ruby-saml 1.4.2 → 1.4.3

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of ruby-saml might be problematic. Click here for more details.

Files changed (28) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +70 -13
  3. data/changelog.md +14 -1
  4. data/lib/onelogin/ruby-saml/idp_metadata_parser.rb +209 -97
  5. data/lib/onelogin/ruby-saml/logoutrequest.rb +2 -1
  6. data/lib/onelogin/ruby-saml/logoutresponse.rb +31 -8
  7. data/lib/onelogin/ruby-saml/metadata.rb +20 -14
  8. data/lib/onelogin/ruby-saml/response.rb +32 -15
  9. data/lib/onelogin/ruby-saml/saml_message.rb +1 -2
  10. data/lib/onelogin/ruby-saml/settings.rb +39 -1
  11. data/lib/onelogin/ruby-saml/slo_logoutrequest.rb +29 -7
  12. data/lib/onelogin/ruby-saml/version.rb +1 -1
  13. data/lib/schemas/xmldsig-core-schema.xsd +1 -1
  14. data/lib/xml_security.rb +25 -0
  15. data/test/certificates/ruby-saml-2.crt +15 -0
  16. data/test/idp_metadata_parser_test.rb +211 -15
  17. data/test/logoutresponse_test.rb +60 -0
  18. data/test/metadata/idp_descriptor.xml +26 -0
  19. data/test/metadata/idp_descriptor_2.xml +56 -0
  20. data/test/metadata/idp_descriptor_3.xml +14 -0
  21. data/test/metadata/idp_multiple_descriptors.xml +53 -0
  22. data/test/metadata_test.rb +70 -2
  23. data/test/response_test.rb +289 -243
  24. data/test/settings_test.rb +105 -22
  25. data/test/slo_logoutrequest_test.rb +66 -0
  26. data/test/test_helper.rb +23 -3
  27. metadata +13 -5
  28. data/test/responses/idp_descriptor.xml +0 -3
data/test/logoutresponse_test.rb CHANGED
@@ -223,6 +223,27 @@ class RubySamlTest < Minitest::Test
223
223
  settings.idp_cert = ruby_saml_cert_text
224
224
  end
225
225
 
226
+ it "return true when no idp_cert is provided and option :relax_signature_validation is present" do
227
+ settings.idp_cert = nil
228
+ settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
229
+ params['RelayState'] = params[:RelayState]
230
+ options = {}
231
+ options[:get_params] = params
232
+ options[:relax_signature_validation] = true
233
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
234
+ assert logoutresponse_sign_test.send(:validate_signature)
235
+ end
236
+
237
+ it "return false when no idp_cert is provided and no option :relax_signature_validation is present" do
238
+ settings.idp_cert = nil
239
+ settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
240
+ params['RelayState'] = params[:RelayState]
241
+ options = {}
242
+ options[:get_params] = params
243
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
244
+ assert !logoutresponse_sign_test.send(:validate_signature)
245
+ end
246
+
226
247
  it "return true when valid RSA_SHA1 Signature" do
227
248
  settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
228
249
  params['RelayState'] = params[:RelayState]
@@ -262,6 +283,45 @@ class RubySamlTest < Minitest::Test
262
283
  assert logoutresponse.errors.include? "Invalid Signature on Logout Response"
263
284
  end
264
285
  end
286
+
287
+ describe "#validate_signature" do
288
+ let (:params) { OneLogin::RubySaml::SloLogoutresponse.new.create_params(settings, random_id, "Custom Logout Message", :RelayState => 'http://example.com') }
289
+
290
+ before do
291
+ settings.soft = true
292
+ settings.idp_slo_target_url = "http://example.com?field=value"
293
+ settings.security[:signature_method] = XMLSecurity::Document::RSA_SHA1
294
+ settings.security[:logout_responses_signed] = true
295
+ settings.security[:embed_sign] = false
296
+ settings.certificate = ruby_saml_cert_text
297
+ settings.private_key = ruby_saml_key_text
298
+ settings.idp_cert = nil
299
+ end
300
+
301
+ it "return true when at least a idp_cert is valid" do
302
+ params['RelayState'] = params[:RelayState]
303
+ options = {}
304
+ options[:get_params] = params
305
+ settings.idp_cert_multi = {
306
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text],
307
+ :encryption => []
308
+ }
309
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
310
+ assert logoutresponse_sign_test.send(:validate_signature)
311
+ end
312
+
313
+ it "return false when none cert on idp_cert_multi is valid" do
314
+ params['RelayState'] = params[:RelayState]
315
+ options = {}
316
+ options[:get_params] = params
317
+ settings.idp_cert_multi = {
318
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text2],
319
+ :encryption => []
320
+ }
321
+ logoutresponse_sign_test = OneLogin::RubySaml::Logoutresponse.new(params['SAMLResponse'], settings, options)
322
+ assert !logoutresponse_sign_test.send(:validate_signature)
323
+ end
324
+ end
265
325
  end
266
326
  end
267
327
  end
data/test/metadata/idp_descriptor.xml ADDED
@@ -0,0 +1,26 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <md:EntityDescriptor entityID="https://hello.example.com/access/saml/idp.xml" validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
3
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
4
+ <md:KeyDescriptor use="signing">
5
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
6
+ <ds:X509Data>
7
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
8
+ </ds:X509Data>
9
+ </ds:KeyInfo>
10
+ </md:KeyDescriptor>
11
+ <md:KeyDescriptor use="encryption">
12
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
13
+ <ds:X509Data>
14
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
15
+ </ds:X509Data>
16
+ </ds:KeyInfo>
17
+ </md:KeyDescriptor>
18
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
19
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
20
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
21
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
22
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
23
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
24
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
25
+ </md:IDPSSODescriptor>
26
+ </md:EntityDescriptor>
data/test/metadata/idp_descriptor_2.xml ADDED
@@ -0,0 +1,56 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <md:EntityDescriptor entityID="https://hello.example.com/access/saml/idp.xml" validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
3
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
4
+ <md:KeyDescriptor use="signing">
5
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
6
+ <ds:X509Data>
7
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
8
+ </ds:X509Data>
9
+ </ds:KeyInfo>
10
+ </md:KeyDescriptor>
11
+ <md:KeyDescriptor use="signing">
12
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
13
+ <ds:X509Data>
14
+ <ds:X509Certificate>MIIEZTCCA02gAwIBAgIUPyy/A3bZAZ4m28PzEUUoT7RJhxIwDQYJKoZIhvcNAQEF
15
+ BQAwcjELMAkGA1UEBhMCVVMxKzApBgNVBAoMIk9uZUxvZ2luIFRlc3QgKHNnYXJj
16
+ aWEtdXMtcHJlcHJvZCkxFTATBgNVBAsMDE9uZUxvZ2luIElkUDEfMB0GA1UEAwwW
17
+ T25lTG9naW4gQWNjb3VudCA4OTE0NjAeFw0xNjA4MDQyMjI5MzdaFw0yMTA4MDUy
18
+ MjI5MzdaMHIxCzAJBgNVBAYTAlVTMSswKQYDVQQKDCJPbmVMb2dpbiBUZXN0IChz
19
+ Z2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQLDAxPbmVMb2dpbiBJZFAxHzAdBgNV
20
+ BAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDYwggEiMA0GCSqGSIb3DQEBAQUAA4IB
21
+ DwAwggEKAoIBAQDN6iqQGcLOCglNO42I2rkzE05UXSiMXT6c8ALThMMiaDw6qqzo
22
+ 3sd/tKK+NcNKWLIIC8TozWVyh5ykUiVZps+08xil7VsTU7E+wKu3kvmOsvw2wlRw
23
+ tnoKZJwYhnr+RkBa+h1r3ZYUgXm1ZPeHMKj1g18KaWz9+MxYL6BhKqrOzfW/P2xx
24
+ VRcFH7/pq+ZsDdgNzD2GD+apzY4MZyZj/N6BpBWJ0GlFsmtBegpbX3LBitJuFkk5
25
+ L4/U/jjF1AJa3boBdCUVfATqO5G03H4XS1GySjBIRQXmlUF52rLjg6xCgWJ30/+t
26
+ 1X+IHLJeixiQ0vxyh6C4/usCEt94cgD1r8ADAgMBAAGjgfIwge8wDAYDVR0TAQH/
27
+ BAIwADAdBgNVHQ4EFgQUPW0DcH0G3IwynWgi74co4wZ6n7gwga8GA1UdIwSBpzCB
28
+ pIAUPW0DcH0G3IwynWgi74co4wZ6n7ihdqR0MHIxCzAJBgNVBAYTAlVTMSswKQYD
29
+ VQQKDCJPbmVMb2dpbiBUZXN0IChzZ2FyY2lhLXVzLXByZXByb2QpMRUwEwYDVQQL
30
+ DAxPbmVMb2dpbiBJZFAxHzAdBgNVBAMMFk9uZUxvZ2luIEFjY291bnQgODkxNDaC
31
+ FD8svwN22QGeJtvD8xFFKE+0SYcSMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0B
32
+ AQUFAAOCAQEAQhB4q9jrycwbHrDSoYR1X4LFFzvJ9Us75wQquRHXpdyS9D6HUBXM
33
+ GI6ahPicXCQrfLgN8vzMIiqZqfySXXv/8/dxe/X4UsWLYKYJHDJmxXD5EmWTa65c
34
+ hjkeP1oJAc8f3CKCpcP2lOBTthbnk2fEVAeLHR4xNdQO0VvGXWO9BliYPpkYqUIB
35
+ vlm+Fg9mF7AM/Uagq2503XXIE1Lq//HON68P10vNMwLSKOtYLsoTiCnuIKGJqG37
36
+ MsZVjQ1ZPRcO+LSLkq0i91gFxrOrVCrgztX4JQi5XkvEsYZGIXXjwHqxTVyt3adZ
37
+ WQO0LPxPqRiUqUzyhDhLo/xXNrHCu4VbMw==</ds:X509Certificate>
38
+ </ds:X509Data>
39
+ </ds:KeyInfo>
40
+ </md:KeyDescriptor>
41
+ <md:KeyDescriptor use="encryption">
42
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
43
+ <ds:X509Data>
44
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
45
+ </ds:X509Data>
46
+ </ds:KeyInfo>
47
+ </md:KeyDescriptor>
48
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
49
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
50
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
51
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
52
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
53
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
54
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
55
+ </md:IDPSSODescriptor>
56
+ </md:EntityDescriptor>
data/test/metadata/idp_descriptor_3.xml ADDED
@@ -0,0 +1,14 @@
1
+ <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" entityID="https://idp.example.com/idp/shibboleth">
2
+ <md:IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
3
+ <md:KeyDescriptor use="signing">
4
+ <ds:KeyInfo>
5
+ <ds:X509Data>
6
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
7
+ </ds:X509Data>
8
+ </ds:KeyInfo>
9
+ </md:KeyDescriptor>
10
+ <md:SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://idp.example.com/idp/profile/Shibboleth/SSO"/>
11
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://idp.example.com/idp/profile/SAML2/POST/SSO"/>
12
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://idp.example.com/idp/profile/SAML2/Redirect/SSO"/>
13
+ </md:IDPSSODescriptor>
14
+ </md:EntityDescriptor>
data/test/metadata/idp_multiple_descriptors.xml ADDED
@@ -0,0 +1,53 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <md:EntitiesDescriptor validUntil="2014-04-17T18:02:33.910Z" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
3
+ <md:EntityDescriptor entityID="https://foo.example.com/access/saml/idp.xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="md:EntityDescriptorType">
4
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
5
+ <md:KeyDescriptor use="signing">
6
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
7
+ <ds:X509Data>
8
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
9
+ </ds:X509Data>
10
+ </ds:KeyInfo>
11
+ </md:KeyDescriptor>
12
+ <md:KeyDescriptor use="encryption">
13
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
14
+ <ds:X509Data>
15
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
16
+ </ds:X509Data>
17
+ </ds:KeyInfo>
18
+ </md:KeyDescriptor>
19
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
20
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
21
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
22
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
23
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
24
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
25
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
26
+ </md:IDPSSODescriptor>
27
+ </md:EntityDescriptor>
28
+ <md:EntityDescriptor entityID="https://bar.example.com/access/saml/idp.xml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="md:EntityDescriptorType">
29
+ <md:IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
30
+ <md:KeyDescriptor use="signing">
31
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
32
+ <ds:X509Data>
33
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
34
+ </ds:X509Data>
35
+ </ds:KeyInfo>
36
+ </md:KeyDescriptor>
37
+ <md:KeyDescriptor use="encryption">
38
+ <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
39
+ <ds:X509Data>
40
+ <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF4T1RJeU5UUXhPRm9YRFRNeU1EUXgKTkRJeU5UUXhPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXFqaWUzUjJvaStwRGFldndJeXMvbWJVVApubkdsa3h0ZGlrcnExMXZleHd4SmlQTmhtaHFSVzNtVXVKRXpsbElkVkw2RW14R1lUcXBxZjkzSGxoa3NhZUowCjhVZ2pQOVVtTVlyaFZKdTFqY0ZXVjdmei9yKzIxL2F3VG5EVjlzTVlRcXVJUllZeTdiRzByMU9iaXdkb3ZudGsKN2dGSTA2WjB2WmFjREU1Ym9xVUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJTUk9OOEdKOG8rOGpnRnRqa3R3WmRxeDZCUnlUQVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVrVGpmQmlmS1B2STRCYlk1TGNHWGFzZWdVY21oZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FDRQpUQWVKVERTQVc2ejFVRlRWN1FyZWg0VUxGT1JhajkrZUN1RjNLV0RIYyswSVFDajlyZG5ERzRRL3dmNy9yYVEwCkpuUFFDU0NkclBMSmV5b1BIN1FhVHdvYUY3ZHpWdzRMQ3N5TkpURld4NGNNNTBWdzZSNWZET2dpQzhic2ZmUzgKQkptb3VscnJaRE5OVmpHOG1XNmNMeHJZdlZRT3JSVmVjQ0ZJZ3NzQ2JBPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
41
+ </ds:X509Data>
42
+ </ds:KeyInfo>
43
+ </md:KeyDescriptor>
44
+ <md:SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/logout" ResponseLocation="https://hello.example.com/access/saml/logout"/>
45
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>
46
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>
47
+ <md:NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</md:NameIDFormat>
48
+ <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://hello.example.com/access/saml/login"/>
49
+ <saml:Attribute Name="AuthToken" NameFormat="urn:oasis:names:tc:SAML:2.0:att rname-format:basic" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
50
+ <saml:Attribute Name="SSOStartPage" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"/>
51
+ </md:IDPSSODescriptor>
52
+ </md:EntityDescriptor>
53
+ </md:EntitiesDescriptor>
data/test/metadata_test.rb CHANGED
@@ -128,8 +128,6 @@ class MetadataTest < Minitest::Test
128
128
 
129
129
  it "generates Service Provider Metadata with AuthnRequestsSigned" do
130
130
  assert_equal "true", spsso_descriptor.attribute("AuthnRequestsSigned").value
131
- assert_equal ruby_saml_cert.to_der, cert.to_der
132
-
133
131
  assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
134
132
  end
135
133
  end
@@ -141,6 +139,7 @@ class MetadataTest < Minitest::Test
141
139
 
142
140
  it "generates Service Provider Metadata with X509Certificate for encrypt" do
143
141
  assert_equal 2, key_descriptors.length
142
+
144
143
  assert_equal "encryption", key_descriptors[1].attribute("use").value
145
144
 
146
145
  assert_equal 2, cert_nodes.length
@@ -150,6 +149,75 @@ class MetadataTest < Minitest::Test
150
149
  end
151
150
  end
152
151
 
152
+ describe "with a future SP certificate" do
153
+ let(:key_descriptors) do
154
+ REXML::XPath.match(
155
+ xml_doc,
156
+ "//md:KeyDescriptor",
157
+ "md" => "urn:oasis:names:tc:SAML:2.0:metadata"
158
+ )
159
+ end
160
+ let(:cert_nodes) do
161
+ REXML::XPath.match(
162
+ xml_doc,
163
+ "//md:KeyDescriptor/ds:KeyInfo/ds:X509Data/ds:X509Certificate",
164
+ "md" => "urn:oasis:names:tc:SAML:2.0:metadata",
165
+ "ds" => "http://www.w3.org/2000/09/xmldsig#"
166
+ )
167
+ end
168
+
169
+ before do
170
+ settings.certificate = ruby_saml_cert_text
171
+ settings.certificate_new = ruby_saml_cert_text2
172
+ end
173
+
174
+ it "generates Service Provider Metadata with 2 X509Certificate for sign" do
175
+ assert_equal 2, key_descriptors.length
176
+ assert_equal "signing", key_descriptors[0].attribute("use").value
177
+ assert_equal "signing", key_descriptors[1].attribute("use").value
178
+
179
+ cert = OpenSSL::X509::Certificate.new(Base64.decode64(cert_nodes[0].text))
180
+ cert_new = OpenSSL::X509::Certificate.new(Base64.decode64(cert_nodes[1].text))
181
+
182
+ assert_equal 2, cert_nodes.length
183
+ assert_equal ruby_saml_cert.to_der, cert.to_der
184
+ assert_equal ruby_saml_cert2.to_der, cert_new.to_der
185
+
186
+ assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
187
+ end
188
+
189
+ describe "and signed authentication requests" do
190
+ before do
191
+ settings.security[:authn_requests_signed] = true
192
+ end
193
+
194
+ it "generates Service Provider Metadata with AuthnRequestsSigned" do
195
+ assert_equal "true", spsso_descriptor.attribute("AuthnRequestsSigned").value
196
+ assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
197
+ end
198
+ end
199
+
200
+ describe "and encrypted assertions" do
201
+ before do
202
+ settings.security[:want_assertions_encrypted] = true
203
+ end
204
+
205
+ it "generates Service Provider Metadata with X509Certificate for encrypt" do
206
+ assert_equal 4, key_descriptors.length
207
+ assert_equal "signing", key_descriptors[0].attribute("use").value
208
+ assert_equal "encryption", key_descriptors[1].attribute("use").value
209
+ assert_equal "signing", key_descriptors[2].attribute("use").value
210
+ assert_equal "encryption", key_descriptors[3].attribute("use").value
211
+
212
+ assert_equal 4, cert_nodes.length
213
+ assert_equal cert_nodes[0].text, cert_nodes[1].text
214
+ assert_equal cert_nodes[2].text, cert_nodes[3].text
215
+ assert validate_xml!(xml_text, "saml-schema-metadata-2.0.xsd")
216
+ end
217
+ end
218
+
219
+ end
220
+
153
221
  describe "when attribute service is configured with multiple attribute values" do
154
222
  let(:attr_svc) { REXML::XPath.first(xml_doc, "//md:AttributeConsumingService") }
155
223
  let(:req_attr) { REXML::XPath.first(xml_doc, "//md:RequestedAttribute") }
data/test/response_test.rb CHANGED
@@ -17,6 +17,7 @@ class RubySamlTest < Minitest::Test
17
17
  let(:response_wrapped) { OneLogin::RubySaml::Response.new(response_document_wrapped) }
18
18
  let(:response_multiple_attr_values) { OneLogin::RubySaml::Response.new(fixture(:response_with_multiple_attribute_values)) }
19
19
  let(:response_valid_signed) { OneLogin::RubySaml::Response.new(response_document_valid_signed) }
20
+ let(:response_valid_signed_without_recipient) { OneLogin::RubySaml::Response.new(response_document_valid_signed, {:skip_recipient_check => true })}
20
21
  let(:response_valid_signed_without_x509certificate) { OneLogin::RubySaml::Response.new(response_document_valid_signed_without_x509certificate) }
21
22
  let(:response_no_id) { OneLogin::RubySaml::Response.new(read_invalid_response("no_id.xml.base64")) }
22
23
  let(:response_no_version) { OneLogin::RubySaml::Response.new(read_invalid_response("no_saml2.xml.base64")) }
@@ -241,19 +242,19 @@ class RubySamlTest < Minitest::Test
241
242
  end
242
243
 
243
244
  it "return true when the response is initialized with valid data" do
244
- response_valid_signed.stubs(:conditions).returns(nil)
245
- response_valid_signed.settings = settings
246
- response_valid_signed.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
247
- assert response_valid_signed.is_valid?
248
- assert_empty response_valid_signed.errors
245
+ response_valid_signed_without_recipient.stubs(:conditions).returns(nil)
246
+ response_valid_signed_without_recipient.settings = settings
247
+ response_valid_signed_without_recipient.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
248
+ assert response_valid_signed_without_recipient.is_valid?
249
+ assert_empty response_valid_signed_without_recipient.errors
249
250
  end
250
251
 
251
252
  it "return true when the response is initialized with valid data and using certificate instead of fingerprint" do
252
- response_valid_signed.stubs(:conditions).returns(nil)
253
- response_valid_signed.settings = settings
254
- response_valid_signed.settings.idp_cert = ruby_saml_cert_text
255
- assert response_valid_signed.is_valid?
256
- assert_empty response_valid_signed.errors
253
+ response_valid_signed_without_recipient.stubs(:conditions).returns(nil)
254
+ response_valid_signed_without_recipient.settings = settings
255
+ response_valid_signed_without_recipient.settings.idp_cert = ruby_saml_cert_text
256
+ assert response_valid_signed_without_recipient.is_valid?
257
+ assert_empty response_valid_signed_without_recipient.errors
257
258
  end
258
259
 
259
260
  it "return false when response is initialized with blank data" do
@@ -282,11 +283,11 @@ class RubySamlTest < Minitest::Test
282
283
  end
283
284
 
284
285
  it "should be idempotent when the response is initialized with valid data" do
285
- response_valid_signed.stubs(:conditions).returns(nil)
286
- response_valid_signed.settings = settings
287
- response_valid_signed.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
288
- assert response_valid_signed.is_valid?
289
- assert response_valid_signed.is_valid?
286
+ response_valid_signed_without_recipient.stubs(:conditions).returns(nil)
287
+ response_valid_signed_without_recipient.settings = settings
288
+ response_valid_signed_without_recipient.settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
289
+ assert response_valid_signed_without_recipient.is_valid?
290
+ assert response_valid_signed_without_recipient.is_valid?
290
291
  end
291
292
 
292
293
  it "not allow signature wrapping attack" do
@@ -382,6 +383,7 @@ class RubySamlTest < Minitest::Test
382
383
 
383
384
  it "return true when a nil URI is given in the ds:Reference" do
384
385
  settings.idp_cert = ruby_saml_cert_text
386
+ settings.assertion_consumer_service_url = "http://localhost:9001/v1/users/authorize/saml"
385
387
  response_without_reference_uri.settings = settings
386
388
  response_without_reference_uri.stubs(:conditions).returns(nil)
387
389
  response_without_reference_uri.is_valid?
@@ -676,6 +678,28 @@ class RubySamlTest < Minitest::Test
676
678
  assert_includes response_invalid_subjectconfirmation_noa.errors, "A valid SubjectConfirmation was not found on this Response"
677
679
  end
678
680
 
681
+ it "return true when valid subject confirmation recipient" do
682
+ response_valid_signed.settings = settings
683
+ response_valid_signed.settings.assertion_consumer_service_url = 'recipient'
684
+ assert response_valid_signed.send(:validate_subject_confirmation)
685
+ assert_empty response_valid_signed.errors
686
+ assert_empty response_valid_signed.errors
687
+ end
688
+
689
+ it "return false when invalid subject confirmation recipient" do
690
+ response_valid_signed.settings = settings
691
+ response_valid_signed.settings.assertion_consumer_service_url = 'not-the-recipient'
692
+ assert !response_valid_signed.send(:validate_subject_confirmation)
693
+ assert_includes response_valid_signed.errors, "A valid SubjectConfirmation was not found on this Response"
694
+ end
695
+
696
+ it "return false when invalid subject confirmation recipient, but skipping the check(default)" do
697
+ response_valid_signed_without_recipient.settings = settings
698
+ response_valid_signed_without_recipient.settings.assertion_consumer_service_url = 'not-the-recipient'
699
+ assert response_valid_signed_without_recipient.send(:validate_subject_confirmation)
700
+ assert_empty response_valid_signed_without_recipient.errors
701
+ end
702
+
679
703
  it "return true when the skip_subject_confirmation option is passed and the subject confirmation is valid" do
680
704
  opts = {}
681
705
  opts[:skip_subject_confirmation] = true
@@ -796,7 +820,30 @@ class RubySamlTest < Minitest::Test
796
820
  response_wrapped.settings = settings
797
821
  assert !response_wrapped.send(:validate_signature)
798
822
  assert_includes response_wrapped.errors, "Invalid Signature on SAML Response"
799
- end
823
+ end
824
+ end
825
+
826
+ describe "#validate_signature with multiple idp certs" do
827
+ it "return true when at least a cert on idp_cert_multi is valid" do
828
+ settings.idp_cert_multi = {
829
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text],
830
+ :encryption => []
831
+ }
832
+ response_valid_signed.settings = settings
833
+ assert response_valid_signed.send(:validate_signature)
834
+ assert_empty response_valid_signed.errors
835
+ end
836
+
837
+ it "return false when none cert on idp_cert_multi is valid" do
838
+ settings.idp_cert_fingerprint = ruby_saml_cert_fingerprint
839
+ settings.idp_cert_multi = {
840
+ :signing => [ruby_saml_cert_text2, ruby_saml_cert_text2],
841
+ :encryption => []
842
+ }
843
+ response_valid_signed.settings = settings
844
+ assert !response_valid_signed.send(:validate_signature)
845
+ assert_includes response_valid_signed.errors, "Invalid Signature on SAML Response"
846
+ end
800
847
  end
801
848
 
802
849
  describe "#validate nameid" do
@@ -1123,6 +1170,7 @@ class RubySamlTest < Minitest::Test
1123
1170
  document.sign_document(private_key, cert)
1124
1171
 
1125
1172
  signed_response = OneLogin::RubySaml::Response.new(document.to_s)
1173
+ settings.assertion_consumer_service_url = "http://recipient"
1126
1174
  settings.idp_cert = ruby_saml_cert_text
1127
1175
  signed_response.settings = settings
1128
1176
  Timecop.freeze(Time.parse("2015-03-18T04:50:24Z")) do
@@ -1159,14 +1207,14 @@ class RubySamlTest < Minitest::Test
1159
1207
  end
1160
1208
 
1161
1209
  it 'is not possible when encryptID inside the assertion but no private key' do
1162
- response_encrypted_nameid.settings = settings
1163
- assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1164
- assert_equal "test@onelogin.com", response_encrypted_nameid.nameid
1165
- end
1210
+ response_encrypted_nameid.settings = settings
1211
+ assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1212
+ assert_equal "test@onelogin.com", response_encrypted_nameid.nameid
1213
+ end
1166
1214
 
1167
- assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1168
- assert_equal "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", response_encrypted_nameid.name_id_format
1169
- end
1215
+ assert_raises(OneLogin::RubySaml::ValidationError, "An EncryptedID found and no SP private key found on the settings to decrypt it") do
1216
+ assert_equal "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress", response_encrypted_nameid.name_id_format
1217
+ end
1170
1218
  end
1171
1219
 
1172
1220
  it 'is possible when encryptID inside the assertion and settings has the private key' do
@@ -1178,277 +1226,275 @@ class RubySamlTest < Minitest::Test
1178
1226
 
1179
1227
  end
1180
1228
 
1181
- end
1182
-
1183
- describe 'try to initialize an encrypted response' do
1184
- it 'raise if an encrypted assertion is found and no sp private key to decrypt it' do
1185
- error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it. Be sure you provided the :settings parameter at the initialize method"
1229
+ describe 'try to initialize an encrypted response' do
1230
+ it 'raise if an encrypted assertion is found and no sp private key to decrypt it' do
1231
+ error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it. Be sure you provided the :settings parameter at the initialize method"
1186
1232
 
1187
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1188
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1189
- end
1233
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1234
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1235
+ end
1190
1236
 
1191
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1192
- response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1193
- end
1237
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1238
+ response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1239
+ end
1194
1240
 
1195
- settings.certificate = ruby_saml_cert_text
1196
- settings.private_key = ruby_saml_key_text
1197
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1198
- response3 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1199
- response3.settings
1241
+ settings.certificate = ruby_saml_cert_text
1242
+ settings.private_key = ruby_saml_key_text
1243
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1244
+ response3 = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion)
1245
+ response3.settings
1246
+ end
1200
1247
  end
1201
- end
1202
1248
 
1203
- it 'raise if an encrypted assertion is found and the sp private key is wrong' do
1204
- settings.certificate = ruby_saml_cert_text
1205
- wrong_private_key = ruby_saml_key_text.sub!('A', 'B')
1206
- settings.private_key = wrong_private_key
1249
+ it 'raise if an encrypted assertion is found and the sp private key is wrong' do
1250
+ settings.certificate = ruby_saml_cert_text
1251
+ wrong_private_key = ruby_saml_key_text.sub!('A', 'B')
1252
+ settings.private_key = wrong_private_key
1207
1253
 
1208
- error_msg = "Neither PUB key nor PRIV key: nested asn1 error"
1209
- assert_raises(OpenSSL::PKey::RSAError, error_msg) do
1210
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1254
+ error_msg = "Neither PUB key nor PRIV key: nested asn1 error"
1255
+ assert_raises(OpenSSL::PKey::RSAError, error_msg) do
1256
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1257
+ end
1211
1258
  end
1212
- end
1213
1259
 
1214
- it 'return true if an encrypted assertion is found and settings initialized with private_key' do
1215
- settings.certificate = ruby_saml_cert_text
1216
- settings.private_key = ruby_saml_key_text
1217
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1218
- assert response.decrypted_document
1260
+ it 'return true if an encrypted assertion is found and settings initialized with private_key' do
1261
+ settings.certificate = ruby_saml_cert_text
1262
+ settings.private_key = ruby_saml_key_text
1263
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1264
+ assert response.decrypted_document
1219
1265
 
1220
- response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1221
- assert response2.decrypted_document
1266
+ response2 = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1267
+ assert response2.decrypted_document
1222
1268
 
1223
- response3 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1224
- assert response3.decrypted_document
1269
+ response3 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1270
+ assert response3.decrypted_document
1225
1271
 
1226
- response4 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1227
- assert response4.decrypted_document
1272
+ response4 = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1273
+ assert response4.decrypted_document
1274
+ end
1228
1275
  end
1229
- end
1230
1276
 
1231
- describe "retrieve nameID and attributes from encrypted assertion" do
1277
+ describe "retrieve nameID and attributes from encrypted assertion" do
1232
1278
 
1233
- before do
1234
- settings.idp_cert_fingerprint = 'EE:17:4E:FB:A8:81:71:12:0D:2A:78:43:BC:E7:0C:07:58:79:F4:F4'
1235
- settings.issuer = 'http://rubysaml.com:3000/saml/metadata'
1236
- settings.assertion_consumer_service_url = 'http://rubysaml.com:3000/saml/acs'
1237
- settings.certificate = ruby_saml_cert_text
1238
- settings.private_key = ruby_saml_key_text
1239
- end
1279
+ before do
1280
+ settings.idp_cert_fingerprint = 'EE:17:4E:FB:A8:81:71:12:0D:2A:78:43:BC:E7:0C:07:58:79:F4:F4'
1281
+ settings.issuer = 'http://rubysaml.com:3000/saml/metadata'
1282
+ settings.assertion_consumer_service_url = 'http://rubysaml.com:3000/saml/acs'
1283
+ settings.certificate = ruby_saml_cert_text
1284
+ settings.private_key = ruby_saml_key_text
1285
+ end
1240
1286
 
1241
- it 'is possible when signed_message_encrypted_unsigned_assertion' do
1242
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1243
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1244
- assert response.is_valid?
1245
- assert_empty response.errors
1246
- assert_equal "test", response.attributes[:uid]
1247
- assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1287
+ it 'is possible when signed_message_encrypted_unsigned_assertion' do
1288
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1289
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1290
+ assert response.is_valid?
1291
+ assert_empty response.errors
1292
+ assert_equal "test", response.attributes[:uid]
1293
+ assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1294
+ end
1248
1295
  end
1249
- end
1250
1296
 
1251
- it 'is possible when signed_message_encrypted_signed_assertion' do
1252
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1253
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1254
- assert response.is_valid?
1255
- assert_empty response.errors
1256
- assert_equal "test", response.attributes[:uid]
1257
- assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1297
+ it 'is possible when signed_message_encrypted_signed_assertion' do
1298
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_signed_assertion, :settings => settings)
1299
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1300
+ assert response.is_valid?
1301
+ assert_empty response.errors
1302
+ assert_equal "test", response.attributes[:uid]
1303
+ assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1304
+ end
1258
1305
  end
1259
- end
1260
1306
 
1261
- it 'is possible when unsigned_message_encrypted_signed_assertion' do
1262
- response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1263
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1264
- assert response.is_valid?
1265
- assert_empty response.errors
1266
- assert_equal "test", response.attributes[:uid]
1267
- assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1307
+ it 'is possible when unsigned_message_encrypted_signed_assertion' do
1308
+ response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_signed_assertion, :settings => settings)
1309
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1310
+ assert response.is_valid?
1311
+ assert_empty response.errors
1312
+ assert_equal "test", response.attributes[:uid]
1313
+ assert_equal "98e2bb61075e951b37d6b3be6954a54b340d86c7", response.nameid
1314
+ end
1268
1315
  end
1269
- end
1270
1316
 
1271
- it 'is not possible when unsigned_message_encrypted_unsigned_assertion' do
1272
- response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1273
- Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1274
- assert !response.is_valid?
1275
- assert_includes response.errors, "Found an unexpected number of Signature Element. SAML Response rejected"
1317
+ it 'is not possible when unsigned_message_encrypted_unsigned_assertion' do
1318
+ response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_unsigned_assertion, :settings => settings)
1319
+ Timecop.freeze(Time.parse("2015-03-19T14:30:31Z")) do
1320
+ assert !response.is_valid?
1321
+ assert_includes response.errors, "Found an unexpected number of Signature Element. SAML Response rejected"
1322
+ end
1276
1323
  end
1277
1324
  end
1278
- end
1279
1325
 
1280
- describe "#decrypt_assertion" do
1281
- before do
1282
- settings.private_key = ruby_saml_key_text
1283
- end
1326
+ describe "#decrypt_assertion" do
1327
+ before do
1328
+ settings.private_key = ruby_saml_key_text
1329
+ end
1284
1330
 
1285
- describe "check right settings" do
1331
+ describe "check right settings" do
1286
1332
 
1287
- it "is not possible to decrypt the assertion if no private key" do
1288
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1333
+ it "is not possible to decrypt the assertion if no private key" do
1334
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1289
1335
 
1290
- encrypted_assertion_node = REXML::XPath.first(
1291
- response.document,
1292
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1293
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1294
- )
1295
- response.settings.private_key = nil
1336
+ encrypted_assertion_node = REXML::XPath.first(
1337
+ response.document,
1338
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1339
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1340
+ )
1341
+ response.settings.private_key = nil
1296
1342
 
1297
- error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it"
1298
- assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1343
+ error_msg = "An EncryptedAssertion found and no SP private key found on the settings to decrypt it"
1344
+ assert_raises(OneLogin::RubySaml::ValidationError, error_msg) do
1345
+ decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1346
+ end
1347
+ end
1348
+
1349
+ it "is possible to decrypt the assertion if private key" do
1350
+ response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1351
+
1352
+ encrypted_assertion_node = REXML::XPath.first(
1353
+ response.document,
1354
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1355
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1356
+ )
1299
1357
  decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1358
+
1359
+ encrypted_assertion_node2 = REXML::XPath.first(
1360
+ decrypted,
1361
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1362
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1363
+ )
1364
+ assert_nil encrypted_assertion_node2
1365
+ assert decrypted.name, "Assertion"
1300
1366
  end
1301
- end
1302
1367
 
1303
- it "is possible to decrypt the assertion if private key" do
1304
- response = OneLogin::RubySaml::Response.new(signed_message_encrypted_unsigned_assertion, :settings => settings)
1368
+ it "is possible to decrypt the assertion if private key provided and EncryptedKey RetrievalMethod presents in response" do
1369
+ settings.private_key = ruby_saml_key_text
1370
+ resp = read_response('response_with_retrieval_method.xml')
1371
+ response = OneLogin::RubySaml::Response.new(resp, :settings => settings)
1305
1372
 
1306
- encrypted_assertion_node = REXML::XPath.first(
1307
- response.document,
1308
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1309
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1310
- )
1311
- decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1373
+ encrypted_assertion_node = REXML::XPath.first(
1374
+ response.document,
1375
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1376
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1377
+ )
1378
+ decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1312
1379
 
1313
- encrypted_assertion_node2 = REXML::XPath.first(
1314
- decrypted,
1315
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1316
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1317
- )
1318
- assert_nil encrypted_assertion_node2
1319
- assert decrypted.name, "Assertion"
1320
- end
1380
+ encrypted_assertion_node2 = REXML::XPath.first(
1381
+ decrypted,
1382
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1383
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1384
+ )
1321
1385
 
1322
- it "is possible to decrypt the assertion if private key provided and EncryptedKey RetrievalMethod presents in response" do
1323
- settings.private_key = ruby_saml_key_text
1324
- resp = read_response('response_with_retrieval_method.xml')
1325
- response = OneLogin::RubySaml::Response.new(resp, :settings => settings)
1326
-
1327
- encrypted_assertion_node = REXML::XPath.first(
1328
- response.document,
1329
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1330
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1331
- )
1332
- decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1333
-
1334
- encrypted_assertion_node2 = REXML::XPath.first(
1335
- decrypted,
1336
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1337
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1338
- )
1339
-
1340
- assert_nil encrypted_assertion_node2
1341
- assert decrypted.name, "Assertion"
1342
- end
1343
-
1344
- it "is possible to decrypt the assertion if private key but no saml namespace on the Assertion Element that is inside the EncryptedAssertion" do
1345
- unsigned_message_encrypted_assertion_without_saml_namespace = read_response('unsigned_message_encrypted_assertion_without_saml_namespace.xml.base64')
1346
- response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_assertion_without_saml_namespace, :settings => settings)
1347
- encrypted_assertion_node = REXML::XPath.first(
1348
- response.document,
1349
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1350
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1351
- )
1352
- decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1353
-
1354
- encrypted_assertion_node2 = REXML::XPath.first(
1355
- decrypted,
1356
- "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1357
- { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1358
- )
1359
- assert_nil encrypted_assertion_node2
1360
- assert decrypted.name, "Assertion"
1361
- end
1362
- end
1386
+ assert_nil encrypted_assertion_node2
1387
+ assert decrypted.name, "Assertion"
1388
+ end
1363
1389
 
1364
- describe "check different encrypt methods supported" do
1365
- it "EncryptionMethod DES-192 && Key Encryption Algorithm RSA-1_5" do
1366
- unsigned_message_des192_encrypted_signed_assertion = read_response('unsigned_message_des192_encrypted_signed_assertion.xml.base64')
1367
- response = OneLogin::RubySaml::Response.new(unsigned_message_des192_encrypted_signed_assertion, :settings => settings)
1368
- assert_equal "test", response.attributes[:uid]
1369
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1370
- end
1390
+ it "is possible to decrypt the assertion if private key but no saml namespace on the Assertion Element that is inside the EncryptedAssertion" do
1391
+ unsigned_message_encrypted_assertion_without_saml_namespace = read_response('unsigned_message_encrypted_assertion_without_saml_namespace.xml.base64')
1392
+ response = OneLogin::RubySaml::Response.new(unsigned_message_encrypted_assertion_without_saml_namespace, :settings => settings)
1393
+ encrypted_assertion_node = REXML::XPath.first(
1394
+ response.document,
1395
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1396
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1397
+ )
1398
+ decrypted = response.send(:decrypt_assertion, encrypted_assertion_node)
1371
1399
 
1372
- it "EncryptionMethod AES-128 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1373
- unsigned_message_aes128_encrypted_signed_assertion = read_response('unsigned_message_aes128_encrypted_signed_assertion.xml.base64')
1374
- response = OneLogin::RubySaml::Response.new(unsigned_message_aes128_encrypted_signed_assertion, :settings => settings)
1375
- assert_equal "test", response.attributes[:uid]
1376
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1400
+ encrypted_assertion_node2 = REXML::XPath.first(
1401
+ decrypted,
1402
+ "(/p:Response/EncryptedAssertion/)|(/p:Response/a:EncryptedAssertion/)",
1403
+ { "p" => "urn:oasis:names:tc:SAML:2.0:protocol", "a" => "urn:oasis:names:tc:SAML:2.0:assertion" }
1404
+ )
1405
+ assert_nil encrypted_assertion_node2
1406
+ assert decrypted.name, "Assertion"
1407
+ end
1377
1408
  end
1378
1409
 
1379
- it "EncryptionMethod AES-192 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1380
- unsigned_message_aes192_encrypted_signed_assertion = read_response('unsigned_message_aes192_encrypted_signed_assertion.xml.base64')
1381
- response = OneLogin::RubySaml::Response.new(unsigned_message_aes192_encrypted_signed_assertion, :settings => settings)
1382
- assert_equal "test", response.attributes[:uid]
1383
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1384
- end
1410
+ describe "check different encrypt methods supported" do
1411
+ it "EncryptionMethod DES-192 && Key Encryption Algorithm RSA-1_5" do
1412
+ unsigned_message_des192_encrypted_signed_assertion = read_response('unsigned_message_des192_encrypted_signed_assertion.xml.base64')
1413
+ response = OneLogin::RubySaml::Response.new(unsigned_message_des192_encrypted_signed_assertion, :settings => settings)
1414
+ assert_equal "test", response.attributes[:uid]
1415
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1416
+ end
1385
1417
 
1386
- it "EncryptionMethod AES-256 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1387
- unsigned_message_aes256_encrypted_signed_assertion = read_response('unsigned_message_aes256_encrypted_signed_assertion.xml.base64')
1388
- response = OneLogin::RubySaml::Response.new(unsigned_message_aes256_encrypted_signed_assertion, :settings => settings)
1389
- assert_equal "test", response.attributes[:uid]
1390
- assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1418
+ it "EncryptionMethod AES-128 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1419
+ unsigned_message_aes128_encrypted_signed_assertion = read_response('unsigned_message_aes128_encrypted_signed_assertion.xml.base64')
1420
+ response = OneLogin::RubySaml::Response.new(unsigned_message_aes128_encrypted_signed_assertion, :settings => settings)
1421
+ assert_equal "test", response.attributes[:uid]
1422
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1423
+ end
1424
+
1425
+ it "EncryptionMethod AES-192 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1426
+ unsigned_message_aes192_encrypted_signed_assertion = read_response('unsigned_message_aes192_encrypted_signed_assertion.xml.base64')
1427
+ response = OneLogin::RubySaml::Response.new(unsigned_message_aes192_encrypted_signed_assertion, :settings => settings)
1428
+ assert_equal "test", response.attributes[:uid]
1429
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1430
+ end
1431
+
1432
+ it "EncryptionMethod AES-256 && Key Encryption Algorithm RSA-OAEP-MGF1P" do
1433
+ unsigned_message_aes256_encrypted_signed_assertion = read_response('unsigned_message_aes256_encrypted_signed_assertion.xml.base64')
1434
+ response = OneLogin::RubySaml::Response.new(unsigned_message_aes256_encrypted_signed_assertion, :settings => settings)
1435
+ assert_equal "test", response.attributes[:uid]
1436
+ assert_equal "_ce3d2948b4cf20146dee0a0b3dd6f69b6cf86f62d7", response.nameid
1437
+ end
1391
1438
  end
1439
+
1392
1440
  end
1441
+ describe "test qualified name id in attributes" do
1393
1442
 
1394
- end
1395
- describe "test qualified name id in attributes" do
1396
-
1397
- it "parsed the nameid" do
1398
- response = OneLogin::RubySaml::Response.new(read_response("signed_nameid_in_atts.xml"), :settings => settings)
1399
- response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1400
- assert_empty response.errors
1401
- assert_equal "test", response.attributes[:uid]
1402
- assert_equal "http://idp.example.com/metadata.php/ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1443
+ it "parsed the nameid" do
1444
+ response = OneLogin::RubySaml::Response.new(read_response("signed_nameid_in_atts.xml"), :settings => settings)
1445
+ response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1446
+ assert_empty response.errors
1447
+ assert_equal "test", response.attributes[:uid]
1448
+ assert_equal "http://idp.example.com/metadata.php/ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1449
+ end
1403
1450
  end
1404
- end
1405
1451
 
1406
- describe "test unqualified name id in attributes" do
1452
+ describe "test unqualified name id in attributes" do
1407
1453
 
1408
- it "parsed the nameid" do
1409
- response = OneLogin::RubySaml::Response.new(read_response("signed_unqual_nameid_in_atts.xml"), :settings => settings)
1410
- response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1411
- assert_empty response.errors
1412
- assert_equal "test", response.attributes[:uid]
1413
- assert_equal "ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1454
+ it "parsed the nameid" do
1455
+ response = OneLogin::RubySaml::Response.new(read_response("signed_unqual_nameid_in_atts.xml"), :settings => settings)
1456
+ response.settings.idp_cert_fingerprint = 'c51985d947f1be57082025050846eb27f6cab783'
1457
+ assert_empty response.errors
1458
+ assert_equal "test", response.attributes[:uid]
1459
+ assert_equal "ZdrjpwEdw22vKoxWAbZB78/gQ7s=", response.attributes.single('urn:oid:1.3.6.1.4.1.5923.1.1.1.10')
1460
+ end
1414
1461
  end
1415
- end
1416
1462
 
1417
- describe "signature wrapping attack with encrypted assertion" do
1418
- it "should not be valid" do
1419
- settings.private_key = ruby_saml_key_text
1420
- signature_wrapping_attack = read_invalid_response("encrypted_new_attack.xml.base64")
1421
- response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1422
- response_wrapped.stubs(:conditions).returns(nil)
1423
- response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1424
- settings.idp_cert_fingerprint = "385b1eec71143f00db6af936e2ea12a28771d72c"
1425
- assert !response_wrapped.is_valid?
1426
- assert_includes response_wrapped.errors, "Found an invalid Signed Element. SAML Response rejected"
1463
+ describe "signature wrapping attack with encrypted assertion" do
1464
+ it "should not be valid" do
1465
+ settings.private_key = ruby_saml_key_text
1466
+ signature_wrapping_attack = read_invalid_response("encrypted_new_attack.xml.base64")
1467
+ response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1468
+ response_wrapped.stubs(:conditions).returns(nil)
1469
+ response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1470
+ settings.idp_cert_fingerprint = "385b1eec71143f00db6af936e2ea12a28771d72c"
1471
+ assert !response_wrapped.is_valid?
1472
+ assert_includes response_wrapped.errors, "Found an invalid Signed Element. SAML Response rejected"
1473
+ end
1427
1474
  end
1428
- end
1429
1475
 
1430
- describe "signature wrapping attack - concealed SAML response body" do
1431
- it "should not be valid" do
1432
- signature_wrapping_attack = read_invalid_response("response_with_concealed_signed_assertion.xml")
1433
- response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1434
- settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1435
- response_wrapped.stubs(:conditions).returns(nil)
1436
- response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1437
- assert !response_wrapped.is_valid?
1438
- assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1476
+ describe "signature wrapping attack - concealed SAML response body" do
1477
+ it "should not be valid" do
1478
+ signature_wrapping_attack = read_invalid_response("response_with_concealed_signed_assertion.xml")
1479
+ response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1480
+ settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1481
+ response_wrapped.stubs(:conditions).returns(nil)
1482
+ response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1483
+ assert !response_wrapped.is_valid?
1484
+ assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1485
+ end
1439
1486
  end
1440
- end
1441
1487
 
1442
- describe "signature wrapping attack - doubled signed assertion SAML response" do
1443
- it "should not be valid" do
1444
- signature_wrapping_attack = read_invalid_response("response_with_doubled_signed_assertion.xml")
1445
- response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1446
- settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1447
- response_wrapped.stubs(:conditions).returns(nil)
1448
- response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1449
- assert !response_wrapped.is_valid?
1450
- assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1488
+ describe "signature wrapping attack - doubled signed assertion SAML response" do
1489
+ it "should not be valid" do
1490
+ signature_wrapping_attack = read_invalid_response("response_with_doubled_signed_assertion.xml")
1491
+ response_wrapped = OneLogin::RubySaml::Response.new(signature_wrapping_attack, :settings => settings)
1492
+ settings.idp_cert_fingerprint = '4b68c453c7d994aad9025c99d5efcf566287fe8d'
1493
+ response_wrapped.stubs(:conditions).returns(nil)
1494
+ response_wrapped.stubs(:validate_subject_confirmation).returns(true)
1495
+ assert !response_wrapped.is_valid?
1496
+ assert_includes response_wrapped.errors, "SAML Response must contain 1 assertion"
1497
+ end
1451
1498
  end
1452
1499
  end
1453
-
1454
1500
  end