ruby-saml-mod 0.1.5 → 0.1.6

data/lib/onelogin/saml.rb

@@ -19,4 +19,5 @@ require 'onelogin/saml/settings'
 require 'onelogin/saml/name_identifiers'
 require 'onelogin/saml/status_codes'
 require 'onelogin/saml/meta_data'
-require 'onelogin/saml/log_out_request'
+require 'onelogin/saml/log_out_request'
+require 'onelogin/saml/logout_response'

data/lib/onelogin/saml/auth_request.rb

@@ -1,27 +1,39 @@
 module Onelogin::Saml
   class AuthRequest
+    
+    attr_reader :settings, :id, :request_xml, :forward_url
+    
+    def initialize(settings)
+      @settings = settings
+    end
+    
     def self.create(settings)
-      id                = Onelogin::Saml::AuthRequest.generate_unique_id(42)
-      issue_instant     = Onelogin::Saml::AuthRequest.get_timestamp
+      ar = AuthRequest.new(settings)
+      ar.generate_request
+    end
+    
+    def generate_request
+      @id = Onelogin::Saml::AuthRequest.generate_unique_id(42)
+      issue_instant = Onelogin::Saml::AuthRequest.get_timestamp
 
-      request = 
-        "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"#{id}\" Version=\"2.0\" IssueInstant=\"#{issue_instant}\" ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" AssertionConsumerServiceURL=\"#{settings.assertion_consumer_service_url}\">" +
-        "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{settings.issuer}</saml:Issuer>\n" +
-        "<samlp:NameIDPolicy xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Format=\"#{settings.name_identifier_format}\" AllowCreate=\"true\"></samlp:NameIDPolicy>\n"
+      @request_xml = 
+        "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"#{@id}\" Version=\"2.0\" IssueInstant=\"#{issue_instant}\" ProtocolBinding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\" AssertionConsumerServiceURL=\"#{settings.assertion_consumer_service_url}\">" +
+        "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{@settings.issuer}</saml:Issuer>\n" +
+        "<samlp:NameIDPolicy xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Format=\"#{@settings.name_identifier_format}\" AllowCreate=\"true\"></samlp:NameIDPolicy>\n"
       
-      if settings.requested_authn_context
-        request += "<samlp:RequestedAuthnContext xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Comparison=\"exact\">"
-        request += "<saml:AuthnContextClassRef xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{settings.requested_authn_context}</saml:AuthnContextClassRef>"
-        request += "</samlp:RequestedAuthnContext>\n"
+      if @settings.requested_authn_context
+        @request_xml += "<samlp:RequestedAuthnContext xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" Comparison=\"exact\">"
+        @request_xml += "<saml:AuthnContextClassRef xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{@settings.requested_authn_context}</saml:AuthnContextClassRef>"
+        @request_xml += "</samlp:RequestedAuthnContext>\n"
       end
         
-      request += "</samlp:AuthnRequest>"
+      @request_xml += "</samlp:AuthnRequest>"
 
-      deflated_request  = Zlib::Deflate.deflate(request, 9)[2..-5]     
+      deflated_request  = Zlib::Deflate.deflate(@request_xml, 9)[2..-5]     
       base64_request    = Base64.encode64(deflated_request)  
-      encoded_request   = CGI.escape(base64_request)  
-  
-      settings.idp_sso_target_url + "?SAMLRequest=" + encoded_request
+      encoded_request   = CGI.escape(base64_request)
+
+      @forward_url = @settings.idp_sso_target_url + "?SAMLRequest=" + encoded_request
     end
     
     private 

data/lib/onelogin/saml/log_out_request.rb

@@ -1,22 +1,34 @@
 module Onelogin::Saml
   class LogOutRequest
+    attr_reader :settings, :id, :request_xml, :forward_url
+
+    def initialize(settings, session)
+      @settings = settings
+      @session = session
+    end
+
     def self.create(settings, session)
-      id                = Onelogin::Saml::AuthRequest.generate_unique_id(42)
-      issue_instant     = Onelogin::Saml::AuthRequest.get_timestamp
+      ar = LogOutRequest.new(settings, session)
+      ar.generate_request
+    end
+    
+    def generate_request
+      @id = Onelogin::Saml::AuthRequest.generate_unique_id(42)
+      issue_instant = Onelogin::Saml::AuthRequest.get_timestamp
       
-      logout_request = "<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"#{id}\" Version=\"2.0\" IssueInstant=\"#{issue_instant}\"> " +
-          "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{settings.issuer}</saml:Issuer>" +
-          "<saml:NameID xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" NameQualifier=\"#{session[:name_qualifier]}\" SPNameQualifier=\"#{settings.issuer}\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\">#{session[:name_id]}</saml:NameID>" + 
-          "<samlp:SessionIndex xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">#{session[:session_index]}</samlp:SessionIndex>" +
-          "</samlp:LogoutRequest>";
+      @request_xml = "<samlp:LogoutRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"#{@id}\" Version=\"2.0\" IssueInstant=\"#{issue_instant}\"> " +
+          "<saml:Issuer xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\">#{@settings.issuer}</saml:Issuer>" +
+          "<saml:NameID xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" NameQualifier=\"#{@session[:name_qualifier]}\" SPNameQualifier=\"#{@settings.issuer}\" Format=\"urn:oasis:names:tc:SAML:2.0:nameid-format:transient\">#{@session[:name_id]}</saml:NameID>" + 
+          "<samlp:SessionIndex xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\">#{@session[:session_index]}</samlp:SessionIndex>" +
+          "</samlp:LogoutRequest>"
 
-      deflated_logout_request = Zlib::Deflate.deflate(logout_request, 9)[2..-5]     
+      deflated_logout_request = Zlib::Deflate.deflate(@request_xml, 9)[2..-5]     
       base64_logout_request = Base64.encode64(deflated_logout_request)  
       encoded_logout_request = CGI.escape(base64_logout_request)  
 
-      redirect_url = settings.idp_slo_target_url + "?SAMLRequest=" + encoded_logout_request 
+      @forward_url = @settings.idp_slo_target_url + "?SAMLRequest=" + encoded_logout_request 
   
-      return redirect_url
+      @forward_url
     end
   end
 end

data/lib/onelogin/saml/logout_response.rb

@@ -0,0 +1,30 @@
+module Onelogin::Saml
+  class LogoutResponse
+    
+    attr_reader :settings, :document, :xml, :response
+    attr_reader :status_code, :status_message
+    attr_reader :in_response_to, :destination
+    def initialize(response, settings)
+      @response = response
+      @settings = settings
+
+      @xml = Base64.decode64(@response)
+      zlib = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+      @xml = zlib.inflate(@xml)
+      @document = XMLSecurity::SignedDocument.new(@xml)
+      
+      @in_response_to = REXML::XPath.first(@document, "/samlp:LogoutResponse", Onelogin::NAMESPACES).attributes['InResponseTo'] rescue nil
+      @destination = REXML::XPath.first(@document, "/samlp:LogoutResponse", Onelogin::NAMESPACES).attributes['Destination'] rescue nil
+      @status_code = REXML::XPath.first(@document, "/samlp:LogoutResponse/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).attributes["Value"] rescue nil
+      @status_message = REXML::XPath.first(@document, "/samlp:LogoutResponse/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).text rescue nil
+    end
+    
+    def logger=(val)
+      @logger = val
+    end
+    
+    def success_status?
+      @status_code == Onelogin::Saml::StatusCodes::SUCCESS_URI
+    end
+  end
+end

data/lib/onelogin/saml/response.rb

@@ -1,9 +1,10 @@
 module Onelogin::Saml
   class Response
     
-    attr_accessor :settings, :document, :xml, :response
-    attr_accessor :name_id, :name_qualifier, :session_index
-    attr_accessor :status_code, :status_message
+    attr_reader :settings, :document, :xml, :response
+    attr_reader :name_id, :name_qualifier, :session_index
+    attr_reader :status_code, :status_message
+    attr_reader :in_response_to, :destination
     def initialize(response, settings)
       @response = response
       @settings = settings
@@ -12,6 +13,8 @@ module Onelogin::Saml
       @document = XMLSecurity::SignedDocument.new(@xml)
       @document.decrypt(@settings)
       
+      @in_response_to = REXML::XPath.first(@document, "/samlp:Response", Onelogin::NAMESPACES).attributes['InResponseTo'] rescue nil
+      @destination = REXML::XPath.first(@document, "/samlp:Response", Onelogin::NAMESPACES).attributes['Destination'] rescue nil
       @name_id = REXML::XPath.first(@document, "/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).text rescue nil
       @name_qualifier = REXML::XPath.first(@document, "/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).attributes["NameQualifier"] rescue nil
       @session_index = REXML::XPath.first(@document, "/samlp:Response/saml:Assertion/saml:AuthnStatement", Onelogin::NAMESPACES).attributes["SessionIndex"] rescue nil
@@ -24,8 +27,10 @@ module Onelogin::Saml
     end
     
     def is_valid?
-      unless @response.blank?
+      if !@response.blank? && @document.elements["//ds:X509Certificate"]
         @document.validate(@settings.idp_cert_fingerprint, @logger) unless !@settings.idp_cert_fingerprint
+      else
+        false
       end
     end
     
@@ -40,5 +45,15 @@ module Onelogin::Saml
     def no_authn_context?
       @status_code == Onelogin::Saml::StatusCodes::NO_AUTHN_CONTEXT_URI
     end
+    
+    def fingerprint_from_idp
+      if base64_cert = @document.elements["//ds:X509Certificate"]
+        cert_text = Base64.decode64(base64_cert.text)
+        cert = OpenSSL::X509::Certificate.new(cert_text)
+        Digest::SHA1.hexdigest(cert.to_der)
+      else
+        nil
+      end
+    end
   end
 end

data/ruby-saml-mod.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.5"
+  s.version = "0.1.6"
 
   s.authors = ["OneLogin LLC", "Bracken", "Zach"]
   s.date = %q{2012-01-26}
@@ -14,6 +14,7 @@ Gem::Specification.new do |s|
     "lib/onelogin/saml/auth_request.rb",
     "lib/onelogin/saml/authn_contexts.rb",
     "lib/onelogin/saml/log_out_request.rb",
+    "lib/onelogin/saml/logout_response.rb",
     "lib/onelogin/saml/meta_data.rb",
     "lib/onelogin/saml/name_identifiers.rb",
     "lib/onelogin/saml/response.rb",

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version 
-  hash: 17
+  hash: 23
   prerelease: 
   segments: 
   - 0
   - 1
-  - 5
-  version: 0.1.5
+  - 6
+  version: 0.1.6
 platform: ruby
 authors: 
 - OneLogin LLC
@@ -35,6 +35,7 @@ files:
 - lib/onelogin/saml/auth_request.rb
 - lib/onelogin/saml/authn_contexts.rb
 - lib/onelogin/saml/log_out_request.rb
+- lib/onelogin/saml/logout_response.rb
 - lib/onelogin/saml/meta_data.rb
 - lib/onelogin/saml/name_identifiers.rb
 - lib/onelogin/saml/response.rb