ruby-saml 0.7.2 → 0.7.3

data/.gitignore

@@ -9,3 +9,4 @@ lib/Lib.iml
 test/Test.iml
 .rvmrc
 *.gem
+.bundle

data/Gemfile

@@ -4,10 +4,12 @@ gemspec
 
 group :test do
   gem "ruby-debug", "~> 0.10.4", :require => nil, :platforms => :ruby_18
-  gem "debugger",   "~> 1.1.1",  :require => nil, :platforms => :ruby_19
-  gem "shoulda"
-  gem "rake"
-  gem "mocha"
-  gem "nokogiri"
-  gem "timecop"
+  gem "debugger",   "~> 1.1",    :require => nil, :platforms => :ruby_19
+  gem "shoulda",    "~> 2.11"
+  gem "rake",       "~> 10"
+  gem "mocha",      "~> 0.14"
+  gem "nokogiri",   "~> 1.5"
+  gem "timecop",    "<= 0.6.0"
+  gem "systemu",    "~> 2"
+  gem "rspec",      "~> 2"
 end

data/README.md

@@ -90,17 +90,19 @@ What's left at this point, is to wrap it all up in a controller and point the in
 If are using saml:AttributeStatement to transfare metadata, like the user name, you can access all the attributes through response.attributes. It
 contains all the saml:AttributeStatement with its 'Name' as a indifferent key and the one saml:AttributeValue as value.
 
+```ruby
   response          = Onelogin::Saml::Response.new(params[:SAMLResponse])
   response.settings = saml_settings
 
   response.attributes[:username]
+```
 
 ## Service Provider Metadata
 
 To form a trusted pair relationship with the IdP, the SP (you) need to provide metadata XML
-to the IdP for various good reasons.  (Caching, certificate lookups, relying party permissions, etc)
+to the IdP for various good reasons.  (Caching, certificate lookups, relaying party permissions, etc)
 
-The class Onelogin::Saml::Metdata takes care of this by reading the Settings and returning XML.  All
+The class Onelogin::Saml::Metadata takes care of this by reading the Settings and returning XML.  All
 you have to do is add a controller to return the data, then give this URL to the IdP administrator.
 The metdata will be polled by the IdP every few minutes, so updating your settings should propagate
 to the IdP settings.
@@ -116,6 +118,20 @@ to the IdP settings.
   end
 ```
 
+## Clock Drift
+
+Server clocks tend to drift naturally. If during validation of the response you get the error "Current time is earlier than NotBefore condition" then this may be due to clock differences between your system and that of the Identity Provider.
+
+First, ensure that both systems synchronize their clocks, using for example the industry standard [Network Time Protocol (NTP)](http://en.wikipedia.org/wiki/Network_Time_Protocol).
+
+Even then you may experience intermittent issues though, because the clock of the Identity Provider may drift slightly ahead of your system clocks. To allow for a small amount of clock drift you can initialize the response passing in an option named `:allowed_clock_drift`. Its value must be given in a number (and/or fraction) of seconds. The value given is added to the current time at which the response is validated before it's tested against the `NotBefore` assertion. For example:
+
+```ruby
+  response = Onelogin::Saml::Response.new(params[:SAMLResponse], :allowed_clock_drift => 1)
+```
+
+Make sure to keep the value as comfortably small as possible to keep security risks to a minimum.
+
 ## Note on Patches/Pull Requests
 
 * Fork the project.

data/lib/onelogin/ruby-saml/authrequest.rb

@@ -13,6 +13,7 @@ module Onelogin
         params = {} if params.nil?
 
         request_doc = create_authentication_xml_doc(settings)
+        request_doc.context[:attribute_quote] = :quote if settings.double_quote_xml_attribute_values
 
         request = ""
         request_doc.write(request)
@@ -35,7 +36,7 @@ module Onelogin
       def create_authentication_xml_doc(settings)
         uuid = "_" + UUID.new.generate
         time = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
-        # Create AuthnRequest root element using REXML 
+        # Create AuthnRequest root element using REXML
         request_doc = REXML::Document.new
 
         root = request_doc.add_element "samlp:AuthnRequest", { "xmlns:samlp" => "urn:oasis:names:tc:SAML:2.0:protocol" }
@@ -43,6 +44,8 @@ module Onelogin
         root.attributes['IssueInstant'] = time
         root.attributes['Version'] = "2.0"
         root.attributes['Destination'] = settings.idp_sso_target_url unless settings.idp_sso_target_url.nil?
+        root.attributes['IsPassive'] = settings.passive unless settings.passive.nil?
+        root.attributes['ProtocolBinding'] = settings.protocol_binding unless settings.protocol_binding.nil?
 
         # Conditionally defined elements based on settings
         if settings.assertion_consumer_service_url != nil
@@ -53,7 +56,7 @@ module Onelogin
           issuer.text = settings.issuer
         end
         if settings.name_identifier_format != nil
-          root.add_element "samlp:NameIDPolicy", { 
+          root.add_element "samlp:NameIDPolicy", {
               "xmlns:samlp" => "urn:oasis:names:tc:SAML:2.0:protocol",
               # Might want to make AllowCreate a setting?
               "AllowCreate" => "true",
@@ -62,14 +65,14 @@ module Onelogin
         end
 
         # BUG fix here -- if an authn_context is defined, add the tags with an "exact"
-        # match required for authentication to succeed.  If this is not defined, 
+        # match required for authentication to succeed.  If this is not defined,
         # the IdP will choose default rules for authentication.  (Shibboleth IdP)
         if settings.authn_context != nil
-          requested_context = root.add_element "samlp:RequestedAuthnContext", { 
+          requested_context = root.add_element "samlp:RequestedAuthnContext", {
             "xmlns:samlp" => "urn:oasis:names:tc:SAML:2.0:protocol",
             "Comparison" => "exact",
           }
-          class_ref = requested_context.add_element "saml:AuthnContextClassRef", { 
+          class_ref = requested_context.add_element "saml:AuthnContextClassRef", {
             "xmlns:saml" => "urn:oasis:names:tc:SAML:2.0:assertion",
           }
           class_ref.text = settings.authn_context

data/lib/onelogin/ruby-saml/logoutresponse.rb

@@ -105,7 +105,7 @@ module Onelogin
         if soft
           @schema.validate(@xml).map{ return false }
         else
-          @schema.validate(@xml).map{ |error| raise(Exception.new("#{error.message}\n\n#{@xml.to_s}")) }
+          @schema.validate(@xml).map{ |error| validation_error("#{error.message}\n\n#{@xml.to_s}") }
         end
       end
 
@@ -151,4 +151,4 @@ module Onelogin
       end
     end
   end
-end
+end

data/lib/onelogin/ruby-saml/response.rb

@@ -78,7 +78,7 @@ module Onelogin
           parse_time(node, "SessionNotOnOrAfter")
         end
       end
-      
+
       # Checks the status of the response for a "Success" code
       def success?
         @status_code ||= begin
@@ -92,6 +92,14 @@ module Onelogin
         @conditions ||= xpath_first_from_signed_assertion('/a:Conditions')
       end
 
+      def not_before
+        @not_before ||= parse_time(conditions, "NotBefore")
+      end
+
+      def not_on_or_after
+        @not_on_or_after ||= parse_time(conditions, "NotOnOrAfter")
+      end
+
       def issuer
         @issuer ||= begin
           node = REXML::XPath.first(document, "/p:Response/a:Issuer", { "p" => PROTOCOL, "a" => ASSERTION })
@@ -110,7 +118,7 @@ module Onelogin
         validate_structure(soft)      &&
         validate_response_state(soft) &&
         validate_conditions(soft)     &&
-        document.validate(get_fingerprint, soft) && 
+        document.validate_document(get_fingerprint, soft) &&
         success?
       end
 
@@ -161,16 +169,14 @@ module Onelogin
         return true if conditions.nil?
         return true if options[:skip_conditions]
 
-        if (not_before = parse_time(conditions, "NotBefore"))
-          if Time.now.utc < not_before
-            return soft ? false : validation_error("Current time is earlier than NotBefore condition")
-          end
+        now = Time.now.utc
+
+        if not_before && (now + (options[:allowed_clock_drift] || 0)) < not_before
+          return soft ? false : validation_error("Current time is earlier than NotBefore condition")
         end
 
-        if (not_on_or_after = parse_time(conditions, "NotOnOrAfter"))
-          if Time.now.utc >= not_on_or_after
-            return soft ? false : validation_error("Current time is on or after NotOnOrAfter condition")
-          end
+        if not_on_or_after && now >= not_on_or_after
+          return soft ? false : validation_error("Current time is on or after NotOnOrAfter condition")
         end
 
         true

data/lib/onelogin/ruby-saml/settings.rb

@@ -16,10 +16,13 @@ module Onelogin
       attr_accessor :sessionindex
       attr_accessor :assertion_consumer_logout_service_url
       attr_accessor :compress_request
+      attr_accessor :double_quote_xml_attribute_values
+      attr_accessor :passive
+      attr_accessor :protocol_binding
 
       private
-      
-      DEFAULTS = {:compress_request => true}
+
+      DEFAULTS = {:compress_request => true, :double_quote_xml_attribute_values => false}
     end
   end
 end

data/lib/onelogin/ruby-saml/validation_error.rb

@@ -1,6 +1,6 @@
 module Onelogin
   module Saml
-    class ValidationError < Exception
+    class ValidationError < StandardError
     end
   end
 end

data/lib/onelogin/ruby-saml/version.rb

@@ -1,5 +1,5 @@
 module Onelogin
   module Saml
-    VERSION = '0.7.2'
+    VERSION = '0.7.3'
   end
 end

data/lib/xml_security.rb

@@ -44,9 +44,10 @@ module XMLSecurity
       extract_signed_element_id
     end
 
-    def validate(idp_cert_fingerprint, soft = true)
+    def validate_document(idp_cert_fingerprint, soft = true)
       # get cert from response
       cert_element = REXML::XPath.first(self, "//ds:X509Certificate", { "ds"=>DSIG })
+      raise Onelogin::Saml::ValidationError.new("Certificate element missing in response (ds:X509Certificate)") unless cert_element
       base64_cert  = cert_element.text
       cert_text    = Base64.decode64(base64_cert)
       cert         = OpenSSL::X509::Certificate.new(cert_text)
@@ -58,10 +59,10 @@ module XMLSecurity
         return soft ? false : (raise Onelogin::Saml::ValidationError.new("Fingerprint mismatch"))
       end
 
-      validate_doc(base64_cert, soft)
+      validate_signature(base64_cert, soft)
     end
 
-    def validate_doc(base64_cert, soft = true)
+    def validate_signature(base64_cert, soft = true)
       # validate references
 
       # check for inclusive namespaces
@@ -93,7 +94,7 @@ module XMLSecurity
 
         hashed_element                = document.at_xpath("//*[@ID='#{uri[1..-1]}']")
         canon_algorithm               = canon_algorithm REXML::XPath.first(ref, '//ds:CanonicalizationMethod', 'ds' => DSIG)
-        canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces).gsub('&','&')
+        canon_hashed_element          = hashed_element.canonicalize(canon_algorithm, inclusive_namespaces)
 
         digest_algorithm              = algorithm(REXML::XPath.first(ref, "//ds:DigestMethod"))
 

data/ruby-saml.gemspec

@@ -25,5 +25,5 @@ Gem::Specification.new do |s|
 
   s.add_runtime_dependency("canonix", ["0.1.1"])
   s.add_runtime_dependency("uuid", ["~> 2.3"])
-  s.add_runtime_dependency("nokogiri")
+  s.add_runtime_dependency("nokogiri", ["~> 1.5.0"])
 end

data/test/certificates/r1_certificate2_base64

@@ -0,0 +1 @@
+MIIEYTCCA0mgAwIBAgIJAMax+2BoUJmCMA0GCSqGSIb3DQEBBQUAMIHGMQswCQYDVQQGEwJVUzERMA8GA1UECAwISWxsaW5vaXMxEDAOBgNVBAcMB0NoaWNhZ28xIzAhBgNVBAoMGldlbGxzcHJpbmcgV29ybGR3aWRlLCBJbmMuMRwwGgYDVQQLDBNTeXN0ZW1zIEVuZ2luZWVyaW5nMSQwIgYDVQQDDBtzc28ud2VsbHNwcmluZ3dvcmxkd2lkZS5jb20xKTAnBgkqhkiG9w0BCQEWGml0QHdlbGxzcHJpbmd3b3JsZHdpZGUuY29tMB4XDTEzMDIyNzIzNTUwOFoXDTIzMDIyNzIzNTUwOFowgcYxCzAJBgNVBAYTAlVTMREwDwYDVQQIDAhJbGxpbm9pczEQMA4GA1UEBwwHQ2hpY2FnbzEjMCEGA1UECgwaV2VsbHNwcmluZyBXb3JsZHdpZGUsIEluYy4xHDAaBgNVBAsME1N5c3RlbXMgRW5naW5lZXJpbmcxJDAiBgNVBAMMG3Nzby53ZWxsc3ByaW5nd29ybGR3aWRlLmNvbTEpMCcGCSqGSIb3DQEJARYaaXRAd2VsbHNwcmluZ3dvcmxkd2lkZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCzNhrDaXa00JAIRaxEyDrK/Zjj8bBTQD5dPgugDndYf1AOpzSGpGFU+lPu0QRv0o66K64HrF24FATWI18Q6aZ+xX8QbuBrfia6hOFef29Sk5paS9+DcDCmisuNpl84kbbiazy6S6cFtcdrG9/cr2iXtYmIzz7EfUcP/UVAp24ZW7dWhcvxoqxF9n6Fj94N+rA0dmUFUGz6glm7us3p36xbkiUMpgr3feD/9P34H+2YFsQ2b2DblDI5Z7YULHxBsl5nuhPLFuPN1olcWQBsJYO6iHElFRH+487L2yZ1mLVXKI0LFb/w1rAJpPeUc8E5s1MATAjNx3wPwwqgw30sKtoXAgMBAAGjUDBOMB0GA1UdDgQWBBSrGGV9w3hGXTafkJLUaWBsWiDGaTAfBgNVHSMEGDAWgBSrGGV9w3hGXTafkJLUaWBsWiDGaTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQCcvZV0VIwIRD4C5CItFwfNRF2LRBmYiNh4FJbo0wESbH0cWT9vXNdcjcx6PHrIj7ICErSCR5eZmIrSgLEBEkptjVsiFsHWSvMHv37WaHwyhZWnhutss32aP9+ifxQ1lzwm54jZWZsVVVFQH155BDsVeU1UwEhvcCExFa7RNjyvqQrZmyQwMFSzL1cQp0humu0hHLtAI7E32lp5itw6kTOfyhjB8d1bzBVZe6RY64RxOPEcx+9hkrHmfCohdt644jRtPdLTvqqxpscYGD+L2QOt1HpbGgAdcgUZeUHo/eosqpwDOoyuFepz7JzqMncxFN//NmjnFGVZdGR+6bTxKUKq

data/test/logoutresponse_test.rb

@@ -102,7 +102,7 @@ class RubySamlTest < Test::Unit::TestCase
       should "raise error for invalid xml" do
         logoutresponse = Onelogin::Saml::Logoutresponse.new(invalid_xml_response, settings)
 
-        assert_raises(Exception) { logoutresponse.validate! }
+        assert_raises(Onelogin::Saml::ValidationError) { logoutresponse.validate! }
       end
     end
 

data/test/request_test.rb

@@ -46,6 +46,23 @@ class RequestTest < Test::Unit::TestCase
       assert_match /^<samlp:AuthnRequest/, decoded
     end
 
+    should "create the SAMLRequest URL parameter with IsPassive" do
+      settings = Onelogin::Saml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.passive = true
+      auth_url = Onelogin::Saml::Authrequest.new.create(settings)
+      assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
+      payload  = CGI.unescape(auth_url.split("=").last)
+      decoded  = Base64.decode64(payload)
+
+      zstream  = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+      inflated = zstream.inflate(decoded)
+      zstream.finish
+      zstream.close
+
+      assert_match /<samlp:AuthnRequest[^<]* IsPassive='true'/, inflated
+    end
+
     should "accept extra parameters" do
       settings = Onelogin::Saml::Settings.new
       settings.idp_sso_target_url = "http://example.com"

data/test/response_test.rb

@@ -120,7 +120,7 @@ class RubySamlTest < Test::Unit::TestCase
         settings = Onelogin::Saml::Settings.new
         response.settings = settings
         settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
-        XMLSecurity::SignedDocument.any_instance.expects(:validate_doc).returns(true)
+        XMLSecurity::SignedDocument.any_instance.expects(:validate_signature).returns(true)
         assert response.validate!
       end
 
@@ -133,6 +133,15 @@ class RubySamlTest < Test::Unit::TestCase
         assert response.validate!
       end
 
+      should "validate the digest" do
+        response = Onelogin::Saml::Response.new(r1_response_document_6)
+        response.stubs(:conditions).returns(nil)
+        settings = Onelogin::Saml::Settings.new
+        settings.idp_cert = Base64.decode64(r1_signature_2)
+        response.settings = settings
+        assert response.validate!
+      end
+
       should "validate SAML 2.0 XML structure" do
         resp_xml = Base64.decode64(response_document_4).gsub(/emailAddress/,'test')
         response = Onelogin::Saml::Response.new(Base64.encode64(resp_xml))
@@ -175,6 +184,17 @@ class RubySamlTest < Test::Unit::TestCase
         response = Onelogin::Saml::Response.new(response_document_5)
         assert response.send(:validate_conditions, true)
       end
+
+      should "optionally allow for clock drift" do
+        # The NotBefore condition in the document is 2011-06-14T18:21:01.516Z
+        Time.stubs(:now).returns(Time.parse("2011-06-14T18:21:01Z"))
+        response = Onelogin::Saml::Response.new(response_document_5, :allowed_clock_drift => 0.515)
+        assert !response.send(:validate_conditions, true)
+
+        Time.stubs(:now).returns(Time.parse("2011-06-14T18:21:01Z"))
+        response = Onelogin::Saml::Response.new(response_document_5, :allowed_clock_drift => 0.516)
+        assert response.send(:validate_conditions, true)
+      end
     end
 
     context "#attributes" do
@@ -220,13 +240,13 @@ class RubySamlTest < Test::Unit::TestCase
         response = Onelogin::Saml::Response.new(response_document)
         assert_equal "https://app.onelogin.com/saml/metadata/13590", response.issuer
       end
-      
+
       should "return the issuer inside the response" do
         response = Onelogin::Saml::Response.new(response_document_2)
         assert_equal "wibble", response.issuer
       end
     end
-    
+
     context "#success" do
       should "find a status code that says success" do
         response = Onelogin::Saml::Response.new(response_document)

data/test/responses/r1_response6.xml.base64

@@ -0,0 +1 @@
+PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJfNmMxZmY2ZmIwNDhjODcyYjdjYmQxNDU2NjA3NGYxN2JlOGQ5YzcyODM3IiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAxMy0wMy0yNVQxNTozNjowMFoiIERlc3RpbmF0aW9uPSJodHRwczovL3JwbS5uZXdyZWxpYy5jb20vYWNjb3VudHMvMTM2ODU3L3Nzby9zYW1sL2ZpbmFsaXplIiBJblJlc3BvbnNlVG89Il85ZTFmMzVkMC03NzhmLTAxMzAtMWRhOS0wNDJiMmI0ZmQyNjUiPjxzYW1sOklzc3Vlcj5odHRwczovL3Nzby53ZWxsc3ByaW5nd29ybGR3aWRlLmNvbS9zaW1wbGVzYW1sL3NhbWwyL2lkcC9tZXRhZGF0YS5waHA8L3NhbWw6SXNzdWVyPjxzYW1scDpTdGF0dXM+PHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbHA6U3RhdHVzPjxzYW1sOkFzc2VydGlvbiB4bWxuczp4c2k9Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvWE1MU2NoZW1hLWluc3RhbmNlIiB4bWxuczp4cz0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEiIElEPSJfMDMwNTgzYjVkN2FhOWY4ODQzODg2NmZhNjE2NDBhMzdjMzVlNGZkNjQ3IiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAxMy0wMy0yNVQxNTozNjowMFoiPjxzYW1sOklzc3Vlcj5odHRwczovL3Nzby53ZWxsc3ByaW5nd29ybGR3aWRlLmNvbS9zaW1wbGVzYW1sL3NhbWwyL2lkcC9tZXRhZGF0YS5waHA8L3NhbWw6SXNzdWVyPjxkczpTaWduYXR1cmUgeG1sbnM6ZHM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyMiPgogIDxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+CiAgICA8ZHM6U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3JzYS1zaGExIi8+CiAgPGRzOlJlZmVyZW5jZSBVUkk9IiNfMDMwNTgzYjVkN2FhOWY4ODQzODg2NmZhNjE2NDBhMzdjMzVlNGZkNjQ3Ij48ZHM6VHJhbnNmb3Jtcz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI2VudmVsb3BlZC1zaWduYXR1cmUiLz48ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+PC9kczpUcmFuc2Zvcm1zPjxkczpEaWdlc3RNZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjc2hhMSIvPjxkczpEaWdlc3RWYWx1ZT50bjc3ajFjMUQ0SjdPaTNrNVZVWlI2YjlzZTQ9PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2RzOlNpZ25lZEluZm8+PGRzOlNpZ25hdHVyZVZhbHVlPldCQ2lWUUM2ZWFscGlzT3NYUUxOaGFIb3ptRy9CWGsxb3lFd2EyVnVBQ2FjTGlSMFplRk9ScXNzQW1tWkVPZXVlSXd1TEUxLzhPZ0t6OUZFYWZrREh6blh4c0x1dXg1N1pPS2R5cTJtUXllNS9XV2NPRVJtYVFHeE5EeERUVzdod1BVUDFLRzJNMTZvbTlzc3RmNTNTSTRHYkg0MzRnM3BwNGlQMjlLVis4b0t6V1h3VUtQb0FkUTFpT2pENWNITXhmNU9oQXRsQ1h6b0JtYTV3K3lOcmgvWFVBMmE2am1ubXV2cWdPS2VUU3VzWWlLYlVIVTAxOE15cVFrcmJaTXFndC9SMTY2RWxVU3RzcFlKc0tYalpYN1hLOUQ4ekdNNWZhQVErZ3BReW1BVEFrRE84MGsrVXZQdjhxWUhXemdvRCtSaDJFNjJpMzdkODZkUjNUNEdOUT09PC9kczpTaWduYXR1cmVWYWx1ZT4KPGRzOktleUluZm8+PGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU+TUlJRVlUQ0NBMG1nQXdJQkFnSUpBTWF4KzJCb1VKbUNNQTBHQ1NxR1NJYjNEUUVCQlFVQU1JSEdNUXN3Q1FZRFZRUUdFd0pWVXpFUk1BOEdBMVVFQ0F3SVNXeHNhVzV2YVhNeEVEQU9CZ05WQkFjTUIwTm9hV05oWjI4eEl6QWhCZ05WQkFvTUdsZGxiR3h6Y0hKcGJtY2dWMjl5YkdSM2FXUmxMQ0JKYm1NdU1Sd3dHZ1lEVlFRTERCTlRlWE4wWlcxeklFVnVaMmx1WldWeWFXNW5NU1F3SWdZRFZRUUREQnR6YzI4dWQyVnNiSE53Y21sdVozZHZjbXhrZDJsa1pTNWpiMjB4S1RBbkJna3Foa2lHOXcwQkNRRVdHbWwwUUhkbGJHeHpjSEpwYm1kM2IzSnNaSGRwWkdVdVkyOXRNQjRYRFRFek1ESXlOekl6TlRVd09Gb1hEVEl6TURJeU56SXpOVFV3T0Zvd2djWXhDekFKQmdOVkJBWVRBbFZUTVJFd0R3WURWUVFJREFoSmJHeHBibTlwY3pFUU1BNEdBMVVFQnd3SFEyaHBZMkZuYnpFak1DRUdBMVVFQ2d3YVYyVnNiSE53Y21sdVp5QlhiM0pzWkhkcFpHVXNJRWx1WXk0eEhEQWFCZ05WQkFzTUUxTjVjM1JsYlhNZ1JXNW5hVzVsWlhKcGJtY3hKREFpQmdOVkJBTU1HM056Ynk1M1pXeHNjM0J5YVc1bmQyOXliR1IzYVdSbExtTnZiVEVwTUNjR0NTcUdTSWIzRFFFSkFSWWFhWFJBZDJWc2JITndjbWx1WjNkdmNteGtkMmxrWlM1amIyMHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDek5ockRhWGEwMEpBSVJheEV5RHJLL1pqajhiQlRRRDVkUGd1Z0RuZFlmMUFPcHpTR3BHRlUrbFB1MFFSdjBvNjZLNjRIckYyNEZBVFdJMThRNmFaK3hYOFFidUJyZmlhNmhPRmVmMjlTazVwYVM5K0RjRENtaXN1TnBsODRrYmJpYXp5NlM2Y0Z0Y2RyRzkvY3IyaVh0WW1Jeno3RWZVY1AvVVZBcDI0Wlc3ZFdoY3Z4b3F4RjluNkZqOTROK3JBMGRtVUZVR3o2Z2xtN3VzM3AzNnhia2lVTXBncjNmZUQvOVAzNEgrMllGc1EyYjJEYmxESTVaN1lVTEh4QnNsNW51aFBMRnVQTjFvbGNXUUJzSllPNmlIRWxGUkgrNDg3TDJ5WjFtTFZYS0kwTEZiL3cxckFKcFBlVWM4RTVzMU1BVEFqTngzd1B3d3FndzMwc0t0b1hBZ01CQUFHalVEQk9NQjBHQTFVZERnUVdCQlNyR0dWOXczaEdYVGFma0pMVWFXQnNXaURHYVRBZkJnTlZIU01FR0RBV2dCU3JHR1Y5dzNoR1hUYWZrSkxVYVdCc1dpREdhVEFNQmdOVkhSTUVCVEFEQVFIL01BMEdDU3FHU0liM0RRRUJCUVVBQTRJQkFRQ2N2WlYwVkl3SVJENEM1Q0l0RndmTlJGMkxSQm1ZaU5oNEZKYm8wd0VTYkgwY1dUOXZYTmRjamN4NlBIcklqN0lDRXJTQ1I1ZVptSXJTZ0xFQkVrcHRqVnNpRnNIV1N2TUh2MzdXYUh3eWhaV25odXRzczMyYVA5K2lmeFExbHp3bTU0alpXWnNWVlZGUUgxNTVCRHNWZVUxVXdFaHZjQ0V4RmE3Uk5qeXZxUXJabXlRd01GU3pMMWNRcDBodW11MGhITHRBSTdFMzJscDVpdHc2a1RPZnloakI4ZDFiekJWWmU2Ulk2NFJ4T1BFY3grOWhrckhtZkNvaGR0NjQ0alJ0UGRMVHZxcXhwc2NZR0QrTDJRT3QxSHBiR2dBZGNnVVplVUhvL2Vvc3Fwd0RPb3l1RmVwejdKenFNbmN4Rk4vL05tam5GR1ZaZEdSKzZiVHhLVUtxPC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWw6U3ViamVjdD48c2FtbDpOYW1lSUQgU1BOYW1lUXVhbGlmaWVyPSJycG0ubmV3cmVsaWMuY29tIiBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjEuMTpuYW1laWQtZm9ybWF0OmVtYWlsQWRkcmVzcyI+ZTQwYzA4OTA3NDVjZTkyNTBhZDIyM2I1OTA5MGNjNmRjNWQxZjVhMTwvc2FtbDpOYW1lSUQ+PHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxzYW1sOlN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAxMy0wMy0yNVQxNTo0MTowMFoiIFJlY2lwaWVudD0iaHR0cHM6Ly9ycG0ubmV3cmVsaWMuY29tL2FjY291bnRzLzEzNjg1Ny9zc28vc2FtbC9maW5hbGl6ZSIgSW5SZXNwb25zZVRvPSJfOWUxZjM1ZDAtNzc4Zi0wMTMwLTFkYTktMDQyYjJiNGZkMjY1Ii8+PC9zYW1sOlN1YmplY3RDb25maXJtYXRpb24+PC9zYW1sOlN1YmplY3Q+PHNhbWw6Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMTMtMDMtMjVUMTU6MzU6MzBaIiBOb3RPbk9yQWZ0ZXI9IjIwMTMtMDMtMjVUMTU6NDE6MDBaIj48c2FtbDpBdWRpZW5jZVJlc3RyaWN0aW9uPjxzYW1sOkF1ZGllbmNlPnJwbS5uZXdyZWxpYy5jb208L3NhbWw6QXVkaWVuY2U+PC9zYW1sOkF1ZGllbmNlUmVzdHJpY3Rpb24+PC9zYW1sOkNvbmRpdGlvbnM+PHNhbWw6QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDEzLTAzLTI1VDE1OjIwOjEyWiIgU2Vzc2lvbk5vdE9uT3JBZnRlcj0iMjAxMy0wMy0yNVQyMzozNjowMFoiIFNlc3Npb25JbmRleD0iX2ZmNjc4NWJkNTUxYjQ2NzVjMGI2MGI3ZTI2YzFmYmI3Y2Y1MDljZTk5OSI+PHNhbWw6QXV0aG5Db250ZXh0PjxzYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9zYW1sOkF1dGhuQ29udGV4dENsYXNzUmVmPjwvc2FtbDpBdXRobkNvbnRleHQ+PC9zYW1sOkF1dGhuU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48c2FtbDpBdHRyaWJ1dGUgTmFtZT0iaG9tZURpcmVjdG9yeSIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPi9ob21lL2t5bGUuYmFjenluc2tpPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWU9ImdpZE51bWJlciIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPjEwNDc8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZT0idWlkTnVtYmVyIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+MTA0Nzwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJzc2hQdWJsaWNLZXkiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5zc2gtcnNhIEFBQUFCM056YUMxeWMyRUFBQUFEQVFBQkFBQUJBUUMrL3U1N2tqOWNRVXNXcW5EOVNYY0lNcCsyUDF3aFREa2FHZ2RPVUtySHpNWmxPMEdrTk9oZFZralBGeFJrcGZZWk1sMldZZE9OQkNiK1ZmY3pyd3J6NFNjOHIvaFFkQUdpRWJEYzJLRHZkT1dSYkRGZGlSVThYNy93aFppOE1ibUx1ZmN1cmlRQmZ3ekpET2NiY2c4S0ZvN25GR3JoNmwrWmVzZ2lZWC9CV2daYmp0NFR4aHhRWHpCWDJSQXBqd1lLVzlRRkV2UCtCOWRxdHErenFsUVdUU0xFSmZobTNLSVdXUUlEUWEwdS9CRUZOYnhMRVVjR3pwdGNQZnRqaktUSjNzZCtwb1pTTlhpUUtKODNxNXpYaDM2QUxYQjlFN3IyTkZTNHlFdHJ6Q1ZqejNqSXhtT0E0TFRGUnNTV2V0aW13TXNrL1VxeFBUaUR5ZUJNQ1hPdCBLeWxlIEJhY3p5bnNraSAmbHQ7a3lsZS5iYWN6eW5za2lAd2VsbHNwcmluZ3dvcmxkd2lkZS5jb20mZ3Q7PC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWU9ImxvZ2luU2hlbGwiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj4vYmluL3pzaDwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJzaGFkb3dMYXN0Q2hhbmdlIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+MTM2MzExOTAyODwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjIuNS40LjQiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5CYWN6eW5za2k8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZT0idXJuOm9pZDoyLjUuNC4wIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+dG9wPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPnBvc2l4QWNjb3VudDwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5leHRlbnNpYmxlT2JqZWN0PC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPmFjY291bnQ8L3NhbWw6QXR0cmlidXRlVmFsdWU+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+bGRhcFB1YmxpY0tleTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjAuOS4yMzQyLjE5MjAwMzAwLjEwMC4xLjMiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5reWxlLmJhY3p5bnNraUB3ZWxsc3ByaW5nd29ybGR3aWRlLmNvbTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjIuNS40LjQyIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+S3lsZTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjAuOS4yMzQyLjE5MjAwMzAwLjEwMC4xLjEiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5reWxlLmJhY3p5bnNraTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjIuNS40LjMiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5LeWxlIEJhY3p5bnNraTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjAuOS4yMzQyLjE5MjAwMzAwLjEwMC4xLjUiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6dXJpIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5JY2VkIFRlYTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjIuNS40LjM1IiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+e1NTSEF9RVB2V3V1bkMxU1p0Nk5OdHMveTdpcFRJcVVMVjZJVWU8L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZT0idXJuOm9pZDowLjkuMjM0Mi4xOTIwMDMwMC4xMDAuMS45IiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OnVyaSI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+Kjwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1cm46b2lkOjIuMTYuODQwLjEuMTEzNzMwLjMuMS4zOSIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDp1cmkiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPmVuPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+

data/test/settings_test.rb

@@ -11,7 +11,8 @@ class SettingsTest < Test::Unit::TestCase
         :assertion_consumer_service_url, :issuer, :sp_name_qualifier,
         :idp_sso_target_url, :idp_cert_fingerprint, :name_identifier_format,
         :idp_slo_target_url, :name_identifier_value, :sessionindex,
-        :assertion_consumer_logout_service_url
+        :assertion_consumer_logout_service_url,
+        :passive, :protocol_binding
       ]
 
       accessors.each do |accessor|
@@ -31,6 +32,8 @@ class SettingsTest < Test::Unit::TestCase
           :idp_slo_target_url => "http://sso.muda.no/slo",
           :idp_cert_fingerprint => "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00",
           :name_identifier_format => "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
+          :passive => true,
+          :protocol_binding => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
       }
       @settings = Onelogin::Saml::Settings.new(config)
 

data/test/test_helper.rb

@@ -1,8 +1,8 @@
 require 'rubygems'
 require 'test/unit'
 require 'shoulda'
-require 'mocha'
 require 'ruby-debug'
+require 'mocha/setup'
 require 'timecop'
 
 $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
@@ -41,6 +41,10 @@ class Test::Unit::TestCase
     @response_document5 ||= File.read(File.join(File.dirname(__FILE__), 'responses', 'response5.xml.base64'))
   end
 
+  def r1_response_document_6
+    @response_document6 ||= File.read(File.join(File.dirname(__FILE__), 'responses', 'r1_response6.xml.base64'))
+  end
+
   def ampersands_response
     @ampersands_resposne ||= File.read(File.join(File.dirname(__FILE__), 'responses', 'response_with_ampersands.xml.base64'))
   end
@@ -64,4 +68,8 @@ class Test::Unit::TestCase
     @signature1 ||= File.read(File.join(File.dirname(__FILE__), 'certificates', 'certificate1'))
   end
 
+  def r1_signature_2
+    @signature2 ||= File.read(File.join(File.dirname(__FILE__), 'certificates', 'r1_certificate2_base64'))
+  end
+
 end

data/test/xml_security_test.rb

@@ -11,31 +11,31 @@ class XmlSecurityTest < Test::Unit::TestCase
     end
 
     should "should run validate without throwing NS related exceptions" do
-      assert !@document.validate_doc(@base64cert, true)
+      assert !@document.validate_signature(@base64cert, true)
     end
 
     should "should run validate with throwing NS related exceptions" do
       assert_raise(Onelogin::Saml::ValidationError) do
-        @document.validate_doc(@base64cert, false)
+        @document.validate_signature(@base64cert, false)
       end
     end
-    
+
     should "not raise an error when softly validating the document multiple times" do
       assert_nothing_raised do
-        2.times { @document.validate_doc(@base64cert, true) }
+        2.times { @document.validate_signature(@base64cert, true) }
       end
     end
 
     should "should raise Fingerprint mismatch" do
       exception = assert_raise(Onelogin::Saml::ValidationError) do
-        @document.validate("no:fi:ng:er:pr:in:t", false)
+        @document.validate_document("no:fi:ng:er:pr:in:t", false)
       end
       assert_equal("Fingerprint mismatch", exception.message)
     end
 
     should "should raise Digest mismatch" do
       exception = assert_raise(Onelogin::Saml::ValidationError) do
-        @document.validate_doc(@base64cert, false)
+        @document.validate_signature(@base64cert, false)
       end
       assert_equal("Digest mismatch", exception.message)
     end
@@ -47,50 +47,60 @@ class XmlSecurityTest < Test::Unit::TestCase
       document = XMLSecurity::SignedDocument.new(response)
       base64cert = document.elements["//ds:X509Certificate"].text
       exception = assert_raise(Onelogin::Saml::ValidationError) do
-        document.validate_doc(base64cert, false)
+        document.validate_signature(base64cert, false)
       end
       assert_equal("Key validation error", exception.message)
     end
+
+    should "raise validation error when the X509Certificate is missing" do
+      response = Base64.decode64(response_document)
+      response.sub!(/<ds:X509Certificate>.*<\/ds:X509Certificate>/, "")
+      document = XMLSecurity::SignedDocument.new(response)
+      exception = assert_raise(Onelogin::Saml::ValidationError) do
+        document.validate_document("a fingerprint", false) # The fingerprint isn't relevant to this test
+      end
+      assert_equal("Certificate element missing in response (ds:X509Certificate)", exception.message)
+    end
   end
 
   context "Algorithms" do
     should "validate using SHA1" do
       @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha1, false))
-      assert @document.validate("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
+      assert @document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
     end
 
     should "validate using SHA256" do
       @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha256, false))
-      assert @document.validate("28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA")
+      assert @document.validate_document("28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA")
     end
 
     should "validate using SHA384" do
       @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha384, false))
-      assert @document.validate("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
+      assert @document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
     end
 
     should "validate using SHA512" do
       @document = XMLSecurity::SignedDocument.new(fixture(:adfs_response_sha512, false))
-      assert @document.validate("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
+      assert @document.validate_document("F1:3C:6B:80:90:5A:03:0E:6C:91:3E:5D:15:FA:DD:B0:16:45:48:72")
     end
   end
-  
+
   context "XmlSecurity::SignedDocument" do
-    
+
     context "#extract_inclusive_namespaces" do
       should "support explicit namespace resolution for exclusive canonicalization" do
         response = fixture(:open_saml_response, false)
         document = XMLSecurity::SignedDocument.new(response)
         inclusive_namespaces = document.send(:extract_inclusive_namespaces)
-        
+
         assert_equal %w[ xs ], inclusive_namespaces
       end
-      
+
       should "support implicit namespace resolution for exclusive canonicalization" do
         response = fixture(:no_signature_ns, false)
         document = XMLSecurity::SignedDocument.new(response)
         inclusive_namespaces = document.send(:extract_inclusive_namespaces)
-        
+
         assert_equal %w[ #default saml ds xs xsi ], inclusive_namespaces
       end
 
@@ -110,10 +120,10 @@ class XmlSecurityTest < Test::Unit::TestCase
       should "return an empty list when inclusive namespace element is missing" do
         response = fixture(:no_signature_ns, false)
         response.slice! %r{<InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="#default saml ds xs xsi"/>}
-        
+
         document = XMLSecurity::SignedDocument.new(response)
         inclusive_namespaces = document.send(:extract_inclusive_namespaces)
-        
+
         assert inclusive_namespaces.empty?
       end
     end
@@ -146,5 +156,5 @@ class XmlSecurityTest < Test::Unit::TestCase
     end
 
   end
-  
+
 end

metadata

@@ -1,72 +1,79 @@
---- !ruby/object:Gem::Specification
+--- !ruby/object:Gem::Specification 
 name: ruby-saml
-version: !ruby/object:Gem::Version
-  version: 0.7.2
+version: !ruby/object:Gem::Version 
+  hash: 5
   prerelease: 
+  segments: 
+  - 0
+  - 7
+  - 3
+  version: 0.7.3
 platform: ruby
-authors:
+authors: 
 - OneLogin LLC
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-02-22 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
+
+date: 2014-02-20 00:00:00 Z
+dependencies: 
+- !ruby/object:Gem::Dependency 
   name: canonix
-  requirement: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
-        version: 0.1.1
-  type: :runtime
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
+  requirement: &id001 !ruby/object:Gem::Requirement 
     none: false
-    requirements:
-    - - '='
-      - !ruby/object:Gem::Version
+    requirements: 
+    - - "="
+      - !ruby/object:Gem::Version 
+        hash: 25
+        segments: 
+        - 0
+        - 1
+        - 1
         version: 0.1.1
-- !ruby/object:Gem::Dependency
+  type: :runtime
+  version_requirements: *id001
+- !ruby/object:Gem::Dependency 
   name: uuid
-  requirement: !ruby/object:Gem::Requirement
+  prerelease: false
+  requirement: &id002 !ruby/object:Gem::Requirement 
     none: false
-    requirements:
+    requirements: 
     - - ~>
-      - !ruby/object:Gem::Version
-        version: '2.3'
+      - !ruby/object:Gem::Version 
+        hash: 5
+        segments: 
+        - 2
+        - 3
+        version: "2.3"
   type: :runtime
+  version_requirements: *id002
+- !ruby/object:Gem::Dependency 
+  name: nokogiri
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
+  requirement: &id003 !ruby/object:Gem::Requirement 
     none: false
-    requirements:
+    requirements: 
     - - ~>
-      - !ruby/object:Gem::Version
-        version: '2.3'
-- !ruby/object:Gem::Dependency
-  name: nokogiri
-  requirement: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 1
+        - 5
+        - 0
+        version: 1.5.0
   type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    none: false
-    requirements:
-    - - ! '>='
-      - !ruby/object:Gem::Version
-        version: '0'
+  version_requirements: *id003
 description: SAML toolkit for Ruby on Rails
 email: support@onelogin.com
 executables: []
+
 extensions: []
-extra_rdoc_files:
+
+extra_rdoc_files: 
 - LICENSE
 - README.md
-files:
+files: 
 - .document
 - .gitignore
 - .travis.yml
@@ -91,6 +98,7 @@ files:
 - lib/xml_security.rb
 - ruby-saml.gemspec
 - test/certificates/certificate1
+- test/certificates/r1_certificate2_base64
 - test/logoutrequest_test.rb
 - test/logoutresponse_test.rb
 - test/request_test.rb
@@ -102,6 +110,7 @@ files:
 - test/responses/logoutresponse_fixtures.rb
 - test/responses/no_signature_ns.xml
 - test/responses/open_saml_response.xml
+- test/responses/r1_response6.xml.base64
 - test/responses/response1.xml.base64
 - test/responses/response2.xml.base64
 - test/responses/response3.xml.base64
@@ -117,31 +126,40 @@ files:
 - test/xml_security_test.rb
 homepage: http://github.com/onelogin/ruby-saml
 licenses: []
+
 post_install_message: 
-rdoc_options:
+rdoc_options: 
 - --charset=UTF-8
-require_paths:
+require_paths: 
 - lib
-required_ruby_version: !ruby/object:Gem::Requirement
+required_ruby_version: !ruby/object:Gem::Requirement 
   none: false
-  requirements:
-  - - ! '>='
-    - !ruby/object:Gem::Version
-      version: '0'
-required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
+required_rubygems_version: !ruby/object:Gem::Requirement 
   none: false
-  requirements:
-  - - ! '>='
-    - !ruby/object:Gem::Version
-      version: '0'
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      hash: 3
+      segments: 
+      - 0
+      version: "0"
 requirements: []
+
 rubyforge_project: http://www.rubygems.org/gems/ruby-saml
-rubygems_version: 1.8.23
+rubygems_version: 1.8.25
 signing_key: 
 specification_version: 3
 summary: SAML Ruby Tookit
-test_files:
+test_files: 
 - test/certificates/certificate1
+- test/certificates/r1_certificate2_base64
 - test/logoutrequest_test.rb
 - test/logoutresponse_test.rb
 - test/request_test.rb
@@ -153,6 +171,7 @@ test_files:
 - test/responses/logoutresponse_fixtures.rb
 - test/responses/no_signature_ns.xml
 - test/responses/open_saml_response.xml
+- test/responses/r1_response6.xml.base64
 - test/responses/response1.xml.base64
 - test/responses/response2.xml.base64
 - test/responses/response3.xml.base64
@@ -166,4 +185,3 @@ test_files:
 - test/settings_test.rb
 - test/test_helper.rb
 - test/xml_security_test.rb
-has_rdoc: