ruby-saml 1.11.0 → 1.12.0

data/test/settings_test.rb

@@ -1,338 +0,0 @@
-require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
-
-require 'onelogin/ruby-saml/settings'
-require 'onelogin/ruby-saml/validation_error'
-
-class SettingsTest < Minitest::Test
-
-  describe "Settings" do
-    before do
-      @settings = OneLogin::RubySaml::Settings.new
-    end
-
-    it "should provide getters and settings" do
-      accessors = [
-        :idp_entity_id, :idp_sso_target_url, :idp_slo_target_url, :valid_until,
-        :idp_cert, :idp_cert_fingerprint, :idp_cert_fingerprint_algorithm, :idp_cert_multi,
-        :idp_attribute_names, :issuer, :assertion_consumer_service_url, :assertion_consumer_service_binding,
-        :single_logout_service_url, :single_logout_service_binding,
-        :sp_name_qualifier, :name_identifier_format, :name_identifier_value, :name_identifier_value_requested,
-        :sessionindex, :attributes_index, :passive, :force_authn,
-        :compress_request, :double_quote_xml_attribute_values, :protocol_binding,
-        :security, :certificate, :private_key,
-        :authn_context, :authn_context_comparison, :authn_context_decl_ref,
-        :assertion_consumer_logout_service_url,
-        :assertion_consumer_logout_service_binding
-      ]
-
-      accessors.each do |accessor|
-        value = Kernel.rand
-        @settings.send("#{accessor}=".to_sym, value)
-        assert_equal value, @settings.send(accessor)
-      end
-
-    end
-
-    it "create settings from hash" do
-      config = {
-          :assertion_consumer_service_url => "http://app.muda.no/sso",
-          :issuer => "http://muda.no",
-          :sp_name_qualifier => "http://sso.muda.no",
-          :idp_sso_target_url => "http://sso.muda.no/sso",
-          :idp_slo_target_url => "http://sso.muda.no/slo",
-          :idp_cert_fingerprint => "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00",
-          :valid_until => '2029-04-16T03:35:08.277Z',
-          :name_identifier_format => "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
-          :attributes_index => 30,
-          :passive => true,
-          :protocol_binding => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'
-      }
-      @settings = OneLogin::RubySaml::Settings.new(config)
-
-      config.each do |k,v|
-        assert_equal v, @settings.send(k)
-      end
-    end
-
-    it "configure attribute service attributes correctly" do
-      @settings.attribute_consuming_service.configure do
-        service_name "Test Service"
-        add_attribute :name => "Name", :name_format => "Name Format", :friendly_name => "Friendly Name"
-      end
-
-      assert_equal @settings.attribute_consuming_service.configured?, true
-      assert_equal @settings.attribute_consuming_service.name, "Test Service"
-      assert_equal @settings.attribute_consuming_service.attributes, [{:name => "Name", :name_format => "Name Format", :friendly_name => "Friendly Name" }]
-    end
-
-    it "does not modify default security settings" do
-      settings = OneLogin::RubySaml::Settings.new
-      settings.security[:authn_requests_signed] = true
-      settings.security[:embed_sign] = true
-      settings.security[:digest_method] = XMLSecurity::Document::SHA256
-      settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
-
-      new_settings = OneLogin::RubySaml::Settings.new
-      assert_equal new_settings.security[:authn_requests_signed], false
-      assert_equal new_settings.security[:embed_sign], false
-      assert_equal new_settings.security[:digest_method], XMLSecurity::Document::SHA1
-      assert_equal new_settings.security[:signature_method], XMLSecurity::Document::RSA_SHA1
-    end
-
-    it "overrides only provided security attributes passing a second parameter" do
-      config = {
-        :security => {
-          :metadata_signed => true
-        }
-      }
-
-      @default_attributes = OneLogin::RubySaml::Settings::DEFAULTS
-
-      @settings = OneLogin::RubySaml::Settings.new(config, true)
-      assert_equal @settings.security[:metadata_signed], true
-      assert_equal @settings.security[:digest_method], @default_attributes[:security][:digest_method]
-    end
-
-    it "doesn't override only provided security attributes without passing a second parameter" do
-      config = {
-        :security => {
-          :metadata_signed => true
-        }
-      }
-
-      @default_attributes = OneLogin::RubySaml::Settings::DEFAULTS
-
-      @settings = OneLogin::RubySaml::Settings.new(config)
-      assert_equal @settings.security[:metadata_signed], true
-      assert_nil @settings.security[:digest_method]
-    end
-
-    describe "#single_logout_service_url" do
-      it "when single_logout_service_url is nil but assertion_consumer_logout_service_url returns its value" do
-        @settings.single_logout_service_url = nil
-        @settings.assertion_consumer_logout_service_url = "http://app.muda.no/sls"
-
-        assert_equal "http://app.muda.no/sls", @settings.single_logout_service_url
-      end
-    end
-
-    describe "#single_logout_service_binding" do
-      it "when single_logout_service_binding is nil but assertion_consumer_logout_service_binding returns its value" do
-        @settings.single_logout_service_binding = nil
-        @settings.assertion_consumer_logout_service_binding = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
-
-        assert_equal "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect", @settings.single_logout_service_binding
-      end
-    end
-
-    describe "#get_idp_cert" do
-      it "returns nil when the cert is an empty string" do
-        @settings.idp_cert = ""
-        assert_nil @settings.get_idp_cert
-      end
-
-      it "returns nil when the cert is nil" do
-        @settings.idp_cert = nil
-        assert_nil @settings.get_idp_cert
-      end
-
-      it "returns the certificate when it is valid" do
-        @settings.idp_cert = ruby_saml_cert_text
-        assert @settings.get_idp_cert.kind_of? OpenSSL::X509::Certificate
-      end
-
-      it "raises when the certificate is not valid" do
-        # formatted but invalid cert
-        @settings.idp_cert = read_certificate("formatted_certificate")
-        assert_raises(OpenSSL::X509::CertificateError) {
-          @settings.get_idp_cert
-        }
-      end
-    end
-
-    describe "#get_idp_cert_multi" do
-      it "returns nil when the value is empty" do
-        @settings.idp_cert = {}
-        assert_nil @settings.get_idp_cert_multi
-      end
-
-      it "returns nil when the idp_cert_multi is nil or empty" do
-        @settings.idp_cert_multi = nil
-        assert_nil @settings.get_idp_cert_multi
-      end
-
-      it "returns partial hash when contains some values" do
-        empty_multi = {
-          :signing => [],
-          :encryption => []
-        }
-
-        @settings.idp_cert_multi = {
-          :signing => []
-        }
-        assert_equal empty_multi, @settings.get_idp_cert_multi
-
-        @settings.idp_cert_multi = {
-          :encryption => []
-        }
-        assert_equal empty_multi, @settings.get_idp_cert_multi
-
-        @settings.idp_cert_multi = {
-          :signing => [],
-          :encryption => []
-        }
-        assert_equal empty_multi, @settings.get_idp_cert_multi
-
-        @settings.idp_cert_multi = {
-          :yyy => [],
-          :zzz => []
-        }
-        assert_equal empty_multi, @settings.get_idp_cert_multi
-      end
-
-      it "returns the hash with certificates when values were valid" do
-        certificates = ruby_saml_cert_text
-        @settings.idp_cert_multi = {
-          :signing => [ruby_saml_cert_text],
-          :encryption => [ruby_saml_cert_text],
-        }
-
-        assert @settings.get_idp_cert_multi.kind_of? Hash
-        assert @settings.get_idp_cert_multi[:signing].kind_of? Array
-        assert @settings.get_idp_cert_multi[:encryption].kind_of? Array
-        assert @settings.get_idp_cert_multi[:signing][0].kind_of? OpenSSL::X509::Certificate
-        assert @settings.get_idp_cert_multi[:encryption][0].kind_of? OpenSSL::X509::Certificate
-      end
-
-      it "raises when there is a cert in idp_cert_multi not valid" do
-        certificate = read_certificate("formatted_certificate")
-
-        @settings.idp_cert_multi = {
-          :signing => [],
-          :encryption => []
-        }
-        @settings.idp_cert_multi[:signing].push(certificate)
-        @settings.idp_cert_multi[:encryption].push(certificate)
-
-        assert_raises(OpenSSL::X509::CertificateError) {
-          @settings.get_idp_cert_multi
-        }
-      end
-    end
-
-    describe "#get_sp_cert" do
-      it "returns nil when the cert is an empty string" do
-        @settings.certificate = ""
-        assert_nil @settings.get_sp_cert
-      end
-
-      it "returns nil when the cert is nil" do
-        @settings.certificate = nil
-        assert_nil @settings.get_sp_cert
-      end
-
-      it "returns the certificate when it is valid" do
-        @settings.certificate = ruby_saml_cert_text
-        assert @settings.get_sp_cert.kind_of? OpenSSL::X509::Certificate
-      end
-
-      it "raises when the certificate is not valid" do
-        # formatted but invalid cert
-        @settings.certificate = read_certificate("formatted_certificate")
-        assert_raises(OpenSSL::X509::CertificateError) {
-          @settings.get_sp_cert
-        }
-      end
-
-      it "raises an error if SP certificate expired and check_sp_cert_expiration enabled" do
-        @settings.certificate = ruby_saml_cert_text
-        @settings.security[:check_sp_cert_expiration] = true
-        assert_raises(OneLogin::RubySaml::ValidationError) {
-          settings.get_sp_cert
-        }
-      end
-    end
-
-    describe "#get_sp_cert_new" do
-      it "returns nil when the cert is an empty string" do
-        @settings.certificate_new = ""
-        assert_nil @settings.get_sp_cert_new
-      end
-
-      it "returns nil when the cert is nil" do
-        @settings.certificate_new = nil
-        assert_nil @settings.get_sp_cert_new
-      end
-
-      it "returns the certificate when it is valid" do
-        @settings.certificate_new = ruby_saml_cert_text
-        assert @settings.get_sp_cert_new.kind_of? OpenSSL::X509::Certificate
-      end
-
-      it "raises when the certificate is not valid" do
-        # formatted but invalid cert
-        @settings.certificate_new = read_certificate("formatted_certificate")
-        assert_raises(OpenSSL::X509::CertificateError) {
-          @settings.get_sp_cert_new
-        }
-      end
-
-    end
-
-    describe "#get_sp_key" do
-      it "returns nil when the private key is an empty string" do
-        @settings.private_key = ""
-        assert_nil @settings.get_sp_key
-      end
-
-      it "returns nil when the private key is nil" do
-        @settings.private_key = nil
-        assert_nil @settings.get_sp_key
-      end
-
-      it "returns the private key when it is valid" do
-        @settings.private_key = ruby_saml_key_text
-        assert @settings.get_sp_key.kind_of? OpenSSL::PKey::RSA
-      end
-
-      it "raises when the private key is not valid" do
-        # formatted but invalid rsa private key
-        @settings.private_key = read_certificate("formatted_rsa_private_key")
-        assert_raises(OpenSSL::PKey::RSAError) {
-          @settings.get_sp_key
-        }
-      end
-
-    end
-
-    describe "#get_fingerprint" do
-      it "get the fingerprint value when cert and fingerprint in settings are nil" do
-        @settings.idp_cert_fingerprint = nil
-        @settings.idp_cert = nil
-        fingerprint = @settings.get_fingerprint
-        assert_nil fingerprint
-      end
-
-      it "get the fingerprint value when there is a cert at the settings" do
-        @settings.idp_cert_fingerprint = nil
-        @settings.idp_cert = ruby_saml_cert_text
-        fingerprint = @settings.get_fingerprint
-        assert fingerprint.downcase == ruby_saml_cert_fingerprint.downcase
-      end
-
-      it "get the fingerprint value when there is a fingerprint at the settings" do
-        @settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
-        @settings.idp_cert = nil
-        fingerprint = @settings.get_fingerprint
-        assert fingerprint.downcase == ruby_saml_cert_fingerprint.downcase
-      end
-
-      it "get the fingerprint value when there are cert and fingerprint at the settings" do
-        @settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
-        @settings.idp_cert = ruby_saml_cert_text
-        fingerprint = @settings.get_fingerprint
-        assert fingerprint.downcase == ruby_saml_cert_fingerprint.downcase
-      end
-    end
-  end
-end

data/test/slo_logoutrequest_test.rb

@@ -1,467 +0,0 @@
-require File.expand_path(File.join(File.dirname(__FILE__), "test_helper"))
-require 'logout_responses/logoutresponse_fixtures'
-
-require 'onelogin/ruby-saml/slo_logoutrequest'
-require 'timecop'
-
-class RubySamlTest < Minitest::Test
-
-  describe "SloLogoutrequest" do
-
-    let(:settings) { OneLogin::RubySaml::Settings.new }
-    let(:logout_request) { OneLogin::RubySaml::SloLogoutrequest.new(logout_request_document) }
-    let(:invalid_logout_request) { OneLogin::RubySaml::SloLogoutrequest.new(invalid_logout_request_document) }
-
-    before do
-      settings.idp_entity_id = 'https://app.onelogin.com/saml/metadata/SOMEACCOUNT'
-      settings.soft = true
-      logout_request.settings = settings
-      invalid_logout_request.settings = settings
-    end
-
-    describe "initiator" do
-      it "raise an exception when logout request is initialized with nil" do
-        assert_raises(ArgumentError) { OneLogin::RubySaml::SloLogoutrequest.new(nil) }
-      end
-    end
-
-    describe "#is_valid?" do
-      it "return false when logout request is initialized with blank data" do
-        logout_request_blank = OneLogin::RubySaml::SloLogoutrequest.new('')
-        assert !logout_request_blank.is_valid?
-        assert_includes logout_request_blank.errors, 'Blank logout request'
-      end
-
-      it "return true when the logout request is initialized with valid data" do
-        assert logout_request.is_valid?
-        assert_empty logout_request.errors
-        assert_equal 'someone@example.org', logout_request.nameid
-      end
-
-      it "should be idempotent when the logout request is initialized with invalid data" do
-        assert !invalid_logout_request.is_valid?
-        assert_equal ['Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd'], invalid_logout_request.errors
-        assert !invalid_logout_request.is_valid?
-        assert_equal ['Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd'], invalid_logout_request.errors
-      end
-
-      it "should be idempotent when the logout request is initialized with valid data" do
-        assert logout_request.is_valid?
-        assert_empty logout_request.errors
-        assert logout_request.is_valid?
-        assert_empty logout_request.errors
-      end
-
-      it "collect errors when collect_errors=true" do
-        settings.idp_entity_id = 'http://idp.example.com/invalid'
-        settings.idp_slo_target_url = "http://example.com?field=value"
-        settings.security[:logout_requests_signed] = true
-        settings.security[:embed_sign] = false
-        settings.certificate = ruby_saml_cert_text
-        settings.private_key = ruby_saml_key_text
-        settings.idp_cert = ruby_saml_cert_text
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        params = {}
-        params['SAMLRequest'] = logout_request_deflated_base64
-        params['RelayState'] = 'http://invalid.example.com'
-        params['Signature'] = 'invalid_signature'
-        params['SigAlg'] = XMLSecurity::Document::RSA_SHA1
-        options = {}
-        options[:get_params] = params
-
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        logout_request_sign_test.settings = settings
-
-        collect_errors = true
-        assert !logout_request_sign_test.is_valid?(collect_errors)
-        assert_includes logout_request_sign_test.errors,  "Invalid Signature on Logout Request"
-        assert_includes logout_request_sign_test.errors,  "Doesn't match the issuer, expected: <http://idp.example.com/invalid>, but was: <https://app.onelogin.com/saml/metadata/SOMEACCOUNT>"
-      end
-
-      it "raise error for invalid xml" do
-        invalid_logout_request.soft = false
-        assert_raises(OneLogin::RubySaml::ValidationError) { invalid_logout_request.is_valid? }
-      end
-
-    end
-
-    describe "#nameid" do
-      it "extract the value of the name id element" do
-        assert_equal "someone@example.org", logout_request.nameid
-      end
-    end
-
-    describe "#nameid_format" do
-      let(:logout_request) { OneLogin::RubySaml::SloLogoutrequest.new(logout_request_document_with_name_id_format) }
-
-      it "extract the format attribute of the name id element" do
-        assert_equal "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", logout_request.nameid_format
-      end
-    end
-
-    describe "#issuer" do
-      it "return the issuer inside the logout request" do
-        assert_equal "https://app.onelogin.com/saml/metadata/SOMEACCOUNT", logout_request.issuer
-      end
-    end
-
-    describe "#id" do
-      it "extract the value of the ID attribute" do
-        assert_equal "_c0348950-935b-0131-1060-782bcb56fcaa", logout_request.id
-      end
-    end
-
-   describe "#not_on_or_after" do
-      it "extract the value of the NotOnOrAfter attribute" do
-        time_value = '2014-07-17T01:01:48Z'
-        assert_nil logout_request.not_on_or_after
-        logout_request.document.root.attributes['NotOnOrAfter'] = time_value
-        assert_equal Time.parse(time_value), logout_request.not_on_or_after
-      end
-    end
-
-    describe '#session_indexes' do
-      it "return empty array when no SessionIndex" do
-        assert_equal [], logout_request.session_indexes
-      end
-
-      it "return an Array with one SessionIndex" do
-        logout_request_with_session_index = OneLogin::RubySaml::SloLogoutrequest.new(logout_request_xml_with_session_index)
-        assert_equal ['_ea853497-c58a-408a-bc23-c849752d9741'], logout_request_with_session_index.session_indexes
-      end
-    end
-
-    describe "#validate_id" do
-      it "return true when there is a valid ID in the logout request" do
-        assert logout_request.send(:validate_id)
-        assert_empty logout_request.errors
-      end
-
-      it "return false when there is an invalid ID in the logout request" do
-        logout_request_blank = OneLogin::RubySaml::SloLogoutrequest.new('')
-        assert !logout_request_blank.send(:validate_id)
-        assert_includes logout_request_blank.errors, "Missing ID attribute on Logout Request"
-      end
-    end
-
-    describe "#validate_version" do
-      it "return true when the logout request is SAML 2.0 Version" do
-        assert logout_request.send(:validate_version)
-      end
-
-      it "return false when the logout request is not SAML 2.0 Version" do
-        logout_request_blank = OneLogin::RubySaml::SloLogoutrequest.new('')
-        assert !logout_request_blank.send(:validate_version)
-        assert_includes logout_request_blank.errors, "Unsupported SAML version"
-      end
-    end
-
-    describe "#validate_not_on_or_after" do
-      it "return true when the logout request has a valid NotOnOrAfter or does not contain any" do
-        assert logout_request.send(:validate_not_on_or_after)
-        assert_empty logout_request.errors
-        Timecop.freeze Time.parse('2011-06-14T18:25:01.516Z') do
-          time_value = '2014-07-17T01:01:48Z'
-          logout_request.document.root.attributes['NotOnOrAfter'] = time_value
-          assert logout_request.send(:validate_not_on_or_after)
-          assert_empty logout_request.errors
-        end
-      end
-
-      it "return false when the logout request has an invalid NotOnOrAfter" do
-        logout_request.document.root.attributes['NotOnOrAfter'] = '2014-07-17T01:01:48Z'
-        assert !logout_request.send(:validate_not_on_or_after)
-        assert /Current time is on or after NotOnOrAfter/.match(logout_request.errors[0])
-      end
-
-      it "raise when the logout request has an invalid NotOnOrAfter" do
-        logout_request.document.root.attributes['NotOnOrAfter'] = '2014-07-17T01:01:48Z'
-        logout_request.soft = false
-        assert_raises(OneLogin::RubySaml::ValidationError, "Current time is on or after NotOnOrAfter") do
-          logout_request.send(:validate_not_on_or_after)
-        end
-      end
-    end
-
-    describe "#validate_request_state" do
-      it "return true when valid logout request xml" do
-        assert logout_request.send(:validate_request_state)
-        assert_empty logout_request.errors
-        assert logout_request.send(:validate_request_state)
-        assert_empty logout_request.errors
-      end
-
-      it "return false when invalid logout request xml" do
-        logout_request_blank = OneLogin::RubySaml::SloLogoutrequest.new('')
-        logout_request_blank.soft = true
-        assert !logout_request_blank.send(:validate_request_state)
-        assert_includes logout_request_blank.errors, "Blank logout request"
-      end
-
-      it "raise error for invalid xml" do
-        logout_request_blank = OneLogin::RubySaml::SloLogoutrequest.new('')
-        logout_request_blank.soft = false
-        assert_raises(OneLogin::RubySaml::ValidationError, "Blank logout request") do
-          logout_request_blank.send(:validate_request_state)
-        end
-      end
-    end
-
-    describe "#validate_structure" do
-      it "return true when encountering a valid Logout Request xml" do
-        assert logout_request.send(:validate_structure)
-        assert_empty logout_request.errors
-      end
-
-      it "return false when encountering a Logout Request bad formatted" do
-        assert !invalid_logout_request.send(:validate_structure)
-        assert_includes invalid_logout_request.errors, "Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd"
-      end
-
-      it "raise when encountering a Logout Request bad formatted" do
-        invalid_logout_request.soft = false
-        assert_raises(OneLogin::RubySaml::ValidationError, "Element '{urn:oasis:names:tc:SAML:2.0:assertion}Issuer': This element is not expected") do
-          invalid_logout_request.send(:validate_structure)
-        end
-      end
-    end
-
-    describe "#validate_issuer" do
-      it "return true when the issuer of the Logout Request matchs the IdP entityId" do
-        logout_request.settings.idp_entity_id = 'https://app.onelogin.com/saml/metadata/SOMEACCOUNT'
-        assert logout_request.send(:validate_issuer)
-      end
-      it "return false when the issuer of the Logout Request does not match the IdP entityId" do
-        logout_request.settings.idp_entity_id = 'http://idp.example.com/invalid'
-        assert !logout_request.send(:validate_issuer)
-        assert_includes logout_request.errors, "Doesn't match the issuer, expected: <#{logout_request.settings.idp_entity_id}>, but was: <https://app.onelogin.com/saml/metadata/SOMEACCOUNT>"
-      end
-      it "raise when the issuer of the Logout Request does not match the IdP entityId" do
-        logout_request.settings.idp_entity_id = 'http://idp.example.com/invalid'
-        logout_request.soft = false
-        assert_raises(OneLogin::RubySaml::ValidationError, "Doesn't match the issuer, expected: <#{logout_request.settings.idp_entity_id}>, but was: <https://app.onelogin.com/saml/metadata/SOMEACCOUNT>") do
-          logout_request.send(:validate_issuer)
-        end
-      end
-    end
-
-    describe "#validate_signature" do
-      before do
-        settings.idp_slo_target_url = "http://example.com?field=value"
-        settings.security[:logout_requests_signed] = true
-        settings.security[:embed_sign] = false
-        settings.certificate = ruby_saml_cert_text
-        settings.private_key = ruby_saml_key_text
-        settings.idp_cert = ruby_saml_cert_text
-      end
-
-      it "return true when no idp_cert is provided and option :relax_signature_validation is present" do
-        settings.idp_cert = nil
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = params[:RelayState]
-        options = {}
-        options[:get_params] = params
-        options[:relax_signature_validation] = true
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        logout_request_sign_test.settings = settings
-        assert logout_request_sign_test.send(:validate_signature)
-      end
-
-      it "return false when no idp_cert is provided and no option :relax_signature_validation is present" do
-        settings.idp_cert = nil
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = params[:RelayState]
-        options = {}
-        options[:get_params] = params
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        logout_request_sign_test.settings = settings
-        assert !logout_request_sign_test.send(:validate_signature)
-      end
-
-      it "return true when valid RSA_SHA1 Signature" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = params[:RelayState]
-        options = {}
-        options[:get_params] = params
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        logout_request_sign_test.settings = settings
-        assert logout_request_sign_test.send(:validate_signature)
-      end
-
-      it "return true when valid RSA_SHA256 Signature" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA256
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        options = {}
-        options[:get_params] = params
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        params['RelayState'] = params[:RelayState]
-        logout_request_sign_test.settings = settings
-        assert logout_request_sign_test.send(:validate_signature)
-      end
-
-      it "return false when invalid RSA_SHA1 Signature" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = 'http://invalid.example.com'
-        params[:RelayState] = params['RelayState']
-        options = {}
-        options[:get_params] = params
-
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        logout_request_sign_test.settings = settings
-        assert !logout_request_sign_test.send(:validate_signature)
-      end
-
-      it "raise when invalid RSA_SHA1 Signature" do
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        settings.soft = false
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = 'http://invalid.example.com'
-        params[:RelayState] = params['RelayState']
-        options = {}
-        options[:get_params] = params
-        options[:settings] = settings
-
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        assert_raises(OneLogin::RubySaml::ValidationError, "Invalid Signature on Logout Request") do
-          logout_request_sign_test.send(:validate_signature)
-        end
-      end
-
-      it "raise when get_params encoding differs from what this library generates" do
-        # Use Logoutrequest only to build the SAMLRequest parameter.
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        settings.soft = false
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, "RelayState" => "http://example.com")
-        # Assemble query string.
-        query = OneLogin::RubySaml::Utils.build_query(
-          :type => 'SAMLRequest',
-          :data => params['SAMLRequest'],
-          :relay_state => params['RelayState'],
-          :sig_alg => params['SigAlg']
-        )
-        # Modify the query string so that it encodes the same values,
-        # but with different percent-encoding. Sanity-check that they
-        # really are equialent before moving on.
-        original_query = query.dup
-        query.gsub!("example", "ex%61mple")
-        refute_equal(query, original_query)
-        assert_equal(CGI.unescape(query), CGI.unescape(original_query))
-        # Make normalised signature based on our modified params.
-        sign_algorithm = XMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method])
-        signature = settings.get_sp_key.sign(sign_algorithm.new, query)
-        params['Signature'] = Base64.encode64(signature).gsub(/\n/, "")
-        # Construct SloLogoutrequest and ask it to validate the signature.
-        # It will do it incorrectly, because it will compute it based on re-encoded
-        # query parameters, rather than their original encodings.
-        options = {}
-        options[:get_params] = params
-        options[:settings] = settings
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        assert_raises(OneLogin::RubySaml::ValidationError, "Invalid Signature on Logout Request") do
-          logout_request_sign_test.send(:validate_signature)
-        end
-      end
-
-      it "return true even if raw_get_params encoding differs from what this library generates" do
-        # Use Logoutrequest only to build the SAMLRequest parameter.
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-        settings.soft = false
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, "RelayState" => "http://example.com")
-        # Assemble query string.
-        query = OneLogin::RubySaml::Utils.build_query(
-          :type => 'SAMLRequest',
-          :data => params['SAMLRequest'],
-          :relay_state => params['RelayState'],
-          :sig_alg => params['SigAlg']
-        )
-        # Modify the query string so that it encodes the same values,
-        # but with different percent-encoding. Sanity-check that they
-        # really are equialent before moving on.
-        original_query = query.dup
-        query.gsub!("example", "ex%61mple")
-        refute_equal(query, original_query)
-        assert_equal(CGI.unescape(query), CGI.unescape(original_query))
-        # Make normalised signature based on our modified params.
-        sign_algorithm = XMLSecurity::BaseDocument.new.algorithm(settings.security[:signature_method])
-        signature = settings.get_sp_key.sign(sign_algorithm.new, query)
-        params['Signature'] = Base64.encode64(signature).gsub(/\n/, "")
-        # Construct SloLogoutrequest and ask it to validate the signature.
-        # Provide the altered parameter in its raw URI-encoded form,
-        # so that we don't have to guess the value that contributed to the signature.
-        options = {}
-        options[:get_params] = params
-        options[:get_params].delete("RelayState")
-        options[:raw_get_params] = {
-          "RelayState" => "http%3A%2F%2Fex%61mple.com",
-        }
-        options[:settings] = settings
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        assert logout_request_sign_test.send(:validate_signature)
-      end
-    end
-
-    describe "#validate_signature with multiple idp certs" do
-      before do
-        settings.idp_slo_target_url = "http://example.com?field=value"
-        settings.certificate = ruby_saml_cert_text
-        settings.private_key = ruby_saml_key_text
-        settings.idp_cert = nil
-        settings.security[:logout_requests_signed] = true
-        settings.security[:embed_sign] = false
-        settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
-      end
-
-      it "return true when at least a idp_cert is valid" do
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = params[:RelayState]
-        options = {}
-        options[:get_params] = params
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        settings.idp_cert_multi = {
-          :signing => [ruby_saml_cert_text2, ruby_saml_cert_text],
-          :encryption => []
-        }
-        logout_request_sign_test.settings = settings
-        assert logout_request_sign_test.send(:validate_signature)
-      end
-
-      it "return false when cert expired and check_idp_cert_expiration expired" do
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = params[:RelayState]
-        options = {}
-        options[:get_params] = params
-        settings.security[:check_idp_cert_expiration] = true
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        settings.idp_cert = nil
-        settings.idp_cert_multi = {
-          :signing => [ruby_saml_cert_text],
-          :encryption => []
-        }
-        logout_request_sign_test.settings = settings
-        assert !logout_request_sign_test.send(:validate_signature)
-        assert_includes logout_request_sign_test.errors, "IdP x509 certificate expired"
-      end
-
-      it "return false when none cert on idp_cert_multi is valid" do
-        params = OneLogin::RubySaml::Logoutrequest.new.create_params(settings, :RelayState => 'http://example.com')
-        params['RelayState'] = params[:RelayState]
-        options = {}
-        options[:get_params] = params
-        logout_request_sign_test = OneLogin::RubySaml::SloLogoutrequest.new(params['SAMLRequest'], options)
-        settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
-        settings.idp_cert_multi = {
-          :signing => [ruby_saml_cert_text2, ruby_saml_cert_text2],
-          :encryption => []
-        }
-        logout_request_sign_test.settings = settings
-        assert !logout_request_sign_test.send(:validate_signature)
-        assert_includes logout_request_sign_test.errors, "Invalid Signature on Logout Request"
-
-      end
-    end
-  end
-end