ruby-saml 1.4.2 → 1.4.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Potentially problematic release.

This version of ruby-saml might be problematic. Click here for more details.

Files changed (28) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +70 -13
  3. data/changelog.md +14 -1
  4. data/lib/onelogin/ruby-saml/idp_metadata_parser.rb +209 -97
  5. data/lib/onelogin/ruby-saml/logoutrequest.rb +2 -1
  6. data/lib/onelogin/ruby-saml/logoutresponse.rb +31 -8
  7. data/lib/onelogin/ruby-saml/metadata.rb +20 -14
  8. data/lib/onelogin/ruby-saml/response.rb +32 -15
  9. data/lib/onelogin/ruby-saml/saml_message.rb +1 -2
  10. data/lib/onelogin/ruby-saml/settings.rb +39 -1
  11. data/lib/onelogin/ruby-saml/slo_logoutrequest.rb +29 -7
  12. data/lib/onelogin/ruby-saml/version.rb +1 -1
  13. data/lib/schemas/xmldsig-core-schema.xsd +1 -1
  14. data/lib/xml_security.rb +25 -0
  15. data/test/certificates/ruby-saml-2.crt +15 -0
  16. data/test/idp_metadata_parser_test.rb +211 -15
  17. data/test/logoutresponse_test.rb +60 -0
  18. data/test/metadata/idp_descriptor.xml +26 -0
  19. data/test/metadata/idp_descriptor_2.xml +56 -0
  20. data/test/metadata/idp_descriptor_3.xml +14 -0
  21. data/test/metadata/idp_multiple_descriptors.xml +53 -0
  22. data/test/metadata_test.rb +70 -2
  23. data/test/response_test.rb +289 -243
  24. data/test/settings_test.rb +105 -22
  25. data/test/slo_logoutrequest_test.rb +66 -0
  26. data/test/test_helper.rb +23 -3
  27. metadata +13 -5
  28. data/test/responses/idp_descriptor.xml +0 -3
data/test/logoutresponse_test.rb CHANGED
@@ -223,6 +223,27 @@ class RubySamlTest < Minitest::Test
223
223
  settings.idp_cert = ruby_saml_cert_text
224
224
  end
225
225
 
226
+ it "return true when no idp_cert is provided and option :relax_signature_validation is present" do
227
+ settings.idp_cert = nil
228
+ settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
229
+ params['RelayState'] = params[:RelayState]
230
+ options = {}
231
+ options[:get_params] = params
232
+ options[:relax_signature_validation] = true
233
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
234
+ assert logoutresponse_sign_test.send(:validate_signature)
235
+ end
236
+
237
+ it "return false when no idp_cert is provided and no option :relax_signature_validation is present" do
238
+ settings.idp_cert = nil
239
+ settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
240
+ params['RelayState'] = params[:RelayState]
241
+ options = {}
242
+ options[:get_params] = params
243
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
244
+ assert !logoutresponse_sign_test.send(:validate_signature)
245
+ end
246
+
226
247
  it "return true when valid RSA_SHA1 Signature" do
227
248
  settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
228
249
  params['RelayState'] = params[:RelayState]
@@ -262,6 +283,45 @@ class RubySamlTest < Minitest::Test
262
283
  assert logoutresponse.errors.include? "Invalid Signature on Logout Response"
263
284
  end
264
285
  end
286
+
287
+ describe "#validate_signature" do
288
+ let (:params) { OneLogin::RubySaml::SloLogoutresponse.new.create_params(settings, random_id, "Custom Logout Message", :RelayState => 'http://example.com') }
289
+
290
+ before do
291
+ settings.soft = true
292
+ settings.idp_slo_target_url = "http://example.com?field=value"
293
+ settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
294
+ settings.security[:logout_responses_signed] = true
295
+ settings.security[:embed_sign] = false
296
+ settings.certificate = ruby_saml_cert_text
297
+ settings.private_key = ruby_saml_key_text
298
+ settings.idp_cert = nil
299
+ end
300
+
301
+ it "return true when at least a idp_cert is valid" do
302
+ params['RelayState'] = params[:RelayState]
303
+ options = {}
304
+ options[:get_params] = params
305
+ settings.idp_cert_multi = {
306
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text],
307
+ :encryption => []
308
+ }
309
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
310
+ assert logoutresponse_sign_test.send(:validate_signature)
311
+ end
312
+
313
+ it "return false when none cert on idp_cert_multi is valid" do
314
+ params['RelayState'] = params[:RelayState]
315
+ options = {}
316
+ options[:get_params] = params
317
+ settings.idp_cert_multi = {
318
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text2],
319
+ :encryption => []
320
+ }
321
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
322
+ assert !logoutresponse_sign_test.send(:validate_signature)
323
+ end
324
+ end
265
325
  end
266
326
  end
267
327
  end
data/test/metadata/idp_descriptor.xml ADDED
@@ -0,0 +1,26 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <md:EntityDescriptor entityID="https://hello.example.com/access/saml/idp.xml" validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
3
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
4
+ <md:KeyDescriptor use="signing">
5
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
6
+ <ds:X509Data>
7
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
8
+ </ds:X509Data>
9
+ </ds:KeyInfo>
10
+ </md:KeyDescriptor>
11
+ <md:KeyDescriptor use="encryption">
12
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
13
+ <ds:X509Data>
14
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
15
+ </ds:X509Data>
16
+ </ds:KeyInfo>
17
+ </md:KeyDescriptor>
18
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
19
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
20
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
21
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
22
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
23
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
24
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
25
+ </md:IDPSSODescriptor>
26
+ </md:EntityDescriptor>
data/test/metadata/idp_descriptor_2.xml ADDED
@@ -0,0 +1,56 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <md:EntityDescriptor entityID="https://hello.example.com/access/saml/idp.xml" validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
3
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
4
+ <md:KeyDescriptor use="signing">
5
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
6
+ <ds:X509Data>
7
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
8
+ </ds:X509Data>
9
+ </ds:KeyInfo>
10
+ </md:KeyDescriptor>
11
+ <md:KeyDescriptor use="signing">
12
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
13
+ <ds:X509Data>
14
+ <ds:X509Certificate>MIIEZTCCA02gAwIBAgIUPyy/A3bZAZ4m28PzEUUoT7RJhxIwDQYJKoZIhvcNAQEF
15
+ BQAwcjELMAkGA1UEBhMCVVMxKzApBgNVBAoMIk9uZUxvZ2luIFRlc3QgKHNnYXJj
16
+ aWEtdXMtcHJlcHJvZCkxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwW
17
+ T25lTG9naW4gQWNjb3VudCA4OTE0NjAeFw0xNjA4MDQyMjI5MzdaFw0yMTA4MDUy
18
+ MjI5MzdaMHIxCzAJBgNVBAYTAlVTMSswKQYDVQQKDCJPbmVMb2dpbiBUZXN0IChz
19
+ Z2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNV
20
+ BAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
21
+ DwAwggEKAoIBAQDN6iqQGcLOCglNO42I2rkzE05UXSiMXT6c8ALThMMiaDw6qqzo
22
+ 3sd/tKK+NcNKWLIIC8TozWVyh5ykUiVZps+08xil7VsTU7E+wKu3kvmOsvw2wlRw
23
+ tnoKZJwYhnr+RkBa+h1r3ZYUgXm1ZPeHMKj1g18KaWz9+MxYL6BhKqrOzfW/P2xx
24
+ VRcFH7/pq+ZsDdgNzD2GD+apzY4MZyZj/N6BpBWJ0GlFsmtBegpbX3LBitJuFkk5
25
+ L4/U/jjF1AJa3boBdCUVfATqO5G03H4XS1GySjBIRQXmlUF52rLjg6xCgWJ30/+t
26
+ 1X+IHLJeixiQ0vxyh6C4/usCEt94cgD1r8ADAgMBAAGjgfIwge8wDAYDVR0TAQH/
27
+ BAIwADAdBgNVHQ4EFgQUPW0DcH0G3IwynWgi74co4wZ6n7gwga8GA1UdIwSBpzCB
28
+ pIAUPW0DcH0G3IwynWgi74co4wZ6n7ihdqR0MHIxCzAJBgNVBAYTAlVTMSswKQYD
29
+ VQQKDCJPbmVMb2dpbiBUZXN0IChzZ2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQL
30
+ DAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDaC
31
+ FD8svwN22QGeJtvD8xFFKE+0SYcSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0B
32
+ AQUFAAOCAQEAQhB4q9jrycwbHrDSoYR1X4LFFzvJ9Us75wQquRHXpdyS9D6HUBXM
33
+ GI6ahPicXCQrfLgN8vzMIiqZqfySXXv/8/dxe/X4UsWLYKYJHDJmxXD5EmWTa65c
34
+ hjkeP1oJAc8f3CKCpcP2lOBTthbnk2fEVAeLHR4xNdQO0VvGXWO9BliYPpkYqUIB
35
+ vlm+Fg9mF7AM/Uagq2503XXIE1Lq//HON68P10vNMwLSKOtYLsoTiCnuIKGJqG37
36
+ MsZVjQ1ZPRcO+LSLkq0i91gFxrOrVCrgztX4JQi5XkvEsYZGIXXjwHqxTVyt3adZ
37
+ WQO0LPxPqRiUqUzyhDhLo/xXNrHCu4VbMw==</ds:X509Certificate>
38
+ </ds:X509Data>
39
+ </ds:KeyInfo>
40
+ </md:KeyDescriptor>
41
+ <md:KeyDescriptor use="encryption">
42
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
43
+ <ds:X509Data>
44
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
45
+ </ds:X509Data>
46
+ </ds:KeyInfo>
47
+ </md:KeyDescriptor>
48
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
49
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
50
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
51
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
52
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
53
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
54
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
55
+ </md:IDPSSODescriptor>
56
+ </md:EntityDescriptor>
data/test/metadata/idp_descriptor_3.xml ADDED
@@ -0,0 +1,14 @@
1
+ <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" entityID="https://idp.example.com/idp/shibboleth">
2
+ <md:IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
3
+ <md:KeyDescriptor use="signing">
4
+ <ds:KeyInfo>
5
+ <ds:X509Data>
6
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
7
+ </ds:X509Data>
8
+ </ds:KeyInfo>
9
+ </md:KeyDescriptor>
10
+ <md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idp.example.com/idp/profile/Shibboleth/SSO"/>
11
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.example.com/idp/profile/SAML2/POST/SSO"/>
12
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.example.com/idp/profile/SAML2/Redirect/SSO"/>
13
+ </md:IDPSSODescriptor>
14
+ </md:EntityDescriptor>
data/test/metadata/idp_multiple_descriptors.xml ADDED
@@ -0,0 +1,53 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <md:EntitiesDescriptor validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
3
+ <md:EntityDescriptor entityID="https://foo.example.com/access/saml/idp.xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="md:EntityDescriptorType">
4
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
5
+ <md:KeyDescriptor use="signing">
6
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
7
+ <ds:X509Data>
8
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
9
+ </ds:X509Data>
10
+ </ds:KeyInfo>
11
+ </md:KeyDescriptor>
12
+ <md:KeyDescriptor use="encryption">
13
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
14
+ <ds:X509Data>
15
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
16
+ </ds:X509Data>
17
+ </ds:KeyInfo>
18
+ </md:KeyDescriptor>
19
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
20
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
21
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
22
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
23
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
24
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
25
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
26
+ </md:IDPSSODescriptor>
27
+ </md:EntityDescriptor>
28
+ <md:EntityDescriptor entityID="https://bar.example.com/access/saml/idp.xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="md:EntityDescriptorType">
29
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
30
+ <md:KeyDescriptor use="signing">
31
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
32
+ <ds:X509Data>
33
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
34
+ </ds:X509Data>
35
+ </ds:KeyInfo>
36
+ </md:KeyDescriptor>
37
+ <md:KeyDescriptor use="encryption">
38
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
39
+ <ds:X509Data>
40
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
41
+ </ds:X509Data>
42
+ </ds:KeyInfo>
43
+ </md:KeyDescriptor>
44
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
45
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
46
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
47
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
48
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
49
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
50
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
51
+ </md:IDPSSODescriptor>
52
+ </md:EntityDescriptor>
53
+ </md:EntitiesDescriptor>
data/test/metadata_test.rb CHANGED
@@ -128,8 +128,6 @@ class MetadataTest < Minitest::Test
128
128
 
129
129
  it "generates Service Provider Metadata with AuthnRequestsSigned" do
130
130
  assert_equal "true", spsso_descriptor.attribute("AuthnRequestsSigned").value
131
- assert_equal ruby_saml_cert.to_der, cert.to_der
132
-
133
131
  assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
134
132
  end
135
133
  end
@@ -141,6 +139,7 @@ class MetadataTest < Minitest::Test
141
139
 
142
140
  it "generates Service Provider Metadata with X509Certificate for encrypt" do
143
141
  assert_equal 2, key_descriptors.length
142
+
144
143
  assert_equal "encryption", key_descriptors[1].attribute("use").value
145
144
 
146
145
  assert_equal 2, cert_nodes.length
@@ -150,6 +149,75 @@ class MetadataTest < Minitest::Test
150
149
  end
151
150
  end
152
151
 
152
+ describe "with a future SP certificate" do
153
+ let(:key_descriptors) do
154
+ REXML::XPath.match(
155
+ xml_doc,
156
+ "//md:KeyDescriptor",
157
+ "md" => "urn:oasis:names:tc:SAML:2.0:metadata"
158
+ )
159
+ end
160
+ let(:cert_nodes) do
161
+ REXML::XPath.match(
162
+ xml_doc,
163
+ "//md:KeyDescriptor/ds:KeyInfo/ds:X509Data/ds:X509Certificate",
164
+ "md" => "urn:oasis:names:tc:SAML:2.0:metadata",
165
+ "ds" => "http://www.w3.org/2000/09/xmldsig#"
166
+ )
167
+ end
168
+
169
+ before do
170
+ settings.certificate = ruby_saml_cert_text
171
+ settings.certificate_new = ruby_saml_cert_text2
172
+ end
173
+
174
+ it "generates Service Provider Metadata with 2 X509Certificate for sign" do
175
+ assert_equal 2, key_descriptors.length
176
+ assert_equal "signing", key_descriptors[0].attribute("use").value
177
+ assert_equal "signing", key_descriptors[1].attribute("use").value
178
+
179
+ cert = OpenSSL::X509::Certificate.new(Base64.decode64(cert_nodes[0].text))
180
+ cert_new = OpenSSL::X509::Certificate.new(Base64.decode64(cert_nodes[1].text))
181
+
182
+ assert_equal 2, cert_nodes.length
183
+ assert_equal ruby_saml_cert.to_der, cert.to_der
184
+ assert_equal ruby_saml_cert2.to_der, cert_new.to_der
185
+
186
+ assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
187
+ end
188
+
189
+ describe "and signed authentication requests" do
190
+ before do
191
+ settings.security[:authn_requests_signed] = true
192
+ end
193
+
194
+ it "generates Service Provider Metadata with AuthnRequestsSigned" do
195
+ assert_equal "true", spsso_descriptor.attribute("AuthnRequestsSigned").value
196
+ assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
197
+ end
198
+ end
199
+
200
+ describe "and encrypted assertions" do
201
+ before do
202
+ settings.security[:want_assertions_encrypted] = true
203
+ end
204
+
205
+ it "generates Service Provider Metadata with X509Certificate for encrypt" do
206
+ assert_equal 4, key_descriptors.length
207
+ assert_equal "signing", key_descriptors[0].attribute("use").value
208
+ assert_equal "encryption", key_descriptors[1].attribute("use").value
209
+ assert_equal "signing", key_descriptors[2].attribute("use").value
210
+ assert_equal "encryption", key_descriptors[3].attribute("use").value
211
+
212
+ assert_equal 4, cert_nodes.length
213
+ assert_equal cert_nodes[0].text, cert_nodes[1].text
214
+ assert_equal cert_nodes[2].text, cert_nodes[3].text
215
+ assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
216
+ end
217
+ end
218
+
219
+ end
220
+
153
221
  describe "when attribute service is configured with multiple attribute values" do
154
222
  let(:attr_svc) { REXML::XPath.first(xml_doc, "//md:AttributeConsumingService") }
155
223
  let(:req_attr) { REXML::XPath.first(xml_doc, "//md:RequestedAttribute") }
data/test/response_test.rb CHANGED
@@ -17,6 +17,7 @@ class RubySamlTest < Minitest::Test
17
17
  let(:response_wrapped) { OneLogin::RubySaml::Response.new(response_document_wrapped) }
18
18
  let(:response_multiple_attr_values) { OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values)) }
19
19
  let(:response_valid_signed) { OneLogin::RubySaml::Response.new(response_document_valid_signed) }
20
+ let(:response_valid_signed_without_recipient) { OneLogin::RubySaml::Response.new(response_document_valid_signed, {:skip_recipient_check => true })}
20
21
  let(:response_valid_signed_without_x509certificate) { OneLogin::RubySaml::Response.new(response_document_valid_signed_without_x509certificate) }
21
22
  let(:response_no_id) { OneLogin::RubySaml::Response.new(read_invalid_response("no_id.xml.base64")) }
22
23
  let(:response_no_version) { OneLogin::RubySaml::Response.new(read_invalid_response("no_saml2.xml.base64")) }
@@ -241,19 +242,19 @@ class RubySamlTest < Minitest::Test
241
242
  end
242
243
 
243
244
  it "return true when the response is initialized with valid data" do
244
- response_valid_signed.stubs(:conditions).returns(nil)
245
- response_valid_signed.settings = settings
246
- response_valid_signed.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
247
- assert response_valid_signed.is_valid?
248
- assert_empty response_valid_signed.errors
245
+ response_valid_signed_without_recipient.stubs(:conditions).returns(nil)
246
+ response_valid_signed_without_recipient.settings = settings
247
+ response_valid_signed_without_recipient.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
248
+ assert response_valid_signed_without_recipient.is_valid?
249
+ assert_empty response_valid_signed_without_recipient.errors
249
250
  end
250
251
 
251
252
  it "return true when the response is initialized with valid data and using certificate instead of fingerprint" do
252
- response_valid_signed.stubs(:conditions).returns(nil)
253
- response_valid_signed.settings = settings
254
- response_valid_signed.settings.idp_cert = ruby_saml_cert_text
255
- assert response_valid_signed.is_valid?
256
- assert_empty response_valid_signed.errors
253
+ response_valid_signed_without_recipient.stubs(:conditions).returns(nil)
254
+ response_valid_signed_without_recipient.settings = settings
255
+ response_valid_signed_without_recipient.settings.idp_cert = ruby_saml_cert_text
256
+ assert response_valid_signed_without_recipient.is_valid?
257
+ assert_empty response_valid_signed_without_recipient.errors
257
258
  end
258
259
 
259
260
  it "return false when response is initialized with blank data" do
@@ -282,11 +283,11 @@ class RubySamlTest < Minitest::Test
282
283
  end
283
284
 
284
285
  it "should be idempotent when the response is initialized with valid data" do
285
- response_valid_signed.stubs(:conditions).returns(nil)
286
- response_valid_signed.settings = settings
287
- response_valid_signed.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
288
- assert response_valid_signed.is_valid?
289
- assert response_valid_signed.is_valid?
286
+ response_valid_signed_without_recipient.stubs(:conditions).returns(nil)
287
+ response_valid_signed_without_recipient.settings = settings
288
+ response_valid_signed_without_recipient.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
289
+ assert response_valid_signed_without_recipient.is_valid?
290
+ assert response_valid_signed_without_recipient.is_valid?
290
291
  end
291
292
 
292
293
  it "not allow signature wrapping attack" do
@@ -382,6 +383,7 @@ class RubySamlTest < Minitest::Test
382
383
 
383
384
  it "return true when a nil URI is given in the ds:Reference" do
384
385
  settings.idp_cert = ruby_saml_cert_text
386
+ settings.assertion_consumer_service_url = "http://localhost:9001/v1/users/authorize/saml"
385
387
  response_without_reference_uri.settings = settings
386
388
  response_without_reference_uri.stubs(:conditions).returns(nil)
387
389
  response_without_reference_uri.is_valid?
@@ -676,6 +678,28 @@ class RubySamlTest < Minitest::Test
676
678
  assert_includes response_invalid_subjectconfirmation_noa.errors, "A valid SubjectConfirmation was not found on this Response"
677
679
  end
678
680
 
681
+ it "return true when valid subject confirmation recipient" do
682
+ response_valid_signed.settings = settings
683
+ response_valid_signed.settings.assertion_consumer_service_url = 'recipient'
684
+ assert response_valid_signed.send(:validate_subject_confirmation)
685
+ assert_empty response_valid_signed.errors
686
+ assert_empty response_valid_signed.errors
687
+ end
688
+
689
+ it "return false when invalid subject confirmation recipient" do
690
+ response_valid_signed.settings = settings
691
+ response_valid_signed.settings.assertion_consumer_service_url = 'not-the-recipient'
692
+ assert !response_valid_signed.send(:validate_subject_confirmation)
693
+ assert_includes response_valid_signed.errors, "A valid SubjectConfirmation was not found on this Response"
694
+ end
695
+
696
+ it "return false when invalid subject confirmation recipient, but skipping the check(default)" do
697
+ response_valid_signed_without_recipient.settings = settings
698
+ response_valid_signed_without_recipient.settings.assertion_consumer_service_url = 'not-the-recipient'
699
+ assert response_valid_signed_without_recipient.send(:validate_subject_confirmation)
700
+ assert_empty response_valid_signed_without_recipient.errors
701
+ end
702
+
679
703
  it "return true when the skip_subject_confirmation option is passed and the subject confirmation is valid" do
680
704
  opts = {}
681
705
  opts[:skip_subject_confirmation] = true
@@ -796,7 +820,30 @@ class RubySamlTest < Minitest::Test
796
820
  response_wrapped.settings = settings
797
821
  assert !response_wrapped.send(:validate_signature)
798
822
  assert_includes response_wrapped.errors, "Invalid Signature on SAML Response"
799
- end
823
+ end
824
+ end
825
+
826
+ describe "#validate_signature with multiple idp certs" do
827
+ it "return true when at least a cert on idp_cert_multi is valid" do
828
+ settings.idp_cert_multi = {
829
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text],
830
+ :encryption => []
831
+ }
832
+ response_valid_signed.settings = settings
833
+ assert response_valid_signed.send(:validate_signature)
834
+ assert_empty response_valid_signed.errors
835
+ end
836
+
837
+ it "return false when none cert on idp_cert_multi is valid" do
838
+ settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
839
+ settings.idp_cert_multi = {
840
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text2],
841
+ :encryption => []
842
+ }
843
+ response_valid_signed.settings = settings
844
+ assert !response_valid_signed.send(:validate_signature)
845
+ assert_includes response_valid_signed.errors, "Invalid Signature on SAML Response"
846
+ end
800
847
  end
801
848
 
802
849
  describe "#validate nameid" do
@@ -1123,6 +1170,7 @@ class RubySamlTest < Minitest::Test
1123
1170
  document.sign_document(private_key, cert)
1124
1171
 
1125
1172
  signed_response = OneLogin::RubySaml::Response.new(document.to_s)
1173
+ settings.assertion_consumer_service_url = "http://recipient"
1126
1174
  settings.idp_cert = ruby_saml_cert_text
1127
1175
  signed_response.settings = settings
1128
1176
  Timecop.freeze(Time.parse("2015-03-18T04:50:24Z")) do
@@ -1159,14 +1207,14 @@ class RubySamlTest < Minitest::Test
1159
1207
  end
1160
1208
 
1161
1209
  it 'is not possible when encryptID inside the assertion but no private key' do
1162
- response_encrypted_nameid.settings = settings
1163
- assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1164
- assert_equal "test@onelogin.com", response_encrypted_nameid.nameid
1165
- end
1210
+ response_encrypted_nameid.settings = settings
1211
+ assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1212
+ assert_equal "test@onelogin.com", response_encrypted_nameid.nameid
1213
+ end
1166
1214
 
1167
- assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1168
- assert_equal "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", response_encrypted_nameid.name_id_format
1169
- end
1215
+ assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1216
+ assert_equal "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", response_encrypted_nameid.name_id_format
1217
+ end
1170
1218
  end
1171
1219
 
1172
1220
  it 'is possible when encryptID inside the assertion and settings has the private key' do
@@ -1178,277 +1226,275 @@ class RubySamlTest < Minitest::Test
1178
1226
 
1179
1227
  end
1180
1228
 
1181
- end
1182
-
1183
- describe 'try to initialize an encrypted response' do
1184
- it 'raise if an encrypted assertion is found and no sp private key to decrypt it' do
1185
- error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it. Be sure you provided the :settings parameter at the initialize method"
1229
+ describe 'try to initialize an encrypted response' do
1230
+ it 'raise if an encrypted assertion is found and no sp private key to decrypt it' do
1231
+ error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it. Be sure you provided the :settings parameter at the initialize method"
1186
1232
 
1187
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1188
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1189
- end
1233
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1234
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1235
+ end
1190
1236
 
1191
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1192
- response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1193
- end
1237
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1238
+ response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1239
+ end
1194
1240
 
1195
- settings.certificate = ruby_saml_cert_text
1196
- settings.private_key = ruby_saml_key_text
1197
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1198
- response3 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1199
- response3.settings
1241
+ settings.certificate = ruby_saml_cert_text
1242
+ settings.private_key = ruby_saml_key_text
1243
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1244
+ response3 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1245
+ response3.settings
1246
+ end
1200
1247
  end
1201
- end
1202
1248
 
1203
- it 'raise if an encrypted assertion is found and the sp private key is wrong' do
1204
- settings.certificate = ruby_saml_cert_text
1205
- wrong_private_key = ruby_saml_key_text.sub!('A', 'B')
1206
- settings.private_key = wrong_private_key
1249
+ it 'raise if an encrypted assertion is found and the sp private key is wrong' do
1250
+ settings.certificate = ruby_saml_cert_text
1251
+ wrong_private_key = ruby_saml_key_text.sub!('A', 'B')
1252
+ settings.private_key = wrong_private_key
1207
1253
 
1208
- error_msg = "Neither PUB key nor PRIV key: nested asn1 error"
1209
- assert_raises(OpenSSL::PKey::RSAError, error_msg) do
1210
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1254
+ error_msg = "Neither PUB key nor PRIV key: nested asn1 error"
1255
+ assert_raises(OpenSSL::PKey::RSAError, error_msg) do
1256
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1257
+ end
1211
1258
  end
1212
- end
1213
1259
 
1214
- it 'return true if an encrypted assertion is found and settings initialized with private_key' do
1215
- settings.certificate = ruby_saml_cert_text
1216
- settings.private_key = ruby_saml_key_text
1217
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1218
- assert response.decrypted_document
1260
+ it 'return true if an encrypted assertion is found and settings initialized with private_key' do
1261
+ settings.certificate = ruby_saml_cert_text
1262
+ settings.private_key = ruby_saml_key_text
1263
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1264
+ assert response.decrypted_document
1219
1265
 
1220
- response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1221
- assert response2.decrypted_document
1266
+ response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1267
+ assert response2.decrypted_document
1222
1268
 
1223
- response3 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1224
- assert response3.decrypted_document
1269
+ response3 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1270
+ assert response3.decrypted_document
1225
1271
 
1226
- response4 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1227
- assert response4.decrypted_document
1272
+ response4 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1273
+ assert response4.decrypted_document
1274
+ end
1228
1275
  end
1229
- end
1230
1276
 
1231
- describe "retrieve nameID and attributes from encrypted assertion" do
1277
+ describe "retrieve nameID and attributes from encrypted assertion" do
1232
1278
 
1233
- before do
1234
- settings.idp_cert_fingerprint = 'EE:17:4E:FB:A8:81:71:12:0D:2A:78:43:BC:E7:0C:07:58:79:F4:F4'
1235
- settings.issuer = 'http://rubysaml.com:3000/saml/metadata'
1236
- settings.assertion_consumer_service_url = 'http://rubysaml.com:3000/saml/acs'
1237
- settings.certificate = ruby_saml_cert_text
1238
- settings.private_key = ruby_saml_key_text
1239
- end
1279
+ before do
1280
+ settings.idp_cert_fingerprint = 'EE:17:4E:FB:A8:81:71:12:0D:2A:78:43:BC:E7:0C:07:58:79:F4:F4'
1281
+ settings.issuer = 'http://rubysaml.com:3000/saml/metadata'
1282
+ settings.assertion_consumer_service_url = 'http://rubysaml.com:3000/saml/acs'
1283
+ settings.certificate = ruby_saml_cert_text
1284
+ settings.private_key = ruby_saml_key_text
1285
+ end
1240
1286
 
1241
- it 'is possible when signed_message_encrypted_unsigned_assertion' do
1242
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1243
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1244
- assert response.is_valid?
1245
- assert_empty response.errors
1246
- assert_equal "test", response.attributes[:uid]
1247
- assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1287
+ it 'is possible when signed_message_encrypted_unsigned_assertion' do
1288
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1289
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1290
+ assert response.is_valid?
1291
+ assert_empty response.errors
1292
+ assert_equal "test", response.attributes[:uid]
1293
+ assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1294
+ end
1248
1295
  end
1249
- end
1250
1296
 
1251
- it 'is possible when signed_message_encrypted_signed_assertion' do
1252
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1253
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1254
- assert response.is_valid?
1255
- assert_empty response.errors
1256
- assert_equal "test", response.attributes[:uid]
1257
- assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1297
+ it 'is possible when signed_message_encrypted_signed_assertion' do
1298
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1299
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1300
+ assert response.is_valid?
1301
+ assert_empty response.errors
1302
+ assert_equal "test", response.attributes[:uid]
1303
+ assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1304
+ end
1258
1305
  end
1259
- end
1260
1306
 
1261
- it 'is possible when unsigned_message_encrypted_signed_assertion' do
1262
- response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1263
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1264
- assert response.is_valid?
1265
- assert_empty response.errors
1266
- assert_equal "test", response.attributes[:uid]
1267
- assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1307
+ it 'is possible when unsigned_message_encrypted_signed_assertion' do
1308
+ response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1309
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1310
+ assert response.is_valid?
1311
+ assert_empty response.errors
1312
+ assert_equal "test", response.attributes[:uid]
1313
+ assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1314
+ end
1268
1315
  end
1269
- end
1270
1316
 
1271
- it 'is not possible when unsigned_message_encrypted_unsigned_assertion' do
1272
- response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1273
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1274
- assert !response.is_valid?
1275
- assert_includes response.errors, "Found an unexpected number of Signature Element. SAML Response rejected"
1317
+ it 'is not possible when unsigned_message_encrypted_unsigned_assertion' do
1318
+ response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1319
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1320
+ assert !response.is_valid?
1321
+ assert_includes response.errors, "Found an unexpected number of Signature Element. SAML Response rejected"
1322
+ end
1276
1323
  end
1277
1324
  end
1278
- end
1279
1325
 
1280
- describe "#decrypt_assertion" do
1281
- before do
1282
- settings.private_key = ruby_saml_key_text
1283
- end
1326
+ describe "#decrypt_assertion" do
1327
+ before do
1328
+ settings.private_key = ruby_saml_key_text
1329
+ end
1284
1330
 
1285
- describe "check right settings" do
1331
+ describe "check right settings" do
1286
1332
 
1287
- it "is not possible to decrypt the assertion if no private key" do
1288
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1333
+ it "is not possible to decrypt the assertion if no private key" do
1334
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1289
1335
 
1290
- encrypted_assertion_node = REXML::XPath.first(
1291
- response.document,
1292
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1293
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1294
- )
1295
- response.settings.private_key = nil
1336
+ encrypted_assertion_node = REXML::XPath.first(
1337
+ response.document,
1338
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1339
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1340
+ )
1341
+ response.settings.private_key = nil
1296
1342
 
1297
- error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it"
1298
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1343
+ error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it"
1344
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1345
+ decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1346
+ end
1347
+ end
1348
+
1349
+ it "is possible to decrypt the assertion if private key" do
1350
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1351
+
1352
+ encrypted_assertion_node = REXML::XPath.first(
1353
+ response.document,
1354
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1355
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1356
+ )
1299
1357
  decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1358
+
1359
+ encrypted_assertion_node2 = REXML::XPath.first(
1360
+ decrypted,
1361
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1362
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1363
+ )
1364
+ assert_nil encrypted_assertion_node2
1365
+ assert decrypted.name, "Assertion"
1300
1366
  end
1301
- end
1302
1367
 
1303
- it "is possible to decrypt the assertion if private key" do
1304
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1368
+ it "is possible to decrypt the assertion if private key provided and EncryptedKey RetrievalMethod presents in response" do
1369
+ settings.private_key = ruby_saml_key_text
1370
+ resp = read_response('response_with_retrieval_method.xml')
1371
+ response = OneLogin::RubySaml::Response.new(resp, :settings => settings)
1305
1372
 
1306
- encrypted_assertion_node = REXML::XPath.first(
1307
- response.document,
1308
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1309
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1310
- )
1311
- decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1373
+ encrypted_assertion_node = REXML::XPath.first(
1374
+ response.document,
1375
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1376
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1377
+ )
1378
+ decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1312
1379
 
1313
- encrypted_assertion_node2 = REXML::XPath.first(
1314
- decrypted,
1315
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1316
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1317
- )
1318
- assert_nil encrypted_assertion_node2
1319
- assert decrypted.name, "Assertion"
1320
- end
1380
+ encrypted_assertion_node2 = REXML::XPath.first(
1381
+ decrypted,
1382
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1383
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1384
+ )
1321
1385
 
1322
- it "is possible to decrypt the assertion if private key provided and EncryptedKey RetrievalMethod presents in response" do
1323
- settings.private_key = ruby_saml_key_text
1324
- resp = read_response('response_with_retrieval_method.xml')
1325
- response = OneLogin::RubySaml::Response.new(resp, :settings => settings)
1326
-
1327
- encrypted_assertion_node = REXML::XPath.first(
1328
- response.document,
1329
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1330
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1331
- )
1332
- decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1333
-
1334
- encrypted_assertion_node2 = REXML::XPath.first(
1335
- decrypted,
1336
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1337
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1338
- )
1339
-
1340
- assert_nil encrypted_assertion_node2
1341
- assert decrypted.name, "Assertion"
1342
- end
1343
-
1344
- it "is possible to decrypt the assertion if private key but no saml namespace on the Assertion Element that is inside the EncryptedAssertion" do
1345
- unsigned_message_encrypted_assertion_without_saml_namespace = read_response('unsigned_message_encrypted_assertion_without_saml_namespace.xml.base64')
1346
- response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_assertion_without_saml_namespace, :settings => settings)
1347
- encrypted_assertion_node = REXML::XPath.first(
1348
- response.document,
1349
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1350
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1351
- )
1352
- decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1353
-
1354
- encrypted_assertion_node2 = REXML::XPath.first(
1355
- decrypted,
1356
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1357
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1358
- )
1359
- assert_nil encrypted_assertion_node2
1360
- assert decrypted.name, "Assertion"
1361
- end
1362
- end
1386
+ assert_nil encrypted_assertion_node2
1387
+ assert decrypted.name, "Assertion"
1388
+ end
1363
1389
 
1364
- describe "check different encrypt methods supported" do
1365
- it "EncryptionMethod DES-192 && Key Encryption Algorithm RSA-1_5" do
1366
- unsigned_message_des192_encrypted_signed_assertion = read_response('unsigned_message_des192_encrypted_signed_assertion.xml.base64')
1367
- response = OneLogin::RubySaml::Response.new(unsigned_message_des192_encrypted_signed_assertion, :settings => settings)
1368
- assert_equal "test", response.attributes[:uid]
1369
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1370
- end
1390
+ it "is possible to decrypt the assertion if private key but no saml namespace on the Assertion Element that is inside the EncryptedAssertion" do
1391
+ unsigned_message_encrypted_assertion_without_saml_namespace = read_response('unsigned_message_encrypted_assertion_without_saml_namespace.xml.base64')
1392
+ response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_assertion_without_saml_namespace, :settings => settings)
1393
+ encrypted_assertion_node = REXML::XPath.first(
1394
+ response.document,
1395
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1396
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1397
+ )
1398
+ decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1371
1399
 
1372
- it "EncryptionMethod AES-128 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1373
- unsigned_message_aes128_encrypted_signed_assertion = read_response('unsigned_message_aes128_encrypted_signed_assertion.xml.base64')
1374
- response = OneLogin::RubySaml::Response.new(unsigned_message_aes128_encrypted_signed_assertion, :settings => settings)
1375
- assert_equal "test", response.attributes[:uid]
1376
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1400
+ encrypted_assertion_node2 = REXML::XPath.first(
1401
+ decrypted,
1402
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1403
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1404
+ )
1405
+ assert_nil encrypted_assertion_node2
1406
+ assert decrypted.name, "Assertion"
1407
+ end
1377
1408
  end
1378
1409
 
1379
- it "EncryptionMethod AES-192 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1380
- unsigned_message_aes192_encrypted_signed_assertion = read_response('unsigned_message_aes192_encrypted_signed_assertion.xml.base64')
1381
- response = OneLogin::RubySaml::Response.new(unsigned_message_aes192_encrypted_signed_assertion, :settings => settings)
1382
- assert_equal "test", response.attributes[:uid]
1383
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1384
- end
1410
+ describe "check different encrypt methods supported" do
1411
+ it "EncryptionMethod DES-192 && Key Encryption Algorithm RSA-1_5" do
1412
+ unsigned_message_des192_encrypted_signed_assertion = read_response('unsigned_message_des192_encrypted_signed_assertion.xml.base64')
1413
+ response = OneLogin::RubySaml::Response.new(unsigned_message_des192_encrypted_signed_assertion, :settings => settings)
1414
+ assert_equal "test", response.attributes[:uid]
1415
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1416
+ end
1385
1417
 
1386
- it "EncryptionMethod AES-256 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1387
- unsigned_message_aes256_encrypted_signed_assertion = read_response('unsigned_message_aes256_encrypted_signed_assertion.xml.base64')
1388
- response = OneLogin::RubySaml::Response.new(unsigned_message_aes256_encrypted_signed_assertion, :settings => settings)
1389
- assert_equal "test", response.attributes[:uid]
1390
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1418
+ it "EncryptionMethod AES-128 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1419
+ unsigned_message_aes128_encrypted_signed_assertion = read_response('unsigned_message_aes128_encrypted_signed_assertion.xml.base64')
1420
+ response = OneLogin::RubySaml::Response.new(unsigned_message_aes128_encrypted_signed_assertion, :settings => settings)
1421
+ assert_equal "test", response.attributes[:uid]
1422
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1423
+ end
1424
+
1425
+ it "EncryptionMethod AES-192 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1426
+ unsigned_message_aes192_encrypted_signed_assertion = read_response('unsigned_message_aes192_encrypted_signed_assertion.xml.base64')
1427
+ response = OneLogin::RubySaml::Response.new(unsigned_message_aes192_encrypted_signed_assertion, :settings => settings)
1428
+ assert_equal "test", response.attributes[:uid]
1429
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1430
+ end
1431
+
1432
+ it "EncryptionMethod AES-256 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1433
+ unsigned_message_aes256_encrypted_signed_assertion = read_response('unsigned_message_aes256_encrypted_signed_assertion.xml.base64')
1434
+ response = OneLogin::RubySaml::Response.new(unsigned_message_aes256_encrypted_signed_assertion, :settings => settings)
1435
+ assert_equal "test", response.attributes[:uid]
1436
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1437
+ end
1391
1438
  end
1439
+
1392
1440
  end
1441
+ describe "test qualified name id in attributes" do
1393
1442
 
1394
- end
1395
- describe "test qualified name id in attributes" do
1396
-
1397
- it "parsed the nameid" do
1398
- response = OneLogin::RubySaml::Response.new(read_response("signed_nameid_in_atts.xml"), :settings => settings)
1399
- response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1400
- assert_empty response.errors
1401
- assert_equal "test", response.attributes[:uid]
1402
- assert_equal "http://idp.example.com/metadata.php/ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1443
+ it "parsed the nameid" do
1444
+ response = OneLogin::RubySaml::Response.new(read_response("signed_nameid_in_atts.xml"), :settings => settings)
1445
+ response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1446
+ assert_empty response.errors
1447
+ assert_equal "test", response.attributes[:uid]
1448
+ assert_equal "http://idp.example.com/metadata.php/ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1449
+ end
1403
1450
  end
1404
- end
1405
1451
 
1406
- describe "test unqualified name id in attributes" do
1452
+ describe "test unqualified name id in attributes" do
1407
1453
 
1408
- it "parsed the nameid" do
1409
- response = OneLogin::RubySaml::Response.new(read_response("signed_unqual_nameid_in_atts.xml"), :settings => settings)
1410
- response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1411
- assert_empty response.errors
1412
- assert_equal "test", response.attributes[:uid]
1413
- assert_equal "ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1454
+ it "parsed the nameid" do
1455
+ response = OneLogin::RubySaml::Response.new(read_response("signed_unqual_nameid_in_atts.xml"), :settings => settings)
1456
+ response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1457
+ assert_empty response.errors
1458
+ assert_equal "test", response.attributes[:uid]
1459
+ assert_equal "ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1460
+ end
1414
1461
  end
1415
- end
1416
1462
 
1417
- describe "signature wrapping attack with encrypted assertion" do
1418
- it "should not be valid" do
1419
- settings.private_key = ruby_saml_key_text
1420
- signature_wrapping_attack = read_invalid_response("encrypted_new_attack.xml.base64")
1421
- response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1422
- response_wrapped.stubs(:conditions).returns(nil)
1423
- response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1424
- settings.idp_cert_fingerprint = "385b1eec71143f00db6af936e2ea12a28771d72c"
1425
- assert !response_wrapped.is_valid?
1426
- assert_includes response_wrapped.errors, "Found an invalid Signed Element. SAML Response rejected"
1463
+ describe "signature wrapping attack with encrypted assertion" do
1464
+ it "should not be valid" do
1465
+ settings.private_key = ruby_saml_key_text
1466
+ signature_wrapping_attack = read_invalid_response("encrypted_new_attack.xml.base64")
1467
+ response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1468
+ response_wrapped.stubs(:conditions).returns(nil)
1469
+ response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1470
+ settings.idp_cert_fingerprint = "385b1eec71143f00db6af936e2ea12a28771d72c"
1471
+ assert !response_wrapped.is_valid?
1472
+ assert_includes response_wrapped.errors, "Found an invalid Signed Element. SAML Response rejected"
1473
+ end
1427
1474
  end
1428
- end
1429
1475
 
1430
- describe "signature wrapping attack - concealed SAML response body" do
1431
- it "should not be valid" do
1432
- signature_wrapping_attack = read_invalid_response("response_with_concealed_signed_assertion.xml")
1433
- response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1434
- settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1435
- response_wrapped.stubs(:conditions).returns(nil)
1436
- response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1437
- assert !response_wrapped.is_valid?
1438
- assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1476
+ describe "signature wrapping attack - concealed SAML response body" do
1477
+ it "should not be valid" do
1478
+ signature_wrapping_attack = read_invalid_response("response_with_concealed_signed_assertion.xml")
1479
+ response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1480
+ settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1481
+ response_wrapped.stubs(:conditions).returns(nil)
1482
+ response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1483
+ assert !response_wrapped.is_valid?
1484
+ assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1485
+ end
1439
1486
  end
1440
- end
1441
1487
 
1442
- describe "signature wrapping attack - doubled signed assertion SAML response" do
1443
- it "should not be valid" do
1444
- signature_wrapping_attack = read_invalid_response("response_with_doubled_signed_assertion.xml")
1445
- response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1446
- settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1447
- response_wrapped.stubs(:conditions).returns(nil)
1448
- response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1449
- assert !response_wrapped.is_valid?
1450
- assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1488
+ describe "signature wrapping attack - doubled signed assertion SAML response" do
1489
+ it "should not be valid" do
1490
+ signature_wrapping_attack = read_invalid_response("response_with_doubled_signed_assertion.xml")
1491
+ response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1492
+ settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1493
+ response_wrapped.stubs(:conditions).returns(nil)
1494
+ response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1495
+ assert !response_wrapped.is_valid?
1496
+ assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1497
+ end
1451
1498
  end
1452
1499
  end
1453
-
1454
1500
  end