ruby-saml-mod 0.1.8 → 0.1.9

data/lib/onelogin/saml.rb

@@ -1,6 +1,6 @@
 require 'zlib'
 require "base64"
-require "rexml/document"
+require "xml/libxml"
 require "xml_sec"
 
 module Onelogin

data/lib/onelogin/saml/logout_response.rb

@@ -12,11 +12,11 @@ module Onelogin::Saml
       zlib = Zlib::Inflate.new(-Zlib::MAX_WBITS)
       @xml = zlib.inflate(@xml)
       @document = XMLSecurity::SignedDocument.new(@xml)
-      
-      @in_response_to = REXML::XPath.first(@document, "/samlp:LogoutResponse", Onelogin::NAMESPACES).attributes['InResponseTo'] rescue nil
-      @destination = REXML::XPath.first(@document, "/samlp:LogoutResponse", Onelogin::NAMESPACES).attributes['Destination'] rescue nil
-      @status_code = REXML::XPath.first(@document, "/samlp:LogoutResponse/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).attributes["Value"] rescue nil
-      @status_message = REXML::XPath.first(@document, "/samlp:LogoutResponse/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).text rescue nil
+
+      @in_response_to = @document.find_first("/samlp:LogoutResponse", Onelogin::NAMESPACES)['InResponseTo'] rescue nil
+      @destination = @document.find_first("/samlp:LogoutResponse", Onelogin::NAMESPACES)['Destination'] rescue nil
+      @status_code = @document.find_first("/samlp:LogoutResponse/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)['Value'] rescue nil
+      @status_message = @document.find_first("/samlp:LogoutResponse/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).content rescue nil
     end
     
     def logger=(val)

data/lib/onelogin/saml/response.rb

@@ -1,8 +1,8 @@
 module Onelogin::Saml
   class Response
     
-    attr_reader :settings, :document, :xml, :response
-    attr_reader :name_id, :name_qualifier, :session_index
+    attr_reader :settings, :document, :decrypted_document, :xml, :response
+    attr_reader :name_id, :name_qualifier, :session_index, :saml_attributes
     attr_reader :status_code, :status_message
     attr_reader :in_response_to, :destination
     attr_reader :validation_error
@@ -11,16 +11,24 @@ module Onelogin::Saml
       @settings = settings
       
       @xml = Base64.decode64(@response)
-      @document = XMLSecurity::SignedDocument.new(@xml)
-      @document.decrypt(@settings)
+      @document = LibXML::XML::Document.string(@xml)
+      @document.extend(XMLSecurity::SignedDocument)
       
-      @in_response_to = REXML::XPath.first(@document, "/samlp:Response", Onelogin::NAMESPACES).attributes['InResponseTo'] rescue nil
-      @destination = REXML::XPath.first(@document, "/samlp:Response", Onelogin::NAMESPACES).attributes['Destination'] rescue nil
-      @name_id = REXML::XPath.first(@document, "/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).text rescue nil
-      @name_qualifier = REXML::XPath.first(@document, "/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).attributes["NameQualifier"] rescue nil
-      @session_index = REXML::XPath.first(@document, "/samlp:Response/saml:Assertion/saml:AuthnStatement", Onelogin::NAMESPACES).attributes["SessionIndex"] rescue nil
-      @status_code = REXML::XPath.first(@document, "/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).attributes["Value"] rescue nil
-      @status_message = REXML::XPath.first(@document, "/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).text rescue nil
+      @decrypted_document = LibXML::XML::Document.document(@document)
+      @decrypted_document.extend(XMLSecurity::SignedDocument)
+      @decrypted_document.decrypt(@settings)
+      
+      @in_response_to = @decrypted_document.find_first("/samlp:Response", Onelogin::NAMESPACES)['InResponseTo'] rescue nil
+      @destination = @decrypted_document.find_first("/samlp:Response", Onelogin::NAMESPACES)['Destination'] rescue nil
+      @name_id = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES).content rescue nil
+      @saml_attributes = {}
+      @decrypted_document.find("//saml:Attribute", Onelogin::NAMESPACES).each do |attr|
+        @saml_attributes[attr['FriendlyName']] = attr.content.strip rescue nil
+      end
+      @name_qualifier = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:Subject/saml:NameID", Onelogin::NAMESPACES)["NameQualifier"] rescue nil
+      @session_index = @decrypted_document.find_first("/samlp:Response/saml:Assertion/saml:AuthnStatement", Onelogin::NAMESPACES)["SessionIndex"] rescue nil
+      @status_code = @decrypted_document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil
+      @status_message = @decrypted_document.find_first("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES).content rescue nil
     end
     
     def logger=(val)
@@ -28,23 +36,27 @@ module Onelogin::Saml
     end
     
     def is_valid?
-      if !@response.blank? && @document.elements["//ds:X509Certificate"]
-        if !@settings.idp_cert_fingerprint
-          @validation_error = "No fingerprint configured in SAML settings"
-          false
-        elsif @document.validate(@settings.idp_cert_fingerprint, @logger)
-          true
-        else
-          @validation_error = @document.validation_error
-          false
-        end
-      elsif @response.blank?
+      if @response.nil? || @response == ""
         @validation_error = "No response to validate"
-        false
-      else
+        return false
+      end
+      
+      if @document.find_first("//ds:X509Certificate", Onelogin::NAMESPACES).nil?
         @validation_error = "No ds:X509Certificate element"
-        false
+        return false
       end
+      
+      if !@settings.idp_cert_fingerprint
+        @validation_error = "No fingerprint configured in SAML settings"
+        return false
+      end
+      
+      if !@document.validate(@settings.idp_cert_fingerprint, @logger)
+        @validation_error = @document.validation_error
+        return false
+      end
+      
+      true
     end
     
     def success_status?
@@ -60,8 +72,8 @@ module Onelogin::Saml
     end
     
     def fingerprint_from_idp
-      if base64_cert = @document.elements["//ds:X509Certificate"]
-        cert_text = Base64.decode64(base64_cert.text)
+      if base64_cert = @document.find_first("//ds:X509Certificate")
+        cert_text = Base64.decode64(base64_cert.content)
         cert = OpenSSL::X509::Certificate.new(cert_text)
         Digest::SHA1.hexdigest(cert.to_der)
       else

data/lib/xml_sec.rb

@@ -23,93 +23,99 @@
 # Portions Copyrighted 2007 Todd W Saxton.
 
 require 'rubygems'
-require "rexml/document"
-require "rexml/xpath"
+require "xml/libxml"
 require "openssl"
-require "xmlcanonicalizer"
 require "digest/sha1"
 require "tempfile"
 require "shellwords"
  
 module XMLSecurity
-
-  class SignedDocument < REXML::Document
-    
+  module SignedDocument
     attr_reader :validation_error
 
-    def validate (idp_cert_fingerprint, logger = nil)
+    def validate(idp_cert_fingerprint, logger = nil)
       # get cert from response
-      base64_cert             = self.elements["//ds:X509Certificate"].text
-      cert_text               = Base64.decode64(base64_cert)
-      cert                    = OpenSSL::X509::Certificate.new(cert_text)
-      
+      base64_cert = self.find_first("//ds:X509Certificate", Onelogin::NAMESPACES).content
+      cert_text = Base64.decode64(base64_cert)
+      cert = OpenSSL::X509::Certificate.new(cert_text)
+
       # check cert matches registered idp cert
-      fingerprint             = Digest::SHA1.hexdigest(cert.to_der)
-      valid_flag              = fingerprint == idp_cert_fingerprint.gsub(":", "").downcase
-      @validation_error       = "Invalid fingerprint" unless valid_flag
-      
-      return valid_flag if !valid_flag 
-      
+      fingerprint = Digest::SHA1.hexdigest(cert.to_der)
+      expected_fingerprint = idp_cert_fingerprint.gsub(":", "").downcase
+      if fingerprint != expected_fingerprint
+        @validation_error = "Invalid fingerprint (expected #{expected_fingerprint}, got #{fingerprint})"
+        return false
+      end
+
       validate_doc(base64_cert, logger)
     end
-    
+
+    def canonicalize_node(node)
+      tmp_document = LibXML::XML::Document.new
+      tmp_document.root = tmp_document.import(node)
+      tmp_document.canonicalize
+    end
+
     def validate_doc(base64_cert, logger)
       # validate references
       
-      # remove signature node
-      sig_element = REXML::XPath.first(self, "//ds:Signature", {"ds"=>"http://www.w3.org/2000/09/xmldsig#"})
-      sig_element.remove
+      sig_element = find_first("//ds:Signature", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
       
-      #check digests
-      REXML::XPath.each(sig_element, "//ds:Reference", {"ds"=>"http://www.w3.org/2000/09/xmldsig#"}) do | ref |          
-        
-        uri                   = ref.attributes.get_attribute("URI").value
-        hashed_element        = REXML::XPath.first(self, "//[@ID='#{uri[1,uri.size]}']")
-        canoner               = XML::Util::XmlCanonicalizer.new(false, true)
-        canon_hashed_element  = canoner.canonicalize(hashed_element)
-        hash                  = Base64.encode64(Digest::SHA1.digest(canon_hashed_element)).chomp
-        digest_value          = REXML::XPath.first(ref, "//ds:DigestValue", {"ds"=>"http://www.w3.org/2000/09/xmldsig#"}).text
-        
-        valid_flag            = hash == digest_value 
-        
-        if !valid_flag
-          @validation_error   = <<-INFO
-Invalid references digest. 
-Got digest of 
-#{hash} 
-but expected 
-#{digest_value}
-XML from response:
-#{hashed_element}
-Canonized XML:
-#{canon_hashed_element}
-INFO
+      # check digests
+      sig_element.find("//ds:Reference", { "ds" => "http://www.w3.org/2000/09/xmldsig#" }).each do |ref|
+        # Find the referenced element
+        uri = ref["URI"]
+        ref_element = find_first("//*[@ID='#{uri[1,uri.size]}']")
+
+        # Create a copy document with it
+        ref_document = LibXML::XML::Document.new
+        ref_document.root = ref_document.import(ref_element)
+
+        # Remove the Signature node
+        ref_document_sig_element = ref_document.find_first("//ds:Signature", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
+        ref_document_sig_element.remove! if ref_document_sig_element
+
+        # Canonicalize the referenced element's document
+        ref_document_canonicalized = ref_document.canonicalize
+        hash = Base64::encode64(Digest::SHA1.digest(ref_document_canonicalized)).chomp
+        digest_value = sig_element.find_first("//ds:DigestValue", { "ds" => "http://www.w3.org/2000/09/xmldsig#" }).content
+
+        if hash != digest_value
+          @validation_error = <<-EOF.gsub(/^\s+/, '')
+            Invalid references digest.
+            Got digest of
+            #{hash}
+            but expected
+            #{digest_value}
+            XML from response:
+            #{ref_document.to_s(:indent => false)}
+            Canonized XML:
+            #{ref_document_canonicalized}
+            EOF
+          return false
         end
-        
-        return valid_flag if !valid_flag
       end
  
       # verify signature
-      canoner                 = XML::Util::XmlCanonicalizer.new(false, true)
-      signed_info_element     = REXML::XPath.first(sig_element, "//ds:SignedInfo", {"ds"=>"http://www.w3.org/2000/09/xmldsig#"})
-      canon_string            = canoner.canonicalize(signed_info_element)
+      signed_info_element = sig_element.find_first("//ds:SignedInfo", { "ds" => "http://www.w3.org/2000/09/xmldsig#" })
+      canon_string = canonicalize_node(signed_info_element)
 
-      base64_signature        = REXML::XPath.first(sig_element, "//ds:SignatureValue", {"ds"=>"http://www.w3.org/2000/09/xmldsig#"}).text
-      signature               = Base64.decode64(base64_signature)
-      
-      # get certificate object
-      cert_text               = Base64.decode64(base64_cert)
-      cert                    = OpenSSL::X509::Certificate.new(cert_text)
-      
-      valid_flag              = cert.public_key.verify(OpenSSL::Digest::SHA1.new, signature, canon_string)
-      @validation_error       = "Invalid public key" unless valid_flag
-        
-      return valid_flag
+      base64_signature = sig_element.find_first("//ds:SignatureValue", { "ds" => "http://www.w3.org/2000/09/xmldsig#" }).content
+      signature = Base64.decode64(base64_signature)
+
+      cert_text = Base64.decode64(base64_cert)
+      cert = OpenSSL::X509::Certificate.new(cert_text)
+
+      if !cert.public_key.verify(OpenSSL::Digest::SHA1.new, signature, canon_string)
+        @validation_error = "Invalid public key"
+        return false
+      end
+      return true
     end
 
     def decrypt(settings)
       if settings.encryption_configured?
-        REXML::XPath.each(self, "//xenc:EncryptedData", Onelogin::NAMESPACES) do |node|
+        find("//xenc:EncryptedData", Onelogin::NAMESPACES).each do |node|
           Tempfile.open("ruby-saml-decrypt") do |f|
             f.puts node.to_s
             f.close
@@ -119,9 +125,11 @@ INFO
               @logger.warn "Could not decrypt: #{decrypted_xml}" if @logger
               return false
             else
-              decrypted_doc = REXML::Document.new(decrypted_xml)
+              decrypted_doc = LibXML::XML::Document.string(decrypted_xml)
               decrypted_node = decrypted_doc.root
-              node.parent.replace_with(decrypted_node)
+              decrypted_node = self.import(decrypted_node)
+              node.parent.next = decrypted_node
+              node.parent.remove!
             end
             f.unlink
           end

data/ruby-saml-mod.gemspec

@@ -1,9 +1,9 @@
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml-mod}
-  s.version = "0.1.8"
+  s.version = "0.1.9"
 
   s.authors = ["OneLogin LLC", "Bracken", "Zach", "Cody"]
-  s.date = %q{2012-02-06}
+  s.date = %q{2012-04-27}
   s.extra_rdoc_files = [
     "LICENSE"
   ]
@@ -23,6 +23,7 @@ Gem::Specification.new do |s|
     "lib/xml_sec.rb",
     "ruby-saml-mod.gemspec"
   ]
+  s.add_dependency('libxml-ruby', '>= 2.3.0')
   s.homepage = %q{http://github.com/bracken/ruby-saml}
   s.require_paths = ["lib"]
   s.summary = %q{Ruby library for SAML service providers}

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version 
-  hash: 11
+  hash: 9
   prerelease: 
   segments: 
   - 0
   - 1
-  - 8
-  version: 0.1.8
+  - 9
+  version: 0.1.9
 platform: ruby
 authors: 
 - OneLogin LLC
@@ -18,9 +18,24 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-02-06 00:00:00 Z
-dependencies: []
-
+date: 2012-04-27 00:00:00 Z
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: libxml-ruby
+  prerelease: false
+  requirement: &id001 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 2
+        - 3
+        - 0
+        version: 2.3.0
+  type: :runtime
+  version_requirements: *id001
 description: "This is an early fork from https://github.com/onelogin/ruby-saml - I plan to \"rebase\" these changes ontop of their current version eventually. "
 email: 
 executables: []