saml2 3.2.2 → 3.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 61db895758d50550a2065ede88a04faf606a2a8c60afe5d972f57849afc69a40
-  data.tar.gz: cbae23b344c5ea0ab74ec8373f773bb3050e72457adbf9b6bde6dce03c932090
+  metadata.gz: 05f37a8ab729b5a78b6b76c430ae6613d5852613b45980721510e60925b39872
+  data.tar.gz: 1e1ea950995d3deefa465c0fdb2c45c796327bf739633ec2e9b1d977931ee116
 SHA512:
-  metadata.gz: 4c343f2707bae3df452174b4e10eccf46703e8d0be7ac5275e7d73947f5f3703c88f7c180d48cc13d6aa5a97d24e4216220ce6ff69c6d787ebd0af2a61eb105c
-  data.tar.gz: c2ac30a2360fb13c0e2cdb41dcd29e1fc0921605f56ec46e3f2c2e3d18f011025f77899860b230d6f4205b534b4903a8c26109689b2b5e9784a1e86844a6f3eb
+  metadata.gz: 3f3f9d16794991653ebd7c779e5f325b4d0f48a94d90d08f225b82329ec448f09fb495a0028ab3b3b13bb7d9a797fc0c8a4ec0df8630822527e632303d54f408
+  data.tar.gz: 4e025a411a4dea50efa1377c3e2b09c1aa34f52db3ddb1e1e146041835dd392e9945e831751cc1f0b749c19e3c792af630d7b27dcbaaea3fe5544d8c15be4ccd

data/lib/saml2/bindings/http_redirect.rb

@@ -131,7 +131,7 @@ module SAML2
         # @param message [Message]
         #   Note that the base URI is taken from {Message#destination}.
         # @param relay_state optional [String]
-        # @param private_key optional [OpenSSL::PKey::RSA]
+        # @param private_key optional [OpenSSL::PKey::RSA, String]
         #   A key to use to sign the encoded message.
         # @param sig_alg optional [String]
         #   The signing algorithm to use. Defaults to RSA-SHA1, as it's the
@@ -164,6 +164,7 @@ module SAML2
               raise ArgumentError,
                     "Unsupported signature algorithm #{sig_alg}"
             end
+            private_key = OpenSSL::PKey.read(private_key) if private_key.is_a?(String)
 
             query << ["SigAlg", sig_alg]
             base_string = URI.encode_www_form(query)

data/lib/saml2/response.rb

@@ -158,17 +158,17 @@ module SAML2
         response_signed = true
       end
 
-      assertion = assertions.first
+      signed_assertions = []
+      assertions.each do |assertion|
+        next unless assertion.signed?
 
-      # this might be nil, if the assertion was encrypted
-      if assertion&.signed?
         unless (signature_errors = assertion.validate_signature(key: keys,
                                                                 fingerprint: idp.fingerprints,
                                                                 cert: certificates)).empty?
           return errors.concat(signature_errors)
         end
 
-        assertion_signed = true
+        signed_assertions << assertion.xml
       end
 
       find_decryption_key = lambda do |embedded_certificates|
@@ -213,46 +213,45 @@ module SAML2
         return errors
       end
 
-      assertion ||= assertions.first
-      unless assertion
+      if assertions.empty?
         errors << "no assertion found"
         return errors
       end
 
-      # if we didn't previously check the assertion's signature (because it was encrypted)
-      # check it now
-      if assertion.signed? && !assertion_signed
-        unless (signature_errors = assertion.validate_signature(fingerprint: idp.fingerprints,
-                                                                cert: certificates)).empty?
-          return errors.concat(signature_errors)
+      assertions.each do |assertion|
+        assertion_signed = signed_assertions.include?(assertion.xml)
+        # if we didn't previously check the assertion's signature (because it was encrypted)
+        # check it now
+        if !response_signed && !assertion_signed
+          unless assertion.signed?
+            errors << "neither response nor assertion were signed"
+            return errors
+          end
+          unless (signature_errors = assertion.validate_signature(fingerprint: idp.fingerprints,
+                                                                  cert: certificates)).empty?
+            return errors.concat(signature_errors)
+          end
         end
 
-        assertion_signed = true
-      end
-
-      # only do our own issue instant validation if the assertion
-      # doesn't mandate any
-      if !assertion.conditions&.not_on_or_after && (assertion.issue_instant + (5 * 60) < verification_time ||
-           assertion.issue_instant - (5 * 60) > verification_time)
-        errors << "assertion not recently issued"
-        return errors
-      end
+        # only do our own issue instant validation if the assertion
+        # doesn't mandate any
+        if !assertion.conditions&.not_on_or_after && (assertion.issue_instant + (5 * 60) < verification_time ||
+            assertion.issue_instant - (5 * 60) > verification_time)
+          errors << "assertion not recently issued"
+          return errors
+        end
 
-      if assertion.conditions &&
-         !(condition_errors = assertion.conditions.validate(
-           verification_time:,
-           audience: service_provider.entity_id,
-           ignore_audience_condition:
-         )).empty?
-        return errors.concat(condition_errors)
-      end
+        if assertion.conditions &&
+           !(condition_errors = assertion.conditions.validate(
+             verification_time:,
+             audience: service_provider.entity_id,
+             ignore_audience_condition:
+           )).empty?
+          return errors.concat(condition_errors)
+        end
 
-      if !response_signed && !assertion_signed
-        errors << "neither response nor assertion were signed"
-        return errors
-      end
+        next if sp.private_keys.empty?
 
-      unless sp.private_keys.empty?
         begin
           decypted_anything = assertion.decrypt(&find_decryption_key)
         rescue XMLSec::DecryptionError

data/lib/saml2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SAML2
-  VERSION = "3.2.2"
+  VERSION = "3.2.4"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: saml2
 version: !ruby/object:Gem::Version
-  version: 3.2.2
+  version: 3.2.4
 platform: ruby
 authors:
 - Cody Cutrer
 bindir: exe
 cert_chain: []
-date: 2025-07-10 00:00:00.000000000 Z
+date: 2025-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -158,7 +158,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.3
 specification_version: 4
 summary: SAML 2.0 Library
 test_files: []