saml2 3.1.1 → 3.1.3

data/lib/saml2/authn_request.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
 
-require 'base64'
-require 'zlib'
-
-require 'saml2/attribute_consuming_service'
-require 'saml2/bindings/http_redirect'
-require 'saml2/endpoint'
-require 'saml2/name_id'
-require 'saml2/namespaces'
-require 'saml2/request'
-require 'saml2/requested_authn_context'
-require 'saml2/schemas'
-require 'saml2/subject'
+require "base64"
+require "zlib"
+
+require "saml2/attribute_consuming_service"
+require "saml2/bindings/http_redirect"
+require "saml2/endpoint"
+require "saml2/name_id"
+require "saml2/namespaces"
+require "saml2/request"
+require "saml2/requested_authn_context"
+require "saml2/schemas"
+require "saml2/subject"
 
 module SAML2
   class AuthnRequest < Request
@@ -35,8 +35,8 @@ module SAML2
     # @param service_provider [ServiceProvider]
     # @return [AuthnRequest]
     def self.initiate(issuer, identity_provider = nil,
-        assertion_consumer_service: nil,
-        service_provider: nil)
+                      assertion_consumer_service: nil,
+                      service_provider: nil)
       authn_request = new
       authn_request.issuer = issuer
       authn_request.destination = identity_provider.single_sign_on_services.first.location if identity_provider
@@ -80,12 +80,16 @@ module SAML2
     def resolve(service_provider)
       # TODO: check signature if present
 
-      if assertion_consumer_service_url
-        @assertion_consumer_service = service_provider.assertion_consumer_services.find { |acs| acs.location == assertion_consumer_service_url }
-      else
-        @assertion_consumer_service  = service_provider.assertion_consumer_services.resolve(assertion_consumer_service_index)
-      end
-      @attribute_consuming_service = service_provider.attribute_consuming_services.resolve(attribute_consuming_service_index)
+      @assertion_consumer_service =
+        if assertion_consumer_service_url
+          service_provider.assertion_consumer_services.find do |acs|
+            acs.location == assertion_consumer_service_url
+          end
+        else
+          service_provider.assertion_consumer_services.resolve(assertion_consumer_service_index)
+        end
+      @attribute_consuming_service =
+        service_provider.attribute_consuming_services.resolve(attribute_consuming_service_index)
 
       return false unless @assertion_consumer_service
       return false if attribute_consuming_service_index && !@attribute_consuming_service
@@ -96,7 +100,7 @@ module SAML2
     # @return [NameID::Policy, nil]
     def name_id_policy
       if xml && !instance_variable_defined?(:@name_id_policy)
-        @name_id_policy = NameID::Policy.from_xml(xml.at_xpath('samlp:NameIDPolicy', Namespaces::ALL))
+        @name_id_policy = NameID::Policy.from_xml(xml.at_xpath("samlp:NameIDPolicy", Namespaces::ALL))
       end
       @name_id_policy
     end
@@ -111,7 +115,7 @@ module SAML2
     # @return [Integer, nil]
     def assertion_consumer_service_index
       if xml && !instance_variable_defined?(:@assertion_consumer_service_index)
-        @assertion_consumer_service_index = xml['AssertionConsumerServiceIndex']&.to_i
+        @assertion_consumer_service_index = xml["AssertionConsumerServiceIndex"]&.to_i
       end
       @assertion_consumer_service_index
     end
@@ -119,7 +123,7 @@ module SAML2
     # @return [String, nil]
     def assertion_consumer_service_url
       if xml && !instance_variable_defined?(:@assertion_consumer_service_url)
-        @assertion_consumer_service_url = xml['AssertionConsumerServiceURL']
+        @assertion_consumer_service_url = xml["AssertionConsumerServiceURL"]
       end
       @assertion_consumer_service_url
     end
@@ -127,61 +131,64 @@ module SAML2
     # @return [Integer, nil]
     def attribute_consuming_service_index
       if xml && !instance_variable_defined?(:@attribute_consuming_service_index)
-        @attribute_consuming_service_index = xml['AttributeConsumingServiceIndex']&.to_i
+        @attribute_consuming_service_index = xml["AttributeConsumingServiceIndex"]&.to_i
       end
       @attribute_consuming_service_index
     end
 
     # @return [true, false, nil]
     def force_authn?
-      if xml && !instance_variable_defined?(:@force_authn)
-        @force_authn = xml['ForceAuthn']&.== 'true'
-      end
+      @force_authn = xml["ForceAuthn"]&.== "true" if xml && !instance_variable_defined?(:@force_authn)
       @force_authn
     end
 
     # @return [true, false, nil]
     def passive?
-      if xml && !instance_variable_defined?(:@passive)
-        @passive = xml['IsPassive']&.== 'true'
-      end
+      @passive = xml["IsPassive"]&.== "true" if xml && !instance_variable_defined?(:@passive)
       @passive
     end
 
     # @return [String, nil]
     def protocol_binding
-      if xml && !instance_variable_defined?(:@protocol_binding)
-        @protocol_binding = xml['ProtocolBinding']
-      end
+      @protocol_binding = xml["ProtocolBinding"] if xml && !instance_variable_defined?(:@protocol_binding)
       @protocol_binding
     end
 
     # @return [Subject, nil]
     def subject
       if xml && !instance_variable_defined?(:@subject)
-        @subject = Subject.from_xml(xml.at_xpath('saml:Subject', Namespaces::ALL))
+        @subject = Subject.from_xml(xml.at_xpath("saml:Subject", Namespaces::ALL))
       end
       @subject
     end
 
     # (see Base#build)
     def build(builder)
-      builder['samlp'].AuthnRequest(
-          'xmlns:samlp' => Namespaces::SAMLP,
-          'xmlns:saml' => Namespaces::SAML
+      builder["samlp"].AuthnRequest(
+        "xmlns:samlp" => Namespaces::SAMLP,
+        "xmlns:saml" => Namespaces::SAML
       ) do |authn_request|
         super(authn_request)
 
-        authn_request.parent['AssertionConsumerServiceIndex'] = assertion_consumer_service_index if assertion_consumer_service_index
-        authn_request.parent['AssertionConsumerServiceURL'] = assertion_consumer_service_url if assertion_consumer_service_url
-        authn_request.parent['AttributeConsumingServiceIndex'] = attribute_consuming_service_index if attribute_consuming_service_index
-        authn_request.parent['ForceAuthn'] = force_authn? unless force_authn?.nil?
-        authn_request.parent['IsPassive'] = passive? unless passive?.nil?
-        authn_request.parent['ProtocolBinding'] = protocol_binding if protocol_binding
-
-        subject.build(authn_request) if subject
-        name_id_policy.build(authn_request) if name_id_policy
-        requested_authn_context.build(authn_request) if requested_authn_context
+        if assertion_consumer_service_index
+          authn_request.parent["AssertionConsumerServiceIndex"] =
+            assertion_consumer_service_index
+        end
+        if assertion_consumer_service_url
+          authn_request.parent["AssertionConsumerServiceURL"] =
+            assertion_consumer_service_url
+        end
+        if attribute_consuming_service_index
+          authn_request.parent["AttributeConsumingServiceIndex"] =
+            attribute_consuming_service_index
+        end
+        authn_request.parent["ForceAuthn"] = force_authn? unless force_authn?.nil?
+        authn_request.parent["IsPassive"] = passive? unless passive?.nil?
+        authn_request.parent["ProtocolBinding"] = protocol_binding if protocol_binding
+
+        subject&.build(authn_request)
+        name_id_policy&.build(authn_request)
+        requested_authn_context&.build(authn_request)
       end
     end
   end

data/lib/saml2/authn_statement.rb

@@ -1,20 +1,30 @@
 # frozen_string_literal: true
 
-require 'saml2/base'
+require "saml2/base"
 
 module SAML2
   class AuthnStatement < Base
     module Classes
-      INTERNET_PROTOCOL            = "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" # IP address
-      INTERNET_PROTOCOL_PASSWORD   = "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword" # IP address, as well as username/password
-      KERBEROS                     = "urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"
-      PASSWORD                     = "urn:oasis:names:tc:SAML:2.0:ac:classes:Password" # username/password, NOT over SSL
-      PASSWORD_PROTECTED_TRANSPORT = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" # username/password over SSL
-      PREVIOUS_SESSION             = "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession" # remember me
-      SMARTCARD                    = "urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard"
-      SMARTCARD_PKI                = "urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI" # smartcard with a private key on it
-      TLS_CLIENT                   = "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" # SSL client certificate
-      UNSPECIFIED                  = "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
+      INTERNET_PROTOCOL =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" # IP address
+      INTERNET_PROTOCOL_PASSWORD =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword" # IP address, as well as username/password
+      KERBEROS =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"
+      PASSWORD =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:Password" # username/password, NOT over SSL
+      PASSWORD_PROTECTED_TRANSPORT =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" # username/password over SSL
+      PREVIOUS_SESSION =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession" # remember me
+      SMARTCARD =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard"
+      SMARTCARD_PKI =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI" # smartcard with a private key on it
+      TLS_CLIENT =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" # SSL client certificate
+      UNSPECIFIED =
+        "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"
     end
 
     # @return [Time]
@@ -30,19 +40,20 @@ module SAML2
     # (see Base#from_xml)
     def from_xml(node)
       super
-      @authn_instant = Time.parse(node['AuthnInstant'])
-      @session_index = node['SessionIndex']
-      @session_not_on_or_after = Time.parse(node['SessionNotOnOrAfter']) if node['SessionNotOnOrAfter']
-      @authn_context_class_ref = node.at_xpath('saml:AuthnContext/saml:AuthnContextClassRef', Namespaces::ALL)&.content&.strip
+      @authn_instant = Time.parse(node["AuthnInstant"])
+      @session_index = node["SessionIndex"]
+      @session_not_on_or_after = Time.parse(node["SessionNotOnOrAfter"]) if node["SessionNotOnOrAfter"]
+      @authn_context_class_ref = node.at_xpath("saml:AuthnContext/saml:AuthnContextClassRef",
+                                               Namespaces::ALL)&.content&.strip
     end
 
     # (see Base#build)
     def build(builder)
-      builder['saml'].AuthnStatement('AuthnInstant' => authn_instant.iso8601) do |authn_statement|
-        authn_statement.parent['SessionIndex'] = session_index if session_index
-        authn_statement.parent['SessionNotOnOrAfter'] = session_not_on_or_after.iso8601 if session_not_on_or_after
-        authn_statement['saml'].AuthnContext do |authn_context|
-          authn_context['saml'].AuthnContextClassRef(authn_context_class_ref) if authn_context_class_ref
+      builder["saml"].AuthnStatement("AuthnInstant" => authn_instant.iso8601) do |authn_statement|
+        authn_statement.parent["SessionIndex"] = session_index if session_index
+        authn_statement.parent["SessionNotOnOrAfter"] = session_not_on_or_after.iso8601 if session_not_on_or_after
+        authn_statement["saml"].AuthnContext do |authn_context|
+          authn_context["saml"].AuthnContextClassRef(authn_context_class_ref) if authn_context_class_ref
         end
       end
     end

data/lib/saml2/base.rb

@@ -1,19 +1,61 @@
 # frozen_string_literal: true
 
-require 'saml2/namespaces'
+require "saml2/namespaces"
 
 module SAML2
   # @abstract
   class Base
-    # Create an appropriate object to represent the given XML element.
-    #
-    # @param node [Nokogiri::XML::Element, nil]
-    # @return [Base, nil]
-    def self.from_xml(node)
-      return nil unless node
-      result = new
-      result.from_xml(node)
-      result
+    class << self
+      def lookup_qname(qname, namespaces)
+        prefix, local_name = split_qname(qname)
+        [lookup_namespace(prefix, namespaces), local_name]
+      end
+
+      # Create an appropriate object to represent the given XML element.
+      #
+      # @param node [Nokogiri::XML::Element, nil]
+      # @return [Base, nil]
+      def from_xml(node)
+        return nil unless node
+
+        result = new
+        result.from_xml(node)
+        result
+      end
+
+      def load_string_array(node, element)
+        node.xpath(element, Namespaces::ALL).map do |element_node|
+          element_node.content&.strip
+        end
+      end
+
+      def load_object_array(node, element, klass = nil)
+        node.xpath(element, Namespaces::ALL).map do |element_node|
+          if klass.nil?
+            SAML2.const_get(element_node.name, false).from_xml(element_node)
+          elsif klass.is_a?(Hash)
+            klass[element_node.name].from_xml(element_node)
+          else
+            klass.from_xml(element_node)
+          end
+        end
+      end
+
+      private
+
+      def split_qname(qname)
+        if qname.include?(":")
+          qname.split(":", 2)
+        else
+          [nil, qname]
+        end
+      end
+
+      def lookup_namespace(prefix, namespaces)
+        return nil if namespaces.empty?
+
+        namespaces[prefix.empty? ? "xmlns" : "xmlns:#{prefix}"]
+      end
     end
 
     # @return [Nokogiri::XML::Element]
@@ -45,13 +87,15 @@ module SAML2
         if pretty
           xml.to_s
         else
-          xml.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML | Nokogiri::XML::Node::SaveOptions::NO_DECLARATION)
+          xml.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML |
+                                Nokogiri::XML::Node::SaveOptions::NO_DECLARATION)
         end
       elsif pretty
         to_xml.to_s
       else
         # make sure to not FORMAT it - it breaks signatures!
-        to_xml.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML | Nokogiri::XML::Node::SaveOptions::NO_DECLARATION)
+        to_xml.to_xml(save_with: Nokogiri::XML::Node::SaveOptions::AS_XML |
+                                 Nokogiri::XML::Node::SaveOptions::NO_DECLARATION)
       end
     end
 
@@ -62,7 +106,11 @@ module SAML2
     # not be created until their attribute is accessed.
     # @return [String]
     def inspect
-      "#<#{self.class.name} #{instance_variables.map { |iv| next if iv == :@xml; "#{iv}=#{instance_variable_get(iv).inspect}" }.compact.join(", ") }>"
+      "#<#{self.class.name} #{instance_variables.filter_map do |iv|
+                                next if iv == :@xml
+
+                                "#{iv}=#{instance_variable_get(iv).inspect}"
+                              end.join(", ")}>"
     end
 
     # Serialize this object to XML
@@ -84,8 +132,7 @@ module SAML2
     #
     # @param builder [Nokogiri::XML::Builder] The builder helper object to serialize to.
     # @return [void]
-    def build(builder)
-    end
+    def build(builder); end
 
     # Decrypt (in-place) encrypted portions of this object
     #
@@ -107,13 +154,14 @@ module SAML2
       encrypted_nodes.each do |node|
         this_nodes_keys = keys
         if keys.nil?
-          allowed_certs = node.xpath("dsig:KeyInfo/xenc:EncryptedKey/dsig:KeyInfo/dsig:X509Data", SAML2::Namespaces::ALL).map do |x509data|
+          allowed_certs = node.xpath("dsig:KeyInfo/xenc:EncryptedKey/dsig:KeyInfo/dsig:X509Data",
+                                     SAML2::Namespaces::ALL).map do |x509data|
             if (cert = x509data.at_xpath("dsig:X509Certificate", SAML2::Namespaces::ALL)&.content&.strip)
               OpenSSL::X509::Certificate.new(Base64.decode64(cert))
             elsif (issuer_serial = x509data.at_xpath("dsig:X509IssuerSerial", SAML2::Namespaces::ALL))
               {
-                  issuer: issuer_serial.at_xpath("dsig:X509IssuerName", SAML2::Namespaces::ALL).content.strip,
-                  serial: issuer_serial.at_xpath("dsig:X509SerialNumber", SAML2::Namespaces::ALL).content.strip.to_i,
+                issuer: issuer_serial.at_xpath("dsig:X509IssuerName", SAML2::Namespaces::ALL).content.strip,
+                serial: issuer_serial.at_xpath("dsig:X509SerialNumber", SAML2::Namespaces::ALL).content.strip.to_i
               }
             elsif (subject_name = x509data.at_xpath("dsig:X509SubjectName", SAML2::Namespaces::ALL)&.content&.strip)
               subject_name
@@ -126,42 +174,16 @@ module SAML2
 
         old_node = node.parent
         this_nodes_keys.each_with_index do |key, i|
-          begin
-            old_node.replace(node.decrypt_with(key: key))
-          rescue XMLSec::DecryptionError
-            # swallow errors on all but the last key
-            raise if i - 1 == this_nodes_keys.length
-          end
+          old_node.replace(node.decrypt_with(key: key))
+        rescue XMLSec::DecryptionError
+          # swallow errors on all but the last key
+          raise if i - 1 == this_nodes_keys.length
         end
       end
       !encrypted_nodes.empty?
     end
 
-    def self.load_string_array(node, element)
-      node.xpath(element, Namespaces::ALL).map do |element_node|
-        element_node.content&.strip
-      end
-    end
-
-
-    def self.load_object_array(node, element, klass = nil)
-      node.xpath(element, Namespaces::ALL).map do |element_node|
-        if klass.nil?
-          SAML2.const_get(element_node.name, false).from_xml(element_node)
-        elsif klass.is_a?(Hash)
-          klass[element_node.name].from_xml(element_node)
-        else
-          klass.from_xml(element_node)
-        end
-      end
-    end
-
-    def self.lookup_qname(qname, namespaces)
-      prefix, local_name = split_qname(qname)
-      [lookup_namespace(prefix, namespaces), local_name]
-    end
-
-    protected
+    private
 
     def load_string_array(node, element)
       self.class.load_string_array(node, element)
@@ -172,20 +194,7 @@ module SAML2
     end
 
     def encrypted_nodes
-      xml.xpath('//xenc:EncryptedData', Namespaces::ALL)
-    end
-
-    def self.split_qname(qname)
-      if qname.include?(':')
-        qname.split(':', 2)
-      else
-        [nil, qname]
-      end
-    end
-
-    def self.lookup_namespace(prefix, namespaces)
-      return nil if namespaces.empty?
-      namespaces[prefix.empty? ? 'xmlns' : "xmlns:#{prefix}"]
+      xml.xpath("//xenc:EncryptedData", Namespaces::ALL)
     end
   end
 end

data/lib/saml2/bindings/http_post.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require 'base64'
+require "base64"
 
 module SAML2
   module Bindings
-    module HTTP_POST
-      URN ="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
+    module HTTP_POST # rubocop:disable Naming/ClassAndModuleCamelCase
+      URN = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
 
       class << self
         # Decode and parse a Base64 encoded SAML message.
@@ -16,7 +16,7 @@ module SAML2
         # @return [[Message, String]]
         #   The Message and the RelayState.
         def decode(post_params)
-          base64 = post_params['SAMLRequest'] || post_params['SAMLResponse']
+          base64 = post_params["SAMLRequest"] || post_params["SAMLResponse"]
           raise MissingMessage unless base64
 
           raise MessageTooLarge if base64.bytesize > SAML2.config[:max_message_size]
@@ -28,7 +28,7 @@ module SAML2
           end
 
           message = Message.parse(xml)
-          [message, post_params['RelayState']]
+          [message, post_params["RelayState"]]
         end
 
         # Encode a SAML message into Base64 POST params.
@@ -40,9 +40,9 @@ module SAML2
         #   +SAMLResponse+ chosen appropriately.
         def encode(message, relay_state: nil)
           xml = message.to_s(pretty: false)
-          key = message.is_a?(Request) ? 'SAMLRequest' : 'SAMLResponse'
+          key = message.is_a?(Request) ? "SAMLRequest" : "SAMLResponse"
           post_params = { key => Base64.encode64(xml) }
-          post_params['RelayState'] = relay_state if relay_state
+          post_params["RelayState"] = relay_state if relay_state
           post_params
         end
       end

data/lib/saml2/bindings/http_redirect.rb

@@ -1,16 +1,16 @@
 # frozen_string_literal: true
 
-require 'base64'
-require 'uri'
-require 'zlib'
+require "base64"
+require "uri"
+require "zlib"
 
-require 'saml2/bindings'
-require 'saml2/message'
+require "saml2/bindings"
+require "saml2/message"
 
 module SAML2
   module Bindings
     module HTTPRedirect
-      URN ="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
+      URN = "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
 
       module SigAlgs
         DSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#dsa-sha1"
@@ -51,18 +51,19 @@ module SAML2
           end
 
           raise MissingMessage unless uri.query
+
           query = URI.decode_www_form(uri.query)
-          base64 = query.assoc('SAMLRequest')&.last
+          base64 = query.assoc("SAMLRequest")&.last
           if base64
-            message_param = 'SAMLRequest'
+            message_param = "SAMLRequest"
           else
-            base64 = query.assoc('SAMLResponse')&.last
-            message_param = 'SAMLResponse'
+            base64 = query.assoc("SAMLResponse")&.last
+            message_param = "SAMLResponse"
           end
-          encoding = query.assoc('SAMLEncoding')&.last
-          relay_state = query.assoc('RelayState')&.last
-          signature = query.assoc('Signature')&.last
-          sig_alg = query.assoc('SigAlg')&.last
+          encoding = query.assoc("SAMLEncoding")&.last
+          relay_state = query.assoc("RelayState")&.last
+          signature = query.assoc("Signature")&.last
+          sig_alg = query.assoc("SigAlg")&.last
           raise MissingMessage unless base64
 
           raise UnsupportedEncoding if encoding && encoding != Encodings::DEFLATE
@@ -76,7 +77,7 @@ module SAML2
           end
 
           zstream = Zlib::Inflate.new(-Zlib::MAX_WBITS)
-          xml = String.new
+          xml = +""
           begin
             # do it in 1K slices, so we can protect against bombs
             (0..deflated.bytesize / 1024).each do |i|
@@ -106,19 +107,19 @@ module SAML2
             end
 
             base_string = find_raw_query_param(uri.query, message_param)
-            base_string << '&' << find_raw_query_param(uri.query, 'RelayState') if relay_state
-            base_string << '&' << find_raw_query_param(uri.query, 'SigAlg')
+            base_string << "&" << find_raw_query_param(uri.query, "RelayState") if relay_state
+            base_string << "&" << find_raw_query_param(uri.query, "SigAlg")
 
             valid_signature = false
             # there could be multiple certificates to try
             Array(public_key).each do |key|
-              hash = (sig_alg == SigAlgs::RSA_SHA256 ? OpenSSL::Digest::SHA256 : OpenSSL::Digest::SHA1)
-              if key.verify(hash.new, signature, base_string)
-                # notify the caller which certificate was used
-                public_key_used&.call(key)
-                valid_signature = true
-                break
-              end
+              hash = ((sig_alg == SigAlgs::RSA_SHA256) ? OpenSSL::Digest::SHA256 : OpenSSL::Digest::SHA1)
+              next unless key.verify(hash.new, signature, base_string)
+
+              # notify the caller which certificate was used
+              public_key_used&.call(key)
+              valid_signature = true
+              break
             end
             raise InvalidSignature unless valid_signature
           end
@@ -145,8 +146,8 @@ module SAML2
           original_query = URI.decode_www_form(result.query) if result.query
           original_query ||= []
           # remove any SAML protocol parameters
-          %w{SAMLEncoding SAMLRequest SAMLResponse RelayState SigAlg Signature}.each do |param|
-            original_query.delete_if { |(k, v)| k == param }
+          %w[SAMLEncoding SAMLRequest SAMLResponse RelayState SigAlg Signature].each do |param|
+            original_query.delete_if { |(k, _v)| k == param }
           end
 
           xml = message.to_s(pretty: false)
@@ -156,16 +157,19 @@ module SAML2
           base64 = Base64.strict_encode64(deflated)
 
           query = []
-          query << [message.is_a?(Request) ? 'SAMLRequest' : 'SAMLResponse', base64]
-          query << ['RelayState', relay_state] if relay_state
+          query << [message.is_a?(Request) ? "SAMLRequest" : "SAMLResponse", base64]
+          query << ["RelayState", relay_state] if relay_state
           if private_key
-            raise ArgumentError, "Unsupported signature algorithm #{sig_alg}" unless SigAlgs::RECOGNIZED.include?(sig_alg)
+            unless SigAlgs::RECOGNIZED.include?(sig_alg)
+              raise ArgumentError,
+                    "Unsupported signature algorithm #{sig_alg}"
+            end
 
-            query << ['SigAlg', sig_alg]
+            query << ["SigAlg", sig_alg]
             base_string = URI.encode_www_form(query)
-            hash = (sig_alg == SigAlgs::RSA_SHA256 ? OpenSSL::Digest::SHA256 : OpenSSL::Digest::SHA1)
+            hash = ((sig_alg == SigAlgs::RSA_SHA256) ? OpenSSL::Digest::SHA256 : OpenSSL::Digest::SHA1)
             signature = private_key.sign(hash.new, base_string)
-            query << ['Signature', Base64.strict_encode64(signature)]
+            query << ["Signature", Base64.strict_encode64(signature)]
           end
 
           result.query = URI.encode_www_form(original_query + query)
@@ -177,7 +181,7 @@ module SAML2
         # we need to find the param, and return it still encoded from the URL
         def find_raw_query_param(query, param)
           start = query.index(param)
-          finish = (query.index('&', start + param.length + 1) || 0) - 1
+          finish = (query.index("&", start + param.length + 1) || 0) - 1
           query[start..finish]
         end
       end

data/lib/saml2/bindings.rb

@@ -3,7 +3,7 @@
 module SAML2
   module Bindings
     module Encodings
-      DEFLATE = 'urn:oasis:names:tc:SAML:2.0:bindings:URL-Encoding:DEFLATE'
+      DEFLATE = "urn:oasis:names:tc:SAML:2.0:bindings:URL-Encoding:DEFLATE"
     end
   end
 end