saml2 2.2.11 → 2.2.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d29dce81582e9f864e9382373bff2d075041266b9a6c13931a2675b2a3b8665f
-  data.tar.gz: a126314896499fd3a30fac541aa8a32ad3d1610c9f7b133b596502d543997a70
+  metadata.gz: 630f03aeb419e5d7ebae94ab4b809bf460be88903fdfdfe981d96dda990fbb5d
+  data.tar.gz: 2f17e8e081522cf5c7b2e8b5705bf600fd33fbc68e404203f865c442ffeea85c
 SHA512:
-  metadata.gz: a6573df0b3f11f79e0878350a021c8bf3c28ebf2736469ea0a97202b22cf41a2823a6aa62a4f0bb18e0e79aecfac946d357e1e2d074dec130192510f997e5fe4
-  data.tar.gz: 9b8011e5a896b084f5e30b552fd8337ea3bcfcce80bdbb99351cf9e6e319864af04f565bc1733c69ee286b53f8e928a4cf7267e7b23409110a5ccc70b2d5b1cc
+  metadata.gz: cad2fd1128ddfa7d8522ca592f8a72b717554ef0d8cddd55b160183e0656df306bebadd0f19e3b131267f8100f1a80ca0956c2c9a78a7eb0e9ad195eb4b72edc
+  data.tar.gz: d38744fc8b083257306a25b7d3f2e1538313f7791e2667debac3e915499153699ee8af484d6aed2769dc51baffa35e03694759af7e5b32407b77e973b7c66bef

data/lib/saml2/attribute.rb

@@ -174,9 +174,13 @@ module SAML2
     #
     # Repeated attributes become an array.
     #
-    # @param name optional [:name, :friendly_name]
-    #   Which name field to use as keys to the hash
-    def to_h(name = :friendly_name)
+    # @param name optional [:name, :friendly_name, :both]
+    #   Which name field to use as keys to the hash. If :both
+    #   is specified, attributes may be duplicated under both
+    #   names.
+    def to_h(name = :both)
+      return to_h(:friendly_name).merge(to_h(:name)) if name == :both
+
       result = {}
       attributes.each do |attribute|
         key = attribute.send(name)

data/lib/saml2/conditions.rb

@@ -46,10 +46,10 @@ module SAML2
     def validate(verification_time: Time.now.utc, **options)
       options[:verification_time] ||= verification_time
       errors = []
-      if not_before && verification_time < not_before - 5
+      if not_before && verification_time < not_before
         errors << "not_before #{not_before} is later than now (#{verification_time})"
       end
-      if not_on_or_after && verification_time >= not_on_or_after + 5
+      if not_on_or_after && verification_time >= not_on_or_after
         errors << "not_on_or_after #{not_on_or_after} is earlier than now (#{verification_time})"
       end
 
@@ -109,7 +109,9 @@ module SAML2
       end
 
       # @param audience [String]
-      def validate(audience: nil, **_)
+      def validate(audience: nil, ignore_audience_condition: false, **_)
+        return [] if ignore_audience_condition
+
         unless Array.wrap(self.audience).include?(audience)
           return ["audience #{audience} not in allowed list of #{Array.wrap(self.audience).join(', ')}"]
         end

data/lib/saml2/entity.rb

@@ -168,9 +168,7 @@ module SAML2
     # @param identity_provider [Entity]
     def valid_response?(message,
                         identity_provider,
-                        verification_time: Time.now.utc,
-                        allow_expired_certificate: false,
-                        verify_certificate: true)
+                        **opts)
       unless message.is_a?(Response)
         message.errors << "not a Response object"
         return false
@@ -178,9 +176,7 @@ module SAML2
 
       message.validate(service_provider: self,
                        identity_provider: identity_provider,
-                       verification_time: verification_time,
-                       allow_expired_certificate: allow_expired_certificate,
-                       verify_certificate: verify_certificate).empty?
+                       **opts).empty?
     end
   end
 end

data/lib/saml2/response.rb

@@ -89,11 +89,19 @@ module SAML2
     # @param verification_time optional [DateTime]
     #   Validate timestamps (signing certificate validity, issued at, etc.) as of
     #   this point in time.
+    # @param allow_expired_certificate optional [true, false]
+    #   Allow signing certificate to be expired.
+    # @param verify_certificate optional [true, false]
+    #   Don't validate the trust chain or validity dates of the signing
+    #   certificate.
+    # @param ignore_audience_condition optional [true, false]
+    #   Don't validate any Audience conditions.
     def validate(service_provider:,
                  identity_provider:,
-                 verification_time: Time.now.utc,
+                 verification_time: nil,
                  allow_expired_certificate: false,
-                 verify_certificate: true)
+                 verify_certificate: true,
+                 ignore_audience_condition: false)
       raise ArgumentError, "service_provider should be an Entity object" unless service_provider.is_a?(Entity)
       raise ArgumentError, "service_provider should have at least one service_provider role" unless (sp = service_provider.service_providers.first)
 
@@ -101,6 +109,13 @@ module SAML2
       super()
       return errors unless errors.empty?
 
+      if verification_time.nil?
+        verification_time = Time.now.utc
+        # they issued it in the (near) future according to our clock;
+        # use their clock instead
+        verification_time = issue_instant if issue_instant > verification_time && issue_instant < verification_time + 5 * 60
+      end
+
       # not finding the issuer is not exceptional
       if identity_provider.nil?
         errors << "could not find issuer of response"
@@ -216,7 +231,8 @@ module SAML2
 
       if assertion.conditions &&
           !(condition_errors = assertion.conditions.validate(verification_time: verification_time,
-                                                             audience: service_provider.entity_id)).empty?
+                                                             audience: service_provider.entity_id,
+                                                             ignore_audience_condition: ignore_audience_condition)).empty?
         return errors.concat(condition_errors)
       end
 

data/lib/saml2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SAML2
-  VERSION = '2.2.11'
+  VERSION = '2.2.12'
 end

data/spec/lib/attribute_spec.rb

@@ -111,13 +111,16 @@ XML
     describe "#to_h" do
       it "works" do
         attr_statement = Response.parse(fixture("response_with_attribute_signed.xml")).assertions.first.attribute_statements.first
-        expect(attr_statement.to_h).to eq('givenName' => 'cody')
+        expect(attr_statement.to_h(:friendly_name)).to eq('givenName' => 'cody')
         expect(attr_statement.to_h(:name)).to eq("urn:oid:2.5.4.42" => 'cody')
+        expect(attr_statement.to_h(:both)).to eq('givenName' => 'cody', "urn:oid:2.5.4.42" => 'cody')
       end
 
       it "infers friendly names if possible" do
         attr_statement = Response.parse(fixture("test3-response.xml")).assertions.first.attribute_statements.first
         expect(attr_statement.to_h).to eq({
+            'urn:oid:1.3.6.1.4.1.5923.1.1.1.1' => 'member',
+            'urn:oid:1.3.6.1.4.1.5923.1.1.1.6' => 'student@example.edu',
             'eduPersonAffiliation' => 'member',
             'eduPersonPrincipalName' => 'student@example.edu'})
       end
@@ -135,7 +138,7 @@ XML
 </saml2:AttributeStatement>
         XML
 
-        expect(attr_statement.to_h).to eq({
+        expect(attr_statement.to_h(:friendly_name)).to eq({
             'eduPersonScopedAffiliation' => ['02', 'employee@school.edu', 'students@school.edu']
                                           })
       end

data/spec/lib/conditions_spec.rb

@@ -64,5 +64,9 @@ module SAML2
     it "should be valid with an array" do
       expect(Conditions::AudienceRestriction.new(['expected', 'actual']).valid?(audience: 'actual')).to eq true
     end
+
+    it "is valid when ignored" do
+      expect(Conditions::AudienceRestriction.new('expected').valid?(audience: 'actual', ignore_audience_condition: true)).to eq true
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: saml2
 version: !ruby/object:Gem::Version
-  version: 2.2.11
+  version: 2.2.12
 platform: ruby
 authors:
 - Cody Cutrer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-23 00:00:00.000000000 Z
+date: 2018-06-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri