saml2 3.0.6 → 3.0.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f16f668d04893f2d399e46312ead9237cc6cce6ed941d3155478750e71ef5b1e
-  data.tar.gz: 5a437fcdc952cfc1c3e42a15ddcfbb101dd6f5eb5b5a947ced98d6f6ecf5dc9d
+  metadata.gz: 953f52449cc1cbab86280c3265ecf74cde4eb8db37946a99aa2d85f59d7a4754
+  data.tar.gz: f211ab22f71726b292c5182fba1b5040284c4a243f03458b84f33983f95dadbc
 SHA512:
-  metadata.gz: 77229a603dc7ae1c8042670f787c443cbe9966a3be4bd91b6b415e4625a92e06118145f82c34627ae16b1959b407a014b7e4a2f592470b9f8283430242b5d49c
-  data.tar.gz: 5521fdac42cb4cd5207171a1164532fb203ac9b3f03bb22c7f703703296b75160535f9be4e74bfcd600f966b7055fba09ffe42e48d282e96fb55ac39ab1d1d5d
+  metadata.gz: 271dd3d0bd8325c59b61ed416fd0ed16d1cbc284d957593220f905c3f5c5f8d001bdcc125fcd96e1d28ffe3ad2ec22a6fec027c768df82ddb5dca609ba435c58
+  data.tar.gz: 87337ae1fd36828023da486e932582009b76f666e04fd336e4d4b4e0a244366c62c7491255b320b2575c6439d56c856200f883a2087fdc70b82f746927fef8db

data/lib/saml2/entity.rb

@@ -65,7 +65,7 @@ module SAML2
 
       # (see Message#valid_schema?)
       def valid_schema?
-        Schemas.federation.valid?(xml.document)
+        Schemas.metadata.valid?(xml.document)
       end
 
       # (see Message#id)
@@ -101,7 +101,7 @@ module SAML2
 
     # (see Message#valid_schema?)
     def valid_schema?
-      Schemas.federation.valid?(xml.document)
+      Schemas.metadata.valid?(xml.document)
     end
 
     # @return [String]

data/lib/saml2/response.rb

@@ -13,6 +13,8 @@ module SAML2
     attr_reader :assertions
 
     # Respond to an {AuthnRequest}
+    #
+    # {AuthnRequest#resolve} needs to have been previously called on the {AuthnRequest}.
     # @param authn_request [AuthnRequest]
     # @param issuer [NameID]
     # @param name_id [NameID] The Subject

data/lib/saml2/schemas.rb

@@ -2,12 +2,8 @@
 
 module SAML2
   module Schemas
-    def self.federation
-      @federation ||= schema('ws-federation.xsd')
-    end
-
     def self.metadata
-      @metadata ||= schema('saml-schema-metadata-2.0.xsd')
+      @metadata ||= schema('metadata_combined.xsd')
     end
 
     def self.protocol

data/lib/saml2/service_provider.rb

@@ -20,6 +20,8 @@ module SAML2
     # (see Base#from_xml)
     def from_xml(node)
       super
+      remove_instance_variable(:@authn_requests_signed)
+      remove_instance_variable(:@want_assertions_signed)
       @assertion_consumer_services = nil
       @attribute_consuming_services = nil
     end

data/lib/saml2/signable.rb

@@ -7,16 +7,16 @@ module SAML2
     # @return [Nokogiri::XML::Element, nil]
     def signature
       unless instance_variable_defined?(:@signature)
-        @signature = xml.at_xpath('dsig:Signature', Namespaces::ALL)
-        if @signature
-          signed_node = @signature.at_xpath('dsig:SignedInfo/dsig:Reference', Namespaces::ALL)['URI']
+        @signature = xml.xpath('//dsig:Signature', Namespaces::ALL).find do |signature|
+          signed_node = signature.at_xpath('dsig:SignedInfo/dsig:Reference', Namespaces::ALL)['URI']
           if signed_node == ''
-            @signature = nil unless xml == xml.document.root
+            true if xml == xml.document.root
           elsif signed_node != "##{xml['ID']}"
-            @signature = nil
+            false
           else
             # validating the schema will automatically add ID attributes, so check that first
             xml.set_id_attribute('ID') unless xml.document.get_id(xml['ID'])
+            true
           end
         end
       end

data/lib/saml2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SAML2
-  VERSION = '3.0.6'
+  VERSION = '3.0.11'
 end

data/schemas/metadata_combined.xsd

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<schema
+        targetNamespace="https://www.instructure.com/ruby-saml2/metadata-combined"
+        xmlns="http://www.w3.org/2001/XMLSchema"
+        version="2.0">
+
+  <import namespace="http://docs.oasis-open.org/wsfed/federation/200706"
+          schemaLocation="ws-federation.xsd"/>
+  <import namespace="urn:oasis:names:tc:SAML:metadata:ext:query"
+          schemaLocation="sstc-saml-metadata-ext-query.xsd"/>
+
+</schema>

data/schemas/sstc-saml-metadata-ext-query.xsd

@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<schema 
+  targetNamespace="urn:oasis:names:tc:SAML:metadata:ext:query"
+  xmlns="http://www.w3.org/2001/XMLSchema"
+  xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+  xmlns:query="urn:oasis:names:tc:SAML:metadata:ext:query"
+  elementFormDefault="unqualified"
+  attributeFormDefault="unqualified"
+  blockDefault="substitution"
+  version="2.0">
+
+  <annotation>
+    <documentation>
+      Document title: SAML Metadata Extension Schema for SAML V2.0 and V1.x Query Requesters
+      Document identifier: sstc-saml-metadata-ext-query.xsd
+      Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security
+      Revision history:
+      V1.0 (May 2007):
+        Initial version.
+    </documentation>
+  </annotation>
+
+  <import namespace="urn:oasis:names:tc:SAML:2.0:metadata"
+    schemaLocation="saml-schema-metadata-2.0.xsd"/>
+
+  <complexType name="QueryDescriptorType" abstract="true">
+    <complexContent>
+      <extension base="md:RoleDescriptorType">
+        <sequence>
+          <element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>
+        </sequence>
+        <attribute name="WantAssertionsSigned" type="boolean" use="optional"/>
+      </extension>
+    </complexContent>
+  </complexType>
+
+  <complexType name="AuthnQueryDescriptorType">
+    <complexContent>
+      <extension base="query:QueryDescriptorType"/>
+    </complexContent>
+  </complexType>
+
+  <complexType name="AttributeQueryDescriptorType">
+    <complexContent>
+      <extension base="query:QueryDescriptorType">
+        <sequence>
+          <element ref="md:AttributeConsumingService" minOccurs="0" maxOccurs="unbounded"/>
+        </sequence>
+      </extension>
+    </complexContent>
+  </complexType>
+
+  <element name="ActionNamespace" type="anyURI"/>
+    
+  <complexType name="AuthzDecisionQueryDescriptorType">
+    <complexContent>
+      <extension base="query:QueryDescriptorType">
+        <sequence>
+          <element ref="query:ActionNamespace" minOccurs="0" maxOccurs="unbounded"/>
+        </sequence>
+      </extension>
+    </complexContent>
+  </complexType>
+
+</schema>

data/spec/fixtures/identity_provider.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://sso.school.edu/idp/shibboleth">
-  <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+  <IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
     <KeyDescriptor use="signing">
       <ds:KeyInfo>
         <ds:X509Data>

data/spec/fixtures/response_assertion_signed_reffed_from_response.xml

@@ -0,0 +1,6 @@
+<samlp:Response ID="eppcgfbmldefddomokfgiljnkflhppmoflakahld" IssueInstant="2020-08-11T18:19:49Z" Destination="https://wscc.instructure.com/login/saml" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#enmnbnkdhfhnbjeifihomffcoanmnjdaocnhgnhc"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>cyBkaF5MxEOSX9hLm0g/BWMJpQA=</DigestValue></Reference></SignedInfo><SignatureValue>BqXuyorfBboZI3sSSi4PC3GnJMKyLSQ/897M1RYmgVHx8Pbg1ANy75mpjRQQxGOIz/nSTh6eTPkkFEAT34nhxBSd+JfHof0RfLl/lBI1klSmpi/YoHCKLdVt+iwAemmBNw5Rxw59EepgrbcVtgjsjWISdvMyY7Wqb3nyJDwTGWw=</SignatureValue><KeyInfo><KeyValue><RSAKeyValue><Modulus>yPxoJ9DLOTzn9j91xlqGTX/8Hs5hxjImPalS9qTOc6BYJgXSC7HtxBLMc0usJG58/OaHgWFlaDi4HSBlZe2vLzecaWL1HYxJtW6s+UpD5i+uoxGTPM1ITNlZudGQblh3XTUESrPUZVwSt1N+Vqd4AUHux0E078meTqj9+EMcgsk=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue></KeyValue><X509Data><X509Certificate>MIIB4TCCAU6gAwIBAgIQhv64tDcg/45BI6qmDbJfKDAJBgUrDgMCHQUAMA8xDTALBgNVBAMTBFRFU1QwIBcNMjAwMTI3MTkxNzMxWhgPMjA4MDEyMzEwNTAwMDBaMA8xDTALBgNVBAMTBFRFU1QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMj8aCfQyzk85/Y/dcZahk1//B7OYcYyJj2pUvakznOgWCYF0gux7cQSzHNLrCRufPzmh4FhZWg4uB0gZWXtry83nGli9R2MSbVurPlKQ+YvrqMRkzzNSEzZWbnRkG5Yd101BEqz1GVcErdTflaneAFB7sdBNO/Jnk6o/fhDHILJAgMBAAGjRDBCMEAGA1UdAQQ5MDeAEFm8dl7/zBigioh82gZb6WGhETAPMQ0wCwYDVQQDEwRURVNUghCG/ri0NyD/jkEjqqYNsl8oMAkGBSsOAwIdBQADgYEAotOROUrAiZr7oA3iaZLxq+B6sN+JdWSBquvDUzaMgIWRvUBZPqmOKpXK0+XSLXChgklpVXBXAo78Juy0zza/ZAMyGPbYlSZSME6GlApjp8hi6wi0ti/usi/D8SQSJ9ephwz2JAvI5WP16PzIruYUlf3uI72hKT0NW8Pl3PhT8z8=</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><Assertion ID="enmnbnkdhfhnbjeifihomffcoanmnjdaocnhgnhc" IssueInstant="2020-08-11T18:19:49Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Issuer>
+      https://my.wscc.edu/idp
+    </Issuer><Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">narnold@wscc.edu</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData Recipient="" NotOnOrAfter="2020-08-11T18:29:49Z" InResponseTo="_bd878908-34c0-4e6e-b429-90cc8bfae27c" /></SubjectConfirmation></Subject><Conditions NotBefore="2020-08-11T18:14:49Z" NotOnOrAfter="2020-08-11T18:29:49Z"><AudienceRestriction><Audience>http://wscc.instructure.com/saml2</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name="email"><AttributeValue>narnold@wscc.edu</AttributeValue></Attribute><Attribute Name="display_name"><AttributeValue>Nicholas Arnold</AttributeValue></Attribute><Attribute Name="given_name"><AttributeValue>Nicholas</AttributeValue></Attribute><Attribute Name="integration_id"><AttributeValue>Ed18RSTYO0ivqnZuzQPehQ==</AttributeValue></Attribute><Attribute Name="sis_user_id"><AttributeValue>0097365</AttributeValue></Attribute><Attribute Name="sortable_name"><AttributeValue>Arnold, Nicholas</AttributeValue></Attribute><Attribute Name="surname"><AttributeValue>Arnold</AttributeValue></Attribute><Attribute Name="time_zone"><AttributeValue>US/Eastern</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant="2020-08-11T18:19:49Z"><AuthnContext><AuthnContextClassRef>
+          urn:oasis:names:tc:SAML:2.0:ac:classes:Password
+        </AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>
+

data/spec/fixtures/service_provider.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="http://siteadmin.instructure.com/saml2" ID="unique">
-  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+  <SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 
     <KeyDescriptor use="encryption">
       <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">

data/spec/lib/attribute_consuming_service_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/attribute_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/authn_request_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/bindings/http_redirect_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../spec_helper'
 
 require 'openssl'
@@ -86,10 +88,10 @@ module SAML2
         end
 
         it "raises on unsupported signature algorithm" do
-          x = url
+          x = url.dup
           # SigAlg is now sha10
           x << "0"
-          expect { Bindings::HTTPRedirect.decode(url, public_key: certificate) }.to raise_error(UnsupportedSignatureAlgorithm)
+          expect { Bindings::HTTPRedirect.decode(x, public_key: certificate) }.to raise_error(UnsupportedSignatureAlgorithm)
         end
 
         it "allows the caller to detect an unsigned message" do

data/spec/lib/conditions_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/entity_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/identity_provider_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -32,6 +34,10 @@ module SAML2
       it "should find the signing certificate" do
         expect(idp.keys.first.x509).to match(/MIIE8TCCA9mgAwIBAgIJAITusxON60cKMA0GCSqGSIb3DQEBBQUAMIGrMQswCQYD/)
       end
+
+      it "loads identity provider attributes" do
+        expect(idp.want_authn_requests_signed?).to be_truthy
+      end
     end
   end
 end

data/spec/lib/indexed_object_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/key_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/logout_request_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/logout_response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/message_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -272,6 +274,20 @@ MIIB/jCCAWegAwIBAgIBCjANBgkqhkiG9w0BAQQFADAkMSIwIAYDVQQDExlhZGRlcjEuaXRzLnVuaW1l
         expect(response.errors).to eq []
         expect(response.assertions.first.subject.name_id.id).to eq 'testuserint.sso@staff.oimtest.unimelb.edu.au'
       end
+
+      it "finds signatures the sign the assertion, not inside the assertion" do
+        response = Response.parse(fixture("response_assertion_signed_reffed_from_response.xml"))
+        sp_entity.entity_id = 'http://wscc.instructure.com/saml2'
+        idp_entity.entity_id = 'https://my.wscc.edu/idp'
+        idp_entity.identity_providers.first.keys.clear
+        idp_entity.identity_providers.first.fingerprints << "c4f473274116a3cbc295c3abf77c7ed1ade9b904"
+
+        sp_entity.valid_response?(response, idp_entity, verification_time: response.issue_instant)
+        expect(response.errors).to eq []
+        expect(response.assertions.first.subject.name_id.id).to eq 'narnold@wscc.edu'
+        expect(response).not_to be_signed
+        expect(response.assertions.first).to be_signed
+      end
     end
   end
 end

data/spec/lib/service_provider_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -64,6 +66,11 @@ module SAML2
         expect(sp.keys.first.encryption_methods.first.algorithm).to eq KeyDescriptor::EncryptionMethod::Algorithm::AES128_CBC
         expect(sp.keys.first.encryption_methods.first.key_size).to eq 128
       end
+
+      it "loads service provider attributes" do
+        expect(sp.authn_requests_signed?).to be_truthy
+        expect(sp.want_assertions_signed?).to be_truthy
+      end
     end
   end
 end

data/spec/spec_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'saml2'
 
 def fixture(name)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: saml2
 version: !ruby/object:Gem::Version
-  version: 3.0.6
+  version: 3.0.11
 platform: ruby
 authors:
 - Cody Cutrer
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-04-16 00:00:00.000000000 Z
+date: 2021-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -19,7 +19,7 @@ dependencies:
         version: 1.5.8
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '1.12'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -29,7 +29,7 @@ dependencies:
         version: 1.5.8
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '1.12'
 - !ruby/object:Gem::Dependency
   name: nokogiri-xmlsec-instructure
   requirement: !ruby/object:Gem::Requirement
@@ -59,7 +59,7 @@ dependencies:
         version: '3.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '6.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -69,7 +69,7 @@ dependencies:
         version: '3.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5.3'
+        version: '6.2'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
@@ -168,11 +168,13 @@ files:
 - lib/saml2/subject.rb
 - lib/saml2/version.rb
 - schemas/MetadataExchange.xsd
+- schemas/metadata_combined.xsd
 - schemas/oasis-200401-wss-wssecurity-secext-1.0.xsd
 - schemas/oasis-200401-wss-wssecurity-utility-1.0.xsd
 - schemas/saml-schema-assertion-2.0.xsd
 - schemas/saml-schema-metadata-2.0.xsd
 - schemas/saml-schema-protocol-2.0.xsd
+- schemas/sstc-saml-metadata-ext-query.xsd
 - schemas/ws-addr.xsd
 - schemas/ws-authorization.xsd
 - schemas/ws-federation.xsd
@@ -189,6 +191,7 @@ files:
 - spec/fixtures/noconditions_response.xml
 - spec/fixtures/othercertificate.pem
 - spec/fixtures/privatekey.key
+- spec/fixtures/response_assertion_signed_reffed_from_response.xml
 - spec/fixtures/response_signed.xml
 - spec/fixtures/response_tampered_certificate.xml
 - spec/fixtures/response_tampered_signature.xml
@@ -224,7 +227,7 @@ homepage: https://github.com/instructure/ruby-saml2
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -239,8 +242,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: SAML 2.0 Library
 test_files:
@@ -269,6 +272,7 @@ test_files:
 - spec/fixtures/certificate.pem
 - spec/fixtures/noconditions_response.xml
 - spec/fixtures/entities.xml
+- spec/fixtures/response_assertion_signed_reffed_from_response.xml
 - spec/fixtures/xml_signature_wrapping_attack_duplicate_ids.xml
 - spec/fixtures/response_without_keyinfo.xml
 - spec/fixtures/response_with_signed_assertion_and_encrypted_subject.xml