ruby-saml-mod 0.1.25 → 0.1.26

checksums.yaml

@@ -0,0 +1,7 @@
+---
+!binary "U0hBMQ==":
+  metadata.gz: 5884860b076f35e491df0c3d402a03d60da78778
+  data.tar.gz: f4ef94c69230b9799cbae69c2ba6cb5b21a9ef95
+!binary "U0hBNTEy":
+  metadata.gz: 2284ac2e714c3bc981de6ac2e2a87b9da238f6f7053561eab6fa30724d36eff99a43590c5d191b329fe064ca02b2540352e732569bfd67e72d1f586624f92049
+  data.tar.gz: 000451843ab8775c51367a6d409f1c763e2fd4cd1cb6fb3d04a8e77de07ce93ce611279dd7b1e4594f176f74336a9c8b7cf943f7e55227fecacfee5906f0c241

data/lib/onelogin/saml/auth_request.rb

@@ -30,7 +30,7 @@ module Onelogin::Saml
       @request_xml += "</samlp:AuthnRequest>"
 
       deflated_request  = Zlib::Deflate.deflate(@request_xml, 9)[2..-5]     
-      base64_request    = Base64.strict_encode64(deflated_request)
+      base64_request    = Base64.encode64(deflated_request)  
       encoded_request   = CGI.escape(base64_request)
 
       @forward_url = @settings.idp_sso_target_url + (@settings.idp_sso_target_url.include?("?") ? "&" : "?") + "SAMLRequest=" + encoded_request

data/lib/onelogin/saml/log_out_request.rb

@@ -11,11 +11,11 @@ module Onelogin::Saml
       ar = LogOutRequest.new(settings, session)
       ar.generate_request
     end
-    
+
     def generate_request
       @id = Onelogin::Saml::AuthRequest.generate_unique_id(42)
       issue_instant = Onelogin::Saml::AuthRequest.get_timestamp
-      
+
       @request_xml = <<-REQUEST_XML
 <samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="#{@id}" Version="2.0" IssueInstant="#{issue_instant}" Destination="#{@settings.idp_slo_target_url}">
   <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">#{@settings.issuer}</saml:Issuer>
@@ -24,12 +24,8 @@ module Onelogin::Saml
 </samlp:LogoutRequest>
       REQUEST_XML
 
-      if settings.sign?
-        @request_xml = XMLSecurity.sign(@id, @request_xml, @settings.xmlsec_privatekey, @settings.xmlsec_certificate)
-      end
-
       deflated_logout_request = Zlib::Deflate.deflate(@request_xml, 9)[2..-5]
-      base64_logout_request = Base64.strict_encode64(deflated_logout_request)
+      base64_logout_request = Base64.encode64(deflated_logout_request)
 
       url, existing_query_string = @settings.idp_slo_target_url.split('?')
       query_string = _query_string_append(existing_query_string, 'SAMLRequest', base64_logout_request)
@@ -41,7 +37,7 @@ module Onelogin::Saml
       end
 
       @forward_url = [url, query_string].join("?")
-  
+
       @forward_url
     end
 

data/lib/onelogin/saml/response.rb

@@ -2,7 +2,7 @@ module Onelogin::Saml
   class Response
 
     attr_accessor :settings
-    attr_reader :document, :xml, :response
+    attr_reader :document, :decrypted_document, :xml, :response
     attr_reader :name_id, :name_qualifier, :session_index, :saml_attributes
     attr_reader :status_code, :status_message
     attr_reader :in_response_to, :destination, :issuer
@@ -14,14 +14,14 @@ module Onelogin::Saml
         @xml = Base64.decode64(@response)
         @document = LibXML::XML::Document.string(@xml)
         @document.extend(XMLSecurity::SignedDocument)
-      rescue
+      rescue => e
         # could not parse document, everything is invalid
         @response = nil
         return
       end
 
-      @issuer = document.find_first("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content rescue nil
-      @status_code = document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil
+      @issuer = @document.find_first("/samlp:Response/saml:Issuer", Onelogin::NAMESPACES).content rescue nil
+      @status_code = @document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil
 
       process(settings) if settings
     end
@@ -30,119 +30,79 @@ module Onelogin::Saml
       @settings = settings
       return unless @response
 
-      @in_response_to = untrusted_find_first("/samlp:Response")['InResponseTo'] rescue nil
-      @destination    = untrusted_find_first("/samlp:Response")['Destination'] rescue nil
-      @status_message = untrusted_find_first("/samlp:Response/samlp:Status/samlp:StatusCode").content rescue nil
-
-      @name_id        = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID").content rescue nil
-      @name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["NameQualifier"] rescue nil
-      @session_index  = trusted_find_first("saml:Assertion/saml:AuthnStatement")["SessionIndex"] rescue nil
+      @decrypted_document = LibXML::XML::Document.document(@document)
+      @decrypted_document.extend(XMLSecurity::SignedDocument)
+      @decrypted_document.decrypt!(@settings)
 
+      @in_response_to = @decrypted_document.find_first("/samlp:Response", Onelogin::NAMESPACES)['InResponseTo'] rescue nil
+      @destination = @decrypted_document.find_first("/samlp:Response", Onelogin::NAMESPACES)['Destination'] rescue nil
+      @name_id = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).content rescue nil
       @saml_attributes = {}
-      trusted_find("saml:Attribute").each do |attr|
+      @decrypted_document.find("//saml:Attribute", Onelogin::NAMESPACES).each do |attr|
         attrname = attr['FriendlyName'] || Onelogin::ATTRIBUTES[attr['Name']] || attr['Name']
         @saml_attributes[attrname] = attr.content.strip rescue nil
       end
-    end
-
-    def disable_signature_validation!(settings)
-      @settings      = settings
-      @is_valid      = true
-      @trusted_roots = [decrypted_document.root]
-    end
-
-    def decrypted_document
-      @decrypted_document ||= LibXML::XML::Document.document(document).tap do |doc|
-        doc.extend(XMLSecurity::SignedDocument)
-        doc.decrypt!(settings)
-      end
-    end
-
-    def untrusted_find_first(xpath)
-      decrypted_document.find(xpath, Onelogin::NAMESPACES).first
-    end
-
-    def trusted_find_first(xpath)
-      trusted_find(xpath).first
-    end
-
-    def trusted_find(xpath)
-      trusted_roots.map do |trusted_root|
-        trusted_root.find("descendant-or-self::#{xpath}", Onelogin::NAMESPACES).to_a
-      end.flatten.compact
+      @name_qualifier = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES)["NameQualifier"] rescue nil
+      @session_index = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:AuthnStatement", Onelogin::NAMESPACES)["SessionIndex"] rescue nil
+      @status_message = @decrypted_document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).content rescue nil
     end
 
     def logger=(val)
       @logger = val
     end
-
+    
     def is_valid?
-      @is_valid ||= validate
-    end
-
-    def validate
-      if response.nil? || response == ""
+      if @response.nil? || @response == ""
         @validation_error = "No response to validate"
         return false
       end
-
-      if !settings.idp_cert_fingerprint
+      
+      if !@settings.idp_cert_fingerprint
         @validation_error = "No fingerprint configured in SAML settings"
         return false
       end
-
+      
       # Verify the original document if it has a signature, otherwise verify the signature
       # in the encrypted portion. If there is no signature, then we can't verify.
       verified = false
-
-      if document.has_signature?
-        verified = document.validate(settings.idp_cert_fingerprint, @logger)
+      if @document.find_first("//ds:Signature", Onelogin::NAMESPACES)
+        verified = @document.validate(@settings.idp_cert_fingerprint, @logger)
         if !verified
-          @validation_error = document.validation_error
+          @validation_error = @document.validation_error
           return false
         end
       end
 
-      if !verified && decrypted_document.has_signature?
-        verified = decrypted_document.validate(settings.idp_cert_fingerprint, @logger)
+      if !verified && @decrypted_document.find_first("//ds:Signature", Onelogin::NAMESPACES)
+        verified = @decrypted_document.validate(@settings.idp_cert_fingerprint, @logger)
         if !verified
-          @validation_error = decrypted_document.validation_error
+          @validation_error = @document.validation_error
           return false
         end
       end
-
+      
       if !verified
         @validation_error = "No signature found in the response"
         return false
       end
-
-      # If we get here, validation has succeeded, and we can trust all
-      # <ds:Signature> elements. Each of those has a <ds:Reference> which
-      # points to the root of the root of the NodeSet it signs.
-      @trusted_roots = decrypted_document.signed_roots
-
+      
       true
     end
-
-    # triggers validation
-    def trusted_roots
-      is_valid? ? @trusted_roots : []
-    end
-
+    
     def success_status?
       @status_code == Onelogin::Saml::StatusCodes::SUCCESS_URI
     end
-
+    
     def auth_failure?
       @status_code == Onelogin::Saml::StatusCodes::AUTHN_FAILED_URI
     end
-
+    
     def no_authn_context?
       @status_code == Onelogin::Saml::StatusCodes::NO_AUTHN_CONTEXT_URI
     end
-
+    
     def fingerprint_from_idp
-      if base64_cert = decrypted_document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES)
+      if base64_cert = @decrypted_document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES)
         cert_text = Base64.decode64(base64_cert.content)
         cert = OpenSSL::X509::Certificate.new(cert_text)
         Digest::SHA1.hexdigest(cert.to_der)

data/lib/xml_sec.rb

@@ -79,9 +79,6 @@ module XMLSecurity
       :xmlSecDSigStatusInvalid
   ]
 
-  XMLSEC_ERRORS_R_INVALID_DATA = 12
-  class XmlSecError < ::RuntimeError; end
-
   class XmlSecPtrList < FFI::Struct
     layout \
       :id,                          :string,
@@ -173,12 +170,6 @@ module XMLSecurity
       :reserved1,                   :pointer
   end
 
-  ErrorCallback = FFI::Function.new(:void,
-      [ :string, :int, :string, :string,     :string,      :int,   :string ]
-  ) do |file,    line, func,    errorObject, errorSubject, reason, msg     |
-    XMLSecurity.handle_xmlsec_error_callback(file, line, func, errorObject, errorSubject, reason, msg)
-  end
-
   # xmlsec functions
   attach_function :xmlSecInit, [], :int
   attach_function :xmlSecParseMemory, [ :pointer, :uint, :int ], :pointer
@@ -202,9 +193,7 @@ module XMLSecurity
   attach_function :xmlSecEncCtxDecrypt, [ :pointer, :pointer ], :int
   attach_function :xmlSecEncCtxDestroy, [ :pointer ], :void
 
-  attach_function :xmlSecErrorsDefaultCallback, [ :string, :int, :string, :string, :string, :int, :string ], :void
   attach_function :xmlSecErrorsDefaultCallbackEnableOutput, [ :bool ], :void
-  attach_function :xmlSecErrorsSetCallback, [:pointer], :void
 
   attach_function :xmlSecTransformExclC14NGetKlass, [], :pointer
   attach_function :xmlSecOpenSSLTransformRsaSha1GetKlass, [], :pointer
@@ -249,18 +238,6 @@ module XMLSecurity
   raise "Failed initializing XMLSec" if self.xmlSecInit < 0
   raise "Failed initializing app crypto" if self.xmlSecOpenSSLAppInit(nil) < 0
   raise "Failed initializing crypto" if self.xmlSecOpenSSLInit < 0
-  self.xmlSecErrorsSetCallback(ErrorCallback)
-
-  def self.handle_xmlsec_error_callback(*args)
-    raise_exception_if_necessary(*args)
-    xmlSecErrorsDefaultCallback(*args)
-  end
-
-  def self.raise_exception_if_necessary(file, line, func, errorObject, errorSubject, reason, msg)
-    if reason == XMLSEC_ERRORS_R_INVALID_DATA
-      raise XmlSecError.new(msg)
-    end
-  end
 
 
   def self.mute(&block)
@@ -290,29 +267,6 @@ module XMLSecurity
       "-----BEGIN PUBLIC KEY-----\n#{base64}-----END PUBLIC KEY-----"
     end
 
-    def has_signature?
-      signatures.any?
-    end
-
-    def signed_roots
-      signatures.map do |sig|
-        ref = sig.find('.//ds:Reference', Onelogin::NAMESPACES).first
-        signed_element_id = ref['URI'].sub(/^#/, '')
-
-        if signed_element_id.empty?
-          self.root
-        else
-          xpath_id_query = %Q(ancestor::*[@ID = "#{signed_element_id}"])
-
-          ref.find(xpath_id_query, Onelogin::NAMESPACES).first
-        end
-      end.compact
-    end
-
-    def signatures
-      @signatures ||= self.find("//ds:Signature", Onelogin::NAMESPACES)
-    end
-
     def validate(idp_cert_fingerprint, logger = nil)
       # get cert from response
       base64_cert = self.find_first("//ds:X509Certificate", Onelogin::NAMESPACES).content

data/ruby-saml-mod.gemspec

@@ -1,9 +1,9 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.25"
+  s.version = "0.1.26"
 
   s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody", "Jeremy", "Paul"]
-  s.date = %q{2014-03-12}
+  s.date = %q{2013-05-07}
   s.extra_rdoc_files = [
     "LICENSE"
   ]

metadata

@@ -1,8 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version
-  version: 0.1.25
-  prerelease: 
+  version: 0.1.26
 platform: ruby
 authors:
 - OneLogin LLC
@@ -14,12 +13,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-12 00:00:00.000000000 Z
+date: 2013-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: libxml-ruby
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -27,7 +25,6 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -35,7 +32,6 @@ dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -43,7 +39,6 @@ dependencies:
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
@@ -72,27 +67,25 @@ files:
 - ruby-saml-mod.gemspec
 homepage: http://github.com/bracken/ruby-saml
 licenses: []
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
   - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.23
+rubygems_version: 2.0.3
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Ruby library for SAML service providers
 test_files: []
-has_rdoc: