saml-kit 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 0a54e04d0c915cf2ed6df1ffa201fca9abea800e
-  data.tar.gz: f38bb36f287bc9f9b7c185eb00b7c87641f99f23
+SHA256:
+  metadata.gz: a7bdb0c763a06da013ef3be5a99b550dfaad5a3cfa5d56cbe1c8effef7e597eb
+  data.tar.gz: 12d4f27c8537146a0e7eae7ffdbfcfc088673a94edcb59d2d7e04b13990b8ad9
 SHA512:
-  metadata.gz: 9bf0e3a075afb0fb4b1038b265a39382a3463cf4b4c490d45cd605534341a4b2227fdf09709af556da2b94e25ca0d50fecd440b5e0ff2e68076fd2584010b110
-  data.tar.gz: ed750eb4bf73f1f631b83c4b17d2ddb1e15907955ce686b9ddaaa591a27c22a79fcac0b76a86ac3898e7c59b2d23e12616965286de614e1cd2b7f118ffd96f0f
+  metadata.gz: da590a94503473525543a63b4922673b78a56cc0fd0252b6d63ef2385aa22e38cbd0fb82833a5ef6fcbf60083d2ca38fdcba8991e12a83603759bdd0bc8b9060
+  data.tar.gz: e22721152e34342c8f0d9f59f7ac1596ae8bf901564e13ae7b1ca1b6311a59e86a102202d536dc253a78cc8acc71f56e3a1cd4e83d121243410ea63783baf13d

data/README.md

@@ -32,7 +32,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/saml-kit.
+Bug reports and pull requests are welcome on GitHub at https://github.com/mokhan/saml-kit.
 
 ## License
 

data/exe/saml-kit-create-self-signed-certificate

@@ -0,0 +1,21 @@
+#!/usr/bin/env ruby
+require 'saml/kit'
+
+password = STDIN.read.strip
+certificate, private_key = Saml::Kit::SelfSignedCertificate.new(password).create
+
+puts "** BEGIN File Format **"
+print certificate
+puts private_key
+puts "***********************"
+
+puts
+
+puts "*** BEGIN ENV Format **"
+puts certificate.inspect
+puts private_key.inspect
+puts "***********************"
+
+puts
+puts "Private Key Password:"
+puts password.inspect

data/lib/saml/kit.rb

@@ -5,6 +5,7 @@ require "active_support/core_ext/date/calculations"
 require "active_support/core_ext/hash/conversions"
 require "active_support/core_ext/hash/indifferent_access"
 require "active_support/core_ext/numeric/time"
+require "active_support/deprecation"
 require "active_support/duration"
 require "builder"
 require "logger"
@@ -13,6 +14,8 @@ require "nokogiri"
 require "securerandom"
 require "xmldsig"
 
+require "saml/kit/buildable"
+require "saml/kit/builders"
 require "saml/kit/namespaces"
 require "saml/kit/serializable"
 require "saml/kit/xsd_validatable"
@@ -26,19 +29,20 @@ require "saml/kit/bindings"
 require "saml/kit/certificate"
 require "saml/kit/configuration"
 require "saml/kit/crypto"
-require "saml/kit/cryptography"
 require "saml/kit/default_registry"
 require "saml/kit/fingerprint"
 require "saml/kit/logout_response"
 require "saml/kit/logout_request"
 require "saml/kit/metadata"
 require "saml/kit/response"
+require "saml/kit/id"
 require "saml/kit/identity_provider_metadata"
 require "saml/kit/invalid_document"
 require "saml/kit/self_signed_certificate"
 require "saml/kit/service_provider_metadata"
 require "saml/kit/signature"
 require "saml/kit/xml"
+require "saml/kit/xml_decryption"
 
 I18n.load_path += Dir[File.expand_path("kit/locales/*.yml", File.dirname(__FILE__))]
 
@@ -56,6 +60,10 @@ module Saml
       def logger
         configuration.logger
       end
+
+      def registry
+        configuration.registry
+      end
     end
   end
 end

data/lib/saml/kit/authentication_request.rb

@@ -7,7 +7,7 @@ module Saml
         super(xml, name: "AuthnRequest")
       end
 
-      def acs_url
+      def assertion_consumer_service_url
         to_h[name]['AssertionConsumerServiceURL']
       end
 
@@ -15,54 +15,16 @@ module Saml
         to_h[name]['NameIDPolicy']['Format']
       end
 
-      def response_for(user)
-        Response::Builder.new(user, self)
-      end
-
-      private
-
-      class Builder
-        attr_accessor :id, :now, :issuer, :acs_url, :name_id_format, :sign, :destination
-        attr_accessor :version
-
-        def initialize(configuration: Saml::Kit.configuration, sign: true)
-          @id = SecureRandom.uuid
-          @issuer = configuration.issuer
-          @name_id_format = Namespaces::PERSISTENT
-          @now = Time.now.utc
-          @version = "2.0"
-          @sign = sign
-        end
-
-        def to_xml
-          Signature.sign(sign: sign) do |xml, signature|
-            xml.tag!('samlp:AuthnRequest', request_options) do
-              xml.tag!('saml:Issuer', issuer)
-              signature.template(id)
-              xml.tag!('samlp:NameIDPolicy', Format: name_id_format)
-            end
-          end
-        end
-
-        def build
-          AuthenticationRequest.new(to_xml)
-        end
-
-        private
-
-        def request_options
-          options = {
-            "xmlns:samlp" => Namespaces::PROTOCOL,
-            "xmlns:saml" => Namespaces::ASSERTION,
-            ID: "_#{id}",
-            Version: version,
-            IssueInstant: now.utc.iso8601,
-            Destination: destination,
-          }
-          options[:AssertionConsumerServiceURL] = acs_url if acs_url.present?
-          options
+      def response_for(user, binding:, relay_state: nil)
+        response_binding = provider.assertion_consumer_service_for(binding: binding)
+        builder = Saml::Kit::Response.builder(user, self) do |x|
+          x.sign = provider.want_assertions_signed
+          yield x if block_given?
         end
+        response_binding.serialize(builder, relay_state: relay_state)
       end
+
+      Builder = ActiveSupport::Deprecation::DeprecatedConstantProxy.new('Saml::Kit::AuthenticationRequest::Builder', 'Saml::Kit::Builders::AuthenticationRequest')
     end
   end
 end

data/lib/saml/kit/bindings/http_post.rb

@@ -9,7 +9,6 @@ module Saml
         end
 
         def serialize(builder, relay_state: nil)
-          builder.sign = true
           builder.destination = location
           document = builder.build
           saml_params = {

data/lib/saml/kit/buildable.rb

@@ -0,0 +1,21 @@
+module Saml
+  module Kit
+    module Buildable
+      extend ActiveSupport::Concern
+
+      class_methods do
+        def build(*args)
+          builder(*args).tap do |x|
+            yield x if block_given?
+          end.build
+        end
+
+        def builder(*args)
+          builder_class.new(*args).tap do |builder|
+            yield builder if block_given?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/saml/kit/builders.rb

@@ -0,0 +1,13 @@
+require 'saml/kit/builders/authentication_request'
+require 'saml/kit/builders/identity_provider_metadata'
+require 'saml/kit/builders/logout_request'
+require 'saml/kit/builders/logout_response'
+require 'saml/kit/builders/response'
+require 'saml/kit/builders/service_provider_metadata'
+
+module Saml
+  module Kit
+    module Builders
+    end
+  end
+end

data/lib/saml/kit/builders/authentication_request.rb

@@ -0,0 +1,48 @@
+module Saml
+  module Kit
+    module Builders
+      class AuthenticationRequest
+        attr_accessor :id, :now, :issuer, :assertion_consumer_service_url, :name_id_format, :sign, :destination
+        attr_accessor :version
+
+        def initialize(configuration: Saml::Kit.configuration, sign: true)
+          @id = Id.generate
+          @issuer = configuration.issuer
+          @name_id_format = Namespaces::PERSISTENT
+          @now = Time.now.utc
+          @version = "2.0"
+          @sign = sign
+        end
+
+        def to_xml
+          Signature.sign(sign: sign) do |xml, signature|
+            xml.tag!('samlp:AuthnRequest', request_options) do
+              xml.tag!('saml:Issuer', issuer)
+              signature.template(id)
+              xml.tag!('samlp:NameIDPolicy', Format: name_id_format)
+            end
+          end
+        end
+
+        def build
+          Saml::Kit::AuthenticationRequest.new(to_xml)
+        end
+
+        private
+
+        def request_options
+          options = {
+            "xmlns:samlp" => Namespaces::PROTOCOL,
+            "xmlns:saml" => Namespaces::ASSERTION,
+            ID: id,
+            Version: version,
+            IssueInstant: now.utc.iso8601,
+            Destination: destination,
+          }
+          options[:AssertionConsumerServiceURL] = assertion_consumer_service_url if assertion_consumer_service_url.present?
+          options
+        end
+      end
+    end
+  end
+end

data/lib/saml/kit/builders/identity_provider_metadata.rb

@@ -0,0 +1,103 @@
+module Saml
+  module Kit
+    module Builders
+      class IdentityProviderMetadata
+        attr_accessor :id, :organization_name, :organization_url, :contact_email, :entity_id, :attributes, :name_id_formats
+        attr_accessor :want_authn_requests_signed, :sign
+        attr_reader :logout_urls, :single_sign_on_urls
+
+        def initialize(configuration = Saml::Kit.configuration)
+          @id = Id.generate
+          @entity_id = configuration.issuer
+          @attributes = []
+          @name_id_formats = [Namespaces::PERSISTENT]
+          @single_sign_on_urls = []
+          @logout_urls = []
+          @configuration = configuration
+          @sign = true
+          @want_authn_requests_signed = true
+        end
+
+        def add_single_sign_on_service(url, binding: :http_post)
+          @single_sign_on_urls.push(location: url, binding: Bindings.binding_for(binding))
+        end
+
+        def add_single_logout_service(url, binding: :http_post)
+          @logout_urls.push(location: url, binding: Bindings.binding_for(binding))
+        end
+
+        def to_xml
+          Signature.sign(sign: sign) do |xml, signature|
+            xml.instruct!
+            xml.EntityDescriptor entity_descriptor_options do
+              signature.template(id)
+              xml.IDPSSODescriptor idp_sso_descriptor_options do
+                if @configuration.signing_certificate_pem.present?
+                  xml.KeyDescriptor use: "signing" do
+                    xml.KeyInfo "xmlns": Namespaces::XMLDSIG do
+                      xml.X509Data do
+                        xml.X509Certificate @configuration.stripped_signing_certificate
+                      end
+                    end
+                  end
+                end
+                if @configuration.encryption_certificate_pem.present?
+                  xml.KeyDescriptor use: "encryption" do
+                    xml.KeyInfo "xmlns": Namespaces::XMLDSIG do
+                      xml.X509Data do
+                        xml.X509Certificate @configuration.stripped_encryption_certificate
+                      end
+                    end
+                  end
+                end
+                logout_urls.each do |item|
+                  xml.SingleLogoutService Binding: item[:binding], Location: item[:location]
+                end
+                name_id_formats.each do |format|
+                  xml.NameIDFormat format
+                end
+                single_sign_on_urls.each do |item|
+                  xml.SingleSignOnService Binding: item[:binding], Location: item[:location]
+                end
+                attributes.each do |attribute|
+                  xml.tag! 'saml:Attribute', Name: attribute
+                end
+              end
+              xml.Organization do
+                xml.OrganizationName organization_name, 'xml:lang': "en"
+                xml.OrganizationDisplayName organization_name, 'xml:lang': "en"
+                xml.OrganizationURL organization_url, 'xml:lang': "en"
+              end
+              xml.ContactPerson contactType: "technical" do
+                xml.Company "mailto:#{contact_email}"
+              end
+            end
+          end
+        end
+
+        def build
+          Saml::Kit::IdentityProviderMetadata.new(to_xml)
+        end
+
+        private
+
+        def entity_descriptor_options
+          {
+            'xmlns': Namespaces::METADATA,
+            'xmlns:ds': Namespaces::XMLDSIG,
+            'xmlns:saml': Namespaces::ASSERTION,
+            ID: id,
+            entityID: entity_id,
+          }
+        end
+
+        def idp_sso_descriptor_options
+          {
+            WantAuthnRequestsSigned: want_authn_requests_signed,
+            protocolSupportEnumeration: Namespaces::PROTOCOL,
+          }
+        end
+      end
+    end
+  end
+end

data/lib/saml/kit/builders/logout_request.rb

@@ -0,0 +1,55 @@
+module Saml
+  module Kit
+    module Builders
+      class LogoutRequest
+        attr_accessor :id, :destination, :issuer, :name_id_format, :now
+        attr_accessor :sign, :version
+        attr_reader :user
+
+        def initialize(user, configuration: Saml::Kit.configuration, sign: true)
+          @user = user
+          @id = "_#{SecureRandom.uuid}"
+          @issuer = configuration.issuer
+          @name_id_format = Saml::Kit::Namespaces::PERSISTENT
+          @now = Time.now.utc
+          @version = "2.0"
+          @sign = sign
+        end
+
+        def to_xml
+          Signature.sign(sign: sign) do |xml, signature|
+            xml.instruct!
+            xml.LogoutRequest logout_request_options do
+              xml.Issuer({ xmlns: Namespaces::ASSERTION }, issuer)
+              signature.template(id)
+              xml.NameID name_id_options, user.name_id_for(name_id_format)
+            end
+          end
+        end
+
+        def build
+          Saml::Kit::LogoutRequest.new(to_xml)
+        end
+
+        private
+
+        def logout_request_options
+          {
+            ID: id,
+            Version: version,
+            IssueInstant: now.utc.iso8601,
+            Destination: destination,
+            xmlns: Namespaces::PROTOCOL,
+          }
+        end
+
+        def name_id_options
+          {
+            Format: name_id_format,
+            xmlns: Namespaces::ASSERTION,
+          }
+        end
+      end
+    end
+  end
+end

data/lib/saml/kit/builders/logout_response.rb

@@ -0,0 +1,50 @@
+module Saml
+  module Kit
+    module Builders
+      class LogoutResponse
+        attr_accessor :id, :issuer, :version, :status_code, :sign, :now, :destination
+        attr_reader :request
+
+        def initialize(user, request, configuration: Saml::Kit.configuration, sign: true)
+          @user = user
+          @now = Time.now.utc
+          @request = request
+          @id = Id.generate
+          @version = "2.0"
+          @status_code = Namespaces::SUCCESS
+          @sign = sign
+          @issuer = configuration.issuer
+        end
+
+        def to_xml
+          Signature.sign(sign: sign) do |xml, signature|
+            xml.LogoutResponse logout_response_options do
+              xml.Issuer(issuer, xmlns: Namespaces::ASSERTION)
+              signature.template(id)
+              xml.Status do
+                xml.StatusCode Value: status_code
+              end
+            end
+          end
+        end
+
+        def build
+          Saml::Kit::LogoutResponse.new(to_xml, request_id: request.id)
+        end
+
+        private
+
+        def logout_response_options
+          {
+            xmlns: Namespaces::PROTOCOL,
+            ID: id,
+            Version: version,
+            IssueInstant: now.utc.iso8601,
+            Destination: destination,
+            InResponseTo: request.id,
+          }
+        end
+      end
+    end
+  end
+end