ruby-saml 0.4.6 → 0.4.7

data/VERSION

@@ -1 +1 @@
-0.4.6
+0.4.7

data/lib/onelogin/saml/response.rb

@@ -81,7 +81,7 @@ module Onelogin::Saml
     def validate(soft = true)
       validate_response_state(soft) &&
       validate_conditions(soft)     &&
-      document.validate(settings.idp_cert_fingerprint, soft)
+      document.validate(get_fingerprint, soft)
     end
 
     def validate_response_state(soft = true)
@@ -93,12 +93,21 @@ module Onelogin::Saml
         return soft ? false : validation_error("No settings on response")
       end
 
-      if settings.idp_cert_fingerprint.nil?
-        return soft ? false : validation_error("No fingerprint on settings")
+      if settings.idp_cert_fingerprint.nil? && settings.idp_cert.nil?
+        return soft ? false : validation_error("No fingerprint or certificate on settings")
       end
 
       true
     end
+    
+    def get_fingerprint
+      if settings.idp_cert
+        cert = OpenSSL::X509::Certificate.new(settings.idp_cert)
+        Digest::SHA1.hexdigest(cert.to_der).upcase.scan(/../).join(":")
+      else
+        settings.idp_cert_fingerprint
+      end
+    end
 
     def validate_conditions(soft = true)
       return true if conditions.nil?

data/lib/onelogin/saml/settings.rb

@@ -1,6 +1,6 @@
 module Onelogin::Saml
   class Settings
     attr_accessor :assertion_consumer_service_url, :issuer, :sp_name_qualifier
-    attr_accessor :idp_sso_target_url, :idp_cert_fingerprint, :name_identifier_format
+    attr_accessor :idp_sso_target_url, :idp_cert_fingerprint, :idp_cert, :name_identifier_format
   end
 end

data/ruby-saml.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{ruby-saml}
-  s.version = "0.4.6"
+  s.version = "0.4.7"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["OneLogin LLC"]
-  s.date = %q{2011-06-28}
+  s.date = %q{2011-06-30}
   s.description = %q{SAML toolkit for Ruby on Rails}
   s.email = %q{support@onelogin.com}
   s.extra_rdoc_files = [
@@ -31,10 +31,10 @@ Gem::Specification.new do |s|
      "lib/ruby-saml.rb",
      "lib/xml_security.rb",
      "ruby-saml.gemspec",
+     "test/certificates/certificate1",
      "test/request_test.rb",
      "test/response_test.rb",
      "test/responses/adfs_response.xml.base64",
-     "test/responses/certificate1",
      "test/responses/open_saml_response.xml",
      "test/responses/response1.xml.base64",
      "test/responses/response2.xml.base64",

data/test/certificates/certificate1

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBrTCCAaGgAwIBAgIBATADBgEAMGcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApD
+YWxpZm9ybmlhMRUwEwYDVQQHDAxTYW50YSBNb25pY2ExETAPBgNVBAoMCE9uZUxv
+Z2luMRkwFwYDVQQDDBBhcHAub25lbG9naW4uY29tMB4XDTEwMTAxMTIxMTUxMloX
+DTE1MTAxMTIxMTUxMlowZzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3Ju
+aWExFTATBgNVBAcMDFNhbnRhIE1vbmljYTERMA8GA1UECgwIT25lTG9naW4xGTAX
+BgNVBAMMEGFwcC5vbmVsb2dpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
+AoGBAMPmjfjy7L35oDpeBXBoRVCgktPkLno9DOEWB7MgYMMVKs2B6ymWQLEWrDug
+MK1hkzWFhIb5fqWLGbWy0J0veGR9/gHOQG+rD/I36xAXnkdiXXhzoiAG/zQxM0ed
+MOUf40n314FC8moErcUg6QabttzesO59HFz6shPuxcWaVAgxAgMBAAEwAwYBAAMB
+AA==
+-----END CERTIFICATE-----

data/test/response_test.rb

@@ -48,6 +48,15 @@ class RubySamlTest < Test::Unit::TestCase
         assert response.is_valid?
       end
 
+      should "return true when using certificate instead of fingerprint" do
+        response = Onelogin::Saml::Response.new(response_document_4)
+        response.stubs(:conditions).returns(nil)
+        settings = Onelogin::Saml::Settings.new
+        response.settings = settings
+        settings.idp_cert = signature_1
+        assert response.is_valid?
+      end
+
       should "not allow signature wrapping attack" do
         response = Onelogin::Saml::Response.new(response_document_4)
         response.stubs(:conditions).returns(nil)
@@ -77,12 +86,12 @@ class RubySamlTest < Test::Unit::TestCase
         assert_equal "someone@example.com", response.name_id
       end
 
-      should_eventually "be extractable from an OpenSAML response" do
+      should "be extractable from an OpenSAML response" do
         response = Onelogin::Saml::Response.new(fixture(:open_saml))
         assert_equal "someone@example.org", response.name_id
       end
 
-      should_eventually "be extractable from a Simple SAML PHP response" do
+      should "be extractable from a Simple SAML PHP response" do
         response = Onelogin::Saml::Response.new(fixture(:simple_saml_php))
         assert_equal "someone@example.com", response.name_id
       end

data/test/test_helper.rb

@@ -48,5 +48,9 @@ class Test::Unit::TestCase
   def signature_fingerprint_1
     @signature_fingerprint1 ||= "C5:19:85:D9:47:F1:BE:57:08:20:25:05:08:46:EB:27:F6:CA:B7:83"
   end
+  
+  def signature_1
+    @signature1 ||= File.read(File.join(File.dirname(__FILE__), 'certificates', 'certificate1'))
+  end
 
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ruby-saml
 version: !ruby/object:Gem::Version 
-  hash: 3
+  hash: 1
   prerelease: false
   segments: 
   - 0
   - 4
-  - 6
-  version: 0.4.6
+  - 7
+  version: 0.4.7
 platform: ruby
 authors: 
 - OneLogin LLC
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-06-28 00:00:00 +02:00
+date: 2011-06-30 00:00:00 +02:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -114,10 +114,10 @@ files:
 - lib/ruby-saml.rb
 - lib/xml_security.rb
 - ruby-saml.gemspec
+- test/certificates/certificate1
 - test/request_test.rb
 - test/response_test.rb
 - test/responses/adfs_response.xml.base64
-- test/responses/certificate1
 - test/responses/open_saml_response.xml
 - test/responses/response1.xml.base64
 - test/responses/response2.xml.base64

data/test/responses/certificate1

@@ -1,12 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBrTCCAaGgAwIBAgIBATADBgEAMGcxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApD
-YWxpZm9ybmlhMRUwEwYDVQQHDAxTYW50YSBNb25pY2ExETAPBgNVBAoMCE9uZUxv
-Z2luMRkwFwYDVQQDDBBhcHAub25lbG9naW4uY29tMB4XDTEwMDMwOTA5NTgzNFoX
-DTE1MDMwOTA5NTgzNFowZzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3Ju
-aWExFTATBgNVBAcMDFNhbnRhIE1vbmljYTERMA8GA1UECgwIT25lTG9naW4xGTAX
-BgNVBAMMEGFwcC5vbmVsb2dpbi5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ
-AoGBANtmwriqGBbZy5Dwy2CmJEtHEENVPoATCZP3UDESRDQmXy9Q0Kq1lBt+KyV4
-kJNHYAAQ9egLGWQ8/1atkPBye5s9fxROtf8VO3uk/x/X5VSRODIrhFISGmKUnVXa
-UhLFIXkGSCAIVfoR5S2ggdfpINKUWGsWS/lEzLNYMBkURXuVAgMBAAEwAwYBAAMB
-AA==
------END CERTIFICATE-----