saml_idp 0.0.1

data/lib/saml_idp/name_id_formatter.rb

@@ -0,0 +1,68 @@
+module SamlIdp
+  class NameIdFormatter
+    attr_accessor :list
+    def initialize(list)
+      self.list = (list || {})
+    end
+
+    def all
+      if split?
+        one_one.map { |key_val| build("1.1", key_val)[:name] } +
+        two_zero.map { |key_val| build("2.0", key_val)[:name] }
+      else
+        list.map { |key_val| build("2.0", key_val)[:name] }
+      end
+    end
+
+    def chosen
+      if split?
+        version, choose = "1.1", one_one.first
+        version, choose = "2.0", two_zero.first unless choose
+        version, choose = "2.0", "persistent" unless choose
+        build(version, choose)
+      else
+        choose = list.first || "persistent"
+        build("2.0", choose)
+      end
+    end
+
+    def build(version, key_val)
+      key_val = Array(key_val)
+      name = key_val.first.to_s.underscore
+      getter = build_getter key_val.last || name
+      {
+        name: "urn:oasis:names:tc:SAML:#{version}:nameid-format:#{name.camelize(:lower)}",
+        getter: getter
+      }
+    end
+    private :build
+
+    def build_getter(getter_val)
+      if getter_val.respond_to?(:call)
+        getter_val
+      else
+        ->(p) { p.public_send getter_val.to_s }
+      end
+    end
+    private :build_getter
+
+    def split?
+      list.is_a?(Hash) && (list.key?("2.0") || list.key?("1.1"))
+    end
+    private :split?
+
+    def one_one
+      list["1.1"] || {}
+    rescue TypeError
+      {}
+    end
+    private :one_one
+
+    def two_zero
+      list["2.0"] || {}
+    rescue TypeError
+      {}
+    end
+    private :two_zero
+  end
+end

data/lib/saml_idp/persisted_metadata.rb

@@ -0,0 +1,10 @@
+require 'saml_idp/attributeable'
+module SamlIdp
+  class PersistedMetadata
+    include Attributeable
+
+    def sign_assertions?
+      !!attributes[:sign_assertions]
+    end
+  end
+end

data/lib/saml_idp/request.rb

@@ -0,0 +1,79 @@
+require 'saml_idp/xml_security'
+require 'saml_idp/service_provider'
+module SamlIdp
+  class Request
+    def self.from_deflated_request(raw)
+      zstream  = Zlib::Inflate.new(-Zlib::MAX_WBITS)
+      inflated = zstream.inflate(Base64.decode64(raw)).tap do
+        zstream.finish
+        zstream.close
+      end
+      new(inflated)
+    end
+
+    attr_accessor :raw_xml
+
+    delegate :config, to: :SamlIdp
+    private :config
+    delegate :xpath, to: :document
+    private :xpath
+
+    def initialize(raw_xml = "")
+      self.raw_xml = raw_xml
+    end
+
+    def request_id
+      authn_request["ID"]
+    end
+
+    def acs_url
+      authn_request["AssertionConsumerServiceURL"]
+    end
+
+    def valid_signature?
+      service_provider.valid_signature? document
+    end
+
+    def service_provider?
+      service_provider.valid?
+    end
+
+    def service_provider
+      @service_provider ||= ServiceProvider.new((service_provider_finder[issuer] || {}).merge(identifier: issuer))
+    end
+
+    def issuer
+      xpath("//saml:Issuer", saml: assertion).first.try :content
+    end
+
+    def document
+      @document ||= Saml::XML::Document.parse(raw_xml)
+    end
+    private :document
+
+    def authn_request
+      xpath("//samlp:AuthnRequest", samlp: samlp).first
+    end
+    private :authn_request
+
+    def samlp
+      Saml::XML::Namespaces::PROTOCOL
+    end
+    private :samlp
+
+    def assertion
+      Saml::XML::Namespaces::ASSERTION
+    end
+    private :assertion
+
+    def signature_namespace
+      Saml::XML::Namespaces::SIGNATURE
+    end
+    private :signature_namespace
+
+    def service_provider_finder
+      config.service_provider.finder
+    end
+    private :service_provider_finder
+  end
+end

data/lib/saml_idp/response_builder.rb

@@ -0,0 +1,60 @@
+require 'builder'
+module SamlIdp
+  class ResponseBuilder
+    attr_accessor :response_id
+    attr_accessor :issuer_uri
+    attr_accessor :saml_acs_url
+    attr_accessor :saml_request_id
+    attr_accessor :assertion_and_signature
+
+    def initialize(response_id, issuer_uri, saml_acs_url, saml_request_id, assertion_and_signature)
+      self.response_id = response_id
+      self.issuer_uri = issuer_uri
+      self.saml_acs_url = saml_acs_url
+      self.saml_request_id = saml_request_id
+      self.assertion_and_signature = assertion_and_signature
+    end
+
+    def encoded
+      @encoded ||= encode
+    end
+
+    def raw
+      build
+    end
+
+    def encode
+      Base64.encode64(raw)
+    end
+    private :encode
+
+    def build
+      builder = Builder::XmlMarkup.new
+      builder.tag! "samlp:Response",
+        ID: response_id_string,
+        Version: "2.0",
+        IssueInstant: now_iso,
+        Destination: saml_acs_url,
+        Consent: Saml::XML::Namespaces::Consents::UNSPECIFIED,
+        InResponseTo: saml_request_id,
+        "xmlns:samlp" => Saml::XML::Namespaces::PROTOCOL do |response|
+          response.Issuer issuer_uri, xmlns: Saml::XML::Namespaces::ASSERTION
+          response.tag! "samlp:Status" do |status|
+            status.tag! "samlp:StatusCode", Value: Saml::XML::Namespaces::Statuses::SUCCESS
+          end
+          response << assertion_and_signature
+        end
+    end
+    private :build
+
+    def response_id_string
+      "_#{response_id}"
+    end
+    private :response_id_string
+
+    def now_iso
+      Time.now.utc.iso8601
+    end
+    private :now_iso
+  end
+end

data/lib/saml_idp/saml_response.rb

@@ -0,0 +1,63 @@
+require 'saml_idp/assertion_builder'
+require 'saml_idp/response_builder'
+module SamlIdp
+  class SamlResponse
+    attr_accessor :assertion_with_signature
+    attr_accessor :reference_id
+    attr_accessor :response_id
+    attr_accessor :issuer_uri
+    attr_accessor :principal
+    attr_accessor :audience_uri
+    attr_accessor :saml_request_id
+    attr_accessor :saml_acs_url
+    attr_accessor :algorithm
+    attr_accessor :secret_key
+    attr_accessor :x509_certificate
+
+    def initialize(reference_id,
+          response_id,
+          issuer_uri,
+          principal,
+          audience_uri,
+          saml_request_id,
+          saml_acs_url,
+          algorithm
+          )
+      self.reference_id = reference_id
+      self.response_id = response_id
+      self.issuer_uri = issuer_uri
+      self.principal = principal
+      self.audience_uri = audience_uri
+      self.saml_request_id = saml_request_id
+      self.saml_acs_url = saml_acs_url
+      self.algorithm = algorithm
+      self.secret_key = secret_key
+      self.x509_certificate = x509_certificate
+    end
+
+    def build
+      @built ||= response_builder.encoded
+    end
+
+    def signed_assertion
+      assertion_builder.signed
+    end
+    private
+
+    def response_builder
+      ResponseBuilder.new(response_id, issuer_uri, saml_acs_url, saml_request_id, signed_assertion)
+    end
+    private :response_builder
+
+    def assertion_builder
+      @assertion_builder ||= AssertionBuilder.new reference_id,
+        issuer_uri,
+        principal,
+        audience_uri,
+        saml_request_id,
+        saml_acs_url,
+        algorithm
+    end
+    private :assertion_builder
+  end
+end

data/lib/saml_idp/service_provider.rb

@@ -0,0 +1,68 @@
+require 'httparty'
+require 'saml_idp/attributeable'
+require 'saml_idp/incoming_metadata'
+require 'saml_idp/persisted_metadata'
+module SamlIdp
+  class ServiceProvider
+    include Attributeable
+    attribute :identifier
+    attribute :fingerprint
+    attribute :metadata_url
+
+    delegate :config, to: :SamlIdp
+
+    def valid?
+      attributes.present?
+    end
+
+    def valid_signature?(doc)
+      !should_validate_signature? ||
+        doc.valid_signature?(fingerprint)
+    end
+
+    def should_validate_signature?
+      current_metadata.respond_to?(:sign_assertions?) && current_metadata.sign_assertions?
+    end
+
+    def refresh_metadata
+      fresh = fresh_incoming_metadata
+      if valid_signature?(fresh.document)
+        metadata_persister[identifier, fresh]
+        @current_metadata = nil
+        fresh
+      end
+    end
+
+    def current_metadata
+      @current_metadata ||= get_current_or_build
+    end
+
+    def get_current_or_build
+      persisted = metadata_getter[identifier, self]
+      if persisted.is_a? Hash
+        PersistedMetadata.new(persisted)
+      end
+    end
+    private :get_current_or_build
+
+    def metadata_getter
+      config.service_provider.persisted_metadata_getter
+    end
+    private :metadata_getter
+
+    def metadata_persister
+      config.service_provider.metadata_persister
+    end
+    private :metadata_persister
+
+    def fresh_incoming_metadata
+      IncomingMetadata.new request_metadata
+    end
+    private :fresh_incoming_metadata
+
+    def request_metadata
+      metadata_url.present? ? HTTParty.get(metadata_url).body : ""
+    end
+    private :request_metadata
+  end
+end

data/lib/saml_idp/signable.rb

@@ -0,0 +1,131 @@
+# Requires methods:
+#   * reference_id
+#   * raw
+#   * digest
+#   * algorithm
+require 'saml_idp/signed_info_builder'
+require 'saml_idp/signature_builder'
+module SamlIdp
+  module Signable
+    def self.included(base)
+      base.extend ClassMethods
+      base.send :attr_accessor, :reference_id
+    end
+
+    def signed
+      generated_reference_id do
+        with_signature do
+          send(self.class.raw_method)
+        end
+      end
+    end
+
+    def sign(el)
+      el << signature if sign?
+    end
+
+    def generated_reference_id
+      if reference_id
+        fin = yield reference_id if block_given?
+      else
+        self.reference_id = ref = reference_id_generator.call
+        fin = yield reference_id if block_given?
+        self.reference_id = nil
+      end
+      block_given? ? fin : ref
+    end
+    private :generated_reference_id
+
+    def reference_id_generator
+      SamlIdp.config.reference_id_generator
+    end
+    private :reference_id_generator
+
+    def with_signature
+      original = @sign
+      @sign = true
+      yield.tap do
+        @sign = original
+      end
+    end
+    private :with_signature
+
+    def without_signature
+      original = @sign
+      @sign = false
+      yield.tap do
+        @sign = original
+      end
+    end
+    private :without_signature
+
+    def sign?
+      !!@sign
+    end
+    private :sign?
+
+    def signature
+      SignatureBuilder.new(signed_info_builder).raw
+    end
+    private :signature
+
+    def signed_info_builder
+      SignedInfoBuilder.new(get_reference_id, get_digest, get_algorithm)
+    end
+    private :signed_info_builder
+
+    def get_reference_id
+      send(self.class.reference_id_method)
+    end
+    private :get_reference_id
+
+    def get_digest
+      without_signature do
+        send(self.class.digest_method)
+      end
+    end
+    private :get_digest
+
+    def get_algorithm
+      send(self.class.algorithm_method)
+    end
+    private :get_algorithm
+
+    def get_raw
+      send(self.class.raw_method)
+    end
+    private :get_raw
+
+    def noko_raw
+      Nokogiri::XML::Document.parse(get_raw)
+    end
+    private :noko_raw
+
+    def digest
+      # Make it check for inclusive at some point (https://github.com/onelogin/ruby-saml/blob/master/lib/xml_security.rb#L159)
+      inclusive_namespaces = []
+      # Also make customizable
+      canon_algorithm = Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0
+      canon_hashed_element = noko_raw.canonicalize(canon_algorithm, inclusive_namespaces)
+      digest_algorithm = get_algorithm
+
+      hash                          = digest_algorithm.digest(canon_hashed_element)
+      Base64.encode64(hash).gsub(/\n/, '')
+    end
+    private :digest
+
+    module ClassMethods
+      def self.module_method(name, default = nil)
+        default ||= name
+        define_method "#{name}_method" do |new_method_name = nil|
+          instance_variable_set("@#{name}", new_method_name) if new_method_name
+          instance_variable_get("@#{name}") || default
+        end
+      end
+      module_method :raw
+      module_method :digest
+      module_method :algorithm
+      module_method :reference_id
+    end
+  end
+end