saml2 3.0.8 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1dff92fc9d0d5ebac2fdef1ec37c5359a0d7bbde83d0d6faa0a8dbacedcf538a
-  data.tar.gz: 3222ef01c4bb421bf27df8e308b64a03fc8c31749283f3ade35d64d425667bcf
+  metadata.gz: 1a9f01162da7309af02b28de55593de014c32eba85d87a7af95360423cd03550
+  data.tar.gz: 71b3e1f1309c840e649e8d6a3dfad701b01349c5c8b3c3378b96733ef62718cf
 SHA512:
-  metadata.gz: 1e4dd06e08cc35fb4e7b6a519d66c097bb0c94fab0c8a6a6bc5a417772c737ea03c577f68f69ce49a271e091b48dad7efb9f664f05c11b8a7b961ad965b8a83a
-  data.tar.gz: 44edac0a66662fc20cde06931927bed8f308d0842e03de1223bb4c73d7defbb016dbd6f55b37c1f2a5de1e8c0800413db4f7175c77a1b7a80b7763ee8557b831
+  metadata.gz: 0b8ff067a719d4e450a94b23967b6519a2c51ed806decb7b342f06c29ace840625b2d03056a986fbd54c12fe9adc2997ab24731be40341d52f01d34d5e14f220
+  data.tar.gz: 2de7817d5dda92bacd3e87fe302a7f7f35e70ca7a2234b4237a45951456ab19c66da8ef836c9004ae289f4d7f8d38ef47ff4f6efc21a2d641bc8d0c62a00f1df

data/lib/saml2/key.rb

@@ -11,6 +11,8 @@ module SAML2
   class KeyInfo < Base
     # @return [String] The PEM encoded certificate.
     attr_reader :x509
+    # @return [OpenSSL::PKey::PKey] An RSA Public Key
+    attr_accessor :key
 
     # @param x509 [String] The PEM encoded certificate.
     def initialize(x509 = nil)
@@ -19,7 +21,15 @@ module SAML2
 
     # (see Base#from_xml)
     def from_xml(node)
-      self.x509 = node.at_xpath('dsig:KeyInfo/dsig:X509Data/dsig:X509Certificate', Namespaces::ALL)&.content&.strip
+      self.x509 = node.at_xpath('dsig:X509Data/dsig:X509Certificate', Namespaces::ALL)&.content&.strip
+      if (rsa_key_value = node.at_xpath('dsig:KeyValue/dsig:RSAKeyValue', Namespaces::ALL))
+        modulus = crypto_binary_to_integer(rsa_key_value.at_xpath('dsig:Modulus', Namespaces::ALL)&.content&.strip)
+        exponent = crypto_binary_to_integer(rsa_key_value.at_xpath('dsig:Exponent', Namespaces::ALL)&.content&.strip)
+        if modulus && exponent
+          @key = OpenSSL::PKey::RSA.new
+          key.set_key(modulus, exponent, nil)
+        end
+      end
     end
 
     def x509=(value)
@@ -28,9 +38,15 @@ module SAML2
 
     # @return [OpenSSL::X509::Certificate]
     def certificate
+      return nil if x509.nil?
       @certificate ||= OpenSSL::X509::Certificate.new(Base64.decode64(x509))
     end
 
+    # @return [OpenSSL::PKey::PKey]
+    def public_key
+      key || certificate&.public_key
+    end
+
     # Formats a fingerprint as all lowercase, with a : every two characters,
     # stripping all non-hexadecimal characters.
     # @param fingerprint [String]
@@ -41,17 +57,35 @@ module SAML2
 
     # @return [String]
     def fingerprint
+      return nil unless certificate
       @fingerprint ||= self.class.format_fingerprint(Digest::SHA1.hexdigest(certificate.to_der))
     end
 
     # (see Base#build)
     def build(builder)
       builder['dsig'].KeyInfo do |key_info|
-        key_info['dsig'].X509Data do |x509_data|
-          x509_data['dsig'].X509Certificate(x509)
+        if x509
+          key_info['dsig'].X509Data do |x509_data|
+            x509_data['dsig'].X509Certificate(x509)
+          end
+        end
+        if key.is_a?(OpenSSL::PKey::RSA)
+          key_info['dsig'].KeyValue do |key_value|
+            key_value['dsig'].RSAKeyValue do |rsa_key_value|
+              rsa_key_value['dsig'].Modulus(Base64.encode64(key.n.to_s(2)))
+              rsa_key_value['dsig'].Exponent(Base64.encode64(key.e.to_s(2)))
+            end
+          end
         end
       end
     end
+
+    private
+
+    def crypto_binary_to_integer(str)
+      return nil unless str
+      OpenSSL::BN.new(Base64.decode64(str), 2)
+    end
   end
 
   class KeyDescriptor < KeyInfo
@@ -99,7 +133,7 @@ module SAML2
 
     # (see Base#from_xml)
     def from_xml(node)
-      super
+      super(node.at_xpath('dsig:KeyInfo', Namespaces::ALL))
       self.use = node['use']
       self.encryption_methods = load_object_array(node, 'md:EncryptionMethod', EncryptionMethod)
     end

data/lib/saml2/response.rb

@@ -13,6 +13,8 @@ module SAML2
     attr_reader :assertions
 
     # Respond to an {AuthnRequest}
+    #
+    # {AuthnRequest#resolve} needs to have been previously called on the {AuthnRequest}.
     # @param authn_request [AuthnRequest]
     # @param issuer [NameID]
     # @param name_id [NameID] The Subject
@@ -125,14 +127,16 @@ module SAML2
         return errors
       end
 
-      certificates = idp.signing_keys.map(&:certificate)
-      if idp.fingerprints.empty? && certificates.empty?
+      certificates = idp.signing_keys.map(&:certificate).compact
+      keys = idp.signing_keys.map(&:key).compact
+      if idp.fingerprints.empty? && certificates.empty? && keys.empty?
         errors << "could not find certificate to validate message"
         return errors
       end
 
       if signed?
-        unless (signature_errors = validate_signature(fingerprint: idp.fingerprints,
+        unless (signature_errors = validate_signature(key: keys,
+                                                      fingerprint: idp.fingerprints,
                                                       cert: certificates)).empty?
           return errors.concat(signature_errors)
         end
@@ -143,7 +147,8 @@ module SAML2
 
       # this might be nil, if the assertion was encrypted
       if assertion&.signed?
-        unless (signature_errors = assertion.validate_signature(fingerprint: idp.fingerprints,
+        unless (signature_errors = assertion.validate_signature(key: keys,
+                                                                fingerprint: idp.fingerprints,
                                                                 cert: certificates)).empty?
           return errors.concat(signature_errors)
         end

data/lib/saml2/service_provider.rb

@@ -20,6 +20,8 @@ module SAML2
     # (see Base#from_xml)
     def from_xml(node)
       super
+      remove_instance_variable(:@authn_requests_signed)
+      remove_instance_variable(:@want_assertions_signed)
       @assertion_consumer_services = nil
       @attribute_consuming_services = nil
     end

data/lib/saml2/signable.rb

@@ -7,16 +7,16 @@ module SAML2
     # @return [Nokogiri::XML::Element, nil]
     def signature
       unless instance_variable_defined?(:@signature)
-        @signature = xml.at_xpath('dsig:Signature', Namespaces::ALL)
-        if @signature
-          signed_node = @signature.at_xpath('dsig:SignedInfo/dsig:Reference', Namespaces::ALL)['URI']
+        @signature = xml.xpath('//dsig:Signature', Namespaces::ALL).find do |signature|
+          signed_node = signature.at_xpath('dsig:SignedInfo/dsig:Reference', Namespaces::ALL)['URI']
           if signed_node == ''
-            @signature = nil unless xml == xml.document.root
+            true if xml == xml.document.root
           elsif signed_node != "##{xml['ID']}"
-            @signature = nil
+            false
           else
             # validating the schema will automatically add ID attributes, so check that first
             xml.set_id_attribute('ID') unless xml.document.get_id(xml['ID'])
+            true
           end
         end
       end
@@ -27,7 +27,7 @@ module SAML2
     def signing_key
       unless instance_variable_defined?(:@signing_key)
         # don't use `... if signature.at_xpath(...)` - we need to make sure we assign the nil
-        @signing_key = signature.at_xpath('dsig:KeyInfo', Namespaces::ALL) ? KeyInfo.from_xml(signature) : nil
+        @signing_key = (key_info = signature.at_xpath('dsig:KeyInfo', Namespaces::ALL)) ? KeyInfo.from_xml(key_info) : nil
       end
       @signing_key
     end
@@ -38,20 +38,21 @@ module SAML2
 
     # Validate the signature on this object.
     #
-    # At least one of +key+, +fingerprint+ or +cert+ must be provided.
+    # At least one of +key+, +fingerprint+ or +cert+ must be provided. If the signature
+    # doesn't specify which key to use, the first provided key will be used.
     #
-    # @param key optional [String, OpenSSL::PKey::PKey]
-    #   The exact public key to use. +fingerprint+ and +cert+ are ignored.
+    # @param key optional [String, OpenSSL::PKey::PKey, Array<String>, Array<OpenSSL::PKey::PKey>]
+    #   Public keys that are allowed to be the valid key.
     # @param fingerprint optional [Array<String>, String]
     #   SHA1 fingerprints of trusted certificates. If provided, they will be
     #   checked against the {#signing_key} embedded in the {#signature}, and if
-    #   a match is found, the certificate embedded in the signature will be
-    #   added to the list of certificates used for verifying the signature.
+    #   a match is found, the key embedded in the signature will be
+    #   used for verifying the signature.
     # @param cert optional [Array<String>, String]
     #   A single or array of trusted certificates. If provided, they will be
-    #   check against the {#signing_key} embedded in the {#signature}, and if
-    #   a match of public keys only is found, that key will be considered trusted
-    #   and used to verify the signature.
+    #   checked against the {#signing_key} embedded in the {#signature}, and if
+    #   a match is found, the key embedded in the signature will be used for
+    #   verifying the signature.
     # @return [Array<String>] An empty array on success, details of errors on failure.
     def validate_signature(key: nil,
                            fingerprint: nil,
@@ -67,23 +68,25 @@ module SAML2
       end
       certs = certs.uniq
 
-      trusted_keys = certs.map do |cert|
+      trusted_keys = Array.wrap(key).map(&:to_s)
+      trusted_keys.concat(certs.map do |cert|
         cert = cert.is_a?(String) ? OpenSSL::X509::Certificate.new(cert) : cert
         cert.public_key.to_s
-      end
-      if signing_key&.certificate && trusted_keys.include?(signing_key.certificate.public_key.to_s)
-        key ||= signing_key.certificate.public_key.to_s
+      end)
+
+      if trusted_keys.include?(signing_key&.public_key&.to_s)
+        verification_key = signing_key.public_key.to_s
       end
       # signature doesn't say who signed it. hope and pray it's with the only certificate
       # we know about
-      if signing_key.nil? && key.nil? && trusted_keys.length == 1
-        key = trusted_keys.first
+      if signing_key.nil?
+        verification_key = trusted_keys.first
       end
 
-      return ["no trusted signing key found"] if key.nil?
+      return ["no trusted signing key found"] if verification_key.nil?
 
       begin
-        result = signature.verify_with(key: key)
+        result = signature.verify_with(key: verification_key)
         result ? [] : ["signature is invalid"]
       rescue XMLSec::VerificationError => e
         [e.message]
@@ -96,8 +99,8 @@ module SAML2
     #
     # @param (see #validate_signature)
     # @return [Boolean]
-    def valid_signature?(fingerprint: nil, cert: nil)
-      validate_signature(fingerprint: fingerprint, cert: cert).empty?
+    def valid_signature?(**kwargs)
+      validate_signature(**kwargs).empty?
     end
 
     # Sign this object.

data/lib/saml2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SAML2
-  VERSION = '3.0.8'
+  VERSION = '3.1.0'
 end

data/spec/fixtures/identity_provider.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://sso.school.edu/idp/shibboleth">
-  <IDPSSODescriptor protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
+  <IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:mace:shibboleth:1.0 urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:2.0:protocol">
     <KeyDescriptor use="signing">
       <ds:KeyInfo>
         <ds:X509Data>

data/spec/fixtures/response_assertion_signed_reffed_from_response.xml

@@ -0,0 +1,6 @@
+<samlp:Response ID="eppcgfbmldefddomokfgiljnkflhppmoflakahld" IssueInstant="2020-08-11T18:19:49Z" Destination="https://wscc.instructure.com/login/saml" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#enmnbnkdhfhnbjeifihomffcoanmnjdaocnhgnhc"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>cyBkaF5MxEOSX9hLm0g/BWMJpQA=</DigestValue></Reference></SignedInfo><SignatureValue>BqXuyorfBboZI3sSSi4PC3GnJMKyLSQ/897M1RYmgVHx8Pbg1ANy75mpjRQQxGOIz/nSTh6eTPkkFEAT34nhxBSd+JfHof0RfLl/lBI1klSmpi/YoHCKLdVt+iwAemmBNw5Rxw59EepgrbcVtgjsjWISdvMyY7Wqb3nyJDwTGWw=</SignatureValue><KeyInfo><KeyValue><RSAKeyValue><Modulus>yPxoJ9DLOTzn9j91xlqGTX/8Hs5hxjImPalS9qTOc6BYJgXSC7HtxBLMc0usJG58/OaHgWFlaDi4HSBlZe2vLzecaWL1HYxJtW6s+UpD5i+uoxGTPM1ITNlZudGQblh3XTUESrPUZVwSt1N+Vqd4AUHux0E078meTqj9+EMcgsk=</Modulus><Exponent>AQAB</Exponent></RSAKeyValue></KeyValue><X509Data><X509Certificate>MIIB4TCCAU6gAwIBAgIQhv64tDcg/45BI6qmDbJfKDAJBgUrDgMCHQUAMA8xDTALBgNVBAMTBFRFU1QwIBcNMjAwMTI3MTkxNzMxWhgPMjA4MDEyMzEwNTAwMDBaMA8xDTALBgNVBAMTBFRFU1QwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMj8aCfQyzk85/Y/dcZahk1//B7OYcYyJj2pUvakznOgWCYF0gux7cQSzHNLrCRufPzmh4FhZWg4uB0gZWXtry83nGli9R2MSbVurPlKQ+YvrqMRkzzNSEzZWbnRkG5Yd101BEqz1GVcErdTflaneAFB7sdBNO/Jnk6o/fhDHILJAgMBAAGjRDBCMEAGA1UdAQQ5MDeAEFm8dl7/zBigioh82gZb6WGhETAPMQ0wCwYDVQQDEwRURVNUghCG/ri0NyD/jkEjqqYNsl8oMAkGBSsOAwIdBQADgYEAotOROUrAiZr7oA3iaZLxq+B6sN+JdWSBquvDUzaMgIWRvUBZPqmOKpXK0+XSLXChgklpVXBXAo78Juy0zza/ZAMyGPbYlSZSME6GlApjp8hi6wi0ti/usi/D8SQSJ9ephwz2JAvI5WP16PzIruYUlf3uI72hKT0NW8Pl3PhT8z8=</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status><Assertion ID="enmnbnkdhfhnbjeifihomffcoanmnjdaocnhgnhc" IssueInstant="2020-08-11T18:19:49Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Issuer>
+      https://my.wscc.edu/idp
+    </Issuer><Subject><NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">narnold@wscc.edu</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData Recipient="" NotOnOrAfter="2020-08-11T18:29:49Z" InResponseTo="_bd878908-34c0-4e6e-b429-90cc8bfae27c" /></SubjectConfirmation></Subject><Conditions NotBefore="2020-08-11T18:14:49Z" NotOnOrAfter="2020-08-11T18:29:49Z"><AudienceRestriction><Audience>http://wscc.instructure.com/saml2</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name="email"><AttributeValue>narnold@wscc.edu</AttributeValue></Attribute><Attribute Name="display_name"><AttributeValue>Nicholas Arnold</AttributeValue></Attribute><Attribute Name="given_name"><AttributeValue>Nicholas</AttributeValue></Attribute><Attribute Name="integration_id"><AttributeValue>Ed18RSTYO0ivqnZuzQPehQ==</AttributeValue></Attribute><Attribute Name="sis_user_id"><AttributeValue>0097365</AttributeValue></Attribute><Attribute Name="sortable_name"><AttributeValue>Arnold, Nicholas</AttributeValue></Attribute><Attribute Name="surname"><AttributeValue>Arnold</AttributeValue></Attribute><Attribute Name="time_zone"><AttributeValue>US/Eastern</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant="2020-08-11T18:19:49Z"><AuthnContext><AuthnContextClassRef>
+          urn:oasis:names:tc:SAML:2.0:ac:classes:Password
+        </AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>
+

data/spec/fixtures/response_with_rsa_key_value.xml

@@ -0,0 +1 @@
+<Response xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_f0b41a2d2b524b8c92027ef426b3cf3b" Version="2.0" IssueInstant="2021-08-02T16:53:20Z" Destination="https://whartononline.instructure.com/login/saml" xmlns="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://test.pep.siemens.knowledgeanywhere.com</Issuer><Status><StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></Status><Assertion Version="2.0" ID="_8be8f34e76e14fe3a990dcc00e60d13d" IssueInstant="2021-08-02T16:53:20Z" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Issuer>https://test.pep.siemens.knowledgeanywhere.com</Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" /><SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference URI="#_8be8f34e76e14fe3a990dcc00e60d13d"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /></Transforms><DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /><DigestValue>VQGa66oHsKF7zCXzob8WTCBLHUI=</DigestValue></Reference></SignedInfo><SignatureValue>S+He/m2bwH+QiGmR/eH9K71TXCQ2hC8BI5pgKWyN3gFfCfEvUYgnksXu/oE1wVxvpp2dtWPiT/8vejTJWfl4Yz8VT8gDcH9xKWhPzsHba8qCHui3U486dR1SwkwII3H0cK0Xhr/dKvco85QPAUsZTKZ+dq5HdeLu6n6aERzC/136iuw/eyCFDfFS2E3dfTHd2u+E9uUh6wI/nCpSzxMxQw9Wz9i941jdLKovuqILEVbbV33sg9VZRFNAs+D92YYiegKnnBBP2+H2fXFA2Wc5uP8yAAsrFMvHA7R1tIP7jci8vEplK/Hlkdta8KQVq4fIKsXUeYu17uNFfbSIXkL5oQ==</SignatureValue><KeyInfo><KeyValue><RSAKeyValue><Modulus>vyYuRxa/PI/r3N4lxOxL/O1OtwYexfmY3mF6mvjMr4YD762UZWNNhLZsFaWqUs3HQQwAZCg0sU65s4a+t4XANuRX1k3E1oPHBmqfLZ8spBeRfyHxc0KSah10RFfCO1LZdte2Avtpvh5RMkGkMhbWFAYQmc24u6sHvI1OVUkKmBiwss6QJAi6bttMsp0VNuW7TmmsPjxmaq5dddSryLHpVP/VbnnLu4fWOnLBMTtDY37l6ZAyqKW8PEaXWSFJSjGlA+9D76+bf5C+snk0yooARZduPny5biXtoHbC3DnPDBbCN70bvkxGNqMBiqPQrI2B7zZUXA1nDiK/iHPxl5X3ZQ==</Modulus><Exponent>AQAB</Exponent></RSAKeyValue></KeyValue></KeyInfo></Signature><Subject><NameID>chad@instructure.com</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData Recipient="https://whartononline.instructure.com/login/saml" NotOnOrAfter="2021-08-02T16:58:20Z" /></SubjectConfirmation></Subject><Conditions NotBefore="2021-08-02T16:48:20Z" NotOnOrAfter="2021-08-02T16:58:20Z"><AudienceRestriction><Audience>http://whartononline.instructure.com/saml2</Audience></AudienceRestriction></Conditions><AuthnStatement AuthnInstant="2021-08-02T16:53:20Z"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement><AttributeStatement><Attribute Name="FIRST_NAME"><AttributeValue>Chad</AttributeValue></Attribute><Attribute Name="LAST_NAME"><AttributeValue>Broadhead</AttributeValue></Attribute><Attribute Name="EMAIL"><AttributeValue>chad@instructure.com</AttributeValue></Attribute><Attribute Name="UserGuid"><AttributeValue>c555db14-fc81-4836-98de-62f592f36ede</AttributeValue></Attribute></AttributeStatement></Assertion></Response>

data/spec/fixtures/service_provider.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="http://siteadmin.instructure.com/saml2" ID="unique">
-  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+  <SPSSODescriptor AuthnRequestsSigned="true" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
 
     <KeyDescriptor use="encryption">
       <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">

data/spec/lib/attribute_consuming_service_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/attribute_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/authn_request_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/bindings/http_redirect_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../../spec_helper'
 
 require 'openssl'
@@ -86,10 +88,10 @@ module SAML2
         end
 
         it "raises on unsupported signature algorithm" do
-          x = url
+          x = url.dup
           # SigAlg is now sha10
           x << "0"
-          expect { Bindings::HTTPRedirect.decode(url, public_key: certificate) }.to raise_error(UnsupportedSignatureAlgorithm)
+          expect { Bindings::HTTPRedirect.decode(x, public_key: certificate) }.to raise_error(UnsupportedSignatureAlgorithm)
         end
 
         it "allows the caller to detect an unsigned message" do

data/spec/lib/conditions_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/entity_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/identity_provider_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -32,6 +34,10 @@ module SAML2
       it "should find the signing certificate" do
         expect(idp.keys.first.x509).to match(/MIIE8TCCA9mgAwIBAgIJAITusxON60cKMA0GCSqGSIb3DQEBBQUAMIGrMQswCQYD/)
       end
+
+      it "loads identity provider attributes" do
+        expect(idp.want_authn_requests_signed?).to be_truthy
+      end
     end
   end
 end

data/spec/lib/indexed_object_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/key_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -7,5 +9,15 @@ module SAML2
         expect(KeyInfo.format_fingerprint("\u200F abcdefghijklmnop 1234567890-\n a1")).to eq("ab:cd:ef:12:34:56:78:90:a1")
       end
     end
+
+    describe '#certificate' do
+      it "doesn't asplode if the keyinfo is just an rsa key value" do
+        response = Nokogiri::XML(fixture("response_with_rsa_key_value.xml"))
+        key = KeyInfo.from_xml(response.at_xpath('//dsig:KeyInfo', Namespaces::ALL))
+        expect(key.certificate).to be_nil
+        expect(key.fingerprint).to be_nil
+        expect(key.key).not_to be_nil
+      end
+    end
   end
 end

data/spec/lib/logout_request_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/logout_response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/message_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2

data/spec/lib/response_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -272,6 +274,20 @@ MIIB/jCCAWegAwIBAgIBCjANBgkqhkiG9w0BAQQFADAkMSIwIAYDVQQDExlhZGRlcjEuaXRzLnVuaW1l
         expect(response.errors).to eq []
         expect(response.assertions.first.subject.name_id.id).to eq 'testuserint.sso@staff.oimtest.unimelb.edu.au'
       end
+
+      it "finds signatures the sign the assertion, not inside the assertion" do
+        response = Response.parse(fixture("response_assertion_signed_reffed_from_response.xml"))
+        sp_entity.entity_id = 'http://wscc.instructure.com/saml2'
+        idp_entity.entity_id = 'https://my.wscc.edu/idp'
+        idp_entity.identity_providers.first.keys.clear
+        idp_entity.identity_providers.first.fingerprints << "c4f473274116a3cbc295c3abf77c7ed1ade9b904"
+
+        sp_entity.valid_response?(response, idp_entity, verification_time: response.issue_instant)
+        expect(response.errors).to eq []
+        expect(response.assertions.first.subject.name_id.id).to eq 'narnold@wscc.edu'
+        expect(response).not_to be_signed
+        expect(response.assertions.first).to be_signed
+      end
     end
   end
 end

data/spec/lib/service_provider_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require_relative '../spec_helper'
 
 module SAML2
@@ -64,6 +66,11 @@ module SAML2
         expect(sp.keys.first.encryption_methods.first.algorithm).to eq KeyDescriptor::EncryptionMethod::Algorithm::AES128_CBC
         expect(sp.keys.first.encryption_methods.first.key_size).to eq 128
       end
+
+      it "loads service provider attributes" do
+        expect(sp.authn_requests_signed?).to be_truthy
+        expect(sp.want_assertions_signed?).to be_truthy
+      end
     end
   end
 end

data/spec/lib/signable_spec.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require_relative '../spec_helper'
+
+module SAML2
+  describe Signable do
+    describe '#valid_signature?' do
+      it 'can work with an explicit key from metadata' do
+        response = Response.parse(fixture("response_with_rsa_key_value.xml"))
+        key = response.assertions.first.signing_key.key
+        expect(response.assertions.first.valid_signature?(key: [key])).to eq true
+      end
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -1,3 +1,6 @@
+# frozen_string_literal: true
+
+require 'byebug'
 require 'saml2'
 
 def fixture(name)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: saml2
 version: !ruby/object:Gem::Version
-  version: 3.0.8
+  version: 3.1.0
 platform: ruby
 authors:
 - Cody Cutrer
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2019-07-30 00:00:00.000000000 Z
+date: 2021-08-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: nokogiri
@@ -19,7 +19,7 @@ dependencies:
         version: 1.5.8
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '1.12'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -29,7 +29,7 @@ dependencies:
         version: 1.5.8
     - - "<"
       - !ruby/object:Gem::Version
-        version: '1.11'
+        version: '1.12'
 - !ruby/object:Gem::Dependency
   name: nokogiri-xmlsec-instructure
   requirement: !ruby/object:Gem::Requirement
@@ -59,7 +59,7 @@ dependencies:
         version: '3.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '6.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -69,21 +69,21 @@ dependencies:
         version: '3.2'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '6.1'
+        version: '6.2'
 - !ruby/object:Gem::Dependency
   name: byebug
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '11.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '10.0'
+        version: '11.0'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -191,11 +191,13 @@ files:
 - spec/fixtures/noconditions_response.xml
 - spec/fixtures/othercertificate.pem
 - spec/fixtures/privatekey.key
+- spec/fixtures/response_assertion_signed_reffed_from_response.xml
 - spec/fixtures/response_signed.xml
 - spec/fixtures/response_tampered_certificate.xml
 - spec/fixtures/response_tampered_signature.xml
 - spec/fixtures/response_with_attribute_signed.xml
 - spec/fixtures/response_with_encrypted_assertion.xml
+- spec/fixtures/response_with_rsa_key_value.xml
 - spec/fixtures/response_with_signed_assertion_and_encrypted_subject.xml
 - spec/fixtures/response_without_keyinfo.xml
 - spec/fixtures/service_provider.xml
@@ -221,12 +223,13 @@ files:
 - spec/lib/message_spec.rb
 - spec/lib/response_spec.rb
 - spec/lib/service_provider_spec.rb
+- spec/lib/signable_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/instructure/ruby-saml2
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -241,8 +244,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
-signing_key: 
+rubygems_version: 3.2.24
+signing_key:
 specification_version: 4
 summary: SAML 2.0 Library
 test_files:
@@ -250,6 +253,7 @@ test_files:
 - spec/lib/logout_response_spec.rb
 - spec/lib/indexed_object_spec.rb
 - spec/lib/attribute_spec.rb
+- spec/lib/signable_spec.rb
 - spec/lib/entity_spec.rb
 - spec/lib/attribute_consuming_service_spec.rb
 - spec/lib/key_spec.rb
@@ -270,7 +274,9 @@ test_files:
 - spec/fixtures/xml_missigned_assertion.xml
 - spec/fixtures/certificate.pem
 - spec/fixtures/noconditions_response.xml
+- spec/fixtures/response_with_rsa_key_value.xml
 - spec/fixtures/entities.xml
+- spec/fixtures/response_assertion_signed_reffed_from_response.xml
 - spec/fixtures/xml_signature_wrapping_attack_duplicate_ids.xml
 - spec/fixtures/response_without_keyinfo.xml
 - spec/fixtures/response_with_signed_assertion_and_encrypted_subject.xml