saml2 3.2.3 → 3.2.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0cc92864a26047c46a21c7294ece5009a8df5edbcc79694167b5dfe569a63530
-  data.tar.gz: c411ec995c1a0a02454821e0f1ea8e0ace5ee0488f0db6394f39ffc3376c5c7e
+  metadata.gz: 05f37a8ab729b5a78b6b76c430ae6613d5852613b45980721510e60925b39872
+  data.tar.gz: 1e1ea950995d3deefa465c0fdb2c45c796327bf739633ec2e9b1d977931ee116
 SHA512:
-  metadata.gz: 04770f4380d3cde93e2169e58923b051e2e70ed08e77c45b000d03ce7d398a28aa958f7e5ca109863a13f8fba1b0724e6679e6a82231509e5931e832890128d5
-  data.tar.gz: 6a80a9275d319b7bf14fa3fd356500cf5a6d14df94263509a3f1a590d77870dff24eed65584991c0da68012576150eb8d1712c736e1742f12fa8ef0037d304f0
+  metadata.gz: 3f3f9d16794991653ebd7c779e5f325b4d0f48a94d90d08f225b82329ec448f09fb495a0028ab3b3b13bb7d9a797fc0c8a4ec0df8630822527e632303d54f408
+  data.tar.gz: 4e025a411a4dea50efa1377c3e2b09c1aa34f52db3ddb1e1e146041835dd392e9945e831751cc1f0b749c19e3c792af630d7b27dcbaaea3fe5544d8c15be4ccd

data/lib/saml2/response.rb

@@ -158,17 +158,17 @@ module SAML2
         response_signed = true
       end
 
-      assertion = assertions.first
+      signed_assertions = []
+      assertions.each do |assertion|
+        next unless assertion.signed?
 
-      # this might be nil, if the assertion was encrypted
-      if assertion&.signed?
         unless (signature_errors = assertion.validate_signature(key: keys,
                                                                 fingerprint: idp.fingerprints,
                                                                 cert: certificates)).empty?
           return errors.concat(signature_errors)
         end
 
-        assertion_signed = true
+        signed_assertions << assertion.xml
       end
 
       find_decryption_key = lambda do |embedded_certificates|
@@ -213,46 +213,45 @@ module SAML2
         return errors
       end
 
-      assertion ||= assertions.first
-      unless assertion
+      if assertions.empty?
         errors << "no assertion found"
         return errors
       end
 
-      # if we didn't previously check the assertion's signature (because it was encrypted)
-      # check it now
-      if assertion.signed? && !assertion_signed
-        unless (signature_errors = assertion.validate_signature(fingerprint: idp.fingerprints,
-                                                                cert: certificates)).empty?
-          return errors.concat(signature_errors)
+      assertions.each do |assertion|
+        assertion_signed = signed_assertions.include?(assertion.xml)
+        # if we didn't previously check the assertion's signature (because it was encrypted)
+        # check it now
+        if !response_signed && !assertion_signed
+          unless assertion.signed?
+            errors << "neither response nor assertion were signed"
+            return errors
+          end
+          unless (signature_errors = assertion.validate_signature(fingerprint: idp.fingerprints,
+                                                                  cert: certificates)).empty?
+            return errors.concat(signature_errors)
+          end
         end
 
-        assertion_signed = true
-      end
-
-      # only do our own issue instant validation if the assertion
-      # doesn't mandate any
-      if !assertion.conditions&.not_on_or_after && (assertion.issue_instant + (5 * 60) < verification_time ||
-           assertion.issue_instant - (5 * 60) > verification_time)
-        errors << "assertion not recently issued"
-        return errors
-      end
+        # only do our own issue instant validation if the assertion
+        # doesn't mandate any
+        if !assertion.conditions&.not_on_or_after && (assertion.issue_instant + (5 * 60) < verification_time ||
+            assertion.issue_instant - (5 * 60) > verification_time)
+          errors << "assertion not recently issued"
+          return errors
+        end
 
-      if assertion.conditions &&
-         !(condition_errors = assertion.conditions.validate(
-           verification_time:,
-           audience: service_provider.entity_id,
-           ignore_audience_condition:
-         )).empty?
-        return errors.concat(condition_errors)
-      end
+        if assertion.conditions &&
+           !(condition_errors = assertion.conditions.validate(
+             verification_time:,
+             audience: service_provider.entity_id,
+             ignore_audience_condition:
+           )).empty?
+          return errors.concat(condition_errors)
+        end
 
-      if !response_signed && !assertion_signed
-        errors << "neither response nor assertion were signed"
-        return errors
-      end
+        next if sp.private_keys.empty?
 
-      unless sp.private_keys.empty?
         begin
           decypted_anything = assertion.decrypt(&find_decryption_key)
         rescue XMLSec::DecryptionError

data/lib/saml2/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SAML2
-  VERSION = "3.2.3"
+  VERSION = "3.2.4"
 end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: saml2
 version: !ruby/object:Gem::Version
-  version: 3.2.3
+  version: 3.2.4
 platform: ruby
 authors:
 - Cody Cutrer
 bindir: exe
 cert_chain: []
-date: 2025-07-16 00:00:00.000000000 Z
+date: 2025-10-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -158,7 +158,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.6.3
 specification_version: 4
 summary: SAML 2.0 Library
 test_files: []