_failure?
       @status_code == Onelogin::Saml::StatusCodes::AUTHN_FAILED_URI
     end
-    
+
     def no_authn_context?
       @status_code == Onelogin::Saml::StatusCodes::NO_AUTHN_CONTEXT_URI
     end
-    
+
     def fingerprint_from_idp
-      if base64_cert = @decrypted_document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES)
+      if base64_cert = decrypted_document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES)
         cert_text = Base64.decode64(base64_cert.content)
         cert = OpenSSL::X509::Certificate.new(cert_text)
         Digest::SHA1.hexdigest(cert.to_der)

data/lib/xml_sec.rb

@@ -267,6 +267,29 @@ module XMLSecurity
       "-----BEGIN PUBLIC KEY-----\n#{base64}-----END PUBLIC KEY-----"
     end
 
+    def has_signature?
+      signatures.any?
+    end
+
+    def signed_roots
+      signatures.map do |sig|
+        ref = sig.find('.//ds:Reference', Onelogin::NAMESPACES).first
+        signed_element_id = ref['URI'].sub(/^#/, '')
+
+        if signed_element_id.empty?
+          self.root
+        else
+          xpath_id_query = %Q(ancestor::*[@ID = "#{signed_element_id}"])
+
+          ref.find(xpath_id_query, Onelogin::NAMESPACES).first
+        end
+      end.compact
+    end
+
+    def signatures
+      @signatures ||= self.find("//ds:Signature", Onelogin::NAMESPACES)
+    end
+
     def validate(idp_cert_fingerprint, logger = nil)
       # get cert from response
       base64_cert = self.find_first("//ds:X509Certificate", Onelogin::NAMESPACES).content

data/ruby-saml-mod.gemspec

@@ -1,9 +1,9 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.22"
+  s.version = "0.1.23"
 
   s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody", "Jeremy", "Paul"]
-  s.date = %q{2013-05-07}
+  s.date = %q{2014-01-25}
   s.extra_rdoc_files = [
     "LICENSE"
   ]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version
-  version: 0.1.22
+  version: 0.1.23
   prerelease: 
 platform: ruby
 authors:
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-05-07 00:00:00.000000000 Z
+date: 2014-01-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: libxml-ruby