saml-kit 0.2.3 → 0.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 68d768bf760de038c1d2509056882bdd822d6d9d81449e9b6b3ee55b1f0061b0
-  data.tar.gz: 36ddb0f1d8f7692518e43604bed5505ff5503235b99644e83923049cbc86cf0d
+  metadata.gz: 13c5ee20e28acd63c6ec3dde99cd1fea092be3db550dca1bd129a4b0e1fb83d3
+  data.tar.gz: 0337c7d33845d4fbfb9dd6cc817cfde1dc620c3745cfd83b96f246e29ec30dc3
 SHA512:
-  metadata.gz: 03dec61510539ae84a0fa52e64f0b522d75ae2388a289f657a47480d716913e16d2c52e369b761581c32467e812aec22eb78b50e311518d877a9a891d1d0a2a0
-  data.tar.gz: 687f187faeb6e73c31abe59ec6734f30cb41213262b4c5fdd0fd4dd4ada9d712a7bce27959e92a03ee8ccbe6efc75d2ce8d9ff75d8595e5e87c15e54da0525ba
+  metadata.gz: cc09a60391991a964b3f6114e6c039da70eb917ba268787abe8940bc00a8883449f5e751aeb2365b9cae5f693d177ded5fd2d9d152ae766569a9feb5a8198ad2
+  data.tar.gz: e6cd00b9f963348a4b9cce442d09fe7b5819c0b970334ccff01c6fcfcce54e60cfff7692878f5603a6e54061c2b75b0df61364e2eaa1717547fdc079efbe588c

data/.rspec

@@ -1,2 +1,2 @@
---format documentation
 --color
+--require spec_helper

data/exe/saml-kit-create-self-signed-certificate

@@ -1,6 +1,7 @@
 #!/usr/bin/env ruby
 require 'saml/kit'
 
+puts "Enter Password:"
 password = STDIN.read.strip
 certificate, private_key = Saml::Kit::SelfSignedCertificate.new(password).create
 

data/lib/saml/kit.rb

@@ -26,6 +26,7 @@ require "saml/kit/requestable"
 require "saml/kit/trustable"
 require "saml/kit/document"
 
+require "saml/kit/assertion"
 require "saml/kit/authentication_request"
 require "saml/kit/bindings"
 require "saml/kit/certificate"

data/lib/saml/kit/assertion.rb

@@ -0,0 +1,73 @@
+module Saml
+  module Kit
+    class Assertion
+      def initialize(xml_hash, configuration:)
+        @xml_hash = xml_hash
+        @configuration = configuration
+      end
+
+      def name_id
+        assertion.fetch('Subject', {}).fetch('NameID', nil)
+      end
+
+      def signed?
+        assertion.fetch('Signature', nil).present?
+      end
+
+      def attributes
+        @attributes ||=
+          begin
+            attrs = assertion.fetch('AttributeStatement', {}).fetch('Attribute', [])
+            items = if attrs.is_a? Hash
+                      [[attrs["Name"], attrs["AttributeValue"]]]
+                    else
+                      attrs.map { |item| [item['Name'], item['AttributeValue']] }
+                    end
+            Hash[items].with_indifferent_access
+          end
+      end
+
+      def started_at
+        parse_date(assertion.fetch('Conditions', {}).fetch('NotBefore', nil))
+      end
+
+      def expired_at
+        parse_date(assertion.fetch('Conditions', {}).fetch('NotOnOrAfter', nil))
+      end
+
+      def certificate
+        assertion.fetch('Signature', {}).fetch('KeyInfo', {}).fetch('X509Data', {}).fetch('X509Certificate', nil)
+      end
+
+      def audiences
+        Array(assertion['Conditions']['AudienceRestriction']['Audience'])
+      rescue => error
+        Saml::Kit.logger.error(error)
+        []
+      end
+
+      private
+
+      def encrypted?
+        @xml_hash.fetch('Response', {}).fetch('EncryptedAssertion', nil).present?
+      end
+
+      def assertion
+        if encrypted?
+          decrypted = XmlDecryption.new(configuration: @configuration).decrypt(@xml_hash['Response']['EncryptedAssertion'])
+          Saml::Kit.logger.debug(decrypted)
+          Hash.from_xml(decrypted)['Assertion']
+        else
+          @xml_hash.fetch('Response', {}).fetch('Assertion', {})
+        end
+      end
+
+      def parse_date(value)
+        DateTime.parse(value)
+      rescue => error
+        Saml::Kit.logger.error(error)
+        Time.at(0).to_datetime
+      end
+    end
+  end
+end

data/lib/saml/kit/authentication_request.rb

@@ -3,8 +3,8 @@ module Saml
     class AuthenticationRequest < Document
       include Requestable
 
-      def initialize(xml)
-        super(xml, name: "AuthnRequest")
+      def initialize(xml, configuration: Saml::Kit.configuration)
+        super(xml, name: "AuthnRequest", configuration: configuration)
       end
 
       def assertion_consumer_service_url

data/lib/saml/kit/bindings/http_redirect.rb

@@ -12,7 +12,7 @@ module Saml
           builder.sign = false
           builder.destination = location
           document = builder.build
-          [UrlBuilder.new.build(document, relay_state: relay_state), {}]
+          [UrlBuilder.new(configuration: builder.configuration).build(document, relay_state: relay_state), {}]
         end
 
         def deserialize(params)

data/lib/saml/kit/bindings/url_builder.rb

@@ -3,21 +3,25 @@ module Saml
     module Bindings
       class UrlBuilder
         include Serializable
+        attr_reader :configuration
 
-        def initialize(private_key: Saml::Kit.configuration.signing_private_key)
-          @private_key = private_key
+        def initialize(configuration: Saml::Kit.configuration)
+          @configuration = configuration
         end
 
         def build(saml_document, relay_state: nil)
           payload = canonicalize(saml_document, relay_state)
-          "#{saml_document.destination}?#{payload}&Signature=#{signature_for(payload)}"
+          if configuration.sign?
+            "#{saml_document.destination}?#{payload}&Signature=#{signature_for(payload)}"
+          else
+            "#{saml_document.destination}?#{payload}"
+          end
         end
 
         private
 
-        attr_reader :private_key
-
         def signature_for(payload)
+          private_key = configuration.private_keys(use: :signing).sample
           encode(private_key.sign(OpenSSL::Digest::SHA256.new, payload))
         end
 

data/lib/saml/kit/buildable.rb

@@ -4,10 +4,8 @@ module Saml
       extend ActiveSupport::Concern
 
       class_methods do
-        def build(*args)
-          builder(*args).tap do |x|
-            yield x if block_given?
-          end.build
+        def build(*args, &block)
+          builder(*args, &block).build
         end
 
         def builder(*args)

data/lib/saml/kit/builders/assertion.rb

@@ -5,7 +5,7 @@ module Saml
         include Templatable
         extend Forwardable
 
-        def_delegators :@response_builder, :encrypt, :sign, :request, :issuer, :reference_id, :now, :configuration, :user, :version
+        def_delegators :@response_builder, :encrypt, :sign, :request, :issuer, :reference_id, :now, :configuration, :user, :version, :destination, :encryption_certificate
 
         def initialize(response_builder)
           @response_builder = response_builder
@@ -38,7 +38,7 @@ module Saml
           {
             InResponseTo: request.id,
             NotOnOrAfter: 3.hours.since(now).utc.iso8601,
-            Recipient: request.assertion_consumer_service_url,
+            Recipient: destination,
           }
         end
 

data/lib/saml/kit/builders/authentication_request.rb

@@ -3,17 +3,16 @@ module Saml
     module Builders
       class AuthenticationRequest
         include Saml::Kit::Templatable
-        attr_accessor :id, :now, :issuer, :assertion_consumer_service_url, :name_id_format, :sign, :destination
+        attr_accessor :id, :now, :issuer, :assertion_consumer_service_url, :name_id_format, :destination
         attr_accessor :version
         attr_reader :configuration
 
-        def initialize(configuration: Saml::Kit.configuration, sign: true)
+        def initialize(configuration: Saml::Kit.configuration)
           @configuration = configuration
           @id = Id.generate
           @issuer = configuration.issuer
           @name_id_format = Namespaces::PERSISTENT
           @now = Time.now.utc
-          @sign = sign
           @version = "2.0"
         end
 

data/lib/saml/kit/builders/identity_provider_metadata.rb

@@ -4,18 +4,17 @@ module Saml
       class IdentityProviderMetadata
         include Saml::Kit::Templatable
         attr_accessor :id, :organization_name, :organization_url, :contact_email, :entity_id, :attributes, :name_id_formats
-        attr_accessor :want_authn_requests_signed, :sign
+        attr_accessor :want_authn_requests_signed
         attr_reader :logout_urls, :single_sign_on_urls
         attr_reader :configuration
 
-        def initialize(configuration = Saml::Kit.configuration)
+        def initialize(configuration: Saml::Kit.configuration)
           @attributes = []
           @configuration = configuration
           @entity_id = configuration.issuer
           @id = Id.generate
           @logout_urls = []
           @name_id_formats = [Namespaces::PERSISTENT]
-          @sign = true
           @single_sign_on_urls = []
           @want_authn_requests_signed = true
         end

data/lib/saml/kit/builders/logout_request.rb

@@ -4,10 +4,10 @@ module Saml
       class LogoutRequest
         include Saml::Kit::Templatable
         attr_accessor :id, :destination, :issuer, :name_id_format, :now
-        attr_accessor :sign, :version
+        attr_accessor :version
         attr_reader :user, :configuration
 
-        def initialize(user, configuration: Saml::Kit.configuration, sign: true)
+        def initialize(user, configuration: Saml::Kit.configuration)
           @configuration = configuration
           @user = user
           @id = "_#{SecureRandom.uuid}"
@@ -15,11 +15,10 @@ module Saml
           @name_id_format = Saml::Kit::Namespaces::PERSISTENT
           @now = Time.now.utc
           @version = "2.0"
-          @sign = sign
         end
 
         def build
-          Saml::Kit::LogoutRequest.new(to_xml)
+          Saml::Kit::LogoutRequest.new(to_xml, configuration: configuration)
         end
 
         private

data/lib/saml/kit/builders/logout_response.rb

@@ -3,17 +3,16 @@ module Saml
     module Builders
       class LogoutResponse
         include Saml::Kit::Templatable
-        attr_accessor :id, :issuer, :version, :status_code, :sign, :now, :destination
+        attr_accessor :id, :issuer, :version, :status_code, :now, :destination
         attr_reader :request
         attr_reader :configuration
 
-        def initialize(user, request, configuration: Saml::Kit.configuration, sign: true)
+        def initialize(user, request, configuration: Saml::Kit.configuration)
           @configuration = configuration
           @id = Id.generate
           @issuer = configuration.issuer
           @now = Time.now.utc
           @request = request
-          @sign = sign
           @status_code = Namespaces::SUCCESS
           @user = user
           @version = "2.0"

data/lib/saml/kit/builders/response.rb

@@ -6,7 +6,7 @@ module Saml
         attr_reader :user, :request
         attr_accessor :id, :reference_id, :now
         attr_accessor :version, :status_code
-        attr_accessor :issuer, :sign, :destination, :encrypt
+        attr_accessor :issuer, :destination, :encrypt
         attr_reader :configuration
 
         def initialize(user, request, configuration: Saml::Kit.configuration)
@@ -18,9 +18,8 @@ module Saml
           @version = "2.0"
           @status_code = Namespaces::SUCCESS
           @issuer = configuration.issuer
-          @destination = destination_for(request)
           @sign = want_assertions_signed
-          @encrypt = false
+          @encrypt = encryption_certificate.present?
           @configuration = configuration
         end
 
@@ -28,29 +27,24 @@ module Saml
           request.provider.want_assertions_signed
         rescue => error
           Saml::Kit.logger.error(error)
-          true
+          nil
         end
 
         def build
-          Saml::Kit::Response.new(to_xml, request_id: request.id)
-        end
-
-        private
-
-        def assertion
-          @assertion ||= Saml::Kit::Builders::Assertion.new(self)
+          Saml::Kit::Response.new(to_xml, request_id: request.id, configuration: configuration)
         end
 
         def encryption_certificate
           request.provider.encryption_certificates.first
+        rescue => error
+          Saml::Kit.logger.error(error)
+          nil
         end
 
-        def destination_for(request)
-          if request.signed? && request.trusted?
-            request.assertion_consumer_service_url || request.provider.assertion_consumer_service_for(binding: :http_post).try(:location)
-          else
-            request.provider.assertion_consumer_service_for(binding: :http_post).try(:location)
-          end
+        private
+
+        def assertion
+          @assertion ||= Saml::Kit::Builders::Assertion.new(self)
         end
 
         def response_options

data/lib/saml/kit/builders/service_provider_metadata.rb

@@ -3,19 +3,18 @@ module Saml
     module Builders
       class ServiceProviderMetadata
         include Saml::Kit::Templatable
-        attr_accessor :id, :entity_id, :acs_urls, :logout_urls, :name_id_formats, :sign
+        attr_accessor :id, :entity_id, :acs_urls, :logout_urls, :name_id_formats
         attr_accessor :organization_name, :organization_url, :contact_email
         attr_accessor :want_assertions_signed
         attr_reader :configuration
 
-        def initialize(configuration = Saml::Kit.configuration)
+        def initialize(configuration: Saml::Kit.configuration)
           @acs_urls = []
           @configuration = configuration
           @entity_id = configuration.issuer
           @id = Id.generate
           @logout_urls = []
           @name_id_formats = [Namespaces::PERSISTENT]
-          @sign = true
           @want_assertions_signed = true
         end
 
@@ -43,7 +42,7 @@ module Saml
 
         def descriptor_options
           {
-            AuthnRequestsSigned: sign,
+            AuthnRequestsSigned: sign?,
             WantAssertionsSigned: want_assertions_signed,
             protocolSupportEnumeration: Namespaces::PROTOCOL,
           }

data/lib/saml/kit/builders/templates/assertion.builder

@@ -1,27 +1,29 @@
-xml.Assertion(assertion_options) do
-  xml.Issuer issuer
-  signature_for(reference_id: reference_id, xml: xml) unless encrypt
-  xml.Subject do
-    xml.NameID name_id, Format: name_id_format
-    xml.SubjectConfirmation Method: Saml::Kit::Namespaces::BEARER do
-      xml.SubjectConfirmationData "", subject_confirmation_data_options
+encryption_for(xml: xml) do |xml|
+  xml.Assertion(assertion_options) do
+    xml.Issuer issuer
+    signature_for(reference_id: reference_id, xml: xml) unless encrypt
+    xml.Subject do
+      xml.NameID name_id, Format: name_id_format
+      xml.SubjectConfirmation Method: Saml::Kit::Namespaces::BEARER do
+        xml.SubjectConfirmationData "", subject_confirmation_data_options
+      end
     end
-  end
-  xml.Conditions conditions_options do
-    xml.AudienceRestriction do
-      xml.Audience request.issuer
+    xml.Conditions conditions_options do
+      xml.AudienceRestriction do
+        xml.Audience request.issuer
+      end
     end
-  end
-  xml.AuthnStatement authn_statement_options do
-    xml.AuthnContext do
-      xml.AuthnContextClassRef Saml::Kit::Namespaces::PASSWORD
+    xml.AuthnStatement authn_statement_options do
+      xml.AuthnContext do
+        xml.AuthnContextClassRef Saml::Kit::Namespaces::PASSWORD
+      end
     end
-  end
-  if assertion_attributes.any?
-    xml.AttributeStatement do
-      assertion_attributes.each do |key, value|
-        xml.Attribute Name: key, NameFormat: Saml::Kit::Namespaces::URI, FriendlyName: key do
-          xml.AttributeValue value.to_s
+    if assertion_attributes.any?
+      xml.AttributeStatement do
+        assertion_attributes.each do |key, value|
+          xml.Attribute Name: key, NameFormat: Saml::Kit::Namespaces::URI, FriendlyName: key do
+            xml.AttributeValue value.to_s
+          end
         end
       end
     end

data/lib/saml/kit/builders/templates/identity_provider_metadata.builder

@@ -2,11 +2,11 @@ xml.instruct!
 xml.EntityDescriptor entity_descriptor_options do
   signature_for(reference_id: id, xml: xml)
   xml.IDPSSODescriptor idp_sso_descriptor_options do
-    if configuration.signing_certificate_pem.present?
-      render configuration.signing_certificate, xml: xml
+    configuration.certificates(use: :signing).each do |certificate|
+      render certificate, xml: xml
     end
-    if configuration.encryption_certificate_pem.present?
-      render configuration.encryption_certificate, xml: xml
+    configuration.certificates(use: :encryption).each do |certificate|
+      render certificate, xml: xml
     end
     logout_urls.each do |item|
       xml.SingleLogoutService Binding: item[:binding], Location: item[:location]

data/lib/saml/kit/builders/templates/response.builder

@@ -5,7 +5,5 @@ xml.Response response_options do
   xml.Status do
     xml.StatusCode Value: status_code
   end
-  encryption_for(xml: xml) do |xml|
-    render assertion, xml: xml
-  end
+  render assertion, xml: xml
 end

data/lib/saml/kit/builders/templates/service_provider_metadata.builder

@@ -2,11 +2,11 @@ xml.instruct!
 xml.EntityDescriptor entity_descriptor_options do
   signature_for(reference_id: id, xml: xml)
   xml.SPSSODescriptor descriptor_options do
-    if configuration.signing_certificate_pem.present?
-      render configuration.signing_certificate, xml: xml
+    configuration.certificates(use: :signing).each do |certificate|
+      render certificate, xml: xml
     end
-    if configuration.encryption_certificate_pem.present?
-      render configuration.encryption_certificate, xml: xml
+    configuration.certificates(use: :encryption).each do |certificate|
+      render certificate, xml: xml
     end
     logout_urls.each do |item|
       xml.SingleLogoutService Binding: item[:binding], Location: item[:location]

data/lib/saml/kit/builders/xml_signature.rb

@@ -21,11 +21,10 @@ module Saml
         attr_reader :reference_id
         attr_reader :x509_certificate
 
-        def initialize(reference_id, configuration:, sign: true)
+        def initialize(reference_id, configuration:)
           @configuration = configuration
           @reference_id = reference_id
-          @sign = sign
-          @x509_certificate = configuration.signing_certificate.stripped
+          @x509_certificate = configuration.certificates(use: :signing).sample.stripped
         end
 
         def signature_method

data/lib/saml/kit/composite_metadata.rb

@@ -1,16 +1,19 @@
 module Saml
   module Kit
     class CompositeMetadata < Metadata
+      include Enumerable
       attr_reader :service_provider, :identity_provider
 
       def initialize(xml)
         super("IDPSSODescriptor", xml)
-        @service_provider = Saml::Kit::ServiceProviderMetadata.new(xml)
-        @identity_provider = Saml::Kit::IdentityProviderMetadata.new(xml)
+        @metadatum = [
+          Saml::Kit::ServiceProviderMetadata.new(xml),
+          Saml::Kit::IdentityProviderMetadata.new(xml),
+        ]
       end
 
       def services(type)
-        xpath = "//md:EntityDescriptor/md:SPSSODescriptor/md:#{type}|//md:EntityDescriptor/md:IDPSSODescriptor/md:#{type}"
+        xpath = map { |x| "//md:EntityDescriptor/md:#{x.name}/md:#{type}" }.join("|")
         document.find_all(xpath).map do |item|
           binding = item.attribute("Binding").value
           location = item.attribute("Location").value
@@ -19,14 +22,16 @@ module Saml
       end
 
       def certificates
-        identity_provider.certificates + service_provider.certificates
+        flat_map(&:certificates)
+      end
+
+      def each(&block)
+        @metadatum.each(&block)
       end
 
       def method_missing(name, *args)
-        if identity_provider.respond_to?(name)
-          identity_provider.public_send(name, *args)
-        elsif service_provider.respond_to?(name)
-          service_provider.public_send(name, *args)
+        if target = find { |x| x.respond_to?(name) }
+          target.public_send(name, *args)
         else
           super
         end

data/lib/saml/kit/configuration.rb

@@ -3,37 +3,62 @@ module Saml
     class Configuration
       attr_accessor :issuer
       attr_accessor :signature_method, :digest_method
-      attr_accessor :signing_certificate_pem, :signing_private_key_pem, :signing_private_key_password
-      attr_accessor :encryption_certificate_pem, :encryption_private_key_pem, :encryption_private_key_password
       attr_accessor :registry, :session_timeout
       attr_accessor :logger
 
       def initialize
         @signature_method = :SHA256
         @digest_method = :SHA256
-        @signing_private_key_password = SecureRandom.uuid
-        @encryption_private_key_password = SecureRandom.uuid
-        @signing_certificate_pem, @signing_private_key_pem = SelfSignedCertificate.new(@signing_private_key_password).create
-        @encryption_certificate_pem, @encryption_private_key_pem = SelfSignedCertificate.new(@encryption_private_key_password).create
         @registry = DefaultRegistry.new
         @session_timeout = 3.hours
         @logger = Logger.new(STDOUT)
+        yield self if block_given?
       end
 
-      def signing_certificate
-        Saml::Kit::Certificate.new(signing_certificate_pem, use: :signing)
+      def add_key_pair(certificate, private_key, password:, use: :signing)
+        key_pairs.push({
+          certificate: Saml::Kit::Certificate.new(certificate, use: use),
+          private_key: OpenSSL::PKey::RSA.new(private_key, password)
+        })
+      end
+
+      def generate_key_pair_for(use:, password: SecureRandom.uuid)
+        certificate, private_key = SelfSignedCertificate.new(password).create
+        add_key_pair(certificate, private_key, password: password, use: use)
+      end
+
+      def certificates(use: nil)
+        certificates = key_pairs.map { |x| x[:certificate] }
+        use.present? ? certificates.find_all { |x| x.for?(use) } : certificates
+      end
+
+      def private_keys(use: :signing)
+        key_pairs.find_all { |x| x[:certificate].for?(use) }.map { |x| x[:private_key] }
       end
 
       def encryption_certificate
-        Saml::Kit::Certificate.new(encryption_certificate_pem, use: :encryption)
+        Saml::Kit.deprecate("encryption_certificate is deprecated. Use certificates(use: :encryption) instead")
+        certificates(use: :encryption).last
       end
 
       def signing_private_key
-        OpenSSL::PKey::RSA.new(signing_private_key_pem, signing_private_key_password)
+        Saml::Kit.deprecate("signing_private_key is deprecated. Use private_keys(use: :signing) instead")
+        private_keys(use: :signing).last
       end
 
       def encryption_private_key
-        OpenSSL::PKey::RSA.new(encryption_private_key_pem, encryption_private_key_password)
+        Saml::Kit.deprecate("encryption_private_key is deprecated. Use private_keys(use: :encryption) instead")
+        private_keys(use: :encryption).last
+      end
+
+      def sign?
+        certificates(use: :signing).any?
+      end
+
+      private
+
+      def key_pairs
+        @key_pairs ||= []
       end
     end
   end

data/lib/saml/kit/document.rb

@@ -12,9 +12,10 @@ module Saml
       validate :must_be_expected_type
       validate :must_be_valid_version
 
-      attr_reader :content, :name
+      attr_reader :content, :name, :configuration
 
-      def initialize(xml, name:)
+      def initialize(xml, name:, configuration: Saml::Kit.configuration)
+        @configuration = configuration
         @content = xml
         @name = name
         @xml_hash = Hash.from_xml(xml) || {}

data/lib/saml/kit/locales/en.yml

@@ -11,6 +11,9 @@ en:
         invalid_signature: "invalid signature."
       InvalidDocument:
         invalid: "must contain valid SAMLRequest"
+      LogoutRequest:
+        invalid_fingerprint: "does not match."
+        unregistered: "is unregistered."
       LogoutResponse:
         unregistered: "is unregistered."
       Response:

data/lib/saml/kit/logout_request.rb

@@ -4,8 +4,8 @@ module Saml
       include Requestable
       validates_presence_of :single_logout_service, if: :expected_type?
 
-      def initialize(xml)
-        super(xml, name: "LogoutRequest")
+      def initialize(xml, configuration: Saml::Kit.configuration)
+        super(xml, name: "LogoutRequest", configuration: configuration)
       end
 
       def name_id

data/lib/saml/kit/metadata.rb

@@ -91,8 +91,8 @@ module Saml
       end
 
       def verify(algorithm, signature, data)
-        signing_certificates.find do |cert|
-          cert.public_key.verify(algorithm, signature, data)
+        signing_certificates.find do |certificate|
+          certificate.public_key.verify(algorithm, signature, data)
         end
       end
 

data/lib/saml/kit/response.rb

@@ -2,42 +2,16 @@ module Saml
   module Kit
     class Response < Document
       include Respondable
+      extend Forwardable
+
+      def_delegators :assertion, :name_id, :[], :attributes, :started_at, :expired_at, :audiences
 
       validate :must_be_active_session
       validate :must_match_issuer
 
-      def initialize(xml, request_id: nil)
+      def initialize(xml, request_id: nil, configuration: Saml::Kit.configuration)
         @request_id = request_id
-        super(xml, name: "Response")
-      end
-
-      def name_id
-        assertion.fetch('Subject', {}).fetch('NameID', nil)
-      end
-
-      def [](key)
-        attributes[key]
-      end
-
-      def attributes
-        @attributes ||=
-          begin
-            attrs = assertion.fetch('AttributeStatement', {}).fetch('Attribute', [])
-            items = if attrs.is_a? Hash
-              [[attrs["Name"], attrs["AttributeValue"]]]
-            else
-              attrs.map { |item| [item['Name'], item['AttributeValue']] }
-            end
-            Hash[items].with_indifferent_access
-          end
-      end
-
-      def started_at
-        parse_date(assertion.fetch('Conditions', {}).fetch('NotBefore', nil))
-      end
-
-      def expired_at
-        parse_date(assertion.fetch('Conditions', {}).fetch('NotOnOrAfter', nil))
+        super(xml, name: "Response", configuration: configuration)
       end
 
       def expired?
@@ -48,29 +22,16 @@ module Saml
         Time.current > started_at && !expired?
       end
 
-      def encrypted?
-        to_h[name]['EncryptedAssertion'].present?
-      end
-
       def assertion
-        @assertion =
-          begin
-            if encrypted?
-              decrypted = XmlDecryption.new.decrypt(to_h.fetch(name, {}).fetch('EncryptedAssertion', {}))
-              Saml::Kit.logger.debug(decrypted)
-              Hash.from_xml(decrypted)['Assertion']
-            else
-              to_h.fetch(name, {}).fetch('Assertion', {})
-            end
-          end
+        @assertion = Saml::Kit::Assertion.new(to_h, configuration: @configuration)
       end
 
       def signed?
-        super || assertion.fetch('Signature', nil).present?
+        super || assertion.signed?
       end
 
       def certificate
-        super || assertion.fetch('Signature', {}).fetch('KeyInfo', {}).fetch('X509Data', {}).fetch('X509Certificate', nil)
+        super || assertion.certificate
       end
 
       private
@@ -85,25 +46,11 @@ module Saml
         return unless expected_type?
         return unless success?
 
-        unless audiences.include?(Saml::Kit.configuration.issuer)
+        unless audiences.include?(configuration.issuer)
           errors[:audience] << error_message(:must_match_issuer)
         end
       end
 
-      def audiences
-        Array(assertion['Conditions']['AudienceRestriction']['Audience'])
-      rescue => error
-        Saml::Kit.logger.error(error)
-        []
-      end
-
-      def parse_date(value)
-        DateTime.parse(value)
-      rescue => error
-        Saml::Kit.logger.error(error)
-        Time.at(0).to_datetime
-      end
-
       Builder = ActiveSupport::Deprecation::DeprecatedConstantProxy.new('Saml::Kit::Response::Builder', 'Saml::Kit::Builders::Response')
     end
   end

data/lib/saml/kit/self_signed_certificate.rb

@@ -17,15 +17,6 @@ module Saml
         certificate.public_key = public_key
         certificate.serial = 0x0
         certificate.version = 2
-        factory = OpenSSL::X509::ExtensionFactory.new
-        factory.subject_certificate = factory.issuer_certificate = certificate
-        certificate.extensions = [
-          factory.create_extension("basicConstraints","CA:TRUE", true),
-          factory.create_extension("subjectKeyIdentifier", "hash"),
-        ]
-        certificate.add_extension(
-          factory.create_extension("authorityKeyIdentifier", "keyid:always,issuer:always")
-        )
         certificate.sign(rsa_key, OpenSSL::Digest::SHA256.new)
         [
           certificate.to_pem,

data/lib/saml/kit/signature.rb

@@ -1,36 +1,23 @@
 module Saml
   module Kit
     class Signature
-      attr_reader :sign, :xml
-      attr_reader :configuration
+      attr_reader :signatures
+      attr_reader :xml
 
-      def initialize(xml, configuration:, sign: true)
-        @configuration = configuration
-        @sign = sign
+      def initialize(xml, signatures)
+        @signatures = signatures
         @xml = xml
       end
 
       def template(reference_id)
-        return unless sign
-        signature = signatures.build(reference_id)
-        Template.new(signature).to_xml(xml: xml)
+        Template.new(signatures.build(reference_id)).to_xml(xml: xml)
       end
 
-      def finalize
+      def self.sign(xml: ::Builder::XmlMarkup.new, configuration: Saml::Kit.configuration)
+        signatures = Saml::Kit::Signatures.new(configuration: configuration)
+        yield xml, new(xml, signatures)
         signatures.complete(xml.target!)
       end
-
-      def self.sign(sign: true, xml: ::Builder::XmlMarkup.new, configuration: Saml::Kit.configuration)
-        signature = new(xml, sign: sign, configuration: configuration)
-        yield xml, signature
-        signature.finalize
-      end
-
-      private
-
-      def signatures
-        @signatures ||= Saml::Kit::Signatures.new(configuration: configuration, sign: sign)
-      end
     end
   end
 end

data/lib/saml/kit/signatures.rb

@@ -1,28 +1,22 @@
 module Saml
   module Kit
     class Signatures
-      attr_reader :sign, :configuration
+      attr_reader :configuration
 
-      def initialize(configuration:, sign: true)
+      def initialize(configuration:)
         @configuration = configuration
-        @sign = sign
       end
 
       def build(reference_id)
-        Saml::Kit::Builders::XmlSignature.new(reference_id, configuration: configuration, sign: sign)
+        return nil unless configuration.sign?
+        Saml::Kit::Builders::XmlSignature.new(reference_id, configuration: configuration)
       end
 
       def complete(raw_xml)
-        return raw_xml unless sign
-
+        return raw_xml unless configuration.sign?
+        private_key = configuration.private_keys(use: :signing).sample
         Xmldsig::SignedDocument.new(raw_xml).sign(private_key)
       end
-
-      private
-
-      def private_key
-        configuration.signing_private_key
-      end
     end
   end
 end

data/lib/saml/kit/templatable.rb

@@ -1,17 +1,23 @@
 module Saml
   module Kit
     module Templatable
+      attr_accessor :sign
+
       def to_xml(xml: ::Builder::XmlMarkup.new)
         signatures.complete(render(self, xml: xml))
       end
 
       def signature_for(reference_id:, xml:)
-        return unless sign
+        return unless sign?
         render(signatures.build(reference_id), xml: xml)
       end
 
+      def sign?
+        sign.nil? ? configuration.sign? : sign && configuration.sign?
+      end
+
       def signatures
-        @signatures ||= Saml::Kit::Signatures.new(configuration: configuration, sign: sign)
+        @signatures ||= Saml::Kit::Signatures.new(configuration: configuration)
       end
 
       def encryption_for(xml:)

data/lib/saml/kit/template.rb

@@ -18,7 +18,8 @@ module Saml
       end
 
       def template_path
-        File.join(File.expand_path(File.dirname(__FILE__)), "builders/templates/#{template_name}")
+        root_path = File.expand_path(File.dirname(__FILE__))
+        File.join(root_path, "builders/templates/", template_name)
       end
 
       def template

data/lib/saml/kit/trustable.rb

@@ -30,7 +30,7 @@ module Saml
       end
 
       def provider
-        Saml::Kit.registry.metadata_for(issuer)
+        configuration.registry.metadata_for(issuer)
       end
 
       def signature_verified!

data/lib/saml/kit/version.rb

@@ -1,5 +1,5 @@
 module Saml
   module Kit
-    VERSION = "0.2.3"
+    VERSION = "0.2.4"
   end
 end

data/lib/saml/kit/xml.rb

@@ -7,6 +7,7 @@ module Saml
         "ds": Namespaces::XMLDSIG,
         "md": Namespaces::METADATA,
         "saml": Namespaces::ASSERTION,
+        "pro": Namespaces::PROTOCOL,
       }.freeze
 
       attr_reader :raw_xml, :document

data/lib/saml/kit/xml_decryption.rb

@@ -3,8 +3,8 @@ module Saml
     class XmlDecryption
       attr_reader :private_key
 
-      def initialize(private_key = Saml::Kit.configuration.encryption_private_key)
-        @private_key = private_key
+      def initialize(configuration: Saml::Kit.configuration)
+        @private_key = configuration.private_keys(use: :encryption).sample
       end
 
       def decrypt(data)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: saml-kit
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.2.4
 platform: ruby
 authors:
 - mo khan
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-12-12 00:00:00.000000000 Z
+date: 2017-12-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activemodel
@@ -188,6 +188,7 @@ files:
 - exe/saml-kit-decode-http-post
 - exe/saml-kit-decode-http-redirect
 - lib/saml/kit.rb
+- lib/saml/kit/assertion.rb
 - lib/saml/kit/authentication_request.rb
 - lib/saml/kit/bindings.rb
 - lib/saml/kit/bindings/binding.rb
@@ -209,6 +210,7 @@ files:
 - lib/saml/kit/builders/templates/identity_provider_metadata.builder
 - lib/saml/kit/builders/templates/logout_request.builder
 - lib/saml/kit/builders/templates/logout_response.builder
+- lib/saml/kit/builders/templates/nil_class.builder
 - lib/saml/kit/builders/templates/response.builder
 - lib/saml/kit/builders/templates/service_provider_metadata.builder
 - lib/saml/kit/builders/templates/xml_encryption.builder