ruby-saml-mod 0.3.6 → 0.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 22e420102cc676f675057d83f7ece4056c974951
-  data.tar.gz: d91e11eb1c0ee8c4ac8588b4178f72b33bb50d41
+  metadata.gz: b1b242e9ff3858681e80c4091494d480e2611088
+  data.tar.gz: 1dc877f9a2879b6e37687b78ab439da852f408bf
 SHA512:
-  metadata.gz: ca3fe26451163cfb0c08e367f8f6507ad7bee9eea5efbdb8c91c45d9ab644008b64439adbd9c4cf364ce5c9719a912c7cfcf0a723c4ec08ee3fe449ac0154f3c
-  data.tar.gz: 0af012fa8a33546831375fc4cba9ce4808c9bd37a9fdaccfca7edb86347a35c4e551e2709a93af52ca2f70beb2cc6a1e930322fee03b64fcfd8966f367063813
+  metadata.gz: 05a823a73ff85abcccc37895b2d4fbbfe94f87963c892a3e3ddf4281e28ec023cc6ea50625ffc23788ad3cd9b353df7190823e10ae4752f6412fb9e2df2ec1b7
+  data.tar.gz: 76e7c832f85e0e1e47a14484c3a55af32ab437b77b07a386f403ddb30ec2503f3fff5f293df0ff17b41b22fbce27372f0c3d2c7f98a2cb841c8d439f38f56a87

data/lib/onelogin/saml/response.rb

@@ -8,7 +8,7 @@ module Onelogin::Saml
     attr_reader :in_response_to, :destination, :issuer
     attr_reader :validation_error, :used_key
 
-    def initialize(response, settings=nil)
+    def initialize(response, settings=nil, as_of: Time.now)
       @response = response
 
       begin
@@ -25,10 +25,10 @@ module Onelogin::Saml
       @issuer ||= document.at_xpath("/samlp:Response/saml:Assertion/saml:Issuer", Onelogin::NAMESPACES).content.strip rescue nil
       @status_code = document.at_xpath("/samlp:Response/samlp:Status/samlp:StatusCode", Onelogin::NAMESPACES)["Value"] rescue nil
 
-      process(settings) if settings
+      process(settings, as_of: as_of) if settings
     end
 
-    def process(settings)
+    def process(settings, as_of: Time.now)
       @settings = settings
       @logger = settings.logger
       return unless @response
@@ -42,12 +42,27 @@ module Onelogin::Saml
       @name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["NameQualifier"] rescue nil
       @sp_name_qualifier = trusted_find_first("saml:Assertion/saml:Subject/saml:NameID")["SPNameQualifier"] rescue nil
       @session_index  = trusted_find_first("saml:Assertion/saml:AuthnStatement")["SessionIndex"] rescue nil
+      @issue_instant  = trusted_find_first("saml:Assertion")["IssueInstant"] rescue nil
 
       @saml_attributes = {}
       trusted_find("saml:Attribute").each do |attr|
         attrname = attr['FriendlyName'] || Onelogin::ATTRIBUTES[attr['Name']] || attr['Name']
         @saml_attributes[attrname] = attr.content.strip rescue nil
       end
+
+      if @is_valid
+        @issue_instant = Time.parse(@issue_instant) if @issue_instant
+        if !@issue_instant
+          @is_valid = false
+          @validation_error = "No timestamp in message"
+        elsif @issue_instant + 5 * 60 < as_of
+          @is_valid = false
+          @validation_error = "Assertion expired"
+        elsif @issue_instant - 5 * 60 > as_of
+          @is_valid = false
+          @validation_error = "Assertion not yet valid"
+        end
+      end
     end
 
     def disable_signature_validation!(settings)
@@ -79,7 +94,10 @@ module Onelogin::Saml
     end
 
     def is_valid?
-      @is_valid ||= validate
+      if !instance_variable_defined?(:@is_valid)
+        @is_valid = validate
+      end
+      @is_valid
     end
 
     def validate

data/spec/response_spec.rb

@@ -12,7 +12,7 @@ describe Onelogin::Saml::Response do
     end
 
     it "should find the right attributes from an encrypted assertion" do
-      @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+      @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2011-11-05T15:51:58Z"))
       @response.should be_is_valid
 
       @response.used_key.should == fixture_path("test1-key.pem")
@@ -23,15 +23,27 @@ describe Onelogin::Saml::Response do
       @response.status_message.strip.should == ""
     end
 
+    it "rejects assertions older than 5 minutes" do
+      @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2011-11-05T15:58:58Z"))
+      @response.should_not be_is_valid
+      @response.validation_error.should eq "Assertion expired"
+    end
+
+    it "rejects assertions from the future" do
+      @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2010-11-05T15:58:58Z"))
+      @response.should_not be_is_valid
+      @response.validation_error.should eq "Assertion not yet valid"
+    end
+
     it "support multiple valid certs" do
       @settings.idp_cert_fingerprint = ['somethingold', 'def18dbed547cdf3d52b627f41637c443045fe33']
-      @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+      @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2011-11-05T15:51:58Z"))
       @response.should be_is_valid
     end
 
     it "gives a decent error for a fingerprint problem" do
       @settings.idp_cert_fingerprint = ['somethingold']
-      @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+      @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2011-11-05T15:51:58Z"))
       @response.should_not be_is_valid
       @response.validation_error.should match(/somethingold/)
     end
@@ -39,7 +51,7 @@ describe Onelogin::Saml::Response do
     it "should not be able to decrypt without the proper key" do
       @settings.xmlsec_privatekey = fixture_path("wrong-key.pem")
       XMLSecurity.mute do
-        @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+        @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2011-11-05T15:51:58Z"))
       end
       document = REXML::Document.new(@response.decrypted_document.to_s)
       REXML::XPath.first(document, "/samlp:Response/saml:Assertion").should be_nil
@@ -50,7 +62,7 @@ describe Onelogin::Saml::Response do
       @settings.xmlsec_privatekey = fixture_path("wrong-key.pem")
       @settings.xmlsec_additional_privatekeys = [fixture_path("test1-key.pem")]
       XMLSecurity.mute do
-        @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+        @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2011-11-05T15:51:58Z"))
       end
       document = REXML::Document.new(@response.decrypted_document.to_s)
       REXML::XPath.first(document, "/samlp:Response/saml:Assertion").should_not be_nil
@@ -65,7 +77,7 @@ describe Onelogin::Saml::Response do
   it "should not verify when XSLT transforms are being used" do
     @xmlb64 = Base64.encode64(File.read(fixture_path("test4-response.xml")))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'bc71f7bacb36011694405dd0e2beafcc069de45f')
-    @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+    @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2014-06-03T12:43:56Z"))
 
     XMLSecurity.mute do
       @response.should_not be_is_valid
@@ -77,7 +89,7 @@ describe Onelogin::Saml::Response do
   it "should not allow external reference URIs" do
     @xmlb64 = Base64.encode64(File.read(fixture_path("test5-response.xml")))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'bc71f7bacb36011694405dd0e2beafcc069de45f')
-    @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+    @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2014-06-03T12:43:56Z"))
 
     XMLSecurity.mute do
       @response.should_not be_is_valid
@@ -91,7 +103,7 @@ describe Onelogin::Saml::Response do
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'def18dbed547cdf3d52b627f41637c443045fe33')
     @response = Onelogin::Saml::Response.new(@xmlb64)
     @response.disable_signature_validation!(@settings)
-    @response.process(@settings)
+    @response.process(@settings, as_of: Time.parse('2011-11-05T15:51:58Z'))
     @response.name_id.should == "zach@example.com"
     @response.name_qualifier.should == "http://saml.example.com:8080/opensso"
     @response.session_index.should == "s2c57ee92b5ca08e93d751987d591c58acc68d2501"
@@ -107,7 +119,7 @@ describe Onelogin::Saml::Response do
     @xmlb64 = Base64.encode64(File.read(fixture_path("xml_signature_wrapping_attack_response_nameid.xml")))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'afe71c28ef740bc87425be13a2263d37971da1f9')
     @response = Onelogin::Saml::Response.new(@xmlb64)
-    @response.process(@settings)
+    @response.process(@settings, as_of: Time.parse('2012-08-03T20:07:16Z'))
     @response.should be_is_valid
     @response.name_id.should == "_3b3e7714b72e29dc4290321a075fa0b73333a4f25f"
   end
@@ -116,7 +128,7 @@ describe Onelogin::Saml::Response do
     @xmlb64 = Base64.encode64(File.read(fixture_path("xml_signature_wrapping_attack_response_attributes.xml")))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'afe71c28ef740bc87425be13a2263d37971da1f9')
     @response = Onelogin::Saml::Response.new(@xmlb64)
-    @response.process(@settings)
+    @response.process(@settings, as_of: Time.parse('2012-08-03T20:07:16Z'))
     @response.should be_is_valid
     @response.saml_attributes['eduPersonAffiliation'].should == 'member'
     @response.saml_attributes['eduPersonPrincipalName'].should == 'student@example.edu'
@@ -126,7 +138,7 @@ describe Onelogin::Saml::Response do
     @xmlb64 = Base64.encode64(File.read(fixture_path('xml_signature_wrapping_attack_duplicate_ids.xml')))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => '7292914fc5bffa6f3fe1e43fd47c205395fecfa2')
     @response = Onelogin::Saml::Response.new(@xmlb64)
-    @response.process(@settings)
+    @response.process(@settings, as_of: Time.parse('2014-02-01T13:48:10.831Z'))
     @response.should_not be_is_valid
   end
 
@@ -134,7 +146,7 @@ describe Onelogin::Saml::Response do
     @xmlb64 = Base64.encode64(File.read(fixture_path('xml_missigned_assertion.xml')))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'c38e789fcfbbd4727bd8ff7fc365b44fc3596bda')
     @response = Onelogin::Saml::Response.new(@xmlb64)
-    @response.process(@settings)
+    @response.process(@settings, as_of: Time.parse("2015-02-27T19:12:52Z"))
     @response.should be_is_valid
     @response.saml_attributes['eduPersonPrincipalName'].should == 'cody'
   end
@@ -142,7 +154,7 @@ describe Onelogin::Saml::Response do
   it "should allow non-ascii characters in attributes" do
     @xmlb64 = Base64.encode64(File.read(fixture_path("test6-response.xml")))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'afe71c28ef740bc87425be13a2263d37971da1f9')
-    @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+    @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2014-09-16T22:15:53Z"))
     @response.should be_is_valid
     @response.status_code.should == "urn:oasis:names:tc:SAML:2.0:status:Success"
     @response.saml_attributes['eduPersonAffiliation'].should == 'member'
@@ -154,7 +166,7 @@ describe Onelogin::Saml::Response do
   it "should map OIDs to known attributes" do
     @xmlb64 = Base64.encode64(File.read(fixture_path("test3-response.xml")))
     @settings = Onelogin::Saml::Settings.new(:idp_cert_fingerprint => 'afe71c28ef740bc87425be13a2263d37971da1f9')
-    @response = Onelogin::Saml::Response.new(@xmlb64, @settings)
+    @response = Onelogin::Saml::Response.new(@xmlb64, @settings, as_of: Time.parse("2012-08-03T20:07:15Z"))
     @response.should be_is_valid
     @response.status_code.should == "urn:oasis:names:tc:SAML:2.0:status:Success"
     @response.saml_attributes['eduPersonAffiliation'].should == 'member'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-saml-mod
 version: !ruby/object:Gem::Version
-  version: 0.3.6
+  version: 0.3.7
 platform: ruby
 authors:
 - OneLogin LLC
@@ -14,7 +14,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-07-18 00:00:00.000000000 Z
+date: 2017-10-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -138,7 +138,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.11
+rubygems_version: 2.6.13
 signing_key: 
 specification_version: 4
 summary: Ruby library for SAML service providers