ruby-saml 0.8.16 → 0.9

data/test/metadata_test.rb

@@ -0,0 +1,87 @@
+require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
+
+class MetadataTest < Test::Unit::TestCase
+
+  def setup
+    @settings = OneLogin::RubySaml::Settings.new
+    @settings.issuer = "https://example.com"
+    @settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+    @settings.assertion_consumer_service_url = "https://foo.example/saml/consume"
+    @settings.security[:authn_requests_signed] = false
+  end
+
+  should "generate Service Provider Metadata with X509Certificate" do
+    @settings.security[:authn_requests_signed] = true
+    @settings.certificate = ruby_saml_cert_text
+
+    xml_text = OneLogin::RubySaml::Metadata.new.generate(@settings)
+
+    # assert xml_text can be parsed into an xml doc
+    xml_doc = REXML::Document.new(xml_text)
+
+    spsso_descriptor = REXML::XPath.first(xml_doc, "//md:SPSSODescriptor")
+    assert_equal "true", spsso_descriptor.attribute("AuthnRequestsSigned").value
+
+    cert_node = REXML::XPath.first(xml_doc, "//md:KeyDescriptor/ds:KeyInfo/ds:X509Data/ds:X509Certificate", {
+      "md" => "urn:oasis:names:tc:SAML:2.0:metadata",
+      "ds" => "http://www.w3.org/2000/09/xmldsig#"
+    })
+    cert_text = cert_node.text
+    cert = OpenSSL::X509::Certificate.new(Base64.decode64(cert_text))
+    assert_equal ruby_saml_cert.to_der, cert.to_der
+  end
+
+  should "should generate Service Provider Metadata" do
+    settings = OneLogin::RubySaml::Settings.new
+    settings.issuer = "https://example.com"
+    settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+    settings.assertion_consumer_service_url = "https://foo.example/saml/consume"
+    settings.security[:authn_requests_signed] = false
+
+    xml_text = OneLogin::RubySaml::Metadata.new.generate(settings)
+
+    # assert correct xml declaration
+    start = "<?xml version='1.0' encoding='UTF-8'?>\n<md:EntityDescriptor"
+    assert xml_text[0..start.length-1] == start
+
+    # assert xml_text can be parsed into an xml doc
+    xml_doc = REXML::Document.new(xml_text)
+
+    assert_equal "https://example.com", REXML::XPath.first(xml_doc, "//md:EntityDescriptor").attribute("entityID").value
+
+    spsso_descriptor = REXML::XPath.first(xml_doc, "//md:SPSSODescriptor")
+    assert_equal "urn:oasis:names:tc:SAML:2.0:protocol", spsso_descriptor.attribute("protocolSupportEnumeration").value
+    assert_equal "false", spsso_descriptor.attribute("AuthnRequestsSigned").value
+    assert_equal "false", spsso_descriptor.attribute("WantAssertionsSigned").value
+
+    assert_equal "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", REXML::XPath.first(xml_doc, "//md:NameIDFormat").text.strip
+
+    acs = REXML::XPath.first(xml_doc, "//md:AssertionConsumerService")
+    assert_equal "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST", acs.attribute("Binding").value
+    assert_equal "https://foo.example/saml/consume", acs.attribute("Location").value
+  end
+
+  should "generate attribute service if configured" do
+    settings = OneLogin::RubySaml::Settings.new
+    settings.issuer = "https://example.com"
+    settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+    settings.assertion_consumer_service_url = "https://foo.example/saml/consume"
+    settings.attribute_consuming_service.configure do
+      service_name "Test Service"
+      add_attribute(:name => "Name", :name_format => "Name Format", :friendly_name => "Friendly Name", :attribute_value => "Attribute Value")
+    end
+
+    xml_text = OneLogin::RubySaml::Metadata.new.generate(settings)
+    xml_doc = REXML::Document.new(xml_text)
+    acs = REXML::XPath.first(xml_doc, "//md:AttributeConsumingService")
+    assert_equal "true", acs.attribute("isDefault").value
+    assert_equal "1", acs.attribute("index").value
+    assert_equal REXML::XPath.first(xml_doc, "//md:ServiceName").text.strip, "Test Service"
+    req_attr = REXML::XPath.first(xml_doc, "//md:RequestedAttribute")
+    assert_equal "Name", req_attr.attribute("Name").value
+    assert_equal "Name Format", req_attr.attribute("NameFormat").value
+    assert_equal "Friendly Name", req_attr.attribute("FriendlyName").value
+    assert_equal "Attribute Value", REXML::XPath.first(xml_doc, "//md:AttributeValue").text.strip
+  end
+
+end

data/test/request_test.rb

@@ -1,15 +1,11 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
 
-class RequestTest < Minitest::Test
+class RequestTest < Test::Unit::TestCase
 
-  describe "Authrequest" do
-    let(:settings) { OneLogin::RubySaml::Settings.new }
-
-    before do
+  context "Authrequest" do
+    should "create the deflated SAMLRequest URL parameter" do
+      settings = OneLogin::RubySaml::Settings.new
       settings.idp_sso_target_url = "http://example.com"
-    end
-
-    it "create the deflated SAMLRequest URL parameter" do
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
       payload  = CGI.unescape(auth_url.split("=").last)
@@ -23,7 +19,9 @@ class RequestTest < Minitest::Test
       assert_match /^<samlp:AuthnRequest/, inflated
     end
 
-    it "create the deflated SAMLRequest URL parameter including the Destination" do
+    should "create the deflated SAMLRequest URL parameter including the Destination" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       payload  = CGI.unescape(auth_url.split("=").last)
       decoded  = Base64.decode64(payload)
@@ -36,8 +34,10 @@ class RequestTest < Minitest::Test
       assert_match /<samlp:AuthnRequest[^<]* Destination='http:\/\/example.com'/, inflated
     end
 
-    it "create the SAMLRequest URL parameter without deflating" do
+    should "create the SAMLRequest URL parameter without deflating" do
+      settings = OneLogin::RubySaml::Settings.new
       settings.compress_request = false
+      settings.idp_sso_target_url = "http://example.com"
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
       payload  = CGI.unescape(auth_url.split("=").last)
@@ -46,7 +46,9 @@ class RequestTest < Minitest::Test
       assert_match /^<samlp:AuthnRequest/, decoded
     end
 
-    it "create the SAMLRequest URL parameter with IsPassive" do
+    should "create the SAMLRequest URL parameter with IsPassive" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
       settings.passive = true
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
@@ -61,8 +63,10 @@ class RequestTest < Minitest::Test
       assert_match /<samlp:AuthnRequest[^<]* IsPassive='true'/, inflated
     end
 
-    it "create the SAMLRequest URL parameter with ProtocolBinding" do
-      settings.protocol_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+    should "create the SAMLRequest URL parameter with ProtocolBinding" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.protocol_binding = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
       payload  = CGI.unescape(auth_url.split("=").last)
@@ -76,8 +80,10 @@ class RequestTest < Minitest::Test
       assert_match /<samlp:AuthnRequest[^<]* ProtocolBinding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'/, inflated
     end
 
-    it "create the SAMLRequest URL parameter with ForceAuthn" do
-      settings.force_authn = true
+    should "create the SAMLRequest URL parameter with AttributeConsumingServiceIndex" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.attributes_index = 30
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
       payload  = CGI.unescape(auth_url.split("=").last)
@@ -87,42 +93,29 @@ class RequestTest < Minitest::Test
       inflated = zstream.inflate(decoded)
       zstream.finish
       zstream.close
-      assert_match /<samlp:AuthnRequest[^<]* ForceAuthn='true'/, inflated
+      assert_match /<samlp:AuthnRequest[^<]* AttributeConsumingServiceIndex='30'/, inflated
     end
 
-    it "create the SAMLRequest URL parameter with NameID Format" do
-      settings.name_identifier_format = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
+    should "create the SAMLRequest URL parameter with ForceAuthn" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.force_authn = true
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
       assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
-      payload = CGI.unescape(auth_url.split("=").last)
-      decoded = Base64.decode64(payload)
-      zstream = Zlib::Inflate.new(-Zlib::MAX_WBITS)
-      inflated = zstream.inflate(decoded)
-      zstream.finish
-      zstream.close
-
-      assert_match /<samlp:NameIDPolicy[^<]* AllowCreate='true'/, inflated
-      assert_match /<samlp:NameIDPolicy[^<]* Format='urn:oasis:names:tc:SAML:2.0:nameid-format:transient'/, inflated
-    end
+      payload  = CGI.unescape(auth_url.split("=").last)
+      decoded  = Base64.decode64(payload)
 
-    it "create the SAMLRequest URL parameter with Subject" do
-      settings.name_identifier_value_requested = "testuser@example.com"
-      settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
-      auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
-      assert auth_url =~ /^http:\/\/example\.com\?SAMLRequest=/
-      payload = CGI.unescape(auth_url.split("=").last)
-      decoded = Base64.decode64(payload)
-      zstream = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+      zstream  = Zlib::Inflate.new(-Zlib::MAX_WBITS)
       inflated = zstream.inflate(decoded)
       zstream.finish
       zstream.close
-
-      assert inflated.include?('<saml:Subject>')
-      assert inflated.include?("<saml:NameID Format='urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'>testuser@example.com</saml:NameID>")
-      assert inflated.include?("<saml:SubjectConfirmation Method='urn:oasis:names:tc:SAML:2.0:cm:bearer'/>")
+      assert_match /<samlp:AuthnRequest[^<]* ForceAuthn='true'/, inflated
     end
 
-    it "accept extra parameters" do
+    should "accept extra parameters" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+
       auth_url = OneLogin::RubySaml::Authrequest.new.create(settings, { :hello => "there" })
       assert auth_url =~ /&hello=there$/
 
@@ -130,15 +123,19 @@ class RequestTest < Minitest::Test
       assert auth_url =~ /&hello=$/
     end
 
-    describe "when the target url doesn't contain a query string" do
-      it "create the SAMLRequest parameter correctly" do
+    context "when the target url doesn't contain a query string" do
+      should "create the SAMLRequest parameter correctly" do
+        settings = OneLogin::RubySaml::Settings.new
+        settings.idp_sso_target_url = "http://example.com"
+
         auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
         assert auth_url =~ /^http:\/\/example.com\?SAMLRequest/
       end
     end
 
-    describe "when the target url contains a query string" do
-      it "create the SAMLRequest parameter correctly" do
+    context "when the target url contains a query string" do
+      should "create the SAMLRequest parameter correctly" do
+        settings = OneLogin::RubySaml::Settings.new
         settings.idp_sso_target_url = "http://example.com?field=value"
 
         auth_url = OneLogin::RubySaml::Authrequest.new.create(settings)
@@ -146,84 +143,100 @@ class RequestTest < Minitest::Test
       end
     end
 
-    describe "#create_params when the settings indicate to sign (embebed) the request" do
-      before do
+    context "when the settings indicate to sign (embebed) the request" do
+      should "create a signed request" do
+        settings = OneLogin::RubySaml::Settings.new
         settings.compress_request = false
         settings.idp_sso_target_url = "http://example.com?field=value"
         settings.security[:authn_requests_signed] = true
         settings.security[:embed_sign] = true
-        settings.certificate = ruby_saml_cert_text
+        settings.certificate  = ruby_saml_cert_text
         settings.private_key = ruby_saml_key_text
-      end
 
-      it "create a signed request" do
         params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
         request_xml = Base64.decode64(params["SAMLRequest"])
         assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
-        assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2000/09/xmldsig#rsa-sha1'/>], request_xml
+        request_xml =~ /<ds:SignatureMethod Algorithm='http:\/\/www.w3.org\/2000\/09\/xmldsig#rsa-sha1'\/>/
+        request_xml =~ /<ds:DigestMethod Algorithm='http:\/\/www.w3.org\/2000\/09\/xmldsig#rsa-sha1'\/>/
       end
 
-      it "create a signed request with 256 digest and signature methods" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
+      should "create a signed request with 256 digest and signature methods" do
+        settings = OneLogin::RubySaml::Settings.new
+        settings.compress_request = false
+        settings.idp_sso_target_url = "http://example.com?field=value"
+        settings.security[:authn_requests_signed] = true
+        settings.security[:embed_sign] = true
+        settings.security[:signature_method] = XMLSecurity::Document::SHA256
         settings.security[:digest_method] = XMLSecurity::Document::SHA512
+        settings.certificate  = ruby_saml_cert_text
+        settings.private_key = ruby_saml_key_text
 
         params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
-
         request_xml = Base64.decode64(params["SAMLRequest"])
         assert_match %r[<ds:SignatureValue>([a-zA-Z0-9/+=]+)</ds:SignatureValue>], request_xml
-        assert_match %r[<ds:SignatureMethod Algorithm='http://www.w3.org/2001/04/xmldsig-more#rsa-sha256'/>], request_xml
-        assert_match %r[<ds:DigestMethod Algorithm='http://www.w3.org/2001/04/xmlenc#sha512'/>], request_xml
+        request_xml =~ /<ds:SignatureMethod Algorithm='http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha256'\/>/
+        request_xml =~ /<ds:DigestMethod Algorithm='http:\/\/www.w3.org\/2001\/04\/xmldsig-more#rsa-sha512'\/>/
       end
     end
 
-    describe "#create_params when the settings indicate to sign the request" do
-      let(:cert) { OpenSSL::X509::Certificate.new(ruby_saml_cert_text) }
 
-      before do
+    context "when the settings indicate to sign the request" do
+      should "create a signature parameter" do
+        settings = OneLogin::RubySaml::Settings.new
         settings.compress_request = false
         settings.idp_sso_target_url = "http://example.com?field=value"
+        settings.assertion_consumer_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
         settings.security[:authn_requests_signed] = true
         settings.security[:embed_sign] = false
-        settings.certificate = ruby_saml_cert_text
+        settings.security[:signature_method] = XMLSecurity::Document::SHA1
+        settings.certificate  = ruby_saml_cert_text
         settings.private_key = ruby_saml_key_text
-      end
-
-      it "create a signature parameter with RSA_SHA1 and validate it" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
 
-        params = OneLogin::RubySaml::Authrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        assert params['SAMLRequest']
-        assert params[:RelayState]
+        params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
         assert params['Signature']
-        assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA1
+        assert params['SigAlg'] == XMLSecurity::Document::SHA1
 
-        query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
-        query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
-        query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
-
-        signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
-        assert_equal signature_algorithm, OpenSSL::Digest::SHA1
-
-        assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
+        # signature_method only affects the embedeed signature
+        settings.security[:signature_method] = XMLSecurity::Document::SHA256
+        params = OneLogin::RubySaml::Authrequest.new.create_params(settings)
+        assert params['Signature']
+        assert params['SigAlg'] == XMLSecurity::Document::SHA1
       end
+    end
 
-      it "create a signature parameter with RSA_SHA256 and validate it" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
-
-        params = OneLogin::RubySaml::Authrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        assert params['Signature']
-        assert_equal params['SigAlg'], XMLSecurity::Document::RSA_SHA256
+    should "create the saml:AuthnContextClassRef element correctly" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.authn_context = 'secure/name/password/uri'
+      auth_doc = OneLogin::RubySaml::Authrequest.new.create_authentication_xml_doc(settings)
+      assert auth_doc.to_s =~ /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/
+    end
 
-        query_string = "SAMLRequest=#{CGI.escape(params['SAMLRequest'])}"
-        query_string << "&RelayState=#{CGI.escape(params[:RelayState])}"
-        query_string << "&SigAlg=#{CGI.escape(params['SigAlg'])}"
+    should "create the saml:AuthnContextClassRef with comparison exact" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.authn_context = 'secure/name/password/uri'
+      auth_doc = OneLogin::RubySaml::Authrequest.new.create_authentication_xml_doc(settings)
+      assert auth_doc.to_s =~ /<samlp:RequestedAuthnContext[\S ]+Comparison='exact'/
+      assert auth_doc.to_s =~ /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/
+    end
 
-        signature_algorithm = XMLSecurity::BaseDocument.new.algorithm(params['SigAlg'])
-        assert_equal signature_algorithm, OpenSSL::Digest::SHA256
-        assert cert.public_key.verify(signature_algorithm.new, Base64.decode64(params['Signature']), query_string)
-      end
+    should "create the saml:AuthnContextClassRef with comparison minimun" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.authn_context = 'secure/name/password/uri'
+      settings.authn_context_comparison = 'minimun'
+      auth_doc = OneLogin::RubySaml::Authrequest.new.create_authentication_xml_doc(settings)
+      assert auth_doc.to_s =~ /<samlp:RequestedAuthnContext[\S ]+Comparison='minimun'/
+      assert auth_doc.to_s =~ /<saml:AuthnContextClassRef>secure\/name\/password\/uri<\/saml:AuthnContextClassRef>/
     end
 
+    should "create the saml:AuthnContextDeclRef element correctly" do
+      settings = OneLogin::RubySaml::Settings.new
+      settings.idp_sso_target_url = "http://example.com"
+      settings.authn_context_decl_ref = 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
+      auth_doc = OneLogin::RubySaml::Authrequest.new.create_authentication_xml_doc(settings)
+      assert auth_doc.to_s =~ /<saml:AuthnContextDeclRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<\/saml:AuthnContextDeclRef>/
+    end
   end
-
 end

data/test/response_test.rb

@@ -1,16 +1,13 @@
 require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
 
-class ResponseTest <  Minitest::Test
+class RubySamlTest < Test::Unit::TestCase
 
-  describe "Response" do
-    it "raise an exception when response is initialized with nil" do
-      err = assert_raises(ArgumentError) do
-        OneLogin::RubySaml::Response.new(nil)
-      end
-      assert_equal "Response cannot be nil", err.message
+  context "Response" do
+    should "raise an exception when response is initialized with nil" do
+      assert_raises(ArgumentError) { OneLogin::RubySaml::Response.new(nil) }
     end
 
-    it "be able to parse a document which contains ampersands" do
+    should "be able to parse a document which contains ampersands" do
       XMLSecurity::SignedDocument.any_instance.stubs(:digests_match?).returns(true)
       OneLogin::RubySaml::Response.any_instance.stubs(:validate_conditions).returns(true)
 
@@ -21,135 +18,74 @@ class ResponseTest <  Minitest::Test
       response.validate!
     end
 
-    it "adapt namespace" do
+    should "adapt namespace" do
       response = OneLogin::RubySaml::Response.new(response_document)
-      assert !response.name_id.nil?
+      assert_not_nil response.name_id
       response = OneLogin::RubySaml::Response.new(response_document_2)
-      assert !response.name_id.nil?
+      assert_not_nil response.name_id
       response = OneLogin::RubySaml::Response.new(response_document_3)
-      assert !response.name_id.nil?
+      assert_not_nil response.name_id
     end
 
-    it "default to raw input when a response is not Base64 encoded" do
+    should "default to raw input when a response is not Base64 encoded" do
       decoded  = Base64.decode64(response_document_2)
       response = OneLogin::RubySaml::Response.new(decoded)
       assert response.document
     end
 
-    describe "Assertion" do
-      it "only retreive an assertion with an ID that matches the signature's reference URI" do
+    context "Assertion" do
+      should "only retreive an assertion with an ID that matches the signature's reference URI" do
         response = OneLogin::RubySaml::Response.new(wrapped_response_2)
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
         settings.idp_cert_fingerprint = signature_fingerprint_1
         response.settings = settings
-        assert response.name_id.nil?
+        assert_nil response.name_id
       end
     end
 
-    describe "#validate!" do
-      it "raise when settings not initialized" do
+    context "#validate!" do
+      should "raise when encountering a condition that prevents the document from being valid" do
         response = OneLogin::RubySaml::Response.new(response_document)
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.validate!
-        end
-        assert_equal "No settings on response", err.message
-      end
-
-      it "raise when encountering a condition that prevents the document from being valid" do
-        response = OneLogin::RubySaml::Response.new(response_document)
-        response.settings = settings
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.validate!
-        end
-        assert_equal "Current time is on or after NotOnOrAfter condition", err.message
-      end
-
-      it "raises an exception when no cert or fingerprint provided" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = nil
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
+        assert_raise(OneLogin::RubySaml::ValidationError) do
           response.validate!
         end
-        assert_equal "No fingerprint or certificate on settings", err.message
       end
+    end
 
-      it "raise when no signature" do
-        response_no_signed_elements = OneLogin::RubySaml::Response.new(read_invalid_response("no_signature.xml.base64"))
-        settings.idp_cert_fingerprint = signature_fingerprint_1
-        response_no_signed_elements.settings = settings
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response_no_signed_elements.validate!
-        end
-        assert_equal "Found an unexpected number of Signature Element. SAML Response rejected", err.message
-      end
-
-      it "raise when multiple signatures" do
-        response_multiple_signed = OneLogin::RubySaml::Response.new(read_invalid_response("multiple_signed.xml.base64"))
-        settings.idp_cert_fingerprint = signature_fingerprint_1
-        response_multiple_signed.settings = settings
-        response_multiple_signed.stubs(:validate_structure).returns(true)
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response_multiple_signed.validate!
-        end
-        assert_equal "Duplicated ID. SAML Response rejected", err.message
-      end
-
-      it "raise when fingerprint missmatch" do
-        resp_xml = Base64.decode64(response_document_valid_signed)
-        response = OneLogin::RubySaml::Response.new(Base64.encode64(resp_xml))
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        settings.idp_cert_fingerprint = signature_fingerprint_1
-        response.settings = settings
-
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.validate!
-        end
-        assert_equal 'Fingerprint mismatch', err.message
+    context "#validate_structure" do
+      should "raise when encountering a condition that prevents the document from being valid" do
+        response = OneLogin::RubySaml::Response.new(response_document_2)
+        response.send(:validate_structure)
+        assert response.errors.include? "Schema validation failed"
       end
-
     end
 
-    describe "#is_valid?" do
-      it "return false when response is initialized with blank data" do
+    context "#is_valid?" do
+      should "return false when response is initialized with blank data" do
         response = OneLogin::RubySaml::Response.new('')
         assert !response.is_valid?
       end
 
-      it "return false if settings have not been set" do
+      should "return false if settings have not been set" do
         response = OneLogin::RubySaml::Response.new(response_document)
         assert !response.is_valid?
       end
 
-      it "return false when no cert or fingerprint provided" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = nil
-        assert !response.is_valid?
-      end
-
-      it "return true when the response is initialized with valid data" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
+      should "return true when the response is initialized with valid data" do
+        response = OneLogin::RubySaml::Response.new(response_document_4)
         response.stubs(:conditions).returns(nil)
         assert !response.is_valid?
         settings = OneLogin::RubySaml::Settings.new
         assert !response.is_valid?
         response.settings = settings
         assert !response.is_valid?
-        response.settings.idp_cert_fingerprint = signature_fingerprint_valid_res
-        response.validate!
+        settings.idp_cert_fingerprint = signature_fingerprint_1
+        assert response.is_valid?
       end
 
-      it "should be idempotent when the response is initialized with invalid data" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
+      should "should be idempotent when the response is initialized with invalid data" do
+        response = OneLogin::RubySaml::Response.new(response_document_4)
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
         response.settings = settings
@@ -157,58 +93,36 @@ class ResponseTest <  Minitest::Test
         assert !response.is_valid?
       end
 
-      it "should be idempotent when the response is initialized with valid data" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
+      should "should be idempotent when the response is initialized with valid data" do
+        response = OneLogin::RubySaml::Response.new(response_document_4)
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
         response.settings = settings
-        response.settings.idp_cert_fingerprint = signature_fingerprint_valid_res
+        settings.idp_cert_fingerprint = signature_fingerprint_1
         assert response.is_valid?
         assert response.is_valid?
       end
 
-      it "return true when valid response and using fingerprint" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = "4B:68:C4:53:C7:D9:94:AA:D9:02:5C:99:D5:EF:CF:56:62:87:FE:8D"
-        assert response.is_valid?
-      end
-
-      it "return true when valid response using certificate" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
+      should "return true when using certificate instead of fingerprint" do
+        response = OneLogin::RubySaml::Response.new(response_document_4)
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
         response.settings = settings
-        settings.idp_cert = valid_cert
+        settings.idp_cert = signature_1
         assert response.is_valid?
       end
 
-      it "not allow signature wrapping attack" do
+      should "not allow signature wrapping attack" do
         response = OneLogin::RubySaml::Response.new(response_document_4)
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
         settings.idp_cert_fingerprint = signature_fingerprint_1
         response.settings = settings
-        assert !response.is_valid?
+        assert response.is_valid?
         assert response.name_id == "test@onelogin.com"
       end
 
-      it "not allow element wrapping attack" do
-        response_wrapped = OneLogin::RubySaml::Response.new(response_document_wrapped)
-        response_wrapped.stubs(:conditions).returns(nil)
-        response_wrapped.stubs(:validate_subject_confirmation).returns(true)
-        settings = OneLogin::RubySaml::Settings.new
-        response_wrapped.settings = settings
-        response_wrapped.settings.idp_cert_fingerprint = signature_fingerprint_1
-
-        assert !response_wrapped.is_valid?
-        assert_nil response_wrapped.name_id
-      end
-
-      it "support dynamic namespace resolution on signature elements" do
+      should "support dynamic namespace resolution on signature elements" do
         response = OneLogin::RubySaml::Response.new(fixture("no_signature_ns.xml"))
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
@@ -218,52 +132,7 @@ class ResponseTest <  Minitest::Test
         assert response.validate!
       end
 
-      it "support signature elements with no KeyInfo if cert provided" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed_without_x509certificate)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = ruby_saml_cert
-        settings.idp_cert_fingerprint = nil
-        XMLSecurity::SignedDocument.any_instance.expects(:validate_signature).returns(true)
-        assert response.validate!
-      end
-
-      it "support signature elements with no KeyInfo if cert provided as text" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed_without_x509certificate)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = ruby_saml_cert_text
-        settings.idp_cert_fingerprint = nil
-        XMLSecurity::SignedDocument.any_instance.expects(:validate_signature).returns(true)
-        assert response.validate!
-      end
-
-      it "returns an error if the signature contains no KeyInfo, cert is not provided and soft" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed_without_x509certificate)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
-        assert !response.is_valid?
-      end
-
-      it "raises an exception if the signature contains no KeyInfo, cert is not provided and no soft" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed_without_x509certificate)
-        response.stubs(:conditions).returns(nil)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.validate!
-        end
-        assert_equal "Certificate element missing in response (ds:X509Certificate) and not cert provided at settings", err.message
-      end
-
-      it "validate ADFS assertions" do
+      should "validate ADFS assertions" do
         response = OneLogin::RubySaml::Response.new(fixture(:adfs_response_sha256))
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
@@ -272,7 +141,7 @@ class ResponseTest <  Minitest::Test
         assert response.validate!
       end
 
-      it "validate the digest" do
+      should "validate the digest" do
         response = OneLogin::RubySaml::Response.new(r1_response_document_6)
         response.stubs(:conditions).returns(nil)
         settings = OneLogin::RubySaml::Settings.new
@@ -281,75 +150,19 @@ class ResponseTest <  Minitest::Test
         assert response.validate!
       end
 
-      it "Prevent node text with comment (VU#475445) attack" do
-        response_doc = File.read(File.join(File.dirname(__FILE__), "responses", 'response_node_text_attack.xml.base64'))
-        response = OneLogin::RubySaml::Response.new(response_doc)
-
-        assert_equal "support@onelogin.com", response.name_id
-        assert_equal "smith", response.attributes["surname"]
-      end
-
-      describe '#validate_audience' do
-        it "return true when sp_entity_id not set or empty" do
-          response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-          response.stubs(:conditions).returns(nil)
-          settings = OneLogin::RubySaml::Settings.new
-          response.settings = settings
-          settings.idp_cert_fingerprint = signature_fingerprint_valid_res
-          assert response.is_valid?
-          settings.sp_entity_id = ''
-          assert response.is_valid?
-        end
-
-        it "return false when sp_entity_id set to incorrectly" do
-          response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-          response.stubs(:conditions).returns(nil)
-          settings = OneLogin::RubySaml::Settings.new
-          response.settings = settings
-          settings.idp_cert_fingerprint = signature_fingerprint_valid_res
-          settings.sp_entity_id = 'wrong_audience'
-          assert !response.is_valid?
-        end
-
-        it "return true when sp_entity_id set to correctly" do
-          response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-          response.stubs(:conditions).returns(nil)
-          settings = OneLogin::RubySaml::Settings.new
-          response.settings = settings
-          settings.idp_cert_fingerprint = signature_fingerprint_valid_res
-          settings.sp_entity_id = 'https://someone.example.com/audience'
-          assert response.is_valid?
-        end
-      end
-    end
-
-    describe "#validate_issuer" do
-      it "return true when the issuer of the Message/Assertion matches the IdP entityId" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        response.settings = settings
-        assert response.send(:validate_issuer)
-
-        response.settings.idp_entity_id = 'https://app.onelogin.com/saml2'
-        assert response.send(:validate_issuer)
-      end
-
-      it "return false when the issuer of the Message does not match the IdP entityId" do
-        response = OneLogin::RubySaml::Response.new(read_invalid_response("invalid_issuer_message.xml.base64"))
-        response.settings = settings
-        response.settings.idp_entity_id = 'http://idp.example.com/'
-        assert !response.send(:validate_issuer)
-      end
-
-      it "return false when the issuer of the Assertion does not match the IdP entityId" do
-        response = OneLogin::RubySaml::Response.new(read_invalid_response("invalid_issuer_assertion.xml.base64"))
+      should "validate SAML 2.0 XML structure" do
+        resp_xml = Base64.decode64(response_document_4).gsub(/emailAddress/,'test')
+        response = OneLogin::RubySaml::Response.new(Base64.encode64(resp_xml))
+        response.stubs(:conditions).returns(nil)
+        settings = OneLogin::RubySaml::Settings.new
+        settings.idp_cert_fingerprint = signature_fingerprint_1
         response.settings = settings
-        response.settings.idp_entity_id = 'http://idp.example.com/'
-        assert !response.send(:validate_issuer)
+        assert_raises(OneLogin::RubySaml::ValidationError, 'Digest mismatch'){ response.validate! }
       end
     end
 
-    describe "#name_id" do
-      it "extract the value of the name id element" do
+    context "#name_id" do
+      should "extract the value of the name id element" do
         response = OneLogin::RubySaml::Response.new(response_document)
         assert_equal "support@onelogin.com", response.name_id
 
@@ -357,19 +170,19 @@ class ResponseTest <  Minitest::Test
         assert_equal "someone@example.com", response.name_id
       end
 
-      it "be extractable from an OpenSAML response" do
+      should "be extractable from an OpenSAML response" do
         response = OneLogin::RubySaml::Response.new(fixture(:open_saml))
         assert_equal "someone@example.org", response.name_id
       end
 
-      it "be extractable from a Simple SAML PHP response" do
+      should "be extractable from a Simple SAML PHP response" do
         response = OneLogin::RubySaml::Response.new(fixture(:simple_saml_php))
         assert_equal "someone@example.com", response.name_id
       end
     end
 
-    describe "#check_conditions" do
-      it "check time conditions" do
+    context "#check_conditions" do
+      should "check time conditions" do
         response = OneLogin::RubySaml::Response.new(response_document)
         assert !response.send(:validate_conditions, true)
         response = OneLogin::RubySaml::Response.new(response_document_6)
@@ -380,290 +193,187 @@ class ResponseTest <  Minitest::Test
         assert response.send(:validate_conditions, true)
       end
 
-      it "optionally allow for clock drift" do
+      should "optionally allow for clock drift" do
         # The NotBefore condition in the document is 2011-06-14T18:21:01.516Z
-        expected_time = Time.parse("2011-06-14T18:21:01Z")
-        Time.stubs(:now).returns(expected_time)
+        Time.stubs(:now).returns(Time.parse("2011-06-14T18:21:01Z"))
         response = OneLogin::RubySaml::Response.new(response_document_5, :allowed_clock_drift => 0.515)
         assert !response.send(:validate_conditions, true)
 
-        expected_time = Time.parse("2011-06-14T18:21:01Z")
-        Time.stubs(:now).returns(expected_time)
+        Time.stubs(:now).returns(Time.parse("2011-06-14T18:21:01Z"))
         response = OneLogin::RubySaml::Response.new(response_document_5, :allowed_clock_drift => 0.516)
         assert response.send(:validate_conditions, true)
       end
     end
 
-    describe "validate_signature" do
-      it "raises an exception when no cert or fingerprint provided" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = nil
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.send(:validate_signature, false)
-        end
-        assert_equal "No fingerprint or certificate on settings", err.message
+    context "#attributes" do
+      should "extract the first attribute in a hash accessed via its symbol" do
+        response = OneLogin::RubySaml::Response.new(response_document)
+        assert_equal "demo", response.attributes[:uid]
       end
 
-      it "raises an exception when wrong cert provided" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = ruby_saml_cert2
-        settings.idp_cert_fingerprint = nil
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.send(:validate_signature, false)
-        end
-        assert_equal "Fingerprint mismatch", err.message
+      should "extract the first attribute in a hash accessed via its name" do
+        response = OneLogin::RubySaml::Response.new(response_document)
+        assert_equal "demo", response.attributes["uid"]
       end
 
-      it "raises an exception when wrong fingerprint provided" do
-        response = OneLogin::RubySaml::Response.new(response_document_valid_signed)
-        settings = OneLogin::RubySaml::Settings.new
-        response.settings = settings
-        settings.idp_cert = nil
-        settings.idp_cert_fingerprint = "28:74:9B:E8:1F:E8:10:9C:A8:7C:A9:C3:E3:C5:01:6C:92:1C:B4:BA"
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response.send(:validate_signature, false)
-        end
-        assert_equal "Fingerprint mismatch", err.message
+      should "extract all attributes" do
+        response = OneLogin::RubySaml::Response.new(response_document)
+        assert_equal "demo", response.attributes[:uid]
+        assert_equal "value", response.attributes[:another_value]
       end
 
-      it "raises an exception when no signature" do
-        response_no_signed_elements = OneLogin::RubySaml::Response.new(read_invalid_response("no_signature.xml.base64"))
-        settings.idp_cert_fingerprint = signature_fingerprint_1
-        response_no_signed_elements.settings = settings
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response_no_signed_elements.validate!
-        end
-        assert_equal "Found an unexpected number of Signature Element. SAML Response rejected", err.message
+      should "work for implicit namespaces" do
+        response = OneLogin::RubySaml::Response.new(response_document_3)
+        assert_equal "someone@example.com", response.attributes["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
       end
-    end
 
-    describe "#attributes" do
-      before do
-        @response = OneLogin::RubySaml::Response.new(response_document)
+      should "not raise errors about nil/empty attributes for EncryptedAttributes" do
+        response = OneLogin::RubySaml::Response.new(response_document_7)
+        assert_equal 'Demo', response.attributes["first_name"]
       end
 
-      it "extract the first attribute in a hash accessed via its symbol" do
-        assert_equal "demo", @response.attributes[:uid]
+      should "not raise on responses without attributes" do
+        response = OneLogin::RubySaml::Response.new(response_document_4)
+        assert_equal OneLogin::RubySaml::Attributes.new, response.attributes
       end
 
-      it "extract the first attribute in a hash accessed via its name" do
-        assert_equal "demo", @response.attributes["uid"]
-      end
+      context "#multiple values" do
+        should "extract single value as string" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal "demo", response.attributes[:uid]
+        end
 
-      it "extract all attributes" do
-        assert_equal "demo", @response.attributes[:uid]
-        assert_equal "value", @response.attributes[:another_value]
-      end
+        should "extract single value as string in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal ["demo"], response.attributes[:uid]
+          # classes are not reloaded between tests so restore default
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
 
-      it "work for implicit namespaces" do
-        response_3 = OneLogin::RubySaml::Response.new(response_document_3)
-        assert_equal "someone@example.com", response_3.attributes["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
-      end
+        should "extract first of multiple values as string for b/w compatibility" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal 'value1', response.attributes[:another_value]
+        end
 
-      it "not raise on responses without attributes" do
-        response_4 = OneLogin::RubySaml::Response.new(response_document_4)
-        assert_equal OneLogin::RubySaml::Attributes.new, response_4.attributes
-      end
+        should "extract first of multiple values as string for b/w compatibility in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal ['value1', 'value2'], response.attributes[:another_value]
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
 
-      it "extract attributes from all AttributeStatement tags" do
-        assert_equal "smith", response_with_multiple_attribute_statements.attributes[:surname]
-        assert_equal "bob", response_with_multiple_attribute_statements.attributes[:firstname]
-      end
+        should "return array with all attributes when asked in XML order" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal ['value1', 'value2'], response.attributes.multi(:another_value)
+        end
 
-      it "be manipulable by hash methods such as #merge and not raise an exception" do
-        @response.attributes.merge({ :testing_attribute => "test" })
-      end
+        should "return array with all attributes when asked in XML order in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal ['value1', 'value2'], response.attributes.multi(:another_value)
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
 
-      it "be manipulable by hash methods such as #shift and not raise an exception" do
-        @response.attributes.shift
-      end
+        should "return first of multiple values when multiple Attribute tags in XML" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal 'role1', response.attributes[:role]
+        end
 
-      it "be manipulable by hash methods such as #merge! and actually contain the value" do
-        @response.attributes.merge!({ :testing_attribute => "test" })
-        assert @response.attributes[:testing_attribute]
-      end
+        should "return first of multiple values when multiple Attribute tags in XML in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal ['role1', 'role2', 'role3'], response.attributes[:role]
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
+
+        should "return all of multiple values in reverse order when multiple Attribute tags in XML" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal ['role1', 'role2', 'role3'], response.attributes.multi(:role)
+        end
+
+        should "return all of multiple values in reverse order when multiple Attribute tags in XML in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal ['role1', 'role2', 'role3'], response.attributes.multi(:role)
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
+
+        should "return nil value correctly" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_nil response.attributes[:attribute_with_nil_value]
+        end
+
+        should "return nil value correctly when not in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal [nil], response.attributes[:attribute_with_nil_value]
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
+
+        should "return multiple values including nil and empty string" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal ["", "valuePresent", nil, nil], response.attributes.multi(:attribute_with_nils_and_empty_strings)
+        end
+
+        should "return multiple values from [] when not in compatibility mode off" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal ["", "valuePresent", nil, nil], response.attributes[:attribute_with_nils_and_empty_strings]
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
+
+        should "check what happens when trying retrieve attribute that does not exists" do
+          response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
+          assert_equal nil, response.attributes[:attribute_not_exists]
+          assert_equal nil, response.attributes.single(:attribute_not_exists)
+          assert_equal nil, response.attributes.multi(:attribute_not_exists)
+
+          OneLogin::RubySaml::Attributes.single_value_compatibility = false
+          assert_equal nil, response.attributes[:attribute_not_exists]
+          assert_equal nil, response.attributes.single(:attribute_not_exists)
+          assert_equal nil, response.attributes.multi(:attribute_not_exists)
+          OneLogin::RubySaml::Attributes.single_value_compatibility = true
+        end
 
-      it "be manipulable by hash methods such as #shift and actually remove the value" do
-        removed_value = @response.attributes.shift
-        assert_nil @response.attributes[removed_value[0]]
       end
     end
 
-    describe "#session_expires_at" do
-      it "extract the value of the SessionNotOnOrAfter attribute" do
+    context "#session_expires_at" do
+      should "extract the value of the SessionNotOnOrAfter attribute" do
         response = OneLogin::RubySaml::Response.new(response_document)
         assert response.session_expires_at.is_a?(Time)
 
         response = OneLogin::RubySaml::Response.new(response_document_2)
-        assert response.session_expires_at.nil?
+        assert_nil response.session_expires_at
       end
     end
 
-    describe "#issuer" do
-      it "return the issuer inside the response assertion" do
+    context "#issuer" do
+      should "return the issuer inside the response assertion" do
         response = OneLogin::RubySaml::Response.new(response_document)
         assert_equal "https://app.onelogin.com/saml/metadata/13590", response.issuer
       end
 
-      it "return the issuer inside the response" do
+      should "return the issuer inside the response" do
         response = OneLogin::RubySaml::Response.new(response_document_2)
         assert_equal "wibble", response.issuer
       end
     end
 
-    describe "#success" do
-      it "find a status code that says success" do
+    context "#success" do
+      should "find a status code that says success" do
         response = OneLogin::RubySaml::Response.new(response_document)
-        assert response.send(:success?)
+        response.success?
       end
     end
 
-    describe '#xpath_first_from_signed_assertion' do
-      it 'not allow arbitrary code execution' do
+    context '#xpath_first_from_signed_assertion' do
+      should 'not allow arbitrary code execution' do
         malicious_response_document = fixture('response_eval', false)
         response = OneLogin::RubySaml::Response.new(malicious_response_document)
         response.send(:xpath_first_from_signed_assertion)
-        assert_nil $evalled
-      end
-    end
-
-    describe "#multiple values" do
-      it "extract single value as string" do
-        assert_equal "demo", response_multiple_attr_values.attributes[:uid]
-      end
-
-      it "extract single value as string in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ["demo"], response_multiple_attr_values.attributes[:uid]
-        # classes are not reloaded between tests so restore default
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "extract first of multiple values as string for b/w compatibility" do
-        assert_equal 'value1', response_multiple_attr_values.attributes[:another_value]
-      end
-
-      it "extract first of multiple values as string for b/w compatibility in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ['value1', 'value2'], response_multiple_attr_values.attributes[:another_value]
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "return array with all attributes when asked in XML order" do
-        assert_equal ['value1', 'value2'], response_multiple_attr_values.attributes.multi(:another_value)
-      end
-
-      it "return array with all attributes when asked in XML order in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ['value1', 'value2'], response_multiple_attr_values.attributes.multi(:another_value)
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "return first of multiple values when multiple Attribute tags in XML" do
-        assert_equal 'role1', response_multiple_attr_values.attributes[:role]
-      end
-
-      it "return first of multiple values when multiple Attribute tags in XML in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ['role1', 'role2', 'role3'], response_multiple_attr_values.attributes[:role]
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "return all of multiple values in reverse order when multiple Attribute tags in XML" do
-        assert_equal ['role1', 'role2', 'role3'], response_multiple_attr_values.attributes.multi(:role)
-      end
-
-      it "return all of multiple values in reverse order when multiple Attribute tags in XML in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ['role1', 'role2', 'role3'], response_multiple_attr_values.attributes.multi(:role)
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "return all of multiple values when multiple Attribute tags in multiple AttributeStatement tags" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ['role1', 'role2', 'role3'], response_with_multiple_attribute_statements.attributes.multi(:role)
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "return nil value correctly" do
-        assert_nil response_multiple_attr_values.attributes[:attribute_with_nil_value]
-      end
-
-      it "return nil value correctly when not in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert [nil] == response_multiple_attr_values.attributes[:attribute_with_nil_value]
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "return multiple values including nil and empty string" do
-        response = OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values))
-        assert_equal ["", "valuePresent", nil, nil], response.attributes.multi(:attribute_with_nils_and_empty_strings)
-      end
-
-      it "return multiple values from [] when not in compatibility mode off" do
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_equal ["", "valuePresent", nil, nil], response_multiple_attr_values.attributes[:attribute_with_nils_and_empty_strings]
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-
-      it "check what happens when trying retrieve attribute that does not exists" do
-        assert_nil response_multiple_attr_values.attributes[:attribute_not_exists]
-        assert_nil response_multiple_attr_values.attributes.single(:attribute_not_exists)
-        assert_nil response_multiple_attr_values.attributes.multi(:attribute_not_exists)
-
-        OneLogin::RubySaml::Attributes.single_value_compatibility = false
-        assert_nil response_multiple_attr_values.attributes[:attribute_not_exists]
-        assert_nil response_multiple_attr_values.attributes.single(:attribute_not_exists)
-        assert_nil response_multiple_attr_values.attributes.multi(:attribute_not_exists)
-        OneLogin::RubySaml::Attributes.single_value_compatibility = true
-      end
-    end
-
-    describe "signature wrapping attack with encrypted assertion" do
-      it "should not be valid" do
-        settings = OneLogin::RubySaml::Settings.new
-        settings.private_key = valid_key
-        signature_wrapping_attack = read_response("encrypted_new_attack.xml.base64")
-        response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
-        response_wrapped.stubs(:conditions).returns(nil)
-        response_wrapped.stubs(:validate_subject_confirmation).returns(true)
-        settings.idp_cert_fingerprint = "385b1eec71143f00db6af936e2ea12a28771d72c"
-        assert !response_wrapped.is_valid?
-        err = assert_raises(OneLogin::RubySaml::ValidationError) do
-          response_wrapped.validate!
-        end
-        assert_equal "Found an invalid Signed Element. SAML Response rejected", err.message
-      end
-    end
-
-    describe "signature wrapping attack - concealed SAML response body" do
-      it "should not be valid" do
-        settings = OneLogin::RubySaml::Settings.new
-        signature_wrapping_attack = read_response("response_with_concealed_signed_assertion.xml")
-        response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
-        settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
-        response_wrapped.stubs(:conditions).returns(nil)
-        response_wrapped.stubs(:validate_subject_confirmation).returns(true)
-        response_wrapped.stubs(:validate_structure).returns(true)
-        assert !response_wrapped.is_valid?
-        assert !response_wrapped.validate!
-      end
-    end
-
-    describe "signature wrapping attack - doubled signed assertion SAML response" do
-      it "should not be valid" do
-        settings = OneLogin::RubySaml::Settings.new
-        signature_wrapping_attack = read_response("response_with_doubled_signed_assertion.xml")
-        response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
-        settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
-        response_wrapped.stubs(:conditions).returns(nil)
-        response_wrapped.stubs(:validate_subject_confirmation).returns(true)
-        assert !response_wrapped.is_valid?
+        assert_equal($evalled, nil)
       end
     end
   end