ruby-saml 1.3.1 → 1.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of ruby-saml might be problematic. Click here for more details.

Files changed (28) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +41 -30
  3. data/changelog.md +24 -0
  4. data/lib/onelogin/ruby-saml/authrequest.rb +5 -2
  5. data/lib/onelogin/ruby-saml/response.rb +171 -50
  6. data/lib/onelogin/ruby-saml/saml_message.rb +3 -1
  7. data/lib/onelogin/ruby-saml/settings.rb +4 -3
  8. data/lib/onelogin/ruby-saml/version.rb +1 -1
  9. data/lib/xml_security.rb +6 -6
  10. data/test/request_test.rb +7 -0
  11. data/test/response_test.rb +161 -14
  12. data/test/responses/invalids/duplicated_attributes.xml.base64 +1 -0
  13. data/test/responses/invalids/empty_destination.xml.base64 +1 -0
  14. data/test/responses/invalids/empty_nameid.xml.base64 +1 -0
  15. data/test/responses/invalids/encrypted_new_attack.xml.base64 +1 -0
  16. data/test/responses/invalids/invalid_issuer_message.xml.base64 +1 -1
  17. data/test/responses/invalids/no_authnstatement.xml.base64 +1 -0
  18. data/test/responses/invalids/no_conditions.xml.base64 +1 -0
  19. data/test/responses/invalids/no_issuer_assertion.xml.base64 +1 -0
  20. data/test/responses/invalids/no_issuer_response.xml.base64 +1 -0
  21. data/test/responses/invalids/no_nameid.xml.base64 +1 -0
  22. data/test/responses/invalids/response_with_concealed_signed_assertion.xml +51 -0
  23. data/test/responses/invalids/response_with_doubled_signed_assertion.xml +49 -0
  24. data/test/responses/invalids/wrong_spnamequalifier.xml.base64 +1 -0
  25. data/test/responses/response_with_multiple_attribute_statements.xml +72 -0
  26. data/test/responses/response_with_signed_assertion_3.xml +30 -0
  27. data/test/xml_security_test.rb +33 -0
  28. metadata +30 -2
data/test/responses/invalids/wrong_spnamequalifier.xml.base64 ADDED
@@ -0,0 +1 @@
1
+ PD94bWwgdmVyc2lvbj0iMS4wIj8+DQo8c2FtbHA6UmVzcG9uc2UgeG1sbnM6c2FtbHA9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpwcm90b2NvbCIgeG1sbnM6c2FtbD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9InBmeDEzNzFkZmU1LTdlMmYtMTdiNy1hODE1LTVmNWU5YTRiNjVkYSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDItMTlUMDE6Mzc6MDFaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9waXRidWxrLm5vLWlwLm9yZy9uZXdvbmVsb2dpbi9kZW1vMS9pbmRleC5waHA/YWNzIiBJblJlc3BvbnNlVG89Ik9ORUxPR0lOXzVmZTlkNmU0OTliMmYwOTEzMjA2YWFiM2Y3MTkxNzI5MDQ5YmI4MDciPjxzYW1sOklzc3Vlcj5odHRwczovL3BpdGJ1bGsubm8taXAub3JnL3NpbXBsZXNhbWwvc2FtbDIvaWRwL21ldGFkYXRhLnBocDwvc2FtbDpJc3N1ZXI+PGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI+DQogIDxkczpTaWduZWRJbmZvPjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8+DQogICAgPGRzOlNpZ25hdHVyZU1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNyc2Etc2hhMSIvPg0KICA8ZHM6UmVmZXJlbmNlIFVSST0iI3BmeDEzNzFkZmU1LTdlMmYtMTdiNy1hODE1LTVmNWU5YTRiNjVkYSI+PGRzOlRyYW5zZm9ybXM+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8+PGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnI3NoYTEiLz48ZHM6RGlnZXN0VmFsdWU+c3lrMGNHOHAxOGpSMUtINThKNnR3Z0JNYlhzPTwvZHM6RGlnZXN0VmFsdWU+PC9kczpSZWZlcmVuY2U+PC9kczpTaWduZWRJbmZvPjxkczpTaWduYXR1cmVWYWx1ZT4yaytTbmhjWWhSV0FLQWdLR2hyMVpZN1ZsSWtWSytsbEFKZncxVnllKzRkWFpZTGh0TkwrMUJ3bWRlVHlLY1BEYjNWSmZtNXRzRGFWRDNtTHVUd2E5L0EvUCt0ZnY0d0t6YVQrdmJvTDl0RVFnNFAwR3hmaWRzbkYrQUM0Z2lLb0VBRE5RbmlaamExR1hhM3VOdi85TEVYV1h4YmZaVGJPNmxLNnlhbGR6UkU9PC9kczpTaWduYXR1cmVWYWx1ZT4NCjxkczpLZXlJbmZvPjxkczpYNTA5RGF0YT48ZHM6WDUwOUNlcnRpZmljYXRlPk1JSUNnVENDQWVvQ0NRQ2JPbHJXRGRYN0ZUQU5CZ2txaGtpRzl3MEJBUVVGQURDQmhERUxNQWtHQTFVRUJoTUNUazh4R0RBV0JnTlZCQWdURDBGdVpISmxZWE1nVTI5c1ltVnlaekVNTUFvR0ExVUVCeE1EUm05dk1SQXdEZ1lEVlFRS0V3ZFZUa2xPUlZSVU1SZ3dGZ1lEVlFRREV3OW1aV2xrWlM1bGNteGhibWN1Ym04eElUQWZCZ2txaGtpRzl3MEJDUUVXRW1GdVpISmxZWE5BZFc1cGJtVjBkQzV1YnpBZUZ3MHdOekEyTVRVeE1qQXhNelZhRncwd056QTRNVFF4TWpBeE16VmFNSUdFTVFzd0NRWURWUVFHRXdKT1R6RVlNQllHQTFVRUNCTVBRVzVrY21WaGN5QlRiMnhpWlhKbk1Rd3dDZ1lEVlFRSEV3TkdiMjh4RURBT0JnTlZCQW9UQjFWT1NVNUZWRlF4R0RBV0JnTlZCQU1URDJabGFXUmxMbVZ5YkdGdVp5NXViekVoTUI4R0NTcUdTSWIzRFFFSkFSWVNZVzVrY21WaGMwQjFibWx1WlhSMExtNXZNSUdmTUEwR0NTcUdTSWIzRFFFQkFRVUFBNEdOQURDQmlRS0JnUURpdmJoUjdQNTE2eC9TM0JxS3h1cFFlMExPTm9saXVwaUJPZXNDTzNTSGJEcmwzK3E5SWJmbmZtRTA0ck51TWNQc0l4QjE2MVRkRHBJZXNMQ243YzhhUEhJU0tPdFBsQWVUWlNuYjhRQXU3YVJqWnEzK1BiclA1dVczVGNmQ0dQdEtUeXRIT2dlL09sSmJvMDc4ZFZoWFExNGQxRUR3WEpXMXJSWHVVdDRDOFFJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQlFVQUE0R0JBQ0RWZnA4NkhPYnFZK2U4QlVvV1E5K1ZNUXgxQVNEb2hCandPc2cyV3lrVXFSWEYrZExmY1VIOWRXUjYzQ3RaSUtGRGJTdE5vbVBuUXo3bmJLK29ueWd3QnNwVkVibkh1VWloWnEzWlVkbXVtUXFDdzRVdnMvMVV2cTNvck9vL1dKVmhUeXZMZ0ZWSzJRYXJRNC82N09aZkhkN1IrUE9CWGhvcGhTTXYxWk9vPC9kczpYNTA5Q2VydGlmaWNhdGU+PC9kczpYNTA5RGF0YT48L2RzOktleUluZm8+PC9kczpTaWduYXR1cmU+PHNhbWxwOlN0YXR1cz48c2FtbHA6U3RhdHVzQ29kZSBWYWx1ZT0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOnN0YXR1czpTdWNjZXNzIi8+PC9zYW1scDpTdGF0dXM+PHNhbWw6QXNzZXJ0aW9uIHhtbG5zOnhzaT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS9YTUxTY2hlbWEtaW5zdGFuY2UiIHhtbG5zOnhzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxL1hNTFNjaGVtYSIgSUQ9InBmeGI0ZWM5YzhhLTQ4ZWItZmRhMi03Zjc0LWZhMWExMDVhOTlmZSIgVmVyc2lvbj0iMi4wIiBJc3N1ZUluc3RhbnQ9IjIwMTQtMDItMTlUMDE6Mzc6MDFaIj48c2FtbDpJc3N1ZXI+aHR0cHM6Ly9waXRidWxrLm5vLWlwLm9yZy9zaW1wbGVzYW1sL3NhbWwyL2lkcC9tZXRhZGF0YS5waHA8L3NhbWw6SXNzdWVyPjxzYW1sOlN1YmplY3Q+PHNhbWw6TmFtZUlEIFNQTmFtZVF1YWxpZmllcj0id3Jvbmctc3AtZW50aXR5aWQiIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6ZW1haWxBZGRyZXNzIj50ZXN0QGV4YW1wbGUuY29tPC9zYW1sOk5hbWVJRD48c2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI+PHNhbWw6U3ViamVjdENvbmZpcm1hdGlvbkRhdGEgTm90T25PckFmdGVyPSIyMDIzLTA4LTIzVDA2OjU3OjAxWiIgUmVjaXBpZW50PSJodHRwczovL3BpdGJ1bGsubm8taXAub3JnL25ld29uZWxvZ2luL2RlbW8xL2luZGV4LnBocD9hY3MiIEluUmVzcG9uc2VUbz0iT05FTE9HSU5fNWZlOWQ2ZTQ5OWIyZjA5MTMyMDZhYWIzZjcxOTE3MjkwNDliYjgwNyIvPjwvc2FtbDpTdWJqZWN0Q29uZmlybWF0aW9uPjwvc2FtbDpTdWJqZWN0PjxzYW1sOkNvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDE0LTAyLTE5VDAxOjM2OjMxWiIgTm90T25PckFmdGVyPSIyMDIzLTA4LTIzVDA2OjU3OjAxWiI+PHNhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48c2FtbDpBdWRpZW5jZT5odHRwczovL3BpdGJ1bGsubm8taXAub3JnL25ld29uZWxvZ2luL2RlbW8xL21ldGFkYXRhLnBocDwvc2FtbDpBdWRpZW5jZT48L3NhbWw6QXVkaWVuY2VSZXN0cmljdGlvbj48L3NhbWw6Q29uZGl0aW9ucz48c2FtbDpBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTQtMDItMTlUMDE6Mzc6MDFaIiBTZXNzaW9uTm90T25PckFmdGVyPSIyMDE0LTAyLTE5VDA5OjM3OjAxWiIgU2Vzc2lvbkluZGV4PSJfNjI3M2Q3N2I4Y2RlMGMzMzNlYzc5ZDIyYTlmYTAwMDNiOWZlMmQ3NWNiIj48c2FtbDpBdXRobkNvbnRleHQ+PHNhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmQ8L3NhbWw6QXV0aG5Db250ZXh0Q2xhc3NSZWY+PC9zYW1sOkF1dGhuQ29udGV4dD48L3NhbWw6QXV0aG5TdGF0ZW1lbnQ+PHNhbWw6QXR0cmlidXRlU3RhdGVtZW50PjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJ1aWQiIE5hbWVGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphdHRybmFtZS1mb3JtYXQ6YmFzaWMiPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPnNtYXJ0aW48L3NhbWw6QXR0cmlidXRlVmFsdWU+PC9zYW1sOkF0dHJpYnV0ZT48c2FtbDpBdHRyaWJ1dGUgTmFtZT0ibWFpbCIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+dGVzdEBleGFtcGxlLmNvbTwvc2FtbDpBdHRyaWJ1dGVWYWx1ZT48L3NhbWw6QXR0cmlidXRlPjxzYW1sOkF0dHJpYnV0ZSBOYW1lPSJjbiIgTmFtZUZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmF0dHJuYW1lLWZvcm1hdDpiYXNpYyI+PHNhbWw6QXR0cmlidXRlVmFsdWUgeHNpOnR5cGU9InhzOnN0cmluZyI+U2l4dG8zPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWU9InNuIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj5NYXJ0aW4yPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PHNhbWw6QXR0cmlidXRlIE5hbWU9ImVkdVBlcnNvbkFmZmlsaWF0aW9uIiBOYW1lRm9ybWF0PSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXR0cm5hbWUtZm9ybWF0OmJhc2ljIj48c2FtbDpBdHRyaWJ1dGVWYWx1ZSB4c2k6dHlwZT0ieHM6c3RyaW5nIj51c2VyPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjxzYW1sOkF0dHJpYnV0ZVZhbHVlIHhzaTp0eXBlPSJ4czpzdHJpbmciPmFkbWluPC9zYW1sOkF0dHJpYnV0ZVZhbHVlPjwvc2FtbDpBdHRyaWJ1dGU+PC9zYW1sOkF0dHJpYnV0ZVN0YXRlbWVudD48L3NhbWw6QXNzZXJ0aW9uPjwvc2FtbHA6UmVzcG9uc2U+
data/test/responses/response_with_multiple_attribute_statements.xml ADDED
@@ -0,0 +1,72 @@
1
+ <samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="GOSAMLR12901174571794" Version="2.0" IssueInstant="2010-11-18T21:57:37Z" Destination="{recipient}">
2
+ <samlp:Status>
3
+ <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
4
+ <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Version="2.0" ID="pfxa46574df-b3b0-a06a-23c8-636413198772" IssueInstant="2010-11-18T21:57:37Z">
5
+ <saml:Issuer>https://app.onelogin.com/saml/metadata/13590</saml:Issuer>
6
+ <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
7
+ <ds:SignedInfo>
8
+ <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
9
+ <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
10
+ <ds:Reference URI="#pfxa46574df-b3b0-a06a-23c8-636413198772">
11
+ <ds:Transforms>
12
+ <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
13
+ <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
14
+ </ds:Transforms>
15
+ <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
16
+ <ds:DigestValue>pJQ7MS/ek4KRRWGmv/H43ReHYMs=</ds:DigestValue>
17
+ </ds:Reference>
18
+ </ds:SignedInfo>
19
+ <ds:SignatureValue>yiveKcPdDpuDNj6shrQ3ABwr/cA3CryD2phG/xLZszKWxU5/mlaKt8ewbZOdKKvtOs2pHBy5Dua3k94AF+zxGyel5gOowmoyXJr+AOr+kPO0vli1V8o3hPPUZwRgSX6Q9pS1CqQghKiEasRyylqqJUaPYzmOzOE8/XlMkwiWmO0=</ds:SignatureValue>
20
+ <ds:KeyInfo>
21
+ <ds:X509Data>
22
+ <ds:X509Certificate>MIIBrTCCAaGgAwIBAgIBATADBgEAMGcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRUwEwYDVQQHDAxTYW50YSBNb25pY2ExETAPBgNVBAoMCE9uZUxvZ2luMRkwFwYDVQQDDBBhcHAub25lbG9naW4uY29tMB4XDTEwMDMwOTA5NTg0NVoXDTE1MDMwOTA5NTg0NVowZzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFTATBgNVBAcMDFNhbnRhIE1vbmljYTERMA8GA1UECgwIT25lTG9naW4xGTAXBgNVBAMMEGFwcC5vbmVsb2dpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAOjSu1fjPy8d5w4QyL1+zd4hIw1Mkkff4WY/TLG8OZkU5YTSWmmHPD5kvYH5uoXS/6qQ81qXpR2wV8CTowZJULg09ddRdRn8Qsqj1FyOC5slE3y2bZ2oFua72of/49fpujnFT6KnQ61CBMqlDoTQqOT62vGJ8nP6MZWvA6sxqud5AgMBAAEwAwYBAAMBAA==</ds:X509Certificate>
23
+ </ds:X509Data>
24
+ </ds:KeyInfo>
25
+ </ds:Signature>
26
+ <saml:Subject>
27
+ <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">support@onelogin.com</saml:NameID>
28
+ <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
29
+ <saml:SubjectConfirmationData NotOnOrAfter="2010-11-18T22:02:37Z" Recipient="{recipient}"/></saml:SubjectConfirmation>
30
+ </saml:Subject>
31
+ <saml:Conditions NotBefore="2010-11-18T21:52:37Z" NotOnOrAfter="2010-11-18T22:02:37Z">
32
+ <saml:AudienceRestriction>
33
+ <saml:Audience>{audience}</saml:Audience>
34
+ </saml:AudienceRestriction>
35
+ </saml:Conditions>
36
+ <saml:AuthnStatement AuthnInstant="2010-11-18T21:57:37Z" SessionNotOnOrAfter="2010-11-19T21:57:37Z" SessionIndex="_531c32d283bdff7e04e487bcdbc4dd8d">
37
+ <saml:AuthnContext>
38
+ <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
39
+ </saml:AuthnContext>
40
+ </saml:AuthnStatement>
41
+ <saml:AttributeStatement>
42
+ <saml:Attribute Name="surname">
43
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">smith</saml:AttributeValue>
44
+ </saml:Attribute>
45
+ <saml:Attribute Name="another_value">
46
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value1</saml:AttributeValue>
47
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">value2</saml:AttributeValue>
48
+ </saml:Attribute>
49
+ <saml:Attribute Name="role">
50
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">role1</saml:AttributeValue>
51
+ </saml:Attribute>
52
+ </saml:AttributeStatement>
53
+ <saml:AttributeStatement>
54
+ <saml:Attribute Name="firstname">
55
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">bob</saml:AttributeValue>
56
+ </saml:Attribute>
57
+ <saml:Attribute Name="role">
58
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">role2</saml:AttributeValue>
59
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">role3</saml:AttributeValue>
60
+ </saml:Attribute>
61
+ <saml:Attribute Name="attribute_with_nil_value">
62
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true"/>
63
+ </saml:Attribute>
64
+ <saml:Attribute Name="attribute_with_nils_and_empty_strings">
65
+ <saml:AttributeValue/>
66
+ <saml:AttributeValue>valuePresent</saml:AttributeValue>
67
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="true"/>
68
+ <saml:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:nil="1"/>
69
+ </saml:Attribute>
70
+ </saml:AttributeStatement>
71
+ </saml:Assertion>
72
+ </samlp:Response>
data/test/responses/response_with_signed_assertion_3.xml ADDED
@@ -0,0 +1,30 @@
1
+ <?xml version="1.0"?>
2
+ <samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="pfx0a3cfa31-f178-71f2-9b94-ad4047591acc" Version="2.0" IssueInstant="2012-04-04T07:33:10.921Z" Destination="https://example.com/endpoint">
3
+ <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">idp.example.com</saml:Issuer>
4
+ <samlp:Status>
5
+ <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
6
+ </samlp:Status>
7
+ <saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" IssueInstant="2012-04-04T07:33:10.923Z" ID="pfx7fca52d6-8991-5d99-3147-4f9d7c278d78">
8
+ <saml:Issuer>idp.myexample.org</saml:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
9
+ <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
10
+ <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
11
+ <ds:Reference URI="#pfx7fca52d6-8991-5d99-3147-4f9d7c278d78"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/><ds:DigestValue>FA0AbR4w9oYdx7MFjERARVJAHps=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>GDH5jhCNX9PFxW+71SOJPyusAOwzECwmd57NDhvA/VKWHnV3PpvpNkOLyamoBNdZ4qxponnobg2zneLESrFnLJdJ1cgs51YvtBJTxKoA7oZMMNKReZFST8g7pDdrBC82n5rTdzxclaJkpwz1yjcho3K3TjxK+gU1svVrEKMUwyo=</ds:SignatureValue>
12
+ <ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIICGzCCAYQCCQCNNcQXom32VDANBgkqhkiG9w0BAQUFADBSMQswCQYDVQQGEwJVUzELMAkGA1UECBMCSU4xFTATBgNVBAcTDEluZGlhbmFwb2xpczERMA8GA1UEChMIT25lTG9naW4xDDAKBgNVBAsTA0VuZzAeFw0xNDA0MjMxODQxMDFaFw0xNTA0MjMxODQxMDFaMFIxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJJTjEVMBMGA1UEBxMMSW5kaWFuYXBvbGlzMREwDwYDVQQKEwhPbmVMb2dpbjEMMAoGA1UECxMDRW5nMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDo6m+QZvYQ/xL0ElLgupK1QDcYL4f5PckwsNgS9pUvV7fzTqCHk8ThLxTk42MQ2McJsOeUJVP728KhymjFCqxgP4VuwRk9rpAl0+mhy6MPdyjyA6G14jrDWS65ysLchK4t/vwpEDz0SQlEoG1kMzllSm7zZS3XregA7DjNaUYQqwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBALM2vGCiQ/vm+a6v40+VX2zdqHA2Q/1vF1ibQzJ54MJCOVWvs+vQXfZFhdm0OPM2IrDU7oqvKPqP6xOAeJK6H0yP7M4YL3fatSvIYmmfyXC9kt3Svz/NyrHzPhUnJ0ye/sUSXxnzQxwcm/9PwAqrQaA3QpQkH57ybF/OoryPe+2h</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature>
13
+ <saml:Subject>
14
+ <saml:NameID NameQualifier="idp.example.com" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">someone@example.org</saml:NameID>
15
+ <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
16
+ <saml:SubjectConfirmationData Recipient="https://example.com/endpoint" InResponseTo="_f7201940-6055-012f-3bc1-782bcb13c426"/>
17
+ </saml:SubjectConfirmation>
18
+ </saml:Subject>
19
+ <saml:Conditions NotBefore="2012-04-04T07:28:11.442Z" NotOnOrAfter="2012-04-04T07:38:11.442Z">
20
+ <saml:AudienceRestriction>
21
+ <saml:Audience>example.com</saml:Audience>
22
+ </saml:AudienceRestriction>
23
+ </saml:Conditions>
24
+ <saml:AuthnStatement AuthnInstant="2012-04-04T07:33:11.442Z">
25
+ <saml:AuthnContext>
26
+ <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
27
+ </saml:AuthnContext>
28
+ </saml:AuthnStatement>
29
+ </saml:Assertion>
30
+ </samlp:Response>
data/test/xml_security_test.rb CHANGED
@@ -344,7 +344,18 @@ class XmlSecurityTest < Minitest::Test
344
344
  assert document.validate_document(fingerprint, true), 'Document should be valid'
345
345
  end
346
346
  end
347
+
348
+ describe 'when response has signed assertion' do
349
+ let(:document_data) { read_response('response_with_signed_assertion_3.xml') }
350
+ let(:document) { OneLogin::RubySaml::Response.new(document_data).document }
351
+ let(:fingerprint) { '4b68c453c7d994aad9025c99d5efcf566287fe8d' }
352
+
353
+ it 'is valid' do
354
+ assert document.validate_document(fingerprint, true), 'Document should be valid'
355
+ end
356
+ end
347
357
  end
358
+
348
359
  describe 'signature_wrapping_attack' do
349
360
  let(:document_data) { read_invalid_response("signature_wrapping_attack.xml.base64") }
350
361
  let(:document) { OneLogin::RubySaml::Response.new(document_data).document }
@@ -354,6 +365,28 @@ class XmlSecurityTest < Minitest::Test
354
365
  assert !document.validate_document(fingerprint, true), 'Document should be invalid'
355
366
  end
356
367
  end
368
+
369
+ describe 'signature wrapping attack - doubled SAML response body' do
370
+ let(:document_data) { read_invalid_response("response_with_doubled_signed_assertion.xml") }
371
+ let(:document) { OneLogin::RubySaml::Response.new(document_data) }
372
+ let(:fingerprint) { '4b68c453c7d994aad9025c99d5efcf566287fe8d' }
373
+
374
+ it 'is valid, but the unsigned information is ignored in favour of the signed information' do
375
+ assert document.document.validate_document(fingerprint, true), 'Document should be valid'
376
+ assert_equal 'someone@example.org', document.name_id, 'Document should expose only signed, valid details'
377
+ end
378
+ end
379
+
380
+ describe 'signature wrapping attack - concealed SAML response body' do
381
+ let(:document_data) { read_invalid_response("response_with_concealed_signed_assertion.xml") }
382
+ let(:document) { OneLogin::RubySaml::Response.new(document_data) }
383
+ let(:fingerprint) { '4b68c453c7d994aad9025c99d5efcf566287fe8d' }
384
+
385
+ it 'is valid, but fails to retrieve information' do
386
+ assert document.document.validate_document(fingerprint, true), 'Document should be valid'
387
+ assert document.name_id.nil?, 'Document should expose only signed, valid details'
388
+ end
389
+ end
357
390
  end
358
391
  end
359
392
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: ruby-saml
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.3.1
4
+ version: 1.4.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - OneLogin LLC
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-07-10 00:00:00.000000000 Z
11
+ date: 2016-10-13 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: nokogiri
@@ -223,6 +223,10 @@ files:
223
223
  - test/responses/adfs_response_xmlns.xml
224
224
  - test/responses/attackxee.xml
225
225
  - test/responses/idp_descriptor.xml
226
+ - test/responses/invalids/duplicated_attributes.xml.base64
227
+ - test/responses/invalids/empty_destination.xml.base64
228
+ - test/responses/invalids/empty_nameid.xml.base64
229
+ - test/responses/invalids/encrypted_new_attack.xml.base64
226
230
  - test/responses/invalids/invalid_audience.xml.base64
227
231
  - test/responses/invalids/invalid_issuer_assertion.xml.base64
228
232
  - test/responses/invalids/invalid_issuer_message.xml.base64
@@ -233,7 +237,12 @@ files:
233
237
  - test/responses/invalids/invalid_subjectconfirmation_recipient.xml.base64
234
238
  - test/responses/invalids/multiple_assertions.xml.base64
235
239
  - test/responses/invalids/multiple_signed.xml.base64
240
+ - test/responses/invalids/no_authnstatement.xml.base64
241
+ - test/responses/invalids/no_conditions.xml.base64
236
242
  - test/responses/invalids/no_id.xml.base64
243
+ - test/responses/invalids/no_issuer_assertion.xml.base64
244
+ - test/responses/invalids/no_issuer_response.xml.base64
245
+ - test/responses/invalids/no_nameid.xml.base64
237
246
  - test/responses/invalids/no_saml2.xml.base64
238
247
  - test/responses/invalids/no_signature.xml.base64
239
248
  - test/responses/invalids/no_status.xml.base64
@@ -242,9 +251,12 @@ files:
242
251
  - test/responses/invalids/no_subjectconfirmation_method.xml.base64
243
252
  - test/responses/invalids/response_encrypted_attrs.xml.base64
244
253
  - test/responses/invalids/response_invalid_signed_element.xml.base64
254
+ - test/responses/invalids/response_with_concealed_signed_assertion.xml
255
+ - test/responses/invalids/response_with_doubled_signed_assertion.xml
245
256
  - test/responses/invalids/signature_wrapping_attack.xml.base64
246
257
  - test/responses/invalids/status_code_responder.xml.base64
247
258
  - test/responses/invalids/status_code_responer_and_msg.xml.base64
259
+ - test/responses/invalids/wrong_spnamequalifier.xml.base64
248
260
  - test/responses/no_signature_ns.xml
249
261
  - test/responses/open_saml_response.xml
250
262
  - test/responses/response_assertion_wrapped.xml.base64
@@ -255,11 +267,13 @@ files:
255
267
  - test/responses/response_with_ampersands.xml
256
268
  - test/responses/response_with_ampersands.xml.base64
257
269
  - test/responses/response_with_ds_namespace_at_the_root.xml.base64
270
+ - test/responses/response_with_multiple_attribute_statements.xml
258
271
  - test/responses/response_with_multiple_attribute_values.xml
259
272
  - test/responses/response_with_retrieval_method.xml
260
273
  - test/responses/response_with_saml2_namespace.xml.base64
261
274
  - test/responses/response_with_signed_assertion.xml.base64
262
275
  - test/responses/response_with_signed_assertion_2.xml.base64
276
+ - test/responses/response_with_signed_assertion_3.xml
263
277
  - test/responses/response_with_signed_message_and_assertion.xml
264
278
  - test/responses/response_with_undefined_recipient.xml.base64
265
279
  - test/responses/response_without_attributes.xml.base64
@@ -350,6 +364,10 @@ test_files:
350
364
  - test/responses/adfs_response_xmlns.xml
351
365
  - test/responses/attackxee.xml
352
366
  - test/responses/idp_descriptor.xml
367
+ - test/responses/invalids/duplicated_attributes.xml.base64
368
+ - test/responses/invalids/empty_destination.xml.base64
369
+ - test/responses/invalids/empty_nameid.xml.base64
370
+ - test/responses/invalids/encrypted_new_attack.xml.base64
353
371
  - test/responses/invalids/invalid_audience.xml.base64
354
372
  - test/responses/invalids/invalid_issuer_assertion.xml.base64
355
373
  - test/responses/invalids/invalid_issuer_message.xml.base64
@@ -360,7 +378,12 @@ test_files:
360
378
  - test/responses/invalids/invalid_subjectconfirmation_recipient.xml.base64
361
379
  - test/responses/invalids/multiple_assertions.xml.base64
362
380
  - test/responses/invalids/multiple_signed.xml.base64
381
+ - test/responses/invalids/no_authnstatement.xml.base64
382
+ - test/responses/invalids/no_conditions.xml.base64
363
383
  - test/responses/invalids/no_id.xml.base64
384
+ - test/responses/invalids/no_issuer_assertion.xml.base64
385
+ - test/responses/invalids/no_issuer_response.xml.base64
386
+ - test/responses/invalids/no_nameid.xml.base64
364
387
  - test/responses/invalids/no_saml2.xml.base64
365
388
  - test/responses/invalids/no_signature.xml.base64
366
389
  - test/responses/invalids/no_status.xml.base64
@@ -369,9 +392,12 @@ test_files:
369
392
  - test/responses/invalids/no_subjectconfirmation_method.xml.base64
370
393
  - test/responses/invalids/response_encrypted_attrs.xml.base64
371
394
  - test/responses/invalids/response_invalid_signed_element.xml.base64
395
+ - test/responses/invalids/response_with_concealed_signed_assertion.xml
396
+ - test/responses/invalids/response_with_doubled_signed_assertion.xml
372
397
  - test/responses/invalids/signature_wrapping_attack.xml.base64
373
398
  - test/responses/invalids/status_code_responder.xml.base64
374
399
  - test/responses/invalids/status_code_responer_and_msg.xml.base64
400
+ - test/responses/invalids/wrong_spnamequalifier.xml.base64
375
401
  - test/responses/no_signature_ns.xml
376
402
  - test/responses/open_saml_response.xml
377
403
  - test/responses/response_assertion_wrapped.xml.base64
@@ -382,11 +408,13 @@ test_files:
382
408
  - test/responses/response_with_ampersands.xml
383
409
  - test/responses/response_with_ampersands.xml.base64
384
410
  - test/responses/response_with_ds_namespace_at_the_root.xml.base64
411
+ - test/responses/response_with_multiple_attribute_statements.xml
385
412
  - test/responses/response_with_multiple_attribute_values.xml
386
413
  - test/responses/response_with_retrieval_method.xml
387
414
  - test/responses/response_with_saml2_namespace.xml.base64
388
415
  - test/responses/response_with_signed_assertion.xml.base64
389
416
  - test/responses/response_with_signed_assertion_2.xml.base64
417
+ - test/responses/response_with_signed_assertion_3.xml
390
418
  - test/responses/response_with_signed_message_and_assertion.xml
391
419
  - test/responses/response_with_undefined_recipient.xml.base64
392
420
  - test/responses/response_without_attributes.xml.base64