ruby-saml 1.3.1 → 1.4.0

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of ruby-saml might be problematic. Click here for more details.

Files changed (28) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +41 -30
  3. data/changelog.md +24 -0
  4. data/lib/onelogin/ruby-saml/authrequest.rb +5 -2
  5. data/lib/onelogin/ruby-saml/response.rb +171 -50
  6. data/lib/onelogin/ruby-saml/saml_message.rb +3 -1
  7. data/lib/onelogin/ruby-saml/settings.rb +4 -3
  8. data/lib/onelogin/ruby-saml/version.rb +1 -1
  9. data/lib/xml_security.rb +6 -6
  10. data/test/request_test.rb +7 -0
  11. data/test/response_test.rb +161 -14
  12. data/test/responses/invalids/duplicated_attributes.xml.base64 +1 -0
  13. data/test/responses/invalids/empty_destination.xml.base64 +1 -0
  14. data/test/responses/invalids/empty_nameid.xml.base64 +1 -0
  15. data/test/responses/invalids/encrypted_new_attack.xml.base64 +1 -0
  16. data/test/responses/invalids/invalid_issuer_message.xml.base64 +1 -1
  17. data/test/responses/invalids/no_authnstatement.xml.base64 +1 -0
  18. data/test/responses/invalids/no_conditions.xml.base64 +1 -0
  19. data/test/responses/invalids/no_issuer_assertion.xml.base64 +1 -0
  20. data/test/responses/invalids/no_issuer_response.xml.base64 +1 -0
  21. data/test/responses/invalids/no_nameid.xml.base64 +1 -0
  22. data/test/responses/invalids/response_with_concealed_signed_assertion.xml +51 -0
  23. data/test/responses/invalids/response_with_doubled_signed_assertion.xml +49 -0
  24. data/test/responses/invalids/wrong_spnamequalifier.xml.base64 +1 -0
  25. data/test/responses/response_with_multiple_attribute_statements.xml +72 -0
  26. data/test/responses/response_with_signed_assertion_3.xml +30 -0
  27. data/test/xml_security_test.rb +33 -0
  28. metadata +30 -2
data/test/responses/invalids/wrong_spnamequalifier.xml.base64 ADDED
@@ -0,0 +1 @@
1
+ PD94bWwgdmVyc2lvbj0iMS4wIj8+DQo8c2FtbHA6UmVzcG9uc2UgeG1sbnM6c2FtbHA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9InBmeDEzNzFkZmU1LTdlMmYtMTdiNy1hODE1LTVmNWU5YTRiNjVkYSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDItMTlUMDE6Mzc6MDFaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9waXRidWxrLm5vLWlwLm9yZy9uZXdvbmVsb2dpbi9kZW1vMS9pbmRleC5waHA/YWNzIiBJblJlc3BvbnNlVG89Ik9ORUxPR0lOXzVmZTlkNmU0OTliMmYwOTEzMjA2YWFiM2Y3MTkxNzI5MDQ5YmI4MDciPjxzYW1sOklzc3Vlcj5odHRwczovL3BpdGJ1bGsubm8taXAub3JnL3NpbXBsZXNhbWwvc2FtbDIvaWRwL21ldGFkYXRhLnBocDwvc2FtbDpJc3N1ZXI+PGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+DQogIDxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+DQogICAgPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPg0KICA8ZHM6UmVmZXJlbmNlIFVSST0iI3BmeDEzNzFkZmU1LTdlMmYtMTdiNy1hODE1LTVmNWU5YTRiNjVkYSI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48ZHM6RGlnZXN0VmFsdWU+c3lrMGNHOHAxOGpSMUtINThKNnR3Z0JNYlhzPTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT4yaytTbmhjWWhSV0FLQWdLR2hyMVpZN1ZsSWtWSytsbEFKZncxVnllKzRkWFpZTGh0TkwrMUJ3bWRlVHlLY1BEYjNWSmZtNXRzRGFWRDNtTHVUd2E5L0EvUCt0ZnY0d0t6YVQrdmJvTDl0RVFnNFAwR3hmaWRzbkYrQUM0Z2lLb0VBRE5RbmlaamExR1hhM3VOdi85TEVYV1h4YmZaVGJPNmxLNnlhbGR6UkU9PC9kczpTaWduYXR1cmVWYWx1ZT4NCjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSUNnVENDQWVvQ0NRQ2JPbHJXRGRYN0ZUQU5CZ2txaGtpRzl3MEJBUVVGQURDQmhERUxNQWtHQTFVRUJoTUNUazh4R0RBV0JnTlZCQWdURDBGdVpISmxZWE1nVTI5c1ltVnlaekVNTUFvR0ExVUVCeE1EUm05dk1SQXdEZ1lEVlFRS0V3ZFZUa2xPUlZSVU1SZ3dGZ1lEVlFRREV3OW1aV2xrWlM1bGNteGhibWN1Ym04eElUQWZCZ2txaGtpRzl3MEJDUUVXRW1GdVpISmxZWE5BZFc1cGJtVjBkQzV1YnpBZUZ3MHdOekEyTVRVeE1qQXhNelZhRncwd056QTRNVFF4TWpBeE16VmFNSUdFTVFzd0NRWURWUVFHRXdKT1R6RVlNQllHQTFVRUNCTVBRVzVrY21WaGN5QlRiMnhpWlhKbk1Rd3dDZ1lEVlFRSEV3TkdiMjh4RURBT0JnTlZCQW9UQjFWT1NVNUZWRlF4R0RBV0JnTlZCQU1URDJabGFXUmxMbVZ5YkdGdVp5NXViekVoTUI4R0NTcUdTSWIzRFFFSkFSWVNZVzVrY21WaGMwQjFibWx1WlhSMExtNXZNSUdmTUEwR0NTcUdTSWIzRFFFQkFRVUFBNEdOQURDQmlRS0JnUURpdmJoUjdQNTE2eC9TM0JxS3h1cFFlMExPTm9saXVwaUJPZXNDTzNTSGJEcmwzK3E5SWJmbmZtRTA0ck51TWNQc0l4QjE2MVRkRHBJZXNMQ243YzhhUEhJU0tPdFBsQWVUWlNuYjhRQXU3YVJqWnEzK1BiclA1dVczVGNmQ0dQdEtUeXRIT2dlL09sSmJvMDc4ZFZoWFExNGQxRUR3WEpXMXJSWHVVdDRDOFFJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQlFVQUE0R0JBQ0RWZnA4NkhPYnFZK2U4QlVvV1E5K1ZNUXgxQVNEb2hCandPc2cyV3lrVXFSWEYrZExmY1VIOWRXUjYzQ3RaSUtGRGJTdE5vbVBuUXo3bmJLK29ueWd3QnNwVkVibkh1VWloWnEzWlVkbXVtUXFDdzRVdnMvMVV2cTNvck9vL1dKVmhUeXZMZ0ZWSzJRYXJRNC82N09aZkhkN1IrUE9CWGhvcGhTTXYxWk9vPC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWxwOlN0YXR1cz48c2FtbHA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1scDpTdGF0dXM+PHNhbWw6QXNzZXJ0aW9uIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSIgSUQ9InBmeGI0ZWM5YzhhLTQ4ZWItZmRhMi03Zjc0LWZhMWExMDVhOTlmZSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDItMTlUMDE6Mzc6MDFaIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9waXRidWxrLm5vLWlwLm9yZy9zaW1wbGVzYW1sL3NhbWwyL2lkcC9tZXRhZGF0YS5waHA8L3NhbWw6SXNzdWVyPjxzYW1sOlN1YmplY3Q+PHNhbWw6TmFtZUlEIFNQTmFtZVF1YWxpZmllcj0id3Jvbmctc3AtZW50aXR5aWQiIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6ZW1haWxBZGRyZXNzIj50ZXN0QGV4YW1wbGUuY29tPC9zYW1sOk5hbWVJRD48c2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+PHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgTm90T25PckFmdGVyPSIyMDIzLTA4LTIzVDA2OjU3OjAxWiIgUmVjaXBpZW50PSJodHRwczovL3BpdGJ1bGsubm8taXAub3JnL25ld29uZWxvZ2luL2RlbW8xL2luZGV4LnBocD9hY3MiIEluUmVzcG9uc2VUbz0iT05FTE9HSU5fNWZlOWQ2ZTQ5OWIyZjA5MTMyMDZhYWIzZjcxOTE3MjkwNDliYjgwNyIvPjwvc2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDE0LTAyLTE5VDAxOjM2OjMxWiIgTm90T25PckFmdGVyPSIyMDIzLTA4LTIzVDA2OjU3OjAxWiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48c2FtbDpBdWRpZW5jZT5odHRwczovL3BpdGJ1bGsubm8taXAub3JnL25ld29uZWxvZ2luL2RlbW8xL21ldGFkYXRhLnBocDwvc2FtbDpBdWRpZW5jZT48L3NhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWw6Q29uZGl0aW9ucz48c2FtbDpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTQtMDItMTlUMDE6Mzc6MDFaIiBTZXNzaW9uTm90T25PckFmdGVyPSIyMDE0LTAyLTE5VDA5OjM3OjAxWiIgU2Vzc2lvbkluZGV4PSJfNjI3M2Q3N2I4Y2RlMGMzMzNlYzc5ZDIyYTlmYTAwMDNiOWZlMmQ3NWNiIj48c2FtbDpBdXRobkNvbnRleHQ+PHNhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmQ8L3NhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sOkF1dGhuQ29udGV4dD48L3NhbWw6QXV0aG5TdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1aWQiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6YmFzaWMiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPnNtYXJ0aW48L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZT0ibWFpbCIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+dGVzdEBleGFtcGxlLmNvbTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJjbiIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+U2l4dG8zPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWU9InNuIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5NYXJ0aW4yPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWU9ImVkdVBlcnNvbkFmZmlsaWF0aW9uIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj51c2VyPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPmFkbWluPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+
data/test/responses/response_with_multiple_attribute_statements.xml ADDED
@@ -0,0 +1,72 @@
1
+ <samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="GOSAMLR12901174571794" Version="2.0" IssueInstant="2010-11-18T21:57:37Z" Destination="{recipient}">
2
+ <samlp:Status>
3
+ <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
4
+ <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfxa46574df-b3b0-a06a-23c8-636413198772" IssueInstant="2010-11-18T21:57:37Z">
5
+ <saml:Issuer>https://app.onelogin.com/saml/metadata/13590</saml:Issuer>
6
+ <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
7
+ <ds:SignedInfo>
8
+ <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
9
+ <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
10
+ <ds:Reference URI="#pfxa46574df-b3b0-a06a-23c8-636413198772">
11
+ <ds:Transforms>
12
+ <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
13
+ <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
14
+ </ds:Transforms>
15
+ <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
16
+ <ds:DigestValue>pJQ7MS/ek4KRRWGmv/H43ReHYMs=</ds:DigestValue>
17
+ </ds:Reference>
18
+ </ds:SignedInfo>
19
+ <ds:SignatureValue>yiveKcPdDpuDNj6shrQ3ABwr/cA3CryD2phG/xLZszKWxU5/mlaKt8ewbZOdKKvtOs2pHBy5Dua3k94AF+zxGyel5gOowmoyXJr+AOr+kPO0vli1V8o3hPPUZwRgSX6Q9pS1CqQghKiEasRyylqqJUaPYzmOzOE8/XlMkwiWmO0=</ds:SignatureValue>
20
+ <ds:KeyInfo>
21
+ <ds:X509Data>
22
+ <ds:X509Certificate>MIIBrTCCAaGgAwIBAgIBATADBgEAMGcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUwEwYDVQQHDAxTYW50YSBNb25pY2ExETAPBgNVBAoMCE9uZUxvZ2luMRkwFwYDVQQDDBBhcHAub25lbG9naW4uY29tMB4XDTEwMDMwOTA5NTg0NVoXDTE1MDMwOTA5NTg0NVowZzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcMDFNhbnRhIE1vbmljYTERMA8GA1UECgwIT25lTG9naW4xGTAXBgNVBAMMEGFwcC5vbmVsb2dpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOjSu1fjPy8d5w4QyL1+zd4hIw1Mkkff4WY/TLG8OZkU5YTSWmmHPD5kvYH5uoXS/6qQ81qXpR2wV8CTowZJULg09ddRdRn8Qsqj1FyOC5slE3y2bZ2oFua72of/49fpujnFT6KnQ61CBMqlDoTQqOT62vGJ8nP6MZWvA6sxqud5AgMBAAEwAwYBAAMBAA==</ds:X509Certificate>
23
+ </ds:X509Data>
24
+ </ds:KeyInfo>
25
+ </ds:Signature>
26
+ <saml:Subject>
27
+ <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">support@onelogin.com</saml:NameID>
28
+ <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
29
+ <saml:SubjectConfirmationData NotOnOrAfter="2010-11-18T22:02:37Z" Recipient="{recipient}"/></saml:SubjectConfirmation>
30
+ </saml:Subject>
31
+ <saml:Conditions NotBefore="2010-11-18T21:52:37Z" NotOnOrAfter="2010-11-18T22:02:37Z">
32
+ <saml:AudienceRestriction>
33
+ <saml:Audience>{audience}</saml:Audience>
34
+ </saml:AudienceRestriction>
35
+ </saml:Conditions>
36
+ <saml:AuthnStatement AuthnInstant="2010-11-18T21:57:37Z" SessionNotOnOrAfter="2010-11-19T21:57:37Z" SessionIndex="_531c32d283bdff7e04e487bcdbc4dd8d">
37
+ <saml:AuthnContext>
38
+ <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
39
+ </saml:AuthnContext>
40
+ </saml:AuthnStatement>
41
+ <saml:AttributeStatement>
42
+ <saml:Attribute Name="surname">
43
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">smith</saml:AttributeValue>
44
+ </saml:Attribute>
45
+ <saml:Attribute Name="another_value">
46
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value1</saml:AttributeValue>
47
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value2</saml:AttributeValue>
48
+ </saml:Attribute>
49
+ <saml:Attribute Name="role">
50
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">role1</saml:AttributeValue>
51
+ </saml:Attribute>
52
+ </saml:AttributeStatement>
53
+ <saml:AttributeStatement>
54
+ <saml:Attribute Name="firstname">
55
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">bob</saml:AttributeValue>
56
+ </saml:Attribute>
57
+ <saml:Attribute Name="role">
58
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">role2</saml:AttributeValue>
59
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">role3</saml:AttributeValue>
60
+ </saml:Attribute>
61
+ <saml:Attribute Name="attribute_with_nil_value">
62
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true"/>
63
+ </saml:Attribute>
64
+ <saml:Attribute Name="attribute_with_nils_and_empty_strings">
65
+ <saml:AttributeValue/>
66
+ <saml:AttributeValue>valuePresent</saml:AttributeValue>
67
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true"/>
68
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="1"/>
69
+ </saml:Attribute>
70
+ </saml:AttributeStatement>
71
+ </saml:Assertion>
72
+ </samlp:Response>
data/test/responses/response_with_signed_assertion_3.xml ADDED
@@ -0,0 +1,30 @@
1
+ <?xml version="1.0"?>
2
+ <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="pfx0a3cfa31-f178-71f2-9b94-ad4047591acc" Version="2.0" IssueInstant="2012-04-04T07:33:10.921Z" Destination="https://example.com/endpoint">
3
+ <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">idp.example.com</saml:Issuer>
4
+ <samlp:Status>
5
+ <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
6
+ </samlp:Status>
7
+ <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" IssueInstant="2012-04-04T07:33:10.923Z" ID="pfx7fca52d6-8991-5d99-3147-4f9d7c278d78">
8
+ <saml:Issuer>idp.myexample.org</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
9
+ <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
10
+ <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
11
+ <ds:Reference URI="#pfx7fca52d6-8991-5d99-3147-4f9d7c278d78"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>FA0AbR4w9oYdx7MFjERARVJAHps=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>GDH5jhCNX9PFxW+71SOJPyusAOwzECwmd57NDhvA/VKWHnV3PpvpNkOLyamoBNdZ4qxponnobg2zneLESrFnLJdJ1cgs51YvtBJTxKoA7oZMMNKReZFST8g7pDdrBC82n5rTdzxclaJkpwz1yjcho3K3TjxK+gU1svVrEKMUwyo=</ds:SignatureValue>
12
+ <ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICGzCCAYQCCQCNNcQXom32VDANBgkqhkiG9w0BAQUFADBSMQswCQYDVQQGEwJVUzELMAkGA1UECBMCSU4xFTATBgNVBAcTDEluZGlhbmFwb2xpczERMA8GA1UEChMIT25lTG9naW4xDDAKBgNVBAsTA0VuZzAeFw0xNDA0MjMxODQxMDFaFw0xNTA0MjMxODQxMDFaMFIxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJTjEVMBMGA1UEBxMMSW5kaWFuYXBvbGlzMREwDwYDVQQKEwhPbmVMb2dpbjEMMAoGA1UECxMDRW5nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDo6m+QZvYQ/xL0ElLgupK1QDcYL4f5PckwsNgS9pUvV7fzTqCHk8ThLxTk42MQ2McJsOeUJVP728KhymjFCqxgP4VuwRk9rpAl0+mhy6MPdyjyA6G14jrDWS65ysLchK4t/vwpEDz0SQlEoG1kMzllSm7zZS3XregA7DjNaUYQqwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBALM2vGCiQ/vm+a6v40+VX2zdqHA2Q/1vF1ibQzJ54MJCOVWvs+vQXfZFhdm0OPM2IrDU7oqvKPqP6xOAeJK6H0yP7M4YL3fatSvIYmmfyXC9kt3Svz/NyrHzPhUnJ0ye/sUSXxnzQxwcm/9PwAqrQaA3QpQkH57ybF/OoryPe+2h</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature>
13
+ <saml:Subject>
14
+ <saml:NameID NameQualifier="idp.example.com" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">someone@example.org</saml:NameID>
15
+ <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
16
+ <saml:SubjectConfirmationData Recipient="https://example.com/endpoint" InResponseTo="_f7201940-6055-012f-3bc1-782bcb13c426"/>
17
+ </saml:SubjectConfirmation>
18
+ </saml:Subject>
19
+ <saml:Conditions NotBefore="2012-04-04T07:28:11.442Z" NotOnOrAfter="2012-04-04T07:38:11.442Z">
20
+ <saml:AudienceRestriction>
21
+ <saml:Audience>example.com</saml:Audience>
22
+ </saml:AudienceRestriction>
23
+ </saml:Conditions>
24
+ <saml:AuthnStatement AuthnInstant="2012-04-04T07:33:11.442Z">
25
+ <saml:AuthnContext>
26
+ <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
27
+ </saml:AuthnContext>
28
+ </saml:AuthnStatement>
29
+ </saml:Assertion>
30
+ </samlp:Response>
data/test/xml_security_test.rb CHANGED
@@ -344,7 +344,18 @@ class XmlSecurityTest < Minitest::Test
344
344
  assert document.validate_document(fingerprint, true), 'Document should be valid'
345
345
  end
346
346
  end
347
+
348
+ describe 'when response has signed assertion' do
349
+ let(:document_data) { read_response('response_with_signed_assertion_3.xml') }
350
+ let(:document) { OneLogin::RubySaml::Response.new(document_data).document }
351
+ let(:fingerprint) { '4b68c453c7d994aad9025c99d5efcf566287fe8d' }
352
+
353
+ it 'is valid' do
354
+ assert document.validate_document(fingerprint, true), 'Document should be valid'
355
+ end
356
+ end
347
357
  end
358
+
348
359
  describe 'signature_wrapping_attack' do
349
360
  let(:document_data) { read_invalid_response("signature_wrapping_attack.xml.base64") }
350
361
  let(:document) { OneLogin::RubySaml::Response.new(document_data).document }
@@ -354,6 +365,28 @@ class XmlSecurityTest < Minitest::Test
354
365
  assert !document.validate_document(fingerprint, true), 'Document should be invalid'
355
366
  end
356
367
  end
368
+
369
+ describe 'signature wrapping attack - doubled SAML response body' do
370
+ let(:document_data) { read_invalid_response("response_with_doubled_signed_assertion.xml") }
371
+ let(:document) { OneLogin::RubySaml::Response.new(document_data) }
372
+ let(:fingerprint) { '4b68c453c7d994aad9025c99d5efcf566287fe8d' }
373
+
374
+ it 'is valid, but the unsigned information is ignored in favour of the signed information' do
375
+ assert document.document.validate_document(fingerprint, true), 'Document should be valid'
376
+ assert_equal 'someone@example.org', document.name_id, 'Document should expose only signed, valid details'
377
+ end
378
+ end
379
+
380
+ describe 'signature wrapping attack - concealed SAML response body' do
381
+ let(:document_data) { read_invalid_response("response_with_concealed_signed_assertion.xml") }
382
+ let(:document) { OneLogin::RubySaml::Response.new(document_data) }
383
+ let(:fingerprint) { '4b68c453c7d994aad9025c99d5efcf566287fe8d' }
384
+
385
+ it 'is valid, but fails to retrieve information' do
386
+ assert document.document.validate_document(fingerprint, true), 'Document should be valid'
387
+ assert document.name_id.nil?, 'Document should expose only signed, valid details'
388
+ end
389
+ end
357
390
  end
358
391
  end
359
392
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: ruby-saml
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.3.1
4
+ version: 1.4.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - OneLogin LLC
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-07-10 00:00:00.000000000 Z
11
+ date: 2016-10-13 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: nokogiri
@@ -223,6 +223,10 @@ files:
223
223
  - test/responses/adfs_response_xmlns.xml
224
224
  - test/responses/attackxee.xml
225
225
  - test/responses/idp_descriptor.xml
226
+ - test/responses/invalids/duplicated_attributes.xml.base64
227
+ - test/responses/invalids/empty_destination.xml.base64
228
+ - test/responses/invalids/empty_nameid.xml.base64
229
+ - test/responses/invalids/encrypted_new_attack.xml.base64
226
230
  - test/responses/invalids/invalid_audience.xml.base64
227
231
  - test/responses/invalids/invalid_issuer_assertion.xml.base64
228
232
  - test/responses/invalids/invalid_issuer_message.xml.base64
@@ -233,7 +237,12 @@ files:
233
237
  - test/responses/invalids/invalid_subjectconfirmation_recipient.xml.base64
234
238
  - test/responses/invalids/multiple_assertions.xml.base64
235
239
  - test/responses/invalids/multiple_signed.xml.base64
240
+ - test/responses/invalids/no_authnstatement.xml.base64
241
+ - test/responses/invalids/no_conditions.xml.base64
236
242
  - test/responses/invalids/no_id.xml.base64
243
+ - test/responses/invalids/no_issuer_assertion.xml.base64
244
+ - test/responses/invalids/no_issuer_response.xml.base64
245
+ - test/responses/invalids/no_nameid.xml.base64
237
246
  - test/responses/invalids/no_saml2.xml.base64
238
247
  - test/responses/invalids/no_signature.xml.base64
239
248
  - test/responses/invalids/no_status.xml.base64
@@ -242,9 +251,12 @@ files:
242
251
  - test/responses/invalids/no_subjectconfirmation_method.xml.base64
243
252
  - test/responses/invalids/response_encrypted_attrs.xml.base64
244
253
  - test/responses/invalids/response_invalid_signed_element.xml.base64
254
+ - test/responses/invalids/response_with_concealed_signed_assertion.xml
255
+ - test/responses/invalids/response_with_doubled_signed_assertion.xml
245
256
  - test/responses/invalids/signature_wrapping_attack.xml.base64
246
257
  - test/responses/invalids/status_code_responder.xml.base64
247
258
  - test/responses/invalids/status_code_responer_and_msg.xml.base64
259
+ - test/responses/invalids/wrong_spnamequalifier.xml.base64
248
260
  - test/responses/no_signature_ns.xml
249
261
  - test/responses/open_saml_response.xml
250
262
  - test/responses/response_assertion_wrapped.xml.base64
@@ -255,11 +267,13 @@ files:
255
267
  - test/responses/response_with_ampersands.xml
256
268
  - test/responses/response_with_ampersands.xml.base64
257
269
  - test/responses/response_with_ds_namespace_at_the_root.xml.base64
270
+ - test/responses/response_with_multiple_attribute_statements.xml
258
271
  - test/responses/response_with_multiple_attribute_values.xml
259
272
  - test/responses/response_with_retrieval_method.xml
260
273
  - test/responses/response_with_saml2_namespace.xml.base64
261
274
  - test/responses/response_with_signed_assertion.xml.base64
262
275
  - test/responses/response_with_signed_assertion_2.xml.base64
276
+ - test/responses/response_with_signed_assertion_3.xml
263
277
  - test/responses/response_with_signed_message_and_assertion.xml
264
278
  - test/responses/response_with_undefined_recipient.xml.base64
265
279
  - test/responses/response_without_attributes.xml.base64
@@ -350,6 +364,10 @@ test_files:
350
364
  - test/responses/adfs_response_xmlns.xml
351
365
  - test/responses/attackxee.xml
352
366
  - test/responses/idp_descriptor.xml
367
+ - test/responses/invalids/duplicated_attributes.xml.base64
368
+ - test/responses/invalids/empty_destination.xml.base64
369
+ - test/responses/invalids/empty_nameid.xml.base64
370
+ - test/responses/invalids/encrypted_new_attack.xml.base64
353
371
  - test/responses/invalids/invalid_audience.xml.base64
354
372
  - test/responses/invalids/invalid_issuer_assertion.xml.base64
355
373
  - test/responses/invalids/invalid_issuer_message.xml.base64
@@ -360,7 +378,12 @@ test_files:
360
378
  - test/responses/invalids/invalid_subjectconfirmation_recipient.xml.base64
361
379
  - test/responses/invalids/multiple_assertions.xml.base64
362
380
  - test/responses/invalids/multiple_signed.xml.base64
381
+ - test/responses/invalids/no_authnstatement.xml.base64
382
+ - test/responses/invalids/no_conditions.xml.base64
363
383
  - test/responses/invalids/no_id.xml.base64
384
+ - test/responses/invalids/no_issuer_assertion.xml.base64
385
+ - test/responses/invalids/no_issuer_response.xml.base64
386
+ - test/responses/invalids/no_nameid.xml.base64
364
387
  - test/responses/invalids/no_saml2.xml.base64
365
388
  - test/responses/invalids/no_signature.xml.base64
366
389
  - test/responses/invalids/no_status.xml.base64
@@ -369,9 +392,12 @@ test_files:
369
392
  - test/responses/invalids/no_subjectconfirmation_method.xml.base64
370
393
  - test/responses/invalids/response_encrypted_attrs.xml.base64
371
394
  - test/responses/invalids/response_invalid_signed_element.xml.base64
395
+ - test/responses/invalids/response_with_concealed_signed_assertion.xml
396
+ - test/responses/invalids/response_with_doubled_signed_assertion.xml
372
397
  - test/responses/invalids/signature_wrapping_attack.xml.base64
373
398
  - test/responses/invalids/status_code_responder.xml.base64
374
399
  - test/responses/invalids/status_code_responer_and_msg.xml.base64
400
+ - test/responses/invalids/wrong_spnamequalifier.xml.base64
375
401
  - test/responses/no_signature_ns.xml
376
402
  - test/responses/open_saml_response.xml
377
403
  - test/responses/response_assertion_wrapped.xml.base64
@@ -382,11 +408,13 @@ test_files:
382
408
  - test/responses/response_with_ampersands.xml
383
409
  - test/responses/response_with_ampersands.xml.base64
384
410
  - test/responses/response_with_ds_namespace_at_the_root.xml.base64
411
+ - test/responses/response_with_multiple_attribute_statements.xml
385
412
  - test/responses/response_with_multiple_attribute_values.xml
386
413
  - test/responses/response_with_retrieval_method.xml
387
414
  - test/responses/response_with_saml2_namespace.xml.base64
388
415
  - test/responses/response_with_signed_assertion.xml.base64
389
416
  - test/responses/response_with_signed_assertion_2.xml.base64
417
+ - test/responses/response_with_signed_assertion_3.xml
390
418
  - test/responses/response_with_signed_message_and_assertion.xml
391
419
  - test/responses/response_with_undefined_recipient.xml.base64
392
420
  - test/responses/response_without_attributes.xml.base64